crypto.c 6.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287
  1. #include <openssl/evp.h>
  2. #include <openssl/dh.h>
  3. #include <openssl/bn.h>
  4. #include <openssl/err.h>
  5. #include <openssl/rand.h>
  6. #include <openssl/ssl.h>
  7. #include <netinet/in.h>
  8. #include "crypto.h"
  9. #include "socks5proxy.h"
  10. #include "tagging.h"
  11. #include "ptwist.h"
  12. static super_data *super;
  13. /* PRF using sha384, as defined in RFC 5246 */
  14. int PRF(uint8_t *secret, int32_t secret_len,
  15. uint8_t *seed1, int32_t seed1_len,
  16. uint8_t *seed2, int32_t seed2_len,
  17. uint8_t *seed3, int32_t seed3_len,
  18. uint8_t *seed4, int32_t seed4_len,
  19. uint8_t *output, int32_t output_len){
  20. EVP_MD_CTX ctx, ctx_tmp, ctx_init;
  21. EVP_PKEY *mac_key;
  22. const EVP_MD *md = EVP_sha256();
  23. uint8_t A[EVP_MAX_MD_SIZE];
  24. size_t len, A_len;
  25. int chunk = EVP_MD_size(md);
  26. int remaining = output_len;
  27. uint8_t *out = output;
  28. EVP_MD_CTX_init(&ctx);
  29. EVP_MD_CTX_init(&ctx_tmp);
  30. EVP_MD_CTX_init(&ctx_init);
  31. EVP_MD_CTX_set_flags(&ctx_init, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
  32. mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, secret, secret_len);
  33. /* Calculate first A value */
  34. EVP_DigestSignInit(&ctx_init, NULL, md, NULL, mac_key);
  35. EVP_MD_CTX_copy_ex(&ctx, &ctx_init);
  36. if(seed1 != NULL && seed1_len > 0){
  37. EVP_DigestSignUpdate(&ctx, seed1, seed1_len);
  38. }
  39. if(seed2 != NULL && seed2_len > 0){
  40. EVP_DigestSignUpdate(&ctx, seed2, seed2_len);
  41. }
  42. if(seed3 != NULL && seed3_len > 0){
  43. EVP_DigestSignUpdate(&ctx, seed3, seed3_len);
  44. }
  45. if(seed4 != NULL && seed4_len > 0){
  46. EVP_DigestSignUpdate(&ctx, seed4, seed4_len);
  47. }
  48. EVP_DigestSignFinal(&ctx, A, &A_len);
  49. //iterate until desired length is achieved
  50. while(remaining > 0){
  51. /* Now compute SHA384(secret, A+seed) */
  52. EVP_MD_CTX_copy_ex(&ctx, &ctx_init);
  53. EVP_DigestSignUpdate(&ctx, A, A_len);
  54. EVP_MD_CTX_copy_ex(&ctx_tmp, &ctx);
  55. if(seed1 != NULL && seed1_len > 0){
  56. EVP_DigestSignUpdate(&ctx, seed1, seed1_len);
  57. }
  58. if(seed2 != NULL && seed2_len > 0){
  59. EVP_DigestSignUpdate(&ctx, seed2, seed2_len);
  60. }
  61. if(seed3 != NULL && seed3_len > 0){
  62. EVP_DigestSignUpdate(&ctx, seed3, seed3_len);
  63. }
  64. if(seed4 != NULL && seed4_len > 0){
  65. EVP_DigestSignUpdate(&ctx, seed4, seed4_len);
  66. }
  67. if(remaining > chunk){
  68. EVP_DigestSignFinal(&ctx, out, &len);
  69. out += len;
  70. remaining -= len;
  71. /* Next A value */
  72. EVP_DigestSignFinal(&ctx_tmp, A, &A_len);
  73. } else {
  74. EVP_DigestSignFinal(&ctx, A, &A_len);
  75. memcpy(out, A, remaining);
  76. remaining -= remaining;
  77. }
  78. }
  79. return 1;
  80. }
  81. /*
  82. * Generate the keys for the super encryption layer, based on the slitheen ID
  83. */
  84. int generate_super_keys(uint8_t *secret){
  85. super = calloc(1, sizeof(super_data));
  86. EVP_MD_CTX *mac_ctx;
  87. const EVP_MD *md = EVP_sha256();
  88. /* Generate Keys */
  89. uint8_t *hdr_key, *bdy_key;
  90. uint8_t *mac_secret;
  91. EVP_PKEY *mac_key;
  92. int32_t mac_len, key_len;
  93. key_len = EVP_CIPHER_key_length(EVP_aes_256_cbc());
  94. mac_len = EVP_MD_size(md);
  95. int32_t total_len = 2*key_len + mac_len;
  96. uint8_t *key_block = calloc(1, total_len);
  97. PRF(secret, SLITHEEN_SUPER_SECRET_SIZE,
  98. (uint8_t *) SLITHEEN_SUPER_CONST, SLITHEEN_SUPER_CONST_SIZE,
  99. NULL, 0,
  100. NULL, 0,
  101. NULL, 0,
  102. key_block, total_len);
  103. #ifdef DEBUG
  104. int i;
  105. printf("secret: \n");
  106. for(i=0; i< SLITHEEN_SUPER_SECRET_SIZE; i++){
