[openssh.git] / cipher.c

/*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
 *                    All rights reserved
 *
 * As far as I am concerned, the code I have written for this software
 * can be used freely for any purpose.  Any derived versions of this
 * software must be clearly marked as such, and if the derived work is
 * incompatible with the protocol description in the RFC file, it must be
 * called by a name other than "ssh" or "Secure Shell".
 *
 *
 * Copyright (c) 1999 Niels Provos.  All rights reserved.
 * Copyright (c) 1999,2000 Markus Friedl.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"
RCSID("$OpenBSD: cipher.c,v 1.45 2001/06/23 15:12:18 itojun Exp $");

#include "xmalloc.h"
#include "log.h"
#include "cipher.h"

#include <openssl/md5.h>

/* no encryption */
static void
none_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
}
static void
none_setiv(CipherContext *cc, const u_char *iv, u_int ivlen)
{
}
static void
none_crypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	memcpy(dest, src, len);
}

/* DES */
static void
des_ssh1_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	static int dowarn = 1;
	if (dowarn) {
		error("Warning: use of DES is strongly discouraged "
		    "due to cryptographic weaknesses");
		dowarn = 0;
	}
	des_set_key((void *)key, cc->u.des.key);
}
static void
des_ssh1_setiv(CipherContext *cc, const u_char *iv, u_int ivlen)
{
	memset(cc->u.des.iv, 0, sizeof(cc->u.des.iv));
}
static void
des_ssh1_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	des_ncbc_encrypt(src, dest, len, cc->u.des.key, &cc->u.des.iv,
	    DES_ENCRYPT);
}
static void
des_ssh1_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	des_ncbc_encrypt(src, dest, len, cc->u.des.key, &cc->u.des.iv,
	    DES_DECRYPT);
}

/* 3DES */
static void
des3_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	des_set_key((void *) key, cc->u.des3.key1);
	des_set_key((void *) (key+8), cc->u.des3.key2);
	des_set_key((void *) (key+16), cc->u.des3.key3);
}
static void
des3_setiv(CipherContext *cc, const u_char *iv, u_int ivlen)
{
	memset(cc->u.des3.iv1, 0, sizeof(cc->u.des3.iv1));
	memset(cc->u.des3.iv2, 0, sizeof(cc->u.des3.iv2));
	memset(cc->u.des3.iv3, 0, sizeof(cc->u.des3.iv3));
	if (iv == NULL)
		return;
	memcpy(cc->u.des3.iv3, (char *)iv, 8);
}
static void
des3_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	des_ede3_cbc_encrypt(src, dest, len,
	    cc->u.des3.key1, cc->u.des3.key2, cc->u.des3.key3,
	    &cc->u.des3.iv3, DES_ENCRYPT);
}
static void
des3_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	des_ede3_cbc_encrypt(src, dest, len,
	    cc->u.des3.key1, cc->u.des3.key2, cc->u.des3.key3,
	    &cc->u.des3.iv3, DES_DECRYPT);
}

/*
 * This is used by SSH1:
 *
 * What kind of triple DES are these 2 routines?
 *
 * Why is there a redundant initialization vector?
 *
 * If only iv3 was used, then, this would till effect have been
 * outer-cbc. However, there is also a private iv1 == iv2 which
 * perhaps makes differential analysis easier. On the other hand, the
 * private iv1 probably makes the CRC-32 attack ineffective. This is a
 * result of that there is no longer any known iv1 to use when
 * choosing the X block.
 */
static void
des3_ssh1_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	des_set_key((void *) key, cc->u.des3.key1);
	des_set_key((void *) (key+8), cc->u.des3.key2);
	if (keylen <= 16)
		des_set_key((void *) key, cc->u.des3.key3);
	else
		des_set_key((void *) (key+16), cc->u.des3.key3);
}
static void
des3_ssh1_encrypt(CipherContext *cc, u_char *dest, const u_char *src,
    u_int len)
{
	des_ncbc_encrypt(src,  dest, len, cc->u.des3.key1, &cc->u.des3.iv1,
	    DES_ENCRYPT);
	des_ncbc_encrypt(dest, dest, len, cc->u.des3.key2, &cc->u.des3.iv2,
	    DES_DECRYPT);
	des_ncbc_encrypt(dest, dest, len, cc->u.des3.key3, &cc->u.des3.iv3,
	    DES_ENCRYPT);
}
static void
des3_ssh1_decrypt(CipherContext *cc, u_char *dest, const u_char *src,
    u_int len)
{
	des_ncbc_encrypt(src,  dest, len, cc->u.des3.key3, &cc->u.des3.iv3,
	    DES_DECRYPT);
	des_ncbc_encrypt(dest, dest, len, cc->u.des3.key2, &cc->u.des3.iv2,
	    DES_ENCRYPT);
	des_ncbc_encrypt(dest, dest, len, cc->u.des3.key1, &cc->u.des3.iv1,
	    DES_DECRYPT);
}

