/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
/* plugins/preauth/spake/spake_client.c - SPAKE clpreauth module */
/*
* Copyright (C) 2015 by the Massachusetts Institute of Technology.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "k5-int.h"
#include "k5-spake.h"
#include "trace.h"
#include "util.h"
#include "iana.h"
#include "groups.h"
#include <krb5/clpreauth_plugin.h>
typedef struct reqstate_st {
krb5_pa_spake *msg; /* set in prep_questions, used in process */
krb5_keyblock *initial_key;
krb5_data *support;
krb5_data thash;
krb5_data spakeresult;
} reqstate;
/* Return true if SF-NONE is present in factors. */
static krb5_boolean
contains_sf_none(krb5_spake_factor **factors)
{
int i;
for (i = 0; factors != NULL && factors[i] != NULL; i++) {
if (factors[i]->type == SPAKE_SF_NONE)
return TRUE;
}
return FALSE;
}
static krb5_error_code
spake_init(krb5_context context, krb5_clpreauth_moddata *moddata_out)
{
krb5_error_code ret;
groupstate *gstate;
ret = group_init_state(context, FALSE, &gstate);
if (ret)
return ret;
*moddata_out = (krb5_clpreauth_moddata)gstate;
return 0;
}
static void
spake_fini(krb5_context context, krb5_clpreauth_moddata moddata)
{
group_free_state((groupstate *)moddata);
}
static void
spake_request_init(krb5_context context, krb5_clpreauth_moddata moddata,
krb5_clpreauth_modreq *modreq_out)
{
*modreq_out = calloc(1, sizeof(reqstate));
}
static void
spake_request_fini(krb5_context context, krb5_clpreauth_moddata moddata,
krb5_clpreauth_modreq modreq)
{
reqstate *st = (reqstate *)modreq;
k5_free_pa_spake(context, st->msg);
krb5_free_keyblock(context, st->initial_key);
krb5_free_data(context, st->support);
krb5_free_data_contents(context, &st->thash);
zapfree(st->spakeresult.data, st->spakeresult.length);
free(st);
}
static krb5_error_code
spake_prep_questions(krb5_context context, krb5_clpreauth_moddata moddata,
krb5_clpreauth_modreq modreq,
krb5_get_init_creds_opt *opt, krb5_clpreauth_callbacks cb,
krb5_clpreauth_rock rock, krb5_kdc_req *req,
krb5_data *enc_req, krb5_data *enc_prev_req,
krb5_pa_data *pa_data)
{
krb5_error_code ret;
groupstate *gstate = (groupstate *)moddata;
reqstate *st = (reqstate *)modreq;
krb5_data in_data;
krb5_spake_challenge *ch;
if (st == NULL)
return ENOMEM;
/* We don't need to ask any questions to send a support message. */
if (pa_data->length == 0)
return 0;
/* Decode the incoming message, replacing any previous one in the request
* state. If we can't decode it, we have no questions to ask. */
k5_free_pa_spake(context, st->msg);
st->msg = NULL;
in_data = make_data(pa_data->contents, pa_data->length);
ret = decode_krb5_pa_spake(&in_data, &st->msg);
if (ret)
return (ret == ENOMEM) ? ENOMEM : 0;
if (st->msg->choice == SPAKE_MSGTYPE_CHALLENGE) {
ch = &st->msg->u.challenge;
if (!group_is_permitted(gstate, ch->group))
return 0;
/* When second factor support is implemented, we should ask questions
* based on the factors in the challenge. */
if (!contains_sf_none(ch->factors))
return 0;
/* We will need the AS key to respond to the challenge. */
cb->need_as_key(context, rock);
} else if (st->msg->choice == SPAKE_MSGTYPE_ENCDATA) {
/* When second factor support is implemented, we should decrypt the
* encdata message and ask questions based on the factor data. */
}
return 0;
}
/*
* Output a PA-SPAKE support message indicating which groups we support. This
* may be done for optimistic preauth, in response to an empty message, or in
* response to a challenge using a group we do not support. Save the support
* message in st->support.
