[openssh.git] / cipher.c

/*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
 *                    All rights reserved
 *
 * As far as I am concerned, the code I have written for this software
 * can be used freely for any purpose.  Any derived versions of this
 * software must be clearly marked as such, and if the derived work is
 * incompatible with the protocol description in the RFC file, it must be
 * called by a name other than "ssh" or "Secure Shell".
 *
 *
 * Copyright (c) 1999 Niels Provos.  All rights reserved.
 * Copyright (c) 1999,2000 Markus Friedl.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"
RCSID("$OpenBSD: cipher.c,v 1.37 2000/10/23 19:31:54 markus Exp $");

#include "ssh.h"
#include "xmalloc.h"

#include <openssl/md5.h>


/* no encryption */
void
none_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
}
void
none_setiv(CipherContext *cc, const u_char *iv, u_int ivlen)
{
}
void
none_crypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	memcpy(dest, src, len);
}

/* DES */
void
des_ssh1_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	static int dowarn = 1;
	if (dowarn) {
		error("Warning: use of DES is strongly discouraged "
		    "due to cryptographic weaknesses");
		dowarn = 0;
	}
	des_set_key((void *)key, cc->u.des.key);
}
void
des_ssh1_setiv(CipherContext *cc, const u_char *iv, u_int ivlen)
{
	memset(cc->u.des.iv, 0, sizeof(cc->u.des.iv));
}
void
des_ssh1_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	des_ncbc_encrypt(src, dest, len, cc->u.des.key, &cc->u.des.iv,
	    DES_ENCRYPT);
}
void
des_ssh1_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	des_ncbc_encrypt(src, dest, len, cc->u.des.key, &cc->u.des.iv,
	    DES_DECRYPT);
}

/* 3DES */
void
des3_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	des_set_key((void *) key, cc->u.des3.key1);
	des_set_key((void *) (key+8), cc->u.des3.key2);
	des_set_key((void *) (key+16), cc->u.des3.key3);
}
void
des3_setiv(CipherContext *cc, const u_char *iv, u_int ivlen)
{
	memset(cc->u.des3.iv2, 0, sizeof(cc->u.des3.iv2));
	memset(cc->u.des3.iv3, 0, sizeof(cc->u.des3.iv3));
	if (iv == NULL)
		return;
	memcpy(cc->u.des3.iv3, (char *)iv, 8);
}
void
des3_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	des_ede3_cbc_encrypt(src, dest, len,
	    cc->u.des3.key1, cc->u.des3.key2, cc->u.des3.key3,
	    &cc->u.des3.iv3, DES_ENCRYPT);
}
void
des3_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	des_ede3_cbc_encrypt(src, dest, len,
	    cc->u.des3.key1, cc->u.des3.key2, cc->u.des3.key3,
	    &cc->u.des3.iv3, DES_DECRYPT);
}

/*
 * This is used by SSH1:
 *
 * What kind of triple DES are these 2 routines?
 *
 * Why is there a redundant initialization vector?
 *
 * If only iv3 was used, then, this would till effect have been
 * outer-cbc. However, there is also a private iv1 == iv2 which
 * perhaps makes differential analysis easier. On the other hand, the
 * private iv1 probably makes the CRC-32 attack ineffective. This is a
 * result of that there is no longer any known iv1 to use when
 * choosing the X block.
 */
void
des3_ssh1_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	des_set_key((void *) key, cc->u.des3.key1);
	des_set_key((void *) (key+8), cc->u.des3.key2);
	if (keylen <= 16)
		des_set_key((void *) key, cc->u.des3.key3);
	else
		des_set_key((void *) (key+16), cc->u.des3.key3);
}
void
des3_ssh1_encrypt(CipherContext *cc, u_char *dest, const u_char *src,
    u_int len)
{
	des_cblock iv1;
	des_cblock *iv2 = &cc->u.des3.iv2;
	des_cblock *iv3 = &cc->u.des3.iv3;

	memcpy(&iv1, iv2, 8);

	des_cbc_encrypt(src, dest, len, cc->u.des3.key1, &iv1, DES_ENCRYPT);
	memcpy(&iv1, dest + len - 8, 8);

	des_cbc_encrypt(dest, dest, len, cc->u.des3.key2, iv2, DES_DECRYPT);
	memcpy(iv2, &iv1, 8);	/* Note how iv1 == iv2 on entry and exit. */

	des_cbc_encrypt(dest, dest, len, cc->u.des3.key3, iv3, DES_ENCRYPT);
	memcpy(iv3, dest + len - 8, 8);
}
void
des3_ssh1_decrypt(CipherContext *cc, u_char *dest, const u_char *src,
    u_int len)
{
	des_cblock iv1;
	des_cblock *iv2 = &cc->u.des3.iv2;
	des_cblock *iv3 = &cc->u.des3.iv3;

	memcpy(&iv1, iv2, 8);

	des_cbc_encrypt(src, dest, len, cc->u.des3.key3, iv3, DES_DECRYPT);
	memcpy(iv3, src + len - 8, 8);

	des_cbc_encrypt(dest, dest, len, cc->u.des3.key2, iv2, DES_ENCRYPT);
	memcpy(iv2, dest + len - 8, 8);

	des_cbc_encrypt(dest, dest, len, cc->u.des3.key1, &iv1, DES_DECRYPT);
	/* memcpy(&iv1, iv2, 8); */
	/* Note how iv1 == iv2 on entry and exit. */
}

