slitheen/client/crypto.c

/*
 * Slitheen - a decoy routing system for censorship resistance
 * Copyright (C) 2017 Cecylia Bocovich (cbocovic@uwaterloo.ca)
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 * Additional permission under GNU GPL version 3 section 7
 * 
 * If you modify this Program, or any covered work, by linking or combining
 * it with the OpenSSL library (or a modified version of that library), 
 * containing parts covered by the terms of the OpenSSL Licence and the
 * SSLeay license, the licensors of this Program grant you additional
 * permission to convey the resulting work. Corresponding Source for a
 * non-source form of such a combination shall include the source code
 * for the parts of the OpenSSL library used as well as that of the covered
 * work.
 */

#include <string.h>

#include <openssl/evp.h>
#include <openssl/dh.h>
#include <openssl/bn.h>
#include <openssl/err.h>
#include <openssl/rand.h>
#include <openssl/ssl.h>

#include <netinet/in.h>

#include "crypto.h"
#include "socks5proxy.h"
#include "tagging.h"
#include "ptwist.h"
#include "util.h"

static super_data *super;

/* PRF using sha384, as defined in RFC 5246 */
int PRF(uint8_t *secret, int32_t secret_len,
		uint8_t *seed1, int32_t seed1_len,
		uint8_t *seed2, int32_t seed2_len,
		uint8_t *seed3, int32_t seed3_len,
		uint8_t *seed4, int32_t seed4_len,
		uint8_t *output, int32_t output_len){

	EVP_MD_CTX *ctx, *ctx_tmp, *ctx_init;
	EVP_PKEY *mac_key;
	const EVP_MD *md = EVP_sha256();

	uint8_t A[EVP_MAX_MD_SIZE];
	size_t len, A_len;
	int chunk = EVP_MD_size(md);
	int remaining = output_len;

	uint8_t *out = output;

#if OPENSSL_VERSION_NUMBER >= 0x1010000eL
        ctx = EVP_MD_CTX_new();
        ctx_tmp = EVP_MD_CTX_new();
        ctx_init = EVP_MD_CTX_new();
#else
        ctx = ecalloc(1, sizeof(EVP_MD_CTX));
	EVP_MD_CTX_init(ctx);
        ctx_tmp = ecalloc(1, sizeof(EVP_MD_CTX));
	EVP_MD_CTX_init(ctx_tmp);
        ctx_init = ecalloc(1, sizeof(EVP_MD_CTX));
	EVP_MD_CTX_init(ctx_init);
#endif

	EVP_MD_CTX_set_flags(ctx_init, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);

	mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, secret, secret_len);

	/* Calculate first A value */
	EVP_DigestSignInit(ctx_init, NULL, md, NULL, mac_key);
	EVP_MD_CTX_copy_ex(ctx, ctx_init);
	if(seed1 != NULL && seed1_len > 0){
		EVP_DigestSignUpdate(ctx, seed1, seed1_len);
	}
	if(seed2 != NULL && seed2_len > 0){
		EVP_DigestSignUpdate(ctx, seed2, seed2_len);
	}
	if(seed3 != NULL && seed3_len > 0){
		EVP_DigestSignUpdate(ctx, seed3, seed3_len);
	}
	if(seed4 != NULL && seed4_len > 0){
		EVP_DigestSignUpdate(ctx, seed4, seed4_len);
	}
	EVP_DigestSignFinal(ctx, A, &A_len);

	//iterate until desired length is achieved
	while(remaining > 0){
		/* Now compute SHA384(secret, A+seed) */
		EVP_MD_CTX_copy_ex(ctx, ctx_init);
		EVP_DigestSignUpdate(ctx, A, A_len);
		EVP_MD_CTX_copy_ex(ctx_tmp, ctx);
		if(seed1 != NULL && seed1_len > 0){
			EVP_DigestSignUpdate(ctx, seed1, seed1_len);
		}
		if(seed2 != NULL && seed2_len > 0){
			EVP_DigestSignUpdate(ctx, seed2, seed2_len);
		}
		if(seed3 != NULL && seed3_len > 0){
			EVP_DigestSignUpdate(ctx, seed3, seed3_len);
		}
		if(seed4 != NULL && seed4_len > 0){
			EVP_DigestSignUpdate(ctx, seed4, seed4_len);
		}
		
		if(remaining > chunk){
			EVP_DigestSignFinal(ctx, out, &len);
			out += len;
			remaining -= len;

