10Sstevel@tonic-gate /*
2*420Sstevel * Copyright 2003 Sun Microsystems, Inc. All rights reserved.
3*420Sstevel * Use is subject to license terms.
40Sstevel@tonic-gate */
5*420Sstevel
6*420Sstevel #pragma ident "%Z%%M% %I% %E% SMI"
7*420Sstevel
80Sstevel@tonic-gate /* $OpenBSD: bcrypt.c,v 1.16 2002/02/19 19:39:36 millert Exp $ */
90Sstevel@tonic-gate
100Sstevel@tonic-gate /*
110Sstevel@tonic-gate * Copyright 1997 Niels Provos <provos@physnet.uni-hamburg.de>
120Sstevel@tonic-gate * All rights reserved.
130Sstevel@tonic-gate *
140Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without
150Sstevel@tonic-gate * modification, are permitted provided that the following conditions
160Sstevel@tonic-gate * are met:
170Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright
180Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer.
190Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright
200Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the
210Sstevel@tonic-gate * documentation and/or other materials provided with the distribution.
220Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this software
230Sstevel@tonic-gate * must display the following acknowledgement:
240Sstevel@tonic-gate * This product includes software developed by Niels Provos.
250Sstevel@tonic-gate * 4. The name of the author may not be used to endorse or promote products
260Sstevel@tonic-gate * derived from this software without specific prior written permission.
270Sstevel@tonic-gate *
280Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
290Sstevel@tonic-gate * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
300Sstevel@tonic-gate * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
310Sstevel@tonic-gate * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
320Sstevel@tonic-gate * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
330Sstevel@tonic-gate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
340Sstevel@tonic-gate * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
350Sstevel@tonic-gate * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
360Sstevel@tonic-gate * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
370Sstevel@tonic-gate * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
380Sstevel@tonic-gate */
390Sstevel@tonic-gate
400Sstevel@tonic-gate /* This password hashing algorithm was designed by David Mazieres
410Sstevel@tonic-gate * <dm@lcs.mit.edu> and works as follows:
420Sstevel@tonic-gate *
430Sstevel@tonic-gate * 1. state := InitState ()
440Sstevel@tonic-gate * 2. state := ExpandKey (state, salt, password) 3.
450Sstevel@tonic-gate * REPEAT rounds:
460Sstevel@tonic-gate * state := ExpandKey (state, 0, salt)
470Sstevel@tonic-gate * state := ExpandKey(state, 0, password)
480Sstevel@tonic-gate * 4. ctext := "OrpheanBeholderScryDoubt"
490Sstevel@tonic-gate * 5. REPEAT 64:
500Sstevel@tonic-gate * ctext := Encrypt_ECB (state, ctext);
510Sstevel@tonic-gate * 6. RETURN Concatenate (salt, ctext);
520Sstevel@tonic-gate *
530Sstevel@tonic-gate */
540Sstevel@tonic-gate
550Sstevel@tonic-gate #if 0
560Sstevel@tonic-gate #include <stdio.h>
570Sstevel@tonic-gate #endif
580Sstevel@tonic-gate
590Sstevel@tonic-gate #include <stdio.h>
600Sstevel@tonic-gate #include <stdlib.h>
610Sstevel@tonic-gate #include <sys/types.h>
620Sstevel@tonic-gate #include <string.h>
630Sstevel@tonic-gate #include <pwd.h>
640Sstevel@tonic-gate #include <blf.h>
650Sstevel@tonic-gate
660Sstevel@tonic-gate extern uint32_t arc4random();
670Sstevel@tonic-gate
680Sstevel@tonic-gate /* This implementation is adaptable to current computing power.
690Sstevel@tonic-gate * You can have up to 2^31 rounds which should be enough for some
700Sstevel@tonic-gate * time to come.
