Annotation of src/usr.bin/ssh/cipher.c, Revision 1.65
1.1 deraadt 1: /*
1.30 deraadt 2: * Author: Tatu Ylonen <ylo@cs.hut.fi>
3: * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4: * All rights reserved
1.26 markus 5: *
1.30 deraadt 6: * As far as I am concerned, the code I have written for this software
7: * can be used freely for any purpose. Any derived versions of this
8: * software must be clearly marked as such, and if the derived work is
9: * incompatible with the protocol description in the RFC file, it must be
10: * called by a name other than "ssh" or "Secure Shell".
1.26 markus 11: *
12: *
1.30 deraadt 13: * Copyright (c) 1999 Niels Provos. All rights reserved.
1.46 markus 14: * Copyright (c) 1999, 2000 Markus Friedl. All rights reserved.
1.26 markus 15: *
1.30 deraadt 16: * Redistribution and use in source and binary forms, with or without
17: * modification, are permitted provided that the following conditions
18: * are met:
19: * 1. Redistributions of source code must retain the above copyright
20: * notice, this list of conditions and the following disclaimer.
21: * 2. Redistributions in binary form must reproduce the above copyright
22: * notice, this list of conditions and the following disclaimer in the
23: * documentation and/or other materials provided with the distribution.
1.26 markus 24: *
1.30 deraadt 25: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
26: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
27: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
28: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
29: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
30: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
31: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
32: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
33: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
34: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.17 deraadt 35: */
1.1 deraadt 36:
37: #include "includes.h"
1.65 ! markus 38: RCSID("$OpenBSD: cipher.c,v 1.64 2003/05/15 03:08:29 markus Exp $");
1.1 deraadt 39:
1.24 markus 40: #include "xmalloc.h"
1.42 markus 41: #include "log.h"
42: #include "cipher.h"
1.8 deraadt 43:
1.25 markus 44: #include <openssl/md5.h>
1.57 markus 45:
46: #if OPENSSL_VERSION_NUMBER < 0x00907000L
1.64 markus 47: extern const EVP_CIPHER *evp_rijndael(void);
48: extern void ssh_rijndael_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
1.57 markus 49: #endif
1.64 markus 50: extern const EVP_CIPHER *evp_ssh1_bf(void);
51: extern const EVP_CIPHER *evp_ssh1_3des(void);
52: extern void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int);
1.65 ! markus 53: extern const EVP_CIPHER *evp_aes_128_ctr(void);
! 54: extern void ssh_aes_ctr_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
1.1 deraadt 55:
1.51 markus 56: struct Cipher {
57: char *name;
58: int number; /* for ssh1 only */
59: u_int block_size;
60: u_int key_len;
1.56 markus 61: const EVP_CIPHER *(*evptype)(void);
1.52 markus 62: } ciphers[] = {
63: { "none", SSH_CIPHER_NONE, 8, 0, EVP_enc_null },
64: { "des", SSH_CIPHER_DES, 8, 8, EVP_des_cbc },
65: { "3des", SSH_CIPHER_3DES, 8, 16, evp_ssh1_3des },
66: { "blowfish", SSH_CIPHER_BLOWFISH, 8, 32, evp_ssh1_bf },
67:
68: { "3des-cbc", SSH_CIPHER_SSH2, 8, 24, EVP_des_ede3_cbc },
