=================================================================== RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/cipher.c,v retrieving revision 1.37.2.5 retrieving revision 1.37.2.6 diff -u -r1.37.2.5 -r1.37.2.6 --- src/usr.bin/ssh/cipher.c 2001/09/27 00:15:41 1.37.2.5 +++ src/usr.bin/ssh/cipher.c 2002/03/08 17:04:42 1.37.2.6 @@ -35,389 +35,62 @@ */ #include "includes.h" -RCSID("$OpenBSD: cipher.c,v 1.37.2.5 2001/09/27 00:15:41 miod Exp $"); +RCSID("$OpenBSD: cipher.c,v 1.37.2.6 2002/03/08 17:04:42 brad Exp $"); #include "xmalloc.h" #include "log.h" #include "cipher.h" +#define EVP_CIPHER_CTX_get_app_data(e) ((e)->app_data) + #include +#include "rijndael.h" -/* no encryption */ -static void -none_setkey(CipherContext *cc, const u_char *key, u_int keylen) -{ -} -static void -none_setiv(CipherContext *cc, const u_char *iv, u_int ivlen) -{ -} -static void -none_crypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) -{ - memcpy(dest, src, len); -} +static EVP_CIPHER *evp_ssh1_3des(void); +static EVP_CIPHER *evp_ssh1_bf(void); +static EVP_CIPHER *evp_rijndael(void); -/* DES */ -static void -des_ssh1_setkey(CipherContext *cc, const u_char *key, u_int keylen) -{ - static int dowarn = 1; - if (dowarn) { - error("Warning: use of DES is strongly discouraged " - "due to cryptographic weaknesses"); - dowarn = 0; - } - des_set_key((void *)key, cc->u.des.key); -} -static void -des_ssh1_setiv(CipherContext *cc, const u_char *iv, u_int ivlen) -{ - memset(cc->u.des.iv, 0, sizeof(cc->u.des.iv)); -} -static void -des_ssh1_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) -{ - des_ncbc_encrypt(src, dest, len, cc->u.des.key, &cc->u.des.iv, - DES_ENCRYPT); -} -static void -des_ssh1_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) -{ - des_ncbc_encrypt(src, dest, len, cc->u.des.key, &cc->u.des.iv, - DES_DECRYPT); -} +struct Cipher { + char *name; + int number; /* for ssh1 only */ + u_int block_size; + u_int key_len; + EVP_CIPHER *(*evptype)(void); +} ciphers[] = { + { "none", SSH_CIPHER_NONE, 8, 0, EVP_enc_null }, + { "des", SSH_CIPHER_DES, 8, 8, EVP_des_cbc }, + { "3des", SSH_CIPHER_3DES, 8, 16, evp_ssh1_3des }, + { "blowfish", SSH_CIPHER_BLOWFISH, 8, 32, evp_ssh1_bf }, -/* 3DES */ -static void -des3_setkey(CipherContext *cc, const u_char *key, u_int keylen) -{ - des_set_key((void *) key, cc->u.des3.key1); - des_set_key((void *) (key+8), cc->u.des3.key2); - des_set_key((void *) (key+16), cc->u.des3.key3); -} -static void -des3_setiv(CipherContext *cc, const u_char *iv, u_int ivlen) -{ - memset(cc->u.des3.iv1, 0, sizeof(cc->u.des3.iv1)); - memset(cc->u.des3.iv2, 0, sizeof(cc->u.des3.iv2)); - memset(cc->u.des3.iv3, 0, sizeof(cc->u.des3.iv3)); - if (iv == NULL) - return; - memcpy(cc->u.des3.iv3, (char *)iv, 8); -} -static void -des3_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) -{ - des_ede3_cbc_encrypt(src, dest, len, - cc->u.des3.key1, cc->u.des3.key2, cc->u.des3.key3, - &cc->u.des3.iv3, DES_ENCRYPT); -} -static