710Sstevel@tonic-gate */
720Sstevel@tonic-gate
730Sstevel@tonic-gate #define BCRYPT_VERSION '2'
740Sstevel@tonic-gate #define BCRYPT_MAXSALT 16 /* Precomputation is just so nice */
750Sstevel@tonic-gate #define BCRYPT_BLOCKS 6 /* Ciphertext blocks */
760Sstevel@tonic-gate #define BCRYPT_MINROUNDS 16 /* we have log2(rounds) in salt */
770Sstevel@tonic-gate
780Sstevel@tonic-gate char *bcrypt_gensalt(uint8_t);
790Sstevel@tonic-gate
800Sstevel@tonic-gate static void encode_salt(char *, uint8_t *, uint16_t, uint8_t);
810Sstevel@tonic-gate static void encode_base64(uint8_t *, uint8_t *, uint16_t);
820Sstevel@tonic-gate static void decode_base64(uint8_t *, uint16_t, uint8_t *);
830Sstevel@tonic-gate
840Sstevel@tonic-gate static char encrypted[128]; /* _PASSWORD_LEN in <pwd.h> on OpenBSD */
850Sstevel@tonic-gate static char gsalt[BCRYPT_MAXSALT * 4 / 3 + 1];
860Sstevel@tonic-gate static char error[] = ":";
870Sstevel@tonic-gate
880Sstevel@tonic-gate static uint8_t Base64Code[] =
890Sstevel@tonic-gate "./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
900Sstevel@tonic-gate
910Sstevel@tonic-gate static uint8_t index_64[128] =
920Sstevel@tonic-gate {
930Sstevel@tonic-gate 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
940Sstevel@tonic-gate 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
950Sstevel@tonic-gate 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
960Sstevel@tonic-gate 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
970Sstevel@tonic-gate 255, 255, 255, 255, 255, 255, 0, 1, 54, 55,
980Sstevel@tonic-gate 56, 57, 58, 59, 60, 61, 62, 63, 255, 255,
990Sstevel@tonic-gate 255, 255, 255, 255, 255, 2, 3, 4, 5, 6,
1000Sstevel@tonic-gate 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
1010Sstevel@tonic-gate 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27,
1020Sstevel@tonic-gate 255, 255, 255, 255, 255, 255, 28, 29, 30,
1030Sstevel@tonic-gate 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
1040Sstevel@tonic-gate 41, 42, 43, 44, 45, 46, 47, 48, 49, 50,
1050Sstevel@tonic-gate 51, 52, 53, 255, 255, 255, 255, 255
1060Sstevel@tonic-gate };
1070Sstevel@tonic-gate #define CHAR64(c) ( (c) > 127 ? 255 : index_64[(c)])
1080Sstevel@tonic-gate
1090Sstevel@tonic-gate static void
decode_base64(uint8_t * buffer,uint16_t len,uint8_t * data)1100Sstevel@tonic-gate decode_base64(uint8_t *buffer, uint16_t len, uint8_t *data)
1110Sstevel@tonic-gate {
1120Sstevel@tonic-gate uint8_t *bp = buffer;
1130Sstevel@tonic-gate uint8_t *p = data;
1140Sstevel@tonic-gate uint8_t c1, c2, c3, c4;
1150Sstevel@tonic-gate while (bp < buffer + len) {
1160Sstevel@tonic-gate c1 = CHAR64(*p);
1170Sstevel@tonic-gate c2 = CHAR64(*(p + 1));
1180Sstevel@tonic-gate
1190Sstevel@tonic-gate /* Invalid data */
1200Sstevel@tonic-gate if (c1 == 255 || c2 == 255)
1210Sstevel@tonic-gate break;
1220Sstevel@tonic-gate
1230Sstevel@tonic-gate *bp++ = (c1 << 2) | ((c2 & 0x30) >> 4);
1240Sstevel@tonic-gate if (bp >= buffer + len)
1250Sstevel@tonic-gate break;
1260Sstevel@tonic-gate
1270Sstevel@tonic-gate c3 = CHAR64(*(p + 2));
1280Sstevel@tonic-gate if (c3 == 255)
1290Sstevel@tonic-gate break;
1300Sstevel@tonic-gate
1310Sstevel@tonic-gate *bp++ = ((c2 & 0x0f) << 4) | ((c3 & 0x3c) >> 2);
1320Sstevel@tonic-gate if (bp >= buffer + len)
1330Sstevel@tonic-gate break;
1340Sstevel@tonic-gate
1350Sstevel@tonic-gate c4 = CHAR64(*(p + 3));
1360Sstevel@tonic-gate if (c4 == 255)
1370Sstevel@tonic-gate break;
1380Sstevel@tonic-gate *bp++ = ((c3 & 0x03) << 6) | c4;
1390Sstevel@tonic-gate
1400Sstevel@tonic-gate p += 4;
1410Sstevel@tonic-gate }
1420Sstevel@tonic-gate }
1430Sstevel@tonic-gate
1440Sstevel@tonic-gate static void
encode_salt(char * salt,uint8_t * csalt,uint16_t clen,uint8_t logr)1450Sstevel@tonic-gate encode_salt(char *salt, uint8_t *csalt, uint16_t clen, uint8_t logr)
1460Sstevel@tonic-gate {
1470Sstevel@tonic-gate salt[0] = '$';
1480Sstevel@tonic-gate salt[1] = BCRYPT_VERSION;
1490Sstevel@tonic-gate salt[2] = 'a';
1500Sstevel@tonic-gate salt[3] = '$';
1510Sstevel@tonic-gate
1520Sstevel@tonic-gate (void) snprintf(salt + 4, 4, "%2.2u$", logr);
1530Sstevel@tonic-gate
1540Sstevel@tonic-gate encode_base64((uint8_t *) salt + 7, csalt, clen);
1550Sstevel@tonic-gate }
1560Sstevel@tonic-gate /* Generates a salt for this version of crypt.
