| 1 | /* -*-c-*- |
| 2 | * |
| 3 | * Bulk crypto transformations |
| 4 | * |
| 5 | * (c) 2014 Straylight/Edgeware |
| 6 | */ |
| 7 | |
| 8 | /*----- Licensing notice --------------------------------------------------* |
| 9 | * |
| 10 | * This file is part of Trivial IP Encryption (TrIPE). |
| 11 | * |
| 12 | * TrIPE is free software: you can redistribute it and/or modify it under |
| 13 | * the terms of the GNU General Public License as published by the Free |
| 14 | * Software Foundation; either version 3 of the License, or (at your |
| 15 | * option) any later version. |
| 16 | * |
| 17 | * TrIPE is distributed in the hope that it will be useful, but WITHOUT |
| 18 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| 19 | * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| 20 | * for more details. |
| 21 | * |
| 22 | * You should have received a copy of the GNU General Public License |
| 23 | * along with TrIPE. If not, see <https://www.gnu.org/licenses/>. |
| 24 | */ |
| 25 | |
| 26 | /*----- Header files ------------------------------------------------------*/ |
| 27 | |
| 28 | #include "tripe.h" |
| 29 | |
| 30 | /*----- Utilities ---------------------------------------------------------*/ |
| 31 | |
| 32 | #define SEQSZ 4 /* Size of sequence number packet */ |
| 33 | |
| 34 | #define TRACE_IV(qiv, ivsz) do { IF_TRACING(T_KEYSET, { \ |
| 35 | trace_block(T_CRYPTO, "crypto: initialization vector", \ |
| 36 | (qiv), (ivsz)); \ |
| 37 | }) } while (0) |
| 38 | |
| 39 | #define TRACE_CT(qpk, sz) do { IF_TRACING(T_KEYSET, { \ |
| 40 | trace_block(T_CRYPTO, "crypto: encrypted packet", (qpk), (sz)); \ |
| 41 | }) } while (0) |
| 42 | |
| 43 | #define TRACE_MAC(qmac, tagsz) do { IF_TRACING(T_KEYSET, { \ |
| 44 | trace_block(T_CRYPTO, "crypto: computed MAC", (qmac), (tagsz)); \ |
| 45 | }) } while (0) |
| 46 | |
| 47 | #define TRACE_MACERR(pmac, tagsz) do { IF_TRACING(T_KEYSET, { \ |
| 48 | trace(T_KEYSET, "keyset: incorrect MAC: decryption failed"); \ |
| 49 | trace_block(T_CRYPTO, "crypto: expected MAC", (pmac), (tagsz)); \ |
| 50 | }) } while (0) |
| 51 | |
| 52 | /* --- @derivekey@ --- * |
| 53 | * |
| 54 | * Arguments: @octet *k@ = pointer to an output buffer of at least |
| 55 | * @MAXHASHSZ@ bytes |
| 56 | * @size_t ksz@ = actual size wanted (for tracing) |
| 57 | * @const deriveargs@ = derivation parameters, as passed into |
| 58 | * @genkeys@ |
| 59 | * @int dir@ = direction for the key (@DIR_IN@ or @DIR_OUT@) |
| 60 | * @const char *what@ = label for the key (input to derivation) |
| 61 | * |
| 62 | * Returns: --- |
| 63 | * |
| 64 | * Use: Derives a session key, for use on incoming or outgoing data. |
| 65 | */ |
| 66 | |
| 67 | static void derivekey(octet *k, size_t ksz, const deriveargs *a, |
| 68 | int dir, const char *what) |
| 69 | { |
| 70 | const gchash *hc = a->hc; |
| 71 | ghash *h; |
| 72 | |
| 73 | assert(ksz <= hc->hashsz); |
| 74 | assert(hc->hashsz <= MAXHASHSZ); |
| 75 | h = GH_INIT(hc); |
| 76 | GH_HASH(h, a->what, strlen(a->what)); GH_HASH(h, what, strlen(what) + 1); |
| 77 | switch (dir) { |
| 78 | case DIR_IN: |
| 79 | if (a->x) GH_HASH(h, a->k, a->x); |
| 80 | if (a->y != a->x) GH_HASH(h, a->k + a->x, a->y - a->x); |
| 81 | break; |
| 82 | case DIR_OUT: |
| 83 | if (a->y != a->x) GH_HASH(h, a->k + a->x, a->y - a->x); |
| 84 | if (a->x) GH_HASH(h, a->k, a->x); |
| 85 | break; |
| 86 | default: |
| 87 | abort(); |
| 88 | } |
| 89 | GH_HASH(h, a->k + a->y, a->z - a->y); |
| 90 | GH_DONE(h, k); |
| 91 | GH_DESTROY(h); |
| 92 | IF_TRACING(T_KEYSET, { IF_TRACING(T_CRYPTO, { |
| 93 | char _buf[32]; |
| 94 | sprintf(_buf, "crypto: %s key %s", dir ? "outgoing" : "incoming", what); |
| 95 | trace_block(T_CRYPTO, _buf, k, ksz); |
| 96 | }) }) |
| 97 | } |
| 98 | |
| 99 | /*----- Common functionality for generic-composition transforms -----------*/ |
| 100 | |
| 101 | #define CHECK_MAC(h, pmac, tagsz) do { \ |
| 102 | ghash *_h = (h); \ |
| 103 | const octet *_pmac = (pmac); \ |
| 104 | size_t _tagsz = (tagsz); \ |
| 105 | octet *_mac = GH_DONE(_h, 0); \ |
| 106 | int _eq = ct_memeq(_mac, _pmac, _tagsz); \ |
| 107 | TRACE_MAC(_mac, _tagsz); \ |
| 108 | GH_DESTROY(_h); \ |
| 109 | if (!_eq) { \ |
| 110 | TRACE_MACERR(_pmac, _tagsz); \ |
| 111 | return (KSERR_DECRYPT); \ |
| 112 | } \ |
| 113 | } while (0) |
| 114 | |
| 115 | typedef struct gencomp_algs { |
| 116 | const gccipher *c; size_t cksz; |
| 117 | const gcmac *m; size_t mksz; size_t tagsz; |
| 118 | } gencomp_algs; |
| 119 | |
| 120 | typedef struct gencomp_chal { |
| 121 | bulkchal _b; |
| 122 | gmac *m; |
| 123 | } gencomp_chal; |
| 124 | |
| 125 | static int gencomp_getalgs(gencomp_algs *a, const algswitch *asw, |
| 126 | dstr *e, key_file *kf, key *k) |
| 127 | { |
| 128 | const char *p; |
| 129 | char *q, *qq; |
| 130 | unsigned long n; |
| 131 | dstr d = DSTR_INIT; |
| 132 | int rc = -1; |
| 133 | |
| 134 | /* --- Symmetric encryption --- */ |
| 135 | |
| 136 | if ((p = key_getattr(kf, k, "cipher")) == 0) p = "blowfish-cbc"; |
| 137 | if ((a->c = gcipher_byname(p)) == 0) { |
| 138 | a_format(e, "unknown-cipher", "%s", p, A_END); |
