[openssh.git] / cipher.c

/*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
 *                    All rights reserved
 *
 * As far as I am concerned, the code I have written for this software
 * can be used freely for any purpose.  Any derived versions of this
 * software must be clearly marked as such, and if the derived work is
 * incompatible with the protocol description in the RFC file, it must be
 * called by a name other than "ssh" or "Secure Shell".
 *
 *
 * Copyright (c) 1999 Niels Provos.  All rights reserved.
 * Copyright (c) 1999,2000 Markus Friedl.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"
RCSID("$OpenBSD: cipher.c,v 1.41 2000/12/19 23:17:56 markus Exp $");

#include "ssh.h"
#include "xmalloc.h"

#include <openssl/md5.h>


/* no encryption */
void
none_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
}
void
none_setiv(CipherContext *cc, const u_char *iv, u_int ivlen)
{
}
void
none_crypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	memcpy(dest, src, len);
}

/* DES */
void
des_ssh1_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	static int dowarn = 1;
	if (dowarn) {
		error("Warning: use of DES is strongly discouraged "
		    "due to cryptographic weaknesses");
		dowarn = 0;
	}
	des_set_key((void *)key, cc->u.des.key);
}
void
des_ssh1_setiv(CipherContext *cc, const u_char *iv, u_int ivlen)
{
	memset(cc->u.des.iv, 0, sizeof(cc->u.des.iv));
}
void
des_ssh1_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	des_ncbc_encrypt(src, dest, len, cc->u.des.key, &cc->u.des.iv,
	    DES_ENCRYPT);
}
void
des_ssh1_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	des_ncbc_encrypt(src, dest, len, cc->u.des.key, &cc->u.des.iv,
	    DES_DECRYPT);
}

/* 3DES */
void
des3_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	des_set_key((void *) key, cc->u.des3.key1);
	des_set_key((void *) (key+8), cc->u.des3.key2);
	des_set_key((void *) (key+16), cc->u.des3.key3);
}
void
des3_setiv(CipherContext *cc, const u_char *iv, u_int ivlen)
{
	memset(cc->u.des3.iv2, 0, sizeof(cc->u.des3.iv2));
	memset(cc->u.des3.iv3, 0, sizeof(cc->u.des3.iv3));
	if (iv == NULL)
		return;
	memcpy(cc->u.des3.iv3, (char *)iv, 8);
}
void
des3_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	des_ede3_cbc_encrypt(src, dest, len,
	    cc->u.des3.key1, cc->u.des3.key2, cc->u.des3.key3,
	    &cc->u.des3.iv3, DES_ENCRYPT);
}
void
des3_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	des_ede3_cbc_encrypt(src, dest, len,
	    cc->u.des3.key1, cc->u.des3.key2, cc->u.des3.key3,
	    &cc->u.des3.iv3, DES_DECRYPT);
}

/*
 * This is used by SSH1:
 *
 * What kind of triple DES are these 2 routines?
 *
 * Why is there a redundant initialization vector?
 *
 * If only iv3 was used, then, this would till effect have been
 * outer-cbc. However, there is also a private iv1 == iv2 which
 * perhaps makes differential analysis easier. On the other hand, the
 * private iv1 probably makes the CRC-32 attack ineffective. This is a
 * result of that there is no longer any known iv1 to use when
 * choosing the X block.
 */
void
des3_ssh1_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	des_set_key((void *) key, cc->u.des3.key1);
	des_set_key((void *) (key+8), cc->u.des3.key2);
	if (keylen <= 16)
		des_set_key((void *) key, cc->u.des3.key3);
	else
		des_set_key((void *) (key+16), cc->u.des3.key3);
}
void
des3_ssh1_encrypt(CipherContext *cc, u_char *dest, const u_char *src,
    u_int len)
{
	des_cblock iv1;
	des_cblock *iv2 = &cc->u.des3.iv2;
	des_cblock *iv3 = &cc->u.des3.iv3;

	memcpy(&iv1, iv2, 8);

	des_ncbc_encrypt(src,  dest, len, cc->u.des3.key1, &iv1, DES_ENCRYPT);
	des_ncbc_encrypt(dest, dest, len, cc->u.des3.key2, iv2, DES_DECRYPT);
	des_ncbc_encrypt(dest, dest, len, cc->u.des3.key3, iv3, DES_ENCRYPT);
}
void
des3_ssh1_decrypt(CipherContext *cc, u_char *dest, const u_char *src,
    u_int len)
{
	des_cblock iv1;
	des_cblock *iv2 = &cc->u.des3.iv2;
	des_cblock *iv3 = &cc->u.des3.iv3;

	memcpy(&iv1, iv2, 8);

	des_ncbc_encrypt(src,  dest, len, cc->u.des3.key3, iv3, DES_DECRYPT);
	des_ncbc_encrypt(dest, dest, len, cc->u.des3.key2, iv2, DES_ENCRYPT);
	des_ncbc_encrypt(dest, dest, len, cc->u.des3.key1, &iv1, DES_DECRYPT);
}

