crypto.c 9.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424
  1. /*
  2. * Slitheen - a decoy routing system for censorship resistance
  3. * Copyright (C) 2017 Cecylia Bocovich (cbocovic@uwaterloo.ca)
  4. *
  5. * This program is free software: you can redistribute it and/or modify
  6. * it under the terms of the GNU General Public License as published by
  7. * the Free Software Foundation, version 3.
  8. *
  9. * This program is distributed in the hope that it will be useful,
  10. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  12. * GNU General Public License for more details.
  13. *
  14. * You should have received a copy of the GNU General Public License
  15. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  16. *
  17. * Additional permission under GNU GPL version 3 section 7
  18. *
  19. * If you modify this Program, or any covered work, by linking or combining
  20. * it with the OpenSSL library (or a modified version of that library),
  21. * containing parts covered by the terms of the OpenSSL Licence and the
  22. * SSLeay license, the licensors of this Program grant you additional
  23. * permission to convey the resulting work. Corresponding Source for a
  24. * non-source form of such a combination shall include the source code
  25. * for the parts of the OpenSSL library used as well as that of the covered
  26. * work.
  27. */
  28. #include <string.h>
  29. #include <openssl/evp.h>
  30. #include <openssl/dh.h>
  31. #include <openssl/bn.h>
  32. #include <openssl/err.h>
  33. #include <openssl/rand.h>
  34. #include <openssl/ssl.h>
  35. #include <netinet/in.h>
  36. #include "crypto.h"
  37. #include "socks5proxy.h"
  38. #include "tagging.h"
  39. #include "ptwist.h"
  40. #include "util.h"
  41. static super_data *super;
  42. /* PRF using sha384, as defined in RFC 5246 */
  43. int PRF(uint8_t *secret, int32_t secret_len,
  44. uint8_t *seed1, int32_t seed1_len,
  45. uint8_t *seed2, int32_t seed2_len,
  46. uint8_t *seed3, int32_t seed3_len,
  47. uint8_t *seed4, int32_t seed4_len,
  48. uint8_t *output, int32_t output_len){
  49. EVP_MD_CTX *ctx, *ctx_tmp, *ctx_init;
  50. EVP_PKEY *mac_key;
  51. const EVP_MD *md = EVP_sha256();
  52. uint8_t A[EVP_MAX_MD_SIZE];
  53. size_t len, A_len;
  54. int chunk = EVP_MD_size(md);
  55. int remaining = output_len;
  56. uint8_t *out = output;
  57. #if OPENSSL_VERSION_NUMBER >= 0x1010000eL
  58. ctx = EVP_MD_CTX_new();
  59. ctx_tmp = EVP_MD_CTX_new();
  60. ctx_init = EVP_MD_CTX_new();
  61. #else
  62. ctx = ecalloc(1, sizeof(EVP_MD_CTX));
  63. EVP_MD_CTX_init(ctx);
  64. ctx_tmp = ecalloc(1, sizeof(EVP_MD_CTX));
  65. EVP_MD_CTX_init(ctx_tmp);
  66. ctx_init = ecalloc(1, sizeof(EVP_MD_CTX));
  67. EVP_MD_CTX_init(ctx_init);
  68. #endif
  69. EVP_MD_CTX_set_flags(ctx_init, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