/* Blowfish */
void
blowfish_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	BF_set_key(&cc->u.bf.key, keylen, (unsigned char *)key);
}
void
blowfish_setiv(CipherContext *cc, const u_char *iv, u_int ivlen)
{
	if (iv == NULL)
		memset(cc->u.bf.iv, 0, 8);
	else
		memcpy(cc->u.bf.iv, (char *)iv, 8);
}
void
blowfish_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src,
     u_int len)
{
	BF_cbc_encrypt((void *)src, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	    BF_ENCRYPT);
}
void
blowfish_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src,
     u_int len)
{
	BF_cbc_encrypt((void *)src, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	    BF_DECRYPT);
}

/*
 * SSH1 uses a variation on Blowfish, all bytes must be swapped before
 * and after encryption/decryption. Thus the swap_bytes stuff (yuk).
 */
static void
swap_bytes(const unsigned char *src, unsigned char *dst, int n)
{
	char c[4];

	/* Process 4 bytes every lap. */
	for (n = n / 4; n > 0; n--) {
		c[3] = *src++;
		c[2] = *src++;
		c[1] = *src++;
		c[0] = *src++;

		*dst++ = c[0];
		*dst++ = c[1];
		*dst++ = c[2];
		*dst++ = c[3];
	}
}

void
blowfish_ssh1_encrypt(CipherContext *cc, u_char *dest, const u_char *src,
    u_int len)
{
	swap_bytes(src, dest, len);
	BF_cbc_encrypt((void *)dest, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	    BF_ENCRYPT);
	swap_bytes(dest, dest, len);
}
void
blowfish_ssh1_decrypt(CipherContext *cc, u_char *dest, const u_char *src,
    u_int len)
{
	swap_bytes(src, dest, len);
	BF_cbc_encrypt((void *)dest, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	    BF_DECRYPT);
	swap_bytes(dest, dest, len);
}

/* alleged rc4 */
void
arcfour_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	RC4_set_key(&cc->u.rc4, keylen, (u_char *)key);
}
void
arcfour_crypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	RC4(&cc->u.rc4, len, (u_char *)src, dest);
}

/* CAST */
void
cast_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	CAST_set_key(&cc->u.cast.key, keylen, (unsigned char *) key);
}
void
cast_setiv(CipherContext *cc, const u_char *iv, u_int ivlen)
{
	if (iv == NULL) 
		fatal("no IV for %s.", cc->cipher->name);
	memcpy(cc->u.cast.iv, (char *)iv, 8);
}
void
cast_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	CAST_cbc_encrypt(src, dest, len, &cc->u.cast.key, cc->u.cast.iv,
	    CAST_ENCRYPT);
}
void
cast_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	CAST_cbc_encrypt(src, dest, len, &cc->u.cast.key, cc->u.cast.iv,
	    CAST_DECRYPT);
}

/* RIJNDAEL */

#define RIJNDAEL_BLOCKSIZE 16
void
rijndael_setkey(CipherContext *cc, const u_char *key, u_int keylen)
{
	rijndael_set_key(&cc->u.rijndael.enc, (u4byte *)key, 8*keylen, 1);
	rijndael_set_key(&cc->u.rijndael.dec, (u4byte *)key, 8*keylen, 0);
}
void
rijndael_setiv(CipherContext *cc, const u_char *iv, u_int ivlen)
{
	if (iv == NULL) 
		fatal("no IV for %s.", cc->cipher->name);
	memcpy((u_char *)cc->u.rijndael.iv, iv, RIJNDAEL_BLOCKSIZE);
}
void
rijndael_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src,
    u_int len)
{
	rijndael_ctx *ctx = &cc->u.rijndael.enc;
	u4byte *iv = cc->u.rijndael.iv;
	u4byte in[4];
	u4byte *cprev, *cnow, *plain;
	int i, blocks = len / RIJNDAEL_BLOCKSIZE;
	if (len == 0)
		return;
	if (len % RIJNDAEL_BLOCKSIZE)
		fatal("rijndael_cbc_encrypt: bad len %d", len);
	cnow  = (u4byte*) dest;
	plain = (u4byte*) src;
	cprev = iv;
	for(i = 0; i < blocks; i++, plain+=4, cnow+=4) {
		in[0] = plain[0] ^ cprev[0];
		in[1] = plain[1] ^ cprev[1];
		in[2] = plain[2] ^ cprev[2];
		in[3] = plain[3] ^ cprev[3];
		rijndael_encrypt(ctx, in, cnow);
		cprev = cnow;
	}
	memcpy(iv, cprev, RIJNDAEL_BLOCKSIZE);
}