*/
static krb5_error_code
send_support(krb5_context context, groupstate *gstate, reqstate *st,
krb5_pa_data ***pa_out)
{
krb5_error_code ret;
krb5_data *support;
krb5_pa_spake msg;
msg.choice = SPAKE_MSGTYPE_SUPPORT;
group_get_permitted(gstate, &msg.u.support.groups, &msg.u.support.ngroups);
ret = encode_krb5_pa_spake(&msg, &support);
if (ret)
return ret;
/* Save the support message for later use in the transcript hash. */
ret = krb5_copy_data(context, support, &st->support);
if (ret) {
krb5_free_data(context, support);
return ret;
}
TRACE_SPAKE_SEND_SUPPORT(context);
return convert_to_padata(support, pa_out);
}
static krb5_error_code
process_challenge(krb5_context context, groupstate *gstate, reqstate *st,
krb5_spake_challenge *ch, const krb5_data *der_msg,
krb5_clpreauth_callbacks cb, krb5_clpreauth_rock rock,
krb5_prompter_fct prompter, void *prompter_data,
const krb5_data *der_req, krb5_pa_data ***pa_out)
{
krb5_error_code ret;
krb5_keyblock *k0 = NULL, *k1 = NULL, *as_key;
krb5_spake_factor factor;
krb5_pa_spake msg;
krb5_data *der_factor = NULL, *response;
krb5_data clpriv = empty_data(), clpub = empty_data();
krb5_data wbytes = empty_data();
krb5_enc_data enc_factor;
enc_factor.ciphertext = empty_data();
/* Not expected if we processed a challenge and didn't reject it. */
if (st->initial_key != NULL)
return KRB5KDC_ERR_PREAUTH_FAILED;
if (!group_is_permitted(gstate, ch->group)) {
TRACE_SPAKE_REJECT_CHALLENGE(context, ch->group);
/* No point in sending a second support message. */
if (st->support != NULL)
return KRB5KDC_ERR_PREAUTH_FAILED;
return send_support(context, gstate, st, pa_out);
}
/* Initialize and update the transcript with the concatenation of the
* support message (if we sent one) and the received challenge. */
ret = update_thash(context, gstate, ch->group, &st->thash, st->support,
der_msg);
if (ret)
return ret;
TRACE_SPAKE_RECEIVE_CHALLENGE(context, ch->group, &ch->pubkey);
/* When second factor support is implemented, we should check for a
* supported factor type instead of just checking for SF-NONE. */
if (!contains_sf_none(ch->factors))
return KRB5KDC_ERR_PREAUTH_FAILED;
ret = cb->get_as_key(context, rock, &as_key);
if (ret)
goto cleanup;
ret = krb5_copy_keyblock(context, as_key, &st->initial_key);
if (ret)
goto cleanup;
ret = derive_wbytes(context, ch->group, st->initial_key, &wbytes);
if (ret)
goto cleanup;
ret = group_keygen(context, gstate, ch->group, &wbytes, &clpriv, &clpub);
if (ret)
goto cleanup;
ret = group_result(context, gstate, ch->group, &wbytes, &clpriv,
&ch->pubkey, &st->spakeresult);
if (ret)
goto cleanup;
ret = update_thash(context, gstate, ch->group, &st->thash, &clpub, NULL);
if (ret)
goto cleanup;
TRACE_SPAKE_CLIENT_THASH(context, &st->thash);
/* Replace the reply key with K'[0]. */
ret = derive_key(context, gstate, ch->group, st->initial_key, &wbytes,
&st->spakeresult, &st->thash, der_req, 0, &k0);
if (ret)
goto cleanup;
ret = cb->set_as_key(context, rock, k0);
if (ret)
goto cleanup;
/* Encrypt a SPAKESecondFactor message with K'[1]. */
ret = derive_key(context, gstate, ch->group, st->initial_key, &wbytes,
&st->spakeresult, &st->thash, der_req, 1, &k1);
if (ret)
goto cleanup;
/* When second factor support is implemented, we should construct an
* appropriate factor here instead of hardcoding SF-NONE. */
factor.type = SPAKE_SF_NONE;
factor.data = NULL;
ret = encode_krb5_spake_factor(&factor, &der_factor);
if (ret)
goto cleanup;
ret = krb5_encrypt_helper(context, k1, KRB5_KEYUSAGE_SPAKE, der_factor,
&enc_factor);
if (ret)
goto cleanup;
