/* -*-c-*-
*
- * $Id: keyutil.c,v 1.16 2003/10/15 09:31:45 mdw Exp $
+ * $Id: keyutil.c,v 1.25 2004/04/21 00:38:22 mdw Exp $
*
* Simple key manager program
*
* MA 02111-1307, USA.
*/
-/*----- Revision history --------------------------------------------------*
- *
- * $Log: keyutil.c,v $
- * Revision 1.16 2003/10/15 09:31:45 mdw
- * Fix help message.
- *
- * Revision 1.15 2003/05/15 23:23:24 mdw
- * Fix behaviour with bogus trailing attributes.
- *
- * Revision 1.14 2001/02/23 09:03:27 mdw
- * Simplify usage message by removing nonexistant options.
- *
- * Revision 1.13 2001/02/21 20:04:27 mdw
- * Provide help on individual commands (some need it desparately). Allow
- * atomic retagging of keys.
- *
- * Revision 1.12 2001/02/03 11:58:22 mdw
- * Store the correct seed information and count for DSA keys now that it's
- * available.
- *
- * Revision 1.11 2000/12/06 20:33:27 mdw
- * Make flags be macros rather than enumerations, to ensure that they're
- * unsigned.
- *
- * Revision 1.10 2000/10/08 12:02:21 mdw
- * Use @MP_EQ@ instead of @MP_CMP@.
- *
- * Revision 1.9 2000/08/15 21:40:49 mdw
- * Minor formatting change in listing attributes.
- *
- * Revision 1.8 2000/07/29 09:59:13 mdw
- * Support Lim-Lee primes in Diffie-Hellman parameter generation.
- *
- * Revision 1.7 2000/07/01 11:18:51 mdw
- * Use new interfaces for key manipulation.
- *
- * Revision 1.6 2000/06/17 11:28:22 mdw
- * Use secure memory interface from MP library. `rand_getgood' is
- * deprecated.
- *
- * Revision 1.5 2000/02/12 18:21:03 mdw
- * Overhaul of key management (again).
- *
- * Revision 1.4 1999/12/22 15:48:10 mdw
- * Track new key-management changes. Support new key generation
- * algorithms.
- *
- * Revision 1.3 1999/11/02 15:23:24 mdw
- * Fix newlines in keyring list.
- *
- * Revision 1.2 1999/10/15 21:05:28 mdw
- * In `key list', show timezone for local times, and support `-u' option
- * for UTC output.
- *
- * Revision 1.1 1999/09/03 08:41:12 mdw
- * Initial import.
- *
- */
-
/*----- Header files ------------------------------------------------------*/
#include "config.h"
#include "bbs.h"
#include "dh.h"
#include "dsa.h"
+#include "dsarand.h"
+#include "ec.h"
+#include "ec-keys.h"
+#include "ectab.h"
#include "fibrand.h"
#include "getdate.h"
#include "key.h"
#include "mprand.h"
#include "mptext.h"
#include "pgen.h"
+#include "ptab.h"
#include "rsa.h"
+#include "sha-mgf.h"
+#include "sha256-mgf.h"
+#include "sha224-mgf.h"
+#include "sha384-mgf.h"
+#include "sha512-mgf.h"
+#include "tiger-mgf.h"
+#include "rmd128-mgf.h"
+#include "rmd160-mgf.h"
+#include "rmd256-mgf.h"
+#include "rmd320-mgf.h"
+#include "md5-mgf.h"
+#include "dsarand.h"
+
/*----- Handy global state ------------------------------------------------*/
static const char *keyfile = "keyring";
}
}
+/*----- Seeding -----------------------------------------------------------*/
+
+const struct seedalg { const char *p; grand *(*gen)(const void *, size_t); }
+seedtab[] = {
+ { "dsarand", dsarand_create },
+ { "rmd128-mgf", rmd128_mgfrand },
+ { "rmd160-mgf", rmd160_mgfrand },
+ { "rmd256-mgf", rmd256_mgfrand },
+ { "rmd320-mgf", rmd320_mgfrand },
+ { "sha-mgf", sha_mgfrand },
+ { "sha224-mgf", sha224_mgfrand },
+ { "sha256-mgf", sha256_mgfrand },
+ { "sha384-mgf", sha384_mgfrand },
+ { "sha512-mgf", sha512_mgfrand },
+ { "tiger-mgf", tiger_mgfrand },
+ { 0, 0 }
+};
+
+#define SEEDALG_DEFAULT (seedtab + 2)
+