void
rijndael_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src,
    u_int len)
{
	rijndael_ctx *ctx = &cc->u.rijndael.dec;
	u4byte *iv = cc->u.rijndael.iv;
	u4byte ivsaved[4];
	u4byte *cnow =  (u4byte*) (src+len-RIJNDAEL_BLOCKSIZE);
	u4byte *plain = (u4byte*) (dest+len-RIJNDAEL_BLOCKSIZE);
	u4byte *ivp;
	int i, blocks = len / RIJNDAEL_BLOCKSIZE;
	if (len == 0)
		return;
	if (len % RIJNDAEL_BLOCKSIZE)
		fatal("rijndael_cbc_decrypt: bad len %d", len);
	memcpy(ivsaved, cnow, RIJNDAEL_BLOCKSIZE);
	for(i = blocks; i > 0; i--, cnow-=4, plain-=4) {
		rijndael_decrypt(ctx, cnow, plain);
		ivp =  (i == 1) ? iv : cnow-4;
		plain[0] ^= ivp[0];
		plain[1] ^= ivp[1];
		plain[2] ^= ivp[2];
		plain[3] ^= ivp[3];
	}
	memcpy(iv, ivsaved, RIJNDAEL_BLOCKSIZE);
}

Cipher ciphers[] = {
	{ "none",
		SSH_CIPHER_NONE, 8, 0,
		none_setkey, none_setiv,
		none_crypt, none_crypt },
	{ "des",
		SSH_CIPHER_DES, 8, 8,
		des_ssh1_setkey, des_ssh1_setiv,
		des_ssh1_encrypt, des_ssh1_decrypt },
	{ "3des",
		SSH_CIPHER_3DES, 8, 16,
		des3_ssh1_setkey, des3_setiv,
		des3_ssh1_encrypt, des3_ssh1_decrypt },
	{ "blowfish",
		SSH_CIPHER_BLOWFISH, 8, 16,
		blowfish_setkey, blowfish_setiv,
		blowfish_ssh1_encrypt, blowfish_ssh1_decrypt },

	{ "3des-cbc",
		SSH_CIPHER_SSH2, 8, 24,
		des3_setkey, des3_setiv,
		des3_cbc_encrypt, des3_cbc_decrypt },
	{ "blowfish-cbc",
		SSH_CIPHER_SSH2, 8, 16,
		blowfish_setkey, blowfish_setiv,
		blowfish_cbc_encrypt, blowfish_cbc_decrypt },
	{ "cast128-cbc",
		SSH_CIPHER_SSH2, 8, 16,
		cast_setkey, cast_setiv,
		cast_cbc_encrypt, cast_cbc_decrypt },
	{ "arcfour",
		SSH_CIPHER_SSH2, 8, 16,
		arcfour_setkey, none_setiv,
		arcfour_crypt, arcfour_crypt },
	{ "aes128-cbc",
		SSH_CIPHER_SSH2, 16, 16,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ "aes192-cbc",
		SSH_CIPHER_SSH2, 16, 24,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ "aes256-cbc",
		SSH_CIPHER_SSH2, 16, 32,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ "rijndael128-cbc",
		SSH_CIPHER_SSH2, 16, 16,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ "rijndael192-cbc",
		SSH_CIPHER_SSH2, 16, 24,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ "rijndael256-cbc",
		SSH_CIPHER_SSH2, 16, 32,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
	{ "rijndael-cbc@lysator.liu.se",
		SSH_CIPHER_SSH2, 16, 32,
		rijndael_setkey, rijndael_setiv,
		rijndael_cbc_encrypt, rijndael_cbc_decrypt },
        { NULL, SSH_CIPHER_ILLEGAL, 0, 0, NULL, NULL, NULL, NULL }
};

/*--*/

unsigned int
cipher_mask_ssh1(int client)
{
	unsigned int mask = 0;
	mask |= 1 << SSH_CIPHER_3DES;           /* Mandatory */
	mask |= 1 << SSH_CIPHER_BLOWFISH;
	if (client) {
		mask |= 1 << SSH_CIPHER_DES;
	}
	return mask;
}

Cipher *
cipher_by_name(const char *name)
{
	Cipher *c;
	for (c = ciphers; c->name != NULL; c++)
		if (strcasecmp(c->name, name) == 0)
			return c;
	return NULL;
}

Cipher *
cipher_by_number(int id)
{
	Cipher *c;
	for (c = ciphers; c->name != NULL; c++)
		if (c->number == id)
			return c;
	return NULL;
}

#define	CIPHER_SEP	","
int
ciphers_valid(const char *names)
{
	Cipher *c;
	char *ciphers, *cp;
	char *p;

	if (names == NULL || strcmp(names, "") == 0)
		return 0;
	ciphers = cp = xstrdup(names);
	for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0';
	     (p = strsep(&cp, CIPHER_SEP))) {
		c = cipher_by_name(p);
		if (c == NULL || c->number != SSH_CIPHER_SSH2) {
			debug("bad cipher %s [%s]", p, names);
			xfree(ciphers);
			return 0;
		} else {
			debug3("cipher ok: %s [%s]", p, names);
		}
	}
	debug3("ciphers ok: [%s]", names);
	xfree(ciphers);
	return 1;
}

