1 /* 2 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * All rights reserved 5 * 6 * As far as I am concerned, the code I have written for this software 7 * can be used freely for any purpose. Any derived versions of this 8 * software must be clearly marked as such, and if the derived work is 9 * incompatible with the protocol description in the RFC file, it must be 10 * called by a name other than "ssh" or "Secure Shell". 11 * 12 * 13 * Copyright (c) 1999 Niels Provos. All rights reserved. 14 * Copyright (c) 1999, 2000 Markus Friedl. All rights reserved. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions 18 * are met: 19 * 1. Redistributions of source code must retain the above copyright 20 * notice, this list of conditions and the following disclaimer. 21 * 2. Redistributions in binary form must reproduce the above copyright 22 * notice, this list of conditions and the following disclaimer in the 23 * documentation and/or other materials provided with the distribution. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35 */ 36 37 #include "includes.h" 38 RCSID("$OpenBSD: cipher.c,v 1.46 2001/06/25 08:25:36 markus Exp $"); 39 40 #include "xmalloc.h" 41 #include "log.h" 42 #include "cipher.h" 43 44 #include <openssl/md5.h> 45 46 /* no encryption */ 47 static void 48 none_setkey(CipherContext *cc, const u_char *key, u_int keylen) 49 { 50 } 51 static void 52 none_setiv(CipherContext *cc, const u_char *iv, u_int ivlen) 53 { 54 } 55 static void 56 none_crypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) 57 { 58 memcpy(dest, src, len); 59 } 60 61 /* DES */ 62 static void 63 des_ssh1_setkey(CipherContext *cc, const u_char *key, u_int keylen) 64 { 65 static int dowarn = 1; 66 if (dowarn) { 67 error("Warning: use of DES is strongly discouraged " 68 "due to cryptographic weaknesses"); 69 dowarn = 0; 70 } 71 des_set_key((void *)key, cc->u.des.key); 72 } 73 static void 74 des_ssh1_setiv(CipherContext *cc, const u_char *iv, u_int ivlen) 75 { 76 memset(cc->u.des.iv, 0, sizeof(cc->u.des.iv)); 77 } 78 static void 79 des_ssh1_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) 80 { 81 des_ncbc_encrypt(src, dest, len, cc->u.des.key, &cc->u.des.iv, 82 DES_ENCRYPT); 83 } 84 static void 85 des_ssh1_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) 86 { 87 des_ncbc_encrypt(src, dest, len, cc->u.des.key, &cc->u.des.iv, 88 DES_DECRYPT); 89 } 90 91 /* 3DES */ 92 static void 93 des3_setkey(CipherContext *cc, const u_char *key, u_int keylen) 94 { 95 des_set_key((void *) key, cc->u.des3.key1); 96 des_set_key((void *) (key+8), cc->u.des3.key2); 97 des_set_key((void *) (key+16), cc->u.des3.key3); 98 } 99 static void 100 des3_setiv(CipherContext *cc, const u_char *iv, u_int ivlen) 101 { 102 memset(cc->u.des3.iv1, 0, sizeof(cc->u.des3.iv1)); 103 memset(cc->u.des3.iv2, 0, sizeof(cc->u.des3.iv2)); 104 memset(cc->u.des3.iv3, 0, sizeof(cc->u.des3.iv3)); 105 if (iv == NULL) 106 return; 107 memcpy(cc->u.des3.iv3, (char *)iv, 8); 108 } 109 static void 110 des3_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) 111 { 112 des_ede3_cbc_encrypt(src, dest, len, 113 cc->u.des3.key1, cc->u.des3.key2, cc->u.des3.key3, 114 &cc->u.des3.iv3, DES_ENCRYPT); 115 } 116 static void 117 des3_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) 118 { 119 des_ede3_cbc_encrypt(src, dest, len, 120 cc->u.des3.key1, cc->u.des3.key2, cc->u.des3.key3, 121 &cc->u.des3.iv3, DES_DECRYPT); 122 } 123 124 /* 125 * This is used by SSH1: 126 * 127 * What kind of triple DES are these 2 routines? 