lib/krb5/test_fx.c

   1 /*
   2  * Copyright (c) 2009 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of KTH nor the names of its contributors may be
  18  *    used to endorse or promote products derived from this software without
  19  *    specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY
  22  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  24  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE
  25  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  26  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  27  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  28  * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
  29  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
  30  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  31  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */
  32
  33 #include "krb5_locl.h"
  34 #include <err.h>
  35 #include <getarg.h>
  36
  37 struct {
  38     char *p1;
  39     char *pepper1;
  40     krb5_enctype e1;
  41     char *p2;
  42     char *pepper2;
  43     krb5_enctype e2;
  44     krb5_enctype e3;
  45     char *key;
  46     size_t len;
  47 } cf2[] = {
  48     {
  49         "key1", "a", ETYPE_AES128_CTS_HMAC_SHA1_96,
  50         "key2", "b", ETYPE_AES128_CTS_HMAC_SHA1_96,
  51         ETYPE_AES128_CTS_HMAC_SHA1_96,
  52         "\x97\xdf\x97\xe4\xb7\x98\xb2\x9e\xb3\x1e\xd7\x28\x02\x87\xa9\x2a",
  53         16
  54     },
  55     {
  56         "key1", "a", ETYPE_AES256_CTS_HMAC_SHA1_96,
  57         "key2", "b", ETYPE_AES256_CTS_HMAC_SHA1_96,
  58         ETYPE_AES256_CTS_HMAC_SHA1_96,
  59         "\x4d\x6c\xa4\xe6\x29\x78\x5c\x1f\x01\xba\xf5\x5e\x2e\x54\x85\x66"
  60         "\xb9\x61\x7a\xe3\xa9\x68\x68\xc3\x37\xcb\x93\xb5\xe7\x2b\x1c\x7b",
  61         32
  62     },
  63     {
  64         "key1", "a", ETYPE_AES128_CTS_HMAC_SHA1_96,
  65         "key2", "b", ETYPE_AES128_CTS_HMAC_SHA1_96,
  66         ETYPE_AES256_CTS_HMAC_SHA1_96,
  67         "\x97\xdf\x97\xe4\xb7\x98\xb2\x9e\xb3\x1e\xd7\x28\x2\x87\xa9\x2a"
  68         "\x1\x96\xfa\xf2\x44\xf8\x11\x20\xc2\x1c\x51\x17\xb3\xe6\xeb\x98",
  69         32
  70     },
  71     {
  72         "key1", "a", ETYPE_AES256_CTS_HMAC_SHA1_96,
  73         "key2", "b", ETYPE_AES256_CTS_HMAC_SHA1_96,
  74         ETYPE_AES128_CTS_HMAC_SHA1_96,
  75         "\x4d\x6c\xa4\xe6\x29\x78\x5c\x1f\x01\xba\xf5\x5e\x2e\x54\x85\x66",
  76         16
  77     },
  78     {
  79         "key1", "a", ETYPE_AES128_CTS_HMAC_SHA1_96,
  80         "key2", "b", ETYPE_AES256_CTS_HMAC_SHA1_96,
  81         ETYPE_AES256_CTS_HMAC_SHA1_96,
  82         "\x88\xbd\xb2\xa9\xf\x3e\x52\x5a\xb0\x5f\x68\xc5\x43\x9a\x4d\x5e"
  83         "\x9c\x2b\xfd\x2b\x02\x24\xde\x39\xb5\x82\xf4\xbb\x05\xfe\x2\x2e",
  84         32
  85     },
  86     {
  87         "key1", "a", ETYPE_ARCFOUR_HMAC_MD5,
  88         "key2", "b", ETYPE_ARCFOUR_HMAC_MD5,
  89         ETYPE_ARCFOUR_HMAC_MD5,
  90         "\x24\xd7\xf6\xb6\xba\xe4\xe5\xc0\x0d\x20\x82\xc5\xeb\xab\x36\x72",
  91         16
  92     },
  93     /* We don't yet have a PRF for 1DES in Heimdal */
  94     {
  95         "key1", "a", ETYPE_DES_CBC_CRC,
  96         "key2", "b", ETYPE_DES_CBC_CRC,
  97         ETYPE_DES_CBC_CRC,
  98         "\x43\xba\xe3\x73\x8c\x94\x67\xe6",
  99         8
 100     },
 101     {
 102         "key1", "a", ETYPE_DES3_CBC_SHA1,
 103         "key2", "b", ETYPE_DES3_CBC_SHA1,
 104         ETYPE_DES3_CBC_SHA1,
 105         "\xe5\x8f\x9e\xb6\x43\x86\x2c\x13\xad\x38\xe5\x29\x31\x34\x62\xa7"
 106         "\xf7\x3e\x62\x83\x4f\xe5\x4a\x01",
 107         24
 108     },
 109 };
 110
 111
 112 static void
 113 test_cf2(krb5_context context)
 114 {
 115     krb5_error_code ret;
 116     krb5_data pw, p1, p2;
 117     krb5_salt salt;
 118     krb5_keyblock k1, k2, k3;
 119     krb5_crypto c1, c2;
 120     unsigned int i;
 121     unsigned int errors = 0;
 122
 123     ret = krb5_allow_weak_crypto(context, 1);
 124     if (ret)
 125         krb5_err(context, 1, ret, "krb5_allow_weak_crypto");
 126
 127     for (i = 0; i < sizeof(cf2)/sizeof(cf2[0]); i++) {
 128         pw.data = cf2[i].p1;
