chiark / gitweb /
server/tun-slip.c: Fix signed/unsigned char mismatch.
[tripe] / server / keyset.c
CommitLineData
410c8acf 1/* -*-c-*-
2 *
410c8acf 3 * Handling of symmetric keysets
4 *
5 * (c) 2001 Straylight/Edgeware
6 */
7
e04c2d50 8/*----- Licensing notice --------------------------------------------------*
410c8acf 9 *
10 * This file is part of Trivial IP Encryption (TrIPE).
11 *
12 * TrIPE is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU General Public License as published by
14 * the Free Software Foundation; either version 2 of the License, or
15 * (at your option) any later version.
e04c2d50 16 *
410c8acf 17 * TrIPE is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
e04c2d50 21 *
410c8acf 22 * You should have received a copy of the GNU General Public License
23 * along with TrIPE; if not, write to the Free Software Foundation,
24 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
25 */
26
410c8acf 27/*----- Header files ------------------------------------------------------*/
28
29#include "tripe.h"
30
410c8acf 31/*----- Handy macros ------------------------------------------------------*/
32
33#define KEYOK(ks, now) ((ks)->sz_exp > 0 && (ks)->t_exp > now)
34
b5c45da1 35#define SEQSZ 4 /* Size of sequence number packet */
36
426c0bc6 37/*----- Low-level packet encryption and decryption ------------------------*/
410c8acf 38
59d670e7 39/* --- Encrypted data format --- *
40 *
7ed14135 41 * Let %$p_i$% be the %$i$%-th plaintext message, with type %$t$%. We first
e04c2d50 42 * compute
59d670e7 43 *
44 * %$c_i = \mathcal{E}\textrm{-CBC}_{K_{\text{E}}}(p_i)$%
45 *
46 * as the CBC-ciphertext of %$p_i$%, and then
47 *
7ed14135 48 * %$\sigma_i = \mathcal{T}_{K_{\text{M}}}(t, i, c_i)$%
59d670e7 49 *
50 * as a MAC on the %%\emph{ciphertext}%%. The message sent is then the pair
51 * %$(\sigma_i, c_i)$%. This construction is provably secure in the NM-CCA
52 * sense (assuming that the cipher is IND-CPA, and the MAC is SUF-CMA)
53 * [Bellare and Namprempre].
54 *
55 * This also ensures that, assuming the key is good, we have a secure channel
56 * [Krawczyk]. Actually, [Krawczyk] shows that, if the cipher is either a
57 * simple stream cipher or a block cipher in CBC mode, we can use the MAC-
58 * then-encrypt scheme and still have a secure channel. However, I like the
59 * NM-CCA guarantee from [Bellare and Namprempre]. I'm less worried about
60 * the Horton Principle [Wagner and Schneier].
61 */
62
426c0bc6 63/* --- @doencrypt@ --- *
410c8acf 64 *
426c0bc6 65 * Arguments: @keyset *ks@ = pointer to keyset to use
7ed14135 66 * @unsigned ty@ = type of message this is
426c0bc6 67 * @buf *b@ = pointer to an input buffer
68 * @buf *bb@ = pointer to an output buffer
410c8acf 69 *
a50f9a0e
MW
70 * Returns: Zero if OK; @KSERR_REGEN@ if it's time to generate new keys.
71 * Also returns zero if there was insufficient buffer space, but
72 * the buffer is broken in this case.
410c8acf 73 *
426c0bc6 74 * Use: Encrypts a message with the given key. We assume that the
75 * keyset is OK to use.