  70. mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, secret, secret_len);
  71. /* Calculate first A value */
  72. EVP_DigestSignInit(ctx_init, NULL, md, NULL, mac_key);
  73. EVP_MD_CTX_copy_ex(ctx, ctx_init);
  74. if(seed1 != NULL && seed1_len > 0){
  75. EVP_DigestSignUpdate(ctx, seed1, seed1_len);
  76. }
  77. if(seed2 != NULL && seed2_len > 0){
  78. EVP_DigestSignUpdate(ctx, seed2, seed2_len);
  79. }
  80. if(seed3 != NULL && seed3_len > 0){
  81. EVP_DigestSignUpdate(ctx, seed3, seed3_len);
  82. }
  83. if(seed4 != NULL && seed4_len > 0){
  84. EVP_DigestSignUpdate(ctx, seed4, seed4_len);
  85. }
  86. EVP_DigestSignFinal(ctx, A, &A_len);
  87. //iterate until desired length is achieved
  88. while(remaining > 0){
  89. /* Now compute SHA384(secret, A+seed) */
  90. EVP_MD_CTX_copy_ex(ctx, ctx_init);
  91. EVP_DigestSignUpdate(ctx, A, A_len);
  92. EVP_MD_CTX_copy_ex(ctx_tmp, ctx);
  93. if(seed1 != NULL && seed1_len > 0){
  94. EVP_DigestSignUpdate(ctx, seed1, seed1_len);
  95. }
  96. if(seed2 != NULL && seed2_len > 0){
  97. EVP_DigestSignUpdate(ctx, seed2, seed2_len);
  98. }
  99. if(seed3 != NULL && seed3_len > 0){
  100. EVP_DigestSignUpdate(ctx, seed3, seed3_len);
  101. }
  102. if(seed4 != NULL && seed4_len > 0){
  103. EVP_DigestSignUpdate(ctx, seed4, seed4_len);
  104. }
  105. if(remaining > chunk){
  106. EVP_DigestSignFinal(ctx, out, &len);
  107. out += len;
  108. remaining -= len;
  109. /* Next A value */
  110. EVP_DigestSignFinal(ctx_tmp, A, &A_len);
  111. } else {
  112. EVP_DigestSignFinal(ctx, A, &A_len);
  113. memcpy(out, A, remaining);
  114. remaining -= remaining;
  115. }
  116. }
  117. EVP_PKEY_free(mac_key);
  118. #if OPENSSL_VERSION_NUMBER >= 0x1010000eL
  119. EVP_MD_CTX_free(ctx);
  120. EVP_MD_CTX_free(ctx_tmp);
  121. EVP_MD_CTX_free(ctx_init);
  122. #else
  123. EVP_MD_CTX_cleanup(ctx);
  124. EVP_MD_CTX_cleanup(ctx_tmp);
  125. EVP_MD_CTX_cleanup(ctx_init);
  126. free(ctx);
  127. free(ctx_tmp);
  128. free(ctx_init);
  129. #endif
  130. return 1;
  131. }
  132. /*
  133. * Generate the keys for the super encryption layer, based on the slitheen ID
  134. */
  135. int generate_super_keys(uint8_t *secret){
  136. super = calloc(1, sizeof(super_data));
  137. EVP_MD_CTX *mac_ctx;
  138. const EVP_MD *md = EVP_sha256();
  139. /* Generate Keys */
  140. uint8_t *hdr_key, *bdy_key;
  141. uint8_t *mac_secret;
  142. EVP_PKEY *mac_key;
  143. int32_t mac_len, key_len;
  144. key_len = EVP_CIPHER_key_length(EVP_aes_256_cbc());
  145. mac_len = EVP_MD_size(md);
  146. int32_t total_len = 2*key_len + mac_len;
  147. uint8_t *key_block = calloc(1, total_len);
  148. PRF(secret, SLITHEEN_SUPER_SECRET_SIZE,
  149. (uint8_t *) SLITHEEN_SUPER_CONST, SLITHEEN_SUPER_CONST_SIZE,
  150. NULL, 0,
  151. NULL, 0,
  152. NULL, 0,
  153. key_block, total_len);
  154. #ifdef DEBUG