69: { "blowfish-cbc", SSH_CIPHER_SSH2, 8, 16, EVP_bf_cbc },
70: { "cast128-cbc", SSH_CIPHER_SSH2, 8, 16, EVP_cast5_cbc },
71: { "arcfour", SSH_CIPHER_SSH2, 8, 16, EVP_rc4 },
1.57 markus 72: #if OPENSSL_VERSION_NUMBER < 0x00907000L
1.52 markus 73: { "aes128-cbc", SSH_CIPHER_SSH2, 16, 16, evp_rijndael },
74: { "aes192-cbc", SSH_CIPHER_SSH2, 16, 24, evp_rijndael },
75: { "aes256-cbc", SSH_CIPHER_SSH2, 16, 32, evp_rijndael },
1.55 markus 76: { "rijndael-cbc@lysator.liu.se",
77: SSH_CIPHER_SSH2, 16, 32, evp_rijndael },
1.57 markus 78: #else
79: { "aes128-cbc", SSH_CIPHER_SSH2, 16, 16, EVP_aes_128_cbc },
80: { "aes192-cbc", SSH_CIPHER_SSH2, 16, 24, EVP_aes_192_cbc },
81: { "aes256-cbc", SSH_CIPHER_SSH2, 16, 32, EVP_aes_256_cbc },
82: { "rijndael-cbc@lysator.liu.se",
83: SSH_CIPHER_SSH2, 16, 32, EVP_aes_256_cbc },
84: #endif
1.65 ! markus 85: { "aes128-ctr", SSH_CIPHER_SSH2, 16, 16, evp_aes_128_ctr },
! 86: { "aes192-ctr", SSH_CIPHER_SSH2, 16, 24, evp_aes_128_ctr },
! 87: { "aes256-ctr", SSH_CIPHER_SSH2, 16, 32, evp_aes_128_ctr },
1.47 markus 88:
1.52 markus 89: { NULL, SSH_CIPHER_ILLEGAL, 0, 0, NULL }
1.32 markus 90: };
91:
92: /*--*/
1.1 deraadt 93:
1.54 markus 94: u_int
1.51 markus 95: cipher_blocksize(Cipher *c)
96: {
97: return (c->block_size);
98: }
1.60 deraadt 99:
1.54 markus 100: u_int
1.51 markus 101: cipher_keylen(Cipher *c)
102: {
103: return (c->key_len);
104: }
1.60 deraadt 105:
1.54 markus 106: u_int
1.53 markus 107: cipher_get_number(Cipher *c)
108: {
109: return (c->number);
110: }
1.51 markus 111:
1.41 markus 112: u_int
1.34 markus 113: cipher_mask_ssh1(int client)
1.1 deraadt 114: {
1.41 markus 115: u_int mask = 0;
1.48 deraadt 116: mask |= 1 << SSH_CIPHER_3DES; /* Mandatory */
1.34 markus 117: mask |= 1 << SSH_CIPHER_BLOWFISH;
118: if (client) {
119: mask |= 1 << SSH_CIPHER_DES;
1.32 markus 120: }
121: return mask;
1.1 deraadt 122: }
123:
1.32 markus 124: Cipher *
125: cipher_by_name(const char *name)
126: {
127: Cipher *c;
128: for (c = ciphers; c->name != NULL; c++)
129: if (strcasecmp(c->name, name) == 0)
130: return c;
131: return NULL;
132: }
133:
134: Cipher *
135: cipher_by_number(int id)
136: {
137: Cipher *c;
138: for (c = ciphers; c->name != NULL; c++)
139: if (c->number == id)
140: return c;
141: return NULL;
142: }
1.24 markus 143:
144: #define CIPHER_SEP ","
145: int
146: ciphers_valid(const char *names)
147: {
1.32 markus 148: Cipher *c;
1.29 ho 149: char *ciphers, *cp;
1.24 markus 150: char *p;
151:
1.27 markus 152: if (names == NULL || strcmp(names, "") == 0)
1.24 markus 153: return 0;
1.29 ho 154: ciphers = cp = xstrdup(names);
1.32 markus 155: for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0';
1.48 deraadt 156: (p = strsep(&cp, CIPHER_SEP))) {
1.32 markus 157: c = cipher_by_name(p);
158: if (c == NULL || c->number != SSH_CIPHER_SSH2) {
159: debug("bad cipher %s [%s]", p, names);
1.24 markus 160: xfree(ciphers);
161: return 0;
1.32 markus 162: } else {
1.36 markus 163: debug3("cipher ok: %s [%s]", p, names);
1.24 markus 164: }
165: }
1.36 markus 166: debug3("ciphers ok: [%s]", names);
1.24 markus 167: xfree(ciphers);
168: return 1;
169: }
170:
1.18 markus 171: /*
172: * Parses the name of the cipher. Returns the number of the corresponding
173: * cipher, or -1 on error.