/* Encode and output a response message. */
msg.choice = SPAKE_MSGTYPE_RESPONSE;
msg.u.response.pubkey = clpub;
msg.u.response.factor = enc_factor;
ret = encode_krb5_pa_spake(&msg, &response);
if (ret)
goto cleanup;
TRACE_SPAKE_SEND_RESPONSE(context);
ret = convert_to_padata(response, pa_out);
if (ret)
goto cleanup;
cb->disable_fallback(context, rock);
cleanup:
krb5_free_keyblock(context, k0);
krb5_free_keyblock(context, k1);
krb5_free_data_contents(context, &enc_factor.ciphertext);
krb5_free_data_contents(context, &clpub);
zapfree(clpriv.data, clpriv.length);
zapfree(wbytes.data, wbytes.length);
if (der_factor != NULL) {
zapfree(der_factor->data, der_factor->length);
free(der_factor);
}
return ret;
}
static krb5_error_code
process_encdata(krb5_context context, reqstate *st, krb5_enc_data *enc,
krb5_clpreauth_callbacks cb, krb5_clpreauth_rock rock,
krb5_prompter_fct prompter, void *prompter_data,
const krb5_data *der_prev_req, const krb5_data *der_req,
krb5_pa_data ***pa_out)
{
/* Not expected if we haven't sent a response yet. */
if (st->initial_key == NULL || st->spakeresult.length == 0)
return KRB5KDC_ERR_PREAUTH_FAILED;
/*
* When second factor support is implemented, we should process encdata
* messages according to the factor type. We should make sure to re-derive
* K'[0] and replace the reply key again, in case the request has changed.
* We should use der_prev_req to derive K'[n] to decrypt factor from the
* KDC. We should use der_req to derive K'[n+1] for the next message to
* send to the KDC.
*/
return KRB5_PLUGIN_OP_NOTSUPP;
}
static krb5_error_code
spake_process(krb5_context context, krb5_clpreauth_moddata moddata,
krb5_clpreauth_modreq modreq, krb5_get_init_creds_opt *opt,
krb5_clpreauth_callbacks cb, krb5_clpreauth_rock rock,
krb5_kdc_req *req, krb5_data *der_req, krb5_data *der_prev_req,
krb5_pa_data *pa_in, krb5_prompter_fct prompter,
void *prompter_data, krb5_pa_data ***pa_out)
{
krb5_error_code ret;
groupstate *gstate = (groupstate *)moddata;
reqstate *st = (reqstate *)modreq;
krb5_data in_data;
if (st == NULL)
return ENOMEM;
if (pa_in->length == 0) {
/* Not expected if we already sent a support message. */
if (st->support != NULL)
return KRB5KDC_ERR_PREAUTH_FAILED;
return send_support(context, gstate, st, pa_out);
}
if (st->msg == NULL) {
/* The message failed to decode in spake_prep_questions(). */
ret = KRB5KDC_ERR_PREAUTH_FAILED;
} else if (st->msg->choice == SPAKE_MSGTYPE_CHALLENGE) {
in_data = make_data(pa_in->contents, pa_in->length);
ret = process_challenge(context, gstate, st, &st->msg->u.challenge,
&in_data, cb, rock, prompter, prompter_data,
der_req, pa_out);
} else if (st->msg->choice == SPAKE_MSGTYPE_ENCDATA) {
ret = process_encdata(context, st, &st->msg->u.encdata, cb, rock,
prompter, prompter_data, der_prev_req, der_req,
pa_out);
} else {
/* Unexpected message type */
ret = KRB5KDC_ERR_PREAUTH_FAILED;
}
return ret;
}
krb5_error_code
clpreauth_spake_initvt(krb5_context context, int maj_ver, int min_ver,
krb5_plugin_vtable vtable);
krb5_error_code
clpreauth_spake_initvt(krb5_context context, int maj_ver, int min_ver,
krb5_plugin_vtable vtable)
{
krb5_clpreauth_vtable vt;
static krb5_preauthtype pa_types[] = { KRB5_PADATA_SPAKE, 0 };
if (maj_ver != 1)
return KRB5_PLUGIN_VER_NOTSUPP;
vt = (krb5_clpreauth_vtable)vtable;
vt->name = "spake";
vt->pa_type_list = pa_types;
vt->init = spake_init;
vt->fini = spake_fini;
vt->request_init = spake_request_init;
vt->request_fini = spake_request_fini;
vt->process = spake_process;
vt->prep_questions = spake_prep_questions;
return 0;
}