void -des3_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) -{ - des_ede3_cbc_encrypt(src, dest, len, - cc->u.des3.key1, cc->u.des3.key2, cc->u.des3.key3, - &cc->u.des3.iv3, DES_DECRYPT); -} + { "3des-cbc", SSH_CIPHER_SSH2, 8, 24, EVP_des_ede3_cbc }, + { "blowfish-cbc", SSH_CIPHER_SSH2, 8, 16, EVP_bf_cbc }, + { "cast128-cbc", SSH_CIPHER_SSH2, 8, 16, EVP_cast5_cbc }, + { "arcfour", SSH_CIPHER_SSH2, 8, 16, EVP_rc4 }, + { "aes128-cbc", SSH_CIPHER_SSH2, 16, 16, evp_rijndael }, + { "aes192-cbc", SSH_CIPHER_SSH2, 16, 24, evp_rijndael }, + { "aes256-cbc", SSH_CIPHER_SSH2, 16, 32, evp_rijndael }, -/* - * This is used by SSH1: - * - * What kind of triple DES are these 2 routines? - * - * Why is there a redundant initialization vector? - * - * If only iv3 was used, then, this would till effect have been - * outer-cbc. However, there is also a private iv1 == iv2 which - * perhaps makes differential analysis easier. On the other hand, the - * private iv1 probably makes the CRC-32 attack ineffective. This is a - * result of that there is no longer any known iv1 to use when - * choosing the X block. - */ -static void -des3_ssh1_setkey(CipherContext *cc, const u_char *key, u_int keylen) -{ - des_set_key((void *) key, cc->u.des3.key1); - des_set_key((void *) (key+8), cc->u.des3.key2); - if (keylen <= 16) - des_set_key((void *) key, cc->u.des3.key3); - else - des_set_key((void *) (key+16), cc->u.des3.key3); -} -static void -des3_ssh1_encrypt(CipherContext *cc, u_char *dest, const u_char *src, - u_int len) -{ - des_ncbc_encrypt(src, dest, len, cc->u.des3.key1, &cc->u.des3.iv1, - DES_ENCRYPT); - des_ncbc_encrypt(dest, dest, len, cc->u.des3.key2, &cc->u.des3.iv2, - DES_DECRYPT); - des_ncbc_encrypt(dest, dest, len, cc->u.des3.key3, &cc->u.des3.iv3, - DES_ENCRYPT); -} -static void -des3_ssh1_decrypt(CipherContext *cc, u_char *dest, const u_char *src, - u_int len) -{ - des_ncbc_encrypt(src, dest, len, cc->u.des3.key3, &cc->u.des3.iv3, - DES_DECRYPT); - des_ncbc_encrypt(dest, dest, len, cc->u.des3.key2, &cc->u.des3.iv2, - DES_ENCRYPT); - des_ncbc_encrypt(dest, dest, len, cc->u.des3.key1, &cc->u.des3.iv1, - DES_DECRYPT); -} + { NULL, SSH_CIPHER_ILLEGAL, 0, 0, NULL } +}; -/* Blowfish */ -static void -blowfish_setkey(CipherContext *cc, const u_char *key, u_int keylen) -{ - BF_set_key(&cc->u.bf.key, keylen, (u_char *)key); -} -static void -blowfish_setiv(CipherContext *cc, const u_char *iv, u_int ivlen) -{ - if (iv == NULL) - memset(cc->u.bf.iv, 0, 8); - else - memcpy(cc->u.bf.iv, (char *)iv, 8); -} -static void -blowfish_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src, - u_int len) -{ - BF_cbc_encrypt((void *)src, dest, len, &cc->u.bf.key, cc->u.bf.iv, - BF_ENCRYPT); -} -static void -blowfish_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src, - u_int len) -{ - BF_cbc_encrypt((void *)src, dest, len, &cc->u.bf.key, cc->u.bf.iv, - BF_DECRYPT); -} +/*--*/ -/* - * SSH1 uses a variation on Blowfish, all bytes must be swapped before - * and after encryption/decryption. Thus the swap_bytes stuff (yuk). - */ -static void -swap_bytes(const u_char *src, u_char *dst, int n) +u_int +cipher_blocksize(Cipher *c) { - char c[4]; - - /* Process 4 bytes every lap. */ - for (n = n / 4; n > 0; n--) { - c[3] = *src++; - c[2] = *src++; - c[1] = *src++; - c[0] = *src++; - - *dst++ = c[0]; - *dst++ = c[1]; - *dst++ = c[2]; - *dst++ = c[3]; - } + return (c->block_size); } - -static void -blowfish_ssh1_encrypt(CipherContext *cc, u_char *dest, const u_char *src, - u_int len) +u_int +cipher_keylen(Cipher *c) { - swap_bytes(src, dest, len); - BF_cbc_encrypt((void *)dest, dest, len, &cc->u.bf.key, cc->u.bf.iv, - BF_ENCRYPT); - swap_bytes(dest, dest, len); + return (c->key_len); } -static void -blowfish_ssh1_decrypt(CipherContext *cc, u_char *dest, const u_char *src, - u_int len) -{ - swap_bytes(src, dest, len); - BF_cbc_encrypt((void *)dest, dest, len, &cc->u.bf.key, cc->u.bf.iv, - BF_DECRYPT); - swap_bytes(dest, dest, len); -} -/* alleged rc4 */ -static void -arcfour_setkey(CipherContext *cc, const u_char *key, u_int keylen) -{ - RC4_set_key(&cc->u.rc4, keylen, (u_char *)key); -} -static void -arcfour_crypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) -{ - RC4(&cc->u.rc4, len, (u_char *)src, dest); -} - -/* CAST */ -static void -cast_setkey(CipherContext *cc, const u_char *key, u_int keylen) -{ - CAST_set_key(&cc->u.cast.key, keylen, (u_char *) key); -} -static void -cast_setiv(CipherContext *cc, const u_char *iv, u_int ivlen) -{ - if (iv == NULL) - fatal("no IV for %s.", cc->cipher->name); - memcpy(cc->u.cast.iv, (char *)iv, 8); -} -static void -cast_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) -{ - CAST_cbc_encrypt(src, dest, len, &cc->u.cast.key, cc->u.cast.iv, - CAST_ENCRYPT); -} -static void -cast_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) -{ - CAST_cbc_encrypt(src, dest, len, &cc->u.cast.key, cc->u.cast.iv, - CAST_DECRYPT); -} - -/* RIJNDAEL */ - -#define RIJNDAEL_BLOCKSIZE 16 -static void -rijndael_setkey(CipherContext *cc, const u_char *key, u_int keylen) -{ - rijndael_set_key(&cc->u.rijndael.enc, (char *)key, 8*keylen, 1); - rijndael_set_key(&cc->u.rijndael.dec, (char *)key, 8*keylen, 0); -} -static void -rijndael_setiv(CipherContext *cc, const u_char *iv, u_int ivlen) -{ - if (iv == NULL || ivlen != RIJNDAEL_BLOCKSIZE) - fatal("bad/no IV for %s.", cc->cipher->name); - memcpy(cc->u.rijndael.iv, iv, RIJNDAEL_BLOCKSIZE); -} -static void -rijndael_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src, - u_int len) -{ - rijndael_ctx *ctx = &cc->u.rijndael.enc; - u_char *iv = cc->u.rijndael.iv; - u_char in[RIJNDAEL_BLOCKSIZE]; - u_char *cprev, *cnow, *plain; - int i, j, blocks = len / RIJNDAEL_BLOCKSIZE; - - if (len == 0) - return; - if (len % RIJNDAEL_BLOCKSIZE) - fatal("rijndael_cbc_encrypt: bad len %d", len); - cnow = dest; - plain = (u_char *) src; - cprev = iv; - for (i = 0; i < blocks; i++, plain+=RIJNDAEL_BLOCKSIZE, - cnow+=RIJNDAEL_BLOCKSIZE) { - for (j = 0; j < RIJNDAEL_BLOCKSIZE; j++) - in[j] = plain[j] ^ cprev[j]; - rijndael_encrypt(ctx, in, cnow); - cprev = cnow; - } - memcpy(iv, cprev, RIJNDAEL_BLOCKSIZE); -} -static void -rijndael_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src, - u_int len) -{ - rijndael_ctx *ctx = &cc->u.rijndael.dec; - u_char *iv = cc->u.rijndael.iv; - u_char ivsaved[RIJNDAEL_BLOCKSIZE]; - u_char *cnow = (u_char *) (src+len-RIJNDAEL_BLOCKSIZE); - u_char *plain = dest+len-RIJNDAEL_BLOCKSIZE; - u_char *ivp; - int i, j, blocks = len / RIJNDAEL_BLOCKSIZE; - - if (len == 0) - return; - if (len % RIJNDAEL_BLOCKSIZE) - fatal("rijndael_cbc_decrypt: bad len %d", len); - memcpy(ivsaved, cnow, RIJNDAEL_BLOCKSIZE); - for (i = blocks; i > 0; i--, cnow-=RIJNDAEL_BLOCKSIZE, - plain-=RIJNDAEL_BLOCKSIZE) { - rijndael_decrypt(ctx, cnow, plain); - ivp = (i == 1) ? iv : cnow-RIJNDAEL_BLOCKSIZE; - for (j = 0; j < RIJNDAEL_BLOCKSIZE; j++) - plain[j] ^= ivp[j]; - } - memcpy(iv, ivsaved, RIJNDAEL_BLOCKSIZE); -} - -Cipher ciphers[] = { - { "none", - SSH_CIPHER_NONE, 8, 0, - none_setkey, none_setiv, - none_crypt, none_crypt }, - { "des", - SSH_CIPHER_DES, 8, 8, - des_ssh1_setkey, des_ssh1_setiv, - des_ssh1_encrypt, des_ssh1_decrypt }, - { "3des", - SSH_CIPHER_3DES, 8, 16, - des3_ssh1_setkey, des3_setiv, - des3_ssh1_encrypt, des3_ssh1_decrypt }, - { "blowfish", - SSH_CIPHER_BLOWFISH, 8, 16, - blowfish_setkey, blowfish_setiv, - blowfish_ssh1_encrypt, blowfish_ssh1_decrypt }, - - { "3des-cbc", - SSH_CIPHER_SSH2, 8, 24, - des3_setkey, des3_setiv, - des3_cbc_encrypt, des3_cbc_decrypt }, - { "blowfish-cbc", - SSH_CIPHER_SSH2, 8, 16, - blowfish_setkey, blowfish_setiv, - blowfish_cbc_encrypt, blowfish_cbc_decrypt }, - { "cast128-cbc", - SSH_CIPHER_SSH2, 8, 16, - cast_setkey, cast_setiv, - cast_cbc_encrypt, cast_cbc_decrypt }, - { "arcfour", - SSH_CIPHER_SSH2, 8, 16, - arcfour_setkey, none_setiv, - arcfour_crypt, arcfour_crypt }, - { "aes128-cbc", - SSH_CIPHER_SSH2, 16, 16, - rijndael_setkey, rijndael_setiv, - rijndael_cbc_encrypt, rijndael_cbc_decrypt }, - { "aes192-cbc", - SSH_CIPHER_SSH2, 16, 24, - rijndael_setkey, rijndael_setiv, - rijndael_cbc_encrypt, rijndael_cbc_decrypt }, - { "aes256-cbc", - SSH_CIPHER_SSH2, 16, 32, - rijndael_setkey, rijndael_setiv, - rijndael_cbc_encrypt, rijndael_cbc_decrypt }, - { "rijndael128-cbc", - SSH_CIPHER_SSH2, 16, 16, - rijndael_setkey, rijndael_setiv, - rijndael_cbc_encrypt, rijndael_cbc_decrypt }, - { "rijndael192-cbc", - SSH_CIPHER_SSH2, 16, 24, - rijndael_setkey, rijndael_setiv, - rijndael_cbc_encrypt, rijndael_cbc_decrypt }, - { "rijndael256-cbc", - SSH_CIPHER_SSH2, 16, 32, - rijndael_setkey, rijndael_setiv, - rijndael_cbc_encrypt, rijndael_cbc_decrypt }, - { "rijndael-cbc@lysator.liu.se", - SSH_CIPHER_SSH2, 16, 