/* Blowfish */
static void
blowfish_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	BF_set_key(&cc->u.bf.key, keylen, (u_char *)key);
}
static void
blowfish_setiv(CipherContext *cc, const u_char *iv, u_int ivlen)
{
	if (iv == NULL)
		memset(cc->u.bf.iv, 0, 8);
	else
		memcpy(cc->u.bf.iv, (char *)iv, 8);
}
static void
blowfish_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src,
     u_int len)
{
	BF_cbc_encrypt((void *)src, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	    BF_ENCRYPT);
}
static void
blowfish_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src,
     u_int len)
{
	BF_cbc_encrypt((void *)src, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	    BF_DECRYPT);
}

/*
 * SSH1 uses a variation on Blowfish, all bytes must be swapped before
 * and after encryption/decryption. Thus the swap_bytes stuff (yuk).
 */
static void
swap_bytes(const u_char *src, u_char *dst, int n)
{
	char c[4];

	/* Process 4 bytes every lap. */
	for (n = n / 4; n > 0; n--) {
		c[3] = *src++;
		c[2] = *src++;
		c[1] = *src++;
		c[0] = *src++;

		*dst++ = c[0];
		*dst++ = c[1];
		*dst++ = c[2];
		*dst++ = c[3];
	}
}

static void
blowfish_ssh1_encrypt(CipherContext *cc, u_char *dest, const u_char *src,
    u_int len)
{
	swap_bytes(src, dest, len);
	BF_cbc_encrypt((void *)dest, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	    BF_ENCRYPT);
	swap_bytes(dest, dest, len);
}
static void
blowfish_ssh1_decrypt(CipherContext *cc, u_char *dest, const u_char *src,
    u_int len)
{
	swap_bytes(src, dest, len);
	BF_cbc_encrypt((void *)dest, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	    BF_DECRYPT);
	swap_bytes(dest, dest, len);
}

/* alleged rc4 */
static void
arcfour_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	RC4_set_key(&cc->u.rc4, keylen, (u_char *)key);
}
static void
arcfour_crypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	RC4(&cc->u.rc4, len, (u_char *)src, dest);
}

/* CAST */
static void
cast_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	CAST_set_key(&cc->u.cast.key, keylen, (u_char *) key);
}
static void
cast_setiv(CipherContext *cc, const u_char *iv, u_int ivlen)
{
	if (iv == NULL)
		fatal("no IV for %s.", cc->cipher->name);
	memcpy(cc->u.cast.iv, (char *)iv, 8);
}
static void
cast_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	CAST_cbc_encrypt(src, dest, len, &cc->u.cast.key, cc->u.cast.iv,
	    CAST_ENCRYPT);
}
static void
cast_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	CAST_cbc_encrypt(src, dest, len, &cc->u.cast.key, cc->u.cast.iv,
	    CAST_DECRYPT);
}

/* RIJNDAEL */

#define RIJNDAEL_BLOCKSIZE 16
static void
rijndael_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	rijndael_set_key(&cc->u.rijndael.enc, (u4byte *)key, 8*keylen, 1);
	rijndael_set_key(&cc->u.rijndael.dec, (u4byte *)key, 8*keylen, 0);
}
static void
rijndael_setiv(CipherContext *cc, const u_char *iv, u_int ivlen)
{
	if (iv == NULL)
		fatal("no IV for %s.", cc->cipher->name);
	memcpy((u_char *)cc->u.rijndael.iv, iv, RIJNDAEL_BLOCKSIZE);
}
static void
rijndael_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src,
    u_int len)
{
	rijndael_ctx *ctx = &cc->u.rijndael.enc;
	u4byte *iv = cc->u.rijndael.iv;
	u4byte in[4];
	u4byte *cprev, *cnow, *plain;
	int i, blocks = len / RIJNDAEL_BLOCKSIZE;
	if (len == 0)
		return;
	if (len % RIJNDAEL_BLOCKSIZE)
		fatal("rijndael_cbc_encrypt: bad len %d", len);
	cnow  = (u4byte*) dest;
	plain = (u4byte*) src;
	cprev = iv;
	for(i = 0; i < blocks; i++, plain+=4, cnow+=4) {
		in[0] = plain[0] ^ cprev[0];
		in[1] = plain[1] ^ cprev[1];
		in[2] = plain[2] ^ cprev[2];
		in[3] = plain[3] ^ cprev[3];
		rijndael_encrypt(ctx, in, cnow);
		cprev = cnow;
	}
	memcpy(iv, cprev, RIJNDAEL_BLOCKSIZE);
}

static void
rijndael_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src,
    u_int len)
{
	rijndael_ctx *ctx = &cc->u.rijndael.dec;
	u4byte *iv = cc->u.rijndael.iv;
	u4byte ivsaved[4];
	u4byte *cnow =  (u4byte*) (src+len-RIJNDAEL_BLOCKSIZE);
	u4byte *plain = (u4byte*) (dest+len-RIJNDAEL_BLOCKSIZE);
	u4byte *ivp;
	int i, blocks = len / RIJNDAEL_BLOCKSIZE;
	if (len == 0)
		return;
	if (len % RIJNDAEL_BLOCKSIZE)
		fatal("rijndael_cbc_decrypt: bad len %d", len);
	memcpy(ivsaved, cnow, RIJNDAEL_BLOCKSIZE);
	for(i = blocks; i > 0; i--, cnow-=4, plain-=4) {
		rijndael_decrypt(ctx, cnow, plain);
		ivp =  (i == 1) ? iv : cnow-4;
		plain[0] ^= ivp[0];
		plain[1] ^= ivp[1];
		plain[2] ^= ivp[2];
		plain[3] ^= ivp[3];
	}
	memcpy(iv, ivsaved, RIJNDAEL_BLOCKSIZE);
}

