Initial support for BSD tunnel devices.

[tripe] / keyset.c

/* -*-c-*-
 *
 * $Id: keyset.c,v 1.1 2001/02/03 20:26:37 mdw Exp $
 *
 * Handling of symmetric keysets
 *
 * (c) 2001 Straylight/Edgeware
 */

/*----- Licensing notice --------------------------------------------------* 
 *
 * This file is part of Trivial IP Encryption (TrIPE).
 *
 * TrIPE is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 * 
 * TrIPE is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License
 * along with TrIPE; if not, write to the Free Software Foundation,
 * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

/*----- Revision history --------------------------------------------------* 
 *
 * $Log: keyset.c,v $
 * Revision 1.1  2001/02/03 20:26:37  mdw
 * Initial checkin.
 *
 */

/*----- Header files ------------------------------------------------------*/

#include "tripe.h"

/*----- Tunable parameters ------------------------------------------------*/

#define KEY_EXPTIME MIN(60)		/* Expiry time for a key */
#define KEY_REGENTIME MIN(45)		/* Regeneration time for a key */
#define KEY_EXPSZ MEG(512)		/* Expiry data size for a key */
#define KEY_REGENSZ MEG(256)		/* Data size threshold for regen */

/*----- Handy macros ------------------------------------------------------*/

#define KEYOK(ks, now) ((ks)->sz_exp > 0 && (ks)->t_exp > now)

/*----- Main code ---------------------------------------------------------*/

/* --- @freeks@ --- *
 *
 * Arguments:	@keyset *ks@ = pointer to a keyset
 *
 * Returns:	---
 *
 * Use:		Frees a keyset.
 */

static void freeks(keyset *ks)
{
  ks->c->ops->destroy(ks->c);
  ks->m->ops->destroy(ks->m);
  DESTROY(ks);
}

/* --- @ks_free@ --- *
 *
 * Arguments:	@keyset **ksroot@ = pointer to keyset list head
 *
 * Returns:	---
 *
 * Use:		Frees all of the keys in a keyset.
 */

void ks_free(keyset **ksroot)
{
  keyset *ks, *ksn;
  for (ks = *ksroot; ks; ks = ksn) {
    ksn = ks->next;
    freeks(ks);
  }
}

/* --- @ks_prune@ --- *
 *
 * Arguments:	@keyset **ksroot@ = pointer to keyset list head
 *
 * Returns:	---
 *
 * Use:		Prunes the keyset list by removing keys which mustn't be used
 *		any more.
 */

void ks_prune(keyset **ksroot)
{
  time_t now = time(0);

  while (*ksroot) {
    keyset *ks = *ksroot;
    if (ks->t_exp <= now) {
      T( trace(T_KEYSET, "keyset: expiring keyset %u (time limit reached)",
	       ks->seq); )
      *ksroot = ks->next;
      freeks(ks);
    } else if (ks->sz_exp == 0) {
      T( trace(T_KEYSET, "keyset: expiring keyset %u (data limit reached)",
	       ks->seq); )
      *ksroot = ks->next;
      freeks(ks);
    } else
      ksroot = &ks->next;
  }
}

/* --- @ks_gen@ --- *
 *
 * Arguments:	@keyset **ksroot@ = pointer to keyset list head
 *		@const void *k@ = pointer to key material
 *		@size_t sz@ = size of the key material
 *
 * Returns:	The regeneration time for the new key.
 *
 * Use:		Derives a keyset from the given key material and adds it to
 *		the list.
 */

time_t ks_gen(keyset **ksroot, const void *k, size_t sz)
{
  rmd160_ctx r;
  octet buf[RMD160_HASHSZ];
  keyset *ks = CREATE(keyset);
  time_t now = time(0);
  T( static unsigned seq = 0; )

  T( trace(T_KEYSET, "keyset: adding new keyset %u", seq); )

#define GETHASH(str) do {						\
  rmd160_init(&r);							\
  rmd160_hash(&r, str, sizeof(str) - 1);				\
  rmd160_hash(&r, k, sz);						\
  rmd160_done(&r, buf);							\
  IF_TRACING(T_KEYSET, {						\
    trace_block(T_CRYPTO, "crypto: key " str, buf, sizeof(buf));	\
  })									\
} while (0)

  GETHASH("tripe-encryption "); ks->c = blowfish_cbc.init(buf, sizeof(buf));
  GETHASH("tripe-integrity "); ks->m = rmd160_hmac.key(buf, sizeof(buf));

#undef GETHASH

  T( ks->seq = seq++; )
  ks->t_exp = now + KEY_EXPTIME;
  ks->sz_exp = KEY_EXPSZ;
  ks->next = *ksroot;
  *ksroot = ks;
  BURN(buf);
  return (now + KEY_REGENTIME);
}