32, - rijndael_setkey, rijndael_setiv, - rijndael_cbc_encrypt, rijndael_cbc_decrypt }, - { NULL, SSH_CIPHER_ILLEGAL, 0, 0, NULL, NULL, NULL, NULL } -}; - -/*--*/ - u_int cipher_mask_ssh1(int client) { u_int mask = 0; - mask |= 1 << SSH_CIPHER_3DES; /* Mandatory */ + mask |= 1 << SSH_CIPHER_3DES; /* Mandatory */ mask |= 1 << SSH_CIPHER_BLOWFISH; if (client) { mask |= 1 << SSH_CIPHER_DES; @@ -457,7 +130,7 @@ return 0; ciphers = cp = xstrdup(names); for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0'; - (p = strsep(&cp, CIPHER_SEP))) { + (p = strsep(&cp, CIPHER_SEP))) { c = cipher_by_name(p); if (c == NULL || c->number != SSH_CIPHER_SSH2) { debug("bad cipher %s [%s]", p, names); @@ -496,8 +169,24 @@ void cipher_init(CipherContext *cc, Cipher *cipher, - const u_char *key, u_int keylen, const u_char *iv, u_int ivlen) + const u_char *key, u_int keylen, const u_char *iv, u_int ivlen, + int encrypt) { + static int dowarn = 1; + const EVP_CIPHER *type; + int klen; + + if (cipher->number == SSH_CIPHER_DES) { + if (dowarn) { + error("Warning: use of DES is strongly discouraged " + "due to cryptographic weaknesses"); + dowarn = 0; + } + if (keylen > 8) + keylen = 8; + } + cc->plaintext = (cipher->number == SSH_CIPHER_NONE); + if (keylen < cipher->key_len) fatal("cipher_init: key length %d is insufficient for %s.", keylen, cipher->name); @@ -505,24 +194,26 @@ fatal("cipher_init: iv length %d is insufficient for %s.", ivlen, cipher->name); cc->cipher = cipher; - cipher->setkey(cc, key, keylen); - cipher->setiv(cc, iv, ivlen); + + type = (*cipher->evptype)(); + + EVP_CIPHER_CTX_init(&cc->evp); + EVP_CipherInit(&cc->evp, type, (u_char *)key, (u_char *)iv, + (encrypt == CIPHER_ENCRYPT)); } void -cipher_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) +cipher_crypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) { if (len % cc->cipher->block_size) fatal("cipher_encrypt: bad plaintext length %d", len); - cc->cipher->encrypt(cc, dest, src, len); + EVP_Cipher(&cc->evp, dest, (u_char *)src, len); } void -cipher_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) +cipher_cleanup(CipherContext *cc) { - if (len % cc->cipher->block_size) - fatal("cipher_decrypt: bad ciphertext length %d", len); - cc->cipher->decrypt(cc, dest, src, len); + EVP_CIPHER_CTX_cleanup(&cc->evp); } /* @@ -532,7 +223,7 @@ void cipher_set_key_string(CipherContext *cc, Cipher *cipher, - const char *passphrase) + const char *passphrase, int encrypt) { MD5_CTX md; u_char digest[16]; @@ -541,8 +232,248 @@ MD5_Update(&md, (const u_char *)passphrase, strlen(passphrase)); MD5_Final(digest, &md); - cipher_init(cc, cipher, digest, 16, NULL, 0); + cipher_init(cc, cipher, digest, 16, NULL, 0, encrypt); memset(digest, 0, sizeof(digest)); memset(&md, 0, sizeof(md)); +} + +/* Implementations for other non-EVP ciphers */ + +/* + * This is used by SSH1: + * + * What kind of triple DES are these 2 routines? + * + * Why is there a redundant initialization vector? + * + * If only iv3 was used, then, this would till effect have been + * outer-cbc. However, there is also a private iv1 == iv2 which + * perhaps makes differential analysis easier. On the other hand, the + * private iv1 probably makes the CRC-32 attack ineffective. This is a + * result of that there is no longer any known iv1 to use when + * choosing the X block. + */ +struct ssh1_3des_ctx +{ + EVP_CIPHER_CTX k1, k2, k3; +}; +static int +ssh1_3des_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv, + int enc) +{ + struct ssh1_3des_ctx *c; + u_char *k1, *k2, *k3; + + if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { + c = xmalloc(sizeof(*c)); + EVP_CIPHER_CTX_set_app_data(ctx, c); + } + if (key == NULL) + return (1); + if (enc == -1) + enc = ctx->encrypt; + k1 = k2 = k3 = (u_char *) key; + k2 += 8; + if (EVP_CIPHER_CTX_key_length(ctx) >= 16+8) { + if (enc) + k3 += 16; + else + k1 += 16; + } + EVP_CIPHER_CTX_init(&c->k1); + EVP_CIPHER_CTX_init(&c->k2); + EVP_CIPHER_CTX_init(&c->k3); + EVP_CipherInit(&c->k1, EVP_des_cbc(), k1, NULL, enc); + EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc); + EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc); + return (1); +} +static int +ssh1_3des_cbc(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src, u_int len) +{ + struct ssh1_3des_ctx *c; + + if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { + error("ssh1_3des_cbc: no context"); + return (0); + } + EVP_Cipher(&c->k1, dest, (u_char *)src, len); + EVP_Cipher(&c->k2, dest, dest, len); + EVP_Cipher(&c->k3, dest, dest, len); + return (1); +} +static int +ssh1_3des_cleanup(EVP_CIPHER_CTX *ctx) +{ + struct ssh1_3des_ctx *c; + + if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) { + memset(c, 0, sizeof(*c)); + xfree(c); + EVP_CIPHER_CTX_set_app_data(ctx, NULL); + } + return (1); +} +static EVP_CIPHER * +evp_ssh1_3des(void) +{ + static EVP_CIPHER ssh1_3des; + + memset(&ssh1_3des, 0, sizeof(EVP_CIPHER)); + ssh1_3des.nid = NID_undef; + ssh1_3des.block_size = 8; + ssh1_3des.iv_len = 0; + ssh1_3des.key_len = 16; + ssh1_3des.init = ssh1_3des_init; + ssh1_3des.cleanup = ssh1_3des_cleanup; + ssh1_3des.do_cipher = ssh1_3des_cbc; + return (&ssh1_3des); +} + +/* + * SSH1 uses a variation on Blowfish, all bytes must be swapped before + * and after encryption/decryption. Thus the swap_bytes stuff (yuk). + */ +static void +swap_bytes(const u_char *src, u_char *dst, int n) +{ + u_char c[4]; + + /* Process 4 bytes every lap. */ + for (n = n / 4; n > 0; n--) { + c[3] = *src++; + c[2] = *src++; + c[1] = *src++; + c[0] = *src++; + + *dst++ = c[0]; + *dst++ = c[1]; + *dst++ = c[2]; + *dst++ = c[3]; + } +} +static int (*orig_bf)(EVP_CIPHER_CTX *, u_char *, const u_char *, u_int) = NULL; +static int +bf_ssh1_cipher(EVP_CIPHER_CTX *ctx, u_char *out, const u_char *in, u_int len) +{ + int ret; + + swap_bytes(in, out, len); + ret = (*orig_bf)(ctx, out, out, len); + swap_bytes(out, out, len); + return (ret); +} +static EVP_CIPHER * +evp_ssh1_bf(void) +{ + static EVP_CIPHER ssh1_bf; + + memcpy(&ssh1_bf, EVP_bf_cbc(), sizeof(EVP_CIPHER)); + orig_bf = ssh1_bf.do_cipher; + ssh1_bf.nid = NID_undef; + ssh1_bf.do_cipher = bf_ssh1_cipher; + ssh1_bf.key_len = 32; + return (&ssh1_bf); +} + +/* RIJNDAEL */ +#define RIJNDAEL_BLOCKSIZE 16 +struct ssh_rijndael_ctx +{ + rijndael_ctx r_ctx; + u_char r_iv[RIJNDAEL_BLOCKSIZE]; +}; + +static int +ssh_rijndael_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv, + int enc) +{ + struct ssh_rijndael_ctx *c; + + if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { + c = xmalloc(sizeof(*c)); + EVP_CIPHER_CTX_set_app_data(ctx, c); + } + if (key != NULL) { + if (enc == -1) + enc = ctx->encrypt; + rijndael_set_key(&c->r_ctx, (u_char *)key, + 8*EVP_CIPHER_CTX_key_length(ctx), enc); + } + if (iv != NULL) + memcpy(c->r_iv, iv, RIJNDAEL_BLOCKSIZE); + return (1); +} +static int +ssh_rijndael_cbc(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src, + u_int len) +{ + struct ssh_rijndael_ctx *c; + u_char buf[RIJNDAEL_BLOCKSIZE]; + u_char *cprev, *cnow, *plain, *ivp; + int i, j, blocks = len / RIJNDAEL_BLOCKSIZE; + + if (len == 0) + return (1); + if (len % RIJNDAEL_BLOCKSIZE) + fatal("ssh_rijndael_cbc: bad len %d", len); + if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { + error("ssh_rijndael_cbc: no context"); + return (0); + } + if (ctx->encrypt) { + cnow = dest; + plain = (u_char *)src; + cprev = c->r_iv; + for (i = 0; i < blocks; i++, plain+=RIJNDAEL_BLOCKSIZE, + cnow+=RIJNDAEL_BLOCKSIZE) { + for (j = 0; j < RIJNDAEL_BLOCKSIZE; j++) + buf[j] = plain[j] ^ cprev[j]; + rijndael_encrypt(&c->r_ctx, buf, cnow); + cprev = cnow; + } + memcpy(c->r_iv, cprev, RIJNDAEL_BLOCKSIZE); + } else { + cnow = (u_char *) (src+len-RIJNDAEL_BLOCKSIZE); + plain = dest+len-RIJNDAEL_BLOCKSIZE; + + memcpy(buf, cnow, RIJNDAEL_BLOCKSIZE); + for (i = blocks; i > 0; i--, cnow-=RIJNDAEL_BLOCKSIZE, + plain-=RIJNDAEL_BLOCKSIZE) { + rijndael_decrypt(&c->r_ctx, cnow, plain); + ivp = (i == 1) ? c->r_iv : cnow-RIJNDAEL_BLOCKSIZE; + for (j = 0; j < RIJNDAEL_BLOCKSIZE; j++) + plain[j] ^= ivp[j]; + } + memcpy(c->r_iv, buf, RIJNDAEL_BLOCKSIZE); + } + return (1); +} +static int +ssh_rijndael_cleanup(EVP_CIPHER_CTX *ctx) +{ + struct ssh_rijndael_ctx *c; + + if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) { + memset(c, 0, sizeof(*c)); + xfree(c); + EVP_CIPHER_CTX_set_app_data(ctx, NULL); + } + return (1); +} +static EVP_CIPHER * +evp_rijndael(void) +{ + static EVP_CIPHER rijndal_cbc; + + memset(&rijndal_cbc, 0, sizeof(EVP_CIPHER)); + rijndal_cbc.nid = NID_undef; + rijndal_cbc.block_size = RIJNDAEL_BLOCKSIZE; + rijndal_cbc.iv_len = RIJNDAEL_BLOCKSIZE; + rijndal_cbc.key_len = 16; + rijndal_cbc.init = ssh_rijndael_init; + rijndal_cbc.cleanup = ssh_rijndael_cleanup; + rijndal_cbc.do_cipher = ssh_rijndael_cbc; + return (&rijndal_cbc); }