src/common/crypto_s2k.c

   1 /* Copyright (c) 2001, Matej Pfajfar.
   2  * Copyright (c) 2001-2004, Roger Dingledine.
   3  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
   4  * Copyright (c) 2007-2015, The Tor Project, Inc. */
   5 /* See LICENSE for licensing information */
   6
   7 #define CRYPTO_S2K_PRIVATE
   8
   9 #include "crypto.h"
  10 #include "util.h"
  11 #include "compat.h"
  12 #include "crypto_s2k.h"
  13
  14 #include <openssl/evp.h>
  15
  16 #ifdef HAVE_LIBSCRYPT_H
  17 #define HAVE_SCRYPT
  18 #include <libscrypt.h>
  19 #endif
  20
  21 /* Encoded secrets take the form:
  22
  23      u8 type;
  24      u8 salt_and_parameters[depends on type];
  25      u8 key[depends on type];
  26
  27    As a special case, if the encoded secret is exactly 29 bytes long,
  28    type 0 is understood.
  29
  30    Recognized types are:
  31        00 -- RFC2440. salt_and_parameters is 9 bytes. key is 20 bytes.
  32                 salt_and_parameters is 8 bytes random salt,
  33                 1 byte iteration info.
  34        01 -- PKBDF2_SHA1. salt_and_parameters is 17 bytes. key is 20 bytes.
  35                 salt_and_parameters is 16 bytes random salt,
  36                 1 byte iteration info.
  37        02 -- SCRYPT_SALSA208_SHA256. salt_and_parameters is 18 bytes. key is
  38              32 bytes.
  39                 salt_and_parameters is 18 bytes random salt, 2 bytes iteration
  40                 info.
  41 */
  42
  43 #define S2K_TYPE_RFC2440 0
  44 #define S2K_TYPE_PBKDF2  1
  45 #define S2K_TYPE_SCRYPT  2
  46
  47 #define PBKDF2_SPEC_LEN 17
  48 #define PBKDF2_KEY_LEN 20
  49
  50 #define SCRYPT_SPEC_LEN 18
  51 #define SCRYPT_KEY_LEN 32
  52
  53 /** Given an algorithm ID (one of S2K_TYPE_*), return the length of the
  54  * specifier part of it, without the prefix type byte. */
  55 static int
  56 secret_to_key_spec_len(uint8_t type)
  57 {
  58   switch (type) {
  59     case S2K_TYPE_RFC2440:
  60       return S2K_RFC2440_SPECIFIER_LEN;
  61     case S2K_TYPE_PBKDF2:
  62       return PBKDF2_SPEC_LEN;
  63     case S2K_TYPE_SCRYPT:
  64       return SCRYPT_SPEC_LEN;
  65     default:
  66       return -1;
  67   }
  68 }
  69
  70 /** Given an algorithm ID (one of S2K_TYPE_*), return the length of the
  71  * its preferred output. */
  72 static int
  73 secret_to_key_key_len(uint8_t type)
  74 {
  75   switch (type) {
  76     case S2K_TYPE_RFC2440:
  77       return DIGEST_LEN;
  78     case S2K_TYPE_PBKDF2:
  79       return DIGEST_LEN;
  80     case S2K_TYPE_SCRYPT:
  81       return DIGEST256_LEN;
  82     default:
  83       return -1;
  84   }
  85 }
  86
  87 /** Given a specifier in <b>spec_and_key</b> of length
  88  * <b>spec_and_key_len</b>, along with its prefix algorithm ID byte, and along
  89  * with a key if <b>key_included</b> is true, check whether the whole
  90  * specifier-and-key is of valid length, and return the algorithm type if it
  91  * is.  Set *<b>legacy_out</b> to 1 iff this is a legacy password hash or
  92  * legacy specifier.  Return an error code on failure.
  93  */
  94 static int
  95 secret_to_key_get_type(const uint8_t *spec_and_key, size_t spec_and_key_len,
  96                        int key_included, int *legacy_out)
  97 {
  98   size_t legacy_len = S2K_RFC2440_SPECIFIER_LEN;
  99   uint8_t type;
 100   int total_len;
 101
 102   if (key_included)
 103     legacy_len += DIGEST_LEN;
 104
 105   if (spec_and_key_len == legacy_len) {
 106     *legacy_out = 1;
 107     return S2K_TYPE_RFC2440;
 108   }
 109
 110   *legacy_out = 0;
 111   if (spec_and_key_len == 0)
 112     return S2K_BAD_LEN;
 113
 114   type = spec_and_key[0];
 115   total_len = secret_to_key_spec_len(type);
 116   if (total_len < 0)
 117     return S2K_BAD_ALGORITHM;
 118   if (key_included) {
 119     int keylen = secret_to_key_key_len(type);
 120     if (keylen < 0)
 121       return S2K_BAD_ALGORITHM;
 122     total_len += keylen;
 123   }
 124
 125   if ((size_t)total_len + 1 == spec_and_key_len)
 126     return type;
 127   else
 128     return S2K_BAD_LEN;
 129 }
 130
 131 /**
 132  * Write a new random s2k specifier of type <b>type</b>, without prefixing
 133  * type byte, to <b>spec_out</b>, which must have enough room.  May adjust
 134  * parameter choice based on <b>flags</b>.
 135  */
 136 static int
 137 make_specifier(uint8_t *spec_out, uint8_t type, unsigned flags)
 138 {
 139   int speclen = secret_to_key_spec_len(type);
 140   if (speclen < 0)
 141       return S2K_BAD_ALGORITHM;
 142
 143   crypto_rand((char*)spec_out, speclen);
 144   switch (type) {
 145     case S2K_TYPE_RFC2440:
 146       /* Hash 64 k of data. */
 147       spec_out[S2K_RFC2440_SPECIFIER_LEN-1] = 96;
 148       break;
 149     case S2K_TYPE_PBKDF2:
 150       /* 131 K iterations */
 151       spec_out[PBKDF2_SPEC_LEN-1] = 17;
 152       break;
 153     case S2K_TYPE_SCRYPT:
 154       if (flags & S2K_FLAG_LOW_MEM) {
 155         /* N = 1<<12 */
 156         spec_out[SCRYPT_SPEC_LEN-2] = 12;
 157       } else {
 158         /* N = 1<<15 */
 159         spec_out[SCRYPT_SPEC_LEN-2] = 15;
 160       }
 161       /* r = 8; p = 2. */
 162       spec_out[SCRYPT_SPEC_LEN-1] = (3u << 4) | (1u << 0);
 163       break;
 164     default:
 165       tor_fragile_assert();
 166       return S2K_BAD_ALGORITHM;
 167   }
 168
 169   return speclen;
 170 }
 171
 172 /** Implement RFC2440-style iterated-salted S2K conversion: convert the
 173  * <b>secret_len</b>-byte <b>secret</b> into a <b>key_out_len</b> byte
 174  * <b>key_out</b>.  As in RFC2440, the first 8 bytes of s2k_specifier
 175  * are a salt; the 9th byte describes how much iteration to do.
 176  * If <b>key_out_len</b> &gt; DIGEST_LEN, use HDKF to expand the result.
 177  */
 178 void
 179 secret_to_key_rfc2440(char *key_out, size_t key_out_len, const char *secret,
 180               size_t secret_len, const char *s2k_specifier)
 181 {
 182   crypto_digest_t *d;
 183   uint8_t c;
 184   size_t count, tmplen;
 185   char *tmp;
 186   uint8_t buf[DIGEST_LEN];
 187   tor_assert(key_out_len < SIZE_T_CEILING);
 188
 189 #define EXPBIAS 6
 190   c = s2k_specifier[8];
 191   count = ((uint32_t)16 + (c & 15)) << ((c >> 4) + EXPBIAS);
 192 #undef EXPBIAS
 193
 194   d = crypto_digest_new();
 195   tmplen = 8+secret_len;
 196   tmp = tor_malloc(tmplen);
 197   memcpy(tmp,s2k_specifier,8);
 198   memcpy(tmp+8,secret,secret_len);
 199   secret_len += 8;
 200   while (count) {
 201     if (count >= secret_len) {
 202       crypto_digest_add_bytes(d, tmp, secret_len);
 203       count -= secret_len;
 204     } else {
 205       crypto_digest_add_bytes(d, tmp, count);
 206       count = 0;
 207     }
 208   }
 209   crypto_digest_get_digest(d, (char*)buf, sizeof(buf));
 210
 211   if (key_out_len <= sizeof(buf)) {
 212     memcpy(key_out, buf, key_out_len);
 213   } else {
 214     crypto_expand_key_material_rfc5869_sha256(buf, DIGEST_LEN,
 215                                            (const uint8_t*)s2k_specifier, 8,
 216                                            (const uint8_t*)"EXPAND", 6,
 217                                            (uint8_t*)key_out, key_out_len);
 218   }
 219   memwipe(tmp, 0, tmplen);
 220   memwipe(buf, 0, sizeof(buf));
 221   tor_free(tmp);
 222   crypto_digest_free(d);
 223 }
 224
 225 /**
 226  * Helper: given a valid specifier without prefix type byte in <b>spec</b>,
 227  * whose length must be correct, and given a secret passphrase <b>secret</b>
 228  * of length <b>secret_len</b>, compute the key and store it into
 229  * <b>key_out</b>, which must have enough room for secret_to_key_key_len(type)
 230  * bytes.  Return the number of bytes written on success and an error code
 231  * on failure.