/* Blowfish */
void
blowfish_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	BF_set_key(&cc->u.bf.key, keylen, (u_char *)key);
}
void
blowfish_setiv(CipherContext *cc, const u_char *iv, u_int ivlen)
{
	if (iv == NULL)
		memset(cc->u.bf.iv, 0, 8);
	else
		memcpy(cc->u.bf.iv, (char *)iv, 8);
}
void
blowfish_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src,
     u_int len)
{
	BF_cbc_encrypt((void *)src, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	    BF_ENCRYPT);
}
void
blowfish_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src,
     u_int len)
{
	BF_cbc_encrypt((void *)src, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	    BF_DECRYPT);
}

/*
 * SSH1 uses a variation on Blowfish, all bytes must be swapped before
 * and after encryption/decryption. Thus the swap_bytes stuff (yuk).
 */
static void
swap_bytes(const u_char *src, u_char *dst, int n)
{
	char c[4];

	/* Process 4 bytes every lap. */
	for (n = n / 4; n > 0; n--) {
		c[3] = *src++;
		c[2] = *src++;
		c[1] = *src++;
		c[0] = *src++;

		*dst++ = c[0];
		*dst++ = c[1];
		*dst++ = c[2];
		*dst++ = c[3];
	}
}

void
blowfish_ssh1_encrypt(CipherContext *cc, u_char *dest, const u_char *src,
    u_int len)
{
	swap_bytes(src, dest, len);
	BF_cbc_encrypt((void *)dest, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	    BF_ENCRYPT);
	swap_bytes(dest, dest, len);
}
void
blowfish_ssh1_decrypt(CipherContext *cc, u_char *dest, const u_char *src,
    u_int len)
{
	swap_bytes(src, dest, len);
	BF_cbc_encrypt((void *)dest, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	    BF_DECRYPT);
	swap_bytes(dest, dest, len);
}

/* alleged rc4 */
void
arcfour_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	RC4_set_key(&cc->u.rc4, keylen, (u_char *)key);
}
void
arcfour_crypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	RC4(&cc->u.rc4, len, (u_char *)src, dest);
}

/* CAST */
void
cast_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	CAST_set_key(&cc->u.cast.key, keylen, (u_char *) key);
}
void
cast_setiv(CipherContext *cc, const u_char *iv, u_int ivlen)
{
	if (iv == NULL) 
		fatal("no IV for %s.", cc->cipher->name);
	memcpy(cc->u.cast.iv, (char *)iv, 8);
}
void
cast_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	CAST_cbc_encrypt(src, dest, len, &cc->u.cast.key, cc->u.cast.iv,
	    CAST_ENCRYPT);
}
void
cast_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	CAST_cbc_encrypt(src, dest, len, &cc->u.cast.key, cc->u.cast.iv,
	    CAST_DECRYPT);
}

/* RIJNDAEL */

#define RIJNDAEL_BLOCKSIZE 16
void
rijndael_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	rijndael_set_key(&cc->u.rijndael.enc, (u4byte *)key, 8*keylen, 1);
	rijndael_set_key(&cc->u.rijndael.dec, (u4byte *)key, 8*keylen, 0);
}
void
rijndael_setiv(CipherContext *cc, const u_char *iv, u_int ivlen)
{
	if (iv == NULL) 
		fatal("no IV for %s.", cc->cipher->name);
	memcpy((u_char *)cc->u.rijndael.iv, iv, RIJNDAEL_BLOCKSIZE);
}
void
rijndael_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src,
    u_int len)
{
	rijndael_ctx *ctx = &cc->u.rijndael.enc;
	u4byte *iv = cc->u.rijndael.iv;
	u4byte in[4];
	u4byte *cprev, *cnow, *plain;
	int i, blocks = len / RIJNDAEL_BLOCKSIZE;
	if (len == 0)
		return;
	if (len % RIJNDAEL_BLOCKSIZE)
		fatal("rijndael_cbc_encrypt: bad len %d", len);
	cnow  = (u4byte*) dest;
	plain = (u4byte*) src;
	cprev = iv;
	for(i = 0; i < blocks; i++, plain+=4, cnow+=4) {
		in[0] = plain[0] ^ cprev[0];
		in[1] = plain[1] ^ cprev[1];
		in[2] = plain[2] ^ cprev[2];
		in[3] = plain[3] ^ cprev[3];
		rijndael_encrypt(ctx, in, cnow);
		cprev = cnow;
	}
	memcpy(iv, cprev, RIJNDAEL_BLOCKSIZE);
}

void
rijndael_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src,
    u_int len)
{
	rijndael_ctx *ctx = &cc->u.rijndael.dec;
	u4byte *iv = cc->u.rijndael.iv;
	u4byte ivsaved[4];
	u4byte *cnow =  (u4byte*) (src+len-RIJNDAEL_BLOCKSIZE);
	u4byte *plain = (u4byte*) (dest+len-RIJNDAEL_BLOCKSIZE);
	u4byte *ivp;
	int i, blocks = len / RIJNDAEL_BLOCKSIZE;
	if (len == 0)
		return;
	if (len % RIJNDAEL_BLOCKSIZE)
		fatal("rijndael_cbc_decrypt: bad len %d", len);
	memcpy(ivsaved, cnow, RIJNDAEL_BLOCKSIZE);
	for(i = blocks; i > 0; i--, cnow-=4, plain-=4) {
		rijndael_decrypt(ctx, cnow, plain);
		ivp =  (i == 1) ? iv : cnow-4;
		plain[0] ^= ivp[0];
		plain[1] ^= ivp[1];
		plain[2] ^= ivp[2];
		plain[3] ^= ivp[3];
	}
	memcpy(iv, ivsaved, RIJNDAEL_BLOCKSIZE);
}