 129         pw.length = strlen(cf2[i].p1);
 130         salt.salttype = (krb5_salttype)KRB5_PADATA_PW_SALT;
 131         salt.saltvalue.data = cf2[i].p1;
 132         salt.saltvalue.length = strlen(cf2[i].p1);
 133
 134         ret = krb5_string_to_key_data_salt(context,
 135                                            cf2[i].e1,
 136                                            pw,
 137                                            salt,
 138                                            &k1);
 139         if (ret)
 140             krb5_err(context, 1, ret, "krb5_string_to_key_data_salt");
 141
 142         ret = krb5_crypto_init(context, &k1, 0, &c1);
 143         if (ret)
 144             krb5_err(context, 1, ret, "krb5_crypto_init");
 145
 146         pw.data = cf2[i].p2;
 147         pw.length = strlen(cf2[i].p2);
 148         salt.saltvalue.data = cf2[i].p2;
 149         salt.saltvalue.length = strlen(cf2[i].p2);
 150
 151         ret = krb5_string_to_key_data_salt(context,
 152                                            cf2[i].e2,
 153                                            pw,
 154                                            salt,
 155                                            &k2);
 156         if (ret)
 157             krb5_err(context, 1, ret, "krb5_string_to_key_data_salt");
 158
 159         ret = krb5_crypto_init(context, &k2, 0, &c2);
 160         if (ret)
 161             krb5_err(context, 1, ret, "krb5_crypto_init");
 162
 163
 164         p1.data = cf2[i].pepper1;
 165         p1.length = strlen(cf2[i].pepper1);
 166
 167         p2.data = cf2[i].pepper2;
 168         p2.length = strlen(cf2[i].pepper2);
 169
 170         ret = krb5_crypto_fx_cf2(context, c1, c2, &p1, &p2, cf2[i].e3, &k3);
 171         if (ret == KRB5_PROG_ETYPE_NOSUPP) {
 172             krb5_warn(context, ret, "KRB-FX-CF2 not supported for enctype %d",
 173                       cf2[i].e1);
 174             continue;
 175         } else if (ret) {
 176             krb5_err(context, 1, ret, "krb5_crypto_fx_cf2");
 177         }
 178
 179         if (k3.keytype != cf2[i].e3) {
 180             errors++;
 181             krb5_warnx(context, "length not right for enctype %d", cf2[i].e3);
 182             continue;
 183         }
 184         if (k3.keyvalue.length != cf2[i].len ||
 185             memcmp(k3.keyvalue.data, cf2[i].key, cf2[i].len) != 0) {
 186             errors++;
 187             krb5_warnx(context, "key not same for enctypes %d %d %d",
 188                        cf2[i].e1, cf2[i].e2, cf2[i].e3);
 189             continue;
 190         }
 191
 192         krb5_crypto_destroy(context, c1);
 193         krb5_crypto_destroy(context, c2);
 194
 195         krb5_free_keyblock_contents(context, &k1);
 196         krb5_free_keyblock_contents(context, &k2);
 197         krb5_free_keyblock_contents(context, &k3);
 198     }
 199
 200     if (errors)
 201         krb5_errx(context, 1, "%u KRB-FX-CF2 vectors failed", errors);
 202 }
 203
 204 static int version_flag = 0;
 205 static int help_flag    = 0;
 206
 207 static struct getargs args[] = {
 208     {"version", 0,      arg_flag,       &version_flag,
 209      "print version", NULL },
 210     {"help",    0,      arg_flag,       &help_flag,
 211      NULL, NULL }
 212 };
 213
 214 static void
 215 usage (int ret)
 216 {
 217     arg_printusage (args,
 218                     sizeof(args)/sizeof(*args),
 219                     NULL,
 220                     "");
 221     exit (ret);
 222 }
 223
 224 int
 225 main(int argc, char **argv)
 226 {
 227     krb5_context context;
 228     krb5_error_code ret;
 229     int optidx = 0;
 230
 231     setprogname(argv[0]);
 232
 233     if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
 234         usage(1);
 235
 236     if (help_flag)
 237         usage (0);
 238
 239     if(version_flag){
 240         print_version(NULL);
 241         exit(0);
 242     }
 243
 244     ret = krb5_init_context(&context);
 245     if (ret)
 246         errx (1, "krb5_init_context failed: %d", ret);
 247
 248     test_cf2(context);
 249
 250     krb5_free_context(context);
 251
 252     return 0;
 253 }