X-Git-Url: https://git.distorted.org.uk/~mdw/sgt/putty/blobdiff_plain/5c72ca6161da0e7976245222c412d62ebae2e386..47061bb488400d53fd20deb52d51763d2caa056e:/sshsha.c

diff --git a/sshsha.c b/sshsha.c
index 5b50d7ec..9e9ef8c6 100644
--- a/sshsha.c
+++ b/sshsha.c
@@ -1,5 +1,5 @@
 /*
- * SHA1 hash algorithm. Used in SSH2 as a MAC, and the transform is
+ * SHA1 hash algorithm. Used in SSH-2 as a MAC, and the transform is
  * also used as a `stirring' function for the PuTTY random number
  * pool. Implemented directly from the specification by Simon
  * Tatham.
@@ -13,7 +13,7 @@
 
 #define rol(x,y) ( ((x) << (y)) | (((uint32)x) >> (32-y)) )
 
-void SHA_Core_Init(uint32 h[5])
+static void SHA_Core_Init(uint32 h[5])
 {
     h[0] = 0x67452301;
     h[1] = 0xefcdab89;
@@ -28,6 +28,21 @@ void SHATransform(word32 * digest, word32 * block)
     word32 a, b, c, d, e;
     int t;
 
+#ifdef RANDOM_DIAGNOSTICS
+    {
+        extern int random_diagnostics;
+        if (random_diagnostics) {
+            int i;
+            printf("SHATransform:");
+            for (i = 0; i < 5; i++)
+                printf(" %08x", digest[i]);
+            printf(" +");
+            for (i = 0; i < 16; i++)
+                printf(" %08x", block[i]);
+        }
+    }
+#endif
+
     for (t = 0; t < 16; t++)
 	w[t] = block[t];
 
@@ -83,6 +98,19 @@ void SHATransform(word32 * digest, word32 * block)
     digest[2] += c;
     digest[3] += d;
     digest[4] += e;
+
+#ifdef RANDOM_DIAGNOSTICS
+    {
+        extern int random_diagnostics;
+        if (random_diagnostics) {
+            int i;
+            printf(" =");
+            for (i = 0; i < 5; i++)
+                printf(" %08x", digest[i]);
+            printf("\n");
+        }
+    }
+#endif
 }
 
 /* ----------------------------------------------------------------------
@@ -188,114 +216,220 @@ void SHA_Simple(void *p, int len, unsigned char *output)
     SHA_Final(&s, output);
 }
 
+/*
+ * Thin abstraction for things where hashes are pluggable.
+ */
+
+static void *sha1_init(void)
+{
+    SHA_State *s;
+
+    s = snew(SHA_State);
+    SHA_Init(s);
+    return s;
+}
+
+static void sha1_bytes(void *handle, void *p, int len)
+{
+    SHA_State *s = handle;
+
+    SHA_Bytes(s, p, len);
+}
+
+static void sha1_final(void *handle, unsigned char *output)
+{
+    SHA_State *s = handle;
+
+    SHA_Final(s, output);
+    sfree(s);
+}
+
+const struct ssh_hash ssh_sha1 = {
+    sha1_init, sha1_bytes, sha1_final, 20, "SHA-1"
+};
+
 /* ----------------------------------------------------------------------
  * The above is the SHA-1 algorithm itself. Now we implement the
  * HMAC wrapper on it.
  */
 
-static SHA_State sha1_cs_mac_s1, sha1_cs_mac_s2;
-static SHA_State sha1_sc_mac_s1, sha1_sc_mac_s2;
+static void *sha1_make_context(void)
+{
+    return snewn(3, SHA_State);
+}
+
+static void sha1_free_context(void *handle)
+{
+    sfree(handle);
+}
 
-static void sha1_key(SHA_State * s1, SHA_State * s2,
-		     unsigned char *key, int len)
+static void sha1_key_internal(void *handle, unsigned char *key, int len)
 {
+    SHA_State *keys = (SHA_State *)handle;
     unsigned char foo[64];
     int i;
 
     memset(foo, 0x36, 64);
     for (i = 0; i < len && i < 64; i++)
 	foo[i] ^= key[i];
-    SHA_Init(s1);
-    SHA_Bytes(s1, foo, 64);
+    SHA_Init(&keys[0]);
+    SHA_Bytes(&keys[0], foo, 64);
 
     memset(foo, 0x5C, 64);
     for (i = 0; i < len && i < 64; i++)
 	foo[i] ^= key[i];
-    SHA_Init(s2);
-    SHA_Bytes(s2, foo, 64);
+    SHA_Init(&keys[1]);
+    SHA_Bytes(&keys[1], foo, 64);
 
-    memset(foo, 0, 64);		       /* burn the evidence */
+    smemclr(foo, 64);		       /* burn the evidence */
 }
 
-static void sha1_cskey(unsigned char *key)
+static void sha1_key(void *handle, unsigned char *key)
 {
-    sha1_key(&sha1_cs_mac_s1, &sha1_cs_mac_s2, key, 20);
+    sha1_key_internal(handle, key, 20);
 }
 
-static void sha1_sckey(unsigned char *key)
+static void sha1_key_buggy(void *handle, unsigned char *key)
 {
-    sha1_key(&sha1_sc_mac_s1, &sha1_sc_mac_s2, key, 20);
+    sha1_key_internal(handle, key, 16);
 }
 
-static void sha1_cskey_buggy(unsigned char *key)
+static void hmacsha1_start(void *handle)
 {
-    sha1_key(&sha1_cs_mac_s1, &sha1_cs_mac_s2, key, 16);
+    SHA_State *keys = (SHA_State *)handle;
+
+    keys[2] = keys[0];		      /* structure copy */
 }
 
-static void sha1_sckey_buggy(unsigned char *key)
+static void hmacsha1_bytes(void *handle, unsigned char const *blk, int len)
 {
-    sha1_key(&sha1_sc_mac_s1, &sha1_sc_mac_s2, key, 16);
+    SHA_State *keys = (SHA_State *)handle;
+    SHA_Bytes(&keys[2], (void *)blk, len);
 }
 
-static void sha1_do_hmac(SHA_State * s1, SHA_State * s2,
-			 unsigned char *blk, int len, unsigned long seq,
-			 unsigned char *hmac)
+static void hmacsha1_genresult(void *handle, unsigned char *hmac)
 {
+    SHA_State *keys = (SHA_State *)handle;
     SHA_State s;
     unsigned char intermediate[20];
 
-    intermediate[0] = (unsigned char) ((seq >> 24) & 0xFF);
-    intermediate[1] = (unsigned char) ((seq >> 16) & 0xFF);
-    intermediate[2] = (unsigned char) ((seq >> 8) & 0xFF);
-    intermediate[3] = (unsigned char) ((seq) & 0xFF);
-
-    s = *s1;			       /* structure copy */
-    SHA_Bytes(&s, intermediate, 4);
-    SHA_Bytes(&s, blk, len);
+    s = keys[2];		       /* structure copy */
     SHA_Final(&s, intermediate);
-    s = *s2;			       /* structure copy */
+    s = keys[1];		       /* structure copy */
     SHA_Bytes(&s, intermediate, 20);
     SHA_Final(&s, hmac);
 }
 
-static void sha1_generate(unsigned char *blk, int len, unsigned long seq)
+static void sha1_do_hmac(void *handle, unsigned char *blk, int len,
+			 unsigned long seq, unsigned char *hmac)
+{
+    unsigned char seqbuf[4];
+
+    PUT_32BIT_MSB_FIRST(seqbuf, seq);
+    hmacsha1_start(handle);
+    hmacsha1_bytes(handle, seqbuf, 4);
+    hmacsha1_bytes(handle, blk, len);
+    hmacsha1_genresult(handle, hmac);
+}
+
+static void sha1_generate(void *handle, unsigned char *blk, int len,
+			  unsigned long seq)
+{
+    sha1_do_hmac(handle, blk, len, seq, blk + len);
+}
+
+static int hmacsha1_verresult(void *handle, unsigned char const *hmac)
 {
-    sha1_do_hmac(&sha1_cs_mac_s1, &sha1_cs_mac_s2, blk, len, seq,
-		 blk + len);
+    unsigned char correct[20];
+    hmacsha1_genresult(handle, correct);
+    return !memcmp(correct, hmac, 20);
 }
 
