onion_tap.c 8.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244
  1. /* Copyright (c) 2001 Matej Pfajfar.
  2. * Copyright (c) 2001-2004, Roger Dingledine.
  3. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
  4. * Copyright (c) 2007-2017, The Tor Project, Inc. */
  5. /* See LICENSE for licensing information */
  6. /**
  7. * \file onion_tap.c
  8. * \brief Functions to implement the original Tor circuit extension handshake
  9. * (a.k.a TAP).
  10. *
  11. * The "TAP" handshake is the first one that was widely used in Tor: It
  12. * combines RSA1024-OAEP and AES128-CTR to perform a hybrid encryption over
  13. * the first message DH1024 key exchange. (The RSA-encrypted part of the
  14. * encryption is authenticated; the AES-encrypted part isn't. This was
  15. * not a smart choice.)
  16. *
  17. * We didn't call it "TAP" ourselves -- Ian Goldberg named it in "On the
  18. * Security of the Tor Authentication Protocol". (Spoiler: it's secure, but
  19. * its security is kind of fragile and implementation dependent. Never modify
  20. * this implementation without reading and understanding that paper at least.)
  21. *
  22. * We have deprecated TAP since the ntor handshake came into general use. It
  23. * is still used for hidden service IP and RP connections, however.
  24. *
  25. * This handshake, like the other circuit-extension handshakes, is
  26. * invoked from onion.c.
  27. **/
  28. #include "or.h"
  29. #include "config.h"
  30. #include "onion_tap.h"
  31. #include "rephist.h"
  32. /*----------------------------------------------------------------------*/
  33. /** Given a router's 128 byte public key,
  34. * stores the following in onion_skin_out:
  35. * - [42 bytes] OAEP padding
  36. * - [16 bytes] Symmetric key for encrypting blob past RSA
  37. * - [70 bytes] g^x part 1 (inside the RSA)
  38. * - [58 bytes] g^x part 2 (symmetrically encrypted)
  39. *
  40. * Stores the DH private key into handshake_state_out for later completion
  41. * of the handshake.
  42. *
  43. * The meeting point/cookies and auth are zeroed out for now.
  44. */
  45. int
  46. onion_skin_TAP_create(crypto_pk_t *dest_router_key,
  47. crypto_dh_t **handshake_state_out,
  48. char *onion_skin_out) /* TAP_ONIONSKIN_CHALLENGE_LEN bytes */
  49. {
  50. char challenge[DH_KEY_LEN];
  51. crypto_dh_t *dh = NULL;
  52. int dhbytes, pkbytes;
  53. tor_assert(dest_router_key);
  54. tor_assert(handshake_state_out);
  55. tor_assert(onion_skin_out);
  56. *handshake_state_out = NULL;
  57. memset(onion_skin_out, 0, TAP_ONIONSKIN_CHALLENGE_LEN);
  58. if (!(dh = crypto_dh_new(DH_TYPE_CIRCUIT)))
  59. goto err;
  60. dhbytes = crypto_dh_get_bytes(dh);
  61. pkbytes = (int) crypto_pk_keysize(dest_router_key);
  62. tor_assert(dhbytes == 128);
  63. tor_assert(pkbytes == 128);
  64. if (crypto_dh_get_public(dh, challenge, dhbytes))
  65. goto err;
  66. /* set meeting point, meeting cookie, etc here. Leave zero for now. */
  67. if (crypto_pk_obsolete_public_hybrid_encrypt(dest_router_key, onion_skin_out,
  68. TAP_ONIONSKIN_CHALLENGE_LEN,
  69. challenge, DH_KEY_LEN,
  70. PK_PKCS1_OAEP_PADDING, 1)<0)
  71. goto err;
  72. memwipe(challenge, 0, sizeof(challenge));
  73. *handshake_state_out = dh;
  74. return 0;
  75. err:
  76. /* LCOV_EXCL_START
  77. * We only get here if RSA encryption fails or DH keygen fails. Those
  78. * shouldn't be possible. */
  79. memwipe(challenge, 0, sizeof(challenge));
  80. if (dh) crypto_dh_free(dh);
  81. return -1;
  82. /* LCOV_EXCL_STOP */
  83. }
  84. /** Given an encrypted DH public key as generated by onion_skin_create,
  85. * and the private key for this onion router, generate the reply (128-byte
  86. * DH plus the first 20 bytes of shared key material), and store the
  87. * next key_out_len bytes of key material in key_out.
