onion_tap.c 7.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223
  1. /* Copyright (c) 2001 Matej Pfajfar.
  2. * Copyright (c) 2001-2004, Roger Dingledine.
  3. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
  4. * Copyright (c) 2007-2016, The Tor Project, Inc. */
  5. /* See LICENSE for licensing information */
  6. /**
  7. * \file onion_tap.c
  8. * \brief Functions to implement the original Tor circuit extension handshake
  9. * (a.k.a TAP).
  10. *
  11. * We didn't call it "TAP" ourselves -- Ian Goldberg named it in "On the
  12. * Security of the Tor Authentication Protocol". (Spoiler: it's secure, but
  13. * its security is kind of fragile and implementation dependent. Never modify
  14. * this implementation without reading and understanding that paper at least.)
  15. **/
  16. #include "or.h"
  17. #include "config.h"
  18. #include "onion_tap.h"
  19. #include "rephist.h"
  20. /*----------------------------------------------------------------------*/
  21. /** Given a router's 128 byte public key,
  22. * stores the following in onion_skin_out:
  23. * - [42 bytes] OAEP padding
  24. * - [16 bytes] Symmetric key for encrypting blob past RSA
  25. * - [70 bytes] g^x part 1 (inside the RSA)
  26. * - [58 bytes] g^x part 2 (symmetrically encrypted)
  27. *
  28. * Stores the DH private key into handshake_state_out for later completion
  29. * of the handshake.
  30. *
  31. * The meeting point/cookies and auth are zeroed out for now.
  32. */
  33. int
  34. onion_skin_TAP_create(crypto_pk_t *dest_router_key,
  35. crypto_dh_t **handshake_state_out,
  36. char *onion_skin_out) /* TAP_ONIONSKIN_CHALLENGE_LEN bytes */
  37. {
  38. char challenge[DH_KEY_LEN];
  39. crypto_dh_t *dh = NULL;
  40. int dhbytes, pkbytes;
  41. tor_assert(dest_router_key);
  42. tor_assert(handshake_state_out);
  43. tor_assert(onion_skin_out);
  44. *handshake_state_out = NULL;
  45. memset(onion_skin_out, 0, TAP_ONIONSKIN_CHALLENGE_LEN);
  46. if (!(dh = crypto_dh_new(DH_TYPE_CIRCUIT)))
  47. goto err;
  48. dhbytes = crypto_dh_get_bytes(dh);
  49. pkbytes = (int) crypto_pk_keysize(dest_router_key);
  50. tor_assert(dhbytes == 128);
  51. tor_assert(pkbytes == 128);
  52. if (crypto_dh_get_public(dh, challenge, dhbytes))
  53. goto err;
  54. note_crypto_pk_op(ENC_ONIONSKIN);
  55. /* set meeting point, meeting cookie, etc here. Leave zero for now. */
  56. if (crypto_pk_public_hybrid_encrypt(dest_router_key, onion_skin_out,
  57. TAP_ONIONSKIN_CHALLENGE_LEN,
  58. challenge, DH_KEY_LEN,
  59. PK_PKCS1_OAEP_PADDING, 1)<0)
  60. goto err;
  61. memwipe(challenge, 0, sizeof(challenge));
  62. *handshake_state_out = dh;
  63. return 0;
  64. err:
  65. memwipe(challenge, 0, sizeof(challenge));
  66. if (dh) crypto_dh_free(dh);
  67. return -1;
  68. }
  69. /** Given an encrypted DH public key as generated by onion_skin_create,
  70. * and the private key for this onion router, generate the reply (128-byte
  71. * DH plus the first 20 bytes of shared key material), and store the
  72. * next key_out_len bytes of key material in key_out.