410c8acf 76 */
77
7ed14135 78static int doencrypt(keyset *ks, unsigned ty, buf *b, buf *bb)
410c8acf 79{
426c0bc6 80 ghash *h;
b5c45da1 81 gcipher *c = ks->cout;
426c0bc6 82 const octet *p = BCUR(b);
83 size_t sz = BLEFT(b);
59d670e7 84 octet *qmac, *qseq, *qiv, *qpk;
426c0bc6 85 uint32 oseq;
b5c45da1 86 size_t ivsz = GC_CLASS(c)->blksz;
87 size_t tagsz = ks->tagsz;
426c0bc6 88 size_t osz, nsz;
7ed14135 89 octet t[4];
426c0bc6 90 int rc = 0;
91
92 /* --- Allocate the required buffer space --- */
93
b5c45da1 94 if (buf_ensure(bb, tagsz + SEQSZ + ivsz + sz))
426c0bc6 95 return (0); /* Caution! */
b5c45da1 96 qmac = BCUR(bb); qseq = qmac + tagsz; qiv = qseq + SEQSZ; qpk = qiv + ivsz;
97 BSTEP(bb, tagsz + SEQSZ + ivsz + sz);
7ed14135 98 STORE32(t, ty);
426c0bc6 99
426c0bc6 100 oseq = ks->oseq++; STORE32(qseq, oseq);
426c0bc6 101 IF_TRACING(T_KEYSET, {
102 trace(T_KEYSET, "keyset: encrypting packet %lu using keyset %u",
103 (unsigned long)oseq, ks->seq);
b5c45da1 104 trace_block(T_CRYPTO, "crypto: plaintext packet", p, sz);
426c0bc6 105 })
59d670e7 106
b5c45da1 107 /* --- Encrypt the packet --- */
59d670e7 108
b5c45da1 109 if (ivsz) {
110 rand_get(RAND_GLOBAL, qiv, ivsz);
111 GC_SETIV(c, qiv);
112 IF_TRACING(T_KEYSET, {
113 trace_block(T_CRYPTO, "crypto: initialization vector", qiv, ivsz);
114 })
115 }
116 GC_ENCRYPT(c, p, qpk, sz);
426c0bc6 117 IF_TRACING(T_KEYSET, {
b5c45da1 118 trace_block(T_CRYPTO, "crypto: encrypted packet", qpk, sz);
426c0bc6 119 })
120
b5c45da1 121 /* --- Now compute the MAC --- */
122
123 if (tagsz) {
124 h = GM_INIT(ks->mout);
125 GH_HASH(h, t, sizeof(t));
126 GH_HASH(h, qseq, SEQSZ + ivsz + sz);
127 memcpy(qmac, GH_DONE(h, 0), tagsz);
128 GH_DESTROY(h);
129 IF_TRACING(T_KEYSET, {
130 trace_block(T_CRYPTO, "crypto: computed MAC", qmac, tagsz);
131 })
132 }
133
426c0bc6 134 /* --- Deduct the packet size from the key's data life --- */
135
136 osz = ks->sz_exp;
137 if (osz > sz)
138 nsz = osz - sz;
139 else
140 nsz = 0;
383a9d71 141 if (osz >= ks->sz_regen && ks->sz_regen > nsz) {
426c0bc6 142 T( trace(T_KEYSET, "keyset: keyset %u data regen limit exceeded -- "
143 "forcing exchange", ks->seq); )
a50f9a0e 144 rc = KSERR_REGEN;
426c0bc6 145 }
146 ks->sz_exp = nsz;
e04c2d50 147 return (rc);
410c8acf 148}
149
426c0bc6 150/* --- @dodecrypt@ --- *
410c8acf 151 *
426c0bc6 152 * Arguments: @keyset *ks@ = pointer to keyset to use
7ed14135 153 * @unsigned ty@ = expected type code
426c0bc6 154 * @buf *b@ = pointer to an input buffer
155 * @buf *bb@ = pointer to an output buffer
156 * @uint32 *seq@ = where to store the sequence number
410c8acf 157 *
a50f9a0e 158 * Returns: Zero on success; @KSERR_DECRYPT@ on failure.
410c8acf 159 *
426c0bc6 160 * Use: Attempts to decrypt a message with the given key. No other
161 * checking (e.g., sequence number checks) is performed. We
162 * assume that the keyset is OK to use, and that there is
163 * sufficient output buffer space reserved. If the decryption
164 * is successful, the buffer pointer is moved past the decrypted
165 * packet, and the packet's sequence number is stored in @*seq@.
