Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update

Browse Source
This commit is contained in:
Hakase
2019-02-22 12:53:31 +09:00
parent 6523a76e2e
commit 25fbda8e8b
186 changed files with 9758 additions and 1640 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crypto/kdf/build.info
+1 -1
View File
@@ -1,3 +1,3 @@
LIBS=../../libcrypto
SOURCE[../../libcrypto]=\
tls1_prf.c kdf_err.c hkdf.c scrypt.c
tls1_prf.c kdf_err.c kdf_util.c hkdf.c scrypt.c pbkdf2.c
crypto/kdf/hkdf.c
+150 -176
View File
@@ -8,32 +8,33 @@
*/
#include <stdlib.h>
#include <stdarg.h>
#include <string.h>
#include <openssl/hmac.h>
#include <openssl/kdf.h>
#include <openssl/evp.h>
#include <openssl/kdf.h>
#include "internal/cryptlib.h"
#include "internal/evp_int.h"
#include "kdf_local.h"
#define HKDF_MAXBUF 1024
static unsigned char *HKDF(const EVP_MD *evp_md,
const unsigned char *salt, size_t salt_len,
const unsigned char *key, size_t key_len,
const unsigned char *info, size_t info_len,
unsigned char *okm, size_t okm_len);
static void kdf_hkdf_reset(EVP_KDF_IMPL *impl);
static int HKDF(const EVP_MD *evp_md,
const unsigned char *salt, size_t salt_len,
const unsigned char *key, size_t key_len,
const unsigned char *info, size_t info_len,
unsigned char *okm, size_t okm_len);
static int HKDF_Extract(const EVP_MD *evp_md,
const unsigned char *salt, size_t salt_len,
const unsigned char *key, size_t key_len,
unsigned char *prk, size_t prk_len);
static int HKDF_Expand(const EVP_MD *evp_md,
const unsigned char *prk, size_t prk_len,
const unsigned char *info, size_t info_len,
unsigned char *okm, size_t okm_len);
static unsigned char *HKDF_Extract(const EVP_MD *evp_md,
const unsigned char *salt, size_t salt_len,
const unsigned char *key, size_t key_len,
unsigned char *prk, size_t *prk_len);
static unsigned char *HKDF_Expand(const EVP_MD *evp_md,
const unsigned char *prk, size_t prk_len,
const unsigned char *info, size_t info_len,
unsigned char *okm, size_t okm_len);
typedef struct {
struct evp_kdf_impl_st {
int mode;
const EVP_MD *md;
unsigned char *salt;
@@ -42,230 +43,208 @@ typedef struct {
size_t key_len;
unsigned char info[HKDF_MAXBUF];
size_t info_len;
} HKDF_PKEY_CTX;
};
static int pkey_hkdf_init(EVP_PKEY_CTX *ctx)
static EVP_KDF_IMPL *kdf_hkdf_new(void)
{
HKDF_PKEY_CTX *kctx;
EVP_KDF_IMPL *impl;
if ((kctx = OPENSSL_zalloc(sizeof(*kctx))) == NULL) {
KDFerr(KDF_F_PKEY_HKDF_INIT, ERR_R_MALLOC_FAILURE);
return 0;
}
ctx->data = kctx;
return 1;
if ((impl = OPENSSL_zalloc(sizeof(*impl))) == NULL)
KDFerr(KDF_F_KDF_HKDF_NEW, ERR_R_MALLOC_FAILURE);
return impl;
}
static void pkey_hkdf_cleanup(EVP_PKEY_CTX *ctx)
static void kdf_hkdf_free(EVP_KDF_IMPL *impl)
{
HKDF_PKEY_CTX *kctx = ctx->data;
OPENSSL_clear_free(kctx->salt, kctx->salt_len);
OPENSSL_clear_free(kctx->key, kctx->key_len);
OPENSSL_cleanse(kctx->info, kctx->info_len);
OPENSSL_free(kctx);
kdf_hkdf_reset(impl);
OPENSSL_free(impl);
}
static int pkey_hkdf_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
static void kdf_hkdf_reset(EVP_KDF_IMPL *impl)
{
HKDF_PKEY_CTX *kctx = ctx->data;
OPENSSL_free(impl->salt);
OPENSSL_clear_free(impl->key, impl->key_len);
OPENSSL_cleanse(impl->info, impl->info_len);
memset(impl, 0, sizeof(*impl));
}
switch (type) {
case EVP_PKEY_CTRL_HKDF_MD:
if (p2 == NULL)
static int kdf_hkdf_ctrl(EVP_KDF_IMPL *impl, int cmd, va_list args)
{
const unsigned char *p;
size_t len;
const EVP_MD *md;
switch (cmd) {
case EVP_KDF_CTRL_SET_MD:
md = va_arg(args, const EVP_MD *);
if (md == NULL)
return 0;
kctx->md = p2;
impl->md = md;
return 1;
case EVP_PKEY_CTRL_HKDF_MODE:
kctx->mode = p1;
case EVP_KDF_CTRL_SET_HKDF_MODE:
impl->mode = va_arg(args, int);
return 1;
case EVP_PKEY_CTRL_HKDF_SALT:
if (p1 == 0 || p2 == NULL)
case EVP_KDF_CTRL_SET_SALT:
p = va_arg(args, const unsigned char *);
len = va_arg(args, size_t);
if (len == 0 || p == NULL)
return 1;
if (p1 < 0)
OPENSSL_free(impl->salt);
impl->salt = OPENSSL_memdup(p, len);
if (impl->salt == NULL)
return 0;
if (kctx->salt != NULL)
OPENSSL_clear_free(kctx->salt, kctx->salt_len);
kctx->salt = OPENSSL_memdup(p2, p1);
if (kctx->salt == NULL)
return 0;
kctx->salt_len = p1;
impl->salt_len = len;
return 1;
case EVP_PKEY_CTRL_HKDF_KEY:
if (p1 < 0)
case EVP_KDF_CTRL_SET_KEY:
p = va_arg(args, const unsigned char *);
len = va_arg(args, size_t);
OPENSSL_clear_free(impl->key, impl->key_len);
impl->key = OPENSSL_memdup(p, len);
if (impl->key == NULL)
return 0;
if (kctx->key != NULL)
OPENSSL_clear_free(kctx->key, kctx->key_len);
kctx->key = OPENSSL_memdup(p2, p1);
if (kctx->key == NULL)
return 0;
kctx->key_len = p1;
impl->key_len = len;
return 1;
case EVP_PKEY_CTRL_HKDF_INFO:
if (p1 == 0 || p2 == NULL)
case EVP_KDF_CTRL_RESET_HKDF_INFO:
OPENSSL_cleanse(impl->info, impl->info_len);
impl->info_len = 0;
return 1;
case EVP_KDF_CTRL_ADD_HKDF_INFO:
p = va_arg(args, const unsigned char *);
len = va_arg(args, size_t);
if (len == 0 || p == NULL)
return 1;
if (p1 < 0 || p1 > (int)(HKDF_MAXBUF - kctx->info_len))
if (len > (HKDF_MAXBUF - impl->info_len))
return 0;
memcpy(kctx->info + kctx->info_len, p2, p1);
kctx->info_len += p1;
memcpy(impl->info + impl->info_len, p, len);
impl->info_len += len;
return 1;
default:
return -2;
}
}
static int pkey_hkdf_ctrl_str(EVP_PKEY_CTX *ctx, const char *type,
const char *value)
static int kdf_hkdf_ctrl_str(EVP_KDF_IMPL *impl, const char *type,
const char *value)
{