-static int sha1_verify(unsigned char *blk, int len, unsigned long seq)
+static int sha1_verify(void *handle, unsigned char *blk, int len,
+		       unsigned long seq)
 {
     unsigned char correct[20];
-    sha1_do_hmac(&sha1_sc_mac_s1, &sha1_sc_mac_s2, blk, len, seq, correct);
+    sha1_do_hmac(handle, blk, len, seq, correct);
     return !memcmp(correct, blk + len, 20);
 }
 
+static void hmacsha1_96_genresult(void *handle, unsigned char *hmac)
+{
+    unsigned char full[20];
+    hmacsha1_genresult(handle, full);
+    memcpy(hmac, full, 12);
+}
+
+static void sha1_96_generate(void *handle, unsigned char *blk, int len,
+			     unsigned long seq)
+{
+    unsigned char full[20];
+    sha1_do_hmac(handle, blk, len, seq, full);
+    memcpy(blk + len, full, 12);
+}
+
+static int hmacsha1_96_verresult(void *handle, unsigned char const *hmac)
+{
+    unsigned char correct[20];
+    hmacsha1_genresult(handle, correct);
+    return !memcmp(correct, hmac, 12);
+}
+
+static int sha1_96_verify(void *handle, unsigned char *blk, int len,
+		       unsigned long seq)
+{
+    unsigned char correct[20];
+    sha1_do_hmac(handle, blk, len, seq, correct);
+    return !memcmp(correct, blk + len, 12);
+}
+
 void hmac_sha1_simple(void *key, int keylen, void *data, int datalen,
 		      unsigned char *output) {
-    SHA_State s1, s2;
+    SHA_State states[2];
     unsigned char intermediate[20];
 
-    sha1_key(&s1, &s2, key, keylen);
-    SHA_Bytes(&s1, data, datalen);
-    SHA_Final(&s1, intermediate);
+    sha1_key_internal(states, key, keylen);
+    SHA_Bytes(&states[0], data, datalen);
+    SHA_Final(&states[0], intermediate);
 
-    SHA_Bytes(&s2, intermediate, 20);
-    SHA_Final(&s2, output);
+    SHA_Bytes(&states[1], intermediate, 20);
+    SHA_Final(&states[1], output);
 }
 
-const struct ssh_mac ssh_sha1 = {
-    sha1_cskey, sha1_sckey,
-    sha1_generate,
-    sha1_verify,
+const struct ssh_mac ssh_hmac_sha1 = {
+    sha1_make_context, sha1_free_context, sha1_key,
+    sha1_generate, sha1_verify,
+    hmacsha1_start, hmacsha1_bytes, hmacsha1_genresult, hmacsha1_verresult,
     "hmac-sha1",
-    20
+    20,
+    "HMAC-SHA1"
+};
+
+const struct ssh_mac ssh_hmac_sha1_96 = {
+    sha1_make_context, sha1_free_context, sha1_key,
+    sha1_96_generate, sha1_96_verify,
+    hmacsha1_start, hmacsha1_bytes,
+    hmacsha1_96_genresult, hmacsha1_96_verresult,
+    "hmac-sha1-96",
+    12,
+    "HMAC-SHA1-96"
 };
 
-const struct ssh_mac ssh_sha1_buggy = {
-    sha1_cskey_buggy, sha1_sckey_buggy,
-    sha1_generate,
-    sha1_verify,
+const struct ssh_mac ssh_hmac_sha1_buggy = {
+    sha1_make_context, sha1_free_context, sha1_key_buggy,
+    sha1_generate, sha1_verify,
+    hmacsha1_start, hmacsha1_bytes, hmacsha1_genresult, hmacsha1_verresult,
     "hmac-sha1",
-    20
+    20,
+    "bug-compatible HMAC-SHA1"
+};
+
+const struct ssh_mac ssh_hmac_sha1_96_buggy = {
+    sha1_make_context, sha1_free_context, sha1_key_buggy,
+    sha1_96_generate, sha1_96_verify,
+    hmacsha1_start, hmacsha1_bytes,
+    hmacsha1_96_genresult, hmacsha1_96_verresult,
+    "hmac-sha1-96",
+    12,
+    "bug-compatible HMAC-SHA1-96"
 };