static void
test_hkdf_sha1(const struct tstring *ikm,
const struct tstring *salt,
const struct tstring *info,
const struct tstring *extract_output,
const struct tstring *expand_output)
{
struct hmac_sha1_ctx ctx;
uint8_t prk[SHA1_DIGEST_SIZE];
uint8_t *buffer = xalloc(expand_output->length);
hmac_sha1_set_key(&ctx, salt->length, salt->data);
hkdf_extract(&ctx,
(nettle_hash_update_func*) hmac_sha1_update,
(nettle_hash_digest_func*) hmac_sha1_digest,
SHA1_DIGEST_SIZE,
ikm->length, ikm->data,
prk);
if (MEMEQ(SHA1_DIGEST_SIZE, prk, extract_output->data) == 0)
{
fprintf(stdout, "\nGot:\n");
print_hex(SHA1_DIGEST_SIZE, prk);
fprintf(stdout, "\nExpected:\n");
print_hex(extract_output->length, extract_output->data);
abort();
}
hmac_sha1_set_key(&ctx, SHA1_DIGEST_SIZE, prk);
hkdf_expand(&ctx,
(nettle_hash_update_func*) hmac_sha1_update,
(nettle_hash_digest_func*) hmac_sha1_digest,
SHA1_DIGEST_SIZE,
info->length, info->data,
expand_output->length, buffer);
if (MEMEQ(expand_output->length, expand_output->data, buffer) == 0)
{
fprintf(stdout, "\nGot:\n");
print_hex(expand_output->length, buffer);
fprintf(stdout, "\nExpected:\n");
print_hex(expand_output->length, expand_output->data);
abort();
}
free(buffer);
}
void
rsa_session_set_encrypt_key(struct rsa_session *ctx,
const struct rsa_session_info *key)
{
const uint8_t *aes_key = SESSION_AES_KEY(key);
const uint8_t *iv = SESSION_IV(key);
const uint8_t *hmac_key = SESSION_HMAC_KEY(key);
aes_set_encrypt_key(&ctx->aes.ctx, AES_KEY_SIZE, aes_key);
CBC_SET_IV(&ctx->aes, iv);
hmac_sha1_set_key(&ctx->hmac, SHA1_DIGEST_SIZE, hmac_key);
}
void
pbkdf2_hmac_sha1 (size_t key_length, const uint8_t *key,
unsigned iterations,
size_t salt_length, const uint8_t *salt,
size_t length, uint8_t *dst)
{
struct hmac_sha1_ctx sha1ctx;
hmac_sha1_set_key (&sha1ctx, key_length, key);
PBKDF2 (&sha1ctx, hmac_sha1_update, hmac_sha1_digest,
SHA1_DIGEST_SIZE, iterations, salt_length, salt, length, dst);
}
term_t cbif_sha_mac_n3(proc_t *proc, term_t *regs)
{
term_t Key = regs[0];
term_t Data = regs[1];
term_t Size = regs[2];
if (!is_list(Key) && !is_boxed_binary(Key))
badarg(Key);
if (!is_list(Data) && !is_boxed_binary(Data))
badarg(Data);
if (!is_int(Size))
badarg(Size);
int trunc_size = int_value(Size);
if (trunc_size < 1 || trunc_size > SHA1_DIGEST_SIZE)
badarg(Size);
int key_size = iolist_size(Key);
if (key_size < 0)
badarg(Key);
assert(key_size <= 65536); // TODO: use heap_tmp_buf for a longer Key
uint8_t key_buf[key_size];
iolist_flatten(Key, key_buf);
int data_size = iolist_size(Data);
if (data_size < 0)
badarg(Data);
assert(data_size <= 65536); // TODO: use heap_tmp_buf for larger Data
uint8_t data_buf[data_size];
iolist_flatten(Data, data_buf);
struct hmac_sha1_ctx ctx;
hmac_sha1_set_key(&ctx, key_size, key_buf);