1570Sstevel@tonic-gate Since versions may change. Keeping this here
1580Sstevel@tonic-gate seems sensible.
1590Sstevel@tonic-gate */
1600Sstevel@tonic-gate
1610Sstevel@tonic-gate char *
bcrypt_gensalt(uint8_t log_rounds)1620Sstevel@tonic-gate bcrypt_gensalt(uint8_t log_rounds)
1630Sstevel@tonic-gate {
1640Sstevel@tonic-gate uint8_t csalt[BCRYPT_MAXSALT];
1650Sstevel@tonic-gate uint16_t i;
1660Sstevel@tonic-gate uint32_t seed = 0;
1670Sstevel@tonic-gate
1680Sstevel@tonic-gate for (i = 0; i < BCRYPT_MAXSALT; i++) {
1690Sstevel@tonic-gate if (i % 4 == 0)
1700Sstevel@tonic-gate seed = arc4random();
1710Sstevel@tonic-gate csalt[i] = seed & 0xff;
1720Sstevel@tonic-gate seed = seed >> 8;
1730Sstevel@tonic-gate }
1740Sstevel@tonic-gate
1750Sstevel@tonic-gate if (log_rounds < 4)
1760Sstevel@tonic-gate log_rounds = 4;
1770Sstevel@tonic-gate
1780Sstevel@tonic-gate encode_salt(gsalt, csalt, BCRYPT_MAXSALT, log_rounds);
1790Sstevel@tonic-gate return gsalt;
1800Sstevel@tonic-gate }
1810Sstevel@tonic-gate /* We handle $Vers$log2(NumRounds)$salt+passwd$
1820Sstevel@tonic-gate i.e. $2$04$iwouldntknowwhattosayetKdJ6iFtacBqJdKe6aW7ou */
1830Sstevel@tonic-gate
1840Sstevel@tonic-gate char *
bcrypt(key,salt)1850Sstevel@tonic-gate bcrypt(key, salt)
1860Sstevel@tonic-gate const char *key;
1870Sstevel@tonic-gate const char *salt;
1880Sstevel@tonic-gate {
1890Sstevel@tonic-gate blf_ctx state;
1900Sstevel@tonic-gate uint32_t rounds, i, k;
1910Sstevel@tonic-gate uint16_t j;
1920Sstevel@tonic-gate uint8_t key_len, salt_len, logr, minor;
1930Sstevel@tonic-gate uint8_t ciphertext[4 * BCRYPT_BLOCKS] = "OrpheanBeholderScryDoubt";
1940Sstevel@tonic-gate uint8_t csalt[BCRYPT_MAXSALT];
1950Sstevel@tonic-gate uint32_t cdata[BCRYPT_BLOCKS];
1960Sstevel@tonic-gate
1970Sstevel@tonic-gate /* Discard "$" identifier */
1980Sstevel@tonic-gate salt++;
1990Sstevel@tonic-gate
2000Sstevel@tonic-gate if (*salt > BCRYPT_VERSION) {
2010Sstevel@tonic-gate /* How do I handle errors ? Return ':' */
2020Sstevel@tonic-gate return error;
2030Sstevel@tonic-gate }
2040Sstevel@tonic-gate
2050Sstevel@tonic-gate /* Check for minor versions */
2060Sstevel@tonic-gate if (salt[1] != '$') {
2070Sstevel@tonic-gate switch (salt[1]) {
2080Sstevel@tonic-gate case 'a':
2090Sstevel@tonic-gate /* 'ab' should not yield the same as 'abab' */
2100Sstevel@tonic-gate minor = salt[1];
2110Sstevel@tonic-gate salt++;
2120Sstevel@tonic-gate break;
2130Sstevel@tonic-gate default:
2140Sstevel@tonic-gate return error;
2150Sstevel@tonic-gate }
2160Sstevel@tonic-gate } else
2170Sstevel@tonic-gate minor = 0;
2180Sstevel@tonic-gate
2190Sstevel@tonic-gate /* Discard version + "$" identifier */
2200Sstevel@tonic-gate salt += 2;
2210Sstevel@tonic-gate
2220Sstevel@tonic-gate if (salt[2] != '$')
2230Sstevel@tonic-gate /* Out of sync with passwd entry */
2240Sstevel@tonic-gate return error;
2250Sstevel@tonic-gate
2260Sstevel@tonic-gate /* Computer power doesn't increase linear, 2^x should be fine */
2270Sstevel@tonic-gate if ((rounds = (uint32_t) 1 << (logr = atoi(salt))) < BCRYPT_MINROUNDS)
2280Sstevel@tonic-gate return error;
2290Sstevel@tonic-gate
2300Sstevel@tonic-gate /* Discard num rounds + "$" identifier */
2310Sstevel@tonic-gate salt += 3;
2320Sstevel@tonic-gate
2330Sstevel@tonic-gate if (strlen(salt) * 3 / 4 < BCRYPT_MAXSALT)
2340Sstevel@tonic-gate return error;
2350Sstevel@tonic-gate
2360Sstevel@tonic-gate /* We dont want the base64 salt but the raw data */
2370Sstevel@tonic-gate decode_base64(csalt, BCRYPT_MAXSALT, (uint8_t *) salt);
2380Sstevel@tonic-gate salt_len = BCRYPT_MAXSALT;
2390Sstevel@tonic-gate key_len = strlen(key) + (minor >= 'a' ? 1 : 0);
2400Sstevel@tonic-gate
2410Sstevel@tonic-gate /* Setting up S-Boxes and Subkeys */
2420Sstevel@tonic-gate Blowfish_initstate(&state);
2430Sstevel@tonic-gate Blowfish_expandstate(&state, csalt, salt_len,
2440Sstevel@tonic-gate (uint8_t *) key, key_len);
2450Sstevel@tonic-gate for (k = 0; k < rounds; k++) {
2460Sstevel@tonic-gate Blowfish_expand0state(&state, (uint8_t *) key, key_len);
2470Sstevel@tonic-gate Blowfish_expand0state(&state, csalt, salt_len);
2480Sstevel@tonic-gate }
2490Sstevel@tonic-gate
2500Sstevel@tonic-gate /* This can be precomputed later */
2510Sstevel@tonic-gate j = 0;
2520Sstevel@tonic-gate for (i = 0; i < BCRYPT_BLOCKS; i++)
2530Sstevel@tonic-gate cdata[i] = Blowfish_stream2word(ciphertext, 4 * BCRYPT_BLOCKS, &j);
2540Sstevel@tonic-gate
2550Sstevel@tonic-gate /* Now do the encryption */
2560Sstevel@tonic-gate for (k = 0; k < 64; k++)
2570Sstevel@tonic-gate blf_enc(&state, cdata, BCRYPT_BLOCKS / 2);
2580Sstevel@tonic-gate
2590Sstevel@tonic-gate for (i = 0; i < BCRYPT_BLOCKS; i++) {
2600Sstevel@tonic-gate ciphertext[4 * i + 3] = cdata[i] & 0xff;
2610Sstevel@tonic-gate cdata[i] = cdata[i] >> 8;
2620Sstevel@tonic-gate ciphertext[4 * i + 2] = cdata[i] & 0xff;
2630Sstevel@tonic-gate cdata[i] = cdata[i] >> 8;
2640Sstevel@tonic-gate ciphertext[4 * i + 1] = cdata[i] & 0xff;
2650Sstevel@tonic-gate cdata[i] = cdata[i] >> 8;
2660Sstevel@tonic-gate ciphertext[4 * i + 0] = cdata[i] & 0xff;
2670Sstevel@tonic-gate }
2680Sstevel@tonic-gate
2690Sstevel@tonic-gate
2700Sstevel@tonic-gate i = 0;
2710Sstevel@tonic-gate encrypted[i++] = '$';
2720Sstevel@tonic-gate encrypted[i++] = BCRYPT_VERSION;
2730Sstevel@tonic-gate if (minor)
2740Sstevel@tonic-gate encrypted[i++] = minor;
2750Sstevel@tonic-gate encrypted[i++] = '$';
2760Sstevel@tonic-gate
2770Sstevel@tonic-gate (void) snprintf(encrypted + i, 4, "%2.2u$", logr);
2780Sstevel@tonic-gate
