crypto.h 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346
  1. /* Copyright (c) 2001, Matej Pfajfar.
  2. * Copyright (c) 2001-2004, Roger Dingledine.
  3. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
  4. * Copyright (c) 2007-2016, The Tor Project, Inc. */
  5. /* See LICENSE for licensing information */
  6. /**
  7. * \file crypto.h
  8. *
  9. * \brief Headers for crypto.c
  10. **/
  11. #ifndef TOR_CRYPTO_H
  12. #define TOR_CRYPTO_H
  13. #include "orconfig.h"
  14. #include <stdio.h>
  15. #include "torint.h"
  16. #include "testsupport.h"
  17. #include "compat.h"
  18. /*
  19. Macro to create an arbitrary OpenSSL version number as used by
  20. OPENSSL_VERSION_NUMBER or SSLeay(), since the actual numbers are a bit hard
  21. to read.
  22. Don't use this directly, instead use one of the other OPENSSL_V macros
  23. below.
  24. The format is: 4 bits major, 8 bits minor, 8 bits fix, 8 bits patch, 4 bit
  25. status.
  26. */
  27. #define OPENSSL_VER(a,b,c,d,e) \
  28. (((a)<<28) | \
  29. ((b)<<20) | \
  30. ((c)<<12) | \
  31. ((d)<< 4) | \
  32. (e))
  33. /** An openssl release number. For example, OPENSSL_V(0,9,8,'j') is the
  34. * version for the released version of 0.9.8j */
  35. #define OPENSSL_V(a,b,c,d) \
  36. OPENSSL_VER((a),(b),(c),(d)-'a'+1,0xf)
  37. /** An openssl release number for the first release in the series. For
  38. * example, OPENSSL_V_NOPATCH(1,0,0) is the first released version of OpenSSL
  39. * 1.0.0. */
  40. #define OPENSSL_V_NOPATCH(a,b,c) \
  41. OPENSSL_VER((a),(b),(c),0,0xf)
  42. /** The first version that would occur for any alpha or beta in an openssl
  43. * series. For example, OPENSSL_V_SERIES(0,9,8) is greater than any released
  44. * 0.9.7, and less than any released 0.9.8. */
  45. #define OPENSSL_V_SERIES(a,b,c) \
  46. OPENSSL_VER((a),(b),(c),0,0)
  47. /** Length of the output of our message digest. */
  48. #define DIGEST_LEN 20
  49. /** Length of the output of our second (improved) message digests. (For now
  50. * this is just sha256, but it could be any other 256-bit digest.) */
  51. #define DIGEST256_LEN 32
  52. /** Length of the output of our 64-bit optimized message digests (SHA512). */
  53. #define DIGEST512_LEN 64
  54. /** Length of our symmetric cipher's keys of 128-bit. */
  55. #define CIPHER_KEY_LEN 16
  56. /** Length of our symmetric cipher's IV of 128-bit. */
  57. #define CIPHER_IV_LEN 16
  58. /** Length of our symmetric cipher's keys of 256-bit. */
  59. #define CIPHER256_KEY_LEN 32
  60. /** Length of our public keys. */
  61. #define PK_BYTES (1024/8)
  62. /** Length of our DH keys. */
  63. #define DH_BYTES (1024/8)
  64. /** Length of a sha1 message digest when encoded in base64 with trailing =
  65. * signs removed. */
  66. #define BASE64_DIGEST_LEN 27
  67. /** Length of a sha256 message digest when encoded in base64 with trailing =
  68. * signs removed. */
  69. #define BASE64_DIGEST256_LEN 43
  70. /** Length of a sha512 message digest when encoded in base64 with trailing =
  71. * signs removed. */
  72. #define BASE64_DIGEST512_LEN 86
  73. /** Constant used to indicate OAEP padding for public-key encryption */
  74. #define PK_PKCS1_OAEP_PADDING 60002
  75. /** Number of bytes added for PKCS1-OAEP padding. */
  76. #define PKCS1_OAEP_PADDING_OVERHEAD 42
  77. /** Length of encoded public key fingerprints, including space; but not
  78. * including terminating NUL. */
  79. #define FINGERPRINT_LEN 49
  80. /** Length of hex encoding of SHA1 digest, not including final NUL. */
  81. #define HEX_DIGEST_LEN 40
  82. /** Length of hex encoding of SHA256 digest, not including final NUL. */
  83. #define HEX_DIGEST256_LEN 64
  84. /** Length of hex encoding of SHA512 digest, not including final NUL. */
  85. #define HEX_DIGEST512_LEN 128
  86. typedef enum {
  87. DIGEST_SHA1 = 0,
  88. DIGEST_SHA256 = 1,
  89. DIGEST_SHA512 = 2,
  90. DIGEST_SHA3_256 = 3,
  91. DIGEST_SHA3_512 = 4,
  92. } digest_algorithm_t;
  93. #define N_DIGEST_ALGORITHMS (DIGEST_SHA3_512+1)
  94. #define N_COMMON_DIGEST_ALGORITHMS (DIGEST_SHA256+1)
  95. /** A set of all the digests we commonly compute, taken on a single
  96. * string. Any digests that are shorter than 512 bits are right-padded
  97. * with 0 bits.
