Annotation of src/usr.bin/ssh/cipher.c, Revision 1.68
1.1 deraadt 1: /*
1.30 deraadt 2: * Author: Tatu Ylonen <ylo@cs.hut.fi>
3: * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4: * All rights reserved
1.26 markus 5: *
1.30 deraadt 6: * As far as I am concerned, the code I have written for this software
7: * can be used freely for any purpose. Any derived versions of this
8: * software must be clearly marked as such, and if the derived work is
9: * incompatible with the protocol description in the RFC file, it must be
10: * called by a name other than "ssh" or "Secure Shell".
1.26 markus 11: *
12: *
1.30 deraadt 13: * Copyright (c) 1999 Niels Provos. All rights reserved.
1.46 markus 14: * Copyright (c) 1999, 2000 Markus Friedl. All rights reserved.
1.26 markus 15: *
1.30 deraadt 16: * Redistribution and use in source and binary forms, with or without
17: * modification, are permitted provided that the following conditions
18: * are met:
19: * 1. Redistributions of source code must retain the above copyright
20: * notice, this list of conditions and the following disclaimer.
21: * 2. Redistributions in binary form must reproduce the above copyright
22: * notice, this list of conditions and the following disclaimer in the
23: * documentation and/or other materials provided with the distribution.
1.26 markus 24: *
1.30 deraadt 25: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
26: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
27: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
28: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
29: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
30: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
31: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
32: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
33: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
34: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.17 deraadt 35: */
1.1 deraadt 36:
37: #include "includes.h"
1.68 ! hshoexer 38: RCSID("$OpenBSD: cipher.c,v 1.67 2004/01/23 17:06:03 hshoexer Exp $");
1.1 deraadt 39:
1.24 markus 40: #include "xmalloc.h"
1.42 markus 41: #include "log.h"
42: #include "cipher.h"
1.8 deraadt 43:
1.25 markus 44: #include <openssl/md5.h>
1.57 markus 45:
46: #if OPENSSL_VERSION_NUMBER < 0x00907000L
1.64 markus 47: extern const EVP_CIPHER *evp_rijndael(void);
48: extern void ssh_rijndael_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
1.57 markus 49: #endif
1.64 markus 50: extern const EVP_CIPHER *evp_ssh1_bf(void);
51: extern const EVP_CIPHER *evp_ssh1_3des(void);
52: extern void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int);
1.65 markus 53: extern const EVP_CIPHER *evp_aes_128_ctr(void);
54: extern void ssh_aes_ctr_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
1.1 deraadt 55:
1.51 markus 56: struct Cipher {
57: char *name;
58: int number; /* for ssh1 only */
59: u_int block_size;
60: u_int key_len;
1.56 markus 61: const EVP_CIPHER *(*evptype)(void);
1.52 markus 62: } ciphers[] = {
63: { "none", SSH_CIPHER_NONE, 8, 0, EVP_enc_null },
64: { "des", SSH_CIPHER_DES, 8, 8, EVP_des_cbc },
65: { "3des", SSH_CIPHER_3DES, 8, 16, evp_ssh1_3des },
66: { "blowfish", SSH_CIPHER_BLOWFISH, 8, 32, evp_ssh1_bf },
67:
68: { "3des-cbc", SSH_CIPHER_SSH2, 8, 24, EVP_des_ede3_cbc },
69: { "blowfish-cbc", SSH_CIPHER_SSH2, 8, 16, EVP_bf_cbc },
70: { "cast128-cbc", SSH_CIPHER_SSH2, 8, 16, EVP_cast5_cbc },
71: { "arcfour", SSH_CIPHER_SSH2, 8, 16, EVP_rc4 },
1.57 markus 72: #if OPENSSL_VERSION_NUMBER < 0x00907000L
1.52 markus 73: { "aes128-cbc", SSH_CIPHER_SSH2, 16, 16, evp_rijndael },
74: { "aes192-cbc", SSH_CIPHER_SSH2, 16, 24, evp_rijndael },
75: { "aes256-cbc", SSH_CIPHER_SSH2, 16, 32, evp_rijndael },
1.55 markus 76: { "rijndael-cbc@lysator.liu.se",
77: SSH_CIPHER_SSH2, 16, 32, evp_rijndael },
1.57 markus 78: #else
79: { "aes128-cbc", SSH_CIPHER_SSH2, 16, 16, EVP_aes_128_cbc },
80: { "aes192-cbc", SSH_CIPHER_SSH2, 16, 24, EVP_aes_192_cbc },
81: { "aes256-cbc", SSH_CIPHER_SSH2, 16, 32, EVP_aes_256_cbc },
82: { "rijndael-cbc@lysator.liu.se",
83: SSH_CIPHER_SSH2, 16, 32, EVP_aes_256_cbc },
84: #endif
1.65 markus 85: { "aes128-ctr", SSH_CIPHER_SSH2, 16, 16, evp_aes_128_ctr },
86: { "aes192-ctr", SSH_CIPHER_SSH2, 16, 24, evp_aes_128_ctr },
87: { "aes256-ctr", SSH_CIPHER_SSH2, 16, 32, evp_aes_128_ctr },
1.68 ! hshoexer 88: { "acss@openssh.org", SSH_CIPHER_SSH2, 16, 5, EVP_acss },
1.47 markus 89:
1.52 markus 90: { NULL, SSH_CIPHER_ILLEGAL, 0, 0, NULL }
1.32 markus 91: };
92:
93: /*--*/
1.1 deraadt 94:
1.54 markus 95: u_int
1.66 jakob 96: cipher_blocksize(const Cipher *c)
1.51 markus 97: {
98: return (c->block_size);
99: }
1.60 deraadt 100:
1.54 markus 101: u_int
1.66 jakob 102: cipher_keylen(const Cipher *c)
1.51 markus 103: {
104: return (c->key_len);
105: }
1.60 deraadt 106:
1.54 markus 107: u_int
1.66 jakob 108: cipher_get_number(const Cipher *c)
1.53 markus 109: {
110: return (c->number);
111: }
1.51 markus 112:
1.41 markus 113: u_int
1.34 markus 114: cipher_mask_ssh1(int client)
1.1 deraadt 115: {
1.41 markus 116: u_int mask = 0;
1.48 deraadt 117: mask |= 1 << SSH_CIPHER_3DES; /* Mandatory */
1.34 markus 118: mask |= 1 << SSH_CIPHER_BLOWFISH;
119: if (client) {
120: mask |= 1 << SSH_CIPHER_DES;
1.32 markus 121: }
122: return mask;
1.1 deraadt 123: }
124:
1.32 markus 125: Cipher *
126: cipher_by_name(const char *name)
127: {
128: Cipher *c;
129: for (c = ciphers; c->name != NULL; c++)
130: if (strcasecmp(c->name, name) == 0)
131: return c;
132: return NULL;
133: }
134:
135: Cipher *
136: cipher_by_number(int id)
137: {
138: Cipher *c;
139: for (c = ciphers; c->name != NULL; c++)
140: if (c->number == id)
141: return c;
142: return NULL;
143: }
1.24 markus 144:
145: #define CIPHER_SEP ","
146: int
147: ciphers_valid(const char *names)
148: {
1.32 markus 149: Cipher *c;
1.29 ho 150: char *ciphers, *cp;
1.24 markus 151: char *p;
152:
1.27 markus 153: if (names == NULL || strcmp(names, "") == 0)
1.24 markus 154: return 0;
1.29 ho 155: ciphers = cp = xstrdup(names);
1.32 markus 156: for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0';
1.48 deraadt 157: (p = strsep(&cp, CIPHER_SEP))) {
1.32 markus 158: c = cipher_by_name(p);
159: if (c == NULL || c->number != SSH_CIPHER_SSH2) {
160: debug("bad cipher %s [%s]", p, names);
1.24 markus 161: xfree(ciphers);
162: return 0;
1.32 markus 163: } else {
1.36 markus 164: debug3("cipher ok: %s [%s]", p, names);
1.24 markus 165: }
166: }
1.36 markus 167: debug3("ciphers ok: [%s]", names);
1.24 markus 168: xfree(ciphers);
169: return 1;
170: }
171:
1.18 markus 172: /*
173: * Parses the name of the cipher. Returns the number of the corresponding
174: * cipher, or -1 on error.
175: */
1.1 deraadt 176:
1.4 provos 177: int
178: cipher_number(const char *name)
1.1 deraadt 179: {
1.32 markus 180: Cipher *c;
1.27 markus 181: if (name == NULL)
182: return -1;
1.32 markus 183: c = cipher_by_name(name);
184: return (c==NULL) ? -1 : c->number;
1.1 deraadt 185: }
186:
1.32 markus 187: char *
188: cipher_name(int id)
1.1 deraadt 189: {
1.32 markus 190: Cipher *c = cipher_by_number(id);
191: return (c==NULL) ? "<unknown>" : c->name;
1.1 deraadt 192: }
193:
1.26 markus 194: void
1.52 markus 195: cipher_init(CipherContext *cc, Cipher *cipher,
196: const u_char *key, u_int keylen, const u_char *iv, u_int ivlen,
197: int encrypt)
1.16 markus 198: {
1.52 markus 199: static int dowarn = 1;
200: const EVP_CIPHER *type;
201: int klen;
202:
203: if (cipher->number == SSH_CIPHER_DES) {
204: if (dowarn) {
205: error("Warning: use of DES is strongly discouraged "
206: "due to cryptographic weaknesses");
207: dowarn = 0;
208: }
209: if (keylen > 8)
210: keylen = 8;
211: }
212: cc->plaintext = (cipher->number == SSH_CIPHER_NONE);
213:
1.32 markus 214: if (keylen < cipher->key_len)
215: fatal("cipher_init: key length %d is insufficient for %s.",
216: keylen, cipher->name);
217: if (iv != NULL && ivlen < cipher->block_size)
218: fatal("cipher_init: iv length %d is insufficient for %s.",
219: ivlen, cipher->name);
220: cc->cipher = cipher;
1.52 markus 221:
222: type = (*cipher->evptype)();
223:
224: EVP_CIPHER_CTX_init(&cc->evp);
225: if (EVP_CipherInit(&cc->evp, type, NULL, (u_char *)iv,
226: (encrypt == CIPHER_ENCRYPT)) == 0)
227: fatal("cipher_init: EVP_CipherInit failed for %s",
228: cipher->name);
229: klen = EVP_CIPHER_CTX_key_length(&cc->evp);
230: if (klen > 0 && keylen != klen) {
1.62 markus 231: debug2("cipher_init: set keylen (%d -> %d)", klen, keylen);
1.52 markus 232: if (EVP_CIPHER_CTX_set_key_length(&cc->evp, keylen) == 0)
233: fatal("cipher_init: set keylen failed (%d -> %d)",
234: klen, keylen);
235: }
236: if (EVP_CipherInit(&cc->evp, NULL, (u_char *)key, NULL, -1) == 0)
237: fatal("cipher_init: EVP_CipherInit: set key failed for %s",
238: cipher->name);
1.1 deraadt 239: }
1.21 markus 240:
1.26 markus 241: void
1.51 markus 242: cipher_crypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
1.32 markus 243: {
244: if (len % cc->cipher->block_size)
245: fatal("cipher_encrypt: bad plaintext length %d", len);
1.52 markus 246: if (EVP_Cipher(&cc->evp, dest, (u_char *)src, len) == 0)
247: fatal("evp_crypt: EVP_Cipher failed");
1.21 markus 248: }
249:
1.26 markus 250: void
1.51 markus 251: cipher_cleanup(CipherContext *cc)
1.16 markus 252: {
1.52 markus 253: if (EVP_CIPHER_CTX_cleanup(&cc->evp) == 0)
254: error("cipher_cleanup: EVP_CIPHER_CTX_cleanup failed");
1.16 markus 255: }
1.1 deraadt 256:
1.32 markus 257: /*
258: * Selects the cipher, and keys if by computing the MD5 checksum of the
259: * passphrase and using the resulting 16 bytes as the key.
260: */
1.1 deraadt 261:
1.26 markus 262: void
1.32 markus 263: cipher_set_key_string(CipherContext *cc, Cipher *cipher,
1.51 markus 264: const char *passphrase, int encrypt)
1.16 markus 265: {
1.32 markus 266: MD5_CTX md;
1.41 markus 267: u_char digest[16];
1.32 markus 268:
269: MD5_Init(&md);
270: MD5_Update(&md, (const u_char *)passphrase, strlen(passphrase));
271: MD5_Final(digest, &md);
1.16 markus 272:
1.51 markus 273: cipher_init(cc, cipher, digest, 16, NULL, 0, encrypt);
1.16 markus 274:
1.32 markus 275: memset(digest, 0, sizeof(digest));
276: memset(&md, 0, sizeof(md));
1.52 markus 277: }
1.53 markus 278:
1.54 markus 279: /*
1.53 markus 280: * Exports an IV from the CipherContext required to export the key
281: * state back from the unprivileged child to the privileged parent
282: * process.
283: */
284:
285: int
1.66 jakob 286: cipher_get_keyiv_len(const CipherContext *cc)
1.53 markus 287: {
288: Cipher *c = cc->cipher;
289: int ivlen;
290:
291: if (c->number == SSH_CIPHER_3DES)
292: ivlen = 24;
293: else
294: ivlen = EVP_CIPHER_CTX_iv_length(&cc->evp);
295: return (ivlen);
296: }
297:
298: void
299: cipher_get_keyiv(CipherContext *cc, u_char *iv, u_int len)
300: {
301: Cipher *c = cc->cipher;
302: int evplen;
303:
304: switch (c->number) {
305: case SSH_CIPHER_SSH2:
306: case SSH_CIPHER_DES:
307: case SSH_CIPHER_BLOWFISH:
308: evplen = EVP_CIPHER_CTX_iv_length(&cc->evp);
309: if (evplen == 0)
310: return;
311: if (evplen != len)
1.58 markus 312: fatal("%s: wrong iv length %d != %d", __func__,
1.53 markus 313: evplen, len);
1.57 markus 314: #if OPENSSL_VERSION_NUMBER < 0x00907000L
1.63 markus 315: if (c->evptype == evp_rijndael)
316: ssh_rijndael_iv(&cc->evp, 0, iv, len);
317: else
1.57 markus 318: #endif
1.65 markus 319: if (c->evptype == evp_aes_128_ctr)
320: ssh_aes_ctr_iv(&cc->evp, 0, iv, len);
321: else
1.63 markus 322: memcpy(iv, cc->evp.iv, len);
323: break;
324: case SSH_CIPHER_3DES:
325: ssh1_3des_iv(&cc->evp, 0, iv, 24);
1.53 markus 326: break;
327: default:
1.58 markus 328: fatal("%s: bad cipher %d", __func__, c->number);
1.53 markus 329: }
330: }
331:
332: void
333: cipher_set_keyiv(CipherContext *cc, u_char *iv)
334: {
335: Cipher *c = cc->cipher;
336: int evplen = 0;
337:
338: switch (c->number) {
339: case SSH_CIPHER_SSH2:
340: case SSH_CIPHER_DES:
341: case SSH_CIPHER_BLOWFISH:
342: evplen = EVP_CIPHER_CTX_iv_length(&cc->evp);
343: if (evplen == 0)
344: return;
1.57 markus 345: #if OPENSSL_VERSION_NUMBER < 0x00907000L
1.63 markus 346: if (c->evptype == evp_rijndael)
347: ssh_rijndael_iv(&cc->evp, 1, iv, evplen);
348: else
1.57 markus 349: #endif
1.65 markus 350: if (c->evptype == evp_aes_128_ctr)
351: ssh_aes_ctr_iv(&cc->evp, 1, iv, evplen);
352: else
1.63 markus 353: memcpy(cc->evp.iv, iv, evplen);
354: break;
355: case SSH_CIPHER_3DES:
356: ssh1_3des_iv(&cc->evp, 1, iv, 24);
1.53 markus 357: break;
358: default:
1.58 markus 359: fatal("%s: bad cipher %d", __func__, c->number);
1.53 markus 360: }
361: }
362:
363: #if OPENSSL_VERSION_NUMBER < 0x00907000L
364: #define EVP_X_STATE(evp) &(evp).c
365: #define EVP_X_STATE_LEN(evp) sizeof((evp).c)
366: #else
367: #define EVP_X_STATE(evp) (evp).cipher_data
368: #define EVP_X_STATE_LEN(evp) (evp).cipher->ctx_size
369: #endif
370:
371: int
1.66 jakob 372: cipher_get_keycontext(const CipherContext *cc, u_char *dat)
1.53 markus 373: {
374: Cipher *c = cc->cipher;
1.59 markus 375: int plen = 0;
1.53 markus 376:
1.67 hshoexer 377: if (c->evptype == EVP_rc4 || c->evptype == EVP_acss) {
1.59 markus 378: plen = EVP_X_STATE_LEN(cc->evp);
1.53 markus 379: if (dat == NULL)
1.59 markus 380: return (plen);
381: memcpy(dat, EVP_X_STATE(cc->evp), plen);
1.53 markus 382: }
383: return (plen);
384: }
385:
386: void
387: cipher_set_keycontext(CipherContext *cc, u_char *dat)
388: {
389: Cipher *c = cc->cipher;
390: int plen;
391:
1.67 hshoexer 392: if (c->evptype == EVP_rc4 || c->evptype == EVP_acss) {
1.53 markus 393: plen = EVP_X_STATE_LEN(cc->evp);
394: memcpy(EVP_X_STATE(cc->evp), dat, plen);
395: }
1.1 deraadt 396: }
![[BACK]](/icons/back.gif){kind=icon}
Return to cipher.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh