2 * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #define KRB5_DEPRECATED
36 #include "krb5_locl.h"
38 struct _krb5_key_usage {
40 struct _krb5_key_data key;
44 #ifndef HEIMDAL_SMALLER
45 #define DES3_OLD_ENCTYPE 1
48 static krb5_error_code _get_derived_key(krb5_context, krb5_crypto,
49 unsigned, struct _krb5_key_data**);
50 static struct _krb5_key_data *_new_derived_key(krb5_crypto crypto, unsigned usage);
52 static void free_key_schedule(krb5_context,
53 struct _krb5_key_data *,
54 struct _krb5_encryption_type *);
56 /************************************************************
58 ************************************************************/
60 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
61 krb5_enctype_keysize(krb5_context context,
65 struct _krb5_encryption_type *et = _krb5_find_enctype(type);
67 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
68 N_("encryption type %d not supported", ""),
70 return KRB5_PROG_ETYPE_NOSUPP;
72 *keysize = et->keytype->size;
76 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
77 krb5_enctype_keybits(krb5_context context,
81 struct _krb5_encryption_type *et = _krb5_find_enctype(type);
83 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
84 "encryption type %d not supported",
86 return KRB5_PROG_ETYPE_NOSUPP;
88 *keybits = et->keytype->bits;
92 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
93 krb5_generate_random_keyblock(krb5_context context,
98 struct _krb5_encryption_type *et = _krb5_find_enctype(type);
100 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
101 N_("encryption type %d not supported", ""),
103 return KRB5_PROG_ETYPE_NOSUPP;
105 ret = krb5_data_alloc(&key->keyvalue, et->keytype->size);
109 if(et->keytype->random_key)
110 (*et->keytype->random_key)(context, key);
112 krb5_generate_random_block(key->keyvalue.data,
113 key->keyvalue.length);
117 static krb5_error_code
118 _key_schedule(krb5_context context,
119 struct _krb5_key_data *key)
122 struct _krb5_encryption_type *et = _krb5_find_enctype(key->key->keytype);
123 struct _krb5_key_type *kt;
126 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
127 N_("encryption type %d not supported", ""),
129 return KRB5_PROG_ETYPE_NOSUPP;
134 if(kt->schedule == NULL)
136 if (key->schedule != NULL)
138 ALLOC(key->schedule, 1);
139 if(key->schedule == NULL) {
140 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
143 ret = krb5_data_alloc(key->schedule, kt->schedule_size);
146 key->schedule = NULL;
149 (*kt->schedule)(context, kt, key);
153 /************************************************************
155 ************************************************************/
157 static krb5_error_code
158 SHA1_checksum(krb5_context context,
159 struct _krb5_key_data *key,
165 if (EVP_Digest(data, len, C->checksum.data, NULL, EVP_sha1(), NULL) != 1)
166 krb5_abortx(context, "sha1 checksum failed");
170 /* HMAC according to RFC2104 */
172 _krb5_internal_hmac(krb5_context context,
173 struct _krb5_checksum_type *cm,
177 struct _krb5_key_data *keyblock,
180 unsigned char *ipad, *opad;
185 ipad = malloc(cm->blocksize + len);
188 opad = malloc(cm->blocksize + cm->checksumsize);
193 memset(ipad, 0x36, cm->blocksize);
194 memset(opad, 0x5c, cm->blocksize);
196 if(keyblock->key->keyvalue.length > cm->blocksize){
197 (*cm->checksum)(context,
199 keyblock->key->keyvalue.data,
200 keyblock->key->keyvalue.length,
203 key = result->checksum.data;
204 key_len = result->checksum.length;
206 key = keyblock->key->keyvalue.data;
207 key_len = keyblock->key->keyvalue.length;
209 for(i = 0; i < key_len; i++){
213 memcpy(ipad + cm->blocksize, data, len);
214 (*cm->checksum)(context, keyblock, ipad, cm->blocksize + len,
216 memcpy(opad + cm->blocksize, result->checksum.data,
217 result->checksum.length);
218 (*cm->checksum)(context, keyblock, opad,
219 cm->blocksize + cm->checksumsize, usage, result);
220 memset(ipad, 0, cm->blocksize + len);
222 memset(opad, 0, cm->blocksize + cm->checksumsize);
228 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
229 krb5_hmac(krb5_context context,
230 krb5_cksumtype cktype,
237 struct _krb5_checksum_type *c = _krb5_find_checksum(cktype);
238 struct _krb5_key_data kd;
242 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
243 N_("checksum type %d not supported", ""),
245 return KRB5_PROG_SUMTYPE_NOSUPP;
251 ret = _krb5_internal_hmac(context, c, data, len, usage, &kd, result);
254 krb5_free_data(context, kd.schedule);
260 _krb5_SP_HMAC_SHA1_checksum(krb5_context context,
261 struct _krb5_key_data *key,
267 struct _krb5_checksum_type *c = _krb5_find_checksum(CKSUMTYPE_SHA1);
272 res.checksum.data = sha1_data;
273 res.checksum.length = sizeof(sha1_data);
275 ret = _krb5_internal_hmac(context, c, data, len, usage, key, &res);
277 krb5_abortx(context, "hmac failed");
278 memcpy(result->checksum.data, res.checksum.data, result->checksum.length);
282 struct _krb5_checksum_type _krb5_checksum_sha1 = {
292 struct _krb5_checksum_type *
293 _krb5_find_checksum(krb5_cksumtype type)
296 for(i = 0; i < _krb5_num_checksums; i++)
297 if(_krb5_checksum_types[i]->type == type)
298 return _krb5_checksum_types[i];
302 static krb5_error_code
303 get_checksum_key(krb5_context context,
305 unsigned usage, /* not krb5_key_usage */
306 struct _krb5_checksum_type *ct,
307 struct _krb5_key_data **key)
309 krb5_error_code ret = 0;
311 if(ct->flags & F_DERIVED)
312 ret = _get_derived_key(context, crypto, usage, key);
313 else if(ct->flags & F_VARIANT) {
316 *key = _new_derived_key(crypto, 0xff/* KRB5_KU_RFC1510_VARIANT */);
318 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
321 ret = krb5_copy_keyblock(context, crypto->key.key, &(*key)->key);
324 for(i = 0; i < (*key)->key->keyvalue.length; i++)
325 ((unsigned char*)(*key)->key->keyvalue.data)[i] ^= 0xF0;
330 ret = _key_schedule(context, *key);
334 static krb5_error_code
335 create_checksum (krb5_context context,
336 struct _krb5_checksum_type *ct,
344 struct _krb5_key_data *dkey;
347 if (ct->flags & F_DISABLED) {
348 krb5_clear_error_message (context);
349 return KRB5_PROG_SUMTYPE_NOSUPP;
351 keyed_checksum = (ct->flags & F_KEYED) != 0;
352 if(keyed_checksum && crypto == NULL) {
353 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
354 N_("Checksum type %s is keyed but no "
355 "crypto context (key) was passed in", ""),
357 return KRB5_PROG_SUMTYPE_NOSUPP; /* XXX */
360 ret = get_checksum_key(context, crypto, usage, ct, &dkey);
365 result->cksumtype = ct->type;
366 ret = krb5_data_alloc(&result->checksum, ct->checksumsize);
369 return (*ct->checksum)(context, dkey, data, len, usage, result);
373 arcfour_checksum_p(struct _krb5_checksum_type *ct, krb5_crypto crypto)
375 return (ct->type == CKSUMTYPE_HMAC_MD5) &&
376 (crypto->key.key->keytype == KEYTYPE_ARCFOUR);
379 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
380 krb5_create_checksum(krb5_context context,
382 krb5_key_usage usage,
388 struct _krb5_checksum_type *ct = NULL;
391 /* type 0 -> pick from crypto */
393 ct = _krb5_find_checksum(type);
395 ct = crypto->et->keyed_checksum;
397 ct = crypto->et->checksum;
401 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
402 N_("checksum type %d not supported", ""),
404 return KRB5_PROG_SUMTYPE_NOSUPP;
407 if (arcfour_checksum_p(ct, crypto)) {
409 _krb5_usage2arcfour(context, &keyusage);
411 keyusage = CHECKSUM_USAGE(usage);
413 return create_checksum(context, ct, crypto, keyusage,
417 static krb5_error_code
418 verify_checksum(krb5_context context,
420 unsigned usage, /* not krb5_key_usage */
426 struct _krb5_key_data *dkey;
429 struct _krb5_checksum_type *ct;
431 ct = _krb5_find_checksum(cksum->cksumtype);
432 if (ct == NULL || (ct->flags & F_DISABLED)) {
433 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
434 N_("checksum type %d not supported", ""),
436 return KRB5_PROG_SUMTYPE_NOSUPP;
438 if(ct->checksumsize != cksum->checksum.length) {
439 krb5_clear_error_message (context);
440 krb5_set_error_message(context, KRB5KRB_AP_ERR_BAD_INTEGRITY,
441 N_("Decrypt integrity check failed for checksum type %s, "
442 "length was %u, expected %u", ""),
443 ct->name, (unsigned)cksum->checksum.length,
444 (unsigned)ct->checksumsize);
446 return KRB5KRB_AP_ERR_BAD_INTEGRITY; /* XXX */
448 keyed_checksum = (ct->flags & F_KEYED) != 0;
450 struct _krb5_checksum_type *kct;
451 if (crypto == NULL) {
452 krb5_set_error_message(context, KRB5_PROG_SUMTYPE_NOSUPP,
453 N_("Checksum type %s is keyed but no "
454 "crypto context (key) was passed in", ""),
456 return KRB5_PROG_SUMTYPE_NOSUPP; /* XXX */
458 kct = crypto->et->keyed_checksum;
459 if (kct != NULL && kct->type != ct->type) {
460 krb5_set_error_message(context, KRB5_PROG_SUMTYPE_NOSUPP,
461 N_("Checksum type %s is keyed, but "
462 "the key type %s passed didnt have that checksum "
463 "type as the keyed type", ""),
464 ct->name, crypto->et->name);
465 return KRB5_PROG_SUMTYPE_NOSUPP; /* XXX */
468 ret = get_checksum_key(context, crypto, usage, ct, &dkey);
475 * If checksum have a verify function, lets use that instead of
476 * calling ->checksum and then compare result.
480 ret = (*ct->verify)(context, dkey, data, len, usage, cksum);
482 krb5_set_error_message(context, ret,
483 N_("Decrypt integrity check failed for checksum "
484 "type %s, key type %s", ""),
485 ct->name, (crypto != NULL)? crypto->et->name : "(none)");
489 ret = krb5_data_alloc (&c.checksum, ct->checksumsize);
493 ret = (*ct->checksum)(context, dkey, data, len, usage, &c);
495 krb5_data_free(&c.checksum);
499 if(krb5_data_ct_cmp(&c.checksum, &cksum->checksum) != 0) {
500 ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
501 krb5_set_error_message(context, ret,
502 N_("Decrypt integrity check failed for checksum "
503 "type %s, key type %s", ""),
504 ct->name, crypto ? crypto->et->name : "(unkeyed)");
508 krb5_data_free (&c.checksum);
512 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
513 krb5_verify_checksum(krb5_context context,
515 krb5_key_usage usage,
520 struct _krb5_checksum_type *ct;
523 ct = _krb5_find_checksum(cksum->cksumtype);
525 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
526 N_("checksum type %d not supported", ""),
528 return KRB5_PROG_SUMTYPE_NOSUPP;
531 if (arcfour_checksum_p(ct, crypto)) {
533 _krb5_usage2arcfour(context, &keyusage);
535 keyusage = CHECKSUM_USAGE(usage);
537 return verify_checksum(context, crypto, keyusage,
541 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
542 krb5_crypto_get_checksum_type(krb5_context context,
544 krb5_cksumtype *type)
546 struct _krb5_checksum_type *ct = NULL;
548 if (crypto != NULL) {
549 ct = crypto->et->keyed_checksum;
551 ct = crypto->et->checksum;
555 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
556 N_("checksum type not found", ""));
557 return KRB5_PROG_SUMTYPE_NOSUPP;
566 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
567 krb5_checksumsize(krb5_context context,
571 struct _krb5_checksum_type *ct = _krb5_find_checksum(type);
573 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
574 N_("checksum type %d not supported", ""),
576 return KRB5_PROG_SUMTYPE_NOSUPP;
578 *size = ct->checksumsize;
582 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
583 krb5_checksum_is_keyed(krb5_context context,
586 struct _krb5_checksum_type *ct = _krb5_find_checksum(type);
589 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
590 N_("checksum type %d not supported", ""),
592 return KRB5_PROG_SUMTYPE_NOSUPP;
594 return ct->flags & F_KEYED;
597 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
598 krb5_checksum_is_collision_proof(krb5_context context,
601 struct _krb5_checksum_type *ct = _krb5_find_checksum(type);
604 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
605 N_("checksum type %d not supported", ""),
607 return KRB5_PROG_SUMTYPE_NOSUPP;
609 return ct->flags & F_CPROOF;
612 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
613 krb5_checksum_disable(krb5_context context,
616 struct _krb5_checksum_type *ct = _krb5_find_checksum(type);
619 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
620 N_("checksum type %d not supported", ""),
622 return KRB5_PROG_SUMTYPE_NOSUPP;
624 ct->flags |= F_DISABLED;
628 /************************************************************
630 ************************************************************/
632 struct _krb5_encryption_type *
633 _krb5_find_enctype(krb5_enctype type)
636 for(i = 0; i < _krb5_num_etypes; i++)
637 if(_krb5_etypes[i]->type == type)
638 return _krb5_etypes[i];
643 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
644 krb5_enctype_to_string(krb5_context context,
648 struct _krb5_encryption_type *e;
649 e = _krb5_find_enctype(etype);
651 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
652 N_("encryption type %d not supported", ""),
655 return KRB5_PROG_ETYPE_NOSUPP;
657 *string = strdup(e->name);
658 if(*string == NULL) {
659 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
665 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
666 krb5_string_to_enctype(krb5_context context,
671 for(i = 0; i < _krb5_num_etypes; i++)
672 if(strcasecmp(_krb5_etypes[i]->name, string) == 0){
673 *etype = _krb5_etypes[i]->type;
676 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
677 N_("encryption type %s not supported", ""),
679 return KRB5_PROG_ETYPE_NOSUPP;
682 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
683 krb5_enctype_to_keytype(krb5_context context,
685 krb5_keytype *keytype)
687 struct _krb5_encryption_type *e = _krb5_find_enctype(etype);
689 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
690 N_("encryption type %d not supported", ""),
692 return KRB5_PROG_ETYPE_NOSUPP;
694 *keytype = e->keytype->type; /* XXX */
698 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
699 krb5_enctype_valid(krb5_context context,
702 struct _krb5_encryption_type *e = _krb5_find_enctype(etype);
704 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
705 N_("encryption type %d not supported", ""),
707 return KRB5_PROG_ETYPE_NOSUPP;
709 if (e->flags & F_DISABLED) {
710 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
711 N_("encryption type %s is disabled", ""),
713 return KRB5_PROG_ETYPE_NOSUPP;
719 * Return the coresponding encryption type for a checksum type.
721 * @param context Kerberos context
722 * @param ctype The checksum type to get the result enctype for
723 * @param etype The returned encryption, when the matching etype is
724 * not found, etype is set to ETYPE_NULL.
726 * @return Return an error code for an failure or 0 on success.
727 * @ingroup krb5_crypto
731 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
732 krb5_cksumtype_to_enctype(krb5_context context,
733 krb5_cksumtype ctype,
740 for(i = 0; i < _krb5_num_etypes; i++) {
741 if(_krb5_etypes[i]->keyed_checksum &&
742 _krb5_etypes[i]->keyed_checksum->type == ctype)
744 *etype = _krb5_etypes[i]->type;
749 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
750 N_("checksum type %d not supported", ""),
752 return KRB5_PROG_SUMTYPE_NOSUPP;
756 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
757 krb5_cksumtype_valid(krb5_context context,
758 krb5_cksumtype ctype)
760 struct _krb5_checksum_type *c = _krb5_find_checksum(ctype);
762 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
763 N_("checksum type %d not supported", ""),
765 return KRB5_PROG_SUMTYPE_NOSUPP;
767 if (c->flags & F_DISABLED) {
768 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
769 N_("checksum type %s is disabled", ""),
771 return KRB5_PROG_SUMTYPE_NOSUPP;
778 derived_crypto(krb5_context context,
781 return (crypto->et->flags & F_DERIVED) != 0;
785 special_crypto(krb5_context context,
788 return (crypto->et->flags & F_SPECIAL) != 0;
791 #define CHECKSUMSIZE(C) ((C)->checksumsize)
792 #define CHECKSUMTYPE(C) ((C)->type)
794 static krb5_error_code
795 encrypt_internal_derived(krb5_context context,
803 size_t sz, block_sz, checksum_sz, total_sz;
805 unsigned char *p, *q;
807 struct _krb5_key_data *dkey;
808 const struct _krb5_encryption_type *et = crypto->et;
810 checksum_sz = CHECKSUMSIZE(et->keyed_checksum);
812 sz = et->confoundersize + len;
813 block_sz = (sz + et->padsize - 1) &~ (et->padsize - 1); /* pad */
814 total_sz = block_sz + checksum_sz;
815 p = calloc(1, total_sz);
817 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
822 krb5_generate_random_block(q, et->confoundersize); /* XXX */
823 q += et->confoundersize;
824 memcpy(q, data, len);
826 ret = create_checksum(context,
829 INTEGRITY_USAGE(usage),
833 if(ret == 0 && cksum.checksum.length != checksum_sz) {
834 free_Checksum (&cksum);
835 krb5_clear_error_message (context);
836 ret = KRB5_CRYPTO_INTERNAL;
840 memcpy(p + block_sz, cksum.checksum.data, cksum.checksum.length);
841 free_Checksum (&cksum);
842 ret = _get_derived_key(context, crypto, ENCRYPTION_USAGE(usage), &dkey);
845 ret = _key_schedule(context, dkey);
848 ret = (*et->encrypt)(context, dkey, p, block_sz, 1, usage, ivec);
852 result->length = total_sz;
855 memset(p, 0, total_sz);
861 static krb5_error_code
862 encrypt_internal(krb5_context context,
869 size_t sz, block_sz, checksum_sz;
871 unsigned char *p, *q;
873 const struct _krb5_encryption_type *et = crypto->et;
875 checksum_sz = CHECKSUMSIZE(et->checksum);
877 sz = et->confoundersize + checksum_sz + len;
878 block_sz = (sz + et->padsize - 1) &~ (et->padsize - 1); /* pad */
879 p = calloc(1, block_sz);
881 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
886 krb5_generate_random_block(q, et->confoundersize); /* XXX */
887 q += et->confoundersize;
888 memset(q, 0, checksum_sz);
890 memcpy(q, data, len);
892 ret = create_checksum(context,
899 if(ret == 0 && cksum.checksum.length != checksum_sz) {
900 krb5_clear_error_message (context);
901 free_Checksum(&cksum);
902 ret = KRB5_CRYPTO_INTERNAL;
906 memcpy(p + et->confoundersize, cksum.checksum.data, cksum.checksum.length);
907 free_Checksum(&cksum);
908 ret = _key_schedule(context, &crypto->key);
911 ret = (*et->encrypt)(context, &crypto->key, p, block_sz, 1, 0, ivec);
913 memset(p, 0, block_sz);
918 result->length = block_sz;
921 memset(p, 0, block_sz);
926 static krb5_error_code
927 encrypt_internal_special(krb5_context context,
935 struct _krb5_encryption_type *et = crypto->et;
936 size_t cksum_sz = CHECKSUMSIZE(et->checksum);
937 size_t sz = len + cksum_sz + et->confoundersize;
943 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
947 memset (p, 0, cksum_sz);
949 krb5_generate_random_block(p, et->confoundersize);
950 p += et->confoundersize;
951 memcpy (p, data, len);
952 ret = (*et->encrypt)(context, &crypto->key, tmp, sz, TRUE, usage, ivec);
963 static krb5_error_code
964 decrypt_internal_derived(krb5_context context,
976 struct _krb5_key_data *dkey;
977 struct _krb5_encryption_type *et = crypto->et;
980 checksum_sz = CHECKSUMSIZE(et->keyed_checksum);
981 if (len < checksum_sz + et->confoundersize) {
982 krb5_set_error_message(context, KRB5_BAD_MSIZE,
983 N_("Encrypted data shorter then "
984 "checksum + confunder", ""));
985 return KRB5_BAD_MSIZE;
988 if (((len - checksum_sz) % et->padsize) != 0) {
989 krb5_clear_error_message(context);
990 return KRB5_BAD_MSIZE;
994 if(len != 0 && p == NULL) {
995 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
998 memcpy(p, data, len);
1002 ret = _get_derived_key(context, crypto, ENCRYPTION_USAGE(usage), &dkey);
1007 ret = _key_schedule(context, dkey);
1012 ret = (*et->encrypt)(context, dkey, p, len, 0, usage, ivec);
1018 cksum.checksum.data = p + len;
1019 cksum.checksum.length = checksum_sz;
1020 cksum.cksumtype = CHECKSUMTYPE(et->keyed_checksum);
1022 ret = verify_checksum(context,
1024 INTEGRITY_USAGE(usage),
1032 l = len - et->confoundersize;
1033 memmove(p, p + et->confoundersize, l);
1034 result->data = realloc(p, l);
1035 if(result->data == NULL && l != 0) {
1037 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
1044 static krb5_error_code
1045 decrypt_internal(krb5_context context,
1052 krb5_error_code ret;
1055 size_t checksum_sz, l;
1056 struct _krb5_encryption_type *et = crypto->et;
1058 if ((len % et->padsize) != 0) {
1059 krb5_clear_error_message(context);
1060 return KRB5_BAD_MSIZE;
1062 checksum_sz = CHECKSUMSIZE(et->checksum);
1063 if (len < checksum_sz + et->confoundersize) {
1064 krb5_set_error_message(context, KRB5_BAD_MSIZE,
1065 N_("Encrypted data shorter then "
1066 "checksum + confunder", ""));
1067 return KRB5_BAD_MSIZE;
1071 if(len != 0 && p == NULL) {
1072 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
1075 memcpy(p, data, len);
1077 ret = _key_schedule(context, &crypto->key);
1082 ret = (*et->encrypt)(context, &crypto->key, p, len, 0, 0, ivec);
1087 ret = krb5_data_copy(&cksum.checksum, p + et->confoundersize, checksum_sz);
1092 memset(p + et->confoundersize, 0, checksum_sz);
1093 cksum.cksumtype = CHECKSUMTYPE(et->checksum);
1094 ret = verify_checksum(context, NULL, 0, p, len, &cksum);
1095 free_Checksum(&cksum);
1100 l = len - et->confoundersize - checksum_sz;
1101 memmove(p, p + et->confoundersize + checksum_sz, l);
1102 result->data = realloc(p, l);
1103 if(result->data == NULL && l != 0) {
1105 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
1112 static krb5_error_code
1113 decrypt_internal_special(krb5_context context,
1121 struct _krb5_encryption_type *et = crypto->et;
1122 size_t cksum_sz = CHECKSUMSIZE(et->checksum);
1123 size_t sz = len - cksum_sz - et->confoundersize;
1125 krb5_error_code ret;
1127 if ((len % et->padsize) != 0) {
1128 krb5_clear_error_message(context);
1129 return KRB5_BAD_MSIZE;
1131 if (len < cksum_sz + et->confoundersize) {
1132 krb5_set_error_message(context, KRB5_BAD_MSIZE,
1133 N_("Encrypted data shorter then "
1134 "checksum + confunder", ""));
1135 return KRB5_BAD_MSIZE;
1140 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
1143 memcpy(p, data, len);
1145 ret = (*et->encrypt)(context, &crypto->key, p, len, FALSE, usage, ivec);
1151 memmove (p, p + cksum_sz + et->confoundersize, sz);
1152 result->data = realloc(p, sz);
1153 if(result->data == NULL && sz != 0) {
1155 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
1158 result->length = sz;
1162 static krb5_crypto_iov *
1163 find_iv(krb5_crypto_iov *data, int num_data, int type)
1166 for (i = 0; i < num_data; i++)
1167 if (data[i].flags == type)
1173 * Inline encrypt a kerberos message
1175 * @param context Kerberos context
1176 * @param crypto Kerberos crypto context
1177 * @param usage Key usage for this buffer
1178 * @param data array of buffers to process
1179 * @param num_data length of array
1180 * @param ivec initial cbc/cts vector
1182 * @return Return an error code or 0.
1183 * @ingroup krb5_crypto
1185 * Kerberos encrypted data look like this:
1187 * 1. KRB5_CRYPTO_TYPE_HEADER
1188 * 2. array [1,...] KRB5_CRYPTO_TYPE_DATA and array [0,...]
1189 * KRB5_CRYPTO_TYPE_SIGN_ONLY in any order, however the receiver
1190 * have to aware of the order. KRB5_CRYPTO_TYPE_SIGN_ONLY is
1191 * commonly used headers and trailers.
1192 * 3. KRB5_CRYPTO_TYPE_PADDING, at least on padsize long if padsize > 1
1193 * 4. KRB5_CRYPTO_TYPE_TRAILER
1196 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1197 krb5_encrypt_iov_ivec(krb5_context context,
1200 krb5_crypto_iov *data,
1204 size_t headersz, trailersz, len;
1206 size_t sz, block_sz, pad_sz;
1208 unsigned char *p, *q;
1209 krb5_error_code ret;
1210 struct _krb5_key_data *dkey;
1211 const struct _krb5_encryption_type *et = crypto->et;
1212 krb5_crypto_iov *tiv, *piv, *hiv;
1215 krb5_clear_error_message(context);
1216 return KRB5_CRYPTO_INTERNAL;
1219 if(!derived_crypto(context, crypto)) {
1220 krb5_clear_error_message(context);
1221 return KRB5_CRYPTO_INTERNAL;
1224 headersz = et->confoundersize;
1225 trailersz = CHECKSUMSIZE(et->keyed_checksum);
1227 for (len = 0, i = 0; i < num_data; i++) {
1228 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
1230 len += data[i].data.length;
1233 sz = headersz + len;
1234 block_sz = (sz + et->padsize - 1) &~ (et->padsize - 1); /* pad */
1236 pad_sz = block_sz - sz;
1240 hiv = find_iv(data, num_data, KRB5_CRYPTO_TYPE_HEADER);
1241 if (hiv == NULL || hiv->data.length != headersz)
1242 return KRB5_BAD_MSIZE;
1244 krb5_generate_random_block(hiv->data.data, hiv->data.length);
1247 piv = find_iv(data, num_data, KRB5_CRYPTO_TYPE_PADDING);
1248 /* its ok to have no TYPE_PADDING if there is no padding */
1249 if (piv == NULL && pad_sz != 0)
1250 return KRB5_BAD_MSIZE;
1252 if (piv->data.length < pad_sz)
1253 return KRB5_BAD_MSIZE;
1254 piv->data.length = pad_sz;
1256 memset(piv->data.data, pad_sz, pad_sz);
1262 tiv = find_iv(data, num_data, KRB5_CRYPTO_TYPE_TRAILER);
1263 if (tiv == NULL || tiv->data.length != trailersz)
1264 return KRB5_BAD_MSIZE;
1267 * XXX replace with EVP_Sign? at least make create_checksum an iov
1269 * XXX CTS EVP is broken, can't handle multi buffers :(
1273 for (i = 0; i < num_data; i++) {
1274 if (data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
1276 len += data[i].data.length;
1279 p = q = malloc(len);
1281 memcpy(q, hiv->data.data, hiv->data.length);
1282 q += hiv->data.length;
1283 for (i = 0; i < num_data; i++) {
1284 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA &&
1285 data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
1287 memcpy(q, data[i].data.data, data[i].data.length);
1288 q += data[i].data.length;
1291 memset(q, 0, piv->data.length);
1293 ret = create_checksum(context,
1296 INTEGRITY_USAGE(usage),
1301 if(ret == 0 && cksum.checksum.length != trailersz) {
1302 free_Checksum (&cksum);
1303 krb5_clear_error_message (context);
1304 ret = KRB5_CRYPTO_INTERNAL;
1309 /* save cksum at end */
1310 memcpy(tiv->data.data, cksum.checksum.data, cksum.checksum.length);
1311 free_Checksum (&cksum);
1313 /* XXX replace with EVP_Cipher */
1314 p = q = malloc(block_sz);
1318 memcpy(q, hiv->data.data, hiv->data.length);
1319 q += hiv->data.length;
1321 for (i = 0; i < num_data; i++) {
1322 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
1324 memcpy(q, data[i].data.data, data[i].data.length);
1325 q += data[i].data.length;
1328 memset(q, 0, piv->data.length);
1331 ret = _get_derived_key(context, crypto, ENCRYPTION_USAGE(usage), &dkey);
1336 ret = _key_schedule(context, dkey);
1342 ret = (*et->encrypt)(context, dkey, p, block_sz, 1, usage, ivec);
1348 /* now copy data back to buffers */
1351 memcpy(hiv->data.data, q, hiv->data.length);
1352 q += hiv->data.length;
1354 for (i = 0; i < num_data; i++) {
1355 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
1357 memcpy(data[i].data.data, q, data[i].data.length);
1358 q += data[i].data.length;
1361 memcpy(piv->data.data, q, pad_sz);
1369 * Inline decrypt a Kerberos message.
1371 * @param context Kerberos context
1372 * @param crypto Kerberos crypto context
1373 * @param usage Key usage for this buffer
1374 * @param data array of buffers to process
1375 * @param num_data length of array
1376 * @param ivec initial cbc/cts vector
1378 * @return Return an error code or 0.
