chiark / gitweb /
server/{keyexch.c,keyset.c}: Eliminate `ks_tregen'.
[tripe] / server / keyset.c
CommitLineData
410c8acf 1/* -*-c-*-
2 *
410c8acf 3 * Handling of symmetric keysets
4 *
5 * (c) 2001 Straylight/Edgeware
6 */
7
e04c2d50 8/*----- Licensing notice --------------------------------------------------*
410c8acf 9 *
10 * This file is part of Trivial IP Encryption (TrIPE).
11 *
12 * TrIPE is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU General Public License as published by
14 * the Free Software Foundation; either version 2 of the License, or
15 * (at your option) any later version.
e04c2d50 16 *
410c8acf 17 * TrIPE is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
e04c2d50 21 *
410c8acf 22 * You should have received a copy of the GNU General Public License
23 * along with TrIPE; if not, write to the Free Software Foundation,
24 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
25 */
26
410c8acf 27/*----- Header files ------------------------------------------------------*/
28
29#include "tripe.h"
30
410c8acf 31/*----- Handy macros ------------------------------------------------------*/
32
33#define KEYOK(ks, now) ((ks)->sz_exp > 0 && (ks)->t_exp > now)
34
b5c45da1 35#define SEQSZ 4 /* Size of sequence number packet */
36
426c0bc6 37/*----- Low-level packet encryption and decryption ------------------------*/
410c8acf 38
59d670e7 39/* --- Encrypted data format --- *
40 *
7ed14135 41 * Let %$p_i$% be the %$i$%-th plaintext message, with type %$t$%. We first
e04c2d50 42 * compute
59d670e7 43 *
44 * %$c_i = \mathcal{E}\textrm{-CBC}_{K_{\text{E}}}(p_i)$%
45 *
46 * as the CBC-ciphertext of %$p_i$%, and then
47 *
7ed14135 48 * %$\sigma_i = \mathcal{T}_{K_{\text{M}}}(t, i, c_i)$%
59d670e7 49 *
50 * as a MAC on the %%\emph{ciphertext}%%. The message sent is then the pair
51 * %$(\sigma_i, c_i)$%. This construction is provably secure in the NM-CCA
52 * sense (assuming that the cipher is IND-CPA, and the MAC is SUF-CMA)
53 * [Bellare and Namprempre].
54 *
55 * This also ensures that, assuming the key is good, we have a secure channel
56 * [Krawczyk]. Actually, [Krawczyk] shows that, if the cipher is either a
57 * simple stream cipher or a block cipher in CBC mode, we can use the MAC-
58 * then-encrypt scheme and still have a secure channel. However, I like the
59 * NM-CCA guarantee from [Bellare and Namprempre]. I'm less worried about
60 * the Horton Principle [Wagner and Schneier].
61 */
62
426c0bc6 63/* --- @doencrypt@ --- *
410c8acf 64 *
426c0bc6 65 * Arguments: @keyset *ks@ = pointer to keyset to use
7ed14135 66 * @unsigned ty@ = type of message this is
426c0bc6 67 * @buf *b@ = pointer to an input buffer
68 * @buf *bb@ = pointer to an output buffer
410c8acf 69 *
a50f9a0e
MW
70 * Returns: Zero if OK; @KSERR_REGEN@ if it's time to generate new keys.
71 * Also returns zero if there was insufficient buffer space, but
72 * the buffer is broken in this case.
410c8acf 73 *
426c0bc6 74 * Use: Encrypts a message with the given key. We assume that the
75 * keyset is OK to use.