  73. */
  74. int
  75. onion_skin_TAP_server_handshake(
  76. /*TAP_ONIONSKIN_CHALLENGE_LEN*/
  77. const char *onion_skin,
  78. crypto_pk_t *private_key,
  79. crypto_pk_t *prev_private_key,
  80. /*TAP_ONIONSKIN_REPLY_LEN*/
  81. char *handshake_reply_out,
  82. char *key_out,
  83. size_t key_out_len)
  84. {
  85. char challenge[TAP_ONIONSKIN_CHALLENGE_LEN];
  86. crypto_dh_t *dh = NULL;
  87. ssize_t len;
  88. char *key_material=NULL;
  89. size_t key_material_len=0;
  90. int i;
  91. crypto_pk_t *k;
  92. len = -1;
  93. for (i=0;i<2;++i) {
  94. k = i==0?private_key:prev_private_key;
  95. if (!k)
  96. break;
  97. note_crypto_pk_op(DEC_ONIONSKIN);
  98. len = crypto_pk_private_hybrid_decrypt(k, challenge,
  99. TAP_ONIONSKIN_CHALLENGE_LEN,
  100. onion_skin,
  101. TAP_ONIONSKIN_CHALLENGE_LEN,
  102. PK_PKCS1_OAEP_PADDING,0);
  103. if (len>0)
  104. break;
  105. }
  106. if (len<0) {
  107. log_info(LD_PROTOCOL,
  108. "Couldn't decrypt onionskin: client may be using old onion key");
  109. goto err;
  110. } else if (len != DH_KEY_LEN) {
  111. log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
  112. "Unexpected onionskin length after decryption: %ld",
  113. (long)len);
  114. goto err;
  115. }
  116. dh = crypto_dh_new(DH_TYPE_CIRCUIT);
  117. if (!dh) {
  118. log_warn(LD_BUG, "Couldn't allocate DH key");
  119. goto err;
  120. }
  121. if (crypto_dh_get_public(dh, handshake_reply_out, DH_KEY_LEN)) {
  122. log_info(LD_GENERAL, "crypto_dh_get_public failed.");
  123. goto err;
  124. }
  125. key_material_len = DIGEST_LEN+key_out_len;
  126. key_material = tor_malloc(key_material_len);
  127. len = crypto_dh_compute_secret(LOG_PROTOCOL_WARN, dh, challenge,
  128. DH_KEY_LEN, key_material,
  129. key_material_len);
  130. if (len < 0) {
  131. log_info(LD_GENERAL, "crypto_dh_compute_secret failed.");
  132. goto err;
  133. }
  134. /* send back H(K|0) as proof that we learned K. */
  135. memcpy(handshake_reply_out+DH_KEY_LEN, key_material, DIGEST_LEN);
  136. /* use the rest of the key material for our shared keys, digests, etc */
  137. memcpy(key_out, key_material+DIGEST_LEN, key_out_len);
  138. memwipe(challenge, 0, sizeof(challenge));
  139. memwipe(key_material, 0, key_material_len);
  140. tor_free(key_material);
  141. crypto_dh_free(dh);
  142. return 0;
  143. err:
  144. memwipe(challenge, 0, sizeof(challenge));
  145. if (key_material) {
  146. memwipe(key_material, 0, key_material_len);
  147. tor_free(key_material);
  148. }
  149. if (dh) crypto_dh_free(dh);
  150. return -1;
  151. }
  152. /** Finish the client side of the DH handshake.
  153. * Given the 128 byte DH reply + 20 byte hash as generated by
  154. * onion_skin_server_handshake and the handshake state generated by
  155. * onion_skin_create, verify H(K) with the first 20 bytes of shared
  156. * key material, then generate key_out_len more bytes of shared key
  157. * material and store them in key_out.
  158. *
  159. * After the invocation, call crypto_dh_free on handshake_state.
  160. */
  161. int
  162. onion_skin_TAP_client_handshake(crypto_dh_t *handshake_state,
  163. const char *handshake_reply, /* TAP_ONIONSKIN_REPLY_LEN bytes */
  164. char *key_out,
  165. size_t key_out_len,
  166. const char **msg_out)
  167. {
  168. ssize_t len;
  169. char *key_material=NULL;
  170. size_t key_material_len;
  171. tor_assert(crypto_dh_get_bytes(handshake_state) == DH_KEY_LEN);
  172. key_material_len = DIGEST_LEN + key_out_len;
  173. key_material = tor_malloc(key_material_len);
  174. len = crypto_dh_compute_secret(LOG_PROTOCOL_WARN, handshake_state,
  175. handshake_reply, DH_KEY_LEN, key_material,
  176. key_material_len);
  177. if (len < 0) {
  178. if (msg_out)
  179. *msg_out = "DH computation failed.";
  180. goto err;
  181. }
  182. if (tor_memneq(key_material, handshake_reply+DH_KEY_LEN, DIGEST_LEN)) {
  183. /* H(K) does *not* match. Something fishy. */
  184. if (msg_out)
  185. *msg_out = "Digest DOES NOT MATCH on onion handshake. Bug or attack.";
  186. goto err;
  187. }
  188. /* use the rest of the key material for our shared keys, digests, etc */
  189. memcpy(key_out, key_material+DIGEST_LEN, key_out_len);
  190. memwipe(key_material, 0, key_material_len);
  191. tor_free(key_material);
  192. return 0;
  193. err:
  194. memwipe(key_material, 0, key_material_len);
  195. tor_free(key_material);
  196. return -1;
  197. }