Cipher ciphers[] = {
	{ "none",
		SSH_CIPHER_NONE, 8, 0,
		none_setkey, none_setiv,
		none_crypt, none_crypt },
	{ "des",
		SSH_CIPHER_DES, 8, 8,
		des_ssh1_setkey, des_ssh1_setiv,
		des_ssh1_encrypt, des_ssh1_decrypt },
	{ "3des",
		SSH_CIPHER_3DES, 8, 16,
		des3_ssh1_setkey, des3_setiv,
		des3_ssh1_encrypt, des3_ssh1_decrypt },
	{ "blowfish",
		SSH_CIPHER_BLOWFISH, 8, 16,
		blowfish_setkey, blowfish_setiv,
		blowfish_ssh1_encrypt, blowfish_ssh1_decrypt },

	{ "3des-cbc",
		SSH_CIPHER_SSH2, 8, 24,
		des3_setkey, des3_setiv,
		des3_cbc_encrypt, des3_cbc_decrypt },
	{ "blowfish-cbc",
		SSH_CIPHER_SSH2, 8, 16,
		blowfish_setkey, blowfish_setiv,
		blowfish_cbc_encrypt, blowfish_cbc_decrypt },
	{ "cast128-cbc",
		SSH_CIPHER_SSH2, 8, 16,
		cast_setkey, cast_setiv,
		cast_cbc_encrypt, cast_cbc_decrypt },
	{ "arcfour",
		SSH_CIPHER_SSH2, 8, 16,
		arcfour_setkey, none_setiv,
		arcfour_crypt, arcfour_crypt },
	{ "aes128-cbc",
		SSH_CIPHER_SSH2, 16, 16,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ "aes192-cbc",
		SSH_CIPHER_SSH2, 16, 24,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ "aes256-cbc",
		SSH_CIPHER_SSH2, 16, 32,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ "rijndael128-cbc",
		SSH_CIPHER_SSH2, 16, 16,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ "rijndael192-cbc",
		SSH_CIPHER_SSH2, 16, 24,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ "rijndael256-cbc",
		SSH_CIPHER_SSH2, 16, 32,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ "rijndael-cbc@lysator.liu.se",
		SSH_CIPHER_SSH2, 16, 32,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
        { NULL, SSH_CIPHER_ILLEGAL, 0, 0, NULL, NULL, NULL, NULL }
};

/*--*/

u_int
cipher_mask_ssh1(int client)
{
	u_int mask = 0;
	mask |= 1 << SSH_CIPHER_3DES;           /* Mandatory */
	mask |= 1 << SSH_CIPHER_BLOWFISH;
	if (client) {
		mask |= 1 << SSH_CIPHER_DES;
	}
	return mask;
}

Cipher *
cipher_by_name(const char *name)
{
	Cipher *c;
	for (c = ciphers; c->name != NULL; c++)
		if (strcasecmp(c->name, name) == 0)
			return c;
	return NULL;
}

Cipher *
cipher_by_number(int id)
{
	Cipher *c;
	for (c = ciphers; c->name != NULL; c++)
		if (c->number == id)
			return c;
	return NULL;
}

#define	CIPHER_SEP	","
int
ciphers_valid(const char *names)
{
	Cipher *c;
	char *ciphers, *cp;
	char *p;

	if (names == NULL || strcmp(names, "") == 0)
		return 0;
	ciphers = cp = xstrdup(names);
	for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0';
	     (p = strsep(&cp, CIPHER_SEP))) {
		c = cipher_by_name(p);
		if (c == NULL || c->number != SSH_CIPHER_SSH2) {
			debug("bad cipher %s [%s]", p, names);
			xfree(ciphers);
			return 0;
		} else {
			debug3("cipher ok: %s [%s]", p, names);
		}
	}
	debug3("ciphers ok: [%s]", names);
	xfree(ciphers);
	return 1;
}