hmac_sha1_update(&ctx, data_size, data_buf);
uint8_t *ptr;
term_t mac = heap_make_bin(&proc->hp, trunc_size, &ptr);
hmac_sha1_digest(&ctx, trunc_size, ptr);
return mac;
}
static int
__hmac_sha1_init(archive_hmac_sha1_ctx *ctx, const uint8_t *key, size_t key_len)
{
hmac_sha1_set_key(ctx, key_len, key);
return 0;
}
static int pbkdf2_check(
const struct berval *scheme,
const struct berval *passwd,
const struct berval *cred,
const char **text)
{
int rc;
int iteration;
/* salt_value require PBKDF2_SALT_SIZE + 1 in lutil_b64_pton. */
unsigned char salt_value[PBKDF2_SALT_SIZE + 1];
char salt_b64[LUTIL_BASE64_ENCODE_LEN(PBKDF2_SALT_SIZE) + 1];
/* dk_value require PBKDF2_MAX_DK_SIZE + 1 in lutil_b64_pton. */
unsigned char dk_value[PBKDF2_MAX_DK_SIZE + 1];
char dk_b64[LUTIL_BASE64_ENCODE_LEN(PBKDF2_MAX_DK_SIZE) + 1];
unsigned char input_dk_value[PBKDF2_MAX_DK_SIZE];
size_t dk_len;
#ifdef HAVE_OPENSSL
const EVP_MD *md;
#elif HAVE_GNUTLS
struct hmac_sha1_ctx sha1_ctx;
struct hmac_sha256_ctx sha256_ctx;
struct hmac_sha512_ctx sha512_ctx;
void * current_ctx = NULL;
pbkdf2_hmac_update current_hmac_update = NULL;
pbkdf2_hmac_digest current_hmac_digest = NULL;
#endif
#ifdef SLAPD_PBKDF2_DEBUG
printf("Checking for %s\n", scheme->bv_val);
printf(" Stored Value:\t%s\n", passwd->bv_val);
printf(" Input Cred:\t%s\n", cred->bv_val);
#endif
#ifdef HAVE_OPENSSL
if(!ber_bvcmp(scheme, &pbkdf2_scheme)){
dk_len = PBKDF2_SHA1_DK_SIZE;
md = EVP_sha1();
}else if(!ber_bvcmp(scheme, &pbkdf2_sha1_scheme)){
dk_len = PBKDF2_SHA1_DK_SIZE;
md = EVP_sha1();
}else if(!ber_bvcmp(scheme, &pbkdf2_sha256_scheme)){
dk_len = PBKDF2_SHA256_DK_SIZE;
md = EVP_sha256();
}else if(!ber_bvcmp(scheme, &pbkdf2_sha512_scheme)){
dk_len = PBKDF2_SHA512_DK_SIZE;
md = EVP_sha512();
}else{
return LUTIL_PASSWD_ERR;
}
#elif HAVE_GNUTLS
if(!ber_bvcmp(scheme, &pbkdf2_scheme)){
dk_len = PBKDF2_SHA1_DK_SIZE;
current_ctx = &sha1_ctx;
current_hmac_update = (pbkdf2_hmac_update) &hmac_sha1_update;
current_hmac_digest = (pbkdf2_hmac_digest) &hmac_sha1_digest;
hmac_sha1_set_key(current_ctx, cred->bv_len, (const uint8_t *) cred->bv_val);
}else if(!ber_bvcmp(scheme, &pbkdf2_sha1_scheme)){
dk_len = PBKDF2_SHA1_DK_SIZE;
current_ctx = &sha1_ctx;
current_hmac_update = (pbkdf2_hmac_update) &hmac_sha1_update;
current_hmac_digest = (pbkdf2_hmac_digest) &hmac_sha1_digest;
hmac_sha1_set_key(current_ctx, cred->bv_len, (const uint8_t *) cred->bv_val);
}else if(!ber_bvcmp(scheme, &pbkdf2_sha256_scheme)){
dk_len = PBKDF2_SHA256_DK_SIZE;
current_ctx = &sha256_ctx;
current_hmac_update = (pbkdf2_hmac_update) &hmac_sha256_update;
current_hmac_digest = (pbkdf2_hmac_digest) &hmac_sha256_digest;
hmac_sha256_set_key(current_ctx, cred->bv_len, (const uint8_t *) cred->bv_val);
}else if(!ber_bvcmp(scheme, &pbkdf2_sha512_scheme)){