/*
 * Parses the name of the cipher.  Returns the number of the corresponding
 * cipher, or -1 on error.
 */

int
cipher_number(const char *name)
{
	Cipher *c;
	if (name == NULL)
		return -1;
	c = cipher_by_name(name);
	return (c==NULL) ? -1 : c->number;
}

char *
cipher_name(int id)
{
	Cipher *c = cipher_by_number(id);
	return (c==NULL) ? "<unknown>" : c->name;
}

void
cipher_init(CipherContext *cc, Cipher *cipher,
    const u_char *key, u_int keylen, const u_char *iv, u_int ivlen)
{
	if (keylen < cipher->key_len)
		fatal("cipher_init: key length %d is insufficient for %s.",
		    keylen, cipher->name);
	if (iv != NULL && ivlen < cipher->block_size)
		fatal("cipher_init: iv length %d is insufficient for %s.",
		    ivlen, cipher->name);
	cc->cipher = cipher;
	cipher->setkey(cc, key, keylen);
	cipher->setiv(cc, iv, ivlen);
}

void
cipher_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	if (len % cc->cipher->block_size)
		fatal("cipher_encrypt: bad plaintext length %d", len);
	cc->cipher->encrypt(cc, dest, src, len);
}

void
cipher_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
{
	if (len % cc->cipher->block_size)
		fatal("cipher_decrypt: bad ciphertext length %d", len);
	cc->cipher->decrypt(cc, dest, src, len);
}

/*
 * Selects the cipher, and keys if by computing the MD5 checksum of the
 * passphrase and using the resulting 16 bytes as the key.
 */

void
cipher_set_key_string(CipherContext *cc, Cipher *cipher,
    const char *passphrase)
{
	MD5_CTX md;
	unsigned char digest[16];

	MD5_Init(&md);
	MD5_Update(&md, (const u_char *)passphrase, strlen(passphrase));
	MD5_Final(digest, &md);

	cipher_init(cc, cipher, digest, 16, NULL, 0);

