X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~mdw/git/tripe/blobdiff_plain/de8edc7fdb0a26ca9cb736a49b020a64ee4a0d40..fb6a9f13a40d1b9e797b4fe858a06cfdbcc1109b:/server/bulkcrypto.c diff --git a/server/bulkcrypto.c b/server/bulkcrypto.c index 0e02f747..d0e654cc 100644 --- a/server/bulkcrypto.c +++ b/server/bulkcrypto.c @@ -9,19 +9,18 @@ * * This file is part of Trivial IP Encryption (TrIPE). * - * TrIPE is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. + * TrIPE is free software: you can redistribute it and/or modify it under + * the terms of the GNU General Public License as published by the Free + * Software Foundation; either version 3 of the License, or (at your + * option) any later version. * - * TrIPE is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. + * TrIPE is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. * * You should have received a copy of the GNU General Public License - * along with TrIPE; if not, write to the Free Software Foundation, - * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + * along with TrIPE. If not, see . */ /*----- Header files ------------------------------------------------------*/ @@ -50,6 +49,53 @@ trace_block(T_CRYPTO, "crypto: expected MAC", (pmac), (tagsz)); \ }) } while (0) +/* --- @derivekey@ --- * + * + * Arguments: @octet *k@ = pointer to an output buffer of at least + * @MAXHASHSZ@ bytes + * @size_t ksz@ = actual size wanted (for tracing) + * @const deriveargs@ = derivation parameters, as passed into + * @genkeys@ + * @int dir@ = direction for the key (@DIR_IN@ or @DIR_OUT@) + * @const char *what@ = label for the key (input to derivation) + * + * Returns: --- + * + * Use: Derives a session key, for use on incoming or outgoing data. + */ + +static void derivekey(octet *k, size_t ksz, const deriveargs *a, + int dir, const char *what) +{ + const gchash *hc = a->hc; + ghash *h; + + assert(ksz <= hc->hashsz); + assert(hc->hashsz <= MAXHASHSZ); + h = GH_INIT(hc); + GH_HASH(h, a->what, strlen(a->what)); GH_HASH(h, what, strlen(what) + 1); + switch (dir) { + case DIR_IN: + if (a->x) GH_HASH(h, a->k, a->x); + if (a->y != a->x) GH_HASH(h, a->k + a->x, a->y - a->x); + break; + case DIR_OUT: + if (a->y != a->x) GH_HASH(h, a->k + a->x, a->y - a->x); + if (a->x) GH_HASH(h, a->k, a->x); + break; + default: + abort(); + } + GH_HASH(h, a->k + a->y, a->z - a->y); + GH_DONE(h, k); + GH_DESTROY(h); + IF_TRACING(T_KEYSET, { IF_TRACING(T_CRYPTO, { + char _buf[32]; + sprintf(_buf, "crypto: %s key %s", dir ? "outgoing" : "incoming", what); + trace_block(T_CRYPTO, _buf, k, ksz); + }) }) +} + /*----- Common functionality for generic-composition transforms -----------*/ #define CHECK_MAC(h, pmac, tagsz) do { \ @@ -73,7 +119,7 @@ typedef struct gencomp_algs { typedef struct gencomp_chal { bulkchal _b; - gmac *m; size_t tagsz; + gmac *m; } gencomp_chal; static int gencomp_getalgs(gencomp_algs *a, const algswitch *asw, @@ -98,7 +144,7 @@ static int gencomp_getalgs(gencomp_algs *a, const algswitch *asw, if ((p = key_getattr(kf, k, "mac")) != 0) { dstr_reset(&d); dstr_puts(&d, p); - if ((q = strchr(d.buf, '/')) != 0) + if ((q = strrchr(d.buf, '/')) != 0) *q++ = 0; if ((a->m = gmac_byname(d.buf)) == 0) { a_format(e, "unknown-mac", "%s", d.buf, A_END); @@ -205,25 +251,26 @@ static bulkchal *gencomp_genchal(const gencomp_algs *a) return (&gc->_b); } -static int gencomp_chaltag(bulkchal *bc, const void *m, size_t msz, void *t) +static int gencomp_chaltag(bulkchal *bc, const void *m, size_t msz, + uint32 seq, void *t) { gencomp_chal *gc = (gencomp_chal *)bc; ghash *h = GM_INIT(gc->m); - GH_HASH(h, m, msz); + GH_HASHU32(h, seq); if (msz) GH_HASH(h, m, msz); memcpy(t, GH_DONE(h, 0), bc->tagsz); GH_DESTROY(h); return (0); } static int gencomp_chalvrf(bulkchal *bc, const void *m, size_t msz, - const void *t) + uint32 seq, const void *t) { gencomp_chal *gc = (gencomp_chal *)bc; ghash *h = GM_INIT(gc->m); int ok; - GH_HASH(h, m, msz); + GH_HASHU32(h, seq); if (msz) GH_HASH(h, m, msz); ok = ct_memeq(GH_DONE(h, 0), t, gc->_b.tagsz); GH_DESTROY(h); return (ok ? 0 : -1); @@ -310,7 +357,7 @@ static size_t v0_overhead(const bulkalgs *aa) static size_t v0_expsz(const bulkalgs *aa) { const v0_algs *a = (const v0_algs *)aa; return (gencomp_expsz(&a->ga)); } -static bulkctx *v0_genkeys(const bulkalgs *aa, const struct rawkey *rk) +static bulkctx *v0_genkeys(const bulkalgs *aa, const deriveargs *da) { const v0_algs *a = (const v0_algs *)aa; v0_ctx *bc = CREATE(v0_ctx); @@ -319,9 +366,10 @@ static bulkctx *v0_genkeys(const bulkalgs *aa, const struct rawkey *rk) bc->tagsz = a->ga.tagsz; for (i = 0; i < NDIR; i++) { - ks_derivekey(k, a->ga.cksz, rk, i, "encryption"); + if (!(da->f&(1 << i))) { bc->d[i].c = 0; bc->d[i].m = 0; continue; } + derivekey(k, a->ga.cksz, da, i, "encryption"); bc->d[i].c = GC_INIT(a->ga.c, k, a->ga.cksz); - ks_derivekey(k, a->ga.mksz, rk, i, "integrity"); + derivekey(k, a->ga.mksz, da, i, "integrity"); bc->d[i].m = GM_KEY(a->ga.m, k, a->ga.mksz); } return (&bc->_b); @@ -345,8 +393,8 @@ static void v0_freectx(bulkctx *bbc) int i; for (i = 0; i < NDIR; i++) { - GC_DESTROY(bc->d[i].c); - GM_DESTROY(bc->d[i].m); + if (bc->d[i].c) GC_DESTROY(bc->d[i].c); + if (bc->d[i].m) GM_DESTROY(bc->d[i].m); } DESTROY(bc); } @@ -360,10 +408,13 @@ static int v0_encrypt(bulkctx *bbc, unsigned ty, const octet *p = BCUR(b); size_t sz = BLEFT(b); octet *qmac, *qseq, *qiv, *qpk; - size_t ivsz = GC_CLASS(c)->blksz; + size_t ivsz; size_t tagsz = bc->tagsz; octet t[4]; + assert(c); + ivsz = GC_CLASS(c)->blksz; + /* --- Determine the ciphertext layout --- */ if (buf_ensure(bb, tagsz + SEQSZ + ivsz + sz)) return (0); @@ -420,10 +471,13 @@ static int v0_decrypt(bulkctx *bbc, unsigned ty, octet *q = BCUR(bb); ghash *h; gcipher *c = bc->d[DIR_IN].c; - size_t ivsz = GC_CLASS(c)->blksz; + size_t ivsz; size_t tagsz = bc->tagsz; octet t[4]; + assert(c); + ivsz = GC_CLASS(c)->blksz; + /* --- Break up the packet into its components --- */ if (psz < ivsz + SEQSZ + tagsz) { @@ -537,7 +591,8 @@ static void iiv_tracealgs(const bulkalgs *aa) const iiv_algs *a = (const iiv_algs *)aa; gencomp_tracealgs(&a->ga); - trace(T_CRYPTO, "crypto: blkc = %.