1379 * @ingroup krb5_crypto
1381 * 1. KRB5_CRYPTO_TYPE_HEADER
1382 * 2. one KRB5_CRYPTO_TYPE_DATA and array [0,...] of KRB5_CRYPTO_TYPE_SIGN_ONLY in
1383 * any order, however the receiver have to aware of the
1384 * order. KRB5_CRYPTO_TYPE_SIGN_ONLY is commonly used unencrypoted
1385 * protocol headers and trailers. The output data will be of same
1386 * size as the input data or shorter.
1389 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1390 krb5_decrypt_iov_ivec(krb5_context context,
1393 krb5_crypto_iov *data,
1394 unsigned int num_data,
1398 size_t headersz, trailersz, len;
1400 unsigned char *p, *q;
1401 krb5_error_code ret;
1402 struct _krb5_key_data *dkey;
1403 struct _krb5_encryption_type *et = crypto->et;
1404 krb5_crypto_iov *tiv, *hiv;
1407 krb5_clear_error_message(context);
1408 return KRB5_CRYPTO_INTERNAL;
1411 if(!derived_crypto(context, crypto)) {
1412 krb5_clear_error_message(context);
1413 return KRB5_CRYPTO_INTERNAL;
1416 headersz = et->confoundersize;
1418 hiv = find_iv(data, num_data, KRB5_CRYPTO_TYPE_HEADER);
1419 if (hiv == NULL || hiv->data.length != headersz)
1420 return KRB5_BAD_MSIZE;
1423 trailersz = CHECKSUMSIZE(et->keyed_checksum);
1425 tiv = find_iv(data, num_data, KRB5_CRYPTO_TYPE_TRAILER);
1426 if (tiv->data.length != trailersz)
1427 return KRB5_BAD_MSIZE;
1429 /* Find length of data we will decrypt */
1432 for (i = 0; i < num_data; i++) {
1433 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
1435 len += data[i].data.length;
1438 if ((len % et->padsize) != 0) {
1439 krb5_clear_error_message(context);
1440 return KRB5_BAD_MSIZE;
1443 /* XXX replace with EVP_Cipher */
1445 p = q = malloc(len);
1449 memcpy(q, hiv->data.data, hiv->data.length);
1450 q += hiv->data.length;
1452 for (i = 0; i < num_data; i++) {
1453 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
1455 memcpy(q, data[i].data.data, data[i].data.length);
1456 q += data[i].data.length;
1459 ret = _get_derived_key(context, crypto, ENCRYPTION_USAGE(usage), &dkey);
1464 ret = _key_schedule(context, dkey);
1470 ret = (*et->encrypt)(context, dkey, p, len, 0, usage, ivec);
1476 /* copy data back to buffers */
1477 memcpy(hiv->data.data, p, hiv->data.length);
1478 q = p + hiv->data.length;
1479 for (i = 0; i < num_data; i++) {
1480 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
1482 memcpy(data[i].data.data, q, data[i].data.length);
1483 q += data[i].data.length;
1488 /* check signature */
1489 for (i = 0; i < num_data; i++) {
1490 if (data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
1492 len += data[i].data.length;
1495 p = q = malloc(len);
1499 memcpy(q, hiv->data.data, hiv->data.length);
1500 q += hiv->data.length;
1501 for (i = 0; i < num_data; i++) {
1502 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA &&
1503 data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
1505 memcpy(q, data[i].data.data, data[i].data.length);
1506 q += data[i].data.length;
1509 cksum.checksum.data = tiv->data.data;
1510 cksum.checksum.length = tiv->data.length;
1511 cksum.cksumtype = CHECKSUMTYPE(et->keyed_checksum);
1513 ret = verify_checksum(context,
1515 INTEGRITY_USAGE(usage),
1524 * Create a Kerberos message checksum.
1526 * @param context Kerberos context
1527 * @param crypto Kerberos crypto context
1528 * @param usage Key usage for this buffer
1529 * @param data array of buffers to process
1530 * @param num_data length of array
1531 * @param type output data
1533 * @return Return an error code or 0.
1534 * @ingroup krb5_crypto
1537 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1538 krb5_create_checksum_iov(krb5_context context,
1541 krb5_crypto_iov *data,
1542 unsigned int num_data,
1543 krb5_cksumtype *type)
1546 krb5_crypto_iov *civ;
1547 krb5_error_code ret;
1553 krb5_clear_error_message(context);
1554 return KRB5_CRYPTO_INTERNAL;
1557 if(!derived_crypto(context, crypto)) {
1558 krb5_clear_error_message(context);
1559 return KRB5_CRYPTO_INTERNAL;
1562 civ = find_iv(data, num_data, KRB5_CRYPTO_TYPE_CHECKSUM);
1564 return KRB5_BAD_MSIZE;
1567 for (i = 0; i < num_data; i++) {
1568 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA &&
1569 data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
1571 len += data[i].data.length;
1574 p = q = malloc(len);
1576 for (i = 0; i < num_data; i++) {
1577 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA &&
1578 data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
1580 memcpy(q, data[i].data.data, data[i].data.length);
1581 q += data[i].data.length;
1584 ret = krb5_create_checksum(context, crypto, usage, 0, p, len, &cksum);
1590 *type = cksum.cksumtype;
1592 if (cksum.checksum.length > civ->data.length) {
1593 krb5_set_error_message(context, KRB5_BAD_MSIZE,
1594 N_("Checksum larger then input buffer", ""));
1595 free_Checksum(&cksum);
1596 return KRB5_BAD_MSIZE;
1599 civ->data.length = cksum.checksum.length;
1600 memcpy(civ->data.data, cksum.checksum.data, civ->data.length);
1601 free_Checksum(&cksum);
1607 * Verify a Kerberos message checksum.
1609 * @param context Kerberos context
1610 * @param crypto Kerberos crypto context
1611 * @param usage Key usage for this buffer
1612 * @param data array of buffers to process
1613 * @param num_data length of array
1614 * @param type return checksum type if not NULL
1616 * @return Return an error code or 0.