	memset(digest, 0, sizeof(digest));
	memset(&md, 0, sizeof(md));
}
Commit	Line	Data
8efc0c15	1	/*
5260325f	2	* Author: Tatu Ylonen <ylo@cs.hut.fi>
5260325f	3	* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5260325f	4	* All rights reserved
6ae2364d	5	*
bcbf86ec	6	* As far as I am concerned, the code I have written for this software
	7	* can be used freely for any purpose. Any derived versions of this
	8	* software must be clearly marked as such, and if the derived work is
	9	* incompatible with the protocol description in the RFC file, it must be
	10	* called by a name other than "ssh" or "Secure Shell".
	11	*
	12	*
	13	* Copyright (c) 1999 Niels Provos. All rights reserved.
	14	* Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
	15	*
	16	* Redistribution and use in source and binary forms, with or without
	17	* modification, are permitted provided that the following conditions
	18	* are met:
	19	* 1. Redistributions of source code must retain the above copyright
	20	* notice, this list of conditions and the following disclaimer.
	21	* 2. Redistributions in binary form must reproduce the above copyright
	22	* notice, this list of conditions and the following disclaimer in the
	23	* documentation and/or other materials provided with the distribution.
6ae2364d	24	*
bcbf86ec	25	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	26	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	27	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	28	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
	29	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	30	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	31	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	32	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	33	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	34	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
5260325f	35	*/
8efc0c15	36
8efc0c15	37	#include "includes.h"
a22aff1f	38	RCSID("$OpenBSD: cipher.c,v 1.37 2000/10/23 19:31:54 markus Exp $");
8efc0c15	39
8efc0c15	40	#include "ssh.h"
a8be9f80	41	#include "xmalloc.h"
8efc0c15	42
	43	#include <openssl/md5.h>
	44
94ec8c6b	45
	46	/* no encryption */
	47	void
	48	none_setkey(CipherContext cc, const u_char key, u_int keylen)
	49	{
	50	}
	51	void
	52	none_setiv(CipherContext cc, const u_char iv, u_int ivlen)
	53	{
	54	}
	55	void
	56	none_crypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	57	{
	58	memcpy(dest, src, len);
	59	}
	60
	61	/* DES */
	62	void
	63	des_ssh1_setkey(CipherContext cc, const u_char key, u_int keylen)
	64	{
	65	static int dowarn = 1;
	66	if (dowarn) {
	67	error("Warning: use of DES is strongly discouraged "
	68	"due to cryptographic weaknesses");
	69	dowarn = 0;
	70	}
	71	des_set_key((void *)key, cc->u.des.key);
	72	}
	73	void
	74	des_ssh1_setiv(CipherContext cc, const u_char iv, u_int ivlen)
	75	{
	76	memset(cc->u.des.iv, 0, sizeof(cc->u.des.iv));
	77	}
	78	void
	79	des_ssh1_encrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	80	{
	81	des_ncbc_encrypt(src, dest, len, cc->u.des.key, &cc->u.des.iv,
	82	DES_ENCRYPT);
	83	}
	84	void
	85	des_ssh1_decrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	86	{
	87	des_ncbc_encrypt(src, dest, len, cc->u.des.key, &cc->u.des.iv,
	88	DES_DECRYPT);
	89	}
	90
	91	/* 3DES */
	92	void
	93	des3_setkey(CipherContext cc, const u_char key, u_int keylen)
	94	{
	95	des_set_key((void *) key, cc->u.des3.key1);
	96	des_set_key((void *) (key+8), cc->u.des3.key2);
	97	des_set_key((void *) (key+16), cc->u.des3.key3);
	98	}
	99	void
	100	des3_setiv(CipherContext cc, const u_char iv, u_int ivlen)
	101	{
	102	memset(cc->u.des3.iv2, 0, sizeof(cc->u.des3.iv2));
	103	memset(cc->u.des3.iv3, 0, sizeof(cc->u.des3.iv3));
	104	if (iv == NULL)
	105	return;
	106	memcpy(cc->u.des3.iv3, (char *)iv, 8);
	107	}
	108	void
109	des3_cbc_encrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
110	{
111	des_ede3_cbc_encrypt(src, dest, len,
112	cc->u.des3.key1, cc->u.des3.key2, cc->u.des3.key3,
113	&cc->u.des3.iv3, DES_ENCRYPT);
114	}
115	void
116	des3_cbc_decrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
117	{
118	des_ede3_cbc_encrypt(src, dest, len,
119	cc->u.des3.key1, cc->u.des3.key2, cc->u.des3.key3,
120	&cc->u.des3.iv3, DES_DECRYPT);
121	}
122
8efc0c15	123	/*
a8be9f80	124	* This is used by SSH1:
	125	*
	126	* What kind of triple DES are these 2 routines?
8efc0c15	127	*
	128	* Why is there a redundant initialization vector?
	129	*
	130	* If only iv3 was used, then, this would till effect have been