128 * 129 * Why is there a redundant initialization vector? 130 * 131 * If only iv3 was used, then, this would till effect have been 132 * outer-cbc. However, there is also a private iv1 == iv2 which 133 * perhaps makes differential analysis easier. On the other hand, the 134 * private iv1 probably makes the CRC-32 attack ineffective. This is a 135 * result of that there is no longer any known iv1 to use when 136 * choosing the X block. 137 */ 138 static void 139 des3_ssh1_setkey(CipherContext *cc, const u_char *key, u_int keylen) 140 { 141 des_set_key((void *) key, cc->u.des3.key1); 142 des_set_key((void *) (key+8), cc->u.des3.key2); 143 if (keylen <= 16) 144 des_set_key((void *) key, cc->u.des3.key3); 145 else 146 des_set_key((void *) (key+16), cc->u.des3.key3); 147 } 148 static void 149 des3_ssh1_encrypt(CipherContext *cc, u_char *dest, const u_char *src, 150 u_int len) 151 { 152 des_ncbc_encrypt(src, dest, len, cc->u.des3.key1, &cc->u.des3.iv1, 153 DES_ENCRYPT); 154 des_ncbc_encrypt(dest, dest, len, cc->u.des3.key2, &cc->u.des3.iv2, 155 DES_DECRYPT); 156 des_ncbc_encrypt(dest, dest, len, cc->u.des3.key3, &cc->u.des3.iv3, 157 DES_ENCRYPT); 158 } 159 static void 160 des3_ssh1_decrypt(CipherContext *cc, u_char *dest, const u_char *src, 161 u_int len) 162 { 163 des_ncbc_encrypt(src, dest, len, cc->u.des3.key3, &cc->u.des3.iv3, 164 DES_DECRYPT); 165 des_ncbc_encrypt(dest, dest, len, cc->u.des3.key2, &cc->u.des3.iv2, 166 DES_ENCRYPT); 167 des_ncbc_encrypt(dest, dest, len, cc->u.des3.key1, &cc->u.des3.iv1, 168 DES_DECRYPT); 169 } 170 171 /* Blowfish */ 172 static void 173 blowfish_setkey(CipherContext *cc, const u_char *key, u_int keylen) 174 { 175 BF_set_key(&cc->u.bf.key, keylen, (u_char *)key); 176 } 177 static void 178 blowfish_setiv(CipherContext *cc, const u_char *iv, u_int ivlen) 179 { 180 if (iv == NULL) 181 memset(cc->u.bf.iv, 0, 8); 182 else 183 memcpy(cc->u.bf.iv, (char *)iv, 8); 184 } 185 static void 186 blowfish_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src, 187 u_int len) 188 { 189 BF_cbc_encrypt((void *)src, dest, len, &cc->u.bf.key, cc->u.bf.iv, 190 BF_ENCRYPT); 191 } 192 static void 193 blowfish_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src, 194 u_int len) 195 { 196 BF_cbc_encrypt((void *)src, dest, len, &cc->u.bf.key, cc->u.bf.iv, 197 BF_DECRYPT); 198 } 199 200 /* 201 * SSH1 uses a variation on Blowfish, all bytes must be swapped before 202 * and after encryption/decryption. Thus the swap_bytes stuff (yuk). 