cipher-3des1.c revision 221420
112099Sjoerg/* $OpenBSD: cipher-3des1.c,v 1.7 2010/10/01 23:05:32 djm Exp $ */ 212099Sjoerg/* 312099Sjoerg * Copyright (c) 2003 Markus Friedl. All rights reserved. 412099Sjoerg * 512099Sjoerg * Redistribution and use in source and binary forms, with or without 612099Sjoerg * modification, are permitted provided that the following conditions 712099Sjoerg * are met: 812099Sjoerg * 1. Redistributions of source code must retain the above copyright 912099Sjoerg * notice, this list of conditions and the following disclaimer. 1012099Sjoerg * 2. Redistributions in binary form must reproduce the above copyright 1112099Sjoerg * notice, this list of conditions and the following disclaimer in the 1212099Sjoerg * documentation and/or other materials provided with the distribution. 1312099Sjoerg * 1412099Sjoerg * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 1512099Sjoerg * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 1612099Sjoerg * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 1712099Sjoerg * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 1812099Sjoerg * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 1912099Sjoerg * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 2012099Sjoerg * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 2112099Sjoerg * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 2212099Sjoerg * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 2312099Sjoerg * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 2412099Sjoerg */ 2512099Sjoerg 2612099Sjoerg#include "includes.h" 2712099Sjoerg 2812099Sjoerg#include <sys/types.h> 2912099Sjoerg 3012099Sjoerg#include <openssl/evp.h> 3112099Sjoerg 3212099Sjoerg#include <stdarg.h> 3312099Sjoerg#include <string.h> 3412099Sjoerg 3512099Sjoerg#include "xmalloc.h" 3612099Sjoerg#include "log.h" 3712099Sjoerg 3812099Sjoerg#include "openbsd-compat/openssl-compat.h" 3912099Sjoerg 4012099Sjoerg/* 4112099Sjoerg * This is used by SSH1: 4212099Sjoerg * 4312099Sjoerg * What kind of triple DES are these 2 routines? 4412099Sjoerg * 4512099Sjoerg * Why is there a redundant initialization vector? 4612099Sjoerg * 4712099Sjoerg * If only iv3 was used, then, this would till effect have been 4812099Sjoerg * outer-cbc. However, there is also a private iv1 == iv2 which 4912099Sjoerg * perhaps makes differential analysis easier. On the other hand, the 5012099Sjoerg * private iv1 probably makes the CRC-32 attack ineffective. This is a 5191586Smarkm * result of that there is no longer any known iv1 to use when 5212099Sjoerg * choosing the X block. 5312099Sjoerg */ 5412099Sjoergstruct ssh1_3des_ctx 5512099Sjoerg{ 5612099Sjoerg EVP_CIPHER_CTX k1, k2, k3; 5712099Sjoerg}; 5812099Sjoerg 5912099Sjoergconst EVP_CIPHER * evp_ssh1_3des(void); 6012099Sjoergvoid ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int); 6112099Sjoerg 6212099Sjoergstatic int 6312099Sjoergssh1_3des_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv, 6412099Sjoerg int enc) 6512099Sjoerg{ 6612099Sjoerg struct ssh1_3des_ctx *c; 6712099Sjoerg u_char *k1, *k2, *k3; 6812099Sjoerg 6912099Sjoerg if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { 7012099Sjoerg c = xmalloc(sizeof(*c)); 7112099Sjoerg EVP_CIPHER_CTX_set_app_data(ctx, c); 7212099Sjoerg } 7312099Sjoerg if (key == NULL) 7412099Sjoerg return (1); 7512099Sjoerg if (enc == -1) 7612099Sjoerg enc = ctx->encrypt; 7712099Sjoerg k1 = k2 = k3 = (u_char *) key; 7812099Sjoerg k2 += 8; 7912099Sjoerg if (EVP_CIPHER_CTX_key_length(ctx) >= 16+8) { 8012099Sjoerg if (enc) 8112099Sjoerg k3 += 16; 8212099Sjoerg else 8312099Sjoerg k1 += 16; 8412099Sjoerg } 8512099Sjoerg EVP_CIPHER_CTX_init(&c->k1); 8612099Sjoerg EVP_CIPHER_CTX_init(&c->k2); 8712099Sjoerg EVP_CIPHER_CTX_init(&c->k3); 8812099Sjoerg#ifdef SSH_OLD_EVP 8912099Sjoerg EVP_CipherInit(&c->k1, EVP_des_cbc(), k1, NULL, enc); 9012099Sjoerg EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc); 9112099Sjoerg EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc); 9212099Sjoerg#else 9312099Sjoerg if (EVP_CipherInit(&c->k1, EVP_des_cbc(), k1, NULL, enc) == 0 || 9412099Sjoerg EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc) == 0 || 9512099Sjoerg EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc) == 0) { 9612099Sjoerg memset(c, 0, sizeof(*c)); 9712099Sjoerg xfree(c); 9812099Sjoerg EVP_CIPHER_CTX_set_app_data(ctx, NULL); 9912099Sjoerg return (0); 10012099Sjoerg } 10112099Sjoerg#endif 10212099Sjoerg return (1); 10312099Sjoerg} 10412099Sjoerg 10512099Sjoergstatic int 10612099Sjoergssh1_3des_cbc(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src, 10712099Sjoerg LIBCRYPTO_EVP_INL_TYPE len) 10812099Sjoerg{ 10912099Sjoerg struct ssh1_3des_ctx *c; 11012099Sjoerg 11112099Sjoerg if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { 11212099Sjoerg error("ssh1_3des_cbc: no context"); 11312099Sjoerg return (0); 11412099Sjoerg } 11512099Sjoerg#ifdef SSH_OLD_EVP 11612099Sjoerg EVP_Cipher(&c->k1, dest, (u_char *)src, len); 11712099Sjoerg EVP_Cipher(&c->k2, dest, dest, len); 11812099Sjoerg EVP_Cipher(&c->k3, dest, dest, len); 11912099Sjoerg#else 12012099Sjoerg if (EVP_Cipher(&c->k1, dest, (u_char *)src, len) == 0 || 121 EVP_Cipher(&c->k2, dest, dest, len) == 0 || 122 EVP_Cipher(&c->k3, dest, dest, len) == 0) 123 return (0); 124#endif 125 return (1); 126} 127 128static int 129ssh1_3des_cleanup(EVP_CIPHER_CTX *ctx) 130{ 131 struct ssh1_3des_ctx *c; 132 133 if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) { 134 EVP_CIPHER_CTX_cleanup(&c->k1); 135 EVP_CIPHER_CTX_cleanup(&c->k2); 136 EVP_CIPHER_CTX_cleanup(&c->k3); 137 memset(c, 0, sizeof(*c)); 138 xfree(c); 139 EVP_CIPHER_CTX_set_app_data(ctx, NULL); 140 } 141 return (1); 142} 143 144void 145ssh1_3des_iv(EVP_CIPHER_CTX *evp, int doset, u_char *iv, int len) 146{ 147 struct ssh1_3des_ctx *c; 148 149 if (len != 24) 150 fatal("%s: bad 3des iv length: %d", __func__, len); 151 if ((c = EVP_CIPHER_CTX_get_app_data(evp)) == NULL) 152 fatal("%s: no 3des context", __func__); 153 if (doset) { 154 debug3("%s: Installed 3DES IV", __func__); 155 memcpy(c->k1.iv, iv, 8); 156 memcpy(c->k2.iv, iv + 8, 8); 157 memcpy(c->k3.iv, iv + 16, 8); 158 } else { 159 debug3("%s: Copying 3DES IV", __func__); 160 memcpy(iv, c->k1.iv, 8); 161 memcpy(iv + 8, c->k2.iv, 8); 162 memcpy(iv + 16, c->k3.iv, 8); 163 } 164} 165 166const EVP_CIPHER * 167evp_ssh1_3des(void) 168{ 169 static EVP_CIPHER ssh1_3des; 170 171 memset(&ssh1_3des, 0, sizeof(EVP_CIPHER)); 172 ssh1_3des.nid = NID_undef; 173 ssh1_3des.block_size = 8; 174 ssh1_3des.iv_len = 0; 175 ssh1_3des.key_len = 16; 176 ssh1_3des.init = ssh1_3des_init; 177 ssh1_3des.cleanup = ssh1_3des_cleanup; 178 ssh1_3des.do_cipher = ssh1_3des_cbc; 179#ifndef SSH_OLD_EVP 180 ssh1_3des.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH; 181#endif 182 return (&ssh1_3des); 183} 184