Cipher ciphers[] = {
	{ "none",
		SSH_CIPHER_NONE, 8, 0,
		none_setkey, none_setiv,
		none_crypt, none_crypt },
	{ "des",
		SSH_CIPHER_DES, 8, 8,
		des_ssh1_setkey, des_ssh1_setiv,
		des_ssh1_encrypt, des_ssh1_decrypt },
	{ "3des",
		SSH_CIPHER_3DES, 8, 16,
		des3_ssh1_setkey, des3_setiv,
		des3_ssh1_encrypt, des3_ssh1_decrypt },
	{ "blowfish",
		SSH_CIPHER_BLOWFISH, 8, 16,
		blowfish_setkey, blowfish_setiv,
		blowfish_ssh1_encrypt, blowfish_ssh1_decrypt },

	{ "3des-cbc",
		SSH_CIPHER_SSH2, 8, 24,
		des3_setkey, des3_setiv,
		des3_cbc_encrypt, des3_cbc_decrypt },
	{ "blowfish-cbc",
		SSH_CIPHER_SSH2, 8, 16,
		blowfish_setkey, blowfish_setiv,
		blowfish_cbc_encrypt, blowfish_cbc_decrypt },
	{ "cast128-cbc",
		SSH_CIPHER_SSH2, 8, 16,
		cast_setkey, cast_setiv,
		cast_cbc_encrypt, cast_cbc_decrypt },
	{ "arcfour",
		SSH_CIPHER_SSH2, 8, 16,
		arcfour_setkey, none_setiv,
		arcfour_crypt, arcfour_crypt },
	{ "aes128-cbc",
		SSH_CIPHER_SSH2, 16, 16,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ "aes192-cbc",
		SSH_CIPHER_SSH2, 16, 24,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ "aes256-cbc",
		SSH_CIPHER_SSH2, 16, 32,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ "rijndael128-cbc",
		SSH_CIPHER_SSH2, 16, 16,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ "rijndael192-cbc",
		SSH_CIPHER_SSH2, 16, 24,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ "rijndael256-cbc",
		SSH_CIPHER_SSH2, 16, 32,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ "rijndael-cbc@lysator.liu.se",
		SSH_CIPHER_SSH2, 16, 32,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ NULL, SSH_CIPHER_ILLEGAL, 0, 0, NULL, NULL, NULL, NULL }
};

/*--*/

u_int
cipher_mask_ssh1(int client)
{
	u_int mask = 0;
	mask |= 1 << SSH_CIPHER_3DES;           /* Mandatory */
	mask |= 1 << SSH_CIPHER_BLOWFISH;
	if (client) {
		mask |= 1 << SSH_CIPHER_DES;
	}
	return mask;
}

Cipher *
cipher_by_name(const char *name)
{
	Cipher *c;
	for (c = ciphers; c->name != NULL; c++)
		if (strcasecmp(c->name, name) == 0)
			return c;
	return NULL;
}

Cipher *
cipher_by_number(int id)
{
	Cipher *c;
	for (c = ciphers; c->name != NULL; c++)
		if (c->number == id)
			return c;
	return NULL;
}

#define	CIPHER_SEP	","
int
ciphers_valid(const char *names)
{
	Cipher *c;
	char *ciphers, *cp;
	char *p;

	if (names == NULL || strcmp(names, "") == 0)
		return 0;
	ciphers = cp = xstrdup(names);
	for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0';
	     (p = strsep(&cp, CIPHER_SEP))) {
		c = cipher_by_name(p);
		if (c == NULL || c->number != SSH_CIPHER_SSH2) {
			debug("bad cipher %s [%s]", p, names);
			xfree(ciphers);
			return 0;
		} else {
			debug3("cipher ok: %s [%s]", p, names);
		}
	}
	debug3("ciphers ok: [%s]", names);
	xfree(ciphers);
	return 1;
}

/*
 * Parses the name of the cipher.  Returns the number of the corresponding
 * cipher, or -1 on error.
 */

int
cipher_number(const char *name)
{
	Cipher *c;
	if (name == NULL)
		return -1;
	c = cipher_by_name(name);
	return (c==NULL) ? -1 : c->number;
}

char *
cipher_name(int id)
{
	Cipher *c = cipher_by_number(id);
	return (c==NULL) ? "<unknown>" : c->name;
}

void
cipher_init(CipherContext *cc, Cipher *cipher,
    const u_char *key, u_int keylen, const u_char *iv, u_int ivlen)
{
	if (keylen < cipher->key_len)
		fatal("cipher_init: key length %d is insufficient for %s.",
		    keylen, cipher->name);
	if (iv != NULL && ivlen < cipher->block_size)
		fatal("cipher_init: iv length %d is insufficient for %s.",
		    ivlen, cipher->name);
	cc->cipher = cipher;
	cipher->setkey(cc, key, keylen);
	cipher->setiv(cc, iv, ivlen);
}

void
cipher_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	if (len % cc->cipher->block_size)
		fatal("cipher_encrypt: bad plaintext length %d", len);
	cc->cipher->encrypt(cc, dest, src, len);
}

void
cipher_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	if (len % cc->cipher->block_size)
		fatal("cipher_decrypt: bad ciphertext length %d", len);
	cc->cipher->decrypt(cc, dest, src, len);
}