410c8acf 166 */
167
7ed14135 168static int dodecrypt(keyset *ks, unsigned ty, buf *b, buf *bb, uint32 *seq)
410c8acf 169{
59d670e7 170 const octet *pmac, *piv, *pseq, *ppk;
426c0bc6 171 size_t psz = BLEFT(b);
172 size_t sz;
173 octet *q = BCUR(bb);
174 ghash *h;
175 gcipher *c = ks->cin;
b5c45da1 176 size_t ivsz = GC_CLASS(c)->blksz;
177 size_t tagsz = ks->tagsz;
426c0bc6 178 octet *mac;
179 int eq;
7ed14135 180 octet t[4];
426c0bc6 181
182 /* --- Break up the packet into its components --- */
183
b5c45da1 184 if (psz < ivsz + SEQSZ + tagsz) {
426c0bc6 185 T( trace(T_KEYSET, "keyset: block too small for keyset %u", ks->seq); )
12a26b8b 186 return (KSERR_MALFORMED);
410c8acf 187 }
b5c45da1 188 sz = psz - ivsz - SEQSZ - tagsz;
189 pmac = BCUR(b); pseq = pmac + tagsz; piv = pseq + SEQSZ; ppk = piv + ivsz;
7ed14135 190 STORE32(t, ty);
426c0bc6 191
426c0bc6 192 IF_TRACING(T_KEYSET, {
193 trace(T_KEYSET, "keyset: decrypting using keyset %u", ks->seq);
b5c45da1 194 trace_block(T_CRYPTO, "crypto: ciphertext packet", ppk, sz);
426c0bc6 195 })
b5c45da1 196
197 /* --- Verify the MAC on the packet --- */
198
199 if (tagsz) {
200 h = GM_INIT(ks->min);
201 GH_HASH(h, t, sizeof(t));
202 GH_HASH(h, pseq, SEQSZ + ivsz + sz);
203 mac = GH_DONE(h, 0);
04ed79b8 204 eq = ct_memeq(mac, pmac, tagsz);
426c0bc6 205 IF_TRACING(T_KEYSET, {
b5c45da1 206 trace_block(T_CRYPTO, "crypto: computed MAC", mac, tagsz);
426c0bc6 207 })
b5c45da1 208 GH_DESTROY(h);
209 if (!eq) {
210 IF_TRACING(T_KEYSET, {
211 trace(T_KEYSET, "keyset: incorrect MAC: decryption failed");
212 trace_block(T_CRYPTO, "crypto: expected MAC", pmac, tagsz);
213 })
a50f9a0e 214 return (KSERR_DECRYPT);
b5c45da1 215 }
426c0bc6 216 }
59d670e7 217
218 /* --- Decrypt the packet --- */
219
b5c45da1 220 if (ivsz) {
221 GC_SETIV(c, piv);
222 IF_TRACING(T_KEYSET, {
223 trace_block(T_CRYPTO, "crypto: initialization vector", piv, ivsz);
224 })
225 }
226 GC_DECRYPT(c, ppk, q, sz);
426c0bc6 227 if (seq)
228 *seq = LOAD32(pseq);
229 IF_TRACING(T_KEYSET, {
230 trace(T_KEYSET, "keyset: decrypted OK (sequence = %lu)",
231 (unsigned long)LOAD32(pseq));
232 trace_block(T_CRYPTO, "crypto: decrypted packet", q, sz);
233 })
234 BSTEP(bb, sz);
235 return (0);
410c8acf 236}
237
426c0bc6 238/*----- Operations on a single keyset -------------------------------------*/
239
240/* --- @ks_drop@ --- *
241 *
242 * Arguments: @keyset *ks@ = pointer to a keyset
243 *
244 * Returns: ---
245 *
246 * Use: Decrements a keyset's reference counter. If the counter hits
247 * zero, the keyset is freed.
248 */
249
250void ks_drop(keyset *ks)
251{
252 if (--ks->ref)
253 return;
b5c45da1 254 GC_DESTROY(ks->cin);
255 GC_DESTROY(ks->cout);
256 GM_DESTROY(ks->min);
257 GM_DESTROY(ks->mout);
426c0bc6 258 DESTROY(ks);
410c8acf 259}
260
261/* --- @ks_gen@ --- *
262 *
426c0bc6 263 * Arguments: @const void *k@ = pointer to key material
264 * @size_t x, y, z@ = offsets into key material (see below)
e04c2d50 265 * @peer *p@ = pointer to peer information
410c8acf 266 *
426c0bc6 267 * Returns: A pointer to the new keyset.