203 */ 204 static void 205 swap_bytes(const u_char *src, u_char *dst, int n) 206 { 207 char c[4]; 208 209 /* Process 4 bytes every lap. */ 210 for (n = n / 4; n > 0; n--) { 211 c[3] = *src++; 212 c[2] = *src++; 213 c[1] = *src++; 214 c[0] = *src++; 215 216 *dst++ = c[0]; 217 *dst++ = c[1]; 218 *dst++ = c[2]; 219 *dst++ = c[3]; 220 } 221 } 222 223 static void 224 blowfish_ssh1_encrypt(CipherContext *cc, u_char *dest, const u_char *src, 225 u_int len) 226 { 227 swap_bytes(src, dest, len); 228 BF_cbc_encrypt((void *)dest, dest, len, &cc->u.bf.key, cc->u.bf.iv, 229 BF_ENCRYPT); 230 swap_bytes(dest, dest, len); 231 } 232 static void 233 blowfish_ssh1_decrypt(CipherContext *cc, u_char *dest, const u_char *src, 234 u_int len) 235 { 236 swap_bytes(src, dest, len); 237 BF_cbc_encrypt((void *)dest, dest, len, &cc->u.bf.key, cc->u.bf.iv, 238 BF_DECRYPT); 239 swap_bytes(dest, dest, len); 240 } 241 242 /* alleged rc4 */ 243 static void 244 arcfour_setkey(CipherContext *cc, const u_char *key, u_int keylen) 245 { 246 RC4_set_key(&cc->u.rc4, keylen, (u_char *)key); 247 } 248 static void 249 arcfour_crypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) 250 { 251 RC4(&cc->u.rc4, len, (u_char *)src, dest); 252 } 253 254 /* CAST */ 255 static void 256 cast_setkey(CipherContext *cc, const u_char *key, u_int keylen) 257 { 258 CAST_set_key(&cc->u.cast.key, keylen, (u_char *) key); 259 } 260 static void 261 cast_setiv(CipherContext *cc, const u_char *iv, u_int ivlen) 262 { 263 if (iv == NULL) 264 fatal("no IV for %s.", cc->cipher->name); 265 memcpy(cc->u.cast.iv, (char *)iv, 8); 266 } 267 static void 268 cast_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) 269 { 270 CAST_cbc_encrypt(src, dest, len, &cc->u.cast.key, cc->u.cast.iv, 271 CAST_ENCRYPT); 272 } 273 static void 274 cast_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) 275 { 276 CAST_cbc_encrypt(src, dest, len, &cc->u.cast.key, cc->u.cast.iv, 277 CAST_DECRYPT); 278 } 279 280 /* RIJNDAEL */ 281 282 #define RIJNDAEL_BLOCKSIZE 16 283 static void 284 rijndael_setkey(CipherContext *cc, const u_char *key, u_int keylen) 285 { 286 rijndael_set_key(&cc->u.rijndael.enc, (u4byte *)key, 8*keylen, 1); 287 rijndael_set_key(&cc->u.rijndael.dec, (u4byte *)key, 8*keylen, 0); 288 } 289 static void 290 rijndael_setiv(CipherContext *cc, const u_char *iv, u_int ivlen) 291 { 292 if (iv == NULL) 293 fatal("no IV for %s.", cc->cipher->name); 294 memcpy((u_char *)cc->u.rijndael.iv, iv, RIJNDAEL_BLOCKSIZE); 295 } 296 static void 297 rijndael_cbc_encrypt(CipherContext *cc, u_char *dest, const u_char *src, 298 u_int len) 299 { 300 rijndael_ctx *ctx = &cc->u.rijndael.enc; 301 u4byte *iv = cc->u.rijndael.iv; 302 u4byte in[4]; 303 u4byte *cprev, *cnow, *plain; 304 int i, blocks = len / RIJNDAEL_BLOCKSIZE; 305 if (len == 0) 306 return; 307 if (len % RIJNDAEL_BLOCKSIZE) 308 fatal("rijndael_cbc_encrypt: bad len %d", len); 309 cnow = (u4byte*) dest; 310 plain = (u4byte*) src; 311 cprev = iv; 312 for(i = 0; i < blocks; i++, plain+=4, cnow+=4) { 313 in[0] = plain[0] ^ cprev[0]; 314 in[1] = plain[1] ^ cprev[1]; 315 in[2] = plain[2] ^ cprev[2]; 316 in[3] = plain[3] ^ cprev[3]; 317 rijndael_encrypt(ctx, in, cnow); 318 cprev = cnow; 319 } 320 memcpy(iv, cprev, RIJNDAEL_BLOCKSIZE); 