git.distorted.org.uk Git - u/mdw/catacomb/blob - key-pass.c

   1 /* -*-c-*-
   2  *
   3  * $Id: key-pass.c,v 1.5 2004/04/08 01:36:15 mdw Exp $
   4  *
   5  * Encrypting keys with passphrases
   6  *
   7  * (c) 1999 Straylight/Edgeware
   8  */
   9
  10 /*----- Licensing notice --------------------------------------------------*
  11  *
  12  * This file is part of Catacomb.
  13  *
  14  * Catacomb is free software; you can redistribute it and/or modify
  15  * it under the terms of the GNU Library General Public License as
  16  * published by the Free Software Foundation; either version 2 of the
  17  * License, or (at your option) any later version.
  18  *
  19  * Catacomb is distributed in the hope that it will be useful,
  20  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22  * GNU Library General Public License for more details.
  23  *
  24  * You should have received a copy of the GNU Library General Public
  25  * License along with Catacomb; if not, write to the Free
  26  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
  27  * MA 02111-1307, USA.
  28  */
  29
  30 /*----- Header files ------------------------------------------------------*/
  31
  32 #include <mLib/dstr.h>
  33
  34 #include "key.h"
  35 #include "paranoia.h"
  36 #include "passphrase.h"
  37 #include "rand.h"
  38
  39 #include "blowfish-cbc.h"
  40 #include "rmd160.h"
  41 #include "rmd160-mgf.h"
  42 #include "rmd160-hmac.h"
  43
  44 /*----- Main code ---------------------------------------------------------*/
  45
  46 /* --- Format --- *
  47  *
  48  * Choose a random 160-bit string %$R$%.  Take the passphrase %$P$%, and
  49  * the message %$m$%.  Now, compute %$K_E \cat K_T = H(R \cat P)$%,
  50  * %$y_0 = E_{K_E}(m)$% and %$\tau = T_{K_T}(y_0)$%.  The ciphertext is
  51  * %$y = N \cat \tau \cat y_0$%.
  52  *
  53  * This is not the original format.  The original format was insecure, and
  54  * has been replaced incompatibly.
  55  */
  56
  57 /* --- @key_plock@ --- *
  58  *
  59  * Arguments:   @const char *tag@ = tag to use for passphrase
  60  *              @key_data *k@ = source key data block
  61  *              @key_data *kt@ = target key data block
  62  *
  63  * Returns:     Zero if successful, nonzero if there was a problem.
  64  *
  65  * Use:         Locks a key by encrypting it with a passphrase.
  66  */
  67
  68 int key_plock(const char *tag, key_data *k, key_data *kt)
  69 {
  70   dstr d = DSTR_INIT;
  71   octet b[RMD160_HASHSZ * 2];
  72   octet *m;
  73   size_t msz;
  74   char buf[256];
  75
  76   /* --- Sanity check --- */
  77
  78   assert(((void)"Key data is already encrypted",
  79           (k->e & KF_ENCMASK) != KENC_ENCRYPT));
  80
  81   /* --- Format the stuff in the buffer --- */
  82
  83   DENSURE(&d, RMD160_HASHSZ * 2);
  84   rand_get(RAND_GLOBAL, d.buf, RMD160_HASHSZ);
  85   d.len += RMD160_HASHSZ * 2;
  86   key_encode(k, &d, 0);
  87   if (k == kt)
  88     key_destroy(k);
  89   m = (octet *)d.buf + RMD160_HASHSZ * 2;
  90   msz = d.len - RMD160_HASHSZ * 2;
  91
  92   /* --- Read the passphrase --- */
  93
  94   if (passphrase_read(tag, PMODE_VERIFY, buf, sizeof(buf))) {
  95     dstr_destroy(&d);
  96     return (-1);
  97   }
  98
  99   /* --- Hash the passphrase to make a key --- */
 100
 101   {
 102     rmd160_mgfctx r;
 103     rmd160_mgfkeybegin(&r);
 104     rmd160_mgfkeyadd(&r, d.buf, RMD160_HASHSZ);
 105     rmd160_mgfkeyadd(&r, buf, strlen(buf));
 106     rmd160_mgfencrypt(&r, 0, b, sizeof(b));
 107     BURN(r);
 108     BURN(buf);
 109   }
 110
 111   /* --- Encrypt the plaintext --- */
 112
 113   {
 114     blowfish_cbcctx c;
 115     blowfish_cbcinit(&c, b, RMD160_HASHSZ, 0);
 116     blowfish_cbcencrypt(&c, m, m, msz);
 117     BURN(c);
 118   }
 119
 120   /* --- MAC the ciphertext --- */
 121
 122   {
 123     rmd160_mackey mk;
 124     rmd160_macctx mc;
 125     rmd160_hmacinit(&mk, b + RMD160_HASHSZ, RMD160_HASHSZ);
 126     rmd160_macinit(&mc, &mk);
 127     rmd160_machash(&mc, m, msz);
 128     rmd160_macdone(&mc, d.buf + RMD160_HASHSZ);
 129     BURN(mk);
 130     BURN(mc);
 131   }
 132
 133   /* --- Done --- */
 134
 135   BURN(b);
 136   key_encrypted(kt, d.buf, d.len);
 137   dstr_destroy(&d);
 138   return (0);
 139 }
 140
 141 /* --- @key_punlock@ --- *
 142  *
 143  * Arguments:   @const char *tag@ = tag to use for passphrase
 144  *              @key_data *k@ = source key data block
 145  *              @key_data *kt@ = target key data block
 146  *
 147  * Returns:     Zero if it worked, nonzero if it didn't.
 148  *
 149  * Use:         Unlocks a passphrase-locked key.
 150  */
 151
 152 int key_punlock(const char *tag, key_data *k, key_data *kt)
 153 {
 154   octet b[RMD160_HASHSZ * 2];
 155   char buf[256];
 156   octet *p = 0;
 157   size_t sz;
 158
 159   /* --- Sanity check --- */
 160
 161   assert(((void)"Key data isn't encrypted",
 162           (k->e & KF_ENCMASK) == KENC_ENCRYPT));
 163
 164   /* --- Check the size --- */
 165
 166   if (k->u.k.sz < RMD160_HASHSZ * 2)
 167     return (-1);
 168   sz = k->u.k.sz - RMD160_HASHSZ * 2;
 169
 170   /* --- Fetch the passphrase --- */
 171
 172   if (passphrase_read(tag, PMODE_READ, buf, sizeof(buf)))
 173     goto fail;
 174
 175   /* --- Hash the passphrase to make a key --- */
 176
 177   {
 178     rmd160_mgfctx r;
 179     rmd160_mgfkeybegin(&r);
 180     rmd160_mgfkeyadd(&r, k->u.k.k, RMD160_HASHSZ);
 181     rmd160_mgfkeyadd(&r, buf, strlen(buf));
 182     rmd160_mgfencrypt(&r, 0, b, sizeof(b));
 183     BURN(r);
 184     BURN(buf);
 185   }
 186
 187   /* --- Verify the MAC --- */
 188
 189   {
 190     rmd160_mackey mk;
 191     rmd160_macctx mc;
 192     rmd160_hmacinit(&mk, b + RMD160_HASHSZ, RMD160_HASHSZ);
 193     rmd160_macinit(&mc, &mk);
 194     rmd160_machash(&mc, k->u.k.k + RMD160_HASHSZ * 2, sz);
 195     rmd160_macdone(&mc, b + RMD160_HASHSZ);
 196     if (memcmp(b + RMD160_HASHSZ, k->u.k.k + RMD160_HASHSZ,
 197                RMD160_HASHSZ) != 0) {
 198       passphrase_cancel(tag);
 199       goto fail;
 200     }
 201     BURN(mk);
 202     BURN(mc);
 203   }
 204
 205   /* --- Allocate a destination buffer --- */
 206
 207   p = xmalloc(sz);
 208
 209   /* --- Decrypt the key data --- */
 210
 211   {
 212     blowfish_cbcctx c;
 213     blowfish_cbcinit(&c, b, RMD160_HASHSZ, 0);
 214     blowfish_cbcdecrypt(&c, k->u.k.k + RMD160_HASHSZ * 2, p, sz);
 215     BURN(c);
 216   }
 217
 218   /* --- Decode the key data into the destination buffer --- */
 219
 220   if (k == kt) {
 221     key_destroy(k);
 222     passphrase_cancel(tag);
 223   }
 224   if (key_decode(p, sz, kt))
 225     goto fail;
 226
 227   /* --- Done --- */
 228
 229   free(p);
 230   return (0);
 231
 232   /* --- Tidy up if things went wrong --- */
 233
 234 fail:
 235   BURN(b);
 236   free(p);
 237   return (-1);
 238 }
 239
 240 /*----- That's all, folks -------------------------------------------------*/