/* --- @ks_encrypt@ --- *
 *
 * Arguments:	@keyset **ksroot@ = pointer to keyset list head
 *		@buf *b@ = pointer to input buffer
 *		@buf *bb@ = pointer to output buffer
 *
 * Returns:	Nonzero if a new key is needed.
 *
 * Use:		Encrypts a packet.
 */

int ks_encrypt(keyset **ksroot, buf *b, buf *bb)
{
  time_t now = time(0);
  keyset *ks;
  ghash *h;
  gcipher *c;
  size_t ivsz;
  const octet *p = BCUR(b);
  octet *q = BCUR(bb);
  size_t sz = BLEFT(b);
  size_t osz, nsz;
  int rc = 0;

  /* --- Get the latest valid key --- */

  ks = *ksroot;
  for (;;) {
    if (!ks) {
      T( trace(T_KEYSET, "keyset: no active keys -- forcing exchange"); )
      buf_break(bb);
      return (-1);
    }
    if (KEYOK(ks, now))
      break;
    ks = ks->next;
  }

  /* --- MAC and encrypt the packet --- */

  c = ks->c;
  ivsz = c->ops->c->blksz;
  if (buf_ensure(bb, ivsz + sz))
    return (0);
  h = ks->m->ops->init(ks->m);
  h->ops->hash(h, p, sz);
  h->ops->done(h, q);
  IF_TRACING(T_KEYSET, {
    trace(T_KEYSET, "keyset: encrypting using keyset %u", ks->seq);
    trace_block(T_CRYPTO, "crypto: computed MAC", q, ivsz);
  })
  c->ops->setiv(c, q);
  h->ops->destroy(h);

  if (buf_ensure(bb, sz))
    return (0);
  c->ops->encrypt(c, p, q + ivsz, sz);
  IF_TRACING(T_KEYSET, {
    trace_block(T_CRYPTO, "crypto: encrypted packet", q + ivsz, sz);
  })
  BSTEP(bb, ivsz + sz);

  /* --- Deduct the packet size from the key's data life --- */

  osz = ks->sz_exp;
  if (osz > sz)
    nsz = osz - sz;
  else
    nsz = 0;
  if (osz >= KEY_REGENSZ && nsz < KEY_REGENSZ) {
    T( trace(T_KEYSET, "keyset: keyset %u data regen limit exceeded -- "
	     "forcing exchange", ks->seq); )
    rc = -1;
  }
  ks->sz_exp = nsz;
  return (rc);
}

/* --- @ks_decrypt@ --- *
 *
 * Arguments:	@keyset **ksroot@ = pointer to keyset list head
 *		@buf *b@ = pointer to input buffer
 *		@buf *bb@ = pointer to output buffer
 *
 * Returns:	Nonzero if the packet couldn't be decrypted.
 *
 * Use:		Decrypts a packet.
 */

int ks_decrypt(keyset **ksroot, buf *b, buf *bb)
{
  time_t now = time(0);
  const octet *pp = BCUR(b);
  const octet *p;
  size_t sz = BLEFT(b);
  octet *q = BCUR(bb);
  keyset *ks;

  T( trace(T_KEYSET, "keyset: attempting to decrypt packet"); )
  if (buf_ensure(bb, sz))
    return (-1);
  for (ks = *ksroot; ks; ks = ks->next) {
    ghash *h;
    gcipher *c = ks->c;
    size_t ivsz = c->ops->c->blksz;
    octet *mac;
    int eq;

    if (!KEYOK(ks, now))
      continue;
    if (sz < ivsz) {
      T( trace(T_KEYSET, "keyset: block too small for keyset %u", ks->seq); )
      continue;
    }
    p = pp + ivsz;
    c->ops->setiv(c, pp);
    c->ops->decrypt(c, p, q, sz - ivsz);
    h = ks->m->ops->init(ks->m);
    h->ops->hash(h, q, sz - ivsz);
    mac = h->ops->done(h, 0);
    eq = !memcmp(mac, pp, ivsz);
    IF_TRACING(T_KEYSET, {
      trace(T_KEYSET, "keyset: decrypting using keyset %u", ks->seq);
      trace_block(T_CRYPTO, "crypto: computed MAC", mac, ivsz);
    })
    h->ops->destroy(h);
    if (eq) {
      BSTEP(bb, sz - ivsz);
      IF_TRACING(T_KEYSET, {
	trace(T_KEYSET, "keyset: decrypted OK");
	trace_block(T_CRYPTO, "crypto: decrypted packet", q, sz - ivsz);
      })
      return (0);
    }
    IF_TRACING(T_KEYSET, {
      trace(T_KEYSET, "keyset: decryption failed");
      trace_block(T_CRYPTO, "crypto: expected MAC", pp, ivsz);
    })
  }
  T( trace(T_KEYSET, "keyset: no matching keys"); )
  return (-1);
}

/*----- That's all, folks -------------------------------------------------*/