1617 * @ingroup krb5_crypto
1620 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1621 krb5_verify_checksum_iov(krb5_context context,
1624 krb5_crypto_iov *data,
1625 unsigned int num_data,
1626 krb5_cksumtype *type)
1628 struct _krb5_encryption_type *et = crypto->et;
1630 krb5_crypto_iov *civ;
1631 krb5_error_code ret;
1637 krb5_clear_error_message(context);
1638 return KRB5_CRYPTO_INTERNAL;
1641 if(!derived_crypto(context, crypto)) {
1642 krb5_clear_error_message(context);
1643 return KRB5_CRYPTO_INTERNAL;
1646 civ = find_iv(data, num_data, KRB5_CRYPTO_TYPE_CHECKSUM);
1648 return KRB5_BAD_MSIZE;
1651 for (i = 0; i < num_data; i++) {
1652 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA &&
1653 data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
1655 len += data[i].data.length;
1658 p = q = malloc(len);
1660 for (i = 0; i < num_data; i++) {
1661 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA &&
1662 data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
1664 memcpy(q, data[i].data.data, data[i].data.length);
1665 q += data[i].data.length;
1668 cksum.cksumtype = CHECKSUMTYPE(et->keyed_checksum);
1669 cksum.checksum.length = civ->data.length;
1670 cksum.checksum.data = civ->data.data;
1672 ret = krb5_verify_checksum(context, crypto, usage, p, len, &cksum);
1675 if (ret == 0 && type)
1676 *type = cksum.cksumtype;
1682 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1683 krb5_crypto_length(krb5_context context,
1688 if (!derived_crypto(context, crypto)) {
1689 krb5_set_error_message(context, EINVAL, "not a derived crypto");
1694 case KRB5_CRYPTO_TYPE_EMPTY:
1697 case KRB5_CRYPTO_TYPE_HEADER:
1698 *len = crypto->et->blocksize;
1700 case KRB5_CRYPTO_TYPE_DATA:
1701 case KRB5_CRYPTO_TYPE_SIGN_ONLY:
1702 /* len must already been filled in */
1704 case KRB5_CRYPTO_TYPE_PADDING:
1705 if (crypto->et->padsize > 1)
1706 *len = crypto->et->padsize;
1710 case KRB5_CRYPTO_TYPE_TRAILER:
1711 *len = CHECKSUMSIZE(crypto->et->keyed_checksum);
1713 case KRB5_CRYPTO_TYPE_CHECKSUM:
1714 if (crypto->et->keyed_checksum)
1715 *len = CHECKSUMSIZE(crypto->et->keyed_checksum);
1717 *len = CHECKSUMSIZE(crypto->et->checksum);
1720 krb5_set_error_message(context, EINVAL,
1721 "%d not a supported type", type);
1726 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1727 krb5_crypto_length_iov(krb5_context context,
1729 krb5_crypto_iov *data,
1730 unsigned int num_data)
1732 krb5_error_code ret;
1735 for (i = 0; i < num_data; i++) {
1736 ret = krb5_crypto_length(context, crypto,
1738 &data[i].data.length);
1746 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1747 krb5_encrypt_ivec(krb5_context context,
1755 if(derived_crypto(context, crypto))
1756 return encrypt_internal_derived(context, crypto, usage,
1757 data, len, result, ivec);
1758 else if (special_crypto(context, crypto))
1759 return encrypt_internal_special (context, crypto, usage,
1760 data, len, result, ivec);
1762 return encrypt_internal(context, crypto, data, len, result, ivec);
1765 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1766 krb5_encrypt(krb5_context context,
1773 return krb5_encrypt_ivec(context, crypto, usage, data, len, result, NULL);
1776 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1777 krb5_encrypt_EncryptedData(krb5_context context,
1783 EncryptedData *result)
1785 result->etype = CRYPTO_ETYPE(crypto);
1787 ALLOC(result->kvno, 1);
1788 *result->kvno = kvno;
1790 result->kvno = NULL;
1791 return krb5_encrypt(context, crypto, usage, data, len, &result->cipher);
1794 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1795 krb5_decrypt_ivec(krb5_context context,
1803 if(derived_crypto(context, crypto))
1804 return decrypt_internal_derived(context, crypto, usage,
1805 data, len, result, ivec);
1806 else if (special_crypto (context, crypto))
1807 return decrypt_internal_special(context, crypto, usage,
1808 data, len, result, ivec);
1810 return decrypt_internal(context, crypto, data, len, result, ivec);
1813 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1814 krb5_decrypt(krb5_context context,
1821 return krb5_decrypt_ivec (context, crypto, usage, data, len, result,
1825 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1826 krb5_decrypt_EncryptedData(krb5_context context,
1829 const EncryptedData *e,
1832 return krb5_decrypt(context, crypto, usage,
1833 e->cipher.data, e->cipher.length, result);
1836 /************************************************************
1838 ************************************************************/
1841 _krb5_derive_key(krb5_context context,
1842 struct _krb5_encryption_type *et,
1843 struct _krb5_key_data *key,
1844 const void *constant,
1847 unsigned char *k = NULL;
1848 unsigned int nblocks = 0, i;
1849 krb5_error_code ret = 0;
1850 struct _krb5_key_type *kt = et->keytype;
1852 ret = _key_schedule(context, key);
1855 if(et->blocksize * 8 < kt->bits || len != et->blocksize) {
1856 nblocks = (kt->bits + et->blocksize * 8 - 1) / (et->blocksize * 8);
1857 k = malloc(nblocks * et->blocksize);
1860 krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
1863 ret = _krb5_n_fold(constant, len, k, et->blocksize);
1865 krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
1869 for(i = 0; i < nblocks; i++) {
1871 memcpy(k + i * et->blocksize,
1872 k + (i - 1) * et->blocksize,
1874 (*et->encrypt)(context, key, k + i * et->blocksize, et->blocksize,
1878 /* this case is probably broken, but won't be run anyway */
1879 void *c = malloc(len);
1880 size_t res_len = (kt->bits + 7) / 8;
1882 if(len != 0 && c == NULL) {
1884 krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
1887 memcpy(c, constant, len);
1888 (*et->encrypt)(context, key, c, len, 1, 0, NULL);
1889 k = malloc(res_len);
1890 if(res_len != 0 && k == NULL) {
1893 krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
1896 ret = _krb5_n_fold(c, len, k, res_len);
1899 krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
1904 /* XXX keytype dependent post-processing */
1907 _krb5_DES3_random_to_key(context, key->key, k, nblocks * et->blocksize);
1909 case KEYTYPE_AES128:
1910 case KEYTYPE_AES256:
1911 memcpy(key->key->keyvalue.data, k, key->key->keyvalue.length);
1914 ret = KRB5_CRYPTO_INTERNAL;
1915 krb5_set_error_message(context, ret,
1916 N_("derive_key() called with unknown keytype (%u)", ""),
1921 if (key->schedule) {
1922 free_key_schedule(context, key, et);
1923 key->schedule = NULL;
1926 memset(k, 0, nblocks * et->blocksize);
1932 static struct _krb5_key_data *
1933 _new_derived_key(krb5_crypto crypto, unsigned usage)
1935 struct _krb5_key_usage *d = crypto->key_usage;
1936 d = realloc(d, (crypto->num_key_usage + 1) * sizeof(*d));
1939 crypto->key_usage = d;
1940 d += crypto->num_key_usage++;
1941 memset(d, 0, sizeof(*d));
1946 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1947 krb5_derive_key(krb5_context context,
1948 const krb5_keyblock *key,
1950 const void *constant,
1951 size_t constant_len,
1952 krb5_keyblock **derived_key)
1954 krb5_error_code ret;
1955 struct _krb5_encryption_type *et;
1956 struct _krb5_key_data d;
1958 *derived_key = NULL;
1960 et = _krb5_find_enctype (etype);
1962 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
1963 N_("encryption type %d not supported", ""),
1965 return KRB5_PROG_ETYPE_NOSUPP;
1968 ret = krb5_copy_keyblock(context, key, &d.key);
1973 ret = _krb5_derive_key(context, et, &d, constant, constant_len);
1975 ret = krb5_copy_keyblock(context, d.key, derived_key);
1976 _krb5_free_key_data(context, &d, et);
1980 static krb5_error_code
1981 _get_derived_key(krb5_context context,
1984 struct _krb5_key_data **key)
1987 struct _krb5_key_data *d;
1988 unsigned char constant[5];
1990 for(i = 0; i < crypto->num_key_usage; i++)
1991 if(crypto->key_usage[i].usage == usage) {
1992 *key = &crypto->key_usage[i].key;
1995 d = _new_derived_key(crypto, usage);
1997 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
2000 krb5_copy_keyblock(context, crypto->key.key, &d->key);
2001 _krb5_put_int(constant, usage, 5);
2002 _krb5_derive_key(context, crypto->et, d, constant, sizeof(constant));
2008 * Create a crypto context used for all encryption and signature
2009 * operation. The encryption type to use is taken from the key, but
2010 * can be overridden with the enctype parameter. This can be useful
2011 * for encryptions types which is compatiable (DES for example).