  107. printf("%02x ", secret[i]);
  108. }
  109. printf("\n");
  110. printf("keyblock: \n");
  111. for(i=0; i< total_len; i++){
  112. printf("%02x ", key_block[i]);
  113. }
  114. printf("\n");
  115. #endif
  116. hdr_key = key_block;
  117. bdy_key = key_block + key_len;
  118. mac_secret = key_block + 2*key_len;
  119. /* Initialize MAC Context */
  120. mac_ctx = EVP_MD_CTX_create();
  121. EVP_DigestInit_ex(mac_ctx, md, NULL);
  122. mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, mac_secret, mac_len);
  123. EVP_DigestSignInit(mac_ctx, NULL, md, NULL, mac_key);
  124. super->header_key = malloc(key_len);
  125. super->body_key = malloc(key_len);
  126. memcpy(super->header_key, hdr_key, key_len);
  127. memcpy(super->body_key, bdy_key, key_len);
  128. super->body_mac_ctx = mac_ctx;
  129. //Free everything
  130. free(key_block);
  131. EVP_PKEY_free(mac_key);
  132. return 0;
  133. }
  134. int super_decrypt(uint8_t *data){
  135. EVP_CIPHER_CTX *bdy_ctx;
  136. EVP_CIPHER_CTX *hdr_ctx;
  137. uint8_t *p = data;
  138. int32_t out_len, len;
  139. uint8_t output[EVP_MAX_MD_SIZE];
  140. size_t mac_len;
  141. int i;
  142. //decrypt header
  143. #ifdef DEBUG
  144. printf("Encrypted header:\n");
  145. for(i=0; i< SLITHEEN_HEADER_LEN; i++){
  146. printf("%02x ", p[i]);
  147. }
  148. printf("\n");
  149. #endif
  150. hdr_ctx = EVP_CIPHER_CTX_new();
  151. EVP_CipherInit_ex(hdr_ctx, EVP_aes_256_ecb(), NULL, super->header_key, NULL, 0);
  152. if(!EVP_CipherUpdate(hdr_ctx, p, &out_len, p, SLITHEEN_HEADER_LEN)){
  153. printf("Decryption failed!");
  154. return 0;
  155. }
  156. EVP_CIPHER_CTX_free(hdr_ctx);
  157. struct slitheen_hdr *sl_hdr = (struct slitheen_hdr *) p;
  158. len = htons(sl_hdr->len);
  159. if(!sl_hdr->len){//there are no data to be decrypted
  160. return 1;
  161. }
  162. if(len %16){ //add padding to len
  163. len += 16 - len%16;
  164. }
  165. //#ifdef DEBUG_PARSE
  166. printf("Decrypted header (%d bytes):\n", SLITHEEN_HEADER_LEN);
  167. for(i=0; i< SLITHEEN_HEADER_LEN; i++){
  168. printf("%02x ", p[i]);
  169. }
  170. printf("\n");
  171. fflush(stdout);
  172. //#endif
  173. p += SLITHEEN_HEADER_LEN;
  174. //initialize body cipher context with IV
  175. bdy_ctx = EVP_CIPHER_CTX_new();
  176. EVP_CipherInit_ex(bdy_ctx, EVP_aes_256_cbc(), NULL, super->body_key, p, 0);
  177. p+=16;
  178. //compute mac
  179. EVP_MD_CTX mac_ctx;
  180. EVP_MD_CTX_init(&mac_ctx);
  181. EVP_MD_CTX_copy_ex(&mac_ctx, super->body_mac_ctx);
  182. EVP_DigestSignUpdate(&mac_ctx, p, len);
  183. EVP_DigestSignFinal(&mac_ctx, output, &mac_len);
  184. EVP_MD_CTX_cleanup(&mac_ctx);
  185. #ifdef DEBUG_PARSE
  186. printf("Received mac:\n");
  187. for(i=0; i< 16; i++){
  188. printf("%02x ", p[len+i]);
  189. }
  190. printf("\n");
  191. fflush(stdout);
  192. #endif
  193. #ifdef DEBUG_PARSE
  194. printf("Computed mac:\n");
  195. for(i=0; i< 16; i++){
  196. printf("%02x ", output[i]);
  197. }
  198. printf("\n");
  199. fflush(stdout);
  200. #endif
  201. if(memcmp(p+len, output, 16)){
  202. printf("MAC verification failed\n");
  203. return 0;
  204. }
  205. //decrypt body
  206. #ifdef DEBUG_PARSE
  207. printf("Encrypted data (%d bytes):\n", len);
  208. for(i=0; i< len; i++){
  209. printf("%02x ", p[i]);
  210. }
  211. printf("\n");
  212. #endif
  213. if(!EVP_CipherUpdate(bdy_ctx, p, &out_len, p, len)){
  214. printf("Decryption failed!");
  215. return 0;
  216. }
  217. EVP_CIPHER_CTX_free(bdy_ctx);
  218. #ifdef DEBUG_PARSE
  219. printf("Decrypted data (%d bytes):\n", out_len);
  220. for(i=0; i< out_len; i++){
  221. printf("%02x ", p[i]);
  222. }
  223. printf("\n");
  224. fflush(stdout);
  225. #endif
  226. p += out_len;
  227. return 1;
  228. }