*s", strlen(a->b->name) - 4, a->b->name); + trace(T_CRYPTO, + "crypto: blkc = %.*s", (int)strlen(a->b->name) - 4, a->b->name); } #endif @@ -587,7 +642,7 @@ static size_t iiv_expsz(const bulkalgs *aa) return (gencomp_expsz(&a->ga)); } -static bulkctx *iiv_genkeys(const bulkalgs *aa, const struct rawkey *rk) +static bulkctx *iiv_genkeys(const bulkalgs *aa, const deriveargs *da) { const iiv_algs *a = (const iiv_algs *)aa; iiv_ctx *bc = CREATE(iiv_ctx); @@ -596,11 +651,13 @@ static bulkctx *iiv_genkeys(const bulkalgs *aa, const struct rawkey *rk) bc->tagsz = a->ga.tagsz; for (i = 0; i < NDIR; i++) { - ks_derivekey(k, a->ga.cksz, rk, i, "encryption"); + if (!(da->f&(1 << i))) + { bc->d[i].c = 0; bc->d[i].b = 0; bc->d[i].m = 0; continue; } + derivekey(k, a->ga.cksz, da, i, "encryption"); bc->d[i].c = GC_INIT(a->ga.c, k, a->ga.cksz); - ks_derivekey(k, a->bksz, rk, i, "blkc"); + derivekey(k, a->bksz, da, i, "blkc"); bc->d[i].b = GC_INIT(a->b, k, a->bksz); - ks_derivekey(k, a->ga.mksz, rk, i, "integrity"); + derivekey(k, a->ga.mksz, da, i, "integrity"); bc->d[i].m = GM_KEY(a->ga.m, k, a->ga.mksz); } return (&bc->_b); @@ -624,9 +681,9 @@ static void iiv_freectx(bulkctx *bbc) int i; for (i = 0; i < NDIR; i++) { - GC_DESTROY(bc->d[i].c); - GC_DESTROY(bc->d[i].b); - GM_DESTROY(bc->d[i].m); + if (bc->d[i].c) GC_DESTROY(bc->d[i].c); + if (bc->d[i].b) GC_DESTROY(bc->d[i].b); + if (bc->d[i].m) GM_DESTROY(bc->d[i].m); } DESTROY(bc); } @@ -644,10 +701,14 @@ static int iiv_encrypt(bulkctx *bbc, unsigned ty, const octet *p = BCUR(b); size_t sz = BLEFT(b); octet *qmac, *qseq, *qpk; - size_t ivsz = GC_CLASS(c)->blksz, blkcsz = GC_CLASS(blkc)->blksz; + size_t ivsz, blkcsz; size_t tagsz = bc->tagsz; octet t[4]; + assert(c); assert(blkc); + ivsz = GC_CLASS(c)->blksz; + blkcsz = GC_CLASS(blkc)->blksz; + /* --- Determine the ciphertext layout --- */ if (buf_ensure(bb, tagsz + SEQSZ + sz)) return (0); @@ -707,10 +768,14 @@ static int iiv_decrypt(bulkctx *bbc, unsigned ty, octet *q = BCUR(bb); ghash *h; gcipher *c = bc->d[DIR_IN].c, *blkc = bc->d[DIR_IN].b; - size_t ivsz = GC_CLASS(c)->blksz, blkcsz = GC_CLASS(blkc)->blksz; + size_t ivsz, blkcsz; size_t tagsz = bc->tagsz; octet t[4]; + assert(c); assert(blkc); + ivsz = GC_CLASS(c)->blksz; + blkcsz = GC_CLASS(blkc)->blksz; + /* --- Break up the packet into its components --- */ if (psz < SEQSZ + tagsz) { @@ -893,7 +958,7 @@ static size_t naclbox_overhead(const bulkalgs *aa) static size_t naclbox_expsz(const bulkalgs *aa) { return (MEG(2048)); } -static bulkctx *naclbox_genkeys(const bulkalgs *aa, const struct rawkey *rk) +static bulkctx *naclbox_genkeys(const bulkalgs *aa, const deriveargs *da) { const naclbox_algs *a = (const naclbox_algs *)aa; naclbox_ctx *bc = CREATE(naclbox_ctx); @@ -901,7 +966,8 @@ static bulkctx *naclbox_genkeys(const bulkalgs *aa, const struct rawkey *rk) int i; for (i = 0; i < NDIR; i++) { - ks_derivekey(k, a->cksz, rk, i, "encryption"); + if (!