1 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
2 /* lib/crypto/openssl/enc_provider/des3.c */
3 /*
4 * Copyright (C) 2009 by the Massachusetts Institute of Technology.
5 * All rights reserved.
6 *
7 * Export of this software from the United States of America may
8 * require a specific license from the United States Government.
9 * It is the responsibility of any person or organization contemplating
10 * export to obtain such a license before exporting.
11 *
12 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
13 * distribute this software and its documentation for any purpose and
14 * without fee is hereby granted, provided that the above copyright
15 * notice appear in all copies and that both that copyright notice and
16 * this permission notice appear in supporting documentation, and that
17 * the name of M.I.T. not be used in advertising or publicity pertaining
18 * to distribution of the software without specific, written prior
19 * permission. Furthermore if you modify this software you must label
20 * your software as modified software and not distribute it in such a
21 * fashion that it might be confused with the original M.I.T. software.
22 * M.I.T. makes no representations about the suitability of
23 * this software for any purpose. It is provided "as is" without express
24 * or implied warranty.
25 */
26 /*
27 * Copyright (C) 1998 by the FundsXpress, INC.
28 *
29 * All rights reserved.
30 *
31 * Export of this software from the United States of America may require
32 * a specific license from the United States Government. It is the
33 * responsibility of any person or organization contemplating export to
34 * obtain such a license before exporting.
35 *
36 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
37 * distribute this software and its documentation for any purpose and
38 * without fee is hereby granted, provided that the above copyright
39 * notice appear in all copies and that both that copyright notice and
40 * this permission notice appear in supporting documentation, and that
41 * the name of FundsXpress. not be used in advertising or publicity pertaining
42 * to distribution of the software without specific, written prior
43 * permission. FundsXpress makes no representations about the suitability of
44 * this software for any purpose. It is provided "as is" without express
45 * or implied warranty.
46 *
47 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
48 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
49 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
50 */
51
52 #include "crypto_int.h"
53
54 #ifdef K5_OPENSSL_DES
55
56 #include <openssl/evp.h>
57
58 #define DES3_BLOCK_SIZE 8
59 #define DES3_KEY_SIZE 24
60 #define DES3_KEY_BYTES 21
61
62 static krb5_error_code
validate(krb5_key key,const krb5_data * ivec,const krb5_crypto_iov * data,size_t num_data,krb5_boolean * empty)63 validate(krb5_key key, const krb5_data *ivec, const krb5_crypto_iov *data,
64 size_t num_data, krb5_boolean *empty)
65 {
66 size_t input_length = iov_total_length(data, num_data, FALSE);
67
68 if (key->keyblock.length != DES3_KEY_SIZE)
69 return(KRB5_BAD_KEYSIZE);
70 if ((input_length%DES3_BLOCK_SIZE) != 0)
71 return(KRB5_BAD_MSIZE);
72 if (ivec && (ivec->length != 8))
73 return(KRB5_BAD_MSIZE);
74
75 *empty = (input_length == 0);
76 return 0;
77 }
78
79 static krb5_error_code
k5_des3_encrypt(krb5_key key,const krb5_data * ivec,krb5_crypto_iov * data,size_t num_data)80 k5_des3_encrypt(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data,
81 size_t num_data)
82 {
83 int ret, olen = DES3_BLOCK_SIZE;
84 unsigned char iblock[DES3_BLOCK_SIZE], oblock[DES3_BLOCK_SIZE];
85 struct iov_cursor cursor;
86 EVP_CIPHER_CTX *ctx;
87 krb5_boolean empty;
88
89 ret = validate(key, ivec, data, num_data, &empty);
90 if (ret != 0 || empty)
91 return ret;
92
93 ctx = EVP_CIPHER_CTX_new();
94 if (ctx == NULL)
95 return ENOMEM;
96
97 ret = EVP_EncryptInit_ex(ctx, EVP_des_ede3_cbc(), NULL,
98 key->keyblock.contents,
99 (ivec) ? (unsigned char*)ivec->data : NULL);
100 if (!ret) {
101 EVP_CIPHER_CTX_free(ctx);
102 return KRB5_CRYPTO_INTERNAL;
103 }
104
105 EVP_CIPHER_CTX_set_padding(ctx,0);
106
107 k5_iov_cursor_init(&cursor, data, num_data, DES3_BLOCK_SIZE, FALSE);
108 while (k5_iov_cursor_get(&cursor, iblock)) {
109 ret = EVP_EncryptUpdate(ctx, oblock, &olen, iblock, DES3_BLOCK_SIZE);
110 if (!ret)
111 break;
112 k5_iov_cursor_put(&cursor, oblock);
113 }
114
115 if (ivec != NULL)
116 memcpy(ivec->data, oblock, DES3_BLOCK_SIZE);
117
118 EVP_CIPHER_CTX_free(ctx);
119
120 zap(iblock, sizeof(iblock));
121 zap(oblock, sizeof(oblock));
122
123 if (ret != 1)
124 return KRB5_CRYPTO_INTERNAL;
125 return 0;
126 }
127
128 static krb5_error_code
k5_des3_decrypt(krb5_key key,const krb5_data * ivec,krb5_crypto_iov * data,size_t num_data)129 k5_des3_decrypt(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data,
130 size_t num_data)
131 {
132 int ret, olen = DES3_BLOCK_SIZE;
133 unsigned char iblock[DES3_BLOCK_SIZE], oblock[DES3_BLOCK_SIZE];
134 struct iov_cursor cursor;
135 EVP_CIPHER_CTX *ctx;
136 krb5_boolean empty;
137
138 ret = validate(key, ivec, data, num_data, &empty);
139 if (ret != 0 || empty)
140 return ret;
141
142 ctx = EVP_CIPHER_CTX_new();
143 if (ctx == NULL)
144 return ENOMEM;
145
146 ret = EVP_DecryptInit_ex(ctx, EVP_des_ede3_cbc(), NULL,
147 key->keyblock.contents,
148 (ivec) ? (unsigned char*)ivec->data : NULL);
149 if (!ret) {
150 EVP_CIPHER_CTX_free(ctx);
151 return KRB5_CRYPTO_INTERNAL;
152 }
153
154 EVP_CIPHER_CTX_set_padding(ctx,0);
155
156 k5_iov_cursor_init(&cursor, data, num_data, DES3_BLOCK_SIZE, FALSE);
157 while (k5_iov_cursor_get(&cursor, iblock)) {
158 ret = EVP_DecryptUpdate(ctx, oblock, &olen,
159 (unsigned char *)iblock, DES3_BLOCK_SIZE);
160 if (!ret)
161 break;
162 k5_iov_cursor_put(&cursor, oblock);
163 }
164
165 if (ivec != NULL)
166 memcpy(ivec->data, iblock, DES3_BLOCK_SIZE);
167
168 EVP_CIPHER_CTX_free(ctx);
169
170 zap(iblock, sizeof(iblock));
171 zap(oblock, sizeof(oblock));
172
173 if (ret != 1)
174 return KRB5_CRYPTO_INTERNAL;
175 return 0;
176 }
177
178 const struct krb5_enc_provider krb5int_enc_des3 = {
179 DES3_BLOCK_SIZE,
180 DES3_KEY_BYTES, DES3_KEY_SIZE,
181 k5_des3_encrypt,
182 k5_des3_decrypt,
183 NULL,
184 krb5int_des_init_state,
185 krb5int_default_free_state
186 };
187
188 #endif /* K5_OPENSSL_DES */
189