 232  */
 233 STATIC int
 234 secret_to_key_compute_key(uint8_t *key_out, size_t key_out_len,
 235                           const uint8_t *spec, size_t spec_len,
 236                           const char *secret, size_t secret_len,
 237                           int type)
 238 {
 239   int rv;
 240   if (key_out_len > INT_MAX)
 241     return S2K_BAD_LEN;
 242
 243   switch (type) {
 244     case S2K_TYPE_RFC2440:
 245       secret_to_key_rfc2440((char*)key_out, key_out_len, secret, secret_len,
 246                             (const char*)spec);
 247       return (int)key_out_len;
 248
 249     case S2K_TYPE_PBKDF2: {
 250       uint8_t log_iters;
 251       if (spec_len < 1 || secret_len > INT_MAX || spec_len > INT_MAX)
 252         return S2K_BAD_LEN;
 253       log_iters = spec[spec_len-1];
 254       if (log_iters > 31)
 255         return S2K_BAD_PARAMS;
 256       rv = PKCS5_PBKDF2_HMAC_SHA1(secret, (int)secret_len,
 257                                   spec, (int)spec_len-1,
 258                                   (1<<log_iters),
 259                                   (int)key_out_len, key_out);
 260       if (rv < 0)
 261         return S2K_FAILED;
 262       return (int)key_out_len;
 263     }
 264
 265     case S2K_TYPE_SCRYPT: {
 266 #ifdef HAVE_SCRYPT
 267       uint8_t log_N, log_r, log_p;
 268       uint64_t N;
 269       uint32_t r, p;
 270       if (spec_len < 2)
 271         return S2K_BAD_LEN;
 272       log_N = spec[spec_len-2];
 273       log_r = (spec[spec_len-1]) >> 4;
 274       log_p = (spec[spec_len-1]) & 15;
 275       if (log_N > 63)
 276         return S2K_BAD_PARAMS;
 277       N = ((uint64_t)1) << log_N;
 278       r = 1u << log_r;
 279       p = 1u << log_p;
 280       rv = libscrypt_scrypt((const uint8_t*)secret, secret_len,
 281                             spec, spec_len-2, N, r, p, key_out, key_out_len);
 282       if (rv != 0)
 283         return S2K_FAILED;
 284       return (int)key_out_len;
 285 #else
 286       return S2K_NO_SCRYPT_SUPPORT;
 287 #endif
 288     }
 289     default:
 290       return S2K_BAD_ALGORITHM;
 291   }
 292 }
 293
 294 /**
 295  * Given a specifier previously constructed with secret_to_key_make_specifier
 296  * in <b>spec</b> of length <b>spec_len</b>, and a secret password in
 297  * <b>secret</b> of length <b>secret_len</b>, generate <b>key_out_len</b>
 298  * bytes of cryptographic material in <b>key_out</b>.  The native output of
 299  * the secret-to-key function will be truncated if key_out_len is short, and
 300  * expanded with HKDF if key_out_len is long.  Returns S2K_OKAY on success,
 301  * and an error code on failure.
 302  */
 303 int
 304 secret_to_key_derivekey(uint8_t *key_out, size_t key_out_len,
 305                         const uint8_t *spec, size_t spec_len,
 306                         const char *secret, size_t secret_len)
 307 {
 308   int legacy_format = 0;
 309   int type = secret_to_key_get_type(spec, spec_len, 0, &legacy_format);
 310   int r;
 311
 312   if (type < 0)
 313     return type;
 314 #ifndef HAVE_SCRYPT
 315   if (type == S2K_TYPE_SCRYPT)
 316     return S2K_NO_SCRYPT_SUPPORT;
 317  #endif
 318
 319   if (! legacy_format) {
 320     ++spec;
 321     --spec_len;
 322   }
 323
 324   r = secret_to_key_compute_key(key_out, key_out_len, spec, spec_len,
 325                                 secret, secret_len, type);
 326   if (r < 0)
 327     return r;
 328   else
 329     return S2K_OKAY;
 330 }
 331
 332 /**
 333  * Construct a new s2k algorithm specifier and salt in <b>buf</b>, according
 334  * to the bitwise-or of some S2K_FLAG_* options in <b>flags</b>.  Up to
 335  * <b>buf_len</b> bytes of storage may be used in <b>buf</b>.  Return the
 336  * number of bytes used on success and an error code on failure.