			/* Next A value */
			EVP_DigestSignFinal(ctx_tmp, A, &A_len);
		} else {
			EVP_DigestSignFinal(ctx, A, &A_len);
			memcpy(out, A, remaining);
			remaining -= remaining;
		}
	}

	EVP_PKEY_free(mac_key);

#if OPENSSL_VERSION_NUMBER >= 0x1010000eL
        EVP_MD_CTX_free(ctx);
        EVP_MD_CTX_free(ctx_tmp);
        EVP_MD_CTX_free(ctx_init);
#else
	EVP_MD_CTX_cleanup(ctx);
	EVP_MD_CTX_cleanup(ctx_tmp);
	EVP_MD_CTX_cleanup(ctx_init);
        free(ctx);
        free(ctx_tmp);
        free(ctx_init);
#endif

	return 1;
}


/*
 * Generate the keys for the super encryption layer, based on the slitheen ID
 */
int generate_super_keys(uint8_t *secret){

	super = calloc(1, sizeof(super_data));
	
    EVP_MD_CTX *mac_ctx;

    const EVP_MD *md = EVP_sha256();

    /* Generate Keys */
    uint8_t *hdr_key, *bdy_key;
    uint8_t *mac_secret;
    EVP_PKEY *mac_key;
    int32_t mac_len, key_len;

    key_len = EVP_CIPHER_key_length(EVP_aes_256_cbc());
    mac_len = EVP_MD_size(md);
    int32_t total_len = 2*key_len + mac_len;
    uint8_t *key_block = calloc(1, total_len);

    PRF(secret, SLITHEEN_SUPER_SECRET_SIZE,
            (uint8_t *) SLITHEEN_SUPER_CONST, SLITHEEN_SUPER_CONST_SIZE,
            NULL, 0,
            NULL, 0,
            NULL, 0,
            key_block, total_len);

#ifdef DEBUG
	int i;
    printf("secret: \n");
    for(i=0; i< SLITHEEN_SUPER_SECRET_SIZE; i++){
        printf("%02x ", secret[i]);
    }
    printf("\n");
    printf("keyblock: \n");
    for(i=0; i< total_len; i++){
        printf("%02x ", key_block[i]);
    }
    printf("\n");
#endif

    hdr_key = key_block;
    bdy_key = key_block + key_len;
    mac_secret = key_block + 2*key_len;


    /* Initialize MAC Context */
    mac_ctx = EVP_MD_CTX_create();

    EVP_DigestInit_ex(mac_ctx, md, NULL);
    mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, mac_secret, mac_len);
    EVP_DigestSignInit(mac_ctx, NULL, md, NULL, mac_key);

	super->header_key = malloc(key_len);
	super->body_key = malloc(key_len);
	memcpy(super->header_key, hdr_key, key_len);
	memcpy(super->body_key, bdy_key, key_len);
    super->body_mac_ctx = mac_ctx;

    //Free everything
    free(key_block);
    EVP_PKEY_free(mac_key);

	return 0;
}

int peek_header(uint8_t *data){

	EVP_CIPHER_CTX *hdr_ctx = NULL;

	int32_t out_len;
	uint8_t *p = data;
	int retval = 1;

	//decrypt header
#ifdef DEBUG_PEEK
	int i;
	printf("Encrypted header:\n");
	for(i=0; i< SLITHEEN_HEADER_LEN; i++){
		printf("%02x ", p[i]);
	}
	printf("\n");
#endif

    hdr_ctx = EVP_CIPHER_CTX_new();

    EVP_CipherInit_ex(hdr_ctx, EVP_aes_256_ecb(), NULL, super->header_key, NULL, 0);

	if(!EVP_CipherUpdate(hdr_ctx, p, &out_len, p, SLITHEEN_HEADER_LEN)){
		retval =  0;
		goto end;
	}

	struct slitheen_hdr *sl_hdr = (struct slitheen_hdr *) p;

        //Finally, check to see if the last few bytes are zeroed.
        if(sl_hdr->zeros){
            //zeros have been corrupted, decryption failed
            printf("Decryption failed!\n");
            retval = 0;
            goto end;
        }

#ifdef DEBUG_PARSE
	printf("Decrypted header (%d bytes):\n", SLITHEEN_HEADER_LEN);
	for(i=0; i< SLITHEEN_HEADER_LEN; i++){
		printf("%02x ", p[i]);
	}
	printf("\n");
	fflush(stdout);
#endif

	retval = 1;

end:
	if(hdr_ctx != NULL){
		EVP_CIPHER_CTX_cleanup(hdr_ctx);
		OPENSSL_free(hdr_ctx);
	}

	return retval;