| 139 | goto done; |
| 140 | } |
| 141 | |
| 142 | /* --- Message authentication --- */ |
| 143 | |
| 144 | if ((p = key_getattr(kf, k, "mac")) != 0) { |
| 145 | dstr_reset(&d); |
| 146 | dstr_puts(&d, p); |
| 147 | if ((q = strrchr(d.buf, '/')) != 0) |
| 148 | *q++ = 0; |
| 149 | if ((a->m = gmac_byname(d.buf)) == 0) { |
| 150 | a_format(e, "unknown-mac", "%s", d.buf, A_END); |
| 151 | goto done; |
| 152 | } |
| 153 | if (!q) |
| 154 | a->tagsz = a->m->hashsz; |
| 155 | else { |
| 156 | n = strtoul(q, &qq, 0); |
| 157 | if (*qq) { |
| 158 | a_format(e, "bad-tag-length-string", "%s", q, A_END); |
| 159 | goto done; |
| 160 | } |
| 161 | if (n%8 || n/8 > a->m->hashsz) { |
| 162 | a_format(e, "bad-tag-length", "%lu", n, A_END); |
| 163 | goto done; |
| 164 | } |
| 165 | a->tagsz = n/8; |
| 166 | } |
| 167 | } else { |
| 168 | dstr_reset(&d); |
| 169 | dstr_putf(&d, "%s-hmac", asw->h->name); |
| 170 | if ((a->m = gmac_byname(d.buf)) == 0) { |
| 171 | a_format(e, "no-hmac-for-hash", "%s", asw->h->name, A_END); |
| 172 | goto done; |
| 173 | } |
| 174 | a->tagsz = asw->h->hashsz/2; |
| 175 | } |
| 176 | |
| 177 | rc = 0; |
| 178 | done: |
| 179 | dstr_destroy(&d); |
| 180 | return (rc); |
| 181 | } |
| 182 | |
| 183 | #ifndef NTRACE |
| 184 | static void gencomp_tracealgs(const gencomp_algs *a) |
| 185 | { |
| 186 | trace(T_CRYPTO, "crypto: cipher = %s", a->c->name); |
| 187 | trace(T_CRYPTO, "crypto: mac = %s/%lu", |
| 188 | a->m->name, (unsigned long)a->tagsz * 8); |
| 189 | } |
| 190 | #endif |
| 191 | |
| 192 | static int gencomp_checkalgs(gencomp_algs *a, const algswitch *asw, dstr *e) |
| 193 | { |
| 194 | /* --- Derive the key sizes --- * |
| 195 | * |
| 196 | * Must ensure that we have non-empty keys. This isn't ideal, but it |
| 197 | * provides a handy sanity check. Also must be based on a 64- or 128-bit |
| 198 | * block cipher or we can't do the data expiry properly. |
| 199 | */ |
| 200 | |
| 201 | if ((a->cksz = keysz(asw->hashsz, a->c->keysz)) == 0) { |
| 202 | a_format(e, "cipher", "%s", a->c->name, |
| 203 | "no-key-size", "%lu", (unsigned long)asw->hashsz, |
| 204 | A_END); |
| 205 | return (-1); |
| 206 | } |
| 207 | if ((a->mksz = keysz(asw->hashsz, a->m->keysz)) == 0) { |
| 208 | a_format(e, "mac", "%s", a->m->name, |
| 209 | "no-key-size", "%lu", (unsigned long)asw->hashsz, |
| 210 | A_END); |
| 211 | return (-1); |
| 212 | } |
| 213 | |
| 214 | return (0); |
| 215 | } |
| 216 | |
| 217 | static void gencomp_alginfo(const gencomp_algs *a, admin *adm) |
| 218 | { |
| 219 | a_info(adm, |
| 220 | "cipher=%s", a->c->name, |
| 221 | "cipher-keysz=%lu", (unsigned long)a->cksz, |
| 222 | "cipher-blksz=%lu", (unsigned long)a->c->blksz, |
| 223 | A_END); |
| 224 | a_info(adm, |
| 225 | "mac=%s", a->m->name, |
| 226 | "mac-keysz=%lu", (unsigned long)a->mksz, |
| 227 | "mac-tagsz=%lu", (unsigned long)a->tagsz, |
| 228 | A_END); |
| 229 | } |
| 230 | |
| 231 | static int gencomp_samealgsp(const gencomp_algs *a, const gencomp_algs *aa) |
| 232 | { |
| 233 | return (a->c == aa->c && |
| 234 | a->m == aa->m && a->tagsz == aa->tagsz); |
| 235 | } |
| 236 | |
| 237 | static size_t gencomp_expsz(const gencomp_algs *a) |
| 238 | { return (a->c->blksz < 16 ? MEG(64) : MEG(2048)); } |
| 239 | |
| 240 | static bulkchal *gencomp_genchal(const gencomp_algs *a) |
| 241 | { |
| 242 | gencomp_chal *gc = CREATE(gencomp_chal); |
| 243 | |
| 244 | rand_get(RAND_GLOBAL, buf_t, a->mksz); |
| 245 | gc->m = GM_KEY(a->m, buf_t, a->mksz); |
| 246 | gc->_b.tagsz = a->tagsz; |
| 247 | IF_TRACING(T_CHAL, { |
| 248 | trace(T_CHAL, "chal: generated new challenge key"); |
| 249 | trace_block(T_CRYPTO, "chal: new key", buf_t, a->mksz); |
| 250 | }) |
| 251 | return (&gc->_b); |
| 252 | } |
| 253 | |
| 254 | static int gencomp_chaltag(bulkchal *bc, const void *m, size_t msz, |
| 255 | uint32 seq, void *t) |
| 256 | { |
| 257 | gencomp_chal *gc = (gencomp_chal *)bc; |
| 258 | ghash *h = GM_INIT(gc->m); |
| 259 | |
| 260 | GH_HASHU32(h, seq); if (msz) GH_HASH(h, m, msz); |
| 261 | memcpy(t, GH_DONE(h, 0), bc->tagsz); |
| 262 | GH_DESTROY(h); |
| 263 | return (0); |
| 264 | } |
| 265 | |
| 266 | static int gencomp_chalvrf(bulkchal *bc, const void *m, size_t msz, |
| 267 | uint32 seq, const void *t) |
| 268 | { |
| 269 | gencomp_chal *gc = (gencomp_chal *)bc; |
| 270 | ghash *h = GM_INIT(gc->m); |
| 271 | int ok; |
| 272 | |
| 273 | GH_HASHU32(h, seq); if (msz) GH_HASH(h, m, msz); |
| 274 | ok = ct_memeq(GH_DONE(h, 0), t, gc->_b.tagsz); |
| 275 | GH_DESTROY(h); |
| 276 | return (ok ? 0 : -1); |
| 277 | } |
| 278 | |
| 279 | static void gencomp_freechal(bulkchal *bc) |
| 280 | { gencomp_chal *gc = (gencomp_chal *)bc; GM_DESTROY(gc->m); DESTROY(gc); } |
| 281 | |
| 282 | /*----- The original transform --------------------------------------------* |
| 283 | * |
| 284 | * We generate a random initialization vector (if the cipher needs one). We |
| 285 | * encrypt the input message with the cipher, and format the type, sequence |
| 286 | * number, IV, and ciphertext as follows. |
| 287 | * |
| 288 | * +------+ +------+---...---+------...------+ |
| 289 | * | type | | seq | iv | ciphertext | |
| 290 | * +------+ +------+---...---+------...------+ |
| 291 | * 32 32 blksz sz |
| 292 | * |
| 293 | * All of this is fed into the MAC to compute a tag. The type is not |
| 294 | * transmitted: the other end knows what type of message it expects, and the |
| 295 | * type is only here to prevent us from being confused because some other |
| 296 | * kind of ciphertext has been substituted. The tag is prepended to the |
| 297 | * remainder, to yield the finished cryptogram, as follows. |
| 298 | * |
| 299 | * +---...---+------+---...---+------...------+ |
| 300 | * | tag | seq | iv | ciphertext | |
| 301 | * +---...---+------+---...---+------...------+ |
| 302 | * tagsz 32 blksz sz |
| 303 | * |
| 304 | * Decryption: checks the overall size, verifies the tag, then decrypts the |
| 305 | * ciphertext and extracts the sequence number. |
| 306 | */ |
| 307 | |
| 308 | typedef struct v0_algs { |
| 309 | bulkalgs _b; |
| 310 | gencomp_algs ga; |
| 311 | } v0_algs; |
| 312 | |
| 313 | typedef struct v0_ctx { |
| 314 | bulkctx _b; |
| 315 | size_t tagsz; |
| 316 | struct { |
| 317 | gcipher *c; |
| 318 | gmac *m; |
| 319 | } d[NDIR]; |
| 320 | } v0_ctx; |
| 321 | |
| 322 | static bulkalgs *v0_getalgs(const algswitch *asw, dstr *e, |
| 323 | key_file *kf, key *k) |
| 324 | { |
| 325 | v0_algs *a = CREATE(v0_algs); |
| 326 | if (gencomp_getalgs(&a->ga, asw, e, kf, k)) { DESTROY(a); return (0); } |
| 327 | return (&a->_b); |
| 328 | } |
| 329 | |
| 330 | #ifndef NTRACE |
| 331 | static void v0_tracealgs(const bulkalgs *aa) |
| 332 | { const v0_algs *a = (const v0_algs *)aa; gencomp_tracealgs(&a->ga); } |
| 333 | #endif |
| 334 | |
| 335 | static int v0_checkalgs(bulkalgs *aa, const algswitch *asw, dstr *e) |
| 336 | { |
| 337 | v0_algs *a = (v0_algs *)aa; |
| 338 | if (gencomp_checkalgs(&a->ga, asw, e)) return (-1); |
| 339 | return (0); |
| 340 | } |
| 341 | |
| 342 | static int v0_samealgsp(const bulkalgs *aa, const bulkalgs *bb) |
| 343 | { |
| 344 | const v0_algs *a = (const v0_algs *)aa, *b = (const v0_algs *)bb; |
| 345 | return (gencomp_samealgsp(&a->ga, &b->ga)); |
| 346 | } |
| 347 | |
| 348 | static void v0_alginfo(const bulkalgs *aa, admin *adm) |
| 349 | { const v0_algs *a = (const v0_algs *)aa; gencomp_alginfo(&a->ga, adm); } |
| 350 | |
| 351 | static size_t v0_overhead(const bulkalgs *aa) |
| 352 | { |
| 353 | const v0_algs *a = (const v0_algs *)aa; |
| 354 | return (a->ga.tagsz + SEQSZ + a->ga.c->blksz); |
| 355 | } |
| 356 | |
| 357 | static size_t v0_expsz(const bulkalgs *aa) |
| 358 | { const v0_algs *a = (const v0_algs *)aa; return (gencomp_expsz(&a->ga)); } |
| 359 | |
| 360 | static bulkctx *v0_genkeys(const bulkalgs *aa, const deriveargs *da) |
| 361 | { |
| 362 | const v0_algs *a = (const v0_algs *)aa; |
| 363 | v0_ctx *bc = CREATE(v0_ctx); |
| 364 | octet k[MAXHASHSZ]; |
| 365 | int i; |
| 366 | |
| 367 | bc->tagsz = a->ga.tagsz; |
| 368 | for (i = 0; i < NDIR; i++) { |
| 369 | if (!(da->f&(1 << i))) { bc->d[i].c = 0; bc->d[i].m = 0; continue; } |
| 370 | derivekey(k, a->ga.cksz, da, i, "encryption"); |
| 371 | bc->d[i].c = GC_INIT(a->ga.c, k, a->ga.cksz); |
| 372 | derivekey(k, a->ga.mksz, da, i, "integrity"); |
| 373 | bc->d[i].m = GM_KEY(a->ga.m, k, a->ga.mksz); |
| 374 | } |
| 375 | return (&bc->_b); |
| 376 | } |
| 377 | |
| 378 | static bulkchal *v0_genchal(const bulkalgs *aa) |
| 379 | { |
| 380 | const v0_algs *a = (const v0_algs *)aa; |
| 381 | return (gencomp_genchal(&a->ga)); |
| 382 | } |
| 383 | #define v0_chaltag gencomp_chaltag |
| 384 | #define v0_chalvrf gencomp_chalvrf |
| 385 | #define v0_freechal gencomp_freechal |
| 386 | |
| 387 | static void v0_freealgs(bulkalgs *aa) |
| 388 | { v0_algs *a = (v0_algs *)aa; DESTROY(a); } |
| 389 | |
| 390 | static void v0_freectx(bulkctx *bbc) |
| 391 | { |
| 392 | v0_ctx *bc = (v0_ctx *)bbc; |
| 393 | int i; |
| 394 | |
| 395 | for (i = 0; i < NDIR; i++) { |
| 396 | if (bc->d[i].c) GC_DESTROY(bc->d[i].c); |
| 397 | if (bc->d[i].m) GM_DESTROY(bc->d[i].m); |
| 398 | } |
| 399 | DESTROY(bc); |
| 400 | } |
| 401 | |
| 402 | static int v0_encrypt(bulkctx *bbc, unsigned ty, |
| 403 | buf *b, buf *bb, uint32 seq) |
| 404 | { |
| 405 | v0_ctx *bc = (v0_ctx *)bbc; |
| 406 | ghash *h; |
| 407 | gcipher *c = bc->d[DIR_OUT].c; |
| 408 | const octet *p = BCUR(b); |
| 409 | size_t sz = BLEFT(b); |
| 410 | octet *qmac, *qseq, *qiv, *qpk; |
| 411 | size_t ivsz; |
| 412 | size_t tagsz = bc->tagsz; |
| 413 | octet t[4]; |
| 414 | |
| 415 | assert(c); |
| 416 | ivsz = GC_CLASS(c)->blksz; |
| 417 | |
| 418 | /* --- Determine the ciphertext layout --- */ |
| 419 | |
| 420 | if (buf_ensure(bb, tagsz + SEQSZ + ivsz + sz)) return (0); |
| 421 | qmac = BCUR(bb); qseq = qmac + tagsz; qiv = qseq + SEQSZ; qpk = qiv + ivsz; |
| 422 | BSTEP(bb, tagsz + SEQSZ + ivsz + sz); |
| 423 | |
| 424 | /* --- Store the type --- * |
| 425 | * |
| 426 | * This isn't transmitted, but it's covered by the MAC. |
| 427 | */ |
| 428 | |
| 429 | STORE32(t, ty); |
| 430 | |
| 431 | /* --- Store the sequence number --- */ |
| 432 | |
| 433 | STORE32(qseq, seq); |
| 434 | |
| 435 | /* --- Establish an initialization vector if necessary --- */ |
| 436 | |
| 437 | if (ivsz) { |
| 438 | rand_get(RAND_GLOBAL, qiv, ivsz); |
| 439 | GC_SETIV(c, qiv); |
| 440 | TRACE_IV(qiv, ivsz); |
| 441 | } |
| 442 | |
| 443 | /* --- Encrypt the packet --- */ |
| 444 | |
| 445 | GC_ENCRYPT(c, p, qpk, sz); |
| 446 | TRACE_CT(qpk, sz); |
| 447 | |
| 448 | /* --- Compute a MAC over type, sequence number, IV, and ciphertext --- */ |
| 449 | |
| 450 | if (tagsz) { |
| 451 | h = GM_INIT(bc->d[DIR_OUT].m); |
| 452 | GH_HASH(h, t, sizeof(t)); |
| 453 | GH_HASH(h, qseq, SEQSZ + ivsz + sz); |
| 454 | memcpy(qmac, GH_DONE(h, 0), tagsz); |
| 455 | GH_DESTROY(h); |
| 456 | TRACE_MAC(qmac, tagsz); |
| 457 | } |
| 458 | |
| 459 | /* --- We're done --- */ |
| 460 | |
| 461 | return (0); |
| 462 | } |
| 463 | |
| 464 | static int v0_decrypt(bulkctx *bbc, unsigned ty, |
| 465 | buf *b, buf *bb, uint32 *seq) |
| 466 | { |
| 467 | v0_ctx *bc = (v0_ctx *)bbc; |
| 468 | const octet *pmac, *piv, *pseq, *ppk; |
| 469 | size_t psz = BLEFT(b); |
| 470 | size_t sz; |
| 471 | octet *q = BCUR(bb); |
| 472 | ghash *h; |
| 473 | gcipher *c = bc->d[DIR_IN].c; |
| 474 | size_t ivsz; |
| 475 | size_t tagsz = bc->tagsz; |
| 476 | octet t[4]; |
| 477 | |
| 478 | assert(c); |
| 479 | ivsz = GC_CLASS(c)->blksz; |
| 480 | |
| 481 | /* --- Break up the packet into its components --- */ |
| 482 | |
| 483 | if (psz < ivsz + SEQSZ + tagsz) { |
| 484 | T( trace(T_KEYSET, "keyset: block too small for keyset"); ) |
| 485 | return (KSERR_MALFORMED); |
| 486 | } |
| 487 | sz = psz - ivsz - SEQSZ - tagsz; |
| 488 | pmac = BCUR(b); pseq = pmac + tagsz; piv = pseq + SEQSZ; ppk = piv + ivsz; |
| 489 | STORE32(t, ty); |
| 490 | |
| 491 | /* --- Verify the MAC on the packet --- */ |
| 492 | |
| 493 | if (tagsz) { |
| 494 | h = GM_INIT(bc->d[DIR_IN].m); |
| 495 | GH_HASH(h, t, sizeof(t)); |
| 496 | GH_HASH(h, pseq, SEQSZ + ivsz + sz); |
| 497 | CHECK_MAC(h, pmac, tagsz); |
| 498 | } |
| 499 | |
| 500 | /* --- Decrypt the packet --- */ |
| 501 | |
| 502 | if (ivsz) { |
| 503 | TRACE_IV(piv, ivsz); |
| 504 | GC_SETIV(c, piv); |
| 505 | } |
| 506 | GC_DECRYPT(c, ppk, q, sz); |
| 507 | |
| 508 | /* --- Finished --- */ |
| 509 | |
| 510 | *seq = LOAD32(pseq); |
| 511 | BSTEP(bb, sz); |
| 512 | return (0); |
| 513 | } |
| 514 | |
| 515 | /*----- The implicit-IV transform -----------------------------------------* |
| 516 | * |
| 517 | * The v0 transform makes everything explicit. There's an IV because the |
| 518 | * cipher needs an IV; there's a sequence number because replay prevention |
| 519 | * needs a sequence number. |
| 520 | * |
| 521 | * This new transform works rather differently. We make use of a block |
| 522 | * cipher to encrypt the sequence number, and use that as the IV. We |
| 523 | * transmit the sequence number in the clear, as before. This reduces |
| 524 | * overhead; and it's not a significant privacy leak because the adversary |
| 525 | * can see the order in which the messages are transmitted -- i.e., the |
| 526 | * sequence numbers are almost completely predictable anyway. |
| 527 | * |
| 528 | * So, a MAC is computed over |
| 529 | * |
| 530 | * +------+ +------+------...------+ |
| 531 | * | type | | seq | ciphertext | |
| 532 | * +------+ +------+------...------+ |
| 533 | * 32 32 sz |
| 534 | * |
| 535 | * and we actually transmit the following as the cryptogram. |
| 536 | * |
| 537 | * +---...---+------+------...------+ |
| 538 | * | tag | seq | ciphertext | |
| 539 | * +---...---+------+------...------+ |
| 540 | * tagsz 32 sz |
| 541 | */ |
| 542 | |
| 543 | typedef struct iiv_algs { |
| 544 | bulkalgs _b; |
| 545 | gencomp_algs ga; |
| 546 | const gccipher *b; size_t bksz; |
| 547 | } iiv_algs; |
| 548 | |
| 549 | typedef struct iiv_ctx { |
| 550 | bulkctx _b; |
| 551 | size_t tagsz; |
| 552 | struct { |
| 553 | gcipher *c, *b; |
| 554 | gmac *m; |
| 555 | } d[NDIR]; |
| 556 | } iiv_ctx; |
| 557 | |
| 558 | |
| 559 | static bulkalgs *iiv_getalgs(const algswitch *asw, dstr *e, |
| 560 | key_file *kf, key *k) |
| 561 | { |
| 562 | iiv_algs *a = CREATE(iiv_algs); |
| 563 | dstr d = DSTR_INIT, dd = DSTR_INIT; |
| 564 | const char *p; |
| 565 | char *q; |
| 566 | |
| 567 | if (gencomp_getalgs(&a->ga, asw, e, kf, k)) goto fail; |
| 568 | |
| 569 | if ((p = key_getattr(kf, k, "blkc")) == 0) { |
| 570 | dstr_puts(&dd, a->ga.c->name); |
| 571 | if ((q = strrchr(dd.buf, '-')) != 0) *q = 0; |
| 572 | p = dd.buf; |
| 573 | } |
| 574 | dstr_putf(&d, "%s-ecb", p); |
| 575 | if ((a->b = gcipher_byname(d.buf)) == 0) { |
| 576 | a_format(e, "unknown-blkc", "%s", p, A_END); |
| 577 | goto fail; |
| 578 | } |
| 579 | |
| 580 | dstr_destroy(&d); dstr_destroy(&dd); |
| 581 | return (&a->_b); |
| 582 | fail: |
| 583 | dstr_destroy(&d); dstr_destroy(&dd); |
| 584 | DESTROY(a); |
| 585 | return (0); |
| 586 | } |
| 587 | |
| 588 | #ifndef NTRACE |
| 589 | static void iiv_tracealgs(const bulkalgs *aa) |
| 590 | { |
| 591 | const iiv_algs *a = (const iiv_algs *)aa; |
| 592 | |
| 593 | gencomp_tracealgs(&a->ga); |
| 594 | trace(T_CRYPTO, |
| 595 | "crypto: blkc = %.*s", (int)strlen(a->b->name) - 4, a->b->name); |
| 596 | } |
| 597 | #endif |
| 598 | |
| 599 | static int iiv_checkalgs(bulkalgs *aa, const algswitch *asw, dstr *e) |
| 600 | { |
| 601 | iiv_algs *a = (iiv_algs *)aa; |
| 602 | |
| 603 | if (gencomp_checkalgs(&a->ga, asw, e)) return (-1); |
| 604 | |
| 605 | if ((a->bksz = keysz(asw->hashsz, a->b->keysz)) == 0) { |
| 606 | a_format(e, "blkc", "%.*s", strlen(a->b->name) - 4, a->b->name, |
| 607 | "no-key-size", "%lu", (unsigned long)asw->hashsz, |
| 608 | A_END); |
| 609 | return (-1); |
| 610 | } |
| 611 | if (a->b->blksz < a->ga.c->blksz) { |
| 612 | a_format(e, "blkc", "%.*s", strlen(a->b->name) - 4, a->b->name, |
| 613 | "blksz-insufficient", A_END); |
| 614 | return (-1); |
| 615 | } |
| 616 | return (0); |
| 617 | } |
| 618 | |
| 619 | static int iiv_samealgsp(const bulkalgs *aa, const bulkalgs *bb) |
| 620 | { |
| 621 | const iiv_algs *a = (const iiv_algs *)aa, *b = (const iiv_algs *)bb; |
| 622 | return (gencomp_samealgsp(&a->ga, &b->ga) && a->b == b->b); |
| 623 | } |
| 624 | |
| 625 | static void iiv_alginfo(const bulkalgs *aa, admin *adm) |
| 626 | { |
| 627 | const iiv_algs *a = (const iiv_algs *)aa; |
| 628 | gencomp_alginfo(&a->ga, adm); |
| 629 | a_info(adm, |
| 630 | "blkc=%.*s", strlen(a->b->name) - 4, a->b->name, |
| 631 | "blkc-keysz=%lu", (unsigned long)a->bksz, |
| 632 | "blkc-blksz=%lu", (unsigned long)a->b->blksz, |
| 633 | A_END); |
| 634 | } |
| 635 | |
| 636 | static size_t iiv_overhead(const bulkalgs *aa) |
| 637 | { const iiv_algs *a = (const iiv_algs *)aa; return (a->ga.tagsz + SEQSZ); } |
| 638 | |
| 639 | static size_t iiv_expsz(const bulkalgs *aa) |
| 640 | { |
| 641 | const iiv_algs *a = (const iiv_algs *)aa; |
| 642 | return (gencomp_expsz(&a->ga)); |
| 643 | } |
| 644 | |
| 645 | static bulkctx *iiv_genkeys(const bulkalgs *aa, const deriveargs *da) |
| 646 | { |
| 647 | const iiv_algs *a = (const iiv_algs *)aa; |
| 648 | iiv_ctx *bc = CREATE(iiv_ctx); |
| 649 | octet k[MAXHASHSZ]; |
| 650 | int i; |
| 651 | |
| 652 | bc->tagsz = a->ga.tagsz; |
| 653 | for (i = 0; i < NDIR; i++) { |
| 654 | if (!(da->f&(1 << i))) |
| 655 | { bc->d[i].c = 0; bc->d[i].b = 0; bc->d[i].m = 0; continue; } |
| 656 | derivekey(k, a->ga.cksz, da, i, "encryption"); |
| 657 | bc->d[i].c = GC_INIT(a->ga.c, k, a->ga.cksz); |
| 658 | derivekey(k, a->bksz, da, i, "blkc"); |
| 659 | bc->d[i].b = GC_INIT(a->b, k, a->bksz); |
| 660 | derivekey(k, a->ga.mksz, da, i, "integrity"); |
| 661 | bc->d[i].m = GM_KEY(a->ga.m, k, a->ga.mksz); |
| 662 | } |
| 663 | return (&bc->_b); |
| 664 | } |
| 665 | |
| 666 | static bulkchal *iiv_genchal(const bulkalgs *aa) |
| 667 | { |
| 668 | const iiv_algs *a = (const iiv_algs *)aa; |
| 669 | return (gencomp_genchal(&a->ga)); |
| 670 | } |
| 671 | #define iiv_chaltag gencomp_chaltag |
| 672 | #define iiv_chalvrf gencomp_chalvrf |
| 673 | #define iiv_freechal gencomp_freechal |
| 674 | |
| 675 | static void iiv_freealgs(bulkalgs *aa) |
| 676 | { iiv_algs *a = (iiv_algs *)aa; DESTROY(a); } |
| 677 | |
| 678 | static void iiv_freectx(bulkctx *bbc) |
| 679 | { |
| 680 | iiv_ctx *bc = (iiv_ctx *)bbc; |
| 681 | int i; |
| 682 | |
| 683 | for (i = 0; i < NDIR; i++) { |
| 684 | if (bc->d[i].c) GC_DESTROY(bc->d[i].c); |
| 685 | if (bc->d[i].b) GC_DESTROY(bc->d[i].b); |
| 686 | if (bc->d[i].m) GM_DESTROY(bc->d[i].m); |
| 687 | } |
| 688 | DESTROY(bc); |
| 689 | } |
| 690 | |
| 691 | #define TRACE_PRESEQ(qseq, ivsz) do { IF_TRACING(T_KEYSET, { \ |
| 692 | trace_block(T_CRYPTO, "crypto: IV derivation input", (qseq), (ivsz)); \ |
| 693 | }) } while (0) |
| 694 | |
| 695 | static int iiv_encrypt(bulkctx *bbc, unsigned ty, |
| 696 | buf *b, buf *bb, uint32 seq) |
| 697 | { |
| 698 | iiv_ctx *bc = (iiv_ctx *)bbc; |
| 699 | ghash *h; |
| 700 | gcipher *c = bc->d[DIR_OUT].c, *blkc = bc->d[DIR_OUT].b; |
| 701 | const octet *p = BCUR(b); |
| 702 | size_t sz = BLEFT(b); |
| 703 | octet *qmac, *qseq, *qpk; |
| 704 | size_t ivsz, blkcsz; |
| 705 | size_t tagsz = bc->tagsz; |
| 706 | octet t[4]; |
| 707 | |
| 708 | assert(c); assert(blkc); |
| 709 | ivsz = GC_CLASS(c)->blksz; |
| 710 | blkcsz = GC_CLASS(blkc)->blksz; |
| 711 | |
| 712 | /* --- Determine the ciphertext layout --- */ |
| 713 | |
| 714 | if (buf_ensure(bb, tagsz + SEQSZ + sz)) return (0); |
| 715 | qmac = BCUR(bb); qseq = qmac + tagsz; qpk = qseq + SEQSZ; |
| 716 | BSTEP(bb, tagsz + SEQSZ + sz); |
| 717 | |
| 718 | /* --- Store the type --- * |
| 719 | * |
| 720 | * This isn't transmitted, but it's covered by the MAC. |
| 721 | */ |
| 722 | |
| 723 | STORE32(t, ty); |
| 724 | |
| 725 | /* --- Store the sequence number --- */ |
| 726 | |
| 727 | STORE32(qseq, seq); |
| 728 | |
| 729 | /* --- Establish an initialization vector if necessary --- */ |
| 730 | |
| 731 | if (ivsz) { |
| 732 | memset(buf_u, 0, blkcsz - SEQSZ); |
| 733 | memcpy(buf_u + blkcsz - SEQSZ, qseq, SEQSZ); |
| 734 | TRACE_PRESEQ(buf_u, ivsz); |
| 735 | GC_ENCRYPT(blkc, buf_u, buf_u, blkcsz); |
| 736 | GC_SETIV(c, buf_u); |
| 737 | TRACE_IV(buf_u, ivsz); |
| 738 | } |
| 739 | |
| 740 | /* --- Encrypt the packet --- */ |
| 741 | |
| 742 | GC_ENCRYPT(c, p, qpk, sz); |
| 743 | TRACE_CT(qpk, sz); |
| 744 | |
| 745 | /* --- Compute a MAC over type, sequence number, and ciphertext --- */ |
| 746 | |
| 747 | if (tagsz) { |
| 748 | h = GM_INIT(bc->d[DIR_OUT].m); |
| 749 | GH_HASH(h, t, sizeof(t)); |
| 750 | GH_HASH(h, qseq, SEQSZ + sz); |
| 751 | memcpy(qmac, GH_DONE(h, 0), tagsz); |
| 752 | GH_DESTROY(h); |
| 753 | TRACE_MAC(qmac, tagsz); |
| 754 | } |
| 755 | |
| 756 | /* --- We're done --- */ |
| 757 | |
| 758 | return (0); |
| 759 | } |
| 760 | |
| 761 | static int iiv_decrypt(bulkctx *bbc, unsigned ty, |
| 762 | buf *b, buf *bb, uint32 *seq) |
| 763 | { |
| 764 | iiv_ctx *bc = (iiv_ctx *)bbc; |
| 765 | const octet *pmac, *pseq, *ppk; |
| 766 | size_t psz = BLEFT(b); |
| 767 | size_t sz; |
| 768 | octet *q = BCUR(bb); |
| 769 | ghash *h; |
| 770 | gcipher *c = bc->d[DIR_IN].c, *blkc = bc->d[DIR_IN].b; |
| 771 | size_t ivsz, blkcsz; |
| 772 | size_t tagsz = bc->tagsz; |
| 773 | octet t[4]; |
| 774 | |
| 775 | assert(c); assert(blkc); |
| 776 | ivsz = GC_CLASS(c)->blksz; |
| 777 | blkcsz = GC_CLASS(blkc)->blksz; |
| 778 | |
| 779 | /* --- Break up the packet into its components --- */ |
| 780 | |
| 781 | if (psz < SEQSZ + tagsz) { |
| 782 | T( trace(T_KEYSET, "keyset: block too small for keyset"); ) |
| 783 | return (KSERR_MALFORMED); |
| 784 | } |
| 785 | sz = psz - SEQSZ - tagsz; |
| 786 | pmac = BCUR(b); pseq = pmac + tagsz; ppk = pseq + SEQSZ; |
| 787 | STORE32(t, ty); |
| 788 | |
| 789 | /* --- Verify the MAC on the packet --- */ |
| 790 | |
| 791 | if (tagsz) { |
| 792 | h = GM_INIT(bc->d[DIR_IN].m); |
| 793 | GH_HASH(h, t, sizeof(t)); |
| 794 | GH_HASH(h, pseq, SEQSZ + sz); |
| 795 | CHECK_MAC(h, pmac, tagsz); |
| 796 | } |
| 797 | |
| 798 | /* --- Decrypt the packet --- */ |
| 799 | |
| 800 | if (ivsz) { |
| 801 | memset(buf_u, 0, blkcsz - SEQSZ); |
| 802 | memcpy(buf_u + blkcsz - SEQSZ, pseq, SEQSZ); |
| 803 | TRACE_PRESEQ(buf_u, ivsz); |
| 804 | GC_ENCRYPT(blkc, buf_u, buf_u, blkcsz); |
| 805 | GC_SETIV(c, buf_u); |
| 806 | TRACE_IV(buf_u, ivsz); |
| 807 | } |
| 808 | GC_DECRYPT(c, ppk, q, sz); |
| 809 | |
| 810 | /* --- Finished --- */ |
| 811 | |
| 812 | *seq = LOAD32(pseq); |
| 813 | BSTEP(bb, sz); |
| 814 | return (0); |
| 815 | } |
| 816 | |
| 817 | /*----- The NaCl box transform --------------------------------------------* |
| 818 | * |
| 819 | * This transform is very similar to the NaCl `crypto_secretbox' transform |
| 820 | * described in Bernstein, `Cryptography in NaCl', with the difference that, |
| 821 | * rather than using XSalsa20, we use either Salsa20/r or ChaChar, because we |
| 822 | * have no need of XSalsa20's extended nonce. The default cipher is Salsa20. |
| 823 | * |
| 824 | * Salsa20 and ChaCha accept a 64-bit nonce. The low 32 bits are the |
| 825 | * sequence number, and the high 32 bits are the type, both big-endian. |
| 826 | * |
| 827 | * +------+------+ |
| 828 | * | seq | type | |
| 829 | * +------+------+ |
| 830 | * 32 32 |
| 831 | * |
| 832 | * A stream is generated by concatenating the raw output blocks generated |
| 833 | * with this nonce and successive counter values starting from zero. The |
| 834 | * first 32 bytes of the stream are used as a key for Poly1305: the first 16 |
| 835 | * bytes are the universal hash key r, and the second 16 bytes are the mask |
| 836 | * value s. |
| 837 | * |
| 838 | * +------+------+ +------...------+ |
| 839 | * | r | s | | keystream | |
| 840 | * +------+------+ +------...------+ |
| 841 | * 128 128 sz |
| 842 | * |
| 843 | * The remainder of the stream is XORed with the incoming plaintext to form a |
| 844 | * ciphertext with the same length. The ciphertext (only) is then tagged |
| 845 | * using Poly1305. The tag, sequence number, and ciphertext are concatenated |
| 846 | * in this order, and transmitted. |
| 847 | * |
| 848 | * |
| 849 | * +---...---+------+------...------+ |
| 850 | * | tag | seq | ciphertext | |
| 851 | * +---...---+------+------...------+ |
| 852 | * 128 32 sz |
| 853 | * |
| 854 | * Note that there is no need to authenticate the type separately, since it |
| 855 | * was used to select the cipher nonce, and hence the Poly1305 key. The |
| 856 | * Poly1305 tag length is fixed. |
| 857 | */ |
| 858 | |
| 859 | typedef struct naclbox_algs { |
| 860 | bulkalgs _b; |
| 861 | const gccipher *c; size_t cksz; |
| 862 | } naclbox_algs; |
| 863 | |
| 864 | typedef struct naclbox_ctx { |
| 865 | bulkctx _b; |
| 866 | struct { gcipher *c; } d[NDIR]; |
| 867 | } naclbox_ctx; |
| 868 | |
| 869 | |
| 870 | static bulkalgs *naclbox_getalgs(const algswitch *asw, dstr *e, |
| 871 | key_file *kf, key *k) |
| 872 | { |
| 873 | naclbox_algs *a = CREATE(naclbox_algs); |
| 874 | const char *p; |
| 875 | char *qq; |
| 876 | unsigned long n; |
| 877 | |
| 878 | /* --- Collect the selected cipher and check that it's supported --- */ |
| 879 | |
| 880 | p = key_getattr(kf, k, "cipher"); |
| 881 | if (!p || strcmp(p, "salsa20") == 0) a->c = &salsa20; |
| 882 | else if (strcmp(p, "salsa20/12") == 0) a->c = &salsa2012; |
| 883 | else if (strcmp(p, "salsa20/8") == 0) a->c = &salsa208; |
| 884 | else if (strcmp(p, "chacha20") == 0) a->c = &chacha20; |
| 885 | else if (strcmp(p, "chacha12") == 0) a->c = &chacha12; |
| 886 | else if (strcmp(p, "chacha8") == 0) a->c = &chacha8; |
| 887 | else { |
| 888 | a_format(e, "unknown-cipher", "%s", p, A_END); |
| 889 | goto fail; |
| 890 | } |
| 891 | |
| 892 | /* --- Collect the selected MAC, and check the tag length --- */ |
| 893 | |
| 894 | p = key_getattr(kf, k, "mac"); |
| 895 | if (!p) |
| 896 | ; |
| 897 | else if (strncmp(p, "poly1305", 8) != 0 || (p[8] && p[8] != '/')) { |
| 898 | a_format(e, "unknown-mac", "%s", p, A_END); |
| 899 | goto fail; |
| 900 | } else if (p[8] == '/') { |
| 901 | n = strtoul(p + 9, &qq, 0); |
| 902 | if (*qq) { |
| 903 | a_format(e, "bad-tag-length-string", "%s", p + 9, A_END); |
| 904 | goto fail; |
| 905 | } |
| 906 | if (n != 128) { |
| 907 | a_format(e, "bad-tag-length", "%lu", n, A_END); |
| 908 | goto fail; |
| 909 | } |
| 910 | } |
| 911 | |
| 912 | return (&a->_b); |
| 913 | fail: |
| 914 | DESTROY(a); |
| 915 | return (0); |
| 916 | } |
| 917 | |
| 918 | #ifndef NTRACE |
| 919 | static void naclbox_tracealgs(const bulkalgs *aa) |
| 920 | { |
| 921 | const naclbox_algs *a = (const naclbox_algs *)aa; |
| 922 | |
| 923 | trace(T_CRYPTO, "crypto: cipher = %s", a->c->name); |
| 924 | trace(T_CRYPTO, "crypto: mac = poly1305/128"); |
| 925 | } |
| 926 | #endif |
| 927 | |
| 928 | static int naclbox_checkalgs(bulkalgs *aa, const algswitch *asw, dstr *e) |
| 929 | { |
| 930 | naclbox_algs *a = (naclbox_algs *)aa; |
| 931 | |
| 932 | if ((a->cksz = keysz(asw->hashsz, a->c->keysz)) == 0) { |
| 933 | a_format(e, "cipher", "%s", a->c->name, |
| 934 | "no-key-size", "%lu", (unsigned long)asw->hashsz, |
| 935 | A_END); |
| 936 | return (-1); |
| 937 | } |
| 938 | return (0); |
| 939 | } |
| 940 | |
| 941 | static int naclbox_samealgsp(const bulkalgs *aa, const bulkalgs *bb) |
| 942 | { |
| 943 | const naclbox_algs *a = (const naclbox_algs *)aa, |
| 944 | *b = (const naclbox_algs *)bb; |
| 945 | return (a->c == b->c); |
| 946 | } |
| 947 | |
| 948 | static void naclbox_alginfo(const bulkalgs *aa, admin *adm) |
| 949 | { |
| 950 | const naclbox_algs *a = (const naclbox_algs *)aa; |
| 951 | a_info(adm, "cipher=%s", a->c->name, "cipher-keysz=32", A_END); |
| 952 | a_info(adm, "mac=poly1305", "mac-tagsz=16", A_END); |
| 953 | } |
| 954 | |
| 955 | static size_t naclbox_overhead(const bulkalgs *aa) |
| 956 | { return (POLY1305_TAGSZ + SEQSZ); } |
| 957 | |
| 958 | static size_t naclbox_expsz(const bulkalgs *aa) |
| 959 | { return (MEG(2048)); } |
| 960 | |
| 961 | static bulkctx *naclbox_genkeys(const bulkalgs *aa, const deriveargs *da) |
| 962 | { |
| 963 | const naclbox_algs *a = (const naclbox_algs *)aa; |
| 964 | naclbox_ctx *bc = CREATE(naclbox_ctx); |
| 965 | octet k[MAXHASHSZ]; |
| 966 | int i; |
| 967 | |
| 968 | for (i = 0; i < NDIR; i++) { |
| 969 | if (!(da->f&(1 << i))) { bc->d[i].c = 0; continue; } |
| 970 | derivekey(k, a->cksz, da, i, "encryption"); |
| 971 | bc->d[i].c = GC_INIT(a->c, k, a->cksz); |
| 972 | } |
| 973 | return (&bc->_b); |
| 974 | } |
| 975 | |
| 976 | typedef struct naclbox_chal { |
| 977 | bulkchal _b; |
| 978 | gcipher *c; |
| 979 | } naclbox_chal; |
| 980 | |
| 981 | static bulkchal *naclbox_genchal(const bulkalgs *aa) |
| 982 | { |
| 983 | const naclbox_algs *a = (const naclbox_algs *)aa; |
| 984 | naclbox_chal *c = CREATE(naclbox_chal); |
| 985 | rand_get(RAND_GLOBAL, buf_t, a->cksz); |
| 986 | c->c = GC_INIT(a->c, buf_t, a->cksz); |
| 987 | IF_TRACING(T_CHAL, { |
| 988 | trace(T_CHAL, "chal: generated new challenge key"); |
| 989 | trace_block(T_CRYPTO, "chal: new key", buf_t, a->cksz); |
| 990 | }) |
| 991 | c->_b.tagsz = POLY1305_TAGSZ; |
| 992 | return (&c->_b); |
| 993 | } |
| 994 | |
| 995 | static int naclbox_chaltag(bulkchal *bc, const void *m, size_t msz, |
| 996 | uint32 seq, void *t) |
| 997 | { |
| 998 | naclbox_chal *c = (naclbox_chal *)bc; |
| 999 | poly1305_key pk; |
| 1000 | poly1305_ctx pm; |
| 1001 | octet b[POLY1305_KEYSZ + POLY1305_MASKSZ]; |
| 1002 | |
| 1003 | assert(SALSA20_NONCESZ <= sizeof(b)); |
| 1004 | memset(b, 0, SALSA20_NONCESZ - 4); STORE32(b + SALSA20_NONCESZ - 4, seq); |
| 1005 | GC_SETIV(c->c, b); GC_ENCRYPT(c->c, 0, b, sizeof(b)); |
| 1006 | poly1305_keyinit(&pk, b, POLY1305_KEYSZ); |
| 1007 | poly1305_macinit(&pm, &pk, b + POLY1305_KEYSZ); |
| 1008 | if (msz) poly1305_hash(&pm, m, msz); |
| 1009 | poly1305_done(&pm, t); |
| 1010 | return (0); |
| 1011 | } |
| 1012 | |
| 1013 | static int naclbox_chalvrf(bulkchal *bc, const void *m, size_t msz, |
| 1014 | uint32 seq, const void *t) |
| 1015 | { |
| 1016 | naclbox_chal *c = (naclbox_chal *)bc; |
| 1017 | poly1305_key pk; |
| 1018 | poly1305_ctx pm; |
| 1019 | octet b[POLY1305_KEYSZ + POLY1305_MASKSZ]; |
| 1020 | |
| 1021 | assert(SALSA20_NONCESZ <= sizeof(b)); |
| 1022 | memset(b, 0, SALSA20_NONCESZ - 4); STORE32(b + SALSA20_NONCESZ - 4, seq); |
| 1023 | GC_SETIV(c->c, b); GC_ENCRYPT(c->c, 0, b, sizeof(b)); |
| 1024 | poly1305_keyinit(&pk, b, POLY1305_KEYSZ); |
| 1025 | poly1305_macinit(&pm, &pk, b + POLY1305_KEYSZ); |