/*
 * Parses the name of the cipher.  Returns the number of the corresponding
 * cipher, or -1 on error.
 */

int
cipher_number(const char *name)
{
	Cipher *c;
	if (name == NULL)
		return -1;
	c = cipher_by_name(name);
	return (c==NULL) ? -1 : c->number;
}

char *
cipher_name(int id)
{
	Cipher *c = cipher_by_number(id);
	return (c==NULL) ? "<unknown>" : c->name;
}

void
cipher_init(CipherContext *cc, Cipher *cipher,
    const u_char *key, u_int keylen, const u_char *iv, u_int ivlen)
{
	if (keylen < cipher->key_len)
		fatal("cipher_init: key length %d is insufficient for %s.",
		    keylen, cipher->name);
	if (iv != NULL && ivlen < cipher->block_size)
		fatal("cipher_init: iv length %d is insufficient for %s.",
		    ivlen, cipher->name);
	cc->cipher = cipher;
	cipher->setkey(cc, key, keylen);
	cipher->setiv(cc, iv, ivlen);
}

void
cipher_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	if (len % cc->cipher->block_size)
		fatal("cipher_encrypt: bad plaintext length %d", len);
	cc->cipher->encrypt(cc, dest, src, len);
}

void
cipher_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	if (len % cc->cipher->block_size)
		fatal("cipher_decrypt: bad ciphertext length %d", len);
	cc->cipher->decrypt(cc, dest, src, len);
}

/*
 * Selects the cipher, and keys if by computing the MD5 checksum of the
 * passphrase and using the resulting 16 bytes as the key.
 */

void
cipher_set_key_string(CipherContext *cc, Cipher *cipher,
    const char *passphrase)
{
	MD5_CTX md;
	u_char digest[16];

	MD5_Init(&md);
	MD5_Update(&md, (const u_char *)passphrase, strlen(passphrase));
	MD5_Final(digest, &md);

	cipher_init(cc, cipher, digest, 16, NULL, 0);

