X-Git-Url: http://andersk.mit.edu/gitweb/openssh.git/blobdiff_plain/4c40f8344426f43f071312f14cbef9de9838b223..e99766900df635875ca0b82c3814ba6e837632d2:/cipher.c diff --git a/cipher.c b/cipher.c index c6ed6816..361da070 100644 --- a/cipher.c +++ b/cipher.c @@ -1,14 +1,14 @@ /* - * + * * cipher.c - * + * * Author: Tatu Ylonen - * + * * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland * All rights reserved - * + * * Created: Wed Apr 19 17:41:39 1995 ylo - * + * */ #include "includes.h" @@ -16,17 +16,14 @@ RCSID("$Id$"); #include "ssh.h" #include "cipher.h" -#include "config.h" +#include "xmalloc.h" -#ifdef HAVE_OPENSSL #include -#endif -#ifdef HAVE_SSL -#include -#endif /* - * What kind of tripple DES are these 2 routines? + * This is used by SSH1: + * + * What kind of triple DES are these 2 routines? * * Why is there a redundant initialization vector? * @@ -41,7 +38,7 @@ void SSH_3CBC_ENCRYPT(des_key_schedule ks1, des_key_schedule ks2, des_cblock * iv2, des_key_schedule ks3, des_cblock * iv3, - void *dest, void *src, + unsigned char *dest, unsigned char *src, unsigned int len) { des_cblock iv1; @@ -49,20 +46,20 @@ SSH_3CBC_ENCRYPT(des_key_schedule ks1, memcpy(&iv1, iv2, 8); des_cbc_encrypt(src, dest, len, ks1, &iv1, DES_ENCRYPT); - memcpy(&iv1, (char *)dest + len - 8, 8); + memcpy(&iv1, dest + len - 8, 8); des_cbc_encrypt(dest, dest, len, ks2, iv2, DES_DECRYPT); memcpy(iv2, &iv1, 8); /* Note how iv1 == iv2 on entry and exit. */ des_cbc_encrypt(dest, dest, len, ks3, iv3, DES_ENCRYPT); - memcpy(iv3, (char *)dest + len - 8, 8); + memcpy(iv3, dest + len - 8, 8); } void SSH_3CBC_DECRYPT(des_key_schedule ks1, des_key_schedule ks2, des_cblock * iv2, des_key_schedule ks3, des_cblock * iv3, - void *dest, void *src, + unsigned char *dest, unsigned char *src, unsigned int len) { des_cblock iv1; @@ -70,10 +67,10 @@ SSH_3CBC_DECRYPT(des_key_schedule ks1, memcpy(&iv1, iv2, 8); des_cbc_encrypt(src, dest, len, ks3, iv3, DES_DECRYPT); - memcpy(iv3, (char *)src + len - 8, 8); + memcpy(iv3, src + len - 8, 8); des_cbc_encrypt(dest, dest, len, ks2, iv2, DES_ENCRYPT); - memcpy(iv2, (char *)dest + len - 8, 8); + memcpy(iv2, dest + len - 8, 8); des_cbc_encrypt(dest, dest, len, ks1, &iv1, DES_DECRYPT); /* memcpy(&iv1, iv2, 8); */ @@ -81,7 +78,7 @@ SSH_3CBC_DECRYPT(des_key_schedule ks1, } /* - * SSH uses a variation on Blowfish, all bytes must be swapped before + * SSH1 uses a variation on Blowfish, all bytes must be swapped before * and after encryption/decryption. Thus the swap_bytes stuff (yuk). */ static void @@ -110,18 +107,6 @@ swap_bytes(const unsigned char *src, unsigned char *dst_, int n) } } -void (*cipher_attack_detected) (const char *fmt,...) = fatal; - -static inline void -detect_cbc_attack(const unsigned char *src, - unsigned int len) -{ - return; - - log("CRC-32 CBC insertion attack detected"); - cipher_attack_detected("CRC-32 CBC insertion attack detected"); -} - /* * Names of all encryption algorithms. * These must match the numbers defined in cipher.h. @@ -134,7 +119,12 @@ static char *cipher_names[] = "3des", "tss", "rc4", - "blowfish" + "blowfish", + "reserved", + "blowfish-cbc", + "3des-cbc", + "arcfour", + "cast128-cbc" }; /* @@ -143,14 +133,29 @@ static char *cipher_names[] = * supported cipher. */ -unsigned int -cipher_mask() +unsigned int +cipher_mask1() { unsigned int mask = 0; mask |= 1 << SSH_CIPHER_3DES; /* Mandatory */ mask |= 1 << SSH_CIPHER_BLOWFISH; return mask; } +unsigned int +cipher_mask2() +{ + unsigned int mask = 0; + mask |= 1 << SSH_CIPHER_BLOWFISH_CBC; + mask |= 1 << SSH_CIPHER_3DES_CBC; + mask |= 1 << SSH_CIPHER_ARCFOUR; + mask |= 1 << SSH_CIPHER_CAST128_CBC; + return mask; +} +unsigned int +cipher_mask() +{ + return cipher_mask1() | cipher_mask2(); +} /* Returns the name of the cipher. */ @@ -159,10 +164,34 @@ cipher_name(int cipher) { if (cipher < 0 || cipher >= sizeof(cipher_names) / sizeof(cipher_names[0]) || cipher_names[cipher] == NULL) - fatal("cipher_name: bad cipher number: %d", cipher); + fatal("cipher_name: bad cipher name: %d", cipher); return cipher_names[cipher]; } +/* Returns 1 if the name of the ciphers are valid. */ + +#define CIPHER_SEP "," +int +ciphers_valid(const char *names) +{ + char *ciphers; + char *p; + int i; + + if (strcmp(names, "") == 0) + return 0; + ciphers = xstrdup(names); + for ((p = strtok(ciphers, CIPHER_SEP)); p; (p = strtok(NULL, CIPHER_SEP))) { + i = cipher_number(p); + if (i == -1 || !(cipher_mask2() & (1 << i))) { + xfree(ciphers); + return 0; + } + } + xfree(ciphers); + return 1; +} + /* * Parses the name of the cipher. Returns the number of the corresponding * cipher, or -1 on error. @@ -184,9 +213,8 @@ cipher_number(const char *name) * passphrase and using the resulting 16 bytes as the key. */ -void -cipher_set_key_string(CipherContext *context, int cipher, - const char *passphrase, int for_encryption) +void +cipher_set_key_string(CipherContext *context, int cipher, const char *passphrase) { MD5_CTX md; unsigned char digest[16]; @@ -195,7 +223,7 @@ cipher_set_key_string(CipherContext *context, int cipher, MD5_Update(&md, (const unsigned char *) passphrase, strlen(passphrase)); MD5_Final(digest, &md); - cipher_set_key(context, cipher, digest, 16, for_encryption); + cipher_set_key(context, cipher, digest, 16); memset(digest, 0, sizeof(digest)); memset(&md, 0, sizeof(md)); @@ -203,9 +231,9 @@ cipher_set_key_string(CipherContext *context, int cipher, /* Selects the cipher to use and sets the key. */ -void -cipher_set_key(CipherContext *context, int cipher, - const unsigned char *key, int keylen, int for_encryption) +void +cipher_set_key(CipherContext *context, int cipher, const unsigned char *key, + int keylen) { unsigned char padded[32]; @@ -245,19 +273,86 @@ cipher_set_key(CipherContext *context, int cipher, break; case SSH_CIPHER_BLOWFISH: + if (keylen < 16) + error("Key length %d is insufficient for blowfish.", keylen); BF_set_key(&context->u.bf.key, keylen, padded); memset(context->u.bf.iv, 0, 8); break; + case SSH_CIPHER_3DES_CBC: + case SSH_CIPHER_BLOWFISH_CBC: + case SSH_CIPHER_ARCFOUR: + case SSH_CIPHER_CAST128_CBC: + fatal("cipher_set_key: illegal cipher: %s", cipher_name(cipher)); + break; + default: fatal("cipher_set_key: unknown cipher: %s", cipher_name(cipher)); } memset(padded, 0, sizeof(padded)); } +void +cipher_set_key_iv(CipherContext * context, int cipher, + const unsigned char *key, int keylen, + const unsigned char *iv, int ivlen) +{ + /* Set cipher type. */ + context->type = cipher; + + /* Initialize the initialization vector. */ + switch (cipher) { + case SSH_CIPHER_NONE: + break; + + case SSH_CIPHER_3DES: + case SSH_CIPHER_BLOWFISH: + fatal("cipher_set_key_iv: illegal cipher: %s", cipher_name(cipher)); + break; + + case SSH_CIPHER_3DES_CBC: + if (keylen < 24) + error("Key length %d is insufficient for 3des-cbc.", keylen); + des_set_key((void *) key, context->u.des3.key1); + des_set_key((void *) (key+8), context->u.des3.key2); + des_set_key((void *) (key+16), context->u.des3.key3); + if (ivlen < 8) + error("IV length %d is insufficient for 3des-cbc.", ivlen); + memcpy(context->u.des3.iv3, (char *)iv, 8); + break; + + case SSH_CIPHER_BLOWFISH_CBC: + if (keylen < 16) + error("Key length %d is insufficient for blowfish.", keylen); + if (ivlen < 8) + error("IV length %d is insufficient for blowfish.", ivlen); + BF_set_key(&context->u.bf.key, keylen, (unsigned char *)key); + memcpy(context->u.bf.iv, (char *)iv, 8); + break; + + case SSH_CIPHER_ARCFOUR: + if (keylen < 16) + error("Key length %d is insufficient for arcfour.", keylen); + RC4_set_key(&context->u.rc4, keylen, (unsigned char *)key); + break; + + case SSH_CIPHER_CAST128_CBC: + if (keylen < 16) + error("Key length %d is insufficient for cast128.", keylen); + if (ivlen < 8) + error("IV length %d is insufficient for cast128.", ivlen); + CAST_set_key(&context->u.cast.key, keylen, (unsigned char *) key); + memcpy(context->u.cast.iv, (char *)iv, 8); + break; + + default: + fatal("cipher_set_key: unknown cipher: %s", cipher_name(cipher)); + } +} + /* Encrypts data using the cipher. */ -void +void cipher_encrypt(CipherContext *context, unsigned char *dest, const unsigned char *src, unsigned int len) { @@ -273,17 +368,38 @@ cipher_encrypt(CipherContext *context, unsigned char *dest, SSH_3CBC_ENCRYPT(context->u.des3.key1, context->u.des3.key2, &context->u.des3.iv2, context->u.des3.key3, &context->u.des3.iv3, - dest, (void *) src, len); + dest, (unsigned char *) src, len); break; case SSH_CIPHER_BLOWFISH: swap_bytes(src, dest, len); BF_cbc_encrypt(dest, dest, len, - &context->u.bf.key, context->u.bf.iv, + &context->u.bf.key, context->u.bf.iv, BF_ENCRYPT); swap_bytes(dest, dest, len); break; + case SSH_CIPHER_BLOWFISH_CBC: + BF_cbc_encrypt((void *)src, dest, len, + &context->u.bf.key, context->u.bf.iv, + BF_ENCRYPT); + break; + + case SSH_CIPHER_3DES_CBC: + des_ede3_cbc_encrypt(src, dest, len, + context->u.des3.key1, context->u.des3.key2, + context->u.des3.key3, &context->u.des3.iv3, DES_ENCRYPT); + break; + + case SSH_CIPHER_ARCFOUR: + RC4(&context->u.rc4, len, (unsigned char *)src, dest); + break; + + case SSH_CIPHER_CAST128_CBC: + CAST_cbc_encrypt(src, dest, len, + &context->u.cast.key, context->u.cast.iv, CAST_ENCRYPT); + break; + default: fatal("cipher_encrypt: unknown cipher: %s", cipher_name(context->type)); } @@ -291,7 +407,7 @@ cipher_encrypt(CipherContext *context, unsigned char *dest, /* Decrypts data using the cipher. */ -void +void cipher_decrypt(CipherContext *context, unsigned char *dest, const unsigned char *src, unsigned int len) { @@ -304,15 +420,13 @@ cipher_decrypt(CipherContext *context, unsigned char *dest, break; case SSH_CIPHER_3DES: - /* CRC-32 attack? */ SSH_3CBC_DECRYPT(context->u.des3.key1, context->u.des3.key2, &context->u.des3.iv2, context->u.des3.key3, &context->u.des3.iv3, - dest, (void *) src, len); + dest, (unsigned char *) src, len); break; case SSH_CIPHER_BLOWFISH: - detect_cbc_attack(src, len); swap_bytes(src, dest, len); BF_cbc_encrypt((void *) dest, dest, len, &context->u.bf.key, context->u.bf.iv, @@ -320,6 +434,27 @@ cipher_decrypt(CipherContext *context, unsigned char *dest, swap_bytes(dest, dest, len); break; + case SSH_CIPHER_BLOWFISH_CBC: + BF_cbc_encrypt((void *) src, dest, len, + &context->u.bf.key, context->u.bf.iv, + BF_DECRYPT); + break; + + case SSH_CIPHER_3DES_CBC: + des_ede3_cbc_encrypt(src, dest, len, + context->u.des3.key1, context->u.des3.key2, + context->u.des3.key3, &context->u.des3.iv3, DES_DECRYPT); + break; + + case SSH_CIPHER_ARCFOUR: + RC4(&context->u.rc4, len, (unsigned char *)src, dest); + break; + + case SSH_CIPHER_CAST128_CBC: + CAST_cbc_encrypt(src, dest, len, + &context->u.cast.key, context->u.cast.iv, CAST_DECRYPT); + break; + default: fatal("cipher_decrypt: unknown cipher: %s", cipher_name(context->type)); }