410c8acf 76 */
77
7ed14135 78static int doencrypt(keyset *ks, unsigned ty, buf *b, buf *bb)
410c8acf 79{
426c0bc6 80 ghash *h;
b5c45da1 81 gcipher *c = ks->cout;
426c0bc6 82 const octet *p = BCUR(b);
83 size_t sz = BLEFT(b);
59d670e7 84 octet *qmac, *qseq, *qiv, *qpk;
426c0bc6 85 uint32 oseq;
b5c45da1 86 size_t ivsz = GC_CLASS(c)->blksz;
87 size_t tagsz = ks->tagsz;
426c0bc6 88 size_t osz, nsz;
7ed14135 89 octet t[4];
426c0bc6 90 int rc = 0;
91
92 /* --- Allocate the required buffer space --- */
93
b5c45da1 94 if (buf_ensure(bb, tagsz + SEQSZ + ivsz + sz))
426c0bc6 95 return (0); /* Caution! */
b5c45da1 96 qmac = BCUR(bb); qseq = qmac + tagsz; qiv = qseq + SEQSZ; qpk = qiv + ivsz;
97 BSTEP(bb, tagsz + SEQSZ + ivsz + sz);
7ed14135 98 STORE32(t, ty);
426c0bc6 99
426c0bc6 100 oseq = ks->oseq++; STORE32(qseq, oseq);
426c0bc6 101 IF_TRACING(T_KEYSET, {
102 trace(T_KEYSET, "keyset: encrypting packet %lu using keyset %u",
103 (unsigned long)oseq, ks->seq);
b5c45da1 104 trace_block(T_CRYPTO, "crypto: plaintext packet", p, sz);
426c0bc6 105 })
59d670e7 106
b5c45da1 107 /* --- Encrypt the packet --- */
59d670e7 108
b5c45da1 109 if (ivsz) {
110 rand_get(RAND_GLOBAL, qiv, ivsz);
111 GC_SETIV(c, qiv);
112 IF_TRACING(T_KEYSET, {
113 trace_block(T_CRYPTO, "crypto: initialization vector", qiv, ivsz);
114 })
115 }
116 GC_ENCRYPT(c, p, qpk, sz);
426c0bc6 117 IF_TRACING(T_KEYSET, {
b5c45da1 118 trace_block(T_CRYPTO, "crypto: encrypted packet", qpk, sz);
426c0bc6 119 })
120
b5c45da1 121 /* --- Now compute the MAC --- */
122
123 if (tagsz) {
124 h = GM_INIT(ks->mout);
125 GH_HASH(h, t, sizeof(t));
126 GH_HASH(h, qseq, SEQSZ + ivsz + sz);
127 memcpy(qmac, GH_DONE(h, 0), tagsz);
128 GH_DESTROY(h);
129 IF_TRACING(T_KEYSET, {
130 trace_block(T_CRYPTO, "crypto: computed MAC", qmac, tagsz);
131 })
132 }
133
426c0bc6 134 /* --- Deduct the packet size from the key's data life --- */
135
136 osz = ks->sz_exp;
137 if (osz > sz)
138 nsz = osz - sz;
139 else
140 nsz = 0;
383a9d71 141 if (osz >= ks->sz_regen && ks->sz_regen > nsz) {
426c0bc6 142 T( trace(T_KEYSET, "keyset: keyset %u data regen limit exceeded -- "
143 "forcing exchange", ks->seq); )
a50f9a0e 144 rc = KSERR_REGEN;
426c0bc6 145 }
146 ks->sz_exp = nsz;
e04c2d50 147 return (rc);
410c8acf 148}
149
426c0bc6 150/* --- @dodecrypt@ --- *
410c8acf 151 *
426c0bc6 152 * Arguments: @keyset *ks@ = pointer to keyset to use
7ed14135 153 * @unsigned ty@ = expected type code
426c0bc6 154 * @buf *b@ = pointer to an input buffer
155 * @buf *bb@ = pointer to an output buffer
156 * @uint32 *seq@ = where to store the sequence number
410c8acf 157 *
a50f9a0e 158 * Returns: Zero on success; @KSERR_DECRYPT@ on failure.
410c8acf 159 *
426c0bc6 160 * Use: Attempts to decrypt a message with the given key. No other
161 * checking (e.g., sequence number checks) is performed. We
162 * assume that the keyset is OK to use, and that there is
163 * sufficient output buffer space reserved. If the decryption
164 * is successful, the buffer pointer is moved past the decrypted
165 * packet, and the packet's sequence number is stored in @*seq@.