174: */
1.1 deraadt 175:
1.4 provos 176: int
177: cipher_number(const char *name)
1.1 deraadt 178: {
1.32 markus 179: Cipher *c;
1.27 markus 180: if (name == NULL)
181: return -1;
1.32 markus 182: c = cipher_by_name(name);
183: return (c==NULL) ? -1 : c->number;
1.1 deraadt 184: }
185:
1.32 markus 186: char *
187: cipher_name(int id)
1.1 deraadt 188: {
1.32 markus 189: Cipher *c = cipher_by_number(id);
190: return (c==NULL) ? "<unknown>" : c->name;
1.1 deraadt 191: }
192:
1.26 markus 193: void
1.52 markus 194: cipher_init(CipherContext *cc, Cipher *cipher,
195: const u_char *key, u_int keylen, const u_char *iv, u_int ivlen,
196: int encrypt)
1.16 markus 197: {
1.52 markus 198: static int dowarn = 1;
199: const EVP_CIPHER *type;
200: int klen;
201:
202: if (cipher->number == SSH_CIPHER_DES) {
203: if (dowarn) {
204: error("Warning: use of DES is strongly discouraged "
205: "due to cryptographic weaknesses");
206: dowarn = 0;
207: }
208: if (keylen > 8)
209: keylen = 8;
210: }
211: cc->plaintext = (cipher->number == SSH_CIPHER_NONE);
212:
1.32 markus 213: if (keylen < cipher->key_len)
214: fatal("cipher_init: key length %d is insufficient for %s.",
215: keylen, cipher->name);
216: if (iv != NULL && ivlen < cipher->block_size)
217: fatal("cipher_init: iv length %d is insufficient for %s.",
218: ivlen, cipher->name);
219: cc->cipher = cipher;
1.52 markus 220:
221: type = (*cipher->evptype)();
222:
223: EVP_CIPHER_CTX_init(&cc->evp);
224: if (EVP_CipherInit(&cc->evp, type, NULL, (u_char *)iv,
225: (encrypt == CIPHER_ENCRYPT)) == 0)
226: fatal("cipher_init: EVP_CipherInit failed for %s",
227: cipher->name);
228: klen = EVP_CIPHER_CTX_key_length(&cc->evp);
229: if (klen > 0 && keylen != klen) {
1.62 markus 230: debug2("cipher_init: set keylen (%d -> %d)", klen, keylen);
1.52 markus 231: if (EVP_CIPHER_CTX_set_key_length(&cc->evp, keylen) == 0)
232: fatal("cipher_init: set keylen failed (%d -> %d)",
233: klen, keylen);
234: }
235: if (EVP_CipherInit(&cc->evp, NULL, (u_char *)key, NULL, -1) == 0)
236: fatal("cipher_init: EVP_CipherInit: set key failed for %s",
237: cipher->name);
1.1 deraadt 238: }
1.21 markus 239:
1.26 markus 240: void
1.51 markus 241: cipher_crypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
1.32 markus 242: {
243: if (len % cc->cipher->block_size)
244: fatal("cipher_encrypt: bad plaintext length %d", len);
1.52 markus 245: if (EVP_Cipher(&cc->evp, dest, (u_char *)src, len) == 0)
246: fatal("evp_crypt: EVP_Cipher failed");
1.21 markus 247: }
248:
1.26 markus 249: void
1.51 markus 250: cipher_cleanup(CipherContext *cc)
1.16 markus 251: {
1.52 markus 252: if (EVP_CIPHER_CTX_cleanup(&cc->evp) == 0)
253: error("cipher_cleanup: EVP_CIPHER_CTX_cleanup failed");
1.16 markus 254: }
1.1 deraadt 255:
1.32 markus 256: /*
257: * Selects the cipher, and keys if by computing the MD5 checksum of the
258: * passphrase and using the resulting 16 bytes as the key.
259: */
1.1 deraadt 260:
1.26 markus 261: void
1.32 markus 262: cipher_set_key_string(CipherContext *cc, Cipher *cipher,
1.51 markus 263: const char *passphrase, int encrypt)
1.16 markus 264: {
1.32 markus 265: MD5_CTX md;
1.41 markus 266: u_char digest[16];
1.32 markus 267:
268: MD5_Init(&md);
269: MD5_Update(&md, (const u_char *)passphrase, strlen(passphrase));
270: MD5_Final(digest, &md);
1.16 markus 271:
1.51 markus 272: cipher_init(cc, cipher, digest, 16, NULL, 0, encrypt);
1.16 markus 273:
1.32 markus 274: memset(digest, 0, sizeof(digest));
275: memset(&md, 0, sizeof(md));
1.52 markus 276: }
1.53 markus 277:
1.54 markus 278: /*
1.53 markus 279: * Exports an IV from the CipherContext required to export the key
280: * state back from the unprivileged child to the privileged parent
281: * process.
282: */
283:
284: int
285: cipher_get_keyiv_len(CipherContext *cc)
286: {
287: Cipher *c = cc->cipher;
288: int ivlen;
289:
290: if (c->number == SSH_CIPHER_3DES)
291: ivlen = 24;
292: else
293: ivlen = EVP_CIPHER_CTX_iv_length(&cc->evp);
294: return (ivlen);
295: }
296:
297: void
298: cipher_get_keyiv(CipherContext *cc, u_char *iv, u_int len)
299: {
300: Cipher *c = cc->cipher;
301: int evplen;
302:
303: switch (c->number) {
304: case SSH_CIPHER_SSH2:
305: case SSH_CIPHER_DES:
306: case SSH_CIPHER_BLOWFISH:
307: evplen = EVP_CIPHER_CTX_iv_length(&cc->evp);
308: if (evplen == 0)
309: return;
310: if (evplen != len)
1.58 markus 311: fatal("%s: wrong iv length %d != %d", __func__,
1.53 markus 312: evplen, len);
1.57 markus 313: #if OPENSSL_VERSION_NUMBER < 0x00907000L
1.63 markus 314: if (c->evptype == evp_rijndael)
315: ssh_rijndael_iv(&cc->evp, 0, iv, len);
316: else
1.57 markus 317: #endif
1.65 ! markus 318: if (c->evptype == evp_aes_128_ctr)
! 319: ssh_aes_ctr_iv(&cc->evp, 0, iv, len);
! 320: else
1.63 markus 321: memcpy(iv, cc->evp.iv, len);
322: break;
323: case SSH_CIPHER_3DES:
324: ssh1_3des_iv(&cc->evp, 0, iv, 24);
1.53 markus 325: break;
326: default:
1.58 markus 327: fatal("%s: bad cipher %d", __func__, c->number);
1.53 markus 328: }
329: }
330:
331: void
332: cipher_set_keyiv(CipherContext *cc, u_char *iv)
333: {
334: Cipher *c = cc->cipher;
335: int evplen = 0;
336:
337: switch (c->number) {
338: case SSH_CIPHER_SSH2:
339: case SSH_CIPHER_DES:
340: case SSH_CIPHER_BLOWFISH:
341: evplen = EVP_CIPHER_CTX_iv_length(&cc->evp);
342: if (evplen == 0)
343: return;
1.57 markus 344: #if OPENSSL_VERSION_NUMBER < 0x00907000L
1.63 markus 345: if (c->evptype == evp_rijndael)
346: ssh_rijndael_iv(&cc->evp, 1, iv, evplen);
347: else
1.57 markus 348: #endif
1.65 ! markus 349: if (c->evptype == evp_aes_128_ctr)
! 350: ssh_aes_ctr_iv(&cc->evp, 1, iv, evplen);
! 351: else
1.63 markus 352: memcpy(cc->evp.iv, iv, evplen);
353: break;
354: case SSH_CIPHER_3DES:
355: ssh1_3des_iv(&cc->evp, 1, iv, 24);
1.53 markus 356: break;
357: default:
1.58 markus 358: fatal("%s: bad cipher %d", __func__, c->number);
1.53 markus 359: }
360: }
361:
362: #if OPENSSL_VERSION_NUMBER < 0x00907000L
363: #define EVP_X_STATE(evp) &(evp).c
364: #define EVP_X_STATE_LEN(evp) sizeof((evp).c)
365: #else
366: #define EVP_X_STATE(evp) (evp).cipher_data
367: #define EVP_X_STATE_LEN(evp) (evp).cipher->ctx_size
368: #endif
369:
370: int
371: cipher_get_keycontext(CipherContext *cc, u_char *dat)
372: {
373: Cipher *c = cc->cipher;
1.59 markus 374: int plen = 0;
1.53 markus 375:
1.59 markus 376: if (c->evptype == EVP_rc4) {
377: plen = EVP_X_STATE_LEN(cc->evp);
1.53 markus 378: if (dat == NULL)
1.59 markus 379: return (plen);
380: memcpy(dat, EVP_X_STATE(cc->evp), plen);
1.53 markus 381: }
382: return (plen);
383: }
384:
385: void
386: cipher_set_keycontext(CipherContext *cc, u_char *dat)
387: {
388: Cipher *c = cc->cipher;
389: int plen;
390:
1.59 markus 391: if (c->evptype == EVP_rc4) {
1.53 markus 392: plen = EVP_X_STATE_LEN(cc->evp);
393: memcpy(EVP_X_STATE(cc->evp), dat, plen);
394: }
1.1 deraadt 395: }
![[BACK]](/icons/back.gif){kind=icon}
Return to cipher.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh