1 /* 2 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * All rights reserved 5 * 6 * As far as I am concerned, the code I have written for this software 7 * can be used freely for any purpose. Any derived versions of this 8 * software must be clearly marked as such, and if the derived work is 9 * incompatible with the protocol description in the RFC file, it must be 10 * called by a name other than "ssh" or "Secure Shell". 11 * 12 * 13 * Copyright (c) 1999 Niels Provos. All rights reserved. 14 * Copyright (c) 1999, 2000 Markus Friedl. All rights reserved. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions 18 * are met: 19 * 1. Redistributions of source code must retain the above copyright 20 * notice, this list of conditions and the following disclaimer. 21 * 2. Redistributions in binary form must reproduce the above copyright 22 * notice, this list of conditions and the following disclaimer in the 23 * documentation and/or other materials provided with the distribution. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35 */ 36 37 #include "includes.h" 38 RCSID("$OpenBSD: cipher.c,v 1.73 2005/01/23 10:18:12 djm Exp $"); 39 40 #include "xmalloc.h" 41 #include "log.h" 42 #include "cipher.h" 43 44 #include <openssl/md5.h> 45 46 #if OPENSSL_VERSION_NUMBER < 0x00906000L 47 #define SSH_OLD_EVP 48 #define EVP_CIPHER_CTX_get_app_data(e) ((e)->app_data) 49 #endif 50 51 #if OPENSSL_VERSION_NUMBER < 0x00907000L 52 extern const EVP_CIPHER *evp_rijndael(void); 53 extern void ssh_rijndael_iv(EVP_CIPHER_CTX *, int, u_char *, u_int); 54 #endif 55 56 #if !defined(EVP_CTRL_SET_ACSS_MODE) 57 # if (OPENSSL_VERSION_NUMBER >= 0x00907000L) 58 extern const EVP_CIPHER *evp_acss(void); 59 # define EVP_acss evp_acss 60 # define EVP_CTRL_SET_ACSS_MODE xxx /* used below */ 61 # else 62 # define EVP_acss NULL /* Don't try to support ACSS on older OpenSSL */ 63 # endif /* (OPENSSL_VERSION_NUMBER >= 0x00906000L) */ 64 #endif /* !defined(EVP_CTRL_SET_ACSS_MODE) */ 65 66 extern const EVP_CIPHER *evp_ssh1_bf(void); 67 extern const EVP_CIPHER *evp_ssh1_3des(void); 68 extern void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int); 69 extern const EVP_CIPHER *evp_aes_128_ctr(void); 70 extern void ssh_aes_ctr_iv(EVP_CIPHER_CTX *, int, u_char *, u_int); 71 72 struct Cipher { 73 char *name; 74 int number; /* for ssh1 only */ 75 u_int block_size; 76 u_int key_len; 77 const EVP_CIPHER *(*evptype)(void); 78 } ciphers[] = { 79 { "none", SSH_CIPHER_NONE, 8, 0, EVP_enc_null }, 80 { "des", SSH_CIPHER_DES, 8, 8, EVP_des_cbc }, 81 { "3des", SSH_CIPHER_3DES, 8, 16, evp_ssh1_3des }, 82 { "blowfish", SSH_CIPHER_BLOWFISH, 8, 32, evp_ssh1_bf }, 83 84 { "3des-cbc", SSH_CIPHER_SSH2, 8, 24, EVP_des_ede3_cbc }, 85 { "blowfish-cbc", SSH_CIPHER_SSH2, 8, 16, EVP_bf_cbc }, 86 { "cast128-cbc", SSH_CIPHER_SSH2, 8, 16, EVP_cast5_cbc }, 87 { "arcfour", SSH_CIPHER_SSH2, 8, 16, EVP_rc4 }, 88 #if OPENSSL_VERSION_NUMBER < 0x00907000L 89 { "aes128-cbc", SSH_CIPHER_SSH2, 16, 16, evp_rijndael }, 90 { "aes192-cbc", SSH_CIPHER_SSH2, 16, 24, evp_rijndael }, 91 { "aes256-cbc", SSH_CIPHER_SSH2, 16, 32, evp_rijndael }, 92 { "rijndael-cbc@lysator.liu.se", 93 SSH_CIPHER_SSH2, 16, 32, evp_rijndael }, 94 #else 95 { "aes128-cbc", SSH_CIPHER_SSH2, 16, 16, EVP_aes_128_cbc }, 96 { "aes192-cbc", SSH_CIPHER_SSH2, 16, 24, EVP_aes_192_cbc }, 97 { "aes256-cbc", SSH_CIPHER_SSH2, 16, 32, EVP_aes_256_cbc }, 98 { "rijndael-cbc@lysator.liu.se", 99 SSH_CIPHER_SSH2, 16, 32, EVP_aes_256_cbc }, 100 #endif 101 #if OPENSSL_VERSION_NUMBER >= 0x00905000L 102 { "aes128-ctr", SSH_CIPHER_SSH2, 16, 16, evp_aes_128_ctr }, 103 { "aes192-ctr", SSH_CIPHER_SSH2, 16, 24, evp_aes_128_ctr }, 104 { "aes256-ctr", SSH_CIPHER_SSH2, 16, 32, evp_aes_128_ctr }, 105 #endif 106 #if defined(EVP_CTRL_SET_ACSS_MODE) 107 { "acss@openssh.org", SSH_CIPHER_SSH2, 16, 5, EVP_acss }, 108 #endif 109 { NULL, SSH_CIPHER_INVALID, 0, 0, NULL } 110 }; 111 112 /*--*/ 113 114 u_int 115 cipher_blocksize(const Cipher *c) 116 { 117 return (c->block_size); 118 } 119 120 u_int 121 cipher_keylen(const Cipher *c) 122 { 123 return (c->key_len); 124 } 125 126 u_int 127 cipher_get_number(const Cipher *c) 128 { 129 return (c->number); 130 } 131 132 u_int 133 cipher_mask_ssh1(int client) 134 { 135 u_int mask = 0; 136 mask |= 1 << SSH_CIPHER_3DES; /* Mandatory */ 137 mask |= 1 << SSH_CIPHER_BLOWFISH; 138 if (client) { 139 mask |= 1 << SSH_CIPHER_DES; 140 } 141 return mask; 142 } 143 144 Cipher * 145 cipher_by_name(const char *name) 146 { 147 Cipher *c; 148 for (c = ciphers; c->name != NULL; c++) 149 if (strcmp(c->name, name) == 0) 150 return c; 151 return NULL; 152 } 153 154 Cipher * 155 cipher_by_number(int id) 156 { 157 Cipher *c; 158 for (c = ciphers; c->name != NULL; c++) 159 if (c->number == id) 160 return c; 161 return NULL; 162 } 163 164 #define CIPHER_SEP "," 165 int 166 ciphers_valid(const char *names) 167 { 168 Cipher *c; 169 char *cipher_list, *cp; 170 char *p; 171 172 if (names == NULL || strcmp(names, "") == 0) 173 return 0; 174 cipher_list = cp = xstrdup(names); 175 for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0'; 176 (p = strsep(&cp, CIPHER_SEP))) { 177 c = cipher_by_name(p); 178 if (c == NULL || c->number != SSH_CIPHER_SSH2) { 179 debug("bad cipher %s [%s]", p, names); 180 xfree(cipher_list); 181 return 0; 182 } else { 183 debug3("cipher ok: %s [%s]", p, names); 184 } 185 } 186 debug3("ciphers ok: [%s]", names); 187 xfree(cipher_list); 188 return 1; 189 } 190 191 /* 192 * Parses the name of the cipher. Returns the number of the corresponding 193 * cipher, or -1 on error. 194 */ 195 196 int 197 cipher_number(const char *name) 198 { 199 Cipher *c; 200 if (name == NULL) 201 return -1; 202 for (c = ciphers; c->name != NULL; c++) 203 if (strcasecmp(c->name, name) == 0) 204 return c->number; 205 return -1; 206 } 207 208 char * 209 cipher_name(int id) 210 { 211 Cipher *c = cipher_by_number(id); 212 return (c==NULL) ? "<unknown>" : c->name; 213 } 214 215 void 216 cipher_init(CipherContext *cc, Cipher *cipher, 217 const u_char *key, u_int keylen, const u_char *iv, u_int ivlen, 218 int do_encrypt) 219 { 220 static int dowarn = 1; 221 #ifdef SSH_OLD_EVP 222 EVP_CIPHER *type; 223 #else 224 const EVP_CIPHER *type; 225 #endif 226 int klen; 227 228 if (cipher->number == SSH_CIPHER_DES) { 229 if (dowarn) { 230 error("Warning: use of DES is strongly discouraged " 231 "due to cryptographic weaknesses"); 232 dowarn = 0; 233 } 234 if (keylen > 8) 235 keylen = 8; 236 } 237 cc->plaintext = (cipher->number == SSH_CIPHER_NONE); 238 239 if (keylen < cipher->key_len) 240 fatal("cipher_init: key length %d is insufficient for %s.", 241 keylen, cipher->name); 242 if (iv != NULL && ivlen < cipher->block_size) 243 fatal("cipher_init: iv length %d is insufficient for %s.", 244 ivlen, cipher->name); 245 cc->cipher = cipher; 246 247 type = (*cipher->evptype)(); 248 249 EVP_CIPHER_CTX_init(&cc->evp); 250 #ifdef SSH_OLD_EVP 251 if (type->key_len > 0 && type->key_len != keylen) { 252 debug("cipher_init: set keylen (%d -> %d)", 253 type->key_len, keylen); 254 type->key_len = keylen; 255 } 256 EVP_CipherInit(&cc->evp, type, (u_char *)key, (u_char *)iv, 257 (do_encrypt == CIPHER_ENCRYPT)); 258 #else 259 if (EVP_CipherInit(&cc->evp, type, NULL, (u_char *)iv, 260 (do_encrypt == CIPHER_ENCRYPT)) == 0) 261 fatal("cipher_init: EVP_CipherInit failed for %s", 262 cipher->name); 263 klen = EVP_CIPHER_CTX_key_length(&cc->evp); 264 if (klen > 0 && keylen != klen) { 265 debug2("cipher_init: set keylen (%d -> %d)", klen, keylen); 266 if (EVP_CIPHER_CTX_set_key_length(&cc->evp, keylen) == 0) 267 fatal("cipher_init: set keylen failed (%d -> %d)", 268 klen, keylen); 269 } 270 if (EVP_CipherInit(&cc->evp, NULL, (u_char *)key, NULL, -1) == 0) 271 fatal("cipher_init: EVP_CipherInit: set key failed for %s", 272 cipher->name); 273 #endif 274 } 275 276 void 277 cipher_crypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) 278 { 279 if (len % cc->cipher->block_size) 280 fatal("cipher_encrypt: bad plaintext length %d", len); 281 #ifdef SSH_OLD_EVP 282 EVP_Cipher(&cc->evp, dest, (u_char *)src, len); 283 #else 284 if (EVP_Cipher(&cc->evp, dest, (u_char *)src, len) == 0) 285 fatal("evp_crypt: EVP_Cipher failed"); 286 #endif 287 } 288 289 void 290 cipher_cleanup(CipherContext *cc) 291 { 292 #ifdef SSH_OLD_EVP 293 EVP_CIPHER_CTX_cleanup(&cc->evp); 294 #else 295 if (EVP_CIPHER_CTX_cleanup(&cc->evp) == 0) 296 error("cipher_cleanup: EVP_CIPHER_CTX_cleanup failed"); 297 #endif 298 } 299 300 /* 301 * Selects the cipher, and keys if by computing the MD5 checksum of the 302 * passphrase and using the resulting 16 bytes as the key. 303 */ 304 305 void 306 cipher_set_key_string(CipherContext *cc, Cipher *cipher, 307 const char *passphrase, int do_encrypt) 308 { 309 MD5_CTX md; 310 u_char digest[16]; 311 312 MD5_Init(&md); 313 MD5_Update(&md, (const u_char *)passphrase, strlen(passphrase)); 314 MD5_Final(digest, &md); 315 316 cipher_init(cc, cipher, digest, 16, NULL, 0, do_encrypt); 317 318 memset(digest, 0, sizeof(digest)); 319 memset(&md, 0, sizeof(md)); 320 } 321 322 /* 323 * Exports an IV from the CipherContext required to export the key 324 * state back from the unprivileged child to the privileged parent 325 * process. 326 */ 327 328 int 329 cipher_get_keyiv_len(const CipherContext *cc) 330 { 331 Cipher *c = cc->cipher; 332 int ivlen; 333 334 if (c->number == SSH_CIPHER_3DES) 335 ivlen = 24; 336 else 337 ivlen = EVP_CIPHER_CTX_iv_length(&cc->evp); 338 return (ivlen); 339 } 340 341 void 342 cipher_get_keyiv(CipherContext *cc, u_char *iv, u_int len) 343 { 344 Cipher *c = cc->cipher; 345 int evplen; 346 347 switch (c->number) { 348 case SSH_CIPHER_SSH2: 349 case SSH_CIPHER_DES: 350 case SSH_CIPHER_BLOWFISH: 351 evplen = EVP_CIPHER_CTX_iv_length(&cc->evp); 352 if (evplen == 0) 353 return; 354 if (evplen != len) 355 fatal("%s: wrong iv length %d != %d", __func__, 356 evplen, len); 357 #if OPENSSL_VERSION_NUMBER < 0x00907000L 358 if (c->evptype == evp_rijndael) 359 ssh_rijndael_iv(&cc->evp, 0, iv, len); 360 else 361 #endif 362 if (c->evptype == evp_aes_128_ctr) 363 ssh_aes_ctr_iv(&cc->evp, 0, iv, len); 364 else 365 memcpy(iv, cc->evp.iv, len); 366 break; 367 case SSH_CIPHER_3DES: 368 ssh1_3des_iv(&cc->evp, 0, iv, 24); 369 break; 370 default: 371 fatal("%s: bad cipher %d", __func__, c->number); 372 } 373 } 374 375 void 376 cipher_set_keyiv(CipherContext *cc, u_char *iv) 377 { 378 Cipher *c = cc->cipher; 379 int evplen = 0; 380 381 switch (c->number) { 382 case SSH_CIPHER_SSH2: 383 case SSH_CIPHER_DES: 384 case SSH_CIPHER_BLOWFISH: 385 evplen = EVP_CIPHER_CTX_iv_length(&cc->evp); 386 if (evplen == 0) 387 return; 388 #if OPENSSL_VERSION_NUMBER < 0x00907000L 389 if (c->evptype == evp_rijndael) 390 ssh_rijndael_iv(&cc->evp, 1, iv, evplen); 391 else 392 #endif 393 if (c->evptype == evp_aes_128_ctr) 394 ssh_aes_ctr_iv(&cc->evp, 1, iv, evplen); 395 else 396 memcpy(cc->evp.iv, iv, evplen); 397 break; 398 case SSH_CIPHER_3DES: 399 ssh1_3des_iv(&cc->evp, 1, iv, 24); 400 break; 401 default: 402 fatal("%s: bad cipher %d", __func__, c->number); 403 } 404 } 405 406 #if OPENSSL_VERSION_NUMBER < 0x00907000L 407 #define EVP_X_STATE(evp) &(evp).c 408 #define EVP_X_STATE_LEN(evp) sizeof((evp).c) 409 #else 410 #define EVP_X_STATE(evp) (evp).cipher_data 411 #define EVP_X_STATE_LEN(evp) (evp).cipher->ctx_size 412 #endif 413 414 int 415 cipher_get_keycontext(const CipherContext *cc, u_char *dat) 416 { 417 Cipher *c = cc->cipher; 418 int plen = 0; 419 420 if (c->evptype == EVP_rc4 || c->evptype == EVP_acss) { 421 plen = EVP_X_STATE_LEN(cc->evp); 422 if (dat == NULL) 423 return (plen); 424 memcpy(dat, EVP_X_STATE(cc->evp), plen); 425 } 426 return (plen); 427 } 428 429 void 430 cipher_set_keycontext(CipherContext *cc, u_char *dat) 431 { 432 Cipher *c = cc->cipher; 433 int plen; 434 435 if (c->evptype == EVP_rc4 || c->evptype == EVP_acss) { 436 plen = EVP_X_STATE_LEN(cc->evp); 437 memcpy(EVP_X_STATE(cc->evp), dat, plen); 438 } 439 } 440