410c8acf 166 */
167
7ed14135 168static int dodecrypt(keyset *ks, unsigned ty, buf *b, buf *bb, uint32 *seq)
410c8acf 169{
59d670e7 170 const octet *pmac, *piv, *pseq, *ppk;
426c0bc6 171 size_t psz = BLEFT(b);
172 size_t sz;
173 octet *q = BCUR(bb);
174 ghash *h;
175 gcipher *c = ks->cin;
b5c45da1 176 size_t ivsz = GC_CLASS(c)->blksz;
177 size_t tagsz = ks->tagsz;
426c0bc6 178 octet *mac;
179 int eq;
7ed14135 180 octet t[4];
426c0bc6 181
182 /* --- Break up the packet into its components --- */
183
b5c45da1 184 if (psz < ivsz + SEQSZ + tagsz) {
426c0bc6 185 T( trace(T_KEYSET, "keyset: block too small for keyset %u", ks->seq); )
12a26b8b 186 return (KSERR_MALFORMED);
410c8acf 187 }
b5c45da1 188 sz = psz - ivsz - SEQSZ - tagsz;
189 pmac = BCUR(b); pseq = pmac + tagsz; piv = pseq + SEQSZ; ppk = piv + ivsz;
7ed14135 190 STORE32(t, ty);
426c0bc6 191
426c0bc6 192 IF_TRACING(T_KEYSET, {
193 trace(T_KEYSET, "keyset: decrypting using keyset %u", ks->seq);
b5c45da1 194 trace_block(T_CRYPTO, "crypto: ciphertext packet", ppk, sz);
426c0bc6 195 })
b5c45da1 196
197 /* --- Verify the MAC on the packet --- */
198
199 if (tagsz) {
200 h = GM_INIT(ks->min);
201 GH_HASH(h, t, sizeof(t));
202 GH_HASH(h, pseq, SEQSZ + ivsz + sz);
203 mac = GH_DONE(h, 0);
204 eq = !memcmp(mac, pmac, tagsz);
426c0bc6 205 IF_TRACING(T_KEYSET, {
b5c45da1 206 trace_block(T_CRYPTO, "crypto: computed MAC", mac, tagsz);
426c0bc6 207 })
b5c45da1 208 GH_DESTROY(h);
209 if (!eq) {
210 IF_TRACING(T_KEYSET, {
211 trace(T_KEYSET, "keyset: incorrect MAC: decryption failed");
212 trace_block(T_CRYPTO, "crypto: expected MAC", pmac, tagsz);
213 })
a50f9a0e 214 return (KSERR_DECRYPT);
b5c45da1 215 }
426c0bc6 216 }
59d670e7 217
218 /* --- Decrypt the packet --- */
219
b5c45da1 220 if (ivsz) {
221 GC_SETIV(c, piv);
222 IF_TRACING(T_KEYSET, {
223 trace_block(T_CRYPTO, "crypto: initialization vector", piv, ivsz);
224 })
225 }
226 GC_DECRYPT(c, ppk, q, sz);
426c0bc6 227 if (seq)
228 *seq = LOAD32(pseq);
229 IF_TRACING(T_KEYSET, {
230 trace(T_KEYSET, "keyset: decrypted OK (sequence = %lu)",
231 (unsigned long)LOAD32(pseq));
232 trace_block(T_CRYPTO, "crypto: decrypted packet", q, sz);
233 })
234 BSTEP(bb, sz);
235 return (0);
410c8acf 236}
237
426c0bc6 238/*----- Operations on a single keyset -------------------------------------*/
239
240/* --- @ks_drop@ --- *
241 *
242 * Arguments: @keyset *ks@ = pointer to a keyset
243 *
244 * Returns: ---
245 *
246 * Use: Decrements a keyset's reference counter. If the counter hits
247 * zero, the keyset is freed.
248 */
249
250void ks_drop(keyset *ks)
251{
252 if (--ks->ref)
253 return;
b5c45da1 254 GC_DESTROY(ks->cin);
255 GC_DESTROY(ks->cout);
256 GM_DESTROY(ks->min);
257 GM_DESTROY(ks->mout);
426c0bc6 258 DESTROY(ks);
410c8acf 259}
260
261/* --- @ks_gen@ --- *
262 *
426c0bc6 263 * Arguments: @const void *k@ = pointer to key material
264 * @size_t x, y, z@ = offsets into key material (see below)
e04c2d50 265 * @peer *p@ = pointer to peer information
410c8acf 266 *
426c0bc6 267 * Returns: A pointer to the new keyset.
