aboutsummaryrefslogtreecommitdiff
path: root/src/lib/crypto/krb/arcfour
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/crypto/krb/arcfour')
-rw-r--r--src/lib/crypto/krb/arcfour/arcfour.c179
-rw-r--r--src/lib/crypto/krb/arcfour/arcfour.h37
-rw-r--r--src/lib/crypto/krb/arcfour/arcfour_aead.c65
-rw-r--r--src/lib/crypto/krb/arcfour/arcfour_s2k.c2
-rw-r--r--src/lib/crypto/krb/arcfour/deps43
5 files changed, 59 insertions, 267 deletions
diff --git a/src/lib/crypto/krb/arcfour/arcfour.c b/src/lib/crypto/krb/arcfour/arcfour.c
index eb80124..c8b478f 100644
--- a/src/lib/crypto/krb/arcfour/arcfour.c
+++ b/src/lib/crypto/krb/arcfour/arcfour.c
@@ -13,15 +13,6 @@
const char l40[] = "fortybits";
-void
-krb5int_arcfour_encrypt_length(const struct krb5_enc_provider *enc,
- const struct krb5_hash_provider *hash,
- size_t inputlen, size_t *length)
-{
- /* checksum + (confounder + inputlen, in even blocksize) */
- *length = hash->hashsize + krb5_roundup(8 + inputlen, enc->block_size);
-}
-
krb5_keyusage
krb5int_arcfour_translate_usage(krb5_keyusage usage)
{
@@ -93,173 +84,3 @@ krb5int_arcfour_enc_key(const struct krb5_enc_provider *enc,
krb5int_c_free_keyblock(NULL, trunc_keyblock);
return ret;
}
-
-krb5_error_code
-krb5int_arcfour_encrypt(const struct krb5_enc_provider *enc,
- const struct krb5_hash_provider *hash,
- krb5_key key, krb5_keyusage usage,
- const krb5_data *ivec, const krb5_data *input,
- krb5_data *output)
-{
- krb5_keyblock *usage_keyblock = NULL, *enc_keyblock = NULL;
- krb5_key enc_key;
- krb5_data plaintext = empty_data();
- krb5_data checksum, ciphertext, confounder;
- krb5_error_code ret;
- unsigned int plainlen;
-
- /* Allocate buffers. */
- plainlen = krb5_roundup(input->length + CONFOUNDERLENGTH, enc->block_size);
- ret = alloc_data(&plaintext, plainlen);
- if (ret != 0)
- goto cleanup;
- ret = krb5int_c_init_keyblock(NULL, key->keyblock.enctype, enc->keybytes,
- &usage_keyblock);
- if (ret != 0)
- goto cleanup;
- ret = krb5int_c_init_keyblock(NULL, key->keyblock.enctype, enc->keybytes,
- &enc_keyblock);
- if (ret != 0)
- goto cleanup;
-
- /* Set up subsets of output and plaintext. */
- checksum = make_data(output->data, hash->hashsize);
- ciphertext = make_data(output->data + hash->hashsize, plainlen);
- confounder = make_data(plaintext.data, CONFOUNDERLENGTH);
-
- /* Derive a usage key from the session key and usage. */
- ret = krb5int_arcfour_usage_key(enc, hash, &key->keyblock, usage,
- usage_keyblock);
- if (ret != 0)
- goto cleanup;
-
- /* Compose a confounder with the input data to form the plaintext. */
- ret = krb5_c_random_make_octets(NULL, &confounder);
- memcpy(plaintext.data + confounder.length, input->data, input->length);
- if (ret)
- goto cleanup;
-
- /* Compute HMAC(usage key, plaintext) to get the checksum. */
- ret = krb5int_hmac_keyblock(hash, usage_keyblock, 1, &plaintext,
- &checksum);
- if (ret)
- goto cleanup;
-
- /* Derive the encryption key from the usage key and checksum. */
- ret = krb5int_arcfour_enc_key(enc, hash, usage_keyblock, &checksum,
- enc_keyblock);
- if (ret)
- goto cleanup;
-
- /* Encrypt the plaintext. */
- ret = krb5_k_create_key(NULL, enc_keyblock, &enc_key);
- if (ret)
- goto cleanup;
- ret = (*enc->encrypt)(enc_key, ivec, &plaintext, &ciphertext);
- krb5_k_free_key(NULL, enc_key);
- if (ret)
- goto cleanup;
-
- output->length = plainlen + hash->hashsize;
-
-cleanup:
- krb5int_c_free_keyblock(NULL, usage_keyblock);
- krb5int_c_free_keyblock(NULL, enc_keyblock);
- zapfree(plaintext.data, plaintext.length);
- return ret;
-}
-
-krb5_error_code
-krb5int_arcfour_decrypt(const struct krb5_enc_provider *enc,
- const struct krb5_hash_provider *hash,
- krb5_key key, krb5_keyusage usage,
- const krb5_data *ivec, const krb5_data *input,
- krb5_data *output)
-{
- krb5_keyblock *usage_keyblock = NULL, *enc_keyblock = NULL;