2013 * To free the crypto context, use krb5_crypto_destroy().
2015 * @param context Kerberos context
2016 * @param key the key block information with all key data
2017 * @param etype the encryption type
2018 * @param crypto the resulting crypto context
2020 * @return Return an error code or 0.
2022 * @ingroup krb5_crypto
2025 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
2026 krb5_crypto_init(krb5_context context,
2027 const krb5_keyblock *key,
2029 krb5_crypto *crypto)
2031 krb5_error_code ret;
2033 if(*crypto == NULL) {
2034 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
2037 if(etype == ETYPE_NULL)
2038 etype = key->keytype;
2039 (*crypto)->et = _krb5_find_enctype(etype);
2040 if((*crypto)->et == NULL || ((*crypto)->et->flags & F_DISABLED)) {
2043 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
2044 N_("encryption type %d not supported", ""),
2046 return KRB5_PROG_ETYPE_NOSUPP;
2048 if((*crypto)->et->keytype->size != key->keyvalue.length) {
2051 krb5_set_error_message (context, KRB5_BAD_KEYSIZE,
2052 "encryption key has bad length");
2053 return KRB5_BAD_KEYSIZE;
2055 ret = krb5_copy_keyblock(context, key, &(*crypto)->key.key);
2061 (*crypto)->key.schedule = NULL;
2062 (*crypto)->num_key_usage = 0;
2063 (*crypto)->key_usage = NULL;
2068 free_key_schedule(krb5_context context,
2069 struct _krb5_key_data *key,
2070 struct _krb5_encryption_type *et)
2072 if (et->keytype->cleanup)
2073 (*et->keytype->cleanup)(context, key);
2074 memset(key->schedule->data, 0, key->schedule->length);
2075 krb5_free_data(context, key->schedule);
2079 _krb5_free_key_data(krb5_context context, struct _krb5_key_data *key,
2080 struct _krb5_encryption_type *et)
2082 krb5_free_keyblock(context, key->key);
2084 free_key_schedule(context, key, et);
2085 key->schedule = NULL;
2090 free_key_usage(krb5_context context, struct _krb5_key_usage *ku,
2091 struct _krb5_encryption_type *et)
2093 _krb5_free_key_data(context, &ku->key, et);
2097 * Free a crypto context created by krb5_crypto_init().
2099 * @param context Kerberos context
2100 * @param crypto crypto context to free
2102 * @return Return an error code or 0.
2104 * @ingroup krb5_crypto
2107 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
2108 krb5_crypto_destroy(krb5_context context,
2113 for(i = 0; i < crypto->num_key_usage; i++)
2114 free_key_usage(context, &crypto->key_usage[i], crypto->et);
2115 free(crypto->key_usage);
2116 _krb5_free_key_data(context, &crypto->key, crypto->et);
2122 * Return the blocksize used algorithm referenced by the crypto context
2124 * @param context Kerberos context
2125 * @param crypto crypto context to query
2126 * @param blocksize the resulting blocksize
2128 * @return Return an error code or 0.
2130 * @ingroup krb5_crypto
2133 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
2134 krb5_crypto_getblocksize(krb5_context context,
2138 *blocksize = crypto->et->blocksize;
2143 * Return the encryption type used by the crypto context
2145 * @param context Kerberos context
2146 * @param crypto crypto context to query
2147 * @param enctype the resulting encryption type
2149 * @return Return an error code or 0.
2151 * @ingroup krb5_crypto
2154 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
2155 krb5_crypto_getenctype(krb5_context context,
2157 krb5_enctype *enctype)
2159 *enctype = crypto->et->type;
2164 * Return the padding size used by the crypto context
2166 * @param context Kerberos context
2167 * @param crypto crypto context to query
2168 * @param padsize the return padding size
2170 * @return Return an error code or 0.
2172 * @ingroup krb5_crypto
2175 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
2176 krb5_crypto_getpadsize(krb5_context context,
2180 *padsize = crypto->et->padsize;
2185 * Return the confounder size used by the crypto context
2187 * @param context Kerberos context
2188 * @param crypto crypto context to query
2189 * @param confoundersize the returned confounder size
2191 * @return Return an error code or 0.
2193 * @ingroup krb5_crypto
2196 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
2197 krb5_crypto_getconfoundersize(krb5_context context,
2199 size_t *confoundersize)
2201 *confoundersize = crypto->et->confoundersize;
2207 * Disable encryption type
2209 * @param context Kerberos 5 context
2210 * @param enctype encryption type to disable
2212 * @return Return an error code or 0.
2214 * @ingroup krb5_crypto
2217 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
2218 krb5_enctype_disable(krb5_context context,
2219 krb5_enctype enctype)
2221 struct _krb5_encryption_type *et = _krb5_find_enctype(enctype);
2224 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
2225 N_("encryption type %d not supported", ""),
2227 return KRB5_PROG_ETYPE_NOSUPP;
2229 et->flags |= F_DISABLED;
2234 * Enable encryption type
2236 * @param context Kerberos 5 context
2237 * @param enctype encryption type to enable
2239 * @return Return an error code or 0.
2241 * @ingroup krb5_crypto
2244 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
2245 krb5_enctype_enable(krb5_context context,
2246 krb5_enctype enctype)
2248 struct _krb5_encryption_type *et = _krb5_find_enctype(enctype);
2251 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
2252 N_("encryption type %d not supported", ""),
2254 return KRB5_PROG_ETYPE_NOSUPP;
2256 et->flags &= ~F_DISABLED;
2261 * Enable or disable all weak encryption types
2263 * @param context Kerberos 5 context
2264 * @param enable true to enable, false to disable
2266 * @return Return an error code or 0.
2268 * @ingroup krb5_crypto
2271 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
2272 krb5_allow_weak_crypto(krb5_context context,
2273 krb5_boolean enable)
2277 for(i = 0; i < _krb5_num_etypes; i++)
2278 if(_krb5_etypes[i]->flags & F_WEAK) {
2280 _krb5_etypes[i]->flags &= ~F_DISABLED;
2282 _krb5_etypes[i]->flags |= F_DISABLED;
2288 wrapped_length (krb5_context context,
2292 struct _krb5_encryption_type *et = crypto->et;
2293 size_t padsize = et->padsize;
2294 size_t checksumsize = CHECKSUMSIZE(et->checksum);
2297 res = et->confoundersize + checksumsize + data_len;
2298 res = (res + padsize - 1) / padsize * padsize;
2303 wrapped_length_dervied (krb5_context context,
2307 struct _krb5_encryption_type *et = crypto->et;
2308 size_t padsize = et->padsize;
2311 res = et->confoundersize + data_len;
2312 res = (res + padsize - 1) / padsize * padsize;
2313 if (et->keyed_checksum)
2314 res += et->keyed_checksum->checksumsize;
2316 res += et->checksum->checksumsize;
2321 * Return the size of an encrypted packet of length `data_len'
2324 KRB5_LIB_FUNCTION size_t KRB5_LIB_CALL
2325 krb5_get_wrapped_length (krb5_context context,
2329 if (derived_crypto (context, crypto))
2330 return wrapped_length_dervied (context, crypto, data_len);
2332 return wrapped_length (context, crypto, data_len);
2336 * Return the size of an encrypted packet of length `data_len'
2340 crypto_overhead (krb5_context context,
2343 struct _krb5_encryption_type *et = crypto->et;
2346 res = CHECKSUMSIZE(et->checksum);
2347 res += et->confoundersize;
2348 if (et->padsize > 1)
2354 crypto_overhead_dervied (krb5_context context,
2357 struct _krb5_encryption_type *et = crypto->et;
2360 if (et->keyed_checksum)
2361 res = CHECKSUMSIZE(et->keyed_checksum);
2363 res = CHECKSUMSIZE(et->checksum);
2364 res += et->confoundersize;
2365 if (et->padsize > 1)
2370 KRB5_LIB_FUNCTION size_t KRB5_LIB_CALL
2371 krb5_crypto_overhead (krb5_context context, krb5_crypto crypto)
2373 if (derived_crypto (context, crypto))
2374 return crypto_overhead_dervied (context, crypto);
2376 return crypto_overhead (context, crypto);
2380 * Converts the random bytestring to a protocol key according to
2381 * Kerberos crypto frame work. It may be assumed that all the bits of
2382 * the input string are equally random, even though the entropy
2383 * present in the random source may be limited.