410c8acf 268 *
426c0bc6 269 * Use: Derives a new keyset from the given key material. The
270 * offsets @x@, @y@ and @z@ separate the key material into three
271 * parts. Between the @k@ and @k + x@ is `my' contribution to
272 * the key material; between @k + x@ and @k + y@ is `your'
273 * contribution; and between @k + y@ and @k + z@ is a shared
274 * value we made together. These are used to construct two
275 * pairs of symmetric keys. Each pair consists of an encryption
276 * key and a message authentication key. One pair is used for
277 * outgoing messages, the other for incoming messages.
278 *
279 * The new key is marked so that it won't be selected for output
280 * by @ksl_encrypt@. You can still encrypt data with it by
281 * calling @ks_encrypt@ directly.
410c8acf 282 */
283
9466fafa 284keyset *ks_gen(const void *k, size_t x, size_t y, size_t z, peer *p)
410c8acf 285{
b5c45da1 286 ghash *h;
287 const octet *hh;
410c8acf 288 keyset *ks = CREATE(keyset);
289 time_t now = time(0);
9466fafa 290 const octet *pp = k;
410c8acf 291 T( static unsigned seq = 0; )
292
293 T( trace(T_KEYSET, "keyset: adding new keyset %u", seq); )
294
426c0bc6 295 /* --- Construct the various keys --- *
296 *
297 * This is done with macros, because it's quite tedious.
298 */
299
b5c45da1 300#define MINE GH_HASH(h, pp, x)
301#define YOURS GH_HASH(h, pp + x, y - x)
302#define OURS GH_HASH(h, pp + y, z - y)
303
304#define HASH_in MINE; YOURS; OURS
305#define HASH_out YOURS; MINE; OURS
306#define INIT_c(k) GC_INIT(algs.c, (k), algs.cksz)
307#define INIT_m(k) GM_KEY(algs.m, (k), algs.mksz)
308#define STR_c "encryption"
309#define STR_m "integrity"
310#define STR_in "incoming"
311#define STR_out "outgoing"
312
313#define SETKEY(a, dir) do { \
314 h = GH_INIT(algs.h); \
315 HASH_STRING(h, "tripe-" STR_##a); \
316 HASH_##dir; \
317 hh = GH_DONE(h, 0); \
410c8acf 318 IF_TRACING(T_KEYSET, { \
b5c45da1 319 trace_block(T_CRYPTO, "crypto: " STR_##dir " key " STR_##a, \
320 hh, algs.a##ksz); \
410c8acf 321 }) \
b5c45da1 322 ks->a##dir = INIT_##a(hh); \
323 GH_DESTROY(h); \
410c8acf 324} while (0)
325
b5c45da1 326 SETKEY(c, in); SETKEY(c, out);
327 SETKEY(m, in); SETKEY(m, out);
426c0bc6 328
329#undef MINE
330#undef YOURS
331#undef OURS
b5c45da1 332#undef STR_c
333#undef STR_m
334#undef STR_in
335#undef STR_out
336#undef INIT_c
337#undef INIT_m
338#undef HASH_in
339#undef HASH_out
340#undef SETKEY
410c8acf 341
342 T( ks->seq = seq++; )
e945d6e4 343 ks->ref = 1;
426c0bc6 344 ks->t_exp = now + T_EXP;
383a9d71
MW
345 ks->sz_exp = algs.expsz;
346 ks->sz_regen = algs.expsz/2;
37941236 347 ks->oseq = 0;
348 seq_reset(&ks->iseq);
426c0bc6 349 ks->next = 0;
9466fafa 350 ks->p = p;
426c0bc6 351 ks->f = KSF_LISTEN;
b5c45da1 352 ks->tagsz = algs.tagsz;
426c0bc6 353 return (ks);
354}
355
426c0bc6 356/* --- @ks_activate@ --- *
357 *
358 * Arguments: @keyset *ks@ = pointer to a keyset
359 *
360 * Returns: ---
361 *
362 * Use: Activates a keyset, so that it can be used for encrypting
363 * outgoing messages.
364 */
365
366void ks_activate(keyset *ks)
367{
368 if (ks->f & KSF_LISTEN) {
369 T( trace(T_KEYSET, "keyset: activating keyset %u", ks->seq); )
370 ks->f &= ~KSF_LISTEN;
371 }
410c8acf 372}
373
374/* --- @ks_encrypt@ --- *
375 *
426c0bc6 376 * Arguments: @keyset *ks@ = pointer to a keyset
7ed14135 377 * @unsigned ty@ = message type
426c0bc6 378 * @buf *b@ = pointer to input buffer
379 * @buf *bb@ = pointer to output buffer
380 *
a50f9a0e
MW
381 * Returns: Zero if successful; @KSERR_REGEN@ if we should negotiate a
382 * new key; @KSERR_NOKEYS@ if the key is not usable. Also
383 * returns zero if there was insufficient buffer (but the output
384 * buffer is broken in this case).
426c0bc6 385 *
386 * Use: Encrypts a block of data using the key. Note that the `key
387 * ought to be replaced' notification is only ever given once
388 * for each key. Also note that this call forces a keyset to be
389 * used even if it's marked as not for data output.
390 */
391
7ed14135 392int ks_encrypt(keyset *ks, unsigned ty, buf *b, buf *bb)
426c0bc6 393{
394 time_t now = time(0);
395
396 if (!KEYOK(ks, now)) {
397 buf_break(bb);
a50f9a0e 398 return (KSERR_NOKEYS);
426c0bc6 399 }
7ed14135 400 return (doencrypt(ks, ty, b, bb));
426c0bc6 401}
402
403/* --- @ks_decrypt@ --- *
404 *
405 * Arguments: @keyset *ks@ = pointer to a keyset
7ed14135 406 * @unsigned ty@ = expected type code
426c0bc6 407 * @buf *b@ = pointer to an input buffer
408 * @buf *bb@ = pointer to an output buffer
409 *
12a26b8b 410 * Returns: Zero on success; @KSERR_...@ on failure. Also returns
a50f9a0e
MW
411 * zero if there was insufficient buffer (but the output buffer
412 * is broken in this case).
426c0bc6 413 *
414 * Use: Attempts to decrypt a message using a given key. Note that
415 * requesting decryption with a key directly won't clear a
416 * marking that it's not for encryption.
417 */
418
7ed14135 419int ks_decrypt(keyset *ks, unsigned ty, buf *b, buf *bb)
426c0bc6 420{
421 time_t now = time(0);
422 uint32 seq;
12a26b8b 423 int err;
426c0bc6 424
12a26b8b
MW
425 if (!KEYOK(ks, now)) return (KSERR_DECRYPT);
426 if (buf_ensure(bb, BLEN(b))) return (0);
427 if ((err = dodecrypt(ks, ty, b, bb, &seq)) != 0) return (err);
428 if (seq_check(&ks->iseq, seq, "SYMM")) return (KSERR_SEQ);
426c0bc6 429 return (0);
430}
431
432/*----- Keyset list handling ----------------------------------------------*/
433
434/* --- @ksl_free@ --- *
435 *
436 * Arguments: @keyset **ksroot@ = pointer to keyset list head
437 *
438 * Returns: ---
439 *
440 * Use: Frees (releases references to) all of the keys in a keyset.
441 */
442
443void ksl_free(keyset **ksroot)
444{
445 keyset *ks, *ksn;
446 for (ks = *ksroot; ks; ks = ksn) {
447 ksn = ks->next;
448 ks->f &= ~KSF_LINK;
449 ks_drop(ks);
450 }
451}
452
453/* --- @ksl_link@ --- *
454 *
455 * Arguments: @keyset **ksroot@ = pointer to keyset list head
456 * @keyset *ks@ = pointer to a keyset
457 *
458 * Returns: ---
459 *
460 * Use: Links a keyset into a list. A keyset can only be on one list
461 * at a time. Bad things happen otherwise.
462 */
463
464void ksl_link(keyset **ksroot, keyset *ks)
465{
466 assert(!(ks->f & KSF_LINK));
467 ks->next = *ksroot;
468 *ksroot = ks;
469 ks->f |= KSF_LINK;
470 ks->ref++;
471}
472
473/* --- @ksl_prune@ --- *
474 *
475 * Arguments: @keyset **ksroot@ = pointer to keyset list head
476 *
477 * Returns: ---
478 *
479 * Use: Prunes the keyset list by removing keys which mustn't be used
480 * any more.