  155. int i;
  156. printf("secret: \n");
  157. for(i=0; i< SLITHEEN_SUPER_SECRET_SIZE; i++){
  158. printf("%02x ", secret[i]);
  159. }
  160. printf("\n");
  161. printf("keyblock: \n");
  162. for(i=0; i< total_len; i++){
  163. printf("%02x ", key_block[i]);
  164. }
  165. printf("\n");
  166. #endif
  167. hdr_key = key_block;
  168. bdy_key = key_block + key_len;
  169. mac_secret = key_block + 2*key_len;
  170. /* Initialize MAC Context */
  171. mac_ctx = EVP_MD_CTX_create();
  172. EVP_DigestInit_ex(mac_ctx, md, NULL);
  173. mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, mac_secret, mac_len);
  174. EVP_DigestSignInit(mac_ctx, NULL, md, NULL, mac_key);
  175. super->header_key = malloc(key_len);
  176. super->body_key = malloc(key_len);
  177. memcpy(super->header_key, hdr_key, key_len);
  178. memcpy(super->body_key, bdy_key, key_len);
  179. super->body_mac_ctx = mac_ctx;
  180. //Free everything
  181. free(key_block);
  182. EVP_PKEY_free(mac_key);
  183. return 0;
  184. }
  185. int peek_header(uint8_t *data){
  186. EVP_CIPHER_CTX *hdr_ctx = NULL;
  187. int32_t out_len;
  188. uint8_t *p = data;
  189. int retval = 1;
  190. //decrypt header
  191. #ifdef DEBUG_PEEK
  192. int i;
  193. printf("Encrypted header:\n");
  194. for(i=0; i< SLITHEEN_HEADER_LEN; i++){
  195. printf("%02x ", p[i]);
  196. }
  197. printf("\n");
  198. #endif
  199. hdr_ctx = EVP_CIPHER_CTX_new();
  200. EVP_CipherInit_ex(hdr_ctx, EVP_aes_256_ecb(), NULL, super->header_key, NULL, 0);
  201. if(!EVP_CipherUpdate(hdr_ctx, p, &out_len, p, SLITHEEN_HEADER_LEN)){
  202. retval = 0;
  203. goto end;
  204. }
  205. struct slitheen_hdr *sl_hdr = (struct slitheen_hdr *) p;
  206. //Finally, check to see if the last few bytes are zeroed.
  207. if(sl_hdr->zeros){
  208. //zeros have been corrupted, decryption failed
  209. printf("Decryption failed!\n");
  210. retval = 0;
  211. goto end;
  212. }
  213. #ifdef DEBUG_PARSE
  214. printf("Decrypted header (%d bytes):\n", SLITHEEN_HEADER_LEN);
  215. for(i=0; i< SLITHEEN_HEADER_LEN; i++){
  216. printf("%02x ", p[i]);
  217. }
  218. printf("\n");
  219. fflush(stdout);
  220. #endif
  221. retval = 1;
  222. end:
  223. if(hdr_ctx != NULL){
  224. EVP_CIPHER_CTX_cleanup(hdr_ctx);
  225. OPENSSL_free(hdr_ctx);
  226. }
  227. return retval;
  228. }
  229. int super_decrypt(uint8_t *data){
  230. EVP_CIPHER_CTX *bdy_ctx = NULL;
  231. EVP_CIPHER_CTX *hdr_ctx = NULL;
  232. uint8_t *p = data;
  233. int32_t out_len, len;
  234. uint8_t output[EVP_MAX_MD_SIZE];
  235. size_t mac_len;
  236. int i, retval = 1;
  237. //decrypt header
  238. #ifdef DEBUG
  239. printf("Encrypted header:\n");
  240. for(i=0; i< SLITHEEN_HEADER_LEN; i++){
  241. printf("%02x ", p[i]);
  242. }
  243. printf("\n");
  244. #endif
  245. hdr_ctx = EVP_CIPHER_CTX_new();