- krb5_data plaintext = empty_data(), comp_checksum = empty_data();
- krb5_data checksum, ciphertext;
- krb5_key enc_key;
- krb5_error_code ret;
-
- /* Set up subsets of input. */
- checksum = make_data(input->data, hash->hashsize);
- ciphertext = make_data(input->data + hash->hashsize,
- input->length - hash->hashsize);
-
- /* Allocate buffers. */
- ret = alloc_data(&plaintext, ciphertext.length);
- if (ret != 0)
- goto cleanup;
- ret = alloc_data(&comp_checksum, hash->hashsize);
- if (ret != 0)
- goto cleanup;
- ret = krb5int_c_init_keyblock(NULL, key->keyblock.enctype, enc->keybytes,
- &usage_keyblock);
- if (ret != 0)
- goto cleanup;
- ret = krb5int_c_init_keyblock(NULL, key->keyblock.enctype, enc->keybytes,
- &enc_keyblock);
- if (ret != 0)
- goto cleanup;
-
- /* We may have to try two usage values; see below. */
- do {
- /* Derive a usage key from the session key and usage. */
- ret = krb5int_arcfour_usage_key(enc, hash, &key->keyblock, usage,
- usage_keyblock);
- if (ret != 0)
- goto cleanup;
-
- /* Derive the encryption key from the usage key and checksum. */
- ret = krb5int_arcfour_enc_key(enc, hash, usage_keyblock, &checksum,
- enc_keyblock);
- if (ret)
- goto cleanup;
-
- /* Decrypt the ciphertext. */
- ret = krb5_k_create_key(NULL, enc_keyblock, &enc_key);
- if (ret)
- goto cleanup;
- ret = (*enc->decrypt)(enc_key, ivec, &ciphertext, &plaintext);
- krb5_k_free_key(NULL, enc_key);
- if (ret)
- goto cleanup;
-
- /* Compute HMAC(usage key, plaintext) to get the checksum. */
- ret = krb5int_hmac_keyblock(hash, usage_keyblock, 1, &plaintext,
- &comp_checksum);
- if (ret)
- goto cleanup;
-
- if (memcmp(checksum.data, comp_checksum.data, hash->hashsize) != 0) {
- if (usage == 9) {
- /*
- * RFC 4757 specifies usage 8 for TGS-REP encrypted
- * parts encrypted in a subkey, but the value used by MS
- * is actually 9. We now use 9 to start with, but fall
- * back to 8 on failure in case we are communicating
- * with a KDC using the value from the RFC.
- */
- usage = 8;
- continue;
- }
- ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
- goto cleanup;
- }
-
- break;
- } while (1);
-
- /* Remove the confounder from the plaintext to get the output. */
- memcpy(output->data, plaintext.data + CONFOUNDERLENGTH,
- plaintext.length - CONFOUNDERLENGTH);
- output->length = plaintext.length - CONFOUNDERLENGTH;
-
-cleanup:
- krb5int_c_free_keyblock(NULL, usage_keyblock);
- krb5int_c_free_keyblock(NULL, enc_keyblock);
- zapfree(plaintext.data, plaintext.length);
- zapfree(comp_checksum.data, comp_checksum.length);
- return ret;
-}
diff --git a/src/lib/crypto/krb/arcfour/arcfour.h b/src/lib/crypto/krb/arcfour/arcfour.h
index 6419338..7ec0d77 100644
--- a/src/lib/crypto/krb/arcfour/arcfour.h
+++ b/src/lib/crypto/krb/arcfour/arcfour.h
@@ -2,39 +2,30 @@
#ifndef ARCFOUR_H
#define ARCFOUR_H
-extern void
-krb5int_arcfour_encrypt_length(const struct krb5_enc_provider *,
- const struct krb5_hash_provider *,
- size_t,
- size_t *);
+#include "etypes.h"
-extern krb5_error_code
-krb5int_arcfour_encrypt(const struct krb5_enc_provider *,
- const struct krb5_hash_provider *,
- krb5_key,
- krb5_keyusage,
- const krb5_data *,
- const krb5_data *,
- krb5_data *);
+unsigned int
+krb5int_arcfour_crypto_length(const struct krb5_keytypes *ktp,
+ krb5_cryptotype type);
-extern krb5_error_code
-krb5int_arcfour_decrypt(const struct krb5_enc_provider *,
- const struct krb5_hash_provider *,
- krb5_key,
- krb5_keyusage,
- const krb5_data *,
- const krb5_data *,
- krb5_data *);
+krb5_error_code
+krb5int_arcfour_encrypt(const struct krb5_keytypes *ktp, krb5_key key,
+ krb5_keyusage usage, const krb5_data *ivec,
+ krb5_crypto_iov *data, size_t num_data);
+
+krb5_error_code
+krb5int_arcfour_decrypt(const struct krb5_keytypes *ktp, krb5_key key,
+ krb5_keyusage usage, const krb5_data *ivec,
+ krb5_crypto_iov *data, size_t num_data);