/*
 * Selects the cipher, and keys if by computing the MD5 checksum of the
 * passphrase and using the resulting 16 bytes as the key.
 */

void
cipher_set_key_string(CipherContext *cc, Cipher *cipher,
    const char *passphrase)
{
	MD5_CTX md;
	u_char digest[16];

	MD5_Init(&md);
	MD5_Update(&md, (const u_char *)passphrase, strlen(passphrase));
	MD5_Final(digest, &md);

	cipher_init(cc, cipher, digest, 16, NULL, 0);

	memset(digest, 0, sizeof(digest));
	memset(&md, 0, sizeof(md));
}
Commit	Line	Data
8efc0c15	1	/*
5260325f	2	* Author: Tatu Ylonen <ylo@cs.hut.fi>
5260325f	3	* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5260325f	4	* All rights reserved
6ae2364d	5	*
bcbf86ec	6	* As far as I am concerned, the code I have written for this software
	7	* can be used freely for any purpose. Any derived versions of this
	8	* software must be clearly marked as such, and if the derived work is
	9	* incompatible with the protocol description in the RFC file, it must be
	10	* called by a name other than "ssh" or "Secure Shell".
	11	*
	12	*
	13	* Copyright (c) 1999 Niels Provos. All rights reserved.
	14	* Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
	15	*
	16	* Redistribution and use in source and binary forms, with or without
	17	* modification, are permitted provided that the following conditions
	18	* are met:
	19	* 1. Redistributions of source code must retain the above copyright
	20	* notice, this list of conditions and the following disclaimer.
	21	* 2. Redistributions in binary form must reproduce the above copyright
	22	* notice, this list of conditions and the following disclaimer in the
	23	* documentation and/or other materials provided with the distribution.
6ae2364d	24	*
bcbf86ec	25	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	26	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	27	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	28	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
	29	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	30	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	31	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	32	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	33	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	34	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
5260325f	35	*/
8efc0c15	36
8efc0c15	37	#include "includes.h"
396c147e	38	RCSID("$OpenBSD: cipher.c,v 1.45 2001/06/23 15:12:18 itojun Exp $");
8efc0c15	39
a8be9f80	40	#include "xmalloc.h"
42f11eb2	41	#include "log.h"
42f11eb2	42	#include "cipher.h"
8efc0c15	43
	44	#include <openssl/md5.h>
	45
94ec8c6b	46	/* no encryption */
396c147e	47	static void
94ec8c6b	48	none_setkey(CipherContext cc, const u_char key, u_int keylen)
	49	{
	50	}
396c147e	51	static void
94ec8c6b	52	none_setiv(CipherContext cc, const u_char iv, u_int ivlen)
	53	{
	54	}
396c147e	55	static void
94ec8c6b	56	none_crypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	57	{
	58	memcpy(dest, src, len);
	59	}
	60
	61	/* DES */
396c147e	62	static void
94ec8c6b	63	des_ssh1_setkey(CipherContext cc, const u_char key, u_int keylen)
	64	{
	65	static int dowarn = 1;
	66	if (dowarn) {
	67	error("Warning: use of DES is strongly discouraged "
	68	"due to cryptographic weaknesses");
	69	dowarn = 0;
	70	}
	71	des_set_key((void *)key, cc->u.des.key);
	72	}
396c147e	73	static void
94ec8c6b	74	des_ssh1_setiv(CipherContext cc, const u_char iv, u_int ivlen)
	75	{
	76	memset(cc->u.des.iv, 0, sizeof(cc->u.des.iv));
	77	}
396c147e	78	static void
94ec8c6b	79	des_ssh1_encrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	80	{
	81	des_ncbc_encrypt(src, dest, len, cc->u.des.key, &cc->u.des.iv,
	82	DES_ENCRYPT);
	83	}
396c147e	84	static void
94ec8c6b	85	des_ssh1_decrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	86	{