410c8acf 268 *
426c0bc6 269 * Use: Derives a new keyset from the given key material. The
270 * offsets @x@, @y@ and @z@ separate the key material into three
271 * parts. Between the @k@ and @k + x@ is `my' contribution to
272 * the key material; between @k + x@ and @k + y@ is `your'
273 * contribution; and between @k + y@ and @k + z@ is a shared
274 * value we made together. These are used to construct two
275 * pairs of symmetric keys. Each pair consists of an encryption
276 * key and a message authentication key. One pair is used for
277 * outgoing messages, the other for incoming messages.
278 *
279 * The new key is marked so that it won't be selected for output
280 * by @ksl_encrypt@. You can still encrypt data with it by
281 * calling @ks_encrypt@ directly.
410c8acf 282 */
283
9466fafa 284keyset *ks_gen(const void *k, size_t x, size_t y, size_t z, peer *p)
410c8acf 285{
b5c45da1 286 ghash *h;
287 const octet *hh;
410c8acf 288 keyset *ks = CREATE(keyset);
289 time_t now = time(0);
9466fafa 290 const octet *pp = k;
35c8b547 291 const algswitch *algs = &p->kx.kpriv->algs;
410c8acf 292 T( static unsigned seq = 0; )
293
294 T( trace(T_KEYSET, "keyset: adding new keyset %u", seq); )
295
426c0bc6 296 /* --- Construct the various keys --- *
297 *
298 * This is done with macros, because it's quite tedious.
299 */
300
b5c45da1 301#define MINE GH_HASH(h, pp, x)
302#define YOURS GH_HASH(h, pp + x, y - x)
303#define OURS GH_HASH(h, pp + y, z - y)
304
305#define HASH_in MINE; YOURS; OURS
306#define HASH_out YOURS; MINE; OURS
35c8b547
MW
307#define INIT_c(k) GC_INIT(algs->c, (k), algs->cksz)
308#define INIT_m(k) GM_KEY(algs->m, (k), algs->mksz)
b5c45da1 309#define STR_c "encryption"
310#define STR_m "integrity"
311#define STR_in "incoming"
312#define STR_out "outgoing"
313
314#define SETKEY(a, dir) do { \
35c8b547 315 h = GH_INIT(algs->h); \
b5c45da1 316 HASH_STRING(h, "tripe-" STR_##a); \
317 HASH_##dir; \
318 hh = GH_DONE(h, 0); \
410c8acf 319 IF_TRACING(T_KEYSET, { \
b5c45da1 320 trace_block(T_CRYPTO, "crypto: " STR_##dir " key " STR_##a, \
35c8b547 321 hh, algs->a##ksz); \
410c8acf 322 }) \
b5c45da1 323 ks->a##dir = INIT_##a(hh); \
324 GH_DESTROY(h); \
410c8acf 325} while (0)
326
b5c45da1 327 SETKEY(c, in); SETKEY(c, out);
328 SETKEY(m, in); SETKEY(m, out);
426c0bc6 329
330#undef MINE
331#undef YOURS
332#undef OURS
b5c45da1 333#undef STR_c
334#undef STR_m
335#undef STR_in
336#undef STR_out
337#undef INIT_c
338#undef INIT_m
339#undef HASH_in
340#undef HASH_out
341#undef SETKEY
410c8acf 342
343 T( ks->seq = seq++; )
e945d6e4 344 ks->ref = 1;
426c0bc6 345 ks->t_exp = now + T_EXP;
35c8b547
MW
346 ks->sz_exp = algs->expsz;
347 ks->sz_regen = algs->expsz/2;
37941236 348 ks->oseq = 0;
349 seq_reset(&ks->iseq);
426c0bc6 350 ks->next = 0;
9466fafa 351 ks->p = p;
426c0bc6 352 ks->f = KSF_LISTEN;
35c8b547 353 ks->tagsz = algs->tagsz;
426c0bc6 354 return (ks);
355}
356
426c0bc6 357/* --- @ks_activate@ --- *
358 *
359 * Arguments: @keyset *ks@ = pointer to a keyset
360 *
361 * Returns: ---
362 *
363 * Use: Activates a keyset, so that it can be used for encrypting
364 * outgoing messages.