  98. *
  99. * Note that this representation wastes 44 bytes for the SHA1 case, so
  100. * don't use it for anything where we need to allocate a whole bunch at
  101. * once.
  102. **/
  103. typedef struct {
  104. char d[N_COMMON_DIGEST_ALGORITHMS][DIGEST256_LEN];
  105. } common_digests_t;
  106. typedef struct crypto_pk_t crypto_pk_t;
  107. typedef struct aes_cnt_cipher crypto_cipher_t;
  108. typedef struct crypto_digest_t crypto_digest_t;
  109. typedef struct crypto_xof_t crypto_xof_t;
  110. typedef struct crypto_dh_t crypto_dh_t;
  111. /* global state */
  112. const char * crypto_openssl_get_version_str(void);
  113. const char * crypto_openssl_get_header_version_str(void);
  114. int crypto_early_init(void) ATTR_WUR;
  115. int crypto_global_init(int hardwareAccel,
  116. const char *accelName,
  117. const char *accelPath) ATTR_WUR;
  118. void crypto_thread_cleanup(void);
  119. int crypto_global_cleanup(void);
  120. /* environment setup */
  121. MOCK_DECL(crypto_pk_t *,crypto_pk_new,(void));
  122. void crypto_pk_free(crypto_pk_t *env);
  123. void crypto_set_tls_dh_prime(void);
  124. crypto_cipher_t *crypto_cipher_new(const char *key);
  125. crypto_cipher_t *crypto_cipher_new_with_bits(const char *key, int bits);
  126. crypto_cipher_t *crypto_cipher_new_with_iv(const char *key, const char *iv);
  127. crypto_cipher_t *crypto_cipher_new_with_iv_and_bits(const uint8_t *key,
  128. const uint8_t *iv,
  129. int bits);
  130. void crypto_cipher_free(crypto_cipher_t *env);
  131. /* public key crypto */
  132. MOCK_DECL(int, crypto_pk_generate_key_with_bits,(crypto_pk_t *env, int bits));
  133. #define crypto_pk_generate_key(env) \
  134. crypto_pk_generate_key_with_bits((env), (PK_BYTES*8))
  135. int crypto_pk_read_private_key_from_filename(crypto_pk_t *env,
  136. const char *keyfile);
  137. int crypto_pk_write_public_key_to_string(crypto_pk_t *env,
  138. char **dest, size_t *len);
  139. int crypto_pk_write_private_key_to_string(crypto_pk_t *env,
  140. char **dest, size_t *len);
  141. int crypto_pk_read_public_key_from_string(crypto_pk_t *env,
  142. const char *src, size_t len);
  143. int crypto_pk_read_private_key_from_string(crypto_pk_t *env,
  144. const char *s, ssize_t len);
  145. int crypto_pk_write_private_key_to_filename(crypto_pk_t *env,
  146. const char *fname);
  147. int crypto_pk_check_key(crypto_pk_t *env);
  148. int crypto_pk_cmp_keys(const crypto_pk_t *a, const crypto_pk_t *b);
  149. int crypto_pk_eq_keys(const crypto_pk_t *a, const crypto_pk_t *b);
  150. size_t crypto_pk_keysize(const crypto_pk_t *env);
  151. int crypto_pk_num_bits(crypto_pk_t *env);
  152. crypto_pk_t *crypto_pk_dup_key(crypto_pk_t *orig);
  153. crypto_pk_t *crypto_pk_copy_full(crypto_pk_t *orig);
  154. int crypto_pk_key_is_private(const crypto_pk_t *key);
  155. int crypto_pk_public_exponent_ok(crypto_pk_t *env);
  156. int crypto_pk_public_encrypt(crypto_pk_t *env, char *to, size_t tolen,
  157. const char *from, size_t fromlen, int padding);
  158. int crypto_pk_private_decrypt(crypto_pk_t *env, char *to, size_t tolen,
  159. const char *from, size_t fromlen,
  160. int padding, int warnOnFailure);
  161. int crypto_pk_public_checksig(const crypto_pk_t *env, char *to, size_t tolen,
  162. const char *from, size_t fromlen);
  163. int crypto_pk_public_checksig_digest(crypto_pk_t *env, const char *data,
  164. size_t datalen, const char *sig, size_t siglen);
  165. int crypto_pk_private_sign(const crypto_pk_t *env, char *to, size_t tolen,