321 } 322 323 static void 324 rijndael_cbc_decrypt(CipherContext *cc, u_char *dest, const u_char *src, 325 u_int len) 326 { 327 rijndael_ctx *ctx = &cc->u.rijndael.dec; 328 u4byte *iv = cc->u.rijndael.iv; 329 u4byte ivsaved[4]; 330 u4byte *cnow = (u4byte*) (src+len-RIJNDAEL_BLOCKSIZE); 331 u4byte *plain = (u4byte*) (dest+len-RIJNDAEL_BLOCKSIZE); 332 u4byte *ivp; 333 int i, blocks = len / RIJNDAEL_BLOCKSIZE; 334 if (len == 0) 335 return; 336 if (len % RIJNDAEL_BLOCKSIZE) 337 fatal("rijndael_cbc_decrypt: bad len %d", len); 338 memcpy(ivsaved, cnow, RIJNDAEL_BLOCKSIZE); 339 for(i = blocks; i > 0; i--, cnow-=4, plain-=4) { 340 rijndael_decrypt(ctx, cnow, plain); 341 ivp = (i == 1) ? iv : cnow-4; 342 plain[0] ^= ivp[0]; 343 plain[1] ^= ivp[1]; 344 plain[2] ^= ivp[2]; 345 plain[3] ^= ivp[3]; 346 } 347 memcpy(iv, ivsaved, RIJNDAEL_BLOCKSIZE); 348 } 349 350 Cipher ciphers[] = { 351 { "none", 352 SSH_CIPHER_NONE, 8, 0, 353 none_setkey, none_setiv, 354 none_crypt, none_crypt }, 355 { "des", 356 SSH_CIPHER_DES, 8, 8, 357 des_ssh1_setkey, des_ssh1_setiv, 358 des_ssh1_encrypt, des_ssh1_decrypt }, 359 { "3des", 360 SSH_CIPHER_3DES, 8, 16, 361 des3_ssh1_setkey, des3_setiv, 362 des3_ssh1_encrypt, des3_ssh1_decrypt }, 363 { "blowfish", 364 SSH_CIPHER_BLOWFISH, 8, 16, 365 blowfish_setkey, blowfish_setiv, 366 blowfish_ssh1_encrypt, blowfish_ssh1_decrypt }, 367 368 { "3des-cbc", 369 SSH_CIPHER_SSH2, 8, 24, 370 des3_setkey, des3_setiv, 371 des3_cbc_encrypt, des3_cbc_decrypt }, 372 { "blowfish-cbc", 373 SSH_CIPHER_SSH2, 8, 16, 374 blowfish_setkey, blowfish_setiv, 375 blowfish_cbc_encrypt, blowfish_cbc_decrypt }, 376 { "cast128-cbc", 377 SSH_CIPHER_SSH2, 8, 16, 378 cast_setkey, cast_setiv, 379 cast_cbc_encrypt, cast_cbc_decrypt }, 380 { "arcfour", 381 SSH_CIPHER_SSH2, 8, 16, 382 arcfour_setkey, none_setiv, 383 arcfour_crypt, arcfour_crypt }, 384 { "aes128-cbc", 385 SSH_CIPHER_SSH2, 16, 16, 386 rijndael_setkey, rijndael_setiv, 387 rijndael_cbc_encrypt, rijndael_cbc_decrypt }, 388 { "aes192-cbc", 389 SSH_CIPHER_SSH2, 16, 24, 390 rijndael_setkey, rijndael_setiv, 391 rijndael_cbc_encrypt, rijndael_cbc_decrypt }, 392 { "aes256-cbc", 393 SSH_CIPHER_SSH2, 16, 32, 394 rijndael_setkey, rijndael_setiv, 395 rijndael_cbc_encrypt, rijndael_cbc_decrypt }, 396 { "rijndael128-cbc", 397 SSH_CIPHER_SSH2, 16, 16, 398 rijndael_setkey, rijndael_setiv, 399 rijndael_cbc_encrypt, rijndael_cbc_decrypt }, 400 { "rijndael192-cbc", 401 SSH_CIPHER_SSH2, 16, 24, 402 rijndael_setkey, rijndael_setiv, 403 rijndael_cbc_encrypt, rijndael_cbc_decrypt }, 404 { "rijndael256-cbc", 405 SSH_CIPHER_SSH2, 16, 32, 406 rijndael_setkey, rijndael_setiv, 407 rijndael_cbc_encrypt, rijndael_cbc_decrypt }, 408 { "rijndael-cbc@lysator.liu.se", 409 SSH_CIPHER_SSH2, 16, 32, 410 rijndael_setkey, rijndael_setiv, 411 rijndael_cbc_encrypt, rijndael_cbc_decrypt }, 412 { NULL, SSH_CIPHER_ILLEGAL, 0, 0, NULL, NULL, NULL, NULL } 413 }; 414 415 /*--*/ 416 417 u_int 418 cipher_mask_ssh1(int client) 419 { 420 u_int mask = 0; 421 mask |= 1 << SSH_CIPHER_3DES; /* Mandatory */ 422 mask |= 1 << SSH_CIPHER_BLOWFISH; 