dk_len = PBKDF2_SHA512_DK_SIZE;
current_ctx = &sha512_ctx;
current_hmac_update = (pbkdf2_hmac_update) &hmac_sha512_update;
current_hmac_digest = (pbkdf2_hmac_digest) &hmac_sha512_digest;
hmac_sha512_set_key(current_ctx, cred->bv_len, (const uint8_t *) cred->bv_val);
}else{
return LUTIL_PASSWD_ERR;
}
#endif
iteration = atoi(passwd->bv_val);
if(iteration < 1){
return LUTIL_PASSWD_ERR;
}
char *ptr;
ptr = strchr(passwd->bv_val, '$');
if(!ptr){
return LUTIL_PASSWD_ERR;
}
ptr++; /* skip '$' */
rc = ab64_to_b64(ptr, salt_b64, sizeof(salt_b64));
if(rc < 0){
return LUTIL_PASSWD_ERR;
}
ptr = strchr(ptr, '$');
if(!ptr){
return LUTIL_PASSWD_ERR;
}
ptr++; /* skip '$' */
rc = ab64_to_b64(ptr, dk_b64, sizeof(dk_b64));
if(rc < 0){
return LUTIL_PASSWD_ERR;
}
/* The targetsize require PBKDF2_SALT_SIZE + 1 in lutil_b64_pton. */
rc = lutil_b64_pton(salt_b64, salt_value, PBKDF2_SALT_SIZE + 1);
if(rc < 0){
return LUTIL_PASSWD_ERR;
}
/* consistency check */
if(rc != PBKDF2_SALT_SIZE){
return LUTIL_PASSWD_ERR;
}
/* The targetsize require PBKDF2_MAX_DK_SIZE + 1 in lutil_b64_pton. */
rc = lutil_b64_pton(dk_b64, dk_value, sizeof(dk_value));
if(rc < 0){
return LUTIL_PASSWD_ERR;
}
/* consistency check */
if(rc != dk_len){
return LUTIL_PASSWD_ERR;
}
#ifdef HAVE_OPENSSL
if(!PKCS5_PBKDF2_HMAC(cred->bv_val, cred->bv_len,
salt_value, PBKDF2_SALT_SIZE,
iteration, md, dk_len, input_dk_value)){
return LUTIL_PASSWD_ERR;
}
#elif HAVE_GNUTLS
PBKDF2(current_ctx, current_hmac_update, current_hmac_digest,
dk_len, iteration,
PBKDF2_SALT_SIZE, salt_value,
dk_len, input_dk_value);
#endif
rc = memcmp(dk_value, input_dk_value, dk_len);
#ifdef SLAPD_PBKDF2_DEBUG
printf(" Iteration:\t%d\n", iteration);
printf(" Base64 Salt:\t%s\n", salt_b64);
printf(" Base64 DK:\t%s\n", dk_b64);
int i;
printf(" Stored Salt:\t");
for(i=0; i<PBKDF2_SALT_SIZE; i++){
printf("%02x", salt_value[i]);
}
printf("\n");
printf(" Stored DK:\t");
for(i=0; i<dk_len; i++){
printf("%02x", dk_value[i]);
}
printf("\n");
printf(" Input DK:\t");
for(i=0; i<dk_len; i++){
printf("%02x", input_dk_value[i]);
}
printf("\n");
printf(" Result:\t%d\n", rc);
#endif
return rc?LUTIL_PASSWD_ERR:LUTIL_PASSWD_OK;
}
static int pbkdf2_encrypt(
const struct berval *scheme,
const struct berval *passwd,
struct berval *msg,
const char **text)
{
unsigned char salt_value[PBKDF2_SALT_SIZE];
struct berval salt;
unsigned char dk_value[PBKDF2_MAX_DK_SIZE];
struct berval dk;
int iteration = PBKDF2_ITERATION;
int rc;
#ifdef HAVE_OPENSSL
const EVP_MD *md;
#elif HAVE_GNUTLS
struct hmac_sha1_ctx sha1_ctx;
struct hmac_sha256_ctx sha256_ctx;
struct hmac_sha512_ctx sha512_ctx;
void * current_ctx = NULL;
pbkdf2_hmac_update current_hmac_update = NULL;
pbkdf2_hmac_digest current_hmac_digest = NULL;
#endif
salt.bv_val = (char *)salt_value;
salt.bv_len = sizeof(salt_value);