	87	des_ncbc_encrypt(src, dest, len, cc->u.des.key, &cc->u.des.iv,
	88	DES_DECRYPT);
	89	}
	90
	91	/* 3DES */
396c147e	92	static void
94ec8c6b	93	des3_setkey(CipherContext cc, const u_char key, u_int keylen)
	94	{
	95	des_set_key((void *) key, cc->u.des3.key1);
	96	des_set_key((void *) (key+8), cc->u.des3.key2);
	97	des_set_key((void *) (key+16), cc->u.des3.key3);
	98	}
396c147e	99	static void
94ec8c6b	100	des3_setiv(CipherContext cc, const u_char iv, u_int ivlen)
94ec8c6b	101	{
2cf27bc4	102	memset(cc->u.des3.iv1, 0, sizeof(cc->u.des3.iv1));
94ec8c6b	103	memset(cc->u.des3.iv2, 0, sizeof(cc->u.des3.iv2));
	104	memset(cc->u.des3.iv3, 0, sizeof(cc->u.des3.iv3));
	105	if (iv == NULL)
	106	return;
	107	memcpy(cc->u.des3.iv3, (char *)iv, 8);
	108	}
396c147e	109	static void
94ec8c6b	110	des3_cbc_encrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	111	{
	112	des_ede3_cbc_encrypt(src, dest, len,
	113	cc->u.des3.key1, cc->u.des3.key2, cc->u.des3.key3,
	114	&cc->u.des3.iv3, DES_ENCRYPT);
	115	}
396c147e	116	static void
94ec8c6b	117	des3_cbc_decrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	118	{
	119	des_ede3_cbc_encrypt(src, dest, len,
	120	cc->u.des3.key1, cc->u.des3.key2, cc->u.des3.key3,
	121	&cc->u.des3.iv3, DES_DECRYPT);
	122	}
	123
8efc0c15	124	/*
a8be9f80	125	* This is used by SSH1:
	126	*
	127	* What kind of triple DES are these 2 routines?
8efc0c15	128	*
	129	* Why is there a redundant initialization vector?
	130	*
	131	* If only iv3 was used, then, this would till effect have been
	132	* outer-cbc. However, there is also a private iv1 == iv2 which
	133	* perhaps makes differential analysis easier. On the other hand, the
	134	* private iv1 probably makes the CRC-32 attack ineffective. This is a
	135	* result of that there is no longer any known iv1 to use when
	136	* choosing the X block.
	137	*/
396c147e	138	static void
94ec8c6b	139	des3_ssh1_setkey(CipherContext cc, const u_char key, u_int keylen)
	140	{
	141	des_set_key((void *) key, cc->u.des3.key1);
	142	des_set_key((void *) (key+8), cc->u.des3.key2);
	143	if (keylen <= 16)
	144	des_set_key((void *) key, cc->u.des3.key3);
	145	else
	146	des_set_key((void *) (key+16), cc->u.des3.key3);
	147	}
396c147e	148	static void
94ec8c6b	149	des3_ssh1_encrypt(CipherContext cc, u_char dest, const u_char *src,
94ec8c6b	150	u_int len)
8efc0c15	151	{
2cf27bc4	152	des_ncbc_encrypt(src, dest, len, cc->u.des3.key1, &cc->u.des3.iv1,
	153	DES_ENCRYPT);
	154	des_ncbc_encrypt(dest, dest, len, cc->u.des3.key2, &cc->u.des3.iv2,
	155	DES_DECRYPT);
	156	des_ncbc_encrypt(dest, dest, len, cc->u.des3.key3, &cc->u.des3.iv3,
	157	DES_ENCRYPT);
8efc0c15	158	}
396c147e	159	static void
94ec8c6b	160	des3_ssh1_decrypt(CipherContext cc, u_char dest, const u_char *src,
94ec8c6b	161	u_int len)
8efc0c15	162	{
2cf27bc4	163	des_ncbc_encrypt(src, dest, len, cc->u.des3.key3, &cc->u.des3.iv3,
	164	DES_DECRYPT);
	165	des_ncbc_encrypt(dest, dest, len, cc->u.des3.key2, &cc->u.des3.iv2,
	166	DES_ENCRYPT);
	167	des_ncbc_encrypt(dest, dest, len, cc->u.des3.key1, &cc->u.des3.iv1,
	168	DES_DECRYPT);
8efc0c15	169	}
8efc0c15	170
94ec8c6b	171	/* Blowfish */
396c147e	172	static void
94ec8c6b	173	blowfish_setkey(CipherContext cc, const u_char key, u_int keylen)
94ec8c6b	174	{
1e3b8b07	175	BF_set_key(&cc->u.bf.key, keylen, (u_char *)key);
94ec8c6b	176	}
396c147e	177	static void
94ec8c6b	178	blowfish_setiv(CipherContext cc, const u_char iv, u_int ivlen)
	179	{
	180	if (iv == NULL)
	181	memset(cc->u.bf.iv, 0, 8);
	182	else
	183	memcpy(cc->u.bf.iv, (char *)iv, 8);
	184	}
396c147e	185	static void
94ec8c6b	186	blowfish_cbc_encrypt(CipherContext cc, u_char dest, const u_char *src,
	187	u_int len)
	188	{
	189	BF_cbc_encrypt((void *)src, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	190	BF_ENCRYPT);