	memset(digest, 0, sizeof(digest));
	memset(&md, 0, sizeof(md));
}
Commit	Line	Data
8efc0c15	1	/*
5260325f	2	* Author: Tatu Ylonen <ylo@cs.hut.fi>
5260325f	3	* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5260325f	4	* All rights reserved
6ae2364d	5	*
bcbf86ec	6	* As far as I am concerned, the code I have written for this software
	7	* can be used freely for any purpose. Any derived versions of this
	8	* software must be clearly marked as such, and if the derived work is
	9	* incompatible with the protocol description in the RFC file, it must be
	10	* called by a name other than "ssh" or "Secure Shell".
	11	*
	12	*
	13	* Copyright (c) 1999 Niels Provos. All rights reserved.
	14	* Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
	15	*
	16	* Redistribution and use in source and binary forms, with or without
	17	* modification, are permitted provided that the following conditions
	18	* are met:
	19	* 1. Redistributions of source code must retain the above copyright
	20	* notice, this list of conditions and the following disclaimer.
	21	* 2. Redistributions in binary form must reproduce the above copyright
	22	* notice, this list of conditions and the following disclaimer in the
	23	* documentation and/or other materials provided with the distribution.
6ae2364d	24	*
bcbf86ec	25	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	26	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	27	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	28	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
	29	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	30	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	31	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	32	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	33	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	34	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
5260325f	35	*/
8efc0c15	36
8efc0c15	37	#include "includes.h"
1e3b8b07	38	RCSID("$OpenBSD: cipher.c,v 1.41 2000/12/19 23:17:56 markus Exp $");
8efc0c15	39
8efc0c15	40	#include "ssh.h"
a8be9f80	41	#include "xmalloc.h"
8efc0c15	42
	43	#include <openssl/md5.h>
	44
94ec8c6b	45
	46	/* no encryption */
	47	void
	48	none_setkey(CipherContext cc, const u_char key, u_int keylen)
	49	{
	50	}
	51	void
	52	none_setiv(CipherContext cc, const u_char iv, u_int ivlen)
	53	{
	54	}
	55	void
	56	none_crypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	57	{
	58	memcpy(dest, src, len);
	59	}
	60
	61	/* DES */
	62	void
	63	des_ssh1_setkey(CipherContext cc, const u_char key, u_int keylen)
	64	{
	65	static int dowarn = 1;
	66	if (dowarn) {
	67	error("Warning: use of DES is strongly discouraged "
	68	"due to cryptographic weaknesses");
	69	dowarn = 0;
	70	}
	71	des_set_key((void *)key, cc->u.des.key);
	72	}
	73	void
	74	des_ssh1_setiv(CipherContext cc, const u_char iv, u_int ivlen)
	75	{
	76	memset(cc->u.des.iv, 0, sizeof(cc->u.des.iv));
	77	}
	78	void
	79	des_ssh1_encrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	80	{
	81	des_ncbc_encrypt(src, dest, len, cc->u.des.key, &cc->u.des.iv,
	82	DES_ENCRYPT);
	83	}
	84	void
	85	des_ssh1_decrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	86	{
	87	des_ncbc_encrypt(src, dest, len, cc->u.des.key, &cc->u.des.iv,
	88	DES_DECRYPT);
	89	}
	90
	91	/* 3DES */
	92	void
	93	des3_setkey(CipherContext cc, const u_char key, u_int keylen)
	94	{
	95	des_set_key((void *) key, cc->u.des3.key1);
	96	des_set_key((void *) (key+8), cc->u.des3.key2);
	97	des_set_key((void *) (key+16), cc->u.des3.key3);
	98	}
	99	void
	100	des3_setiv(CipherContext cc, const u_char iv, u_int ivlen)
	101	{
	102	memset(cc->u.des3.iv2, 0, sizeof(cc->u.des3.iv2));
	103	memset(cc->u.des3.iv3, 0, sizeof(cc->u.des3.iv3));
	104	if (iv == NULL)
	105	return;
	106	memcpy(cc->u.des3.iv3, (char *)iv, 8);
	107	}
	108	void
109	des3_cbc_encrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
110	{
111	des_ede3_cbc_encrypt(src, dest, len,
112	cc->u.des3.key1, cc->u.des3.key2, cc->u.des3.key3,
113	&cc->u.des3.iv3, DES_ENCRYPT);
114	}
115	void
116	des3_cbc_decrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
117	{
118	des_ede3_cbc_encrypt(src, dest, len,
119	cc->u.des3.key1, cc->u.des3.key2, cc->u.des3.key3,
120	&cc->u.des3.iv3, DES_DECRYPT);
121	}
122
8efc0c15	123	/*
a8be9f80	124	* This is used by SSH1:
	125	*
	126	* What kind of triple DES are these 2 routines?
8efc0c15	127	*
	128	* Why is there a redundant initialization vector?
	129	*