if (strcmp(type, "mode") == 0) {
int mode;
if (strcmp(value, "EXTRACT_AND_EXPAND") == 0)
mode = EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND;
mode = EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND;
else if (strcmp(value, "EXTRACT_ONLY") == 0)
mode = EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY;
mode = EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
else if (strcmp(value, "EXPAND_ONLY") == 0)
mode = EVP_PKEY_HKDEF_MODE_EXPAND_ONLY;
mode = EVP_KDF_HKDF_MODE_EXPAND_ONLY;
else
return 0;
return EVP_PKEY_CTX_hkdf_mode(ctx, mode);
return call_ctrl(kdf_hkdf_ctrl, impl, EVP_KDF_CTRL_SET_HKDF_MODE, mode);
}
if (strcmp(type, "md") == 0)
return EVP_PKEY_CTX_md(ctx, EVP_PKEY_OP_DERIVE,
EVP_PKEY_CTRL_HKDF_MD, value);
if (strcmp(type, "digest") == 0)
return kdf_md2ctrl(impl, kdf_hkdf_ctrl, EVP_KDF_CTRL_SET_MD, value);
if (strcmp(type, "salt") == 0)
return EVP_PKEY_CTX_str2ctrl(ctx, EVP_PKEY_CTRL_HKDF_SALT, value);
return kdf_str2ctrl(impl, kdf_hkdf_ctrl, EVP_KDF_CTRL_SET_SALT, value);
if (strcmp(type, "hexsalt") == 0)
return EVP_PKEY_CTX_hex2ctrl(ctx, EVP_PKEY_CTRL_HKDF_SALT, value);
return kdf_hex2ctrl(impl, kdf_hkdf_ctrl, EVP_KDF_CTRL_SET_SALT, value);
if (strcmp(type, "key") == 0)
return EVP_PKEY_CTX_str2ctrl(ctx, EVP_PKEY_CTRL_HKDF_KEY, value);
return kdf_str2ctrl(impl, kdf_hkdf_ctrl, EVP_KDF_CTRL_SET_KEY, value);
if (strcmp(type, "hexkey") == 0)
return EVP_PKEY_CTX_hex2ctrl(ctx, EVP_PKEY_CTRL_HKDF_KEY, value);
return kdf_hex2ctrl(impl, kdf_hkdf_ctrl, EVP_KDF_CTRL_SET_KEY, value);
if (strcmp(type, "info") == 0)
return EVP_PKEY_CTX_str2ctrl(ctx, EVP_PKEY_CTRL_HKDF_INFO, value);
return kdf_str2ctrl(impl, kdf_hkdf_ctrl, EVP_KDF_CTRL_ADD_HKDF_INFO,
value);
if (strcmp(type, "hexinfo") == 0)
return EVP_PKEY_CTX_hex2ctrl(ctx, EVP_PKEY_CTRL_HKDF_INFO, value);
return kdf_hex2ctrl(impl, kdf_hkdf_ctrl, EVP_KDF_CTRL_ADD_HKDF_INFO,
value);
KDFerr(KDF_F_PKEY_HKDF_CTRL_STR, KDF_R_UNKNOWN_PARAMETER_TYPE);
return -2;
}
static int pkey_hkdf_derive_init(EVP_PKEY_CTX *ctx)
static size_t kdf_hkdf_size(EVP_KDF_IMPL *impl)
{
HKDF_PKEY_CTX *kctx = ctx->data;
if (impl->mode != EVP_KDF_HKDF_MODE_EXTRACT_ONLY)
return SIZE_MAX;
OPENSSL_clear_free(kctx->key, kctx->key_len);
OPENSSL_clear_free(kctx->salt, kctx->salt_len);
OPENSSL_cleanse(kctx->info, kctx->info_len);
memset(kctx, 0, sizeof(*kctx));
return 1;
if (impl->md == NULL) {
KDFerr(KDF_F_KDF_HKDF_SIZE, KDF_R_MISSING_MESSAGE_DIGEST);
return 0;
}
return EVP_MD_size(impl->md);
}
static int pkey_hkdf_derive(EVP_PKEY_CTX *ctx, unsigned char *key,
size_t *keylen)
static int kdf_hkdf_derive(EVP_KDF_IMPL *impl, unsigned char *key,
size_t keylen)
{
HKDF_PKEY_CTX *kctx = ctx->data;
if (kctx->md == NULL) {
KDFerr(KDF_F_PKEY_HKDF_DERIVE, KDF_R_MISSING_MESSAGE_DIGEST);
if (impl->md == NULL) {
KDFerr(KDF_F_KDF_HKDF_DERIVE, KDF_R_MISSING_MESSAGE_DIGEST);
return 0;
}
if (kctx->key == NULL) {
KDFerr(KDF_F_PKEY_HKDF_DERIVE, KDF_R_MISSING_KEY);
if (impl->key == NULL) {
KDFerr(KDF_F_KDF_HKDF_DERIVE, KDF_R_MISSING_KEY);
return 0;
}
switch (kctx->mode) {
case EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND:
return HKDF(kctx->md, kctx->salt, kctx->salt_len, kctx->key,
kctx->key_len, kctx->info, kctx->info_len, key,
*keylen) != NULL;
switch (impl->mode) {
case EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND:
return HKDF(impl->md, impl->salt, impl->salt_len, impl->key,
impl->key_len, impl->info, impl->info_len, key,
keylen);
case EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY:
if (key == NULL) {
*keylen = EVP_MD_size(kctx->md);
return 1;
}
return HKDF_Extract(kctx->md, kctx->salt, kctx->salt_len, kctx->key,
kctx->key_len, key, keylen) != NULL;
case EVP_KDF_HKDF_MODE_EXTRACT_ONLY:
return HKDF_Extract(impl->md, impl->salt, impl->salt_len, impl->key,
impl->key_len, key, keylen);
case EVP_PKEY_HKDEF_MODE_EXPAND_ONLY:
return HKDF_Expand(kctx->md, kctx->key, kctx->key_len, kctx->info,
kctx->info_len, key, *keylen) != NULL;
case EVP_KDF_HKDF_MODE_EXPAND_ONLY:
return HKDF_Expand(impl->md, impl->key, impl->key_len, impl->info,
impl->info_len, key, keylen);
default:
return 0;
}
}
const EVP_PKEY_METHOD hkdf_pkey_meth = {
EVP_PKEY_HKDF,
0,
pkey_hkdf_init,
0,
pkey_hkdf_cleanup,
0, 0,
0, 0,
0,
0,
0,
0,
0, 0,
0, 0, 0, 0,
0, 0,
0, 0,
pkey_hkdf_derive_init,
pkey_hkdf_derive,
pkey_hkdf_ctrl,
pkey_hkdf_ctrl_str
const EVP_KDF_METHOD hkdf_kdf_meth = {
EVP_KDF_HKDF,
kdf_hkdf_new,
kdf_hkdf_free,
kdf_hkdf_reset,
kdf_hkdf_ctrl,
kdf_hkdf_ctrl_str,
kdf_hkdf_size,
kdf_hkdf_derive
};
static unsigned char *HKDF(const EVP_MD *evp_md,
const unsigned char *salt, size_t salt_len,
const unsigned char *key, size_t key_len,
const unsigned char *info, size_t info_len,
unsigned char *okm, size_t okm_len)
static int HKDF(const EVP_MD *evp_md,
const unsigned char *salt, size_t salt_len,
const unsigned char *key, size_t key_len,
const unsigned char *info, size_t info_len,
unsigned char *okm, size_t okm_len)
{
unsigned char prk[EVP_MAX_MD_SIZE];
unsigned char *ret;
size_t prk_len;
int ret;
size_t prk_len = EVP_MD_size(evp_md);
if (!HKDF_Extract(evp_md, salt, salt_len, key, key_len, prk, &prk_len))
return NULL;
if (!HKDF_Extract(evp_md, salt, salt_len, key, key_len, prk, prk_len))
return 0;
ret = HKDF_Expand(evp_md, prk, prk_len, info, info_len, okm, okm_len);
OPENSSL_cleanse(prk, sizeof(prk));
@@ -273,43 +252,38 @@ static unsigned char *HKDF(const EVP_MD *evp_md,
