crypto_s2k.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468
  1. /* Copyright (c) 2001, Matej Pfajfar.
  2. * Copyright (c) 2001-2004, Roger Dingledine.
  3. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
  4. * Copyright (c) 2007-2016, The Tor Project, Inc. */
  5. /* See LICENSE for licensing information */
  6. /**
  7. * \file crypto_s2k.c
  8. *
  9. * \brief Functions for deriving keys from human-readable passphrases.
  10. */
  11. #define CRYPTO_S2K_PRIVATE
  12. #include "crypto.h"
  13. #include "util.h"
  14. #include "compat.h"
  15. #include "crypto_s2k.h"
  16. #include <openssl/evp.h>
  17. #if defined(HAVE_LIBSCRYPT_H) && defined(HAVE_LIBSCRYPT_SCRYPT)
  18. #define HAVE_SCRYPT
  19. #include <libscrypt.h>
  20. #endif
  21. /* Encoded secrets take the form:
  22. u8 type;
  23. u8 salt_and_parameters[depends on type];
  24. u8 key[depends on type];
  25. As a special case, if the encoded secret is exactly 29 bytes long,
  26. type 0 is understood.
  27. Recognized types are:
  28. 00 -- RFC2440. salt_and_parameters is 9 bytes. key is 20 bytes.
  29. salt_and_parameters is 8 bytes random salt,
  30. 1 byte iteration info.
  31. 01 -- PKBDF2_SHA1. salt_and_parameters is 17 bytes. key is 20 bytes.
  32. salt_and_parameters is 16 bytes random salt,
  33. 1 byte iteration info.
  34. 02 -- SCRYPT_SALSA208_SHA256. salt_and_parameters is 18 bytes. key is
  35. 32 bytes.
  36. salt_and_parameters is 18 bytes random salt, 2 bytes iteration
  37. info.
  38. */
  39. #define S2K_TYPE_RFC2440 0
  40. #define S2K_TYPE_PBKDF2 1
  41. #define S2K_TYPE_SCRYPT 2
  42. #define PBKDF2_SPEC_LEN 17
  43. #define PBKDF2_KEY_LEN 20
  44. #define SCRYPT_SPEC_LEN 18
  45. #define SCRYPT_KEY_LEN 32
  46. /** Given an algorithm ID (one of S2K_TYPE_*), return the length of the
  47. * specifier part of it, without the prefix type byte. Return -1 if it is not
  48. * a valid algorithm ID. */
  49. static int
  50. secret_to_key_spec_len(uint8_t type)
  51. {
  52. switch (type) {
  53. case S2K_TYPE_RFC2440:
  54. return S2K_RFC2440_SPECIFIER_LEN;
  55. case S2K_TYPE_PBKDF2:
  56. return PBKDF2_SPEC_LEN;
  57. case S2K_TYPE_SCRYPT:
  58. return SCRYPT_SPEC_LEN;
  59. default:
  60. return -1;
  61. }
  62. }
  63. /** Given an algorithm ID (one of S2K_TYPE_*), return the length of the
  64. * its preferred output. */
  65. static int
  66. secret_to_key_key_len(uint8_t type)
  67. {
  68. switch (type) {
  69. case S2K_TYPE_RFC2440:
  70. return DIGEST_LEN;
  71. case S2K_TYPE_PBKDF2:
  72. return DIGEST_LEN;
  73. case S2K_TYPE_SCRYPT:
  74. return DIGEST256_LEN;
  75. default:
  76. tor_fragile_assert(); // LCOV_EXCL_LINE
  77. return -1; // LCOV_EXCL_LINE
  78. }
  79. }
  80. /** Given a specifier in <b>spec_and_key</b> of length
  81. * <b>spec_and_key_len</b>, along with its prefix algorithm ID byte, and along
  82. * with a key if <b>key_included</b> is true, check whether the whole
  83. * specifier-and-key is of valid length, and return the algorithm type if it
  84. * is. Set *<b>legacy_out</b> to 1 iff this is a legacy password hash or
  85. * legacy specifier. Return an error code on failure.
