ssh-dss.c revision 92555 
1/*
2 * Copyright (c) 2000 Markus Friedl.  All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 *    notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 *    notice, this list of conditions and the following disclaimer in the
11 *    documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
24
25#include "includes.h"
26RCSID("$OpenBSD: ssh-dss.c,v 1.14 2002/02/28 15:46:33 markus Exp $");
27
28#include <openssl/bn.h>
29#include <openssl/evp.h>
30
31#include "xmalloc.h"
32#include "buffer.h"
33#include "bufaux.h"
34#include "compat.h"
35#include "log.h"
36#include "key.h"
37#include "ssh-dss.h"
38
39#define INTBLOB_LEN	20
40#define SIGBLOB_LEN	(2*INTBLOB_LEN)
41
42int
43ssh_dss_sign(
44    Key *key,
45    u_char **sigp, u_int *lenp,
46    u_char *data, u_int datalen)
47{
48	DSA_SIG *sig;
49	const EVP_MD *evp_md = EVP_sha1();
50	EVP_MD_CTX md;
51	u_char *ret, digest[EVP_MAX_MD_SIZE], sigblob[SIGBLOB_LEN];
52	u_int rlen, slen, len, dlen;
53	Buffer b;
54
55	if (key == NULL || key->type != KEY_DSA || key->dsa == NULL) {
56		error("ssh_dss_sign: no DSA key");
57		return -1;
58	}
59	EVP_DigestInit(&md, evp_md);
60	EVP_DigestUpdate(&md, data, datalen);
61	EVP_DigestFinal(&md, digest, &dlen);
62
63	sig = DSA_do_sign(digest, dlen, key->dsa);
64	memset(digest, 'd', sizeof(digest));
65
66	if (sig == NULL) {
67		error("ssh_dss_sign: sign failed");
68		return -1;
69	}
70
71	rlen = BN_num_bytes(sig->r);
72	slen = BN_num_bytes(sig->s);
73	if (rlen > INTBLOB_LEN || slen > INTBLOB_LEN) {
74		error("bad sig size %d %d", rlen, slen);
75		DSA_SIG_free(sig);
76		return -1;
77	}
78	memset(sigblob, 0, SIGBLOB_LEN);
79	BN_bn2bin(sig->r, sigblob+ SIGBLOB_LEN - INTBLOB_LEN - rlen);
80	BN_bn2bin(sig->s, sigblob+ SIGBLOB_LEN - slen);
81	DSA_SIG_free(sig);
82
83	if (datafellows & SSH_BUG_SIGBLOB) {
84		ret = xmalloc(SIGBLOB_LEN);
85		memcpy(ret, sigblob, SIGBLOB_LEN);
86		if (lenp != NULL)
87			*lenp = SIGBLOB_LEN;
88		if (sigp != NULL)
89			*sigp = ret;
90	} else {
91		/* ietf-drafts */
92		buffer_init(&b);
93		buffer_put_cstring(&b, "ssh-dss");
94		buffer_put_string(&b, sigblob, SIGBLOB_LEN);
95		len = buffer_len(&b);
96		ret = xmalloc(len);
97		memcpy(ret, buffer_ptr(&b), len);
98		buffer_free(&b);
99		if (lenp != NULL)
100			*lenp = len;
101		if (sigp != NULL)
102			*sigp = ret;
103	}
104	return 0;
105}
106int
107ssh_dss_verify(
108    Key *key,
109    u_char *signature, u_int signaturelen,
110    u_char *data, u_int datalen)
111{
112	DSA_SIG *sig;
113	const EVP_MD *evp_md = EVP_sha1();
114	EVP_MD_CTX md;
115	u_char digest[EVP_MAX_MD_SIZE], *sigblob;
116	u_int len, dlen;
117	int rlen, ret;
118	Buffer b;
119
120	if (key == NULL || key->type != KEY_DSA || key->dsa == NULL) {
121		error("ssh_dss_verify: no DSA key");
122		return -1;
123	}
124
125	/* fetch signature */
126	if (datafellows & SSH_BUG_SIGBLOB) {
127		sigblob = signature;
128		len = signaturelen;
129	} else {
130		/* ietf-drafts */
131		char *ktype;
132		buffer_init(&b);
133		buffer_append(&b, signature, signaturelen);
134		ktype = buffer_get_string(&b, NULL);
135		if (strcmp("ssh-dss", ktype) != 0) {
136			error("ssh_dss_verify: cannot handle type %s", ktype);
137			buffer_free(&b);
138			xfree(ktype);
139			return -1;
140		}
141		xfree(ktype);
142		sigblob = buffer_get_string(&b, &len);
143		rlen = buffer_len(&b);
144		buffer_free(&b);
145		if (rlen != 0) {
146			error("ssh_dss_verify: "
147			    "remaining bytes in signature %d", rlen);
148			xfree(sigblob);
149			return -1;
150		}
151	}
152
153	if (len != SIGBLOB_LEN) {
154		fatal("bad sigbloblen %d != SIGBLOB_LEN", len);
155	}
156
157	/* parse signature */
158	if ((sig = DSA_SIG_new()) == NULL)
159		fatal("ssh_dss_verify: DSA_SIG_new failed");
160	if ((sig->r = BN_new()) == NULL)
161		fatal("ssh_dss_verify: BN_new failed");
162	if ((sig->s = BN_new()) == NULL)
163		fatal("ssh_dss_verify: BN_new failed");
164	BN_bin2bn(sigblob, INTBLOB_LEN, sig->r);
165	BN_bin2bn(sigblob+ INTBLOB_LEN, INTBLOB_LEN, sig->s);
166
167	if (!(datafellows & SSH_BUG_SIGBLOB)) {
168		memset(sigblob, 0, len);
169		xfree(sigblob);
170	}
171
172	/* sha1 the data */
173	EVP_DigestInit(&md, evp_md);
174	EVP_DigestUpdate(&md, data, datalen);
175	EVP_DigestFinal(&md, digest, &dlen);
176
177	ret = DSA_do_verify(digest, dlen, sig, key->dsa);
178	memset(digest, 'd', sizeof(digest));
179
180	DSA_SIG_free(sig);
181
182	debug("ssh_dss_verify: signature %s",
183	    ret == 1 ? "correct" : ret == 0 ? "incorrect" : "error");
184	return ret;
185}
186