	191	}
396c147e	192	static void
94ec8c6b	193	blowfish_cbc_decrypt(CipherContext cc, u_char dest, const u_char *src,
	194	u_int len)
	195	{
	196	BF_cbc_encrypt((void *)src, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	197	BF_DECRYPT);
	198	}
	199
8efc0c15	200	/*
a8be9f80	201	* SSH1 uses a variation on Blowfish, all bytes must be swapped before
8efc0c15	202	* and after encryption/decryption. Thus the swap_bytes stuff (yuk).
8efc0c15	203	*/
5260325f	204	static void
1e3b8b07	205	swap_bytes(const u_char src, u_char dst, int n)
8efc0c15	206	{
a22aff1f	207	char c[4];
5260325f	208
a22aff1f	209	/* Process 4 bytes every lap. */
	210	for (n = n / 4; n > 0; n--) {
	211	c[3] = *src++;
	212	c[2] = *src++;
	213	c[1] = *src++;
	214	c[0] = *src++;
5260325f	215
a22aff1f	216	*dst++ = c[0];
	217	*dst++ = c[1];
	218	*dst++ = c[2];
	219	*dst++ = c[3];
5260325f	220	}
8efc0c15	221	}
8efc0c15	222
396c147e	223	static void
94ec8c6b	224	blowfish_ssh1_encrypt(CipherContext cc, u_char dest, const u_char *src,
	225	u_int len)
	226	{
	227	swap_bytes(src, dest, len);
	228	BF_cbc_encrypt((void *)dest, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	229	BF_ENCRYPT);
	230	swap_bytes(dest, dest, len);
	231	}
396c147e	232	static void
94ec8c6b	233	blowfish_ssh1_decrypt(CipherContext cc, u_char dest, const u_char *src,
	234	u_int len)
	235	{
	236	swap_bytes(src, dest, len);
	237	BF_cbc_encrypt((void *)dest, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	238	BF_DECRYPT);
	239	swap_bytes(dest, dest, len);
	240	}
8efc0c15	241
94ec8c6b	242	/* alleged rc4 */
396c147e	243	static void
94ec8c6b	244	arcfour_setkey(CipherContext cc, const u_char key, u_int keylen)
	245	{
	246	RC4_set_key(&cc->u.rc4, keylen, (u_char *)key);
	247	}
396c147e	248	static void
94ec8c6b	249	arcfour_crypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	250	{
	251	RC4(&cc->u.rc4, len, (u_char *)src, dest);
	252	}
8efc0c15	253
94ec8c6b	254	/* CAST */
396c147e	255	static void
94ec8c6b	256	cast_setkey(CipherContext cc, const u_char key, u_int keylen)
8efc0c15	257	{
1e3b8b07	258	CAST_set_key(&cc->u.cast.key, keylen, (u_char *) key);
94ec8c6b	259	}
396c147e	260	static void
94ec8c6b	261	cast_setiv(CipherContext cc, const u_char iv, u_int ivlen)
94ec8c6b	262	{
2b87da3b	263	if (iv == NULL)
94ec8c6b	264	fatal("no IV for %s.", cc->cipher->name);
	265	memcpy(cc->u.cast.iv, (char *)iv, 8);
	266	}
396c147e	267	static void
94ec8c6b	268	cast_cbc_encrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	269	{
	270	CAST_cbc_encrypt(src, dest, len, &cc->u.cast.key, cc->u.cast.iv,
	271	CAST_ENCRYPT);
	272	}
396c147e	273	static void
94ec8c6b	274	cast_cbc_decrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	275	{
	276	CAST_cbc_encrypt(src, dest, len, &cc->u.cast.key, cc->u.cast.iv,
	277	CAST_DECRYPT);
	278	}
	279
	280	/* RIJNDAEL */
	281
	282	#define RIJNDAEL_BLOCKSIZE 16
396c147e	283	static void
94ec8c6b	284	rijndael_setkey(CipherContext cc, const u_char key, u_int keylen)
94ec8c6b	285	{
6b523bae	286	rijndael_set_key(&cc->u.rijndael.enc, (u4byte )key, 8keylen, 1);
6b523bae	287	rijndael_set_key(&cc->u.rijndael.dec, (u4byte )key, 8keylen, 0);
94ec8c6b	288	}
396c147e	289	static void
94ec8c6b	290	rijndael_setiv(CipherContext cc, const u_char iv, u_int ivlen)
94ec8c6b	291	{
2b87da3b	292	if (iv == NULL)
6b523bae	293	fatal("no IV for %s.", cc->cipher->name);
6b523bae	294	memcpy((u_char *)cc->u.rijndael.iv, iv, RIJNDAEL_BLOCKSIZE);
8ce64345	295	}
396c147e	296	static void
94ec8c6b	297	rijndael_cbc_encrypt(CipherContext cc, u_char dest, const u_char *src,
	298	u_int len)
	299	{
6b523bae	300	rijndael_ctx *ctx = &cc->u.rijndael.enc;
	301	u4byte *iv = cc->u.rijndael.iv;
	302	u4byte in[4];
	303	u4byte cprev, cnow, *plain;
	304	int i, blocks = len / RIJNDAEL_BLOCKSIZE;
