onion_fast.c 4.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124
  1. /* Copyright (c) 2001 Matej Pfajfar.
  2. * Copyright (c) 2001-2004, Roger Dingledine.
  3. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
  4. * Copyright (c) 2007-2016, The Tor Project, Inc. */
  5. /* See LICENSE for licensing information */
  6. /**
  7. * \file onion_fast.c
  8. * \brief Functions implement the CREATE_FAST circuit handshake.
  9. **/
  10. #include "or.h"
  11. #include "onion_fast.h"
  12. /** Release all state held in <b>victim</b>. */
  13. void
  14. fast_handshake_state_free(fast_handshake_state_t *victim)
  15. {
  16. if (! victim)
  17. return;
  18. memwipe(victim, 0, sizeof(fast_handshake_state_t));
  19. tor_free(victim);
  20. }
  21. /** Create the state needed to perform a CREATE_FAST handshake. Return 0
  22. * on success, -1 on failure. */
  23. int
  24. fast_onionskin_create(fast_handshake_state_t **handshake_state_out,
  25. uint8_t *handshake_out)
  26. {
  27. fast_handshake_state_t *s;
  28. *handshake_state_out = s = tor_malloc(sizeof(fast_handshake_state_t));
  29. crypto_rand((char*)s->state, sizeof(s->state));
  30. memcpy(handshake_out, s->state, DIGEST_LEN);
  31. return 0;
  32. }
  33. /** Implement the server side of the CREATE_FAST abbreviated handshake. The
  34. * client has provided DIGEST_LEN key bytes in <b>key_in</b> ("x"). We
  35. * generate a reply of DIGEST_LEN*2 bytes in <b>key_out</b>, consisting of a
  36. * new random "y", followed by H(x|y) to check for correctness. We set
  37. * <b>key_out_len</b> bytes of key material in <b>key_out</b>.
  38. * Return 0 on success, &lt;0 on failure.
  39. **/
  40. int
  41. fast_server_handshake(const uint8_t *key_in, /* DIGEST_LEN bytes */
  42. uint8_t *handshake_reply_out, /* DIGEST_LEN*2 bytes */
  43. uint8_t *key_out,
  44. size_t key_out_len)
  45. {
  46. uint8_t tmp[DIGEST_LEN+DIGEST_LEN];
  47. uint8_t *out = NULL;
  48. size_t out_len;
  49. int r = -1;
  50. crypto_rand((char*)handshake_reply_out, DIGEST_LEN);
  51. memcpy(tmp, key_in, DIGEST_LEN);
  52. memcpy(tmp+DIGEST_LEN, handshake_reply_out, DIGEST_LEN);
  53. out_len = key_out_len+DIGEST_LEN;
  54. out = tor_malloc(out_len);
  55. if (BUG(crypto_expand_key_material_TAP(tmp, sizeof(tmp), out, out_len))) {
  56. goto done; // LCOV_EXCL_LINE
  57. }
  58. memcpy(handshake_reply_out+DIGEST_LEN, out, DIGEST_LEN);
  59. memcpy(key_out, out+DIGEST_LEN, key_out_len);
  60. r = 0;
  61. done:
  62. memwipe(tmp, 0, sizeof(tmp));
  63. memwipe(out, 0, out_len);
  64. tor_free(out);
  65. return r;
  66. }
  67. /** Implement the second half of the client side of the CREATE_FAST handshake.
  68. * We sent the server <b>handshake_state</b> ("x") already, and the server
  69. * told us <b>handshake_reply_out</b> (y|H(x|y)). Make sure that the hash is
  70. * correct, and generate key material in <b>key_out</b>. Return 0 on success,
  71. * true on failure.
  72. *
  73. * NOTE: The "CREATE_FAST" handshake path is distinguishable from regular
  74. * "onionskin" handshakes, and is not secure if an adversary can see or modify
  75. * the messages. Therefore, it should only be used by clients, and only as
  76. * the first hop of a circuit (since the first hop is already authenticated
  77. * and protected by TLS).
  78. */
  79. int
  80. fast_client_handshake(const fast_handshake_state_t *handshake_state,
  81. const uint8_t *handshake_reply_out,/*DIGEST_LEN*2 bytes*/
  82. uint8_t *key_out,
  83. size_t key_out_len,
  84. const char **msg_out)
  85. {
  86. uint8_t tmp[DIGEST_LEN+DIGEST_LEN];
  87. uint8_t *out;
  88. size_t out_len;
  89. int r = -1;
  90. memcpy(tmp, handshake_state->state, DIGEST_LEN);
  91. memcpy(tmp+DIGEST_LEN, handshake_reply_out, DIGEST_LEN);
  92. out_len = key_out_len+DIGEST_LEN;
  93. out = tor_malloc(out_len);
  94. if (BUG(crypto_expand_key_material_TAP(tmp, sizeof(tmp), out, out_len))) {
  95. /* LCOV_EXCL_START */
  96. if (msg_out)
  97. *msg_out = "Failed to expand key material";
  98. goto done;
  99. /* LCOV_EXCL_STOP */
  100. }
  101. if (tor_memneq(out, handshake_reply_out+DIGEST_LEN, DIGEST_LEN)) {
  102. /* H(K) does *not* match. Something fishy. */
  103. if (msg_out)
  104. *msg_out = "Digest DOES NOT MATCH on fast handshake. Bug or attack.";
  105. goto done;
  106. }
  107. memcpy(key_out, out+DIGEST_LEN, key_out_len);
  108. r = 0;
  109. done:
  110. memwipe(tmp, 0, sizeof(tmp));
  111. memwipe(out, 0, out_len);
  112. tor_free(out);
  113. return r;
  114. }