423 if (client) { 424 mask |= 1 << SSH_CIPHER_DES; 425 } 426 return mask; 427 } 428 429 Cipher * 430 cipher_by_name(const char *name) 431 { 432 Cipher *c; 433 for (c = ciphers; c->name != NULL; c++) 434 if (strcasecmp(c->name, name) == 0) 435 return c; 436 return NULL; 437 } 438 439 Cipher * 440 cipher_by_number(int id) 441 { 442 Cipher *c; 443 for (c = ciphers; c->name != NULL; c++) 444 if (c->number == id) 445 return c; 446 return NULL; 447 } 448 449 #define CIPHER_SEP "," 450 int 451 ciphers_valid(const char *names) 452 { 453 Cipher *c; 454 char *ciphers, *cp; 455 char *p; 456 457 if (names == NULL || strcmp(names, "") == 0) 458 return 0; 459 ciphers = cp = xstrdup(names); 460 for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0'; 461 (p = strsep(&cp, CIPHER_SEP))) { 462 c = cipher_by_name(p); 463 if (c == NULL || c->number != SSH_CIPHER_SSH2) { 464 debug("bad cipher %s [%s]", p, names); 465 xfree(ciphers); 466 return 0; 467 } else { 468 debug3("cipher ok: %s [%s]", p, names); 469 } 470 } 471 debug3("ciphers ok: [%s]", names); 472 xfree(ciphers); 473 return 1; 474 } 475 476 /* 477 * Parses the name of the cipher. Returns the number of the corresponding 478 * cipher, or -1 on error. 479 */ 480 481 int 482 cipher_number(const char *name) 483 { 484 Cipher *c; 485 if (name == NULL) 486 return -1; 487 c = cipher_by_name(name); 488 return (c==NULL) ? -1 : c->number; 489 } 490 491 char * 492 cipher_name(int id) 493 { 494 Cipher *c = cipher_by_number(id); 495 return (c==NULL) ? "<unknown>" : c->name; 496 } 497 498 void 499 cipher_init(CipherContext *cc, Cipher *cipher, 500 const u_char *key, u_int keylen, const u_char *iv, u_int ivlen) 501 { 502 if (keylen < cipher->key_len) 503 fatal("cipher_init: key length %d is insufficient for %s.", 504 keylen, cipher->name); 505 if (iv != NULL && ivlen < cipher->block_size) 506 fatal("cipher_init: iv length %d is insufficient for %s.", 507 ivlen, cipher->name); 508 cc->cipher = cipher; 509 cipher->setkey(cc, key, keylen); 510 cipher->setiv(cc, iv, ivlen); 511 } 512 513 void 514 cipher_encrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) 515 { 516 if (len % cc->cipher->block_size) 517 fatal("cipher_encrypt: bad plaintext length %d", len); 518 cc->cipher->encrypt(cc, dest, src, len); 519 } 520 521 void 522 cipher_decrypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len) 523 { 524 if (len % cc->cipher->block_size) 525 fatal("cipher_decrypt: bad ciphertext length %d", len); 526 cc->cipher->decrypt(cc, dest, src, len); 527 } 528 529 /* 530 * Selects the cipher, and keys if by computing the MD5 checksum of the 531 * passphrase and using the resulting 16 bytes as the key. 532 */ 533 534 void 535 cipher_set_key_string(CipherContext *cc, Cipher *cipher, 536 const char *passphrase) 537 { 538 MD5_CTX md; 539 u_char digest[16]; 540 541 MD5_Init(&md); 542 MD5_Update(&md, (const u_char *)passphrase, strlen(passphrase)); 543 MD5_Final(digest, &md); 544 545 cipher_init(cc, cipher, digest, 16, NULL, 0); 546 547 memset(digest, 0, sizeof(digest)); 548 memset(&md, 0, sizeof(md)); 549 } 550