crypto.c 8.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389
  1. /*
  2. * Slitheen - a decoy routing system for censorship resistance
  3. * Copyright (C) 2017 Cecylia Bocovich (cbocovic@uwaterloo.ca)
  4. *
  5. * This program is free software: you can redistribute it and/or modify
  6. * it under the terms of the GNU General Public License as published by
  7. * the Free Software Foundation, version 3.
  8. *
  9. * This program is distributed in the hope that it will be useful,
  10. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  12. * GNU General Public License for more details.
  13. *
  14. * You should have received a copy of the GNU General Public License
  15. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  16. *
  17. * Additional permission under GNU GPL version 3 section 7
  18. *
  19. * If you modify this Program, or any covered work, by linking or combining
  20. * it with the OpenSSL library (or a modified version of that library),
  21. * containing parts covered by the terms of the OpenSSL Licence and the
  22. * SSLeay license, the licensors of this Program grant you additional
  23. * permission to convey the resulting work. Corresponding Source for a
  24. * non-source form of such a combination shall include the source code
  25. * for the parts of the OpenSSL library used as well as that of the covered
  26. * work.
  27. */
  28. #include <openssl/evp.h>
  29. #include <openssl/dh.h>
  30. #include <openssl/bn.h>
  31. #include <openssl/err.h>
  32. #include <openssl/rand.h>
  33. #include <openssl/ssl.h>
  34. #include <netinet/in.h>
  35. #include "crypto.h"
  36. #include "socks5proxy.h"
  37. #include "tagging.h"
  38. #include "ptwist.h"
  39. static super_data *super;
  40. /* PRF using sha384, as defined in RFC 5246 */
  41. int PRF(uint8_t *secret, int32_t secret_len,
  42. uint8_t *seed1, int32_t seed1_len,
  43. uint8_t *seed2, int32_t seed2_len,
  44. uint8_t *seed3, int32_t seed3_len,
  45. uint8_t *seed4, int32_t seed4_len,
  46. uint8_t *output, int32_t output_len){
  47. EVP_MD_CTX ctx, ctx_tmp, ctx_init;
  48. EVP_PKEY *mac_key;
  49. const EVP_MD *md = EVP_sha256();
  50. uint8_t A[EVP_MAX_MD_SIZE];
  51. size_t len, A_len;
  52. int chunk = EVP_MD_size(md);
  53. int remaining = output_len;
  54. uint8_t *out = output;
  55. EVP_MD_CTX_init(&ctx);
  56. EVP_MD_CTX_init(&ctx_tmp);
  57. EVP_MD_CTX_init(&ctx_init);
  58. EVP_MD_CTX_set_flags(&ctx_init, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
  59. mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, secret, secret_len);
  60. /* Calculate first A value */
  61. EVP_DigestSignInit(&ctx_init, NULL, md, NULL, mac_key);
  62. EVP_MD_CTX_copy_ex(&ctx, &ctx_init);
  63. if(seed1 != NULL && seed1_len > 0){
  64. EVP_DigestSignUpdate(&ctx, seed1, seed1_len);
  65. }
  66. if(seed2 != NULL && seed2_len > 0){
  67. EVP_DigestSignUpdate(&ctx, seed2, seed2_len);
  68. }
  69. if(seed3 != NULL && seed3_len > 0){
  70. EVP_DigestSignUpdate(&ctx, seed3, seed3_len);
  71. }
  72. if(seed4 != NULL && seed4_len > 0){
  73. EVP_DigestSignUpdate(&ctx, seed4, seed4_len);
  74. }
  75. EVP_DigestSignFinal(&ctx, A, &A_len);
  76. //iterate until desired length is achieved
  77. while(remaining > 0){
  78. /* Now compute SHA384(secret, A+seed) */
  79. EVP_MD_CTX_copy_ex(&ctx, &ctx_init);
  80. EVP_DigestSignUpdate(&ctx, A, A_len);
  81. EVP_MD_CTX_copy_ex(&ctx_tmp, &ctx);
  82. if(seed1 != NULL && seed1_len > 0){
  83. EVP_DigestSignUpdate(&ctx, seed1, seed1_len);