2790Sstevel@tonic-gate encode_base64((uint8_t *) encrypted + i + 3, csalt, BCRYPT_MAXSALT);
2800Sstevel@tonic-gate encode_base64((uint8_t *) encrypted + strlen(encrypted), ciphertext,
2810Sstevel@tonic-gate 4 * BCRYPT_BLOCKS - 1);
2820Sstevel@tonic-gate return encrypted;
2830Sstevel@tonic-gate }
2840Sstevel@tonic-gate
2850Sstevel@tonic-gate static void
encode_base64(uint8_t * buffer,uint8_t * data,uint16_t len)2860Sstevel@tonic-gate encode_base64(uint8_t *buffer, uint8_t *data, uint16_t len)
2870Sstevel@tonic-gate {
2880Sstevel@tonic-gate uint8_t *bp = buffer;
2890Sstevel@tonic-gate uint8_t *p = data;
2900Sstevel@tonic-gate uint8_t c1, c2;
2910Sstevel@tonic-gate while (p < data + len) {
2920Sstevel@tonic-gate c1 = *p++;
2930Sstevel@tonic-gate *bp++ = Base64Code[(c1 >> 2)];
2940Sstevel@tonic-gate c1 = (c1 & 0x03) << 4;
2950Sstevel@tonic-gate if (p >= data + len) {
2960Sstevel@tonic-gate *bp++ = Base64Code[c1];
2970Sstevel@tonic-gate break;
2980Sstevel@tonic-gate }
2990Sstevel@tonic-gate c2 = *p++;
3000Sstevel@tonic-gate c1 |= (c2 >> 4) & 0x0f;
3010Sstevel@tonic-gate *bp++ = Base64Code[c1];
3020Sstevel@tonic-gate c1 = (c2 & 0x0f) << 2;
3030Sstevel@tonic-gate if (p >= data + len) {
3040Sstevel@tonic-gate *bp++ = Base64Code[c1];
3050Sstevel@tonic-gate break;
3060Sstevel@tonic-gate }
3070Sstevel@tonic-gate c2 = *p++;
3080Sstevel@tonic-gate c1 |= (c2 >> 6) & 0x03;
3090Sstevel@tonic-gate *bp++ = Base64Code[c1];
3100Sstevel@tonic-gate *bp++ = Base64Code[c2 & 0x3f];
3110Sstevel@tonic-gate }
3120Sstevel@tonic-gate *bp = '\0';
3130Sstevel@tonic-gate }
3140Sstevel@tonic-gate #if 0
3150Sstevel@tonic-gate void
3160Sstevel@tonic-gate main()
3170Sstevel@tonic-gate {
3180Sstevel@tonic-gate char blubber[73];
3190Sstevel@tonic-gate char salt[100];
3200Sstevel@tonic-gate char *p;
3210Sstevel@tonic-gate salt[0] = '$';
3220Sstevel@tonic-gate salt[1] = BCRYPT_VERSION;
3230Sstevel@tonic-gate salt[2] = '$';
3240Sstevel@tonic-gate
3250Sstevel@tonic-gate snprintf(salt + 3, 4, "%2.2u$", 5);
3260Sstevel@tonic-gate
3270Sstevel@tonic-gate printf("24 bytes of salt: ");
3280Sstevel@tonic-gate fgets(salt + 6, 94, stdin);
3290Sstevel@tonic-gate salt[99] = 0;
3300Sstevel@tonic-gate printf("72 bytes of password: ");
3310Sstevel@tonic-gate fpurge(stdin);
3320Sstevel@tonic-gate fgets(blubber, 73, stdin);
3330Sstevel@tonic-gate blubber[72] = 0;
3340Sstevel@tonic-gate
3350Sstevel@tonic-gate p = crypt(blubber, salt);
3360Sstevel@tonic-gate printf("Passwd entry: %s\n\n", p);
3370Sstevel@tonic-gate
3380Sstevel@tonic-gate p = bcrypt_gensalt(5);
3390Sstevel@tonic-gate printf("Generated salt: %s\n", p);
3400Sstevel@tonic-gate p = crypt(blubber, p);
3410Sstevel@tonic-gate printf("Passwd entry: %s\n", p);
3420Sstevel@tonic-gate }
3430Sstevel@tonic-gate #endif
344