2385 * @param context Kerberos 5 context
2386 * @param type the enctype resulting key will be of
2387 * @param data input random data to convert to a key
2388 * @param size size of input random data, at least krb5_enctype_keysize() long
2389 * @param key key, output key, free with krb5_free_keyblock_contents()
2391 * @return Return an error code or 0.
2393 * @ingroup krb5_crypto
2396 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
2397 krb5_random_to_key(krb5_context context,
2403 krb5_error_code ret;
2404 struct _krb5_encryption_type *et = _krb5_find_enctype(type);
2406 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
2407 N_("encryption type %d not supported", ""),
2409 return KRB5_PROG_ETYPE_NOSUPP;
2411 if ((et->keytype->bits + 7) / 8 > size) {
2412 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
2413 N_("encryption key %s needs %d bytes "
2414 "of random to make an encryption key "
2416 et->name, (int)et->keytype->size);
2417 return KRB5_PROG_ETYPE_NOSUPP;
2419 ret = krb5_data_alloc(&key->keyvalue, et->keytype->size);
2422 key->keytype = type;
2423 if (et->keytype->random_to_key)
2424 (*et->keytype->random_to_key)(context, key, data, size);
2426 memcpy(key->keyvalue.data, data, et->keytype->size);
2433 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
2434 krb5_crypto_prf_length(krb5_context context,
2438 struct _krb5_encryption_type *et = _krb5_find_enctype(type);
2440 if(et == NULL || et->prf_length == 0) {
2441 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
2442 N_("encryption type %d not supported", ""),
2444 return KRB5_PROG_ETYPE_NOSUPP;
2447 *length = et->prf_length;
2451 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
2452 krb5_crypto_prf(krb5_context context,
2453 const krb5_crypto crypto,
2454 const krb5_data *input,
2457 struct _krb5_encryption_type *et = crypto->et;
2459 krb5_data_zero(output);
2461 if(et->prf == NULL) {
2462 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
2463 "kerberos prf for %s not supported",
2465 return KRB5_PROG_ETYPE_NOSUPP;
2468 return (*et->prf)(context, crypto, input, output);
2471 static krb5_error_code
2472 krb5_crypto_prfplus(krb5_context context,
2473 const krb5_crypto crypto,
2474 const krb5_data *input,
2478 krb5_error_code ret;
2480 unsigned char i = 1;
2483 krb5_data_zero(&input2);
2484 krb5_data_zero(output);
2486 krb5_clear_error_message(context);
2488 ret = krb5_data_alloc(output, length);
2490 ret = krb5_data_alloc(&input2, input->length + 1);
2493 krb5_clear_error_message(context);
2495 memcpy(((unsigned char *)input2.data) + 1, input->data, input->length);
2502 ((unsigned char *)input2.data)[0] = i++;
2504 ret = krb5_crypto_prf(context, crypto, &input2, &block);
2508 if (block.length < length) {
2509 memcpy(p, block.data, block.length);
2510 length -= block.length;
2512 memcpy(p, block.data, length);
2516 krb5_data_free(&block);
2520 krb5_data_free(&input2);
2522 krb5_data_free(output);
2527 * The FX-CF2 key derivation function, used in FAST and preauth framework.
2529 * @param context Kerberos 5 context
2530 * @param crypto1 first key to combine
2531 * @param crypto2 second key to combine
2532 * @param pepper1 factor to combine with first key to garante uniqueness
2533 * @param pepper2 factor to combine with second key to garante uniqueness
2534 * @param enctype the encryption type of the resulting key
2535 * @param res allocated key, free with krb5_free_keyblock_contents()
2537 * @return Return an error code or 0.
2539 * @ingroup krb5_crypto
2542 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
2543 krb5_crypto_fx_cf2(krb5_context context,
2544 const krb5_crypto crypto1,
2545 const krb5_crypto crypto2,
2548 krb5_enctype enctype,
2551 krb5_error_code ret;
2555 memset(res, 0, sizeof(*res));
2557 ret = krb5_enctype_keysize(context, enctype, &keysize);
2561 ret = krb5_data_alloc(&res->keyvalue, keysize);
2564 ret = krb5_crypto_prfplus(context, crypto1, pepper1, keysize, &os1);
2567 ret = krb5_crypto_prfplus(context, crypto2, pepper2, keysize, &os2);
2571 res->keytype = enctype;
2573 unsigned char *p1 = os1.data, *p2 = os2.data, *p3 = res->keyvalue.data;
2574 for (i = 0; i < keysize; i++)
2575 p3[i] = p1[i] ^ p2[i];
2579 krb5_data_free(&res->keyvalue);
2580 krb5_data_free(&os1);
2581 krb5_data_free(&os2);
2588 #ifndef HEIMDAL_SMALLER
2591 * Deprecated: keytypes doesn't exists, they are really enctypes.
2593 * @ingroup krb5_deprecated
2597 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
2598 krb5_keytype_to_enctypes (krb5_context context,
2599 krb5_keytype keytype,
2607 for (i = _krb5_num_etypes - 1; i >= 0; --i) {
2608 if (_krb5_etypes[i]->keytype->type == keytype
2609 && !(_krb5_etypes[i]->flags & F_PSEUDO)
2610 && krb5_enctype_valid(context, _krb5_etypes[i]->type) == 0)
2614 krb5_set_error_message(context, KRB5_PROG_KEYTYPE_NOSUPP,
2615 "Keytype have no mapping");
2616 return KRB5_PROG_KEYTYPE_NOSUPP;
2619 ret = malloc(n * sizeof(*ret));
2620 if (ret == NULL && n != 0) {
2621 krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
2625 for (i = _krb5_num_etypes - 1; i >= 0; --i) {
2626 if (_krb5_etypes[i]->keytype->type == keytype
2627 && !(_krb5_etypes[i]->flags & F_PSEUDO)
2628 && krb5_enctype_valid(context, _krb5_etypes[i]->type) == 0)
2629 ret[n++] = _krb5_etypes[i]->type;
2637 * Deprecated: keytypes doesn't exists, they are really enctypes.
2639 * @ingroup krb5_deprecated
2642 /* if two enctypes have compatible keys */
2644 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
2645 krb5_enctypes_compatible_keys(krb5_context context,
2646 krb5_enctype etype1,
2647 krb5_enctype etype2)
2649 struct _krb5_encryption_type *e1 = _krb5_find_enctype(etype1);
2650 struct _krb5_encryption_type *e2 = _krb5_find_enctype(etype2);
2651 return e1 != NULL && e2 != NULL && e1->keytype == e2->keytype;
2654 #endif /* HEIMDAL_SMALLER */