return ret;
}
static unsigned char *HKDF_Extract(const EVP_MD *evp_md,
const unsigned char *salt, size_t salt_len,
const unsigned char *key, size_t key_len,
unsigned char *prk, size_t *prk_len)
static int HKDF_Extract(const EVP_MD *evp_md,
const unsigned char *salt, size_t salt_len,
const unsigned char *key, size_t key_len,
unsigned char *prk, size_t prk_len)
{
unsigned int tmp_len;
if (!HMAC(evp_md, salt, salt_len, key, key_len, prk, &tmp_len))
return NULL;
*prk_len = tmp_len;
return prk;
if (prk_len != (size_t)EVP_MD_size(evp_md)) {
KDFerr(KDF_F_HKDF_EXTRACT, KDF_R_WRONG_OUTPUT_BUFFER_SIZE);
return 0;
}
return HMAC(evp_md, salt, salt_len, key, key_len, prk, NULL) != NULL;
}
static unsigned char *HKDF_Expand(const EVP_MD *evp_md,
const unsigned char *prk, size_t prk_len,
const unsigned char *info, size_t info_len,
unsigned char *okm, size_t okm_len)
static int HKDF_Expand(const EVP_MD *evp_md,
const unsigned char *prk, size_t prk_len,
const unsigned char *info, size_t info_len,
unsigned char *okm, size_t okm_len)
{
HMAC_CTX *hmac;
unsigned char *ret = NULL;
int ret = 0;
unsigned int i;
unsigned char prev[EVP_MAX_MD_SIZE];
size_t done_len = 0, dig_len = EVP_MD_size(evp_md);
size_t n = okm_len / dig_len;
if (okm_len % dig_len)
n++;
if (n > 255 || okm == NULL)
return NULL;
return 0;
if ((hmac = HMAC_CTX_new()) == NULL)
return NULL;
return 0;
if (!HMAC_Init_ex(hmac, prk, prk_len, evp_md, NULL))
goto err;
@@ -343,7 +317,7 @@ static unsigned char *HKDF_Expand(const EVP_MD *evp_md,
done_len += copy_len;
}
ret = okm;
ret = 1;
err:
OPENSSL_cleanse(prev, sizeof(prev));
crypto/kdf/kdf_err.c
+27 -1
View File
@@ -1,6 +1,6 @@
/*
* Generated by util/mkerr.pl DO NOT EDIT
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -14,6 +14,29 @@
#ifndef OPENSSL_NO_ERR
static const ERR_STRING_DATA KDF_str_functs[] = {
{ERR_PACK(ERR_LIB_KDF, KDF_F_HKDF_EXTRACT, 0), "HKDF_Extract"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_HKDF_DERIVE, 0), "kdf_hkdf_derive"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_HKDF_NEW, 0), "kdf_hkdf_new"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_HKDF_SIZE, 0), "kdf_hkdf_size"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_MD2CTRL, 0), "kdf_md2ctrl"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_PBKDF2_CTRL_STR, 0),
"kdf_pbkdf2_ctrl_str"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_PBKDF2_DERIVE, 0), "kdf_pbkdf2_derive"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_PBKDF2_NEW, 0), "kdf_pbkdf2_new"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_SCRYPT_CTRL_STR, 0),
"kdf_scrypt_ctrl_str"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_SCRYPT_CTRL_UINT32, 0),
"kdf_scrypt_ctrl_uint32"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_SCRYPT_CTRL_UINT64, 0),
"kdf_scrypt_ctrl_uint64"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_SCRYPT_DERIVE, 0), "kdf_scrypt_derive"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_SCRYPT_NEW, 0), "kdf_scrypt_new"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_TLS1_PRF_CTRL_STR, 0),
"kdf_tls1_prf_ctrl_str"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_TLS1_PRF_DERIVE, 0),
"kdf_tls1_prf_derive"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_TLS1_PRF_NEW, 0), "kdf_tls1_prf_new"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_PBKDF2_SET_MEMBUF, 0), "pbkdf2_set_membuf"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_PKEY_HKDF_CTRL_STR, 0), "pkey_hkdf_ctrl_str"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_PKEY_HKDF_DERIVE, 0), "pkey_hkdf_derive"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_PKEY_HKDF_INIT, 0), "pkey_hkdf_init"},
@@ -30,6 +53,7 @@ static const ERR_STRING_DATA KDF_str_functs[] = {
{ERR_PACK(ERR_LIB_KDF, KDF_F_PKEY_TLS1_PRF_DERIVE, 0),
"pkey_tls1_prf_derive"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_PKEY_TLS1_PRF_INIT, 0), "pkey_tls1_prf_init"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_SCRYPT_SET_MEMBUF, 0), "scrypt_set_membuf"},
{ERR_PACK(ERR_LIB_KDF, KDF_F_TLS1_PRF_ALG, 0), "tls1_prf_alg"},
{0, NULL}
};
@@ -50,6 +74,8 @@ static const ERR_STRING_DATA KDF_str_reasons[] = {
"unknown parameter type"},
{ERR_PACK(ERR_LIB_KDF, 0, KDF_R_VALUE_ERROR), "value error"},
{ERR_PACK(ERR_LIB_KDF, 0, KDF_R_VALUE_MISSING), "value missing"},
{ERR_PACK(ERR_LIB_KDF, 0, KDF_R_WRONG_OUTPUT_BUFFER_SIZE),
"wrong output buffer size"},
{0, NULL}
};
crypto/kdf/kdf_local.h
+22
View File
@@ -0,0 +1,22 @@
/*
* Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
int call_ctrl(int (*ctrl)(EVP_KDF_IMPL *impl, int cmd, va_list args),
EVP_KDF_IMPL *impl, int cmd, ...);
int kdf_str2ctrl(EVP_KDF_IMPL *impl,
int (*ctrl)(EVP_KDF_IMPL *impl, int cmd, va_list args),
int cmd, const char *str);
int kdf_hex2ctrl(EVP_KDF_IMPL *impl,
int (*ctrl)(EVP_KDF_IMPL *impl, int cmd, va_list args),
int cmd, const char *hex);
int kdf_md2ctrl(EVP_KDF_IMPL *impl,
int (*ctrl)(EVP_KDF_IMPL *impl, int cmd, va_list args),
int cmd, const char *md_name);
crypto/kdf/kdf_util.c
+73
View File
@@ -0,0 +1,73 @@
/*
* Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <string.h>
#include <stdarg.h>
#include <openssl/kdf.h>
#include <openssl/evp.h>
#include "internal/cryptlib.h"
#include "internal/evp_int.h"
#include "internal/numbers.h"
#include "kdf_local.h"
int call_ctrl(int (*ctrl)(EVP_KDF_IMPL *impl, int cmd, va_list args),
EVP_KDF_IMPL *impl, int cmd, ...)