  166. const char *from, size_t fromlen);
  167. int crypto_pk_private_sign_digest(crypto_pk_t *env, char *to, size_t tolen,
  168. const char *from, size_t fromlen);
  169. int crypto_pk_public_hybrid_encrypt(crypto_pk_t *env, char *to,
  170. size_t tolen,
  171. const char *from, size_t fromlen,
  172. int padding, int force);
  173. int crypto_pk_private_hybrid_decrypt(crypto_pk_t *env, char *to,
  174. size_t tolen,
  175. const char *from, size_t fromlen,
  176. int padding, int warnOnFailure);
  177. int crypto_pk_asn1_encode(crypto_pk_t *pk, char *dest, size_t dest_len);
  178. crypto_pk_t *crypto_pk_asn1_decode(const char *str, size_t len);
  179. int crypto_pk_get_digest(const crypto_pk_t *pk, char *digest_out);
  180. int crypto_pk_get_common_digests(crypto_pk_t *pk,
  181. common_digests_t *digests_out);
  182. int crypto_pk_get_fingerprint(crypto_pk_t *pk, char *fp_out,int add_space);
  183. int crypto_pk_get_hashed_fingerprint(crypto_pk_t *pk, char *fp_out);
  184. int crypto_pk_base64_encode(const crypto_pk_t *pk, char **priv_out);
  185. crypto_pk_t *crypto_pk_base64_decode(const char *str, size_t len);
  186. /* symmetric crypto */
  187. const char *crypto_cipher_get_key(crypto_cipher_t *env);
  188. int crypto_cipher_encrypt(crypto_cipher_t *env, char *to,
  189. const char *from, size_t fromlen);
  190. int crypto_cipher_decrypt(crypto_cipher_t *env, char *to,
  191. const char *from, size_t fromlen);
  192. void crypto_cipher_crypt_inplace(crypto_cipher_t *env, char *d, size_t len);
  193. int crypto_cipher_encrypt_with_iv(const char *key,
  194. char *to, size_t tolen,
  195. const char *from, size_t fromlen);
  196. int crypto_cipher_decrypt_with_iv(const char *key,
  197. char *to, size_t tolen,
  198. const char *from, size_t fromlen);
  199. /* SHA-1 and other digests. */
  200. int crypto_digest(char *digest, const char *m, size_t len);
  201. int crypto_digest256(char *digest, const char *m, size_t len,
  202. digest_algorithm_t algorithm);
  203. int crypto_digest512(char *digest, const char *m, size_t len,
  204. digest_algorithm_t algorithm);
  205. int crypto_common_digests(common_digests_t *ds_out, const char *m, size_t len);
  206. struct smartlist_t;
  207. void crypto_digest_smartlist_prefix(char *digest_out, size_t len_out,
  208. const char *prepend,
  209. const struct smartlist_t *lst,
  210. const char *append,
  211. digest_algorithm_t alg);
  212. void crypto_digest_smartlist(char *digest_out, size_t len_out,
  213. const struct smartlist_t *lst, const char *append,
  214. digest_algorithm_t alg);
  215. const char *crypto_digest_algorithm_get_name(digest_algorithm_t alg);
  216. size_t crypto_digest_algorithm_get_length(digest_algorithm_t alg);
  217. int crypto_digest_algorithm_parse_name(const char *name);
  218. crypto_digest_t *crypto_digest_new(void);
  219. crypto_digest_t *crypto_digest256_new(digest_algorithm_t algorithm);
  220. crypto_digest_t *crypto_digest512_new(digest_algorithm_t algorithm);
  221. void crypto_digest_free(crypto_digest_t *digest);
  222. void crypto_digest_add_bytes(crypto_digest_t *digest, const char *data,
  223. size_t len);
  224. void crypto_digest_get_digest(crypto_digest_t *digest,
  225. char *out, size_t out_len);
  226. crypto_digest_t *crypto_digest_dup(const crypto_digest_t *digest);
  227. void crypto_digest_assign(crypto_digest_t *into,
  228. const crypto_digest_t *from);
  229. void crypto_hmac_sha256(char *hmac_out,
  230. const char *key, size_t key_len,