(da->f&(1 << i))) { bc->d[i].c = 0; continue; } + derivekey(k, a->cksz, da, i, "encryption"); bc->d[i].c = GC_INIT(a->c, k, a->cksz); } return (&bc->_b); @@ -922,31 +988,44 @@ static bulkchal *naclbox_genchal(const bulkalgs *aa) trace(T_CHAL, "chal: generated new challenge key"); trace_block(T_CRYPTO, "chal: new key", buf_t, a->cksz); }) - c->_b.tagsz = 16; + c->_b.tagsz = POLY1305_TAGSZ; return (&c->_b); } -static int naclbox_chaltag(bulkchal *bc, const void *m, size_t msz, void *t) +static int naclbox_chaltag(bulkchal *bc, const void *m, size_t msz, + uint32 seq, void *t) { naclbox_chal *c = (naclbox_chal *)bc; - octet b0[SALSA20_NONCESZ]; - assert(msz <= sizeof(b0)); - memcpy(b0, m, msz); memset(b0 + msz, 0, sizeof(b0) - msz); - GC_SETIV(c->c, b0); - GC_ENCRYPT(c->c, 0, t, c->_b.tagsz); + poly1305_key pk; + poly1305_ctx pm; + octet b[POLY1305_KEYSZ + POLY1305_MASKSZ]; + + assert(SALSA20_NONCESZ <= sizeof(b)); + memset(b, 0, SALSA20_NONCESZ - 4); STORE32(b + SALSA20_NONCESZ - 4, seq); + GC_SETIV(c->c, b); GC_ENCRYPT(c->c, 0, b, sizeof(b)); + poly1305_keyinit(&pk, b, POLY1305_KEYSZ); + poly1305_macinit(&pm, &pk, b + POLY1305_KEYSZ); + if (msz) poly1305_hash(&pm, m, msz); + poly1305_done(&pm, t); return (0); } static int naclbox_chalvrf(bulkchal *bc, const void *m, size_t msz, - const void *t) + uint32 seq, const void *t) { naclbox_chal *c = (naclbox_chal *)bc; - octet b0[SALSA20_NONCESZ], b1[16]; - assert(msz <= sizeof(b0)); assert(c->_b.tagsz <= sizeof(b1)); - memcpy(b0, m, msz); memset(b0 + msz, 0, sizeof(b0) - msz); - GC_SETIV(c->c, b0); - GC_ENCRYPT(c->c, 0, b1, c->_b.tagsz); - return (ct_memeq(t, b1, c->_b.tagsz) ? 0 : -1); + poly1305_key pk; + poly1305_ctx pm; + octet b[POLY1305_KEYSZ + POLY1305_MASKSZ]; + + assert(SALSA20_NONCESZ <= sizeof(b)); + memset(b, 0, SALSA20_NONCESZ - 4); STORE32(b + SALSA20_NONCESZ - 4, seq); + GC_SETIV(c->c, b); GC_ENCRYPT(c->c, 0, b, sizeof(b)); + poly1305_keyinit(&pk, b, POLY1305_KEYSZ); + poly1305_macinit(&pm, &pk, b + POLY1305_KEYSZ); + if (msz) poly1305_hash(&pm, m, msz); + assert(POLY1305_TAGSZ <= sizeof(b)); poly1305_done(&pm, b); + return (ct_memeq(t, b, POLY1305_TAGSZ) ? 0 : -1); } static void naclbox_freechal(bulkchal *bc) @@ -960,7 +1039,7 @@ static void naclbox_freectx(bulkctx *bbc) naclbox_ctx *bc = (naclbox_ctx *)bbc; int i; - for (i = 0; i < NDIR; i++) GC_DESTROY(bc->d[i].c); + for (i = 0; i < NDIR; i++) { if (bc->d[i].c) GC_DESTROY(bc->d[i].c); } DESTROY(bc); } @@ -975,6 +1054,8 @@ static int naclbox_encrypt(bulkctx *bbc, unsigned ty, size_t sz = BLEFT(b); octet *qmac, *qseq, *qpk; + assert(c); + /* --- Determine the ciphertext layout --- */ if (buf_ensure(bb, POLY1305_TAGSZ + SEQSZ + sz)) return (0); @@ -1022,6 +1103,8 @@ static int naclbox_decrypt(bulkctx *bbc, unsigned ty, size_t sz; octet *q = BCUR(bb); + assert(c); + /* --- Break up the packet into its components --- */ if (psz < SEQSZ + POLY1305_TAGSZ) { @@ -1047,6 +1130,7 @@ static int naclbox_decrypt(bulkctx *bbc, unsigned ty, poly1305_hash(&poly, ppk, sz); poly1305_done(&poly, buf_u); + TRACE_MAC(buf_u, POLY1305_TAGSZ); if (!ct_memeq(buf_u, pmac, POLY1305_TAGSZ)) { TRACE_MACERR(pmac, POLY1305_TAGSZ); return (KSERR_DECRYPT);