94ec8c6b	305	if (len == 0)
	306	return;
	307	if (len % RIJNDAEL_BLOCKSIZE)
	308	fatal("rijndael_cbc_encrypt: bad len %d", len);
6b523bae	309	cnow = (u4byte*) dest;
6b523bae	310	plain = (u4byte*) src;
94ec8c6b	311	cprev = iv;
6b523bae	312	for(i = 0; i < blocks; i++, plain+=4, cnow+=4) {
	313	in[0] = plain[0] ^ cprev[0];
	314	in[1] = plain[1] ^ cprev[1];
	315	in[2] = plain[2] ^ cprev[2];
	316	in[3] = plain[3] ^ cprev[3];
94ec8c6b	317	rijndael_encrypt(ctx, in, cnow);
	318	cprev = cnow;
	319	}
	320	memcpy(iv, cprev, RIJNDAEL_BLOCKSIZE);
	321	}
	322
396c147e	323	static void
94ec8c6b	324	rijndael_cbc_decrypt(CipherContext cc, u_char dest, const u_char *src,
	325	u_int len)
	326	{
6b523bae	327	rijndael_ctx *ctx = &cc->u.rijndael.dec;
	328	u4byte *iv = cc->u.rijndael.iv;
	329	u4byte ivsaved[4];
	330	u4byte cnow = (u4byte) (src+len-RIJNDAEL_BLOCKSIZE);
	331	u4byte plain = (u4byte) (dest+len-RIJNDAEL_BLOCKSIZE);
	332	u4byte *ivp;
	333	int i, blocks = len / RIJNDAEL_BLOCKSIZE;
94ec8c6b	334	if (len == 0)
	335	return;
	336	if (len % RIJNDAEL_BLOCKSIZE)
	337	fatal("rijndael_cbc_decrypt: bad len %d", len);
	338	memcpy(ivsaved, cnow, RIJNDAEL_BLOCKSIZE);
6b523bae	339	for(i = blocks; i > 0; i--, cnow-=4, plain-=4) {
94ec8c6b	340	rijndael_decrypt(ctx, cnow, plain);
6b523bae	341	ivp = (i == 1) ? iv : cnow-4;
	342	plain[0] ^= ivp[0];
	343	plain[1] ^= ivp[1];
	344	plain[2] ^= ivp[2];
	345	plain[3] ^= ivp[3];
94ec8c6b	346	}
	347	memcpy(iv, ivsaved, RIJNDAEL_BLOCKSIZE);
	348	}
	349
	350	Cipher ciphers[] = {
	351	{ "none",
	352	SSH_CIPHER_NONE, 8, 0,
	353	none_setkey, none_setiv,
	354	none_crypt, none_crypt },
	355	{ "des",
	356	SSH_CIPHER_DES, 8, 8,
	357	des_ssh1_setkey, des_ssh1_setiv,
	358	des_ssh1_encrypt, des_ssh1_decrypt },
	359	{ "3des",
	360	SSH_CIPHER_3DES, 8, 16,
	361	des3_ssh1_setkey, des3_setiv,
	362	des3_ssh1_encrypt, des3_ssh1_decrypt },
	363	{ "blowfish",
	364	SSH_CIPHER_BLOWFISH, 8, 16,
	365	blowfish_setkey, blowfish_setiv,
	366	blowfish_ssh1_encrypt, blowfish_ssh1_decrypt },
	367
	368	{ "3des-cbc",
	369	SSH_CIPHER_SSH2, 8, 24,
	370	des3_setkey, des3_setiv,
	371	des3_cbc_encrypt, des3_cbc_decrypt },
	372	{ "blowfish-cbc",
	373	SSH_CIPHER_SSH2, 8, 16,
	374	blowfish_setkey, blowfish_setiv,
	375	blowfish_cbc_encrypt, blowfish_cbc_decrypt },
	376	{ "cast128-cbc",
	377	SSH_CIPHER_SSH2, 8, 16,
	378	cast_setkey, cast_setiv,
	379	cast_cbc_encrypt, cast_cbc_decrypt },
	380	{ "arcfour",
	381	SSH_CIPHER_SSH2, 8, 16,
	382	arcfour_setkey, none_setiv,
	383	arcfour_crypt, arcfour_crypt },
	384	{ "aes128-cbc",
	385	SSH_CIPHER_SSH2, 16, 16,
	386	rijndael_setkey, rijndael_setiv,
	387	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	388	{ "aes192-cbc",
	389	SSH_CIPHER_SSH2, 16, 24,
	390	rijndael_setkey, rijndael_setiv,
	391	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	392	{ "aes256-cbc",
	393	SSH_CIPHER_SSH2, 16, 32,
	394	rijndael_setkey, rijndael_setiv,
	395	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	396	{ "rijndael128-cbc",
	397	SSH_CIPHER_SSH2, 16, 16,
	398	rijndael_setkey, rijndael_setiv,
	399	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	400	{ "rijndael192-cbc",
	401	SSH_CIPHER_SSH2, 16, 24,
	402	rijndael_setkey, rijndael_setiv,
	403	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	404	{ "rijndael256-cbc",
	405	SSH_CIPHER_SSH2, 16, 32,
	406	rijndael_setkey, rijndael_setiv,
	407	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	408	{ "rijndael-cbc@lysator.liu.se",
	409	SSH_CIPHER_SSH2, 16, 32,
410	rijndael_setkey, rijndael_setiv,
411	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
2b87da3b	412	{ NULL, SSH_CIPHER_ILLEGAL, 0, 0, NULL, NULL, NULL, NULL }
94ec8c6b	413	};
	414
	415	/--/
	416
1e3b8b07	417	u_int
94ec8c6b	418	cipher_mask_ssh1(int client)
8ce64345	419	{