	131	* outer-cbc. However, there is also a private iv1 == iv2 which
	132	* perhaps makes differential analysis easier. On the other hand, the
	133	* private iv1 probably makes the CRC-32 attack ineffective. This is a
	134	* result of that there is no longer any known iv1 to use when
	135	* choosing the X block.
	136	*/
	137	void
94ec8c6b	138	des3_ssh1_setkey(CipherContext cc, const u_char key, u_int keylen)
	139	{
	140	des_set_key((void *) key, cc->u.des3.key1);
	141	des_set_key((void *) (key+8), cc->u.des3.key2);
	142	if (keylen <= 16)
	143	des_set_key((void *) key, cc->u.des3.key3);
	144	else
	145	des_set_key((void *) (key+16), cc->u.des3.key3);
	146	}
	147	void
	148	des3_ssh1_encrypt(CipherContext cc, u_char dest, const u_char *src,
	149	u_int len)
8efc0c15	150	{
5260325f	151	des_cblock iv1;
94ec8c6b	152	des_cblock *iv2 = &cc->u.des3.iv2;
94ec8c6b	153	des_cblock *iv3 = &cc->u.des3.iv3;
8efc0c15	154
5260325f	155	memcpy(&iv1, iv2, 8);
8efc0c15	156
94ec8c6b	157	des_cbc_encrypt(src, dest, len, cc->u.des3.key1, &iv1, DES_ENCRYPT);
c8d54615	158	memcpy(&iv1, dest + len - 8, 8);
8efc0c15	159
94ec8c6b	160	des_cbc_encrypt(dest, dest, len, cc->u.des3.key2, iv2, DES_DECRYPT);
5260325f	161	memcpy(iv2, &iv1, 8); /* Note how iv1 == iv2 on entry and exit. */
8efc0c15	162
94ec8c6b	163	des_cbc_encrypt(dest, dest, len, cc->u.des3.key3, iv3, DES_ENCRYPT);
c8d54615	164	memcpy(iv3, dest + len - 8, 8);
8efc0c15	165	}
8efc0c15	166	void
94ec8c6b	167	des3_ssh1_decrypt(CipherContext cc, u_char dest, const u_char *src,
94ec8c6b	168	u_int len)
8efc0c15	169	{
5260325f	170	des_cblock iv1;
94ec8c6b	171	des_cblock *iv2 = &cc->u.des3.iv2;
94ec8c6b	172	des_cblock *iv3 = &cc->u.des3.iv3;
8efc0c15	173
5260325f	174	memcpy(&iv1, iv2, 8);
8efc0c15	175
94ec8c6b	176	des_cbc_encrypt(src, dest, len, cc->u.des3.key3, iv3, DES_DECRYPT);
c8d54615	177	memcpy(iv3, src + len - 8, 8);
8efc0c15	178
94ec8c6b	179	des_cbc_encrypt(dest, dest, len, cc->u.des3.key2, iv2, DES_ENCRYPT);
c8d54615	180	memcpy(iv2, dest + len - 8, 8);
8efc0c15	181
94ec8c6b	182	des_cbc_encrypt(dest, dest, len, cc->u.des3.key1, &iv1, DES_DECRYPT);
5260325f	183	/* memcpy(&iv1, iv2, 8); */
5260325f	184	/* Note how iv1 == iv2 on entry and exit. */
8efc0c15	185	}
8efc0c15	186
94ec8c6b	187	/* Blowfish */
	188	void
	189	blowfish_setkey(CipherContext cc, const u_char key, u_int keylen)
	190	{
	191	BF_set_key(&cc->u.bf.key, keylen, (unsigned char *)key);
	192	}
	193	void
	194	blowfish_setiv(CipherContext cc, const u_char iv, u_int ivlen)
	195	{
	196	if (iv == NULL)
	197	memset(cc->u.bf.iv, 0, 8);
	198	else
	199	memcpy(cc->u.bf.iv, (char *)iv, 8);
	200	}
	201	void
	202	blowfish_cbc_encrypt(CipherContext cc, u_char dest, const u_char *src,
	203	u_int len)
	204	{
	205	BF_cbc_encrypt((void *)src, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	206	BF_ENCRYPT);
	207	}
	208	void
	209	blowfish_cbc_decrypt(CipherContext cc, u_char dest, const u_char *src,
	210	u_int len)
	211	{
	212	BF_cbc_encrypt((void *)src, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	213	BF_DECRYPT);
	214	}
	215
8efc0c15	216	/*
a8be9f80	217	* SSH1 uses a variation on Blowfish, all bytes must be swapped before
8efc0c15	218	* and after encryption/decryption. Thus the swap_bytes stuff (yuk).
8efc0c15	219	*/
5260325f	220	static void
a22aff1f	221	swap_bytes(const unsigned char src, unsigned char dst, int n)
8efc0c15	222	{
a22aff1f	223	char c[4];
5260325f	224
a22aff1f	225	/* Process 4 bytes every lap. */
	226	for (n = n / 4; n > 0; n--) {
	227	c[3] = *src++;
	228	c[2] = *src++;
	229	c[1] = *src++;
	230	c[0] = *src++;
5260325f	231
a22aff1f	232	*dst++ = c[0];
	233	*dst++ = c[1];
	234	*dst++ = c[2];
	235	*dst++ = c[3];
5260325f	236	}
8efc0c15	237	}
8efc0c15	238
94ec8c6b	239	void
	240	blowfish_ssh1_encrypt(CipherContext cc, u_char dest, const u_char *src,
	241	u_int len)
	242	{
	243	swap_bytes(src, dest, len);
	244	BF_cbc_encrypt((void *)dest, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	245	BF_ENCRYPT);
	246	swap_bytes(dest, dest, len);
	247	}
	248	void
	249	blowfish_ssh1_decrypt(CipherContext cc, u_char dest, const u_char *src,
	250	u_int len)
	251	{
	252	swap_bytes(src, dest, len);
	253	BF_cbc_encrypt((void *)dest, dest, len, &cc->u.bf.key, cc->u.bf.iv,
	254	BF_DECRYPT);
	255	swap_bytes(dest, dest, len);
	256	}
8efc0c15	257
94ec8c6b	258	/* alleged rc4 */
	259	void
	260	arcfour_setkey(CipherContext cc, const u_char key, u_int keylen)
	261	{
	262	RC4_set_key(&cc->u.rc4, keylen, (u_char *)key);
	263	}
	264	void
	265	arcfour_crypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	266	{