	130	* If only iv3 was used, then, this would till effect have been
	131	* outer-cbc. However, there is also a private iv1 == iv2 which
	132	* perhaps makes differential analysis easier. On the other hand, the
	133	* private iv1 probably makes the CRC-32 attack ineffective. This is a
	134	* result of that there is no longer any known iv1 to use when
	135	* choosing the X block.
	136	*/
	137	void
94ec8c6b	138	des3_ssh1_setkey(CipherContext cc, const u_char key, u_int keylen)
	139	{
	140	des_set_key((void *) key, cc->u.des3.key1);
	141	des_set_key((void *) (key+8), cc->u.des3.key2);
	142	if (keylen <= 16)
	143	des_set_key((void *) key, cc->u.des3.key3);
	144	else
	145	des_set_key((void *) (key+16), cc->u.des3.key3);
	146	}
	147	void
	148	des3_ssh1_encrypt(CipherContext cc, u_char dest, const u_char *src,
	149	u_int len)
8efc0c15	150	{
5260325f	151	des_cblock iv1;
94ec8c6b	152	des_cblock *iv2 = &cc->u.des3.iv2;
94ec8c6b	153	des_cblock *iv3 = &cc->u.des3.iv3;
8efc0c15	154
5260325f	155	memcpy(&iv1, iv2, 8);
8efc0c15	156
0b6fbf03	157	des_ncbc_encrypt(src, dest, len, cc->u.des3.key1, &iv1, DES_ENCRYPT);
	158	des_ncbc_encrypt(dest, dest, len, cc->u.des3.key2, iv2, DES_DECRYPT);
	159	des_ncbc_encrypt(dest, dest, len, cc->u.des3.key3, iv3, DES_ENCRYPT);
8efc0c15	160	}
8efc0c15	161	void
94ec8c6b	162	des3_ssh1_decrypt(CipherContext cc, u_char dest, const u_char *src,
94ec8c6b	163	u_int len)
8efc0c15	164	{
5260325f	165	des_cblock iv1;
94ec8c6b	166	des_cblock *iv2 = &cc->u.des3.iv2;
94ec8c6b	167	des_cblock *iv3 = &cc->u.des3.iv3;
8efc0c15	168
5260325f	169	memcpy(&iv1, iv2, 8);
8efc0c15	170
0b6fbf03	171	des_ncbc_encrypt(src, dest, len, cc->u.des3.key3, iv3, DES_DECRYPT);
	172	des_ncbc_encrypt(dest, dest, len, cc->u.des3.key2, iv2, DES_ENCRYPT);
	173	des_ncbc_encrypt(dest, dest, len, cc->u.des3.key1, &iv1, DES_DECRYPT);
8efc0c15	174	}
8efc0c15	175
94ec8c6b	176	/* Blowfish */
	177	void
	178	blowfish_setkey(CipherContext cc, const u_char key, u_int keylen)
	179	{
1e3b8b07	180	BF_set_key(&cc->u.bf.key, keylen, (u_char *)key);
94ec8c6b	181	}
	182	void
	183	blowfish_setiv(CipherContext cc, const u_char iv, u_int ivlen)
	184	{
	185	if (iv == NULL)
	186	memset(cc->u.bf.iv, 0, 8);
	187	else
	188	memcpy(cc->u.bf.iv, (char *)iv, 8);
	189	}
	190	void
	191	blowfish_cbc_encrypt(CipherContext cc, u_char dest, const u_char *src,
	192	u_int len)
	193	{
	194	BF_cbc_encrypt((void *)src, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	195	BF_ENCRYPT);
	196	}
	197	void
	198	blowfish_cbc_decrypt(CipherContext cc, u_char dest, const u_char *src,
	199	u_int len)
	200	{
	201	BF_cbc_encrypt((void *)src, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	202	BF_DECRYPT);
	203	}
	204
8efc0c15	205	/*
a8be9f80	206	* SSH1 uses a variation on Blowfish, all bytes must be swapped before
8efc0c15	207	* and after encryption/decryption. Thus the swap_bytes stuff (yuk).
8efc0c15	208	*/
5260325f	209	static void
1e3b8b07	210	swap_bytes(const u_char src, u_char dst, int n)
8efc0c15	211	{
a22aff1f	212	char c[4];
5260325f	213
a22aff1f	214	/* Process 4 bytes every lap. */
	215	for (n = n / 4; n > 0; n--) {
	216	c[3] = *src++;
	217	c[2] = *src++;
	218	c[1] = *src++;
	219	c[0] = *src++;
5260325f	220
a22aff1f	221	*dst++ = c[0];
	222	*dst++ = c[1];
	223	*dst++ = c[2];
	224	*dst++ = c[3];
5260325f	225	}
8efc0c15	226	}
8efc0c15	227
94ec8c6b	228	void
	229	blowfish_ssh1_encrypt(CipherContext cc, u_char dest, const u_char *src,
	230	u_int len)
	231	{
	232	swap_bytes(src, dest, len);
	233	BF_cbc_encrypt((void *)dest, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	234	BF_ENCRYPT);
	235	swap_bytes(dest, dest, len);
	236	}
	237	void
	238	blowfish_ssh1_decrypt(CipherContext cc, u_char dest, const u_char *src,
	239	u_int len)
	240	{
	241	swap_bytes(src, dest, len);
	242	BF_cbc_encrypt((void *)dest, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	243	BF_DECRYPT);
	244	swap_bytes(dest, dest, len);
	245	}
8efc0c15	246
94ec8c6b	247	/* alleged rc4 */
	248	void
	249	arcfour_setkey(CipherContext cc, const u_char key, u_int keylen)
	250	{
	251	RC4_set_key(&cc->u.rc4, keylen, (u_char *)key);
	252	}
	253	void
	254	arcfour_crypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	255	{
	256	RC4(&cc->u.rc4, len, (u_char *)src, dest);
	257	}
8efc0c15	258
94ec8c6b	259	/* CAST */
	260	void
	261	cast_setkey(CipherContext cc, const u_char key, u_int keylen)
8efc0c15	262	{
1e3b8b07	263	CAST_set_key(&cc->u.cast.key, keylen, (u_char *) key);
94ec8c6b	264	}