extern krb5_error_code
krb5int_arcfour_string_to_key(
- const struct krb5_enc_provider *,
+ const struct krb5_keytypes *,
const krb5_data *,
const krb5_data *,
const krb5_data *,
krb5_keyblock *);
extern const struct krb5_enc_provider krb5int_enc_arcfour;
-extern const struct krb5_aead_provider krb5int_aead_arcfour;
#endif /* ARCFOUR_H */
diff --git a/src/lib/crypto/krb/arcfour/arcfour_aead.c b/src/lib/crypto/krb/arcfour/arcfour_aead.c
index 0ad7c27..d886235 100644
--- a/src/lib/crypto/krb/arcfour/arcfour_aead.c
+++ b/src/lib/crypto/krb/arcfour/arcfour_aead.c
@@ -34,32 +34,23 @@
/* AEAD */
-static krb5_error_code
-krb5int_arcfour_crypto_length(const struct krb5_aead_provider *aead,
- const struct krb5_enc_provider *enc,
- const struct krb5_hash_provider *hash,
- krb5_cryptotype type,
- unsigned int *length)
+unsigned int
+krb5int_arcfour_crypto_length(const struct krb5_keytypes *ktp,
+ krb5_cryptotype type)
{
switch (type) {
case KRB5_CRYPTO_TYPE_HEADER:
- *length = hash->hashsize + CONFOUNDERLENGTH;
- break;
+ return ktp->hash->hashsize + CONFOUNDERLENGTH;
case KRB5_CRYPTO_TYPE_PADDING:
- *length = 0;
- break;
case KRB5_CRYPTO_TYPE_TRAILER:
- *length = 0;
- break;
+ return 0;
case KRB5_CRYPTO_TYPE_CHECKSUM:
- *length = hash->hashsize;
- break;
+ return ktp->hash->hashsize;
default:
- assert(0 && "invalid cryptotype passed to krb5int_arcfour_crypto_length");
- break;
+ assert(0 &&
+ "invalid cryptotype passed to krb5int_arcfour_crypto_length");
+ return 0;
}
-
- return 0;
}
/* Encrypt or decrypt using a keyblock. */
@@ -74,21 +65,18 @@ keyblock_crypt(const struct krb5_enc_provider *enc, krb5_keyblock *keyblock,
if (ret != 0)
return ret;
/* Works for encryption or decryption since arcfour is a stream cipher. */
- ret = enc->encrypt_iov(key, ivec, data, num_data);
+ ret = enc->encrypt(key, ivec, data, num_data);
krb5_k_free_key(NULL, key);
return ret;
}
-static krb5_error_code
-krb5int_arcfour_encrypt_iov(const struct krb5_aead_provider *aead,
- const struct krb5_enc_provider *enc,
- const struct krb5_hash_provider *hash,
- krb5_key key,
- krb5_keyusage usage,
- const krb5_data *ivec,
- krb5_crypto_iov *data,
- size_t num_data)
+krb5_error_code
+krb5int_arcfour_encrypt(const struct krb5_keytypes *ktp, krb5_key key,
+ krb5_keyusage usage, const krb5_data *ivec,
+ krb5_crypto_iov *data, size_t num_data)
{
+ const struct krb5_enc_provider *enc = ktp->enc;
+ const struct krb5_hash_provider *hash = ktp->hash;
krb5_error_code ret;
krb5_crypto_iov *header, *trailer;
krb5_keyblock *usage_keyblock = NULL, *enc_keyblock = NULL;
@@ -169,16 +157,13 @@ cleanup:
return ret;
}
-static krb5_error_code
-krb5int_arcfour_decrypt_iov(const struct krb5_aead_provider *aead,
- const struct krb5_enc_provider *enc,
- const struct krb5_hash_provider *hash,
- krb5_key key,
- krb5_keyusage usage,
- const krb5_data *ivec,
- krb5_crypto_iov *data,
- size_t num_data)
+krb5_error_code
+krb5int_arcfour_decrypt(const struct krb5_keytypes *ktp, krb5_key key,
+ krb5_keyusage usage, const krb5_data *ivec,
+ krb5_crypto_iov *data, size_t num_data)
{
+ const struct krb5_enc_provider *enc = ktp->enc;
+ const struct krb5_hash_provider *hash = ktp->hash;
krb5_error_code ret;
krb5_crypto_iov *header, *trailer;
krb5_keyblock *usage_keyblock = NULL, *enc_keyblock = NULL;
@@ -270,12 +255,6 @@ cleanup:
return ret;
}
-const struct krb5_aead_provider krb5int_aead_arcfour = {
- krb5int_arcfour_crypto_length,
- krb5int_arcfour_encrypt_iov,
- krb5int_arcfour_decrypt_iov
-};
-
krb5_error_code
krb5int_arcfour_gsscrypt(const krb5_keyblock *keyblock, krb5_keyusage usage,
const krb5_data *kd_data, krb5_crypto_iov *data,
diff --git a/src/lib/crypto/krb/arcfour/arcfour_s2k.c b/src/lib/crypto/krb/arcfour/arcfour_s2k.c
index dbb7f45..b77738e 100644
--- a/src/lib/crypto/krb/arcfour/arcfour_s2k.c
+++ b/src/lib/crypto/krb/arcfour/arcfour_s2k.c