	267	RC4(&cc->u.rc4, len, (u_char *)src, dest);
	268	}
8efc0c15	269
94ec8c6b	270	/* CAST */
	271	void
	272	cast_setkey(CipherContext cc, const u_char key, u_int keylen)
8efc0c15	273	{
94ec8c6b	274	CAST_set_key(&cc->u.cast.key, keylen, (unsigned char *) key);
	275	}
	276	void
	277	cast_setiv(CipherContext cc, const u_char iv, u_int ivlen)
	278	{
	279	if (iv == NULL)
	280	fatal("no IV for %s.", cc->cipher->name);
	281	memcpy(cc->u.cast.iv, (char *)iv, 8);
	282	}
	283	void
	284	cast_cbc_encrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	285	{
	286	CAST_cbc_encrypt(src, dest, len, &cc->u.cast.key, cc->u.cast.iv,
	287	CAST_ENCRYPT);
	288	}
	289	void
	290	cast_cbc_decrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	291	{
	292	CAST_cbc_encrypt(src, dest, len, &cc->u.cast.key, cc->u.cast.iv,
	293	CAST_DECRYPT);
	294	}
	295
	296	/* RIJNDAEL */
	297
	298	#define RIJNDAEL_BLOCKSIZE 16
	299	void
	300	rijndael_setkey(CipherContext cc, const u_char key, u_int keylen)
	301	{
	302	rijndael_set_key(&cc->u.rijndael.enc, (u4byte )key, 8keylen, 1);
	303	rijndael_set_key(&cc->u.rijndael.dec, (u4byte )key, 8keylen, 0);
	304	}
	305	void
	306	rijndael_setiv(CipherContext cc, const u_char iv, u_int ivlen)
	307	{
	308	if (iv == NULL)
	309	fatal("no IV for %s.", cc->cipher->name);
	310	memcpy((u_char *)cc->u.rijndael.iv, iv, RIJNDAEL_BLOCKSIZE);
8ce64345	311	}
94ec8c6b	312	void
	313	rijndael_cbc_encrypt(CipherContext cc, u_char dest, const u_char *src,
	314	u_int len)
	315	{
	316	rijndael_ctx *ctx = &cc->u.rijndael.enc;
	317	u4byte *iv = cc->u.rijndael.iv;
	318	u4byte in[4];
	319	u4byte cprev, cnow, *plain;
	320	int i, blocks = len / RIJNDAEL_BLOCKSIZE;
	321	if (len == 0)
	322	return;
	323	if (len % RIJNDAEL_BLOCKSIZE)
	324	fatal("rijndael_cbc_encrypt: bad len %d", len);
	325	cnow = (u4byte*) dest;
	326	plain = (u4byte*) src;
	327	cprev = iv;
	328	for(i = 0; i < blocks; i++, plain+=4, cnow+=4) {
	329	in[0] = plain[0] ^ cprev[0];
	330	in[1] = plain[1] ^ cprev[1];
	331	in[2] = plain[2] ^ cprev[2];
	332	in[3] = plain[3] ^ cprev[3];
	333	rijndael_encrypt(ctx, in, cnow);
	334	cprev = cnow;
	335	}
	336	memcpy(iv, cprev, RIJNDAEL_BLOCKSIZE);
	337	}
	338
	339	void
	340	rijndael_cbc_decrypt(CipherContext cc, u_char dest, const u_char *src,
	341	u_int len)
	342	{
	343	rijndael_ctx *ctx = &cc->u.rijndael.dec;
	344	u4byte *iv = cc->u.rijndael.iv;
	345	u4byte ivsaved[4];
	346	u4byte cnow = (u4byte) (src+len-RIJNDAEL_BLOCKSIZE);
	347	u4byte plain = (u4byte) (dest+len-RIJNDAEL_BLOCKSIZE);
	348	u4byte *ivp;
	349	int i, blocks = len / RIJNDAEL_BLOCKSIZE;
	350	if (len == 0)
	351	return;
	352	if (len % RIJNDAEL_BLOCKSIZE)
	353	fatal("rijndael_cbc_decrypt: bad len %d", len);
	354	memcpy(ivsaved, cnow, RIJNDAEL_BLOCKSIZE);
	355	for(i = blocks; i > 0; i--, cnow-=4, plain-=4) {
	356	rijndael_decrypt(ctx, cnow, plain);
	357	ivp = (i == 1) ? iv : cnow-4;
	358	plain[0] ^= ivp[0];
	359	plain[1] ^= ivp[1];
	360	plain[2] ^= ivp[2];
	361	plain[3] ^= ivp[3];
	362	}
	363	memcpy(iv, ivsaved, RIJNDAEL_BLOCKSIZE);
	364	}
	365
	366	Cipher ciphers[] = {
	367	{ "none",
	368	SSH_CIPHER_NONE, 8, 0,
	369	none_setkey, none_setiv,
	370	none_crypt, none_crypt },
	371	{ "des",
	372	SSH_CIPHER_DES, 8, 8,
	373	des_ssh1_setkey, des_ssh1_setiv,
	374	des_ssh1_encrypt, des_ssh1_decrypt },
	375	{ "3des",
376	SSH_CIPHER_3DES, 8, 16,
377	des3_ssh1_setkey, des3_setiv,
378	des3_ssh1_encrypt, des3_ssh1_decrypt },
379	{ "blowfish",
380	SSH_CIPHER_BLOWFISH, 8, 16,
381	blowfish_setkey, blowfish_setiv,
382	blowfish_ssh1_encrypt, blowfish_ssh1_decrypt },
383
384	{ "3des-cbc",
385	SSH_CIPHER_SSH2, 8, 24,
386	des3_setkey, des3_setiv,
387	des3_cbc_encrypt, des3_cbc_decrypt },
388	{ "blowfish-cbc",
389	SSH_CIPHER_SSH2, 8, 16,
390	blowfish_setkey, blowfish_setiv,
391	blowfish_cbc_encrypt, blowfish_cbc_decrypt },
392	{ "cast128-cbc",
393	SSH_CIPHER_SSH2, 8, 16,
394	cast_setkey, cast_setiv,
395	cast_cbc_encrypt, cast_cbc_decrypt },
396	{ "arcfour",
397	SSH_CIPHER_SSH2, 8, 16,
398	arcfour_setkey, none_setiv,
399	arcfour_crypt, arcfour_crypt },
400	{ "aes128-cbc",
401	SSH_CIPHER_SSH2, 16, 16,
402	rijndael_setkey, rijndael_setiv,
403	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
404	{ "aes192-cbc",
405	SSH_CIPHER_SSH2, 16, 24,
406	rijndael_setkey, rijndael_setiv,
407	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
408	{ "aes256-cbc",
409	SSH_CIPHER_SSH2, 16, 32,
410	rijndael_setkey, rijndael_setiv,
411	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
412	{ "rijndael128-cbc",