  231. const char *msg, size_t msg_len);
  232. void crypto_mac_sha3_256(uint8_t *mac_out, size_t len_out,
  233. const uint8_t *key, size_t key_len,
  234. const uint8_t *msg, size_t msg_len);
  235. crypto_xof_t *crypto_xof_new(void);
  236. void crypto_xof_add_bytes(crypto_xof_t *xof, const uint8_t *data, size_t len);
  237. void crypto_xof_squeeze_bytes(crypto_xof_t *xof, uint8_t *out, size_t len);
  238. void crypto_xof_free(crypto_xof_t *xof);
  239. /* Key negotiation */
  240. #define DH_TYPE_CIRCUIT 1
  241. #define DH_TYPE_REND 2
  242. #define DH_TYPE_TLS 3
  243. crypto_dh_t *crypto_dh_new(int dh_type);
  244. crypto_dh_t *crypto_dh_dup(const crypto_dh_t *dh);
  245. int crypto_dh_get_bytes(crypto_dh_t *dh);
  246. int crypto_dh_generate_public(crypto_dh_t *dh);
  247. int crypto_dh_get_public(crypto_dh_t *dh, char *pubkey_out,
  248. size_t pubkey_out_len);
  249. ssize_t crypto_dh_compute_secret(int severity, crypto_dh_t *dh,
  250. const char *pubkey, size_t pubkey_len,
  251. char *secret_out, size_t secret_out_len);
  252. void crypto_dh_free(crypto_dh_t *dh);
  253. int crypto_expand_key_material_TAP(const uint8_t *key_in,
  254. size_t key_in_len,
  255. uint8_t *key_out, size_t key_out_len);
  256. int crypto_expand_key_material_rfc5869_sha256(
  257. const uint8_t *key_in, size_t key_in_len,
  258. const uint8_t *salt_in, size_t salt_in_len,
  259. const uint8_t *info_in, size_t info_in_len,
  260. uint8_t *key_out, size_t key_out_len);
  261. /* random numbers */
  262. int crypto_seed_rng(void) ATTR_WUR;
  263. MOCK_DECL(void,crypto_rand,(char *to, size_t n));
  264. void crypto_rand_unmocked(char *to, size_t n);
  265. void crypto_strongest_rand(uint8_t *out, size_t out_len);
  266. int crypto_rand_int(unsigned int max);
  267. int crypto_rand_int_range(unsigned int min, unsigned int max);
  268. uint64_t crypto_rand_uint64_range(uint64_t min, uint64_t max);
  269. time_t crypto_rand_time_range(time_t min, time_t max);
  270. uint64_t crypto_rand_uint64(uint64_t max);
  271. double crypto_rand_double(void);
  272. struct tor_weak_rng_t;
  273. void crypto_seed_weak_rng(struct tor_weak_rng_t *rng);
  274. int crypto_init_siphash_key(void);
  275. char *crypto_random_hostname(int min_rand_len, int max_rand_len,
  276. const char *prefix, const char *suffix);
  277. struct smartlist_t;
  278. void *smartlist_choose(const struct smartlist_t *sl);
  279. void smartlist_shuffle(struct smartlist_t *sl);
  280. /** OpenSSL-based utility functions. */
  281. void memwipe(void *mem, uint8_t byte, size_t sz);
  282. /* Prototypes for private functions only used by tortls.c, crypto.c, and the
  283. * unit tests. */
  284. struct rsa_st;
  285. struct evp_pkey_st;
  286. struct dh_st;
  287. struct rsa_st *crypto_pk_get_rsa_(crypto_pk_t *env);
  288. crypto_pk_t *crypto_new_pk_from_rsa_(struct rsa_st *rsa);
  289. MOCK_DECL(struct evp_pkey_st *, crypto_pk_get_evp_pkey_,(crypto_pk_t *env,
  290. int private));
  291. struct dh_st *crypto_dh_get_dh_(crypto_dh_t *dh);
  292. void crypto_add_spaces_to_fp(char *out, size_t outlen, const char *in);
  293. #ifdef CRYPTO_PRIVATE
  294. STATIC int crypto_force_rand_ssleay(void);
  295. STATIC int crypto_strongest_rand_raw(uint8_t *out, size_t out_len);
  296. #ifdef TOR_UNIT_TESTS
  297. extern int break_strongest_rng_syscall;
  298. extern int break_strongest_rng_fallback;
  299. #endif
  300. #endif
  301. #ifdef TOR_UNIT_TESTS
  302. void crypto_pk_assign_(crypto_pk_t *dest, const crypto_pk_t *src);
  303. #endif
  304. #endif