1e3b8b07	420	u_int mask = 0;
94ec8c6b	421	mask \|= 1 << SSH_CIPHER_3DES; /* Mandatory */
	422	mask \|= 1 << SSH_CIPHER_BLOWFISH;
	423	if (client) {
	424	mask \|= 1 << SSH_CIPHER_DES;
	425	}
5260325f	426	return mask;
8efc0c15	427	}
94ec8c6b	428
	429	Cipher *
	430	cipher_by_name(const char *name)
8ce64345	431	{
94ec8c6b	432	Cipher *c;
	433	for (c = ciphers; c->name != NULL; c++)
	434	if (strcasecmp(c->name, name) == 0)
	435	return c;
	436	return NULL;
8ce64345	437	}
8efc0c15	438
94ec8c6b	439	Cipher *
94ec8c6b	440	cipher_by_number(int id)
8efc0c15	441	{
94ec8c6b	442	Cipher *c;
	443	for (c = ciphers; c->name != NULL; c++)
	444	if (c->number == id)
	445	return c;
	446	return NULL;
8efc0c15	447	}
8efc0c15	448
a8be9f80	449	#define CIPHER_SEP ","
	450	int
	451	ciphers_valid(const char *names)
	452	{
94ec8c6b	453	Cipher *c;
089fbbd2	454	char ciphers, cp;
a8be9f80	455	char *p;
a8be9f80	456
71276795	457	if (names == NULL \|\| strcmp(names, "") == 0)
a8be9f80	458	return 0;
089fbbd2	459	ciphers = cp = xstrdup(names);
94ec8c6b	460	for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0';
089fbbd2	461	(p = strsep(&cp, CIPHER_SEP))) {
94ec8c6b	462	c = cipher_by_name(p);
	463	if (c == NULL \|\| c->number != SSH_CIPHER_SSH2) {
	464	debug("bad cipher %s [%s]", p, names);
a8be9f80	465	xfree(ciphers);
a8be9f80	466	return 0;
94ec8c6b	467	} else {
33de75a3	468	debug3("cipher ok: %s [%s]", p, names);
a8be9f80	469	}
a8be9f80	470	}
33de75a3	471	debug3("ciphers ok: [%s]", names);
a8be9f80	472	xfree(ciphers);
	473	return 1;
	474	}
	475
aa3378df	476	/*
	477	* Parses the name of the cipher. Returns the number of the corresponding
	478	* cipher, or -1 on error.
	479	*/
8efc0c15	480
	481	int
	482	cipher_number(const char *name)
	483	{
94ec8c6b	484	Cipher *c;
71276795	485	if (name == NULL)
71276795	486	return -1;
94ec8c6b	487	c = cipher_by_name(name);
	488	return (c==NULL) ? -1 : c->number;
	489	}
	490
	491	char *
	492	cipher_name(int id)
	493	{
	494	Cipher *c = cipher_by_number(id);
	495	return (c==NULL) ? "<unknown>" : c->name;
	496	}
	497
	498	void
	499	cipher_init(CipherContext cc, Cipher cipher,
	500	const u_char key, u_int keylen, const u_char iv, u_int ivlen)
	501	{
	502	if (keylen < cipher->key_len)
	503	fatal("cipher_init: key length %d is insufficient for %s.",
	504	keylen, cipher->name);
	505	if (iv != NULL && ivlen < cipher->block_size)
	506	fatal("cipher_init: iv length %d is insufficient for %s.",
	507	ivlen, cipher->name);
	508	cc->cipher = cipher;
	509	cipher->setkey(cc, key, keylen);
	510	cipher->setiv(cc, iv, ivlen);
	511	}
	512
	513	void
	514	cipher_encrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	515	{
	516	if (len % cc->cipher->block_size)
	517	fatal("cipher_encrypt: bad plaintext length %d", len);
	518	cc->cipher->encrypt(cc, dest, src, len);
	519	}
	520
	521	void
	522	cipher_decrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	523	{
	524	if (len % cc->cipher->block_size)
	525	fatal("cipher_decrypt: bad ciphertext length %d", len);
	526	cc->cipher->decrypt(cc, dest, src, len);
8efc0c15	527	}
8efc0c15	528
aa3378df	529	/*
	530	* Selects the cipher, and keys if by computing the MD5 checksum of the
	531	* passphrase and using the resulting 16 bytes as the key.
	532	*/
8efc0c15	533
6ae2364d	534	void
94ec8c6b	535	cipher_set_key_string(CipherContext cc, Cipher cipher,
94ec8c6b	536	const char *passphrase)
8efc0c15	537	{
5260325f	538	MD5_CTX md;
1e3b8b07	539	u_char digest[16];
5260325f	540
5260325f	541	MD5_Init(&md);
94ec8c6b	542	MD5_Update(&md, (const u_char *)passphrase, strlen(passphrase));
5260325f	543	MD5_Final(digest, &md);
5260325f	544
94ec8c6b	545	cipher_init(cc, cipher, digest, 16, NULL, 0);
5260325f	546
	547	memset(digest, 0, sizeof(digest));
	548	memset(&md, 0, sizeof(md));
8efc0c15	549	}