  86. */
  87. static int
  88. secret_to_key_get_type(const uint8_t *spec_and_key, size_t spec_and_key_len,
  89. int key_included, int *legacy_out)
  90. {
  91. size_t legacy_len = S2K_RFC2440_SPECIFIER_LEN;
  92. uint8_t type;
  93. int total_len;
  94. if (key_included)
  95. legacy_len += DIGEST_LEN;
  96. if (spec_and_key_len == legacy_len) {
  97. *legacy_out = 1;
  98. return S2K_TYPE_RFC2440;
  99. }
  100. *legacy_out = 0;
  101. if (spec_and_key_len == 0)
  102. return S2K_BAD_LEN;
  103. type = spec_and_key[0];
  104. total_len = secret_to_key_spec_len(type);
  105. if (total_len < 0)
  106. return S2K_BAD_ALGORITHM;
  107. if (key_included) {
  108. int keylen = secret_to_key_key_len(type);
  109. if (keylen < 0)
  110. return S2K_BAD_ALGORITHM;
  111. total_len += keylen;
  112. }
  113. if ((size_t)total_len + 1 == spec_and_key_len)
  114. return type;
  115. else
  116. return S2K_BAD_LEN;
  117. }
  118. /**
  119. * Write a new random s2k specifier of type <b>type</b>, without prefixing
  120. * type byte, to <b>spec_out</b>, which must have enough room. May adjust
  121. * parameter choice based on <b>flags</b>.
  122. */
  123. static int
  124. make_specifier(uint8_t *spec_out, uint8_t type, unsigned flags)
  125. {
  126. int speclen = secret_to_key_spec_len(type);
  127. if (speclen < 0)
  128. return S2K_BAD_ALGORITHM;
  129. crypto_rand((char*)spec_out, speclen);
  130. switch (type) {
  131. case S2K_TYPE_RFC2440:
  132. /* Hash 64 k of data. */
  133. spec_out[S2K_RFC2440_SPECIFIER_LEN-1] = 96;
  134. break;
  135. case S2K_TYPE_PBKDF2:
  136. /* 131 K iterations */
  137. spec_out[PBKDF2_SPEC_LEN-1] = 17;
  138. break;
  139. case S2K_TYPE_SCRYPT:
  140. if (flags & S2K_FLAG_LOW_MEM) {
  141. /* N = 1<<12 */
  142. spec_out[SCRYPT_SPEC_LEN-2] = 12;
  143. } else {
  144. /* N = 1<<15 */
  145. spec_out[SCRYPT_SPEC_LEN-2] = 15;
  146. }
  147. /* r = 8; p = 2. */
  148. spec_out[SCRYPT_SPEC_LEN-1] = (3u << 4) | (1u << 0);
  149. break;
  150. default:
  151. tor_fragile_assert(); // LCOV_EXCL_LINE - we should have returned above.
  152. return S2K_BAD_ALGORITHM;
  153. }
  154. return speclen;
  155. }
  156. /** Implement RFC2440-style iterated-salted S2K conversion: convert the
  157. * <b>secret_len</b>-byte <b>secret</b> into a <b>key_out_len</b> byte
  158. * <b>key_out</b>. As in RFC2440, the first 8 bytes of s2k_specifier
  159. * are a salt; the 9th byte describes how much iteration to do.
  160. * If <b>key_out_len</b> &gt; DIGEST_LEN, use HDKF to expand the result.
  161. */
  162. void
  163. secret_to_key_rfc2440(char *key_out, size_t key_out_len, const char *secret,
  164. size_t secret_len, const char *s2k_specifier)
  165. {
  166. crypto_digest_t *d;
  167. uint8_t c;
  168. size_t count, tmplen;
  169. char *tmp;
  170. uint8_t buf[DIGEST_LEN];
  171. tor_assert(key_out_len < SIZE_T_CEILING);
  172. #define EXPBIAS 6
  173. c = s2k_specifier[8];
  174. count = ((uint32_t)16 + (c & 15)) << ((c >> 4) + EXPBIAS);
  175. #undef EXPBIAS
  176. d = crypto_digest_new();
  177. tmplen = 8+secret_len;
  178. tmp = tor_malloc(tmplen);
  179. memcpy(tmp,s2k_specifier,8);
  180. memcpy(tmp+8,secret,secret_len);
  181. secret_len += 8;
  182. while (count) {
  183. if (count >= secret_len) {
  184. crypto_digest_add_bytes(d, tmp, secret_len);
  185. count -= secret_len;
  186. } else {
  187. crypto_digest_add_bytes(d, tmp, count);
  188. count = 0;
  189. }
  190. }
  191. crypto_digest_get_digest(d, (char*)buf, sizeof(buf));
  192. if (key_out_len <= sizeof(buf)) {
  193. memcpy(key_out, buf, key_out_len);
  194. } else {
  195. crypto_expand_key_material_rfc5869_sha256(buf, DIGEST_LEN,
  196. (const uint8_t*)s2k_specifier, 8,
  197. (const uint8_t*)"EXPAND", 6,
  198. (uint8_t*)key_out, key_out_len);
  199. }
  200. memwipe(tmp, 0, tmplen);
  201. memwipe(buf, 0, sizeof(buf));
  202. tor_free(tmp);
  203. crypto_digest_free(d);
  204. }
  205. /**
  206. * Helper: given a valid specifier without prefix type byte in <b>spec</b>,
  207. * whose length must be correct, and given a secret passphrase <b>secret</b>
  208. * of length <b>secret_len</b>, compute the key and store it into
  209. * <b>key_out</b>, which must have enough room for secret_to_key_key_len(type)
  210. * bytes. Return the number of bytes written on success and an error code
  211. * on failure.