	265	void
	266	cast_setiv(CipherContext cc, const u_char iv, u_int ivlen)
	267	{
	268	if (iv == NULL)
	269	fatal("no IV for %s.", cc->cipher->name);
	270	memcpy(cc->u.cast.iv, (char *)iv, 8);
	271	}
	272	void
	273	cast_cbc_encrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	274	{
	275	CAST_cbc_encrypt(src, dest, len, &cc->u.cast.key, cc->u.cast.iv,
	276	CAST_ENCRYPT);
	277	}
	278	void
	279	cast_cbc_decrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	280	{
	281	CAST_cbc_encrypt(src, dest, len, &cc->u.cast.key, cc->u.cast.iv,
	282	CAST_DECRYPT);
	283	}
	284
	285	/* RIJNDAEL */
	286
	287	#define RIJNDAEL_BLOCKSIZE 16
	288	void
	289	rijndael_setkey(CipherContext cc, const u_char key, u_int keylen)
	290	{
6b523bae	291	rijndael_set_key(&cc->u.rijndael.enc, (u4byte )key, 8keylen, 1);
6b523bae	292	rijndael_set_key(&cc->u.rijndael.dec, (u4byte )key, 8keylen, 0);
94ec8c6b	293	}
	294	void
	295	rijndael_setiv(CipherContext cc, const u_char iv, u_int ivlen)
	296	{
6b523bae	297	if (iv == NULL)
	298	fatal("no IV for %s.", cc->cipher->name);
	299	memcpy((u_char *)cc->u.rijndael.iv, iv, RIJNDAEL_BLOCKSIZE);
8ce64345	300	}
94ec8c6b	301	void
	302	rijndael_cbc_encrypt(CipherContext cc, u_char dest, const u_char *src,
	303	u_int len)
	304	{
6b523bae	305	rijndael_ctx *ctx = &cc->u.rijndael.enc;
	306	u4byte *iv = cc->u.rijndael.iv;
	307	u4byte in[4];
	308	u4byte cprev, cnow, *plain;
	309	int i, blocks = len / RIJNDAEL_BLOCKSIZE;
94ec8c6b	310	if (len == 0)
	311	return;
	312	if (len % RIJNDAEL_BLOCKSIZE)
	313	fatal("rijndael_cbc_encrypt: bad len %d", len);
6b523bae	314	cnow = (u4byte*) dest;
6b523bae	315	plain = (u4byte*) src;
94ec8c6b	316	cprev = iv;
6b523bae	317	for(i = 0; i < blocks; i++, plain+=4, cnow+=4) {
	318	in[0] = plain[0] ^ cprev[0];
	319	in[1] = plain[1] ^ cprev[1];
	320	in[2] = plain[2] ^ cprev[2];
	321	in[3] = plain[3] ^ cprev[3];
94ec8c6b	322	rijndael_encrypt(ctx, in, cnow);
	323	cprev = cnow;
	324	}
	325	memcpy(iv, cprev, RIJNDAEL_BLOCKSIZE);
	326	}
	327
	328	void
	329	rijndael_cbc_decrypt(CipherContext cc, u_char dest, const u_char *src,
	330	u_int len)
	331	{
6b523bae	332	rijndael_ctx *ctx = &cc->u.rijndael.dec;
	333	u4byte *iv = cc->u.rijndael.iv;
	334	u4byte ivsaved[4];
	335	u4byte cnow = (u4byte) (src+len-RIJNDAEL_BLOCKSIZE);
	336	u4byte plain = (u4byte) (dest+len-RIJNDAEL_BLOCKSIZE);
	337	u4byte *ivp;
	338	int i, blocks = len / RIJNDAEL_BLOCKSIZE;
94ec8c6b	339	if (len == 0)
	340	return;
	341	if (len % RIJNDAEL_BLOCKSIZE)
	342	fatal("rijndael_cbc_decrypt: bad len %d", len);
	343	memcpy(ivsaved, cnow, RIJNDAEL_BLOCKSIZE);
6b523bae	344	for(i = blocks; i > 0; i--, cnow-=4, plain-=4) {
94ec8c6b	345	rijndael_decrypt(ctx, cnow, plain);
6b523bae	346	ivp = (i == 1) ? iv : cnow-4;
	347	plain[0] ^= ivp[0];
	348	plain[1] ^= ivp[1];
	349	plain[2] ^= ivp[2];
	350	plain[3] ^= ivp[3];
94ec8c6b	351	}
	352	memcpy(iv, ivsaved, RIJNDAEL_BLOCKSIZE);
	353	}
	354
	355	Cipher ciphers[] = {
	356	{ "none",
	357	SSH_CIPHER_NONE, 8, 0,
	358	none_setkey, none_setiv,
	359	none_crypt, none_crypt },
	360	{ "des",
	361	SSH_CIPHER_DES, 8, 8,
	362	des_ssh1_setkey, des_ssh1_setiv,
	363	des_ssh1_encrypt, des_ssh1_decrypt },
	364	{ "3des",
	365	SSH_CIPHER_3DES, 8, 16,
	366	des3_ssh1_setkey, des3_setiv,
	367	des3_ssh1_encrypt, des3_ssh1_decrypt },
	368	{ "blowfish",
	369	SSH_CIPHER_BLOWFISH, 8, 16,
	370	blowfish_setkey, blowfish_setiv,
	371	blowfish_ssh1_encrypt, blowfish_ssh1_decrypt },
	372
	373	{ "3des-cbc",
	374	SSH_CIPHER_SSH2, 8, 24,
	375	des3_setkey, des3_setiv,
	376	des3_cbc_encrypt, des3_cbc_decrypt },
	377	{ "blowfish-cbc",
	378	SSH_CIPHER_SSH2, 8, 16,
	379	blowfish_setkey, blowfish_setiv,
	380	blowfish_cbc_encrypt, blowfish_cbc_decrypt },
	381	{ "cast128-cbc",
	382	SSH_CIPHER_SSH2, 8, 16,
	383	cast_setkey, cast_setiv,
	384	cast_cbc_encrypt, cast_cbc_decrypt },
	385	{ "arcfour",
	386	SSH_CIPHER_SSH2, 8, 16,
	387	arcfour_setkey, none_setiv,
	388	arcfour_crypt, arcfour_crypt },
	389	{ "aes128-cbc",
	390	SSH_CIPHER_SSH2, 16, 16,
	391	rijndael_setkey, rijndael_setiv,
	392	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	393	{ "aes192-cbc",
	394	SSH_CIPHER_SSH2, 16, 24,
	395	rijndael_setkey, rijndael_setiv,
	396	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	397	{ "aes256-cbc",
	398	SSH_CIPHER_SSH2, 16, 32,
	399	rijndael_setkey, rijndael_setiv,
	400	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	401	{ "rijndael128-cbc",
	402	SSH_CIPHER_SSH2, 16, 16,
	403	rijndael_setkey, rijndael_setiv,