413	SSH_CIPHER_SSH2, 16, 16,
414	rijndael_setkey, rijndael_setiv,
415	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
416	{ "rijndael192-cbc",
417	SSH_CIPHER_SSH2, 16, 24,
418	rijndael_setkey, rijndael_setiv,
419	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
420	{ "rijndael256-cbc",
421	SSH_CIPHER_SSH2, 16, 32,
422	rijndael_setkey, rijndael_setiv,
423	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
424	{ "rijndael-cbc@lysator.liu.se",
425	SSH_CIPHER_SSH2, 16, 32,
426	rijndael_setkey, rijndael_setiv,
427	rijndael_cbc_encrypt, rijndael_cbc_decrypt },
428	{ NULL, SSH_CIPHER_ILLEGAL, 0, 0, NULL, NULL, NULL, NULL }
429	};
430
431	/--/
432
6ae2364d	433	unsigned int
94ec8c6b	434	cipher_mask_ssh1(int client)
8ce64345	435	{
8ce64345	436	unsigned int mask = 0;
94ec8c6b	437	mask \|= 1 << SSH_CIPHER_3DES; /* Mandatory */
	438	mask \|= 1 << SSH_CIPHER_BLOWFISH;
	439	if (client) {
	440	mask \|= 1 << SSH_CIPHER_DES;
	441	}
5260325f	442	return mask;
8efc0c15	443	}
94ec8c6b	444
	445	Cipher *
	446	cipher_by_name(const char *name)
8ce64345	447	{
94ec8c6b	448	Cipher *c;
	449	for (c = ciphers; c->name != NULL; c++)
	450	if (strcasecmp(c->name, name) == 0)
	451	return c;
	452	return NULL;
8ce64345	453	}
8efc0c15	454
94ec8c6b	455	Cipher *
94ec8c6b	456	cipher_by_number(int id)
8efc0c15	457	{
94ec8c6b	458	Cipher *c;
	459	for (c = ciphers; c->name != NULL; c++)
	460	if (c->number == id)
	461	return c;
	462	return NULL;
8efc0c15	463	}
8efc0c15	464
a8be9f80	465	#define CIPHER_SEP ","
	466	int
	467	ciphers_valid(const char *names)
	468	{
94ec8c6b	469	Cipher *c;
089fbbd2	470	char ciphers, cp;
a8be9f80	471	char *p;
a8be9f80	472
71276795	473	if (names == NULL \|\| strcmp(names, "") == 0)
a8be9f80	474	return 0;
089fbbd2	475	ciphers = cp = xstrdup(names);
94ec8c6b	476	for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0';
089fbbd2	477	(p = strsep(&cp, CIPHER_SEP))) {
94ec8c6b	478	c = cipher_by_name(p);
	479	if (c == NULL \|\| c->number != SSH_CIPHER_SSH2) {
	480	debug("bad cipher %s [%s]", p, names);
a8be9f80	481	xfree(ciphers);
a8be9f80	482	return 0;
94ec8c6b	483	} else {
33de75a3	484	debug3("cipher ok: %s [%s]", p, names);
a8be9f80	485	}
a8be9f80	486	}
33de75a3	487	debug3("ciphers ok: [%s]", names);
a8be9f80	488	xfree(ciphers);
	489	return 1;
	490	}
	491
aa3378df	492	/*
	493	* Parses the name of the cipher. Returns the number of the corresponding
	494	* cipher, or -1 on error.
	495	*/
8efc0c15	496
	497	int
	498	cipher_number(const char *name)
	499	{
94ec8c6b	500	Cipher *c;
71276795	501	if (name == NULL)
71276795	502	return -1;
94ec8c6b	503	c = cipher_by_name(name);
	504	return (c==NULL) ? -1 : c->number;
	505	}
	506
	507	char *
	508	cipher_name(int id)
	509	{
	510	Cipher *c = cipher_by_number(id);
	511	return (c==NULL) ? "<unknown>" : c->name;
	512	}
	513
	514	void
	515	cipher_init(CipherContext cc, Cipher cipher,
	516	const u_char key, u_int keylen, const u_char iv, u_int ivlen)
	517	{
	518	if (keylen < cipher->key_len)
	519	fatal("cipher_init: key length %d is insufficient for %s.",
	520	keylen, cipher->name);
	521	if (iv != NULL && ivlen < cipher->block_size)
	522	fatal("cipher_init: iv length %d is insufficient for %s.",
	523	ivlen, cipher->name);
	524	cc->cipher = cipher;
	525	cipher->setkey(cc, key, keylen);
	526	cipher->setiv(cc, iv, ivlen);
	527	}
	528
	529	void
	530	cipher_encrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	531	{
	532	if (len % cc->cipher->block_size)
	533	fatal("cipher_encrypt: bad plaintext length %d", len);
	534	cc->cipher->encrypt(cc, dest, src, len);
	535	}
	536
	537	void
	538	cipher_decrypt(CipherContext cc, u_char dest, const u_char *src, u_int len)
	539	{
	540	if (len % cc->cipher->block_size)
	541	fatal("cipher_decrypt: bad ciphertext length %d", len);
	542	cc->cipher->decrypt(cc, dest, src, len);
8efc0c15	543	}
8efc0c15	544
aa3378df	545	/*
	546	* Selects the cipher, and keys if by computing the MD5 checksum of the
	547	* passphrase and using the resulting 16 bytes as the key.
	548	*/
8efc0c15	549
6ae2364d	550	void
94ec8c6b	551	cipher_set_key_string(CipherContext cc, Cipher cipher,
94ec8c6b	552	const char *passphrase)
8efc0c15	553	{
5260325f	554	MD5_CTX md;
	555	unsigned char digest[16];
	556
	557	MD5_Init(&md);
94ec8c6b	558	MD5_Update(&md, (const u_char *)passphrase, strlen(passphrase));
5260325f	559	MD5_Final(digest, &md);
5260325f	560
94ec8c6b	561	cipher_init(cc, cipher, digest, 16, NULL, 0);
5260325f	562
	563	memset(digest, 0, sizeof(digest));
	564	memset(&md, 0, sizeof(md));
8efc0c15	565	}