  88. */
  89. int
  90. onion_skin_TAP_server_handshake(
  91. /*TAP_ONIONSKIN_CHALLENGE_LEN*/
  92. const char *onion_skin,
  93. crypto_pk_t *private_key,
  94. crypto_pk_t *prev_private_key,
  95. /*TAP_ONIONSKIN_REPLY_LEN*/
  96. char *handshake_reply_out,
  97. char *key_out,
  98. size_t key_out_len)
  99. {
  100. char challenge[TAP_ONIONSKIN_CHALLENGE_LEN];
  101. crypto_dh_t *dh = NULL;
  102. ssize_t len;
  103. char *key_material=NULL;
  104. size_t key_material_len=0;
  105. int i;
  106. crypto_pk_t *k;
  107. len = -1;
  108. for (i=0;i<2;++i) {
  109. k = i==0?private_key:prev_private_key;
  110. if (!k)
  111. break;
  112. len = crypto_pk_obsolete_private_hybrid_decrypt(k, challenge,
  113. TAP_ONIONSKIN_CHALLENGE_LEN,
  114. onion_skin,
  115. TAP_ONIONSKIN_CHALLENGE_LEN,
  116. PK_PKCS1_OAEP_PADDING,0);
  117. if (len>0)
  118. break;
  119. }
  120. if (len<0) {
  121. log_info(LD_PROTOCOL,
  122. "Couldn't decrypt onionskin: client may be using old onion key");
  123. goto err;
  124. } else if (len != DH_KEY_LEN) {
  125. log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
  126. "Unexpected onionskin length after decryption: %ld",
  127. (long)len);
  128. goto err;
  129. }
  130. dh = crypto_dh_new(DH_TYPE_CIRCUIT);
  131. if (!dh) {
  132. /* LCOV_EXCL_START
  133. * Failure to allocate a DH key should be impossible.
  134. */
  135. log_warn(LD_BUG, "Couldn't allocate DH key");
  136. goto err;
  137. /* LCOV_EXCL_STOP */
  138. }
  139. if (crypto_dh_get_public(dh, handshake_reply_out, DH_KEY_LEN)) {
  140. /* LCOV_EXCL_START
  141. * This can only fail if the length of the key we just allocated is too
  142. * big. That should be impossible. */
  143. log_info(LD_GENERAL, "crypto_dh_get_public failed.");
  144. goto err;
  145. /* LCOV_EXCL_STOP */
  146. }
  147. key_material_len = DIGEST_LEN+key_out_len;
  148. key_material = tor_malloc(key_material_len);
  149. len = crypto_dh_compute_secret(LOG_PROTOCOL_WARN, dh, challenge,
  150. DH_KEY_LEN, key_material,
  151. key_material_len);
  152. if (len < 0) {
  153. log_info(LD_GENERAL, "crypto_dh_compute_secret failed.");
  154. goto err;
  155. }
  156. /* send back H(K|0) as proof that we learned K. */
  157. memcpy(handshake_reply_out+DH_KEY_LEN, key_material, DIGEST_LEN);
  158. /* use the rest of the key material for our shared keys, digests, etc */
  159. memcpy(key_out, key_material+DIGEST_LEN, key_out_len);
  160. memwipe(challenge, 0, sizeof(challenge));
  161. memwipe(key_material, 0, key_material_len);
  162. tor_free(key_material);
  163. crypto_dh_free(dh);
  164. return 0;
  165. err:
  166. memwipe(challenge, 0, sizeof(challenge));
  167. if (key_material) {
  168. memwipe(key_material, 0, key_material_len);
  169. tor_free(key_material);
  170. }
  171. if (dh) crypto_dh_free(dh);
  172. return -1;
  173. }
  174. /** Finish the client side of the DH handshake.
  175. * Given the 128 byte DH reply + 20 byte hash as generated by
  176. * onion_skin_server_handshake and the handshake state generated by
  177. * onion_skin_create, verify H(K) with the first 20 bytes of shared
  178. * key material, then generate key_out_len more bytes of shared key
  179. * material and store them in key_out.
  180. *
  181. * After the invocation, call crypto_dh_free on handshake_state.
  182. */
  183. int
  184. onion_skin_TAP_client_handshake(crypto_dh_t *handshake_state,
  185. const char *handshake_reply, /* TAP_ONIONSKIN_REPLY_LEN bytes */
  186. char *key_out,
  187. size_t key_out_len,
  188. const char **msg_out)
  189. {
  190. ssize_t len;
  191. char *key_material=NULL;
  192. size_t key_material_len;
  193. tor_assert(crypto_dh_get_bytes(handshake_state) == DH_KEY_LEN);
  194. key_material_len = DIGEST_LEN + key_out_len;
  195. key_material = tor_malloc(key_material_len);
  196. len = crypto_dh_compute_secret(LOG_PROTOCOL_WARN, handshake_state,
  197. handshake_reply, DH_KEY_LEN, key_material,
  198. key_material_len);
  199. if (len < 0) {
  200. if (msg_out)
  201. *msg_out = "DH computation failed.";
  202. goto err;
  203. }
  204. if (tor_memneq(key_material, handshake_reply+DH_KEY_LEN, DIGEST_LEN)) {
  205. /* H(K) does *not* match. Something fishy. */
  206. if (msg_out)
  207. *msg_out = "Digest DOES NOT MATCH on onion handshake. Bug or attack.";
  208. goto err;
  209. }
  210. /* use the rest of the key material for our shared keys, digests, etc */
  211. memcpy(key_out, key_material+DIGEST_LEN, key_out_len);
  212. memwipe(key_material, 0, key_material_len);
  213. tor_free(key_material);
  214. return 0;
  215. err:
  216. memwipe(key_material, 0, key_material_len);
  217. tor_free(key_material);
  218. return -1;
  219. }