{
int ret;
va_list args;
va_start(args, cmd);
ret = ctrl(impl, cmd, args);
va_end(args);
return ret;
}
/* Utility functions to send a string or hex string to a ctrl */
int kdf_str2ctrl(EVP_KDF_IMPL *impl,
int (*ctrl)(EVP_KDF_IMPL *impl, int cmd, va_list args),
int cmd, const char *str)
{
return call_ctrl(ctrl, impl, cmd, (const unsigned char *)str, strlen(str));
}
int kdf_hex2ctrl(EVP_KDF_IMPL *impl,
int (*ctrl)(EVP_KDF_IMPL *impl, int cmd, va_list args),
int cmd, const char *hex)
{
unsigned char *bin;
long binlen;
int ret = -1;
bin = OPENSSL_hexstr2buf(hex, &binlen);
if (bin == NULL)
return 0;
if (binlen <= INT_MAX)
ret = call_ctrl(ctrl, impl, cmd, bin, (size_t)binlen);
OPENSSL_free(bin);
return ret;
}
/* Pass a message digest to a ctrl */
int kdf_md2ctrl(EVP_KDF_IMPL *impl,
int (*ctrl)(EVP_KDF_IMPL *impl, int cmd, va_list args),
int cmd, const char *md_name)
{
const EVP_MD *md;
if (md_name == NULL || (md = EVP_get_digestbyname(md_name)) == NULL) {
KDFerr(KDF_F_KDF_MD2CTRL, KDF_R_INVALID_DIGEST);
return 0;
}
return call_ctrl(ctrl, impl, cmd, md);
}
crypto/kdf/pbkdf2.c
+264
View File
@@ -0,0 +1,264 @@
/*
* Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <stdlib.h>
#include <stdarg.h>
#include <string.h>
#include <openssl/hmac.h>
#include <openssl/evp.h>
#include <openssl/kdf.h>
#include "internal/cryptlib.h"
#include "internal/evp_int.h"
#include "kdf_local.h"
static void kdf_pbkdf2_reset(EVP_KDF_IMPL *impl);
static void kdf_pbkdf2_init(EVP_KDF_IMPL *impl);
static int pkcs5_pbkdf2_alg(const char *pass, size_t passlen,
const unsigned char *salt, int saltlen, int iter,
const EVP_MD *digest, unsigned char *key,
size_t keylen);
struct evp_kdf_impl_st {
unsigned char *pass;
size_t pass_len;
unsigned char *salt;
size_t salt_len;
int iter;
const EVP_MD *md;
};
static EVP_KDF_IMPL *kdf_pbkdf2_new(void)
{
EVP_KDF_IMPL *impl;
impl = OPENSSL_zalloc(sizeof(*impl));
if (impl == NULL) {
KDFerr(KDF_F_KDF_PBKDF2_NEW, ERR_R_MALLOC_FAILURE);
return NULL;
}
kdf_pbkdf2_init(impl);
return impl;
}
static void kdf_pbkdf2_free(EVP_KDF_IMPL *impl)
{
kdf_pbkdf2_reset(impl);
OPENSSL_free(impl);
}
static void kdf_pbkdf2_reset(EVP_KDF_IMPL *impl)
{
OPENSSL_free(impl->salt);
OPENSSL_clear_free(impl->pass, impl->pass_len);
memset(impl, 0, sizeof(*impl));
kdf_pbkdf2_init(impl);
}
static void kdf_pbkdf2_init(EVP_KDF_IMPL *impl)
{
impl->iter = PKCS5_DEFAULT_ITER;
impl->md = EVP_sha1();
}
static int pbkdf2_set_membuf(unsigned char **buffer, size_t *buflen,
const unsigned char *new_buffer,
size_t new_buflen)
{
if (new_buffer == NULL)
return 1;
OPENSSL_clear_free(*buffer, *buflen);
if (new_buflen > 0) {
*buffer = OPENSSL_memdup(new_buffer, new_buflen);
} else {
*buffer = OPENSSL_malloc(1);
}
if (*buffer == NULL) {
KDFerr(KDF_F_PBKDF2_SET_MEMBUF, ERR_R_MALLOC_FAILURE);
return 0;
}
*buflen = new_buflen;
return 1;
}
static int kdf_pbkdf2_ctrl(EVP_KDF_IMPL *impl, int cmd, va_list args)
{
int iter;
const unsigned char *p;
size_t len;
const EVP_MD *md;
switch (cmd) {
case EVP_KDF_CTRL_SET_PASS:
p = va_arg(args, const unsigned char *);
len = va_arg(args, size_t);
return pbkdf2_set_membuf(&impl->pass, &impl->pass_len, p, len);
case EVP_KDF_CTRL_SET_SALT:
p = va_arg(args, const unsigned char *);
len = va_arg(args, size_t);
return pbkdf2_set_membuf(&impl->salt, &impl->salt_len, p, len);
case EVP_KDF_CTRL_SET_ITER:
iter = va_arg(args, int);
if (iter < 1)
return 0;
impl->iter = iter;
return 1;
case EVP_KDF_CTRL_SET_MD:
md = va_arg(args, const EVP_MD *);
if (md == NULL)
return 0;
impl->md = md;
return 1;
default:
return -2;
}
}
static int kdf_pbkdf2_ctrl_str(EVP_KDF_IMPL *impl, const char *type,
const char *value)
{
if (value == NULL) {
KDFerr(KDF_F_KDF_PBKDF2_CTRL_STR, KDF_R_VALUE_MISSING);
return 0;
}
if (strcmp(type, "pass") == 0)
return kdf_str2ctrl(impl, kdf_pbkdf2_ctrl, EVP_KDF_CTRL_SET_PASS,
value);
if (strcmp(type, "hexpass") == 0)
return kdf_hex2ctrl(impl, kdf_pbkdf2_ctrl, EVP_KDF_CTRL_SET_PASS,
value);
if (strcmp(type, "salt") == 0)
return kdf_str2ctrl(impl, kdf_pbkdf2_ctrl, EVP_KDF_CTRL_SET_SALT,
value);
if (strcmp(type, "hexsalt") == 0)
return kdf_hex2ctrl(impl, kdf_pbkdf2_ctrl, EVP_KDF_CTRL_SET_SALT,
value);
if (strcmp(type, "iter") == 0)
return call_ctrl(kdf_pbkdf2_ctrl, impl, EVP_KDF_CTRL_SET_ITER,
atoi(value));
if (strcmp(type, "digest") == 0)
return kdf_md2ctrl(impl, kdf_pbkdf2_ctrl, EVP_KDF_CTRL_SET_MD, value);
return -2;
}
static int kdf_pbkdf2_derive(EVP_KDF_IMPL *impl, unsigned char *key,
size_t keylen)
{
if (impl->pass == NULL) {
KDFerr(KDF_F_KDF_PBKDF2_DERIVE, KDF_R_MISSING_PASS);
return 0;
}
if (impl->salt == NULL) {
KDFerr(KDF_F_KDF_PBKDF2_DERIVE, KDF_R_MISSING_SALT);
return 0;
}
return pkcs5_pbkdf2_alg((char *)impl->pass, impl->pass_len,
impl->salt, impl->salt_len, impl->iter,
impl->md, key, keylen);
}
const EVP_KDF_METHOD pbkdf2_kdf_meth = {
EVP_KDF_PBKDF2,
kdf_pbkdf2_new,
kdf_pbkdf2_free,
kdf_pbkdf2_reset,
kdf_pbkdf2_ctrl,
kdf_pbkdf2_ctrl_str,
NULL,
kdf_pbkdf2_derive
};
/*
* This is an implementation of PKCS#5 v2.0 password based encryption key
* derivation function PBKDF2. SHA1 version verified against test vectors
* posted by Peter Gutmann to the PKCS-TNG mailing list.
*/
static int pkcs5_pbkdf2_alg(const char *pass, size_t passlen,
const unsigned char *salt, int saltlen, int iter,
const EVP_MD *digest, unsigned char *key,
size_t keylen)
{
int ret = 0;
unsigned char digtmp[EVP_MAX_MD_SIZE], *p, itmp[4];
int cplen, j, k, tkeylen, mdlen;
unsigned long i = 1;
HMAC_CTX *hctx_tpl = NULL, *hctx = NULL;
mdlen = EVP_MD_size(digest);
if (mdlen < 0)
return 0;
hctx_tpl = HMAC_CTX_new();
if (hctx_tpl == NULL)
return 0;
p = key;
tkeylen = keylen;
if (!HMAC_Init_ex(hctx_tpl, pass, passlen, digest, NULL))
goto err;
hctx = HMAC_CTX_new();
if (hctx == NULL)
goto err;
while (tkeylen) {
if (tkeylen > mdlen)
cplen = mdlen;
else
cplen = tkeylen;
/*
* We are unlikely to ever use more than 256 blocks (5120 bits!) but
* just in case...