  246. EVP_CipherInit_ex(hdr_ctx, EVP_aes_256_ecb(), NULL, super->header_key, NULL, 0);
  247. if(!EVP_CipherUpdate(hdr_ctx, p, &out_len, p, SLITHEEN_HEADER_LEN)){
  248. printf("Decryption failed!");
  249. retval = 0;
  250. goto end;
  251. }
  252. struct slitheen_hdr *sl_hdr = (struct slitheen_hdr *) p;
  253. len = htons(sl_hdr->len);
  254. if(!sl_hdr->len){//there are no data to be decrypted
  255. retval = 1;
  256. goto end;
  257. }
  258. if(len %16){ //add padding to len
  259. len += 16 - len%16;
  260. }
  261. #ifdef DEBUG
  262. printf("Decrypted header (%d bytes):\n", SLITHEEN_HEADER_LEN);
  263. for(i=0; i< SLITHEEN_HEADER_LEN; i++){
  264. printf("%02x ", p[i]);
  265. }
  266. printf("\n");
  267. fflush(stdout);
  268. #endif
  269. p += SLITHEEN_HEADER_LEN;
  270. //initialize body cipher context with IV
  271. bdy_ctx = EVP_CIPHER_CTX_new();
  272. EVP_CipherInit_ex(bdy_ctx, EVP_aes_256_cbc(), NULL, super->body_key, p, 0);
  273. p+=16;
  274. //compute mac
  275. EVP_MD_CTX *mac_ctx;
  276. #if OPENSSL_VERSION_NUMBER >= 0x1010000eL
  277. mac_ctx = EVP_MD_CTX_new();
  278. #else
  279. mac_ctx = ecalloc(1, sizeof(EVP_MD_CTX));
  280. EVP_MD_CTX_init(mac_ctx);
  281. #endif
  282. EVP_MD_CTX_copy_ex(mac_ctx, super->body_mac_ctx);
  283. EVP_DigestSignUpdate(mac_ctx, p, len);
  284. EVP_DigestSignFinal(mac_ctx, output, &mac_len);
  285. #if OPENSSL_VERSION_NUMBER >= 0x1010000eL
  286. EVP_MD_CTX_free(mac_ctx);
  287. #else
  288. EVP_MD_CTX_cleanup(mac_ctx);
  289. free(mac_ctx);
  290. #endif
  291. #ifdef DEBUG_PARSE
  292. printf("Received mac:\n");
  293. for(i=0; i< 16; i++){
  294. printf("%02x ", p[len+i]);
  295. }
  296. printf("\n");
  297. fflush(stdout);
  298. #endif
  299. #ifdef DEBUG_PARSE
  300. printf("Computed mac:\n");
  301. for(i=0; i< 16; i++){
  302. printf("%02x ", output[i]);
  303. }
  304. printf("\n");
  305. fflush(stdout);
  306. #endif
  307. if(memcmp(p+len, output, 16)){
  308. printf("MAC verification failed\n");
  309. retval = 0;
  310. goto end;
  311. }
  312. //decrypt body
  313. #ifdef DEBUG_PARSE
  314. printf("Encrypted data (%d bytes):\n", len);
  315. for(i=0; i< len; i++){
  316. printf("%02x ", p[i]);
  317. }
  318. printf("\n");
  319. #endif
  320. if(!EVP_CipherUpdate(bdy_ctx, p, &out_len, p, len)){
  321. printf("Decryption failed!");
  322. retval = 0;
  323. goto end;
  324. }
  325. #ifdef DEBUG
  326. printf("Decrypted data (%d bytes):\n", out_len);
  327. for(i=0; i< out_len; i++){
  328. printf("%02x ", p[i]);
  329. }
  330. printf("\n");
  331. fflush(stdout);
  332. #endif
  333. p += out_len;
  334. retval = 1;
  335. end:
  336. if(hdr_ctx != NULL){
  337. EVP_CIPHER_CTX_cleanup(hdr_ctx);
  338. OPENSSL_free(hdr_ctx);
  339. }
  340. if(bdy_ctx != NULL){
  341. EVP_CIPHER_CTX_cleanup(bdy_ctx);
  342. OPENSSL_free(bdy_ctx);
  343. }
  344. return retval;
  345. }