  84. }
  85. if(seed2 != NULL && seed2_len > 0){
  86. EVP_DigestSignUpdate(&ctx, seed2, seed2_len);
  87. }
  88. if(seed3 != NULL && seed3_len > 0){
  89. EVP_DigestSignUpdate(&ctx, seed3, seed3_len);
  90. }
  91. if(seed4 != NULL && seed4_len > 0){
  92. EVP_DigestSignUpdate(&ctx, seed4, seed4_len);
  93. }
  94. if(remaining > chunk){
  95. EVP_DigestSignFinal(&ctx, out, &len);
  96. out += len;
  97. remaining -= len;
  98. /* Next A value */
  99. EVP_DigestSignFinal(&ctx_tmp, A, &A_len);
  100. } else {
  101. EVP_DigestSignFinal(&ctx, A, &A_len);
  102. memcpy(out, A, remaining);
  103. remaining -= remaining;
  104. }
  105. }
  106. EVP_PKEY_free(mac_key);
  107. EVP_MD_CTX_cleanup(&ctx);
  108. EVP_MD_CTX_cleanup(&ctx_tmp);
  109. EVP_MD_CTX_cleanup(&ctx_init);
  110. return 1;
  111. }
  112. /*
  113. * Generate the keys for the super encryption layer, based on the slitheen ID
  114. */
  115. int generate_super_keys(uint8_t *secret){
  116. super = calloc(1, sizeof(super_data));
  117. EVP_MD_CTX *mac_ctx;
  118. const EVP_MD *md = EVP_sha256();
  119. /* Generate Keys */
  120. uint8_t *hdr_key, *bdy_key;
  121. uint8_t *mac_secret;
  122. EVP_PKEY *mac_key;
  123. int32_t mac_len, key_len;
  124. key_len = EVP_CIPHER_key_length(EVP_aes_256_cbc());
  125. mac_len = EVP_MD_size(md);
  126. int32_t total_len = 2*key_len + mac_len;
  127. uint8_t *key_block = calloc(1, total_len);
  128. PRF(secret, SLITHEEN_SUPER_SECRET_SIZE,
  129. (uint8_t *) SLITHEEN_SUPER_CONST, SLITHEEN_SUPER_CONST_SIZE,
  130. NULL, 0,
  131. NULL, 0,
  132. NULL, 0,
  133. key_block, total_len);
  134. #ifdef DEBUG
  135. int i;
  136. printf("secret: \n");
  137. for(i=0; i< SLITHEEN_SUPER_SECRET_SIZE; i++){
  138. printf("%02x ", secret[i]);
  139. }
  140. printf("\n");
  141. printf("keyblock: \n");
  142. for(i=0; i< total_len; i++){
  143. printf("%02x ", key_block[i]);
  144. }
  145. printf("\n");
  146. #endif
  147. hdr_key = key_block;
  148. bdy_key = key_block + key_len;
  149. mac_secret = key_block + 2*key_len;
  150. /* Initialize MAC Context */
  151. mac_ctx = EVP_MD_CTX_create();
  152. EVP_DigestInit_ex(mac_ctx, md, NULL);
  153. mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, mac_secret, mac_len);
  154. EVP_DigestSignInit(mac_ctx, NULL, md, NULL, mac_key);
  155. super->header_key = malloc(key_len);
  156. super->body_key = malloc(key_len);
  157. memcpy(super->header_key, hdr_key, key_len);
  158. memcpy(super->body_key, bdy_key, key_len);
  159. super->body_mac_ctx = mac_ctx;
  160. //Free everything
  161. free(key_block);
  162. EVP_PKEY_free(mac_key);
  163. return 0;
  164. }
  165. int peek_header(uint8_t *data){
  166. EVP_CIPHER_CTX *hdr_ctx = NULL;
  167. int32_t out_len;
  168. uint8_t *p = data;
  169. int retval = 1;
  170. //decrypt header
  171. #ifdef DEBUG
  172. int i;
  173. printf("Encrypted header:\n");
  174. for(i=0; i< SLITHEEN_HEADER_LEN; i++){
  175. printf("%02x ", p[i]);
  176. }
  177. printf("\n");
  178. #endif
  179. hdr_ctx = EVP_CIPHER_CTX_new();
  180. EVP_CipherInit_ex(hdr_ctx, EVP_aes_256_ecb(), NULL, super->header_key, NULL, 0);
  181. if(!EVP_CipherUpdate(hdr_ctx, p, &out_len, p, SLITHEEN_HEADER_LEN)){
  182. printf("Decryption failed!");
  183. retval = 0;
  184. goto end;
  185. }
  186. struct slitheen_hdr *sl_hdr = (struct slitheen_hdr *) p;
  187. if(!sl_hdr->len){//there are no data to be decrypted
  188. retval = 1;
  189. goto end;
  190. }
  191. #ifdef DEBUG_PARSE