/*----- Key generation ----------------------------------------------------*/
/* --- Key generation parameters --- */
dstr tag; /* Full tag name for the key */
unsigned f; /* Flags for the new key */
unsigned bits, qbits; /* Bit length for the new key */
+ const char *curve; /* Elliptic curve name/info */
+ grand *r; /* Random number source */
key *p; /* Parameters key-data */
} keyopts;
static int copyparam(keyopts *k, const char **pp)
{
key_filter kf;
+ key_attriter i;
+ const char *n, *v;
/* --- Quick check if no parameters supplied --- */
kf.m = KF_CATMASK;
if (!key_copy(&k->k->k, &k->p->k, &kf))
die(EXIT_FAILURE, "unexpected failure while copying parameters");
+
+ /* --- Copy over attributes --- */
+
+ for (key_mkattriter(&i, k->p); key_nextattr(&i, &n, &v); )
+ key_putattr(k->kf, k->k, n, v);
+
+ /* --- Done --- */
+
return (1);
}
sz = (k->bits + 7) >> 3;
p = sub_alloc(sz);
m = (1 << (((k->bits - 1) & 7) + 1)) - 1;
- rand_get(RAND_GLOBAL, p, sz);
+ k->r->ops->fill(k->r, p, sz);
*p &= m;
key_binary(&k->k->k, p, sz);
k->k->k.e |= KCAT_SYMM | KF_BURN;
int i;
if (!k->bits)
- k->bits = 112;
+ k->bits = 168;
if (k->p)
die(EXIT_FAILURE, "no shared parameters for DES keys");
if (k->bits % 56 || k->bits > 168)
sz = k->bits / 7;
p = sub_alloc(sz);
- rand_get(RAND_GLOBAL, p, sz); /* Too much work done here! */
+ k->r->ops->fill(k->r, p, sz);
for (i = 0; i < sz; i++) {
octet x = p[i] | 0x01;
x = x ^ (x >> 4);
/* --- Generate the RSA parameters --- */
- if (rsa_gen(&rp, k->bits, &rand_global, 0,
+ if (rsa_gen(&rp, k->bits, k->r, 0,
(k->f & f_quiet) ? 0 : pgen_ev, 0))
die(EXIT_FAILURE, "RSA key generation failed");
/* --- Run a test encryption --- */
{
- grand *g = fibrand_create(rand_global.ops->word(&rand_global));
+ grand *g = fibrand_create(k->r->ops->word(k->r));
rsa_pub rpp;
mp *m = mprand_range(MP_NEW, rp.n, g, 0);
mp *c;
sz = (k->qbits + 7) >> 3;
p = sub_alloc(sz);
- rand_get(RAND_GLOBAL, p, sz);
+ k->r->ops->fill(k->r, p, sz);
/* --- Allocate the parameters --- */
/* --- Choose a private key --- */
- x = mprand_range(MP_NEWSEC, q, &rand_global, 0);
+ x = mprand_range(MP_NEWSEC, q, k->r, 0);
mpmont_create(&mm, p);
y = mpmont_exp(&mm, MP_NEW, g, x);
static void alg_dhparam(keyopts *k)
{
static const char *pl[] = { "p", "q", "g", 0 };
+ key_data *kd = &k->k->k;
if (!copyparam(k, pl)) {
dh_param dp;
- key_data *kd = &k->k->k;
int rc;
+ if (k->curve) {
+ qd_parse qd;
+
+ if (strcmp(k->curve, "list") == 0) {
+ const pentry *pe;
+ printf("Built-in prime groups:\n");
+ for (pe = ptab; pe->name; pe++)
+ printf(" %s\n", pe->name);
+ exit(0);
+ }
+ qd.p = k->curve;
+ if (dh_parse(&qd, &dp))
+ die(EXIT_FAILURE, "error in group spec: %s", qd.e);
+ goto done;
+ }
+
if (!k->bits)
k->bits = 1024;
k->qbits = 256;
rc = dh_limlee(&dp, k->qbits, k->bits,
(k->f & f_subgroup) ? DH_SUBGROUP : 0,
- 0, &rand_global, (k->f & f_quiet) ? 0 : pgen_ev, 0,
+ 0, k->r, (k->f & f_quiet) ? 0 : pgen_ev, 0,
(k->f & f_quiet) ? 0 : pgen_evspin, 0, &nf, &f);
if (!rc) {
dstr d = DSTR_INIT;
dstr_destroy(&d);
}
} else
- rc = dh_gen(&dp, k->qbits, k->bits, 0, &rand_global,
+ rc = dh_gen(&dp, k->qbits, k->bits, 0, k->r,
(k->f & f_quiet) ? 0 : pgen_ev, 0);
if (rc)
die(EXIT_FAILURE, "Diffie-Hellman parameter generation failed");
+ done:
key_structure(kd);
mpkey(kd, "p", dp.p, KCAT_SHARE);
mpkey(kd, "q", dp.q, KCAT_SHARE);
mp_drop(dp.q);
mp_drop(dp.p);
mp_drop(dp.g);
- }
+ }
}
static void alg_dh(keyopts *k)
* Since %$g$% has order %$q$%, choose %$x < q$%.
*/
- x = mprand_range(MP_NEWSEC, q, &rand_global, 0);
+ x = mprand_range(MP_NEWSEC, q, k->r, 0);
/* --- Compute the public key %$y = g^x \bmod p$% --- */
/* --- Generate the BBS parameters --- */
- if (bbs_gen(&bp, k->bits, &rand_global, 0,
+ if (bbs_gen(&bp, k->bits, k->r, 0,
(k->f & f_quiet) ? 0 : pgen_ev, 0))
die(EXIT_FAILURE, "Blum-Blum-Shub key generation failed");
bbs_privfree(&bp);
}
+static void alg_ecparam(keyopts *k)
+{
+ static const char *pl[] = { "curve", 0 };
+ if (!copyparam(k, pl)) {
+ ec_info ei;
+ const char *e;
+ key_data *kd = &k->k->k;
+
+ /* --- Decide on a curve --- */
+
+ if (!k->bits) k->bits = 256;
+ if (k->curve && strcmp(k->curve, "list") == 0) {
+ const ecentry *ee;
+ printf("Built-in elliptic curves:\n");
+ for (ee = ectab; ee->name; ee++)
+ printf(" %s\n", ee->name);
+ exit(0);
+ }
+ if (!k->curve) {
+ if (k->bits <= 56) k->curve = "secp112r1";
+ else if (k->bits <= 64) k->curve = "secp128r1";
+ else if (k->bits <= 80) k->curve = "secp160r1";
+ else if (k->bits <= 96) k->curve = "secp192r1";
+ else if (k->bits <= 112) k->curve = "secp224r1";
+ else if (k->bits <= 128) k->curve = "secp256r1";
+ else if (k->bits <= 192) k->curve = "secp384r1";
+ else if (k->bits <= 256) k->curve = "secp521r1";
+ else
+ die(EXIT_FAILURE, "no built-in curves provide %u-bit security",
+ k->bits);
+ }
+
+ /* --- Check it --- */
+
+ if ((e = ec_getinfo(&ei, k->curve)) != 0)
+ die(EXIT_FAILURE, "error in curve spec: %s", e);
+ if (!(k->f & f_quiet) && (e = ec_checkinfo(&ei, k->r)) != 0)
+ moan("WARNING! curve check failed: %s", e);
+ ec_freeinfo(&ei);
+
+ /* --- Write out the answer --- */
+
+ key_structure(kd);
+ kd = key_structcreate(kd, "curve");
+ key_string(kd, k->curve);
+ kd->e |= KCAT_SHARE;
+ }
+}
+
+static void alg_ec(keyopts *k)
+{
+ key_data *kd = &k->k->k;
+ key_data *kkd;
+ mp *x = MP_NEW;
+ ec p = EC_INIT;
+ const char *e;
+ ec_info ei;
+
+ /* --- Get the curve --- */
+
+ alg_ecparam(k);
+ if ((kkd = key_structfind(kd, "curve")) == 0)
+ die(EXIT_FAILURE, "unexpected failure looking up subkey `curve')");
+ if ((kkd->e & KF_ENCMASK) != KENC_STRING)
+ die(EXIT_FAILURE, "subkey `curve' is not a string");
+ if ((e = ec_getinfo(&ei, kkd->u.p)) != 0)
+ die(EXIT_FAILURE, "error in curve spec: %s", e);
+
+ /* --- Invent a private exponent and compute the public key --- */
+
+ x = mprand_range(MP_NEWSEC, ei.r, k->r, 0);
+ ec_mul(ei.c, &p, &ei.g, x);
+
+ /* --- Store everything away --- */
+
+ kkd = key_structcreate(kd, "p");
+ key_ec(kkd, &p);
+ kkd->e |= KCAT_PUB;
+ kkd = key_structcreate(kd, "private");
+ key_structure(kkd);
+ mpkey(kkd, "x", x, KCAT_PRIV | KF_BURN);
+
+ /* --- Done --- */
+
+ ec_freeinfo(&ei);
+ mp_drop(x);
+}
+
/* --- The algorithm tables --- */
typedef struct keyalg {
{ "dh", alg_dh, "Diffie-Hellman key exchange" },
{ "dh-param", alg_dhparam, "Diffie-Hellman parameters" },
{ "bbs", alg_bbs, "Blum-Blum-Shub generator" },
+ { "ec-param", alg_ecparam, "Elliptic curve parameters" },
+ { "ec", alg_ec, "Elliptic curve crypto" },
{ 0, 0 }
};
const char *c = 0;
keyalg *alg = algtab;
const char *rtag = 0;
- keyopts k = { 0, 0, DSTR_INIT, 0, 0, 0, 0 };
+ const struct seedalg *sa = SEEDALG_DEFAULT;
+ keyopts k = { 0, 0, DSTR_INIT, 0, 0, 0, 0, 0 };
+ const char *seed = 0;
+ k.r = &rand_global;
/* --- Parse options for the subcommand --- */
{ "comment", OPTF_ARGREQ, 0, 'c' },
{ "tag", OPTF_ARGREQ, 0, 't' },
{ "rand-id", OPTF_ARGREQ, 0, 'R' },
+ { "curve", OPTF_ARGREQ, 0, 'C' },
+ { "seedalg", OPTF_ARGREQ, 0, 'A' },
+ { "seed", OPTF_ARGREQ, 0, 's' },
+ { "newseed", OPTF_ARGREQ, 0, 'n' },
{ "lock", 0, 0, 'l' },
{ "quiet", 0, 0, 'q' },
{ "lim-lee", 0, 0, 'L' },
{ "subgroup", 0, 0, 'S' },
{ 0, 0, 0, 0 }
};
- int i = mdwopt(argc, argv, "+a:b:B:p:e:c:t:R:lqrLS", opt, 0, 0, 0);
+ int i = mdwopt(argc, argv, "+a:b:B:p:e:c:t:R:C:A:s:n:lqrLS",
+ opt, 0, 0, 0);
if (i < 0)
break;
c = optarg;
break;
+ /* --- Elliptic curve parameters --- */
+
+ case 'C':
+ k.curve = optarg;
+ break;
+
/* --- Store tags --- */
case 't':
k.f |= f_retag;
break;
+ /* --- Seeding --- */
+
+ case 'A': {
+ const struct seedalg *ss;
+ if (strcmp(optarg, "list") == 0) {
+ printf("Seed algorithms:\n");
+ for (ss = seedtab; ss->p; ss++)
+ printf(" %s\n", ss->p);
+ exit(0);
+ }
+ if (seed) die(EXIT_FAILURE, "seed already set -- put -A first");
+ sa = 0;
+ for (ss = seedtab; ss->p; ss++) {
+ if (strcmp(optarg, ss->p) == 0)
+ sa = ss;
+ }
+ if (!sa)
+ die(EXIT_FAILURE, "seed algorithm `%s' not known", optarg);
+ } break;
+
+ case 's': {
+ base64_ctx b;
+ dstr d = DSTR_INIT;
+ if (seed) die(EXIT_FAILURE, "seed already set");
+ base64_init(&b);
+ base64_decode(&b, optarg, strlen(optarg), &d);
+ base64_decode(&b, 0, 0, &d);
+ k.r = sa->gen(d.buf, d.len);
+ seed = optarg;
+ dstr_destroy(&d);
+ } break;
+
+ case 'n': {
+ base64_ctx b;
+ dstr d = DSTR_INIT;
+ char *p;
+ unsigned n = strtoul(optarg, &p, 0);
+ if (n == 0 || *p != 0 || n % 8 != 0)
+ die(EXIT_FAILURE, "bad seed length `%s'", optarg);
+ if (seed) die(EXIT_FAILURE, "seed already set");
+ n /= 8;
+ p = xmalloc(n);
+ rand_get(RAND_GLOBAL, p, n);
+ base64_init(&b);
+ base64_encode(&b, p, n, &d);
+ base64_encode(&b, 0, 0, &d);
+ seed = d.buf;
+ k.r = sa->gen(p, n);
+ } break;
+
/* --- Other flags --- */
case 'R':
}
setattr(&f, k.k, argv + optind + 1);
+ if (seed) {
+ key_putattr(&f, k.k, "genseed", seed);
+ key_putattr(&f, k.k, "seedalg", sa->p);
+ }
key_fulltag(k.k, &k.tag);
putchar('\n');
break;
+ /* --- Strings --- */
+
+ case KENC_STRING:
+ printf(" `%s'\n", k->u.p);
+ break;
+
+ /* --- Elliptic curve points --- */
+
+ case KENC_EC:
+ if (EC_ATINF(&k->u.e))
+ fputs(" inf\n", stdout);
+ else {
+ fputs(" 0x", stdout); mp_writefile(k->u.e.x, stdout, 16);
+ fputs(", 0x", stdout); mp_writefile(k->u.e.y, stdout, 16);
+ putchar('\n');
+ }
+ break;
+
/* --- Structured keys --- *
*
* Just iterate over the subkeys.