*/
itmp[0] = (unsigned char)((i >> 24) & 0xff);
itmp[1] = (unsigned char)((i >> 16) & 0xff);
itmp[2] = (unsigned char)((i >> 8) & 0xff);
itmp[3] = (unsigned char)(i & 0xff);
if (!HMAC_CTX_copy(hctx, hctx_tpl))
goto err;
if (!HMAC_Update(hctx, salt, saltlen)
|| !HMAC_Update(hctx, itmp, 4)
|| !HMAC_Final(hctx, digtmp, NULL))
goto err;
memcpy(p, digtmp, cplen);
for (j = 1; j < iter; j++) {
if (!HMAC_CTX_copy(hctx, hctx_tpl))
goto err;
if (!HMAC_Update(hctx, digtmp, mdlen)
|| !HMAC_Final(hctx, digtmp, NULL))
goto err;
for (k = 0; k < cplen; k++)
p[k] ^= digtmp[k];
}
tkeylen -= cplen;
i++;
p += cplen;
}
ret = 1;
err:
HMAC_CTX_free(hctx);
HMAC_CTX_free(hctx_tpl);
return ret;
}
crypto/kdf/scrypt.c
+359 -119
View File
@@ -8,25 +8,34 @@
*/
#include <stdlib.h>
#include <stdarg.h>
#include <string.h>
#include <openssl/hmac.h>
#include <openssl/kdf.h>
#include <openssl/evp.h>
#include "internal/cryptlib.h"
#include <openssl/kdf.h>
#include <openssl/err.h>
#include "internal/evp_int.h"
#include "internal/numbers.h"
#include "kdf_local.h"
#ifndef OPENSSL_NO_SCRYPT
static void kdf_scrypt_reset(EVP_KDF_IMPL *impl);
static void kdf_scrypt_init(EVP_KDF_IMPL *impl);
static int atou64(const char *nptr, uint64_t *result);
static int scrypt_alg(const char *pass, size_t passlen,
const unsigned char *salt, size_t saltlen,
uint64_t N, uint64_t r, uint64_t p, uint64_t maxmem,
unsigned char *key, size_t keylen);
typedef struct {
struct evp_kdf_impl_st {
unsigned char *pass;
size_t pass_len;
unsigned char *salt;
size_t salt_len;
uint64_t N, r, p;
uint64_t N;
uint32_t r, p;
uint64_t maxmem_bytes;
} SCRYPT_PKEY_CTX;
};
/* Custom uint64_t parser since we do not have strtoull */
static int atou64(const char *nptr, uint64_t *result)
@@ -53,51 +62,53 @@ static int atou64(const char *nptr, uint64_t *result)
return 1;
}
static int pkey_scrypt_init(EVP_PKEY_CTX *ctx)
static EVP_KDF_IMPL *kdf_scrypt_new(void)
{
SCRYPT_PKEY_CTX *kctx;
EVP_KDF_IMPL *impl;
kctx = OPENSSL_zalloc(sizeof(*kctx));
if (kctx == NULL) {
KDFerr(KDF_F_PKEY_SCRYPT_INIT, ERR_R_MALLOC_FAILURE);
return 0;
impl = OPENSSL_zalloc(sizeof(*impl));
if (impl == NULL) {
KDFerr(KDF_F_KDF_SCRYPT_NEW, ERR_R_MALLOC_FAILURE);
return NULL;
}
kdf_scrypt_init(impl);
return impl;
}
static void kdf_scrypt_free(EVP_KDF_IMPL *impl)
{
kdf_scrypt_reset(impl);
OPENSSL_free(impl);
}
static void kdf_scrypt_reset(EVP_KDF_IMPL *impl)
{
OPENSSL_free(impl->salt);
OPENSSL_clear_free(impl->pass, impl->pass_len);
memset(impl, 0, sizeof(*impl));
kdf_scrypt_init(impl);
}
static void kdf_scrypt_init(EVP_KDF_IMPL *impl)
{
/* Default values are the most conservative recommendation given in the
* original paper of C. Percival. Derivation uses roughly 1 GiB of memory
* for this parameter choice (approx. 128 * r * (N + p) bytes).
* for this parameter choice (approx. 128 * r * N * p bytes).
*/
kctx->N = 1 << 20;
kctx->r = 8;
kctx->p = 1;
kctx->maxmem_bytes = 1025 * 1024 * 1024;
ctx->data = kctx;
return 1;
impl->N = 1 << 20;
impl->r = 8;
impl->p = 1;
impl->maxmem_bytes = 1025 * 1024 * 1024;
}
static void pkey_scrypt_cleanup(EVP_PKEY_CTX *ctx)
{
SCRYPT_PKEY_CTX *kctx = ctx->data;
OPENSSL_clear_free(kctx->salt, kctx->salt_len);
OPENSSL_clear_free(kctx->pass, kctx->pass_len);
OPENSSL_free(kctx);
}
static int pkey_scrypt_set_membuf(unsigned char **buffer, size_t *buflen,
const unsigned char *new_buffer,
const int new_buflen)
static int scrypt_set_membuf(unsigned char **buffer, size_t *buflen,
const unsigned char *new_buffer,
size_t new_buflen)
{
if (new_buffer == NULL)
return 1;
if (new_buflen < 0)
return 0;
if (*buffer != NULL)
OPENSSL_clear_free(*buffer, *buflen);
OPENSSL_clear_free(*buffer, *buflen);
if (new_buflen > 0) {
*buffer = OPENSSL_memdup(new_buffer, new_buflen);
@@ -105,7 +116,7 @@ static int pkey_scrypt_set_membuf(unsigned char **buffer, size_t *buflen,
*buffer = OPENSSL_malloc(1);
}
if (*buffer == NULL) {
KDFerr(KDF_F_PKEY_SCRYPT_SET_MEMBUF, ERR_R_MALLOC_FAILURE);
KDFerr(KDF_F_SCRYPT_SET_MEMBUF, ERR_R_MALLOC_FAILURE);
return 0;
}
@@ -118,149 +129,378 @@ static int is_power_of_two(uint64_t value)
return (value != 0) && ((value & (value - 1)) == 0);
}
static int pkey_scrypt_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
static int kdf_scrypt_ctrl(EVP_KDF_IMPL *impl, int cmd, va_list args)
{
SCRYPT_PKEY_CTX *kctx = ctx->data;
uint64_t u64_value;
uint32_t value;
const unsigned char *p;
size_t len;
switch (type) {
case EVP_PKEY_CTRL_PASS:
return pkey_scrypt_set_membuf(&kctx->pass, &kctx->pass_len, p2, p1);
switch (cmd) {
case EVP_KDF_CTRL_SET_PASS:
p = va_arg(args, const unsigned char *);
len = va_arg(args, size_t);
return scrypt_set_membuf(&impl->pass, &impl->pass_len, p, len);
case EVP_PKEY_CTRL_SCRYPT_SALT:
return pkey_scrypt_set_membuf(&kctx->salt, &kctx->salt_len, p2, p1);
case EVP_KDF_CTRL_SET_SALT:
p = va_arg(args, const unsigned char *);
len = va_arg(args, size_t);
return scrypt_set_membuf(&impl->salt, &impl->salt_len, p, len);
case EVP_PKEY_CTRL_SCRYPT_N:
u64_value = *((uint64_t *)p2);
case EVP_KDF_CTRL_SET_SCRYPT_N:
u64_value = va_arg(args, uint64_t);
if ((u64_value <= 1) || !is_power_of_two(u64_value))
return 0;
kctx->N = u64_value;
impl->N = u64_value;
return 1;
case EVP_PKEY_CTRL_SCRYPT_R:
u64_value = *((uint64_t *)p2);
if (u64_value < 1)
case EVP_KDF_CTRL_SET_SCRYPT_R:
value = va_arg(args, uint32_t);
if (value < 1)
return 0;
kctx->r = u64_value;
impl->r = value;
return 1;
case EVP_PKEY_CTRL_SCRYPT_P:
u64_value = *((uint64_t *)p2);
if (u64_value < 1)
case EVP_KDF_CTRL_SET_SCRYPT_P:
value = va_arg(args, uint32_t);
if (value < 1)
return 0;
kctx->p = u64_value;
impl->p = value;
return 1;
case EVP_PKEY_CTRL_SCRYPT_MAXMEM_BYTES:
u64_value = *((uint64_t *)p2);
case EVP_KDF_CTRL_SET_MAXMEM_BYTES:
u64_value = va_arg(args, uint64_t);
if (u64_value < 1)
return 0;
kctx->maxmem_bytes = u64_value;
impl->maxmem_bytes = u64_value;
return 1;
default:
return -2;
}
}
static int pkey_scrypt_ctrl_uint64(EVP_PKEY_CTX *ctx, int type,
const char *value)
static int kdf_scrypt_ctrl_uint32(EVP_KDF_IMPL *impl, int cmd,
const char *value)
{
uint64_t int_value;
int int_value = atoi(value);
if (!atou64(value, &int_value)) {