	404	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	405	{ "rijndael192-cbc",
	406	SSH_CIPHER_SSH2, 16, 24,
	407	rijndael_setkey, rijndael_setiv,
	408	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	409	{ "rijndael256-cbc",
	410	SSH_CIPHER_SSH2, 16, 32,
	411	rijndael_setkey, rijndael_setiv,
	412	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	413	{ "rijndael-cbc@lysator.liu.se",
	414	SSH_CIPHER_SSH2, 16, 32,
415	rijndael_setkey, rijndael_setiv,
416	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
417	{ NULL, SSH_CIPHER_ILLEGAL, 0, 0, NULL, NULL, NULL, NULL }
418	};
419
420	/--/
421
1e3b8b07	422	u_int
94ec8c6b	423	cipher_mask_ssh1(int client)
8ce64345	424	{
1e3b8b07	425	u_int mask = 0;
94ec8c6b	426	mask \|= 1 << SSH_CIPHER_3DES; /* Mandatory */
	427	mask \|= 1 << SSH_CIPHER_BLOWFISH;
	428	if (client) {
	429	mask \|= 1 << SSH_CIPHER_DES;
	430	}
5260325f	431	return mask;
8efc0c15	432	}
94ec8c6b	433
	434	Cipher *
	435	cipher_by_name(const char *name)
8ce64345	436	{
94ec8c6b	437	Cipher *c;
	438	for (c = ciphers; c->name != NULL; c++)
	439	if (strcasecmp(c->name, name) == 0)
	440	return c;
	441	return NULL;
8ce64345	442	}
8efc0c15	443
94ec8c6b	444	Cipher *
94ec8c6b	445	cipher_by_number(int id)
8efc0c15	446	{
94ec8c6b	447	Cipher *c;
	448	for (c = ciphers; c->name != NULL; c++)
	449	if (c->number == id)
	450	return c;
	451	return NULL;
8efc0c15	452	}
8efc0c15	453
a8be9f80	454	#define CIPHER_SEP ","
	455	int
	456	ciphers_valid(const char *names)
	457	{
94ec8c6b	458	Cipher *c;
089fbbd2	459	char ciphers, cp;
a8be9f80	460	char *p;
a8be9f80	461
71276795	462	if (names == NULL \|\| strcmp(names, "") == 0)
a8be9f80	463	return 0;
089fbbd2	464	ciphers = cp = xstrdup(names);
94ec8c6b	465	for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0';
089fbbd2	466	(p = strsep(&cp, CIPHER_SEP))) {
94ec8c6b	467	c = cipher_by_name(p);
	468	if (c == NULL \|\| c->number != SSH_CIPHER_SSH2) {
	469	debug("bad cipher %s [%s]", p, names);
a8be9f80	470	xfree(ciphers);
a8be9f80	471	return 0;
94ec8c6b	472	} else {
33de75a3	473	debug3("cipher ok: %s [%s]", p, names);
a8be9f80	474	}
a8be9f80	475	}
33de75a3	476	debug3("ciphers ok: [%s]", names);
a8be9f80	477	xfree(ciphers);
	478	return 1;
	479	}
	480
aa3378df	481	/*
	482	* Parses the name of the cipher. Returns the number of the corresponding
	483	* cipher, or -1 on error.
	484	*/
8efc0c15	485
	486	int
	487	cipher_number(const char *name)
	488	{
94ec8c6b	489	Cipher *c;
71276795	490	if (name == NULL)
71276795	491	return -1;
94ec8c6b	492	c = cipher_by_name(name);
	493	return (c==NULL) ? -1 : c->number;
	494	}
	495
	496	char *
	497	cipher_name(int id)
	498	{
	499	Cipher *c = cipher_by_number(id);
	500	return (c==NULL) ? "<unknown>" : c->name;
	501	}
	502
	503	void
	504	cipher_init(CipherContext cc, Cipher cipher,
	505	const u_char key, u_int keylen, const u_char iv, u_int ivlen)
	506	{
	507	if (keylen < cipher->key_len)
	508	fatal("cipher_init: key length %d is insufficient for %s.",
	509	keylen, cipher->name);
	510	if (iv != NULL && ivlen < cipher->block_size)
	511	fatal("cipher_init: iv length %d is insufficient for %s.",
	512	ivlen, cipher->name);
	513	cc->cipher = cipher;
	514	cipher->setkey(cc, key, keylen);
	515	cipher->setiv(cc, iv, ivlen);
	516	}
	517
	518	void
	519	cipher_encrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	520	{
	521	if (len % cc->cipher->block_size)
	522	fatal("cipher_encrypt: bad plaintext length %d", len);
	523	cc->cipher->encrypt(cc, dest, src, len);
	524	}
	525
	526	void
	527	cipher_decrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	528	{
	529	if (len % cc->cipher->block_size)
	530	fatal("cipher_decrypt: bad ciphertext length %d", len);
	531	cc->cipher->decrypt(cc, dest, src, len);
8efc0c15	532	}
8efc0c15	533
aa3378df	534	/*
	535	* Selects the cipher, and keys if by computing the MD5 checksum of the
	536	* passphrase and using the resulting 16 bytes as the key.
	537	*/
8efc0c15	538
6ae2364d	539	void
94ec8c6b	540	cipher_set_key_string(CipherContext cc, Cipher cipher,
94ec8c6b	541	const char *passphrase)
8efc0c15	542	{
5260325f	543	MD5_CTX md;
1e3b8b07	544	u_char digest[16];
5260325f	545
5260325f	546	MD5_Init(&md);
94ec8c6b	547	MD5_Update(&md, (const u_char *)passphrase, strlen(passphrase));
5260325f	548	MD5_Final(digest, &md);
5260325f	549
94ec8c6b	550	cipher_init(cc, cipher, digest, 16, NULL, 0);
5260325f	551
	552	memset(digest, 0, sizeof(digest));
	553	memset(&md, 0, sizeof(md));
8efc0c15	554	}