481 */
482
483void ksl_prune(keyset **ksroot)
484{
485 time_t now = time(0);
486
487 while (*ksroot) {
488 keyset *ks = *ksroot;
489
490 if (ks->t_exp <= now) {
491 T( trace(T_KEYSET, "keyset: expiring keyset %u (time limit reached)",
492 ks->seq); )
493 goto kill;
494 } else if (ks->sz_exp == 0) {
495 T( trace(T_KEYSET, "keyset: expiring keyset %u (data limit reached)",
496 ks->seq); )
497 goto kill;
498 } else {
499 ksroot = &ks->next;
500 continue;
501 }
502
503 kill:
504 *ksroot = ks->next;
505 ks->f &= ~KSF_LINK;
506 ks_drop(ks);
507 }
508}
509
510/* --- @ksl_encrypt@ --- *
511 *
410c8acf 512 * Arguments: @keyset **ksroot@ = pointer to keyset list head
7ed14135 513 * @unsigned ty@ = message type
410c8acf 514 * @buf *b@ = pointer to input buffer
515 * @buf *bb@ = pointer to output buffer
516 *
a50f9a0e
MW
517 * Returns: Zero if successful; @KSERR_REGEN@ if it's time to negotiate a
518 * new key; @KSERR_NOKEYS@ if there are no suitable keys
519 * available. Also returns zero if there was insufficient
520 * buffer space (but the output buffer is broken in this case).
410c8acf 521 *
522 * Use: Encrypts a packet.
523 */
524
7ed14135 525int ksl_encrypt(keyset **ksroot, unsigned ty, buf *b, buf *bb)
410c8acf 526{
527 time_t now = time(0);
426c0bc6 528 keyset *ks = *ksroot;
410c8acf 529
410c8acf 530 for (;;) {
531 if (!ks) {
426c0bc6 532 T( trace(T_KEYSET, "keyset: no suitable keysets found"); )
410c8acf 533 buf_break(bb);
a50f9a0e 534 return (KSERR_NOKEYS);
410c8acf 535 }
426c0bc6 536 if (KEYOK(ks, now) && !(ks->f & KSF_LISTEN))
410c8acf 537 break;
538 ks = ks->next;
539 }
540
7ed14135 541 return (doencrypt(ks, ty, b, bb));
410c8acf 542}
543
426c0bc6 544/* --- @ksl_decrypt@ --- *
410c8acf 545 *
546 * Arguments: @keyset **ksroot@ = pointer to keyset list head
7ed14135 547 * @unsigned ty@ = expected type code
410c8acf 548 * @buf *b@ = pointer to input buffer
549 * @buf *bb@ = pointer to output buffer
550 *
a50f9a0e
MW
551 * Returns: Zero on success; @KSERR_DECRYPT@ on failure. Also returns
552 * zero if there was insufficient buffer (but the output buffer
553 * is broken in this case).
410c8acf 554 *
555 * Use: Decrypts a packet.
556 */
557
7ed14135 558int ksl_decrypt(keyset **ksroot, unsigned ty, buf *b, buf *bb)
410c8acf 559{
560 time_t now = time(0);
410c8acf 561 keyset *ks;
426c0bc6 562 uint32 seq;
12a26b8b 563 int err;
410c8acf 564
426c0bc6 565 if (buf_ensure(bb, BLEN(b)))
12a26b8b 566 return (0);
09585a65 567
410c8acf 568 for (ks = *ksroot; ks; ks = ks->next) {
410c8acf 569 if (!KEYOK(ks, now))
570 continue;
12a26b8b 571 if ((err = dodecrypt(ks, ty, b, bb, &seq)) == 0) {
426c0bc6 572 if (ks->f & KSF_LISTEN) {
573 T( trace(T_KEYSET, "keyset: implicitly activating keyset %u",
574 ks->seq); )
575 ks->f &= ~KSF_LISTEN;
576 }
a50f9a0e 577 if (seq_check(&ks->iseq, seq, "SYMM"))
12a26b8b 578 return (KSERR_SEQ);
a50f9a0e
MW
579 else
580 return (0);
410c8acf 581 }
12a26b8b 582 if (err != KSERR_DECRYPT) return (err);
410c8acf 583 }
e945d6e4 584 T( trace(T_KEYSET, "keyset: no matching keys, or incorrect MAC"); )
a50f9a0e 585 return (KSERR_DECRYPT);
410c8acf 586}
587
588/*----- That's all, folks -------------------------------------------------*/