365 */
366
367void ks_activate(keyset *ks)
368{
369 if (ks->f & KSF_LISTEN) {
370 T( trace(T_KEYSET, "keyset: activating keyset %u", ks->seq); )
371 ks->f &= ~KSF_LISTEN;
372 }
410c8acf 373}
374
375/* --- @ks_encrypt@ --- *
376 *
426c0bc6 377 * Arguments: @keyset *ks@ = pointer to a keyset
7ed14135 378 * @unsigned ty@ = message type
426c0bc6 379 * @buf *b@ = pointer to input buffer
380 * @buf *bb@ = pointer to output buffer
381 *
a50f9a0e
MW
382 * Returns: Zero if successful; @KSERR_REGEN@ if we should negotiate a
383 * new key; @KSERR_NOKEYS@ if the key is not usable. Also
384 * returns zero if there was insufficient buffer (but the output
385 * buffer is broken in this case).
426c0bc6 386 *
387 * Use: Encrypts a block of data using the key. Note that the `key
388 * ought to be replaced' notification is only ever given once
389 * for each key. Also note that this call forces a keyset to be
390 * used even if it's marked as not for data output.
391 */
392
7ed14135 393int ks_encrypt(keyset *ks, unsigned ty, buf *b, buf *bb)
426c0bc6 394{
395 time_t now = time(0);
396
397 if (!KEYOK(ks, now)) {
398 buf_break(bb);
a50f9a0e 399 return (KSERR_NOKEYS);
426c0bc6 400 }
7ed14135 401 return (doencrypt(ks, ty, b, bb));
426c0bc6 402}
403
404/* --- @ks_decrypt@ --- *
405 *
406 * Arguments: @keyset *ks@ = pointer to a keyset
7ed14135 407 * @unsigned ty@ = expected type code
426c0bc6 408 * @buf *b@ = pointer to an input buffer
409 * @buf *bb@ = pointer to an output buffer
410 *
12a26b8b 411 * Returns: Zero on success; @KSERR_...@ on failure. Also returns
a50f9a0e
MW
412 * zero if there was insufficient buffer (but the output buffer
413 * is broken in this case).
426c0bc6 414 *
415 * Use: Attempts to decrypt a message using a given key. Note that
416 * requesting decryption with a key directly won't clear a
417 * marking that it's not for encryption.
418 */
419
7ed14135 420int ks_decrypt(keyset *ks, unsigned ty, buf *b, buf *bb)
426c0bc6 421{
422 time_t now = time(0);
423 uint32 seq;
12a26b8b 424 int err;
426c0bc6 425
12a26b8b
MW
426 if (!KEYOK(ks, now)) return (KSERR_DECRYPT);
427 if (buf_ensure(bb, BLEN(b))) return (0);
428 if ((err = dodecrypt(ks, ty, b, bb, &seq)) != 0) return (err);
429 if (seq_check(&ks->iseq, seq, "SYMM")) return (KSERR_SEQ);
426c0bc6 430 return (0);
431}
432
433/*----- Keyset list handling ----------------------------------------------*/
434
435/* --- @ksl_free@ --- *
436 *
437 * Arguments: @keyset **ksroot@ = pointer to keyset list head
438 *
439 * Returns: ---
440 *
441 * Use: Frees (releases references to) all of the keys in a keyset.
442 */
443
444void ksl_free(keyset **ksroot)
445{
446 keyset *ks, *ksn;
447 for (ks = *ksroot; ks; ks = ksn) {
448 ksn = ks->next;
449 ks->f &= ~KSF_LINK;
450 ks_drop(ks);
451 }
452}
453
454/* --- @ksl_link@ --- *
455 *
456 * Arguments: @keyset **ksroot@ = pointer to keyset list head
457 * @keyset *ks@ = pointer to a keyset
458 *
459 * Returns: ---
460 *
461 * Use: Links a keyset into a list. A keyset can only be on one list
462 * at a time. Bad things happen otherwise.
463 */
464
465void ksl_link(keyset **ksroot, keyset *ks)
466{
467 assert(!(ks->f & KSF_LINK));
468 ks->next = *ksroot;
469 *ksroot = ks;
470 ks->f |= KSF_LINK;
471 ks->ref++;
472}
473
474/* --- @ksl_prune@ --- *
475 *
476 * Arguments: @keyset **ksroot@ = pointer to keyset list head
477 *
478 * Returns: ---
479 *
480 * Use: Prunes the keyset list by removing keys which mustn't be used
481 * any more.