@@ -9,7 +9,7 @@
#endif
krb5_error_code
-krb5int_arcfour_string_to_key(const struct krb5_enc_provider *enc,
+krb5int_arcfour_string_to_key(const struct krb5_keytypes *ktp,
const krb5_data *string, const krb5_data *salt,
const krb5_data *params, krb5_keyblock *key)
{
diff --git a/src/lib/crypto/krb/arcfour/deps b/src/lib/crypto/krb/arcfour/deps
index d9f47fc..e626ff8 100644
--- a/src/lib/crypto/krb/arcfour/deps
+++ b/src/lib/crypto/krb/arcfour/deps
@@ -4,19 +4,7 @@
arcfour.so arcfour.po $(OUTPRE)arcfour.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
$(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \
$(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../../builtin/hash_provider/hash_provider.h \
- $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
- $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
- $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
- $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
- $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \
- $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
- arcfour-int.h arcfour.c arcfour.h
-arcfour_aead.so arcfour_aead.po $(OUTPRE)arcfour_aead.$(OBJEXT): \
- $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
- $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
- $(COM_ERR_DEPS) $(srcdir)/../../builtin/hash_provider/hash_provider.h \
- $(srcdir)/../aead.h $(srcdir)/../cksumtypes.h $(top_srcdir)/include/k5-buf.h \
+ $(srcdir)/../etypes.h $(top_srcdir)/include/k5-buf.h \
$(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
$(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
$(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
@@ -24,17 +12,30 @@ arcfour_aead.so arcfour_aead.po $(OUTPRE)arcfour_aead.$(OBJEXT): \
$(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \
$(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \
$(top_srcdir)/include/socket-utils.h arcfour-int.h \
- arcfour.h arcfour_aead.c
-arcfour_s2k.so arcfour_s2k.po $(OUTPRE)arcfour_s2k.$(OBJEXT): \
+ arcfour.c arcfour.h
+arcfour_aead.so arcfour_aead.po $(OUTPRE)arcfour_aead.$(OBJEXT): \
$(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
$(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
- $(COM_ERR_DEPS) $(srcdir)/../../builtin/md4/rsa-md4.h \
+ $(COM_ERR_DEPS) $(srcdir)/../../builtin/hash_provider/hash_provider.h \
+ $(srcdir)/../aead.h $(srcdir)/../cksumtypes.h $(srcdir)/../etypes.h \
$(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \
$(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \
$(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \
$(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \
- $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \
- $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \
- $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \
- $(top_srcdir)/include/socket-utils.h arcfour-int.h \
- arcfour.h arcfour_s2k.c
+ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \
+ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+ arcfour-int.h arcfour.h arcfour_aead.c
+arcfour_s2k.so arcfour_s2k.po $(OUTPRE)arcfour_s2k.$(OBJEXT): \
+ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
+ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
+ $(COM_ERR_DEPS) $(srcdir)/../../builtin/md4/rsa-md4.h \
+ $(srcdir)/../etypes.h $(top_srcdir)/include/k5-buf.h \
+ $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
+ $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
+ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
+ $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-utf8.h \
+ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
+ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \
+ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
+ arcfour-int.h arcfour.h arcfour_s2k.c
generated by cgit v1.1 at 2024-09-08 13:03:55 +0000