}

int super_decrypt(uint8_t *data){

	EVP_CIPHER_CTX *bdy_ctx = NULL;
	EVP_CIPHER_CTX *hdr_ctx = NULL;

	uint8_t *p = data;
	int32_t out_len, len;
	uint8_t output[EVP_MAX_MD_SIZE];
	size_t mac_len;
	int i, retval = 1;

	//decrypt header
#ifdef DEBUG
	printf("Encrypted header:\n");
	for(i=0; i< SLITHEEN_HEADER_LEN; i++){
		printf("%02x ", p[i]);
	}
	printf("\n");
#endif

    hdr_ctx = EVP_CIPHER_CTX_new();

    EVP_CipherInit_ex(hdr_ctx, EVP_aes_256_ecb(), NULL, super->header_key, NULL, 0);

	if(!EVP_CipherUpdate(hdr_ctx, p, &out_len, p, SLITHEEN_HEADER_LEN)){
		printf("Decryption failed!");
		retval =  0;
		goto end;
	}

	struct slitheen_hdr *sl_hdr = (struct slitheen_hdr *) p;
	len = htons(sl_hdr->len);

	if(!sl_hdr->len){//there are no data to be decrypted
		retval =  1;
		goto end;
	}

	if(len %16){ //add padding to len
		len += 16 - len%16;
	}


#ifdef DEBUG
	printf("Decrypted header (%d bytes):\n", SLITHEEN_HEADER_LEN);
	for(i=0; i< SLITHEEN_HEADER_LEN; i++){
		printf("%02x ", p[i]);
	}
	printf("\n");
	fflush(stdout);
#endif
	
	p += SLITHEEN_HEADER_LEN;

	//initialize body cipher context with IV
    bdy_ctx = EVP_CIPHER_CTX_new();
    EVP_CipherInit_ex(bdy_ctx, EVP_aes_256_cbc(), NULL, super->body_key, p, 0);
	p+=16;

	//compute mac
	EVP_MD_CTX *mac_ctx;
#if OPENSSL_VERSION_NUMBER >= 0x1010000eL
        mac_ctx = EVP_MD_CTX_new();
#else
        mac_ctx = ecalloc(1, sizeof(EVP_MD_CTX));
	EVP_MD_CTX_init(mac_ctx);
#endif
	EVP_MD_CTX_copy_ex(mac_ctx, super->body_mac_ctx);

	EVP_DigestSignUpdate(mac_ctx, p, len);

        EVP_DigestSignFinal(mac_ctx, output, &mac_len);

#if OPENSSL_VERSION_NUMBER >= 0x1010000eL
        EVP_MD_CTX_free(mac_ctx);
#else
	EVP_MD_CTX_cleanup(mac_ctx);
        free(mac_ctx);
#endif

#ifdef DEBUG_PARSE
	printf("Received mac:\n");
	for(i=0; i< 16; i++){
		printf("%02x ", p[len+i]);
	}
	printf("\n");
	fflush(stdout);
#endif

#ifdef DEBUG_PARSE
	printf("Computed mac:\n");
	for(i=0; i< 16; i++){
		printf("%02x ", output[i]);
	}
	printf("\n");
	fflush(stdout);
#endif

	if(memcmp(p+len, output, 16)){
		printf("MAC verification failed\n");
		retval =  0;
		goto end;
	}

	//decrypt body
#ifdef DEBUG_PARSE
	printf("Encrypted data (%d bytes):\n", len);
	for(i=0; i< len; i++){
		printf("%02x ", p[i]);
	}
	printf("\n");
#endif

	if(!EVP_CipherUpdate(bdy_ctx, p, &out_len, p, len)){
		printf("Decryption failed!");
		retval =  0;
		goto end;
	}

#ifdef DEBUG
	printf("Decrypted data (%d bytes):\n", out_len);
	for(i=0; i< out_len; i++){
		printf("%02x ", p[i]);
	}
	printf("\n");
	fflush(stdout);
#endif

	p += out_len;

	retval = 1;

end:
	if(hdr_ctx != NULL){
		EVP_CIPHER_CTX_cleanup(hdr_ctx);
		OPENSSL_free(hdr_ctx);
	}
	if(bdy_ctx != NULL){
		EVP_CIPHER_CTX_cleanup(bdy_ctx);
		OPENSSL_free(bdy_ctx);
	}

	return retval;

}