482 */
483
484void ksl_prune(keyset **ksroot)
485{
486 time_t now = time(0);
487
488 while (*ksroot) {
489 keyset *ks = *ksroot;
490
491 if (ks->t_exp <= now) {
492 T( trace(T_KEYSET, "keyset: expiring keyset %u (time limit reached)",
493 ks->seq); )
494 goto kill;
495 } else if (ks->sz_exp == 0) {
496 T( trace(T_KEYSET, "keyset: expiring keyset %u (data limit reached)",
497 ks->seq); )
498 goto kill;
499 } else {
500 ksroot = &ks->next;
501 continue;
502 }
503
504 kill:
505 *ksroot = ks->next;
506 ks->f &= ~KSF_LINK;
507 ks_drop(ks);
508 }
509}
510
511/* --- @ksl_encrypt@ --- *
512 *
410c8acf 513 * Arguments: @keyset **ksroot@ = pointer to keyset list head
7ed14135 514 * @unsigned ty@ = message type
410c8acf 515 * @buf *b@ = pointer to input buffer
516 * @buf *bb@ = pointer to output buffer
517 *
a50f9a0e
MW
518 * Returns: Zero if successful; @KSERR_REGEN@ if it's time to negotiate a
519 * new key; @KSERR_NOKEYS@ if there are no suitable keys
520 * available. Also returns zero if there was insufficient
521 * buffer space (but the output buffer is broken in this case).
410c8acf 522 *
523 * Use: Encrypts a packet.
524 */
525
7ed14135 526int ksl_encrypt(keyset **ksroot, unsigned ty, buf *b, buf *bb)
410c8acf 527{
528 time_t now = time(0);
426c0bc6 529 keyset *ks = *ksroot;
410c8acf 530
410c8acf 531 for (;;) {
532 if (!ks) {
426c0bc6 533 T( trace(T_KEYSET, "keyset: no suitable keysets found"); )
410c8acf 534 buf_break(bb);
a50f9a0e 535 return (KSERR_NOKEYS);
410c8acf 536 }
426c0bc6 537 if (KEYOK(ks, now) && !(ks->f & KSF_LISTEN))
410c8acf 538 break;
539 ks = ks->next;
540 }
541
7ed14135 542 return (doencrypt(ks, ty, b, bb));
410c8acf 543}
544
426c0bc6 545/* --- @ksl_decrypt@ --- *
410c8acf 546 *
547 * Arguments: @keyset **ksroot@ = pointer to keyset list head
7ed14135 548 * @unsigned ty@ = expected type code
410c8acf 549 * @buf *b@ = pointer to input buffer
550 * @buf *bb@ = pointer to output buffer
551 *
a50f9a0e
MW
552 * Returns: Zero on success; @KSERR_DECRYPT@ on failure. Also returns
553 * zero if there was insufficient buffer (but the output buffer
554 * is broken in this case).
410c8acf 555 *
556 * Use: Decrypts a packet.
557 */
558
7ed14135 559int ksl_decrypt(keyset **ksroot, unsigned ty, buf *b, buf *bb)
410c8acf 560{
561 time_t now = time(0);
410c8acf 562 keyset *ks;
426c0bc6 563 uint32 seq;
12a26b8b 564 int err;
410c8acf 565
426c0bc6 566 if (buf_ensure(bb, BLEN(b)))
12a26b8b 567 return (0);
09585a65 568
410c8acf 569 for (ks = *ksroot; ks; ks = ks->next) {
410c8acf 570 if (!KEYOK(ks, now))
571 continue;
12a26b8b 572 if ((err = dodecrypt(ks, ty, b, bb, &seq)) == 0) {
426c0bc6 573 if (ks->f & KSF_LISTEN) {
574 T( trace(T_KEYSET, "keyset: implicitly activating keyset %u",
575 ks->seq); )
576 ks->f &= ~KSF_LISTEN;
577 }
a50f9a0e 578 if (seq_check(&ks->iseq, seq, "SYMM"))
12a26b8b 579 return (KSERR_SEQ);
a50f9a0e
MW
580 else
581 return (0);
410c8acf 582 }
12a26b8b 583 if (err != KSERR_DECRYPT) return (err);
410c8acf 584 }
e945d6e4 585 T( trace(T_KEYSET, "keyset: no matching keys, or incorrect MAC"); )
a50f9a0e 586 return (KSERR_DECRYPT);
410c8acf 587}
588
589/*----- That's all, folks -------------------------------------------------*/