123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424 |
- /*
- * Slitheen - a decoy routing system for censorship resistance
- * Copyright (C) 2017 Cecylia Bocovich (cbocovic@uwaterloo.ca)
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, version 3.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
- * Additional permission under GNU GPL version 3 section 7
- *
- * If you modify this Program, or any covered work, by linking or combining
- * it with the OpenSSL library (or a modified version of that library),
- * containing parts covered by the terms of the OpenSSL Licence and the
- * SSLeay license, the licensors of this Program grant you additional
- * permission to convey the resulting work. Corresponding Source for a
- * non-source form of such a combination shall include the source code
- * for the parts of the OpenSSL library used as well as that of the covered
- * work.
- */
- #include <string.h>
- #include <openssl/evp.h>
- #include <openssl/dh.h>
- #include <openssl/bn.h>
- #include <openssl/err.h>
- #include <openssl/rand.h>
- #include <openssl/ssl.h>
- #include <netinet/in.h>
- #include "crypto.h"
- #include "socks5proxy.h"
- #include "tagging.h"
- #include "ptwist.h"
- #include "util.h"
- static super_data *super;
- /* PRF using sha384, as defined in RFC 5246 */
- int PRF(uint8_t *secret, int32_t secret_len,
- uint8_t *seed1, int32_t seed1_len,
- uint8_t *seed2, int32_t seed2_len,
- uint8_t *seed3, int32_t seed3_len,
- uint8_t *seed4, int32_t seed4_len,
- uint8_t *output, int32_t output_len){
- EVP_MD_CTX *ctx, *ctx_tmp, *ctx_init;
- EVP_PKEY *mac_key;
- const EVP_MD *md = EVP_sha256();
- uint8_t A[EVP_MAX_MD_SIZE];
- size_t len, A_len;
- int chunk = EVP_MD_size(md);
- int remaining = output_len;
- uint8_t *out = output;
- #if OPENSSL_VERSION_NUMBER >= 0x1010000eL
- ctx = EVP_MD_CTX_new();
- ctx_tmp = EVP_MD_CTX_new();
- ctx_init = EVP_MD_CTX_new();
- #else
- ctx = ecalloc(1, sizeof(EVP_MD_CTX));
- EVP_MD_CTX_init(ctx);
- ctx_tmp = ecalloc(1, sizeof(EVP_MD_CTX));
- EVP_MD_CTX_init(ctx_tmp);
- ctx_init = ecalloc(1, sizeof(EVP_MD_CTX));
- EVP_MD_CTX_init(ctx_init);
- #endif
- EVP_MD_CTX_set_flags(ctx_init, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
- mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, secret, secret_len);
- /* Calculate first A value */
- EVP_DigestSignInit(ctx_init, NULL, md, NULL, mac_key);
- EVP_MD_CTX_copy_ex(ctx, ctx_init);
- if(seed1 != NULL && seed1_len > 0){
- EVP_DigestSignUpdate(ctx, seed1, seed1_len);
- }
- if(seed2 != NULL && seed2_len > 0){
- EVP_DigestSignUpdate(ctx, seed2, seed2_len);
- }
- if(seed3 != NULL && seed3_len > 0){
- EVP_DigestSignUpdate(ctx, seed3, seed3_len);
- }
- if(seed4 != NULL && seed4_len > 0){
- EVP_DigestSignUpdate(ctx, seed4, seed4_len);
- }
- EVP_DigestSignFinal(ctx, A, &A_len);
- //iterate until desired length is achieved
- while(remaining > 0){
- /* Now compute SHA384(secret, A+seed) */
- EVP_MD_CTX_copy_ex(ctx, ctx_init);
- EVP_DigestSignUpdate(ctx, A, A_len);
- EVP_MD_CTX_copy_ex(ctx_tmp, ctx);
- if(seed1 != NULL && seed1_len > 0){
- EVP_DigestSignUpdate(ctx, seed1, seed1_len);
- }
- if(seed2 != NULL && seed2_len > 0){
- EVP_DigestSignUpdate(ctx, seed2, seed2_len);
- }
- if(seed3 != NULL && seed3_len > 0){
- EVP_DigestSignUpdate(ctx, seed3, seed3_len);
- }
- if(seed4 != NULL && seed4_len > 0){
- EVP_DigestSignUpdate(ctx, seed4, seed4_len);
- }
-
- if(remaining > chunk){
- EVP_DigestSignFinal(ctx, out, &len);
- out += len;
- remaining -= len;
- /* Next A value */
- EVP_DigestSignFinal(ctx_tmp, A, &A_len);
- } else {
- EVP_DigestSignFinal(ctx, A, &A_len);
- memcpy(out, A, remaining);
- remaining -= remaining;
- }
- }
- EVP_PKEY_free(mac_key);
- #if OPENSSL_VERSION_NUMBER >= 0x1010000eL
- EVP_MD_CTX_free(ctx);
- EVP_MD_CTX_free(ctx_tmp);
- EVP_MD_CTX_free(ctx_init);
- #else
- EVP_MD_CTX_cleanup(ctx);
- EVP_MD_CTX_cleanup(ctx_tmp);
- EVP_MD_CTX_cleanup(ctx_init);
- free(ctx);
- free(ctx_tmp);
- free(ctx_init);
- #endif
- return 1;
- }
- /*
- * Generate the keys for the super encryption layer, based on the slitheen ID
- */
- int generate_super_keys(uint8_t *secret){
- super = calloc(1, sizeof(super_data));
-
- EVP_MD_CTX *mac_ctx;
- const EVP_MD *md = EVP_sha256();
- /* Generate Keys */
- uint8_t *hdr_key, *bdy_key;
- uint8_t *mac_secret;
- EVP_PKEY *mac_key;
- int32_t mac_len, key_len;
- key_len = EVP_CIPHER_key_length(EVP_aes_256_cbc());
- mac_len = EVP_MD_size(md);
- int32_t total_len = 2*key_len + mac_len;
- uint8_t *key_block = calloc(1, total_len);
- PRF(secret, SLITHEEN_SUPER_SECRET_SIZE,
- (uint8_t *) SLITHEEN_SUPER_CONST, SLITHEEN_SUPER_CONST_SIZE,
- NULL, 0,
- NULL, 0,
- NULL, 0,
- key_block, total_len);
- #ifdef DEBUG
- int i;
- printf("secret: \n");
- for(i=0; i< SLITHEEN_SUPER_SECRET_SIZE; i++){
- printf("%02x ", secret[i]);
- }
- printf("\n");
- printf("keyblock: \n");
- for(i=0; i< total_len; i++){
- printf("%02x ", key_block[i]);
- }
- printf("\n");
- #endif
- hdr_key = key_block;
- bdy_key = key_block + key_len;
- mac_secret = key_block + 2*key_len;
- /* Initialize MAC Context */
- mac_ctx = EVP_MD_CTX_create();
- EVP_DigestInit_ex(mac_ctx, md, NULL);
- mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, mac_secret, mac_len);
- EVP_DigestSignInit(mac_ctx, NULL, md, NULL, mac_key);
- super->header_key = malloc(key_len);
- super->body_key = malloc(key_len);
- memcpy(super->header_key, hdr_key, key_len);
- memcpy(super->body_key, bdy_key, key_len);
- super->body_mac_ctx = mac_ctx;
- //Free everything
- free(key_block);
- EVP_PKEY_free(mac_key);
- return 0;
- }
- int peek_header(uint8_t *data){
- EVP_CIPHER_CTX *hdr_ctx = NULL;
- int32_t out_len;
- uint8_t *p = data;
- int retval = 1;
- //decrypt header
- #ifdef DEBUG_PEEK
- int i;
- printf("Encrypted header:\n");
- for(i=0; i< SLITHEEN_HEADER_LEN; i++){
- printf("%02x ", p[i]);
- }
- printf("\n");
- #endif
- hdr_ctx = EVP_CIPHER_CTX_new();
- EVP_CipherInit_ex(hdr_ctx, EVP_aes_256_ecb(), NULL, super->header_key, NULL, 0);
- if(!EVP_CipherUpdate(hdr_ctx, p, &out_len, p, SLITHEEN_HEADER_LEN)){
- retval = 0;
- goto end;
- }
- struct slitheen_hdr *sl_hdr = (struct slitheen_hdr *) p;
- //Finally, check to see if the last few bytes are zeroed.
- if(sl_hdr->zeros){
- //zeros have been corrupted, decryption failed
- printf("Decryption failed!\n");
- retval = 0;
- goto end;
- }
- #ifdef DEBUG_PARSE
- printf("Decrypted header (%d bytes):\n", SLITHEEN_HEADER_LEN);
- for(i=0; i< SLITHEEN_HEADER_LEN; i++){
- printf("%02x ", p[i]);
- }
- printf("\n");
- fflush(stdout);
- #endif
- retval = 1;
- end:
- if(hdr_ctx != NULL){
- EVP_CIPHER_CTX_cleanup(hdr_ctx);
- OPENSSL_free(hdr_ctx);
- }
- return retval;
- }
- int super_decrypt(uint8_t *data){
- EVP_CIPHER_CTX *bdy_ctx = NULL;
- EVP_CIPHER_CTX *hdr_ctx = NULL;
- uint8_t *p = data;
- int32_t out_len, len;
- uint8_t output[EVP_MAX_MD_SIZE];
- size_t mac_len;
- int i, retval = 1;
- //decrypt header
- #ifdef DEBUG
- printf("Encrypted header:\n");
- for(i=0; i< SLITHEEN_HEADER_LEN; i++){
- printf("%02x ", p[i]);
- }
- printf("\n");
- #endif
- hdr_ctx = EVP_CIPHER_CTX_new();
- EVP_CipherInit_ex(hdr_ctx, EVP_aes_256_ecb(), NULL, super->header_key, NULL, 0);
- if(!EVP_CipherUpdate(hdr_ctx, p, &out_len, p, SLITHEEN_HEADER_LEN)){
- printf("Decryption failed!");
- retval = 0;
- goto end;
- }
- struct slitheen_hdr *sl_hdr = (struct slitheen_hdr *) p;
- len = htons(sl_hdr->len);
- if(!sl_hdr->len){//there are no data to be decrypted
- retval = 1;
- goto end;
- }
- if(len %16){ //add padding to len
- len += 16 - len%16;
- }
- #ifdef DEBUG
- printf("Decrypted header (%d bytes):\n", SLITHEEN_HEADER_LEN);
- for(i=0; i< SLITHEEN_HEADER_LEN; i++){
- printf("%02x ", p[i]);
- }
- printf("\n");
- fflush(stdout);
- #endif
-
- p += SLITHEEN_HEADER_LEN;
- //initialize body cipher context with IV
- bdy_ctx = EVP_CIPHER_CTX_new();
- EVP_CipherInit_ex(bdy_ctx, EVP_aes_256_cbc(), NULL, super->body_key, p, 0);
- p+=16;
- //compute mac
- EVP_MD_CTX *mac_ctx;
- #if OPENSSL_VERSION_NUMBER >= 0x1010000eL
- mac_ctx = EVP_MD_CTX_new();
- #else
- mac_ctx = ecalloc(1, sizeof(EVP_MD_CTX));
- EVP_MD_CTX_init(mac_ctx);
- #endif
- EVP_MD_CTX_copy_ex(mac_ctx, super->body_mac_ctx);
- EVP_DigestSignUpdate(mac_ctx, p, len);
- EVP_DigestSignFinal(mac_ctx, output, &mac_len);
- #if OPENSSL_VERSION_NUMBER >= 0x1010000eL
- EVP_MD_CTX_free(mac_ctx);
- #else
- EVP_MD_CTX_cleanup(mac_ctx);
- free(mac_ctx);
- #endif
- #ifdef DEBUG_PARSE
- printf("Received mac:\n");
- for(i=0; i< 16; i++){
- printf("%02x ", p[len+i]);
- }
- printf("\n");
- fflush(stdout);
- #endif
- #ifdef DEBUG_PARSE
- printf("Computed mac:\n");
- for(i=0; i< 16; i++){
- printf("%02x ", output[i]);
- }
- printf("\n");
- fflush(stdout);
- #endif
- if(memcmp(p+len, output, 16)){
- printf("MAC verification failed\n");
- retval = 0;
- goto end;
- }
- //decrypt body
- #ifdef DEBUG_PARSE
- printf("Encrypted data (%d bytes):\n", len);
- for(i=0; i< len; i++){
- printf("%02x ", p[i]);
- }
- printf("\n");
- #endif
- if(!EVP_CipherUpdate(bdy_ctx, p, &out_len, p, len)){
- printf("Decryption failed!");
- retval = 0;
- goto end;
- }
- #ifdef DEBUG
- printf("Decrypted data (%d bytes):\n", out_len);
- for(i=0; i< out_len; i++){
- printf("%02x ", p[i]);
- }
- printf("\n");
- fflush(stdout);
- #endif
- p += out_len;
- retval = 1;
- end:
- if(hdr_ctx != NULL){
- EVP_CIPHER_CTX_cleanup(hdr_ctx);
- OPENSSL_free(hdr_ctx);
- }
- if(bdy_ctx != NULL){
- EVP_CIPHER_CTX_cleanup(bdy_ctx);
- OPENSSL_free(bdy_ctx);
- }
- return retval;
- }
|