KDFerr(KDF_F_PKEY_SCRYPT_CTRL_UINT64, KDF_R_VALUE_ERROR);
if (int_value < 0 || (uint64_t)int_value > UINT32_MAX) {
KDFerr(KDF_F_KDF_SCRYPT_CTRL_UINT32, KDF_R_VALUE_ERROR);
return 0;
}
return pkey_scrypt_ctrl(ctx, type, 0, &int_value);
return call_ctrl(kdf_scrypt_ctrl, impl, cmd, (uint32_t)int_value);
}
static int pkey_scrypt_ctrl_str(EVP_PKEY_CTX *ctx, const char *type,
const char *value)
static int kdf_scrypt_ctrl_uint64(EVP_KDF_IMPL *impl, int cmd,
const char *value)
{
uint64_t u64_value;
if (!atou64(value, &u64_value)) {
KDFerr(KDF_F_KDF_SCRYPT_CTRL_UINT64, KDF_R_VALUE_ERROR);
return 0;
}
return call_ctrl(kdf_scrypt_ctrl, impl, cmd, u64_value);
}
static int kdf_scrypt_ctrl_str(EVP_KDF_IMPL *impl, const char *type,
const char *value)
{
if (value == NULL) {
KDFerr(KDF_F_PKEY_SCRYPT_CTRL_STR, KDF_R_VALUE_MISSING);
KDFerr(KDF_F_KDF_SCRYPT_CTRL_STR, KDF_R_VALUE_MISSING);
return 0;
}
if (strcmp(type, "pass") == 0)
return EVP_PKEY_CTX_str2ctrl(ctx, EVP_PKEY_CTRL_PASS, value);
return kdf_str2ctrl(impl, kdf_scrypt_ctrl, EVP_KDF_CTRL_SET_PASS,
value);
if (strcmp(type, "hexpass") == 0)
return EVP_PKEY_CTX_hex2ctrl(ctx, EVP_PKEY_CTRL_PASS, value);
return kdf_hex2ctrl(impl, kdf_scrypt_ctrl, EVP_KDF_CTRL_SET_PASS,
value);
if (strcmp(type, "salt") == 0)
return EVP_PKEY_CTX_str2ctrl(ctx, EVP_PKEY_CTRL_SCRYPT_SALT, value);
return kdf_str2ctrl(impl, kdf_scrypt_ctrl, EVP_KDF_CTRL_SET_SALT,
value);
if (strcmp(type, "hexsalt") == 0)
return EVP_PKEY_CTX_hex2ctrl(ctx, EVP_PKEY_CTRL_SCRYPT_SALT, value);
return kdf_hex2ctrl(impl, kdf_scrypt_ctrl, EVP_KDF_CTRL_SET_SALT,
value);
if (strcmp(type, "N") == 0)
return pkey_scrypt_ctrl_uint64(ctx, EVP_PKEY_CTRL_SCRYPT_N, value);
return kdf_scrypt_ctrl_uint64(impl, EVP_KDF_CTRL_SET_SCRYPT_N, value);
if (strcmp(type, "r") == 0)
return pkey_scrypt_ctrl_uint64(ctx, EVP_PKEY_CTRL_SCRYPT_R, value);
return kdf_scrypt_ctrl_uint32(impl, EVP_KDF_CTRL_SET_SCRYPT_R, value);
if (strcmp(type, "p") == 0)
return pkey_scrypt_ctrl_uint64(ctx, EVP_PKEY_CTRL_SCRYPT_P, value);
return kdf_scrypt_ctrl_uint32(impl, EVP_KDF_CTRL_SET_SCRYPT_P, value);
if (strcmp(type, "maxmem_bytes") == 0)
return pkey_scrypt_ctrl_uint64(ctx, EVP_PKEY_CTRL_SCRYPT_MAXMEM_BYTES,
value);
return kdf_scrypt_ctrl_uint64(impl, EVP_KDF_CTRL_SET_MAXMEM_BYTES,
value);
KDFerr(KDF_F_PKEY_SCRYPT_CTRL_STR, KDF_R_UNKNOWN_PARAMETER_TYPE);
return -2;
}
static int pkey_scrypt_derive(EVP_PKEY_CTX *ctx, unsigned char *key,
size_t *keylen)
static int kdf_scrypt_derive(EVP_KDF_IMPL *impl, unsigned char *key,
size_t keylen)
{
SCRYPT_PKEY_CTX *kctx = ctx->data;
if (kctx->pass == NULL) {
KDFerr(KDF_F_PKEY_SCRYPT_DERIVE, KDF_R_MISSING_PASS);
if (impl->pass == NULL) {
KDFerr(KDF_F_KDF_SCRYPT_DERIVE, KDF_R_MISSING_PASS);
return 0;
}
if (kctx->salt == NULL) {
KDFerr(KDF_F_PKEY_SCRYPT_DERIVE, KDF_R_MISSING_SALT);
if (impl->salt == NULL) {
KDFerr(KDF_F_KDF_SCRYPT_DERIVE, KDF_R_MISSING_SALT);
return 0;
}
return EVP_PBE_scrypt((char *)kctx->pass, kctx->pass_len, kctx->salt,
kctx->salt_len, kctx->N, kctx->r, kctx->p,
kctx->maxmem_bytes, key, *keylen);
return scrypt_alg((char *)impl->pass, impl->pass_len, impl->salt,
impl->salt_len, impl->N, impl->r, impl->p,
impl->maxmem_bytes, key, keylen);
}
const EVP_PKEY_METHOD scrypt_pkey_meth = {
EVP_PKEY_SCRYPT,
0,
pkey_scrypt_init,
0,
pkey_scrypt_cleanup,
0, 0,
0, 0,
0,
0,
0,
0,
0, 0,
0, 0, 0, 0,
0, 0,
0, 0,
0,
pkey_scrypt_derive,
pkey_scrypt_ctrl,
pkey_scrypt_ctrl_str
const EVP_KDF_METHOD scrypt_kdf_meth = {
EVP_KDF_SCRYPT,
kdf_scrypt_new,
kdf_scrypt_free,
kdf_scrypt_reset,
kdf_scrypt_ctrl,
kdf_scrypt_ctrl_str,
NULL,
kdf_scrypt_derive
};
#define R(a,b) (((a) << (b)) | ((a) >> (32 - (b))))
static void salsa208_word_specification(uint32_t inout[16])
{
int i;
uint32_t x[16];
memcpy(x, inout, sizeof(x));
for (i = 8; i > 0; i -= 2) {
x[4] ^= R(x[0] + x[12], 7);
x[8] ^= R(x[4] + x[0], 9);
x[12] ^= R(x[8] + x[4], 13);
x[0] ^= R(x[12] + x[8], 18);
x[9] ^= R(x[5] + x[1], 7);
x[13] ^= R(x[9] + x[5], 9);
x[1] ^= R(x[13] + x[9], 13);
x[5] ^= R(x[1] + x[13], 18);
x[14] ^= R(x[10] + x[6], 7);
x[2] ^= R(x[14] + x[10], 9);
x[6] ^= R(x[2] + x[14], 13);
x[10] ^= R(x[6] + x[2], 18);
x[3] ^= R(x[15] + x[11], 7);
x[7] ^= R(x[3] + x[15], 9);
x[11] ^= R(x[7] + x[3], 13);
x[15] ^= R(x[11] + x[7], 18);
x[1] ^= R(x[0] + x[3], 7);
x[2] ^= R(x[1] + x[0], 9);
x[3] ^= R(x[2] + x[1], 13);
x[0] ^= R(x[3] + x[2], 18);
x[6] ^= R(x[5] + x[4], 7);
x[7] ^= R(x[6] + x[5], 9);
x[4] ^= R(x[7] + x[6], 13);
x[5] ^= R(x[4] + x[7], 18);
x[11] ^= R(x[10] + x[9], 7);
x[8] ^= R(x[11] + x[10], 9);
x[9] ^= R(x[8] + x[11], 13);
x[10] ^= R(x[9] + x[8], 18);
x[12] ^= R(x[15] + x[14], 7);
x[13] ^= R(x[12] + x[15], 9);
x[14] ^= R(x[13] + x[12], 13);
x[15] ^= R(x[14] + x[13], 18);
}
for (i = 0; i < 16; ++i)
inout[i] += x[i];
OPENSSL_cleanse(x, sizeof(x));
}
static void scryptBlockMix(uint32_t *B_, uint32_t *B, uint64_t r)
{
uint64_t i, j;
uint32_t X[16], *pB;
memcpy(X, B + (r * 2 - 1) * 16, sizeof(X));
pB = B;
for (i = 0; i < r * 2; i++) {
for (j = 0; j < 16; j++)
X[j] ^= *pB++;
salsa208_word_specification(X);
memcpy(B_ + (i / 2 + (i & 1) * r) * 16, X, sizeof(X));
}
OPENSSL_cleanse(X, sizeof(X));
}
static void scryptROMix(unsigned char *B, uint64_t r, uint64_t N,
uint32_t *X, uint32_t *T, uint32_t *V)
{
unsigned char *pB;
uint32_t *pV;
uint64_t i, k;
/* Convert from little endian input */
for (pV = V, i = 0, pB = B; i < 32 * r; i++, pV++) {
*pV = *pB++;
*pV |= *pB++ << 8;
*pV |= *pB++ << 16;
*pV |= (uint32_t)*pB++ << 24;
}
for (i = 1; i < N; i++, pV += 32 * r)
scryptBlockMix(pV, pV - 32 * r, r);
scryptBlockMix(X, V + (N - 1) * 32 * r, r);
for (i = 0; i < N; i++) {
uint32_t j;
j = X[16 * (2 * r - 1)] % N;
pV = V + 32 * r * j;
for (k = 0; k < 32 * r; k++)
T[k] = X[k] ^ *pV++;
scryptBlockMix(X, T, r);
}
/* Convert output to little endian */
for (i = 0, pB = B; i < 32 * r; i++) {
uint32_t xtmp = X[i];
*pB++ = xtmp & 0xff;
*pB++ = (xtmp >> 8) & 0xff;
*pB++ = (xtmp >> 16) & 0xff;
*pB++ = (xtmp >> 24) & 0xff;
}
}
#ifndef SIZE_MAX
# define SIZE_MAX ((size_t)-1)
#endif
/*
* Maximum power of two that will fit in uint64_t: this should work on
* most (all?) platforms.
