|
Packit |
6c0a39 |
/*
|
|
Packit |
6c0a39 |
* This file is part of the SSH Library
|
|
Packit |
6c0a39 |
*
|
|
Packit |
6c0a39 |
* Copyright (c) 2009 by Aris Adamantiadis
|
|
Packit |
6c0a39 |
* Copyrihgt (c) 2018 Red Hat, Inc.
|
|
Packit |
6c0a39 |
*
|
|
Packit |
6c0a39 |
* This library is free software; you can redistribute it and/or
|
|
Packit |
6c0a39 |
* modify it under the terms of the GNU Lesser General Public
|
|
Packit |
6c0a39 |
* License as published by the Free Software Foundation; either
|
|
Packit |
6c0a39 |
* version 2.1 of the License, or (at your option) any later version.
|
|
Packit |
6c0a39 |
*
|
|
Packit |
6c0a39 |
* This library is distributed in the hope that it will be useful,
|
|
Packit |
6c0a39 |
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
Packit |
6c0a39 |
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Packit |
6c0a39 |
* Lesser General Public License for more details.
|
|
Packit |
6c0a39 |
*
|
|
Packit |
6c0a39 |
* You should have received a copy of the GNU Lesser General Public
|
|
Packit |
6c0a39 |
* License along with this library; if not, write to the Free Software
|
|
Packit |
6c0a39 |
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
|
Packit |
6c0a39 |
*/
|
|
Packit |
6c0a39 |
|
|
Packit |
6c0a39 |
#include "config.h"
|
|
Packit |
6c0a39 |
#include <stdio.h>
|
|
Packit |
6c0a39 |
#include <stdlib.h>
|
|
Packit |
6c0a39 |
#include <string.h>
|
|
Packit |
6c0a39 |
#include <limits.h>
|
|
Packit |
6c0a39 |
|
|
Packit |
6c0a39 |
#include "libssh/priv.h"
|
|
Packit |
6c0a39 |
#include "libssh/crypto.h"
|
|
Packit |
6c0a39 |
#include "libssh/buffer.h"
|
|
Packit |
6c0a39 |
#include "libssh/session.h"
|
|
Packit |
6c0a39 |
#include "libssh/misc.h"
|
|
Packit |
6c0a39 |
#include "libssh/dh.h"
|
|
Packit |
6c0a39 |
#include "libssh/ssh2.h"
|
|
Packit |
6c0a39 |
#include "libssh/pki.h"
|
|
Packit |
6c0a39 |
#include "libssh/bignum.h"
|
|
Packit |
6c0a39 |
|
|
Packit |
6c0a39 |
#include "libssh/string.h"
|
|
Packit |
6c0a39 |
|
|
Packit |
6c0a39 |
|
|
Packit |
6c0a39 |
/* The following implements the SSHKDF for crypto backend that
|
|
Packit |
6c0a39 |
* do not have a native implementations */
|
|
Packit |
6c0a39 |
struct ssh_mac_ctx_struct {
|
|
Packit |
6c0a39 |
enum ssh_kdf_digest digest_type;
|
|
Packit |
6c0a39 |
union {
|
|
Packit |
6c0a39 |
SHACTX sha1_ctx;
|
|
Packit |
6c0a39 |
SHA256CTX sha256_ctx;
|
|
Packit |
6c0a39 |
SHA384CTX sha384_ctx;
|
|
Packit |
6c0a39 |
SHA512CTX sha512_ctx;
|
|
Packit |
6c0a39 |
} ctx;
|
|
Packit |
6c0a39 |
};
|
|
Packit |
6c0a39 |
|
|
Packit |