  192. printf("Decrypted header (%d bytes):\n", SLITHEEN_HEADER_LEN);
  193. for(i=0; i< SLITHEEN_HEADER_LEN; i++){
  194. printf("%02x ", p[i]);
  195. }
  196. printf("\n");
  197. fflush(stdout);
  198. #endif
  199. retval = 1;
  200. end:
  201. if(hdr_ctx != NULL){
  202. EVP_CIPHER_CTX_cleanup(hdr_ctx);
  203. OPENSSL_free(hdr_ctx);
  204. }
  205. return retval;
  206. }
  207. int super_decrypt(uint8_t *data){
  208. EVP_CIPHER_CTX *bdy_ctx = NULL;
  209. EVP_CIPHER_CTX *hdr_ctx = NULL;
  210. uint8_t *p = data;
  211. int32_t out_len, len;
  212. uint8_t output[EVP_MAX_MD_SIZE];
  213. size_t mac_len;
  214. int i, retval = 1;
  215. //decrypt header
  216. #ifdef DEBUG
  217. printf("Encrypted header:\n");
  218. for(i=0; i< SLITHEEN_HEADER_LEN; i++){
  219. printf("%02x ", p[i]);
  220. }
  221. printf("\n");
  222. #endif
  223. hdr_ctx = EVP_CIPHER_CTX_new();
  224. EVP_CipherInit_ex(hdr_ctx, EVP_aes_256_ecb(), NULL, super->header_key, NULL, 0);
  225. if(!EVP_CipherUpdate(hdr_ctx, p, &out_len, p, SLITHEEN_HEADER_LEN)){
  226. printf("Decryption failed!");
  227. retval = 0;
  228. goto end;
  229. }
  230. struct slitheen_hdr *sl_hdr = (struct slitheen_hdr *) p;
  231. len = htons(sl_hdr->len);
  232. if(!sl_hdr->len){//there are no data to be decrypted
  233. retval = 1;
  234. goto end;
  235. }
  236. if(len %16){ //add padding to len
  237. len += 16 - len%16;
  238. }
  239. //#ifdef DEBUG_PARSE
  240. printf("Decrypted header (%d bytes):\n", SLITHEEN_HEADER_LEN);
  241. for(i=0; i< SLITHEEN_HEADER_LEN; i++){
  242. printf("%02x ", p[i]);
  243. }
  244. printf("\n");
  245. fflush(stdout);
  246. //#endif
  247. p += SLITHEEN_HEADER_LEN;
  248. //initialize body cipher context with IV
  249. bdy_ctx = EVP_CIPHER_CTX_new();
  250. EVP_CipherInit_ex(bdy_ctx, EVP_aes_256_cbc(), NULL, super->body_key, p, 0);
  251. p+=16;
  252. //compute mac
  253. EVP_MD_CTX mac_ctx;
  254. EVP_MD_CTX_init(&mac_ctx);
  255. EVP_MD_CTX_copy_ex(&mac_ctx, super->body_mac_ctx);
  256. EVP_DigestSignUpdate(&mac_ctx, p, len);
  257. EVP_DigestSignFinal(&mac_ctx, output, &mac_len);
  258. EVP_MD_CTX_cleanup(&mac_ctx);
  259. #ifdef DEBUG_PARSE
  260. printf("Received mac:\n");
  261. for(i=0; i< 16; i++){
  262. printf("%02x ", p[len+i]);
  263. }
  264. printf("\n");
  265. fflush(stdout);
  266. #endif
  267. #ifdef DEBUG_PARSE
  268. printf("Computed mac:\n");
  269. for(i=0; i< 16; i++){
  270. printf("%02x ", output[i]);
  271. }
  272. printf("\n");
  273. fflush(stdout);
  274. #endif
  275. if(memcmp(p+len, output, 16)){
  276. printf("MAC verification failed\n");
  277. retval = 0;
  278. goto end;
  279. }
  280. //decrypt body
  281. #ifdef DEBUG_PARSE
  282. printf("Encrypted data (%d bytes):\n", len);
  283. for(i=0; i< len; i++){
  284. printf("%02x ", p[i]);
  285. }
  286. printf("\n");
  287. #endif
  288. if(!EVP_CipherUpdate(bdy_ctx, p, &out_len, p, len)){
  289. printf("Decryption failed!");
  290. retval = 0;
  291. goto end;
  292. }
  293. #ifdef DEBUG_PARSE
  294. printf("Decrypted data (%d bytes):\n", out_len);
  295. for(i=0; i< out_len; i++){
  296. printf("%02x ", p[i]);
  297. }
  298. printf("\n");
  299. fflush(stdout);
  300. #endif
  301. p += out_len;
  302. retval = 1;
  303. end:
  304. if(hdr_ctx != NULL){
  305. EVP_CIPHER_CTX_cleanup(hdr_ctx);
  306. OPENSSL_free(hdr_ctx);
  307. }
  308. if(bdy_ctx != NULL){
  309. EVP_CIPHER_CTX_cleanup(bdy_ctx);
  310. OPENSSL_free(bdy_ctx);
  311. }
  312. return retval;
  313. }