*/
#define LOG2_UINT64_MAX (sizeof(uint64_t) * 8 - 1)
/*
* Maximum value of p * r:
* p <= ((2^32-1) * hLen) / MFLen =>
* p <= ((2^32-1) * 32) / (128 * r) =>
* p * r <= (2^30-1)
*/
#define SCRYPT_PR_MAX ((1 << 30) - 1)
static int scrypt_alg(const char *pass, size_t passlen,
const unsigned char *salt, size_t saltlen,
uint64_t N, uint64_t r, uint64_t p, uint64_t maxmem,
unsigned char *key, size_t keylen)
{
int rv = 0;
unsigned char *B;
uint32_t *X, *V, *T;
uint64_t i, Blen, Vlen;
/* Sanity check parameters */
/* initial check, r,p must be non zero, N >= 2 and a power of 2 */
if (r == 0 || p == 0 || N < 2 || (N & (N - 1)))
return 0;
/* Check p * r < SCRYPT_PR_MAX avoiding overflow */
if (p > SCRYPT_PR_MAX / r) {
EVPerr(EVP_F_SCRYPT_ALG, EVP_R_MEMORY_LIMIT_EXCEEDED);
return 0;
}
/*
* Need to check N: if 2^(128 * r / 8) overflows limit this is
* automatically satisfied since N <= UINT64_MAX.
*/
if (16 * r <= LOG2_UINT64_MAX) {
if (N >= (((uint64_t)1) << (16 * r))) {
EVPerr(EVP_F_SCRYPT_ALG, EVP_R_MEMORY_LIMIT_EXCEEDED);
return 0;
}
}
/* Memory checks: check total allocated buffer size fits in uint64_t */
/*
* B size in section 5 step 1.S
* Note: we know p * 128 * r < UINT64_MAX because we already checked
* p * r < SCRYPT_PR_MAX
*/
Blen = p * 128 * r;
/*
* Yet we pass it as integer to PKCS5_PBKDF2_HMAC... [This would
* have to be revised when/if PKCS5_PBKDF2_HMAC accepts size_t.]
*/
if (Blen > INT_MAX) {
EVPerr(EVP_F_SCRYPT_ALG, EVP_R_MEMORY_LIMIT_EXCEEDED);
return 0;
}
/*
* Check 32 * r * (N + 2) * sizeof(uint32_t) fits in uint64_t
* This is combined size V, X and T (section 4)
*/
i = UINT64_MAX / (32 * sizeof(uint32_t));
if (N + 2 > i / r) {
EVPerr(EVP_F_SCRYPT_ALG, EVP_R_MEMORY_LIMIT_EXCEEDED);
return 0;
}
Vlen = 32 * r * (N + 2) * sizeof(uint32_t);
/* check total allocated size fits in uint64_t */
if (Blen > UINT64_MAX - Vlen) {
EVPerr(EVP_F_SCRYPT_ALG, EVP_R_MEMORY_LIMIT_EXCEEDED);
return 0;
}
/* Check that the maximum memory doesn't exceed a size_t limits */
if (maxmem > SIZE_MAX)
maxmem = SIZE_MAX;
if (Blen + Vlen > maxmem) {
EVPerr(EVP_F_SCRYPT_ALG, EVP_R_MEMORY_LIMIT_EXCEEDED);
return 0;
}
/* If no key return to indicate parameters are OK */
if (key == NULL)
return 1;
B = OPENSSL_malloc((size_t)(Blen + Vlen));
if (B == NULL) {
EVPerr(EVP_F_SCRYPT_ALG, ERR_R_MALLOC_FAILURE);
return 0;
}
X = (uint32_t *)(B + Blen);
T = X + 32 * r;
V = T + 32 * r;
if (PKCS5_PBKDF2_HMAC(pass, passlen, salt, saltlen, 1, EVP_sha256(),
(int)Blen, B) == 0)
goto err;
for (i = 0; i < p; i++)
scryptROMix(B + 128 * r * i, r, N, X, T, V);
if (PKCS5_PBKDF2_HMAC(pass, passlen, B, (int)Blen, 1, EVP_sha256(),
keylen, key) == 0)
goto err;
rv = 1;
err:
if (rv == 0)
EVPerr(EVP_F_SCRYPT_ALG, EVP_R_PBKDF2_ERROR);
OPENSSL_clear_free(B, (size_t)(Blen + Vlen));
return rv;
}
#endif
crypto/kdf/tls1_prf.c
+98 -103
View File
@@ -8,11 +8,15 @@
*/
#include <stdio.h>
#include <stdarg.h>
#include <string.h>
#include "internal/cryptlib.h"
#include <openssl/kdf.h>
#include <openssl/evp.h>
#include <openssl/kdf.h>
#include "internal/evp_int.h"
#include "kdf_local.h"
static void kdf_tls1_prf_reset(EVP_KDF_IMPL *impl);
static int tls1_prf_alg(const EVP_MD *md,
const unsigned char *sec, size_t slen,
const unsigned char *seed, size_t seed_len,
@@ -20,9 +24,9 @@ static int tls1_prf_alg(const EVP_MD *md,
#define TLS1_PRF_MAXBUF 1024
/* TLS KDF pkey context structure */
/* TLS KDF kdf context structure */
typedef struct {
struct evp_kdf_impl_st {
/* Digest to use for PRF */
const EVP_MD *md;
/* Secret value to use for PRF */
@@ -31,145 +35,137 @@ typedef struct {
/* Buffer of concatenated seed data */
unsigned char seed[TLS1_PRF_MAXBUF];
size_t seedlen;
} TLS1_PRF_PKEY_CTX;
};
static int pkey_tls1_prf_init(EVP_PKEY_CTX *ctx)
static EVP_KDF_IMPL *kdf_tls1_prf_new(void)
{
TLS1_PRF_PKEY_CTX *kctx;
EVP_KDF_IMPL *impl;
if ((kctx = OPENSSL_zalloc(sizeof(*kctx))) == NULL) {
KDFerr(KDF_F_PKEY_TLS1_PRF_INIT, ERR_R_MALLOC_FAILURE);
return 0;
}
ctx->data = kctx;
return 1;
if ((impl = OPENSSL_zalloc(sizeof(*impl))) == NULL)
KDFerr(KDF_F_KDF_TLS1_PRF_NEW, ERR_R_MALLOC_FAILURE);
return impl;
}
static void pkey_tls1_prf_cleanup(EVP_PKEY_CTX *ctx)
static void kdf_tls1_prf_free(EVP_KDF_IMPL *impl)
{
TLS1_PRF_PKEY_CTX *kctx = ctx->data;
OPENSSL_clear_free(kctx->sec, kctx->seclen);
OPENSSL_cleanse(kctx->seed, kctx->seedlen);
OPENSSL_free(kctx);
kdf_tls1_prf_reset(impl);
OPENSSL_free(impl);
}
static int pkey_tls1_prf_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
static void kdf_tls1_prf_reset(EVP_KDF_IMPL *impl)
{
TLS1_PRF_PKEY_CTX *kctx = ctx->data;
switch (type) {
case EVP_PKEY_CTRL_TLS_MD:
kctx->md = p2;
OPENSSL_clear_free(impl->sec, impl->seclen);
OPENSSL_cleanse(impl->seed, impl->seedlen);
memset(impl, 0, sizeof(*impl));
}
static int kdf_tls1_prf_ctrl(EVP_KDF_IMPL *impl, int cmd, va_list args)
{
const unsigned char *p;
size_t len;