 337  */
 338 int
 339 secret_to_key_make_specifier(uint8_t *buf, size_t buf_len, unsigned flags)
 340 {
 341   int rv;
 342   int spec_len;
 343 #ifdef HAVE_SCRYPT
 344   uint8_t type = S2K_TYPE_SCRYPT;
 345 #else
 346   uint8_t type = S2K_TYPE_RFC2440;
 347 #endif
 348
 349   if (flags & S2K_FLAG_NO_SCRYPT)
 350     type = S2K_TYPE_RFC2440;
 351   if (flags & S2K_FLAG_USE_PBKDF2)
 352     type = S2K_TYPE_PBKDF2;
 353
 354   spec_len = secret_to_key_spec_len(type);
 355
 356   if ((int)buf_len < spec_len + 1)
 357     return S2K_TRUNCATED;
 358
 359   buf[0] = type;
 360   rv = make_specifier(buf+1, type, flags);
 361   if (rv < 0)
 362     return rv;
 363   else
 364     return rv + 1;
 365 }
 366
 367 /**
 368  * Hash a passphrase from <b>secret</b> of length <b>secret_len</b>, according
 369  * to the bitwise-or of some S2K_FLAG_* options in <b>flags</b>, and store the
 370  * hash along with salt and hashing parameters into <b>buf</b>.  Up to
 371  * <b>buf_len</b> bytes of storage may be used in <b>buf</b>.  Set
 372  * *<b>len_out</b> to the number of bytes used and return S2K_OKAY on success;
 373  * and return an error code on failure.
 374  */
 375 int
 376 secret_to_key_new(uint8_t *buf,
 377                   size_t buf_len,
 378                   size_t *len_out,
 379                   const char *secret, size_t secret_len,
 380                   unsigned flags)
 381 {
 382   int key_len;
 383   int spec_len;
 384   int type;
 385   int rv;
 386
 387   spec_len = secret_to_key_make_specifier(buf, buf_len, flags);
 388
 389   if (spec_len < 0)
 390     return spec_len;
 391
 392   type = buf[0];
 393   key_len = secret_to_key_key_len(type);
 394
 395   if (key_len < 0)
 396     return key_len;
 397
 398   if ((int)buf_len < key_len + spec_len)
 399     return S2K_TRUNCATED;
 400
 401   rv = secret_to_key_compute_key(buf + spec_len, key_len,
 402                                  buf + 1, spec_len-1,
 403                                  secret, secret_len, type);
 404   if (rv < 0)
 405     return rv;
 406
 407   *len_out = spec_len + key_len;
 408
 409   return S2K_OKAY;
 410 }
 411
 412 /**
 413  * Given a hashed passphrase in <b>spec_and_key</b> of length
 414  * <b>spec_and_key_len</b> as generated by secret_to_key_new(), verify whether
 415  * it is a hash of the passphrase <b>secret</b> of length <b>secret_len</b>.
 416  * Return S2K_OKAY on a match, S2K_BAD_SECRET on a well-formed hash that
 417  * doesn't match this secret, and another error code on other errors.
 418  */
 419 int
 420 secret_to_key_check(const uint8_t *spec_and_key, size_t spec_and_key_len,
 421                     const char *secret, size_t secret_len)
 422 {
 423   int is_legacy = 0;
 424   int type = secret_to_key_get_type(spec_and_key, spec_and_key_len,
 425                                     1, &is_legacy);
 426   uint8_t buf[32];
 427   int spec_len;
 428   int key_len;
 429   int rv;
 430
 431   if (type < 0)
 432     return type;
 433
 434   if (! is_legacy) {
 435     spec_and_key++;
 436     spec_and_key_len--;
 437   }
 438
 439   spec_len = secret_to_key_spec_len(type);
 440   key_len = secret_to_key_key_len(type);
 441   tor_assert(spec_len > 0);
 442   tor_assert(key_len > 0);
 443   tor_assert(key_len <= (int) sizeof(buf));
 444   tor_assert((int)spec_and_key_len == spec_len + key_len);
 445   rv = secret_to_key_compute_key(buf, key_len,
 446                                  spec_and_key, spec_len,
 447                                  secret, secret_len, type);
 448   if (rv < 0)
 449     goto done;
 450
 451   if (tor_memeq(buf, spec_and_key + spec_len, key_len))
 452     rv = S2K_OKAY;
 453   else
 454     rv = S2K_BAD_SECRET;
 455
 456  done:
 457   memwipe(buf, 0, sizeof(buf));
 458   return rv;
 459 }
 460