6c0a39 |
static ssh_mac_ctx ssh_mac_ctx_init(enum ssh_kdf_digest type)
|
|
Packit |
6c0a39 |
{
|
|
Packit |
6c0a39 |
ssh_mac_ctx ctx = malloc(sizeof(struct ssh_mac_ctx_struct));
|
|
Packit |
6c0a39 |
if (ctx == NULL) {
|
|
Packit |
6c0a39 |
return NULL;
|
|
Packit |
6c0a39 |
}
|
|
Packit |
6c0a39 |
|
|
Packit |
6c0a39 |
ctx->digest_type = type;
|
|
Packit |
6c0a39 |
switch(type){
|
|
Packit |
6c0a39 |
case SSH_KDF_SHA1:
|
|
Packit |
6c0a39 |
ctx->ctx.sha1_ctx = sha1_init();
|
|
Packit |
6c0a39 |
return ctx;
|
|
Packit |
6c0a39 |
case SSH_KDF_SHA256:
|
|
Packit |
6c0a39 |
ctx->ctx.sha256_ctx = sha256_init();
|
|
Packit |
6c0a39 |
return ctx;
|
|
Packit |
6c0a39 |
case SSH_KDF_SHA384:
|
|
Packit |
6c0a39 |
ctx->ctx.sha384_ctx = sha384_init();
|
|
Packit |
6c0a39 |
return ctx;
|
|
Packit |
6c0a39 |
case SSH_KDF_SHA512:
|
|
Packit |
6c0a39 |
ctx->ctx.sha512_ctx = sha512_init();
|
|
Packit |
6c0a39 |
return ctx;
|
|
Packit |
6c0a39 |
default:
|
|
Packit |
6c0a39 |
SAFE_FREE(ctx);
|
|
Packit |
6c0a39 |
return NULL;
|
|
Packit |
6c0a39 |
}
|
|
Packit |
6c0a39 |
}
|
|
Packit |
6c0a39 |
|
|
Packit |
6c0a39 |
static void ssh_mac_update(ssh_mac_ctx ctx, const void *data, size_t len)
|
|
Packit |
6c0a39 |
{
|
|
Packit |
6c0a39 |
switch(ctx->digest_type){
|
|
Packit |
6c0a39 |
case SSH_KDF_SHA1:
|
|
Packit |
6c0a39 |
sha1_update(ctx->ctx.sha1_ctx, data, len);
|
|
Packit |
6c0a39 |
break;
|
|
Packit |
6c0a39 |
case SSH_KDF_SHA256:
|
|
Packit |
6c0a39 |
sha256_update(ctx->ctx.sha256_ctx, data, len);
|
|
Packit |
6c0a39 |
break;
|
|
Packit |
6c0a39 |
case SSH_KDF_SHA384:
|
|
Packit |
6c0a39 |
sha384_update(ctx->ctx.sha384_ctx, data, len);
|
|
Packit |
6c0a39 |
break;
|
|
Packit |
6c0a39 |
case SSH_KDF_SHA512:
|
|
Packit |
6c0a39 |
sha512_update(ctx->ctx.sha512_ctx, data, len);
|
|
Packit |
6c0a39 |
break;
|
|
Packit |
6c0a39 |
}
|
|
Packit |
6c0a39 |
}
|
|
Packit |
6c0a39 |
|
|
Packit |
6c0a39 |
static void ssh_mac_final(unsigned char *md, ssh_mac_ctx ctx)
|
|
Packit |
6c0a39 |
{
|
|
Packit |
6c0a39 |
switch(ctx->digest_type){
|
|
Packit |
6c0a39 |
case SSH_KDF_SHA1:
|
|
Packit |
6c0a39 |
sha1_final(md,ctx->ctx.sha1_ctx);
|
|
Packit |
6c0a39 |
break;
|
|
Packit |
6c0a39 |
case SSH_KDF_SHA256:
|
|
Packit |
6c0a39 |
sha256_final(md,ctx->ctx.sha256_ctx);
|
|
Packit |
6c0a39 |
break;
|
|
Packit |
6c0a39 |
case SSH_KDF_SHA384:
|
|
Packit |
6c0a39 |
sha384_final(md,ctx->ctx.sha384_ctx);
|
|
Packit |
6c0a39 |
break;
|
|
Packit |
6c0a39 |
case SSH_KDF_SHA512:
|
|
Packit |
6c0a39 |
sha512_final(md,ctx->ctx.sha512_ctx);
|
|
Packit |
6c0a39 |
break;
|