  212. */
  213. STATIC int
  214. secret_to_key_compute_key(uint8_t *key_out, size_t key_out_len,
  215. const uint8_t *spec, size_t spec_len,
  216. const char *secret, size_t secret_len,
  217. int type)
  218. {
  219. int rv;
  220. if (key_out_len > INT_MAX)
  221. return S2K_BAD_LEN;
  222. switch (type) {
  223. case S2K_TYPE_RFC2440:
  224. secret_to_key_rfc2440((char*)key_out, key_out_len, secret, secret_len,
  225. (const char*)spec);
  226. return (int)key_out_len;
  227. case S2K_TYPE_PBKDF2: {
  228. uint8_t log_iters;
  229. if (spec_len < 1 || secret_len > INT_MAX || spec_len > INT_MAX)
  230. return S2K_BAD_LEN;
  231. log_iters = spec[spec_len-1];
  232. if (log_iters > 31)
  233. return S2K_BAD_PARAMS;
  234. rv = PKCS5_PBKDF2_HMAC_SHA1(secret, (int)secret_len,
  235. spec, (int)spec_len-1,
  236. (1<<log_iters),
  237. (int)key_out_len, key_out);
  238. if (rv < 0)
  239. return S2K_FAILED;
  240. return (int)key_out_len;
  241. }
  242. case S2K_TYPE_SCRYPT: {
  243. #ifdef HAVE_SCRYPT
  244. uint8_t log_N, log_r, log_p;
  245. uint64_t N;
  246. uint32_t r, p;
  247. if (spec_len < 2)
  248. return S2K_BAD_LEN;
  249. log_N = spec[spec_len-2];
  250. log_r = (spec[spec_len-1]) >> 4;
  251. log_p = (spec[spec_len-1]) & 15;
  252. if (log_N > 63)
  253. return S2K_BAD_PARAMS;
  254. N = ((uint64_t)1) << log_N;
  255. r = 1u << log_r;
  256. p = 1u << log_p;
  257. rv = libscrypt_scrypt((const uint8_t*)secret, secret_len,
  258. spec, spec_len-2, N, r, p, key_out, key_out_len);
  259. if (rv != 0)
  260. return S2K_FAILED;
  261. return (int)key_out_len;
  262. #else
  263. return S2K_NO_SCRYPT_SUPPORT;
  264. #endif
  265. }
  266. default:
  267. return S2K_BAD_ALGORITHM;
  268. }
  269. }
  270. /**
  271. * Given a specifier previously constructed with secret_to_key_make_specifier
  272. * in <b>spec</b> of length <b>spec_len</b>, and a secret password in
  273. * <b>secret</b> of length <b>secret_len</b>, generate <b>key_out_len</b>
  274. * bytes of cryptographic material in <b>key_out</b>. The native output of
  275. * the secret-to-key function will be truncated if key_out_len is short, and
  276. * expanded with HKDF if key_out_len is long. Returns S2K_OKAY on success,
  277. * and an error code on failure.
  278. */
  279. int
  280. secret_to_key_derivekey(uint8_t *key_out, size_t key_out_len,
  281. const uint8_t *spec, size_t spec_len,
  282. const char *secret, size_t secret_len)
  283. {
  284. int legacy_format = 0;
  285. int type = secret_to_key_get_type(spec, spec_len, 0, &legacy_format);
  286. int r;
  287. if (type < 0)
  288. return type;
  289. #ifndef HAVE_SCRYPT
  290. if (type == S2K_TYPE_SCRYPT)
  291. return S2K_NO_SCRYPT_SUPPORT;
  292. #endif
  293. if (! legacy_format) {
  294. ++spec;
  295. --spec_len;
  296. }
  297. r = secret_to_key_compute_key(key_out, key_out_len, spec, spec_len,
  298. secret, secret_len, type);
  299. if (r < 0)
  300. return r;
  301. else
  302. return S2K_OKAY;
  303. }
  304. /**
  305. * Construct a new s2k algorithm specifier and salt in <b>buf</b>, according
  306. * to the bitwise-or of some S2K_FLAG_* options in <b>flags</b>. Up to
  307. * <b>buf_len</b> bytes of storage may be used in <b>buf</b>. Return the
  308. * number of bytes used on success and an error code on failure.
  309. */
  310. int
  311. secret_to_key_make_specifier(uint8_t *buf, size_t buf_len, unsigned flags)
  312. {
  313. int rv;
  314. int spec_len;
  315. #ifdef HAVE_SCRYPT
  316. uint8_t type = S2K_TYPE_SCRYPT;
  317. #else
  318. uint8_t type = S2K_TYPE_RFC2440;
  319. #endif
  320. if (flags & S2K_FLAG_NO_SCRYPT)
  321. type = S2K_TYPE_RFC2440;
  322. if (flags & S2K_FLAG_USE_PBKDF2)
  323. type = S2K_TYPE_PBKDF2;
  324. spec_len = secret_to_key_spec_len(type);
  325. if ((int)buf_len < spec_len + 1)
  326. return S2K_TRUNCATED;
  327. buf[0] = type;
  328. rv = make_specifier(buf+1, type, flags);
  329. if (rv < 0)
  330. return rv;
  331. else
  332. return rv + 1;
  333. }
  334. /**
  335. * Hash a passphrase from <b>secret</b> of length <b>secret_len</b>, according
  336. * to the bitwise-or of some S2K_FLAG_* options in <b>flags</b>, and store the
  337. * hash along with salt and hashing parameters into <b>buf</b>. Up to
  338. * <b>buf_len</b> bytes of storage may be used in <b>buf</b>. Set
  339. * *<b>len_out</b> to the number of bytes used and return S2K_OKAY on success;
  340. * and return an error code on failure.
  341. */
  342. int
  343. secret_to_key_new(uint8_t *buf,
  344. size_t buf_len,
  345. size_t *len_out,
  346. const char *secret, size_t secret_len,
  347. unsigned flags)
  348. {
  349. int key_len;
  350. int spec_len;
  351. int type;
  352. int rv;
  353. spec_len = secret_to_key_make_specifier(buf, buf_len, flags);
  354. if (spec_len < 0)
  355. return spec_len;
  356. type = buf[0];
  357. key_len = secret_to_key_key_len(type);
  358. if (key_len < 0)
  359. return key_len;
  360. if ((int)buf_len < key_len + spec_len)
  361. return S2K_TRUNCATED;
  362. rv = secret_to_key_compute_key(buf + spec_len, key_len,
  363. buf + 1, spec_len-1,
  364. secret, secret_len, type);
  365. if (rv < 0)
  366. return rv;
  367. *len_out = spec_len + key_len;
  368. return S2K_OKAY;
  369. }
  370. /**
  371. * Given a hashed passphrase in <b>spec_and_key</b> of length
  372. * <b>spec_and_key_len</b> as generated by secret_to_key_new(), verify whether
  373. * it is a hash of the passphrase <b>secret</b> of length <b>secret_len</b>.
  374. * Return S2K_OKAY on a match, S2K_BAD_SECRET on a well-formed hash that
  375. * doesn't match this secret, and another error code on other errors.
  376. */
  377. int
  378. secret_to_key_check(const uint8_t *spec_and_key, size_t spec_and_key_len,
  379. const char *secret, size_t secret_len)
  380. {
  381. int is_legacy = 0;
  382. int type = secret_to_key_get_type(spec_and_key, spec_and_key_len,
  383. 1, &is_legacy);
  384. uint8_t buf[32];
  385. int spec_len;
  386. int key_len;
  387. int rv;
  388. if (type < 0)
  389. return type;
  390. if (! is_legacy) {
  391. spec_and_key++;
  392. spec_and_key_len--;
  393. }
  394. spec_len = secret_to_key_spec_len(type);
  395. key_len = secret_to_key_key_len(type);
  396. tor_assert(spec_len > 0);
  397. tor_assert(key_len > 0);
  398. tor_assert(key_len <= (int) sizeof(buf));
  399. tor_assert((int)spec_and_key_len == spec_len + key_len);
  400. rv = secret_to_key_compute_key(buf, key_len,
  401. spec_and_key, spec_len,
  402. secret, secret_len, type);
  403. if (rv < 0)
  404. goto done;
  405. if (tor_memeq(buf, spec_and_key + spec_len, key_len))
  406. rv = S2K_OKAY;
  407. else
  408. rv = S2K_BAD_SECRET;
  409. done:
  410. memwipe(buf, 0, sizeof(buf));
  411. return rv;
  412. }