| 1026 | if (msz) poly1305_hash(&pm, m, msz); |
| 1027 | assert(POLY1305_TAGSZ <= sizeof(b)); poly1305_done(&pm, b); |
| 1028 | return (ct_memeq(t, b, POLY1305_TAGSZ) ? 0 : -1); |
| 1029 | } |
| 1030 | |
| 1031 | static void naclbox_freechal(bulkchal *bc) |
| 1032 | { naclbox_chal *c = (naclbox_chal *)bc; GC_DESTROY(c->c); DESTROY(c); } |
| 1033 | |
| 1034 | static void naclbox_freealgs(bulkalgs *aa) |
| 1035 | { naclbox_algs *a = (naclbox_algs *)aa; DESTROY(a); } |
| 1036 | |
| 1037 | static void naclbox_freectx(bulkctx *bbc) |
| 1038 | { |
| 1039 | naclbox_ctx *bc = (naclbox_ctx *)bbc; |
| 1040 | int i; |
| 1041 | |
| 1042 | for (i = 0; i < NDIR; i++) { if (bc->d[i].c) GC_DESTROY(bc->d[i].c); } |
| 1043 | DESTROY(bc); |
| 1044 | } |
| 1045 | |
| 1046 | static int naclbox_encrypt(bulkctx *bbc, unsigned ty, |
| 1047 | buf *b, buf *bb, uint32 seq) |
| 1048 | { |
| 1049 | naclbox_ctx *bc = (naclbox_ctx *)bbc; |
| 1050 | gcipher *c = bc->d[DIR_OUT].c; |
| 1051 | poly1305_key polyk; |
| 1052 | poly1305_ctx poly; |
| 1053 | const octet *p = BCUR(b); |
| 1054 | size_t sz = BLEFT(b); |
| 1055 | octet *qmac, *qseq, *qpk; |
| 1056 | |
| 1057 | assert(c); |
| 1058 | |
| 1059 | /* --- Determine the ciphertext layout --- */ |
| 1060 | |
| 1061 | if (buf_ensure(bb, POLY1305_TAGSZ + SEQSZ + sz)) return (0); |
| 1062 | qmac = BCUR(bb); qseq = qmac + POLY1305_TAGSZ; qpk = qseq + SEQSZ; |
| 1063 | BSTEP(bb, POLY1305_TAGSZ + SEQSZ + sz); |
| 1064 | |
| 1065 | /* --- Construct and set the nonce --- */ |
| 1066 | |
| 1067 | STORE32(qseq, seq); |
| 1068 | memcpy(buf_u, qseq, SEQSZ); STORE32(buf_u + SEQSZ, ty); |
| 1069 | GC_SETIV(c, buf_u); |
| 1070 | TRACE_IV(buf_u, SALSA20_NONCESZ); |
| 1071 | |
| 1072 | /* --- Determine the MAC key --- */ |
| 1073 | |
| 1074 | GC_ENCRYPT(c, 0, buf_u, POLY1305_KEYSZ + POLY1305_MASKSZ); |
| 1075 | poly1305_keyinit(&polyk, buf_u, POLY1305_KEYSZ); |
| 1076 | poly1305_macinit(&poly, &polyk, buf_u + POLY1305_KEYSZ); |
| 1077 | |
| 1078 | /* --- Encrypt the message --- */ |
| 1079 | |
| 1080 | GC_ENCRYPT(c, p, qpk, sz); |
| 1081 | TRACE_CT(qpk, sz); |
| 1082 | |
| 1083 | /* --- Compute the MAC --- */ |
| 1084 | |
| 1085 | poly1305_hash(&poly, qpk, sz); |
| 1086 | poly1305_done(&poly, qmac); |
| 1087 | TRACE_MAC(qmac, POLY1305_TAGSZ); |
| 1088 | |
| 1089 | /* --- We're done --- */ |
| 1090 | |
| 1091 | return (0); |
| 1092 | } |
| 1093 | |
| 1094 | static int naclbox_decrypt(bulkctx *bbc, unsigned ty, |
| 1095 | buf *b, buf *bb, uint32 *seq) |
| 1096 | { |
| 1097 | naclbox_ctx *bc = (naclbox_ctx *)bbc; |
| 1098 | gcipher *c = bc->d[DIR_IN].c; |
| 1099 | poly1305_key polyk; |
| 1100 | poly1305_ctx poly; |
| 1101 | const octet *pmac, *pseq, *ppk; |
| 1102 | size_t psz = BLEFT(b); |
| 1103 | size_t sz; |
| 1104 | octet *q = BCUR(bb); |
| 1105 | |
| 1106 | assert(c); |
| 1107 | |
| 1108 | /* --- Break up the packet into its components --- */ |
| 1109 | |
| 1110 | if (psz < SEQSZ + POLY1305_TAGSZ) { |
| 1111 | T( trace(T_KEYSET, "keyset: block too small for keyset"); ) |
| 1112 | return (KSERR_MALFORMED); |
| 1113 | } |
| 1114 | sz = psz - SEQSZ - POLY1305_TAGSZ; |
| 1115 | pmac = BCUR(b); pseq = pmac + POLY1305_TAGSZ; ppk = pseq + SEQSZ; |
| 1116 | |
| 1117 | /* --- Construct and set the nonce --- */ |
| 1118 | |
| 1119 | memcpy(buf_u, pseq, SEQSZ); STORE32(buf_u + SEQSZ, ty); |
| 1120 | GC_SETIV(c, buf_u); |
| 1121 | TRACE_IV(buf_u, SALSA20_NONCESZ); |
| 1122 | |
| 1123 | /* --- Determine the MAC key --- */ |
| 1124 | |
| 1125 | GC_ENCRYPT(c, 0, buf_u, POLY1305_KEYSZ + POLY1305_MASKSZ); |
| 1126 | poly1305_keyinit(&polyk, buf_u, POLY1305_KEYSZ); |
| 1127 | poly1305_macinit(&poly, &polyk, buf_u + POLY1305_KEYSZ); |
| 1128 | |
| 1129 | /* --- Verify the MAC on the packet --- */ |
| 1130 | |
| 1131 | poly1305_hash(&poly, ppk, sz); |
| 1132 | poly1305_done(&poly, buf_u); |
| 1133 | TRACE_MAC(buf_u, POLY1305_TAGSZ); |
| 1134 | if (!ct_memeq(buf_u, pmac, POLY1305_TAGSZ)) { |
| 1135 | TRACE_MACERR(pmac, POLY1305_TAGSZ); |
| 1136 | return (KSERR_DECRYPT); |
| 1137 | } |
| 1138 | |
| 1139 | /* --- Decrypt the packet --- */ |
| 1140 | |
| 1141 | GC_DECRYPT(c, ppk, q, sz); |
| 1142 | |
| 1143 | /* --- Finished --- */ |
| 1144 | |
| 1145 | *seq = LOAD32(pseq); |
| 1146 | BSTEP(bb, sz); |
| 1147 | return (0); |
| 1148 | } |
| 1149 | |
| 1150 | /*----- Bulk crypto transform table ---------------------------------------*/ |
| 1151 | |
| 1152 | const bulkops bulktab[] = { |
| 1153 | |
| 1154 | #define COMMA , |
| 1155 | |
| 1156 | #define BULK(name, pre) \ |
| 1157 | { name, pre##_getalgs, T( pre##_tracealgs COMMA ) \ |
| 1158 | pre##_checkalgs, pre##_samealgsp, \ |
| 1159 | pre##_alginfo, pre##_overhead, pre##_expsz, \ |
| 1160 | pre##_genkeys, pre##_genchal, pre##_freealgs, \ |
| 1161 | pre##_encrypt, pre##_decrypt, pre##_freectx, \ |
| 1162 | pre##_chaltag, pre##_chalvrf, pre##_freechal } |
| 1163 | |
| 1164 | BULK("v0", v0), |
| 1165 | BULK("iiv", iiv), |
| 1166 | BULK("naclbox", naclbox), |
| 1167 | |
| 1168 | #undef BULK |
| 1169 | { 0 } |
| 1170 | }; |
| 1171 | |
| 1172 | /*----- That's all, folks -------------------------------------------------*/ |