|
Packit |
6c0a39 |
}
|
|
Packit |
6c0a39 |
SAFE_FREE(ctx);
|
|
Packit |
6c0a39 |
}
|
|
Packit |
6c0a39 |
|
|
Packit |
6c0a39 |
int sshkdf_derive_key(struct ssh_crypto_struct *crypto,
|
|
Packit |
6c0a39 |
unsigned char *key, size_t key_len,
|
|
Packit |
6c0a39 |
int key_type, unsigned char *output,
|
|
Packit |
6c0a39 |
size_t requested_len)
|
|
Packit |
6c0a39 |
{
|
|
Packit |
6c0a39 |
/* Can't use VLAs with Visual Studio, so allocate the biggest
|
|
Packit |
6c0a39 |
* digest buffer we can possibly need */
|
|
Packit |
6c0a39 |
unsigned char digest[DIGEST_MAX_LEN];
|
|
Packit |
6c0a39 |
size_t output_len = crypto->digest_len;
|
|
Packit |
6c0a39 |
char letter = key_type;
|
|
Packit |
6c0a39 |
ssh_mac_ctx ctx;
|
|
Packit |
6c0a39 |
|
|
Packit |
6c0a39 |
if (DIGEST_MAX_LEN < crypto->digest_len) {
|
|
Packit |
6c0a39 |
return -1;
|
|
Packit |
6c0a39 |
}
|
|
Packit |
6c0a39 |
|
|
Packit |
6c0a39 |
ctx = ssh_mac_ctx_init(crypto->digest_type);
|
|
Packit |
6c0a39 |
if (ctx == NULL) {
|
|
Packit |
6c0a39 |
return -1;
|
|
Packit |
6c0a39 |
}
|
|
Packit |
6c0a39 |
|
|
Packit |
6c0a39 |
ssh_mac_update(ctx, key, key_len);
|
|
Packit |
6c0a39 |
ssh_mac_update(ctx, crypto->secret_hash, crypto->digest_len);
|
|
Packit |
6c0a39 |
ssh_mac_update(ctx, &letter, 1);
|
|
Packit |
6c0a39 |
ssh_mac_update(ctx, crypto->session_id, crypto->digest_len);
|
|
Packit |
6c0a39 |
ssh_mac_final(digest, ctx);
|
|
Packit |
6c0a39 |
|
|
Packit |
6c0a39 |
if (requested_len < output_len) {
|
|
Packit |
6c0a39 |
output_len = requested_len;
|
|
Packit |
6c0a39 |
}
|
|
Packit |
6c0a39 |
memcpy(output, digest, output_len);
|
|
Packit |
6c0a39 |
|
|
Packit |
6c0a39 |
while (requested_len > output_len) {
|
|
Packit |
6c0a39 |
ctx = ssh_mac_ctx_init(crypto->digest_type);
|
|
Packit |
6c0a39 |
if (ctx == NULL) {
|
|
Packit |
6c0a39 |
return -1;
|
|
Packit |
6c0a39 |
}
|
|
Packit |
6c0a39 |
ssh_mac_update(ctx, key, key_len);
|
|
Packit |
6c0a39 |
ssh_mac_update(ctx, crypto->secret_hash, crypto->digest_len);
|
|
Packit |
6c0a39 |
ssh_mac_update(ctx, output, output_len);
|
|
Packit |
6c0a39 |
ssh_mac_final(digest, ctx);
|
|
Packit |
6c0a39 |
if (requested_len < output_len + crypto->digest_len) {
|
|
Packit |
6c0a39 |
memcpy(output + output_len, digest, requested_len - output_len);
|
|
Packit |
6c0a39 |
} else {
|
|
Packit |
6c0a39 |
memcpy(output + output_len, digest, crypto->digest_len);
|
|
Packit |
6c0a39 |
}
|
|
Packit |
6c0a39 |
output_len += crypto->digest_len;
|
|
Packit |
6c0a39 |
}
|
|
Packit |
6c0a39 |
|
|
Packit |
6c0a39 |
return 0;
|
|
Packit |
6c0a39 |
}
|