dk.bv_val = (char *)dk_value;
#ifdef HAVE_OPENSSL
if(!ber_bvcmp(scheme, &pbkdf2_scheme)){
dk.bv_len = PBKDF2_SHA1_DK_SIZE;
md = EVP_sha1();
}else if(!ber_bvcmp(scheme, &pbkdf2_sha1_scheme)){
dk.bv_len = PBKDF2_SHA1_DK_SIZE;
md = EVP_sha1();
}else if(!ber_bvcmp(scheme, &pbkdf2_sha256_scheme)){
dk.bv_len = PBKDF2_SHA256_DK_SIZE;
md = EVP_sha256();
}else if(!ber_bvcmp(scheme, &pbkdf2_sha512_scheme)){
dk.bv_len = PBKDF2_SHA512_DK_SIZE;
md = EVP_sha512();
}else{
return LUTIL_PASSWD_ERR;
}
#elif HAVE_GNUTLS
if(!ber_bvcmp(scheme, &pbkdf2_scheme)){
dk.bv_len = PBKDF2_SHA1_DK_SIZE;
current_ctx = &sha1_ctx;
current_hmac_update = (pbkdf2_hmac_update) &hmac_sha1_update;
current_hmac_digest = (pbkdf2_hmac_digest) &hmac_sha1_digest;
hmac_sha1_set_key(current_ctx, passwd->bv_len, (const uint8_t *) passwd->bv_val);
}else if(!ber_bvcmp(scheme, &pbkdf2_sha1_scheme)){
dk.bv_len = PBKDF2_SHA1_DK_SIZE;
current_ctx = &sha1_ctx;
current_hmac_update = (pbkdf2_hmac_update) &hmac_sha1_update;
current_hmac_digest = (pbkdf2_hmac_digest) &hmac_sha1_digest;
hmac_sha1_set_key(current_ctx, passwd->bv_len, (const uint8_t *) passwd->bv_val);
}else if(!ber_bvcmp(scheme, &pbkdf2_sha256_scheme)){
dk.bv_len = PBKDF2_SHA256_DK_SIZE;
current_ctx = &sha256_ctx;
current_hmac_update = (pbkdf2_hmac_update) &hmac_sha256_update;
current_hmac_digest = (pbkdf2_hmac_digest) &hmac_sha256_digest;
hmac_sha256_set_key(current_ctx, passwd->bv_len, (const uint8_t *) passwd->bv_val);
}else if(!ber_bvcmp(scheme, &pbkdf2_sha512_scheme)){
dk.bv_len = PBKDF2_SHA512_DK_SIZE;
current_ctx = &sha512_ctx;
current_hmac_update = (pbkdf2_hmac_update) &hmac_sha512_update;
current_hmac_digest = (pbkdf2_hmac_digest) &hmac_sha512_digest;
hmac_sha512_set_key(current_ctx, passwd->bv_len, (const uint8_t *) passwd->bv_val);
}else{
return LUTIL_PASSWD_ERR;
}
#endif
if(lutil_entropy((unsigned char *)salt.bv_val, salt.bv_len) < 0){
return LUTIL_PASSWD_ERR;
}
#ifdef HAVE_OPENSSL
if(!PKCS5_PBKDF2_HMAC(passwd->bv_val, passwd->bv_len,
(unsigned char *)salt.bv_val, salt.bv_len,
iteration, md, dk.bv_len, dk_value)){
return LUTIL_PASSWD_ERR;
}
#elif HAVE_GNUTLS
PBKDF2(current_ctx, current_hmac_update, current_hmac_digest,
dk.bv_len, iteration,
salt.bv_len, (const uint8_t *) salt.bv_val,
dk.bv_len, dk_value);
#endif
#ifdef SLAPD_PBKDF2_DEBUG
printf("Encrypt for %s\n", scheme->bv_val);
printf(" Password:\t%s\n", passwd->bv_val);
printf(" Salt:\t\t");
int i;
for(i=0; i<salt.bv_len; i++){
printf("%02x", salt_value[i]);
}
printf("\n");
printf(" Iteration:\t%d\n", iteration);
printf(" DK:\t\t");
for(i=0; i<dk.bv_len; i++){
printf("%02x", dk_value[i]);
}
printf("\n");
#endif
rc = pbkdf2_format(scheme, iteration, &salt, &dk, msg);
#ifdef SLAPD_PBKDF2_DEBUG
printf(" Output:\t%s\n", msg->bv_val);
#endif
return rc;
}