const EVP_MD *md;
switch (cmd) {
case EVP_KDF_CTRL_SET_MD:
md = va_arg(args, const EVP_MD *);
if (md == NULL)
return 0;
impl->md = md;
return 1;
case EVP_PKEY_CTRL_TLS_SECRET:
if (p1 < 0)
case EVP_KDF_CTRL_SET_TLS_SECRET:
p = va_arg(args, const unsigned char *);
len = va_arg(args, size_t);
OPENSSL_clear_free(impl->sec, impl->seclen);
impl->sec = OPENSSL_memdup(p, len);
if (impl->sec == NULL)
return 0;
if (kctx->sec != NULL)
OPENSSL_clear_free(kctx->sec, kctx->seclen);
OPENSSL_cleanse(kctx->seed, kctx->seedlen);
kctx->seedlen = 0;
kctx->sec = OPENSSL_memdup(p2, p1);
if (kctx->sec == NULL)
return 0;
kctx->seclen = p1;
impl->seclen = len;
return 1;
case EVP_PKEY_CTRL_TLS_SEED:
if (p1 == 0 || p2 == NULL)
case EVP_KDF_CTRL_RESET_TLS_SEED:
OPENSSL_cleanse(impl->seed, impl->seedlen);
impl->seedlen = 0;
return 1;
case EVP_KDF_CTRL_ADD_TLS_SEED:
p = va_arg(args, const unsigned char *);
len = va_arg(args, size_t);
if (len == 0 || p == NULL)
return 1;
if (p1 < 0 || p1 > (int)(TLS1_PRF_MAXBUF - kctx->seedlen))
if (len > (TLS1_PRF_MAXBUF - impl->seedlen))
return 0;
memcpy(kctx->seed + kctx->seedlen, p2, p1);
kctx->seedlen += p1;
memcpy(impl->seed + impl->seedlen, p, len);
impl->seedlen += len;
return 1;
default:
return -2;
}
}
static int pkey_tls1_prf_ctrl_str(EVP_PKEY_CTX *ctx,
const char *type, const char *value)
static int kdf_tls1_prf_ctrl_str(EVP_KDF_IMPL *impl,
const char *type, const char *value)
{
if (value == NULL) {
KDFerr(KDF_F_PKEY_TLS1_PRF_CTRL_STR, KDF_R_VALUE_MISSING);
KDFerr(KDF_F_KDF_TLS1_PRF_CTRL_STR, KDF_R_VALUE_MISSING);
return 0;
}
if (strcmp(type, "md") == 0) {
TLS1_PRF_PKEY_CTX *kctx = ctx->data;
if (strcmp(type, "digest") == 0)
return kdf_md2ctrl(impl, kdf_tls1_prf_ctrl, EVP_KDF_CTRL_SET_MD, value);
const EVP_MD *md = EVP_get_digestbyname(value);
if (md == NULL) {
KDFerr(KDF_F_PKEY_TLS1_PRF_CTRL_STR, KDF_R_INVALID_DIGEST);
return 0;
}
kctx->md = md;
return 1;
}
if (strcmp(type, "secret") == 0)
return EVP_PKEY_CTX_str2ctrl(ctx, EVP_PKEY_CTRL_TLS_SECRET, value);
if (strcmp(type, "hexsecret") == 0)
return EVP_PKEY_CTX_hex2ctrl(ctx, EVP_PKEY_CTRL_TLS_SECRET, value);
if (strcmp(type, "seed") == 0)
return EVP_PKEY_CTX_str2ctrl(ctx, EVP_PKEY_CTRL_TLS_SEED, value);
if (strcmp(type, "hexseed") == 0)
return EVP_PKEY_CTX_hex2ctrl(ctx, EVP_PKEY_CTRL_TLS_SEED, value);
return kdf_str2ctrl(impl, kdf_tls1_prf_ctrl,
EVP_KDF_CTRL_SET_TLS_SECRET, value);
if (strcmp(type, "hexsecret") == 0)
return kdf_hex2ctrl(impl, kdf_tls1_prf_ctrl,
EVP_KDF_CTRL_SET_TLS_SECRET, value);
if (strcmp(type, "seed") == 0)
return kdf_str2ctrl(impl, kdf_tls1_prf_ctrl, EVP_KDF_CTRL_ADD_TLS_SEED,
value);
if (strcmp(type, "hexseed") == 0)
return kdf_hex2ctrl(impl, kdf_tls1_prf_ctrl, EVP_KDF_CTRL_ADD_TLS_SEED,
value);
KDFerr(KDF_F_PKEY_TLS1_PRF_CTRL_STR, KDF_R_UNKNOWN_PARAMETER_TYPE);
return -2;
}
static int pkey_tls1_prf_derive(EVP_PKEY_CTX *ctx, unsigned char *key,
size_t *keylen)
static int kdf_tls1_prf_derive(EVP_KDF_IMPL *impl, unsigned char *key,
size_t keylen)
{
TLS1_PRF_PKEY_CTX *kctx = ctx->data;
if (kctx->md == NULL) {
KDFerr(KDF_F_PKEY_TLS1_PRF_DERIVE, KDF_R_MISSING_MESSAGE_DIGEST);
if (impl->md == NULL) {
KDFerr(KDF_F_KDF_TLS1_PRF_DERIVE, KDF_R_MISSING_MESSAGE_DIGEST);
return 0;
}
if (kctx->sec == NULL) {
KDFerr(KDF_F_PKEY_TLS1_PRF_DERIVE, KDF_R_MISSING_SECRET);
if (impl->sec == NULL) {
KDFerr(KDF_F_KDF_TLS1_PRF_DERIVE, KDF_R_MISSING_SECRET);
return 0;
}
if (kctx->seedlen == 0) {
KDFerr(KDF_F_PKEY_TLS1_PRF_DERIVE, KDF_R_MISSING_SEED);
if (impl->seedlen == 0) {
KDFerr(KDF_F_KDF_TLS1_PRF_DERIVE, KDF_R_MISSING_SEED);
return 0;
}
return tls1_prf_alg(kctx->md, kctx->sec, kctx->seclen,
kctx->seed, kctx->seedlen,
key, *keylen);
return tls1_prf_alg(impl->md, impl->sec, impl->seclen,
impl->seed, impl->seedlen,
key, keylen);
}
const EVP_PKEY_METHOD tls1_prf_pkey_meth = {
EVP_PKEY_TLS1_PRF,
0,
pkey_tls1_prf_init,
0,
pkey_tls1_prf_cleanup,
0, 0,
0, 0,
0,
0,
0,
0,
0, 0,
0, 0, 0, 0,
0, 0,
0, 0,
0,
pkey_tls1_prf_derive,
pkey_tls1_prf_ctrl,
pkey_tls1_prf_ctrl_str
const EVP_KDF_METHOD tls1_prf_kdf_meth = {
EVP_KDF_TLS1_PRF,
kdf_tls1_prf_new,
kdf_tls1_prf_free,
kdf_tls1_prf_reset,
kdf_tls1_prf_ctrl,
kdf_tls1_prf_ctrl_str,
NULL,
kdf_tls1_prf_derive
};
static int tls1_prf_P_hash(const EVP_MD *md,
@@ -249,12 +245,11 @@ static int tls1_prf_alg(const EVP_MD *md,
const unsigned char *seed, size_t seed_len,
unsigned char *out, size_t olen)
{
if (EVP_MD_type(md) == NID_md5_sha1) {
size_t i;
unsigned char *tmp;
if (!tls1_prf_P_hash(EVP_md5(), sec, slen/2 + (slen & 1),
seed, seed_len, out, olen))
seed, seed_len, out, olen))
return 0;
if ((tmp = OPENSSL_malloc(olen)) == NULL) {
@@ -262,7 +257,7 @@ static int tls1_prf_alg(const EVP_MD *md,
return 0;
}
if (!tls1_prf_P_hash(EVP_sha1(), sec + slen/2, slen/2 + (slen & 1),
seed, seed_len, tmp, olen)) {
seed, seed_len, tmp, olen)) {
OPENSSL_clear_free(tmp, olen);
return 0;
}