/* --- @cmd_finger@ --- */
-static void fingerprint(key *k, const key_filter *kf)
+static void fingerprint(key *k, const gchash *ch, const key_filter *kf)
{
- rmd160_ctx r;
- octet hash[RMD160_HASHSZ];
+ ghash *h;
dstr d = DSTR_INIT;
- int i;
+ const octet *p;
+ size_t i;
- if (!key_encode(&k->k, &d, kf))
- return;
- rmd160_init(&r);
- rmd160_hash(&r, d.buf, d.len);
- rmd160_done(&r, hash);
-
- DRESET(&d);
- key_fulltag(k, &d);
- for (i = 0; i < sizeof(hash); i++) {
- if (i && i % 4 == 0)
- putchar('-');
- printf("%02x", hash[i]);
+ h = GH_INIT(ch);
+ if (key_fingerprint(k, h, kf)) {
+ p = GH_DONE(h, 0);
+ key_fulltag(k, &d);
+ for (i = 0; i < ch->hashsz; i++) {
+ if (i && i % 4 == 0)
+ putchar('-');
+ printf("%02x", p[i]);
+ }
+ printf(" %s\n", d.buf);
}
- printf(" %s\n", d.buf);
dstr_destroy(&d);
+ GH_DESTROY(h);
}
static int cmd_finger(int argc, char *argv[])
{
key_file f;
int rc = 0;
+ const gchash *ch = &rmd160;
key_filter kf = { KF_NONSECRET, KF_NONSECRET };
for (;;) {
static struct option opt[] = {
{ "filter", OPTF_ARGREQ, 0, 'f' },
+ { "algorithm", OPTF_ARGREQ, 0, 'a' },
{ 0, 0, 0, 0 }
};
- int i = mdwopt(argc, argv, "+f:", opt, 0, 0, 0);
+ int i = mdwopt(argc, argv, "+f:a:", opt, 0, 0, 0);
if (i < 0)
break;
switch (i) {
if (err || *p)
die(EXIT_FAILURE, "bad filter string `%s'", optarg);
} break;
+ case 'a':
+ if ((ch = ghash_byname(optarg)) == 0)
+ die(EXIT_FAILURE, "unknown hash algorithm `%s'", optarg);
+ break;
default:
rc = 1;
break;
for (i = 0; i < argc; i++) {
key *k = key_bytag(&f, argv[i]);
if (k)
- fingerprint(k, &kf);
+ fingerprint(k, ch, &kf);
else {
rc = 1;
moan("key `%s' not found", argv[i]);
key_iter i;
key *k;
for (key_mkiter(&i, &f); (k = key_next(&i)) != 0; )
- fingerprint(k, &kf);
+ fingerprint(k, ch, &kf);
}
return (rc);
}
-b, --bits=N Generate an N-bit key.\n\
-B, --qbits=N Use an N-bit subgroup or factors.\n\
-p, --parameters=TAG Get group parameters from TAG.\n\
+-C, --curve=CURVE Use elliptic curve CURVE.\n\
-e, --expire=TIME Make the key expire after TIME.\n\
-c, --comment=STRING Attach the command STRING to the key.\n\
-t, --tag=TAG Tag the key with the name TAG.\n\
Options:\n\
\n\
-f, --filter=FILT Only hash key components matching FILT.\n\
+-a, --algorithm=HASH Use the named HASH algorithm.\n\
" },
{ "tidy", cmd_tidy, "tidy" },
{ "extract", cmd_extract, "extract [-f filter] file [tag...]", "\