bool agent_get_decryption_key(unsigned char key[KDF_HASH_LEN])
{
char *disable_str;
if (config_exists("plaintext_key")) {
_cleanup_free_ char *key_buffer = NULL;
if (config_read_buffer("plaintext_key", &key_buffer) == KDF_HASH_LEN) {
_cleanup_free_ char *verify = config_read_encrypted_string("verify", (unsigned char *)key_buffer);
if (!verify || strcmp(verify, AGENT_VERIFICATION_STRING))
goto badkey;
memcpy(key, key_buffer, KDF_HASH_LEN);
secure_clear(key_buffer, KDF_HASH_LEN);
mlock(key, KDF_HASH_LEN);
return true;
}
badkey: config_unlink("plaintext_key");
}
if (!agent_ask(key)) {
if (!agent_load_key(key))
return false;
disable_str = getenv("LPASS_AGENT_DISABLE");
if (!disable_str || strcmp(disable_str, "1")) {
agent_start(key);
}
}
mlock(key, KDF_HASH_LEN);
return true;
}
char *cipher_aes_decrypt(const char *ciphertext, size_t len, const unsigned char key[KDF_HASH_LEN])
{
EVP_CIPHER_CTX ctx;
char *plaintext;
int out_len;
if (!len)
return NULL;
EVP_CIPHER_CTX_init(&ctx);
plaintext = xcalloc(len + AES_BLOCK_SIZE + 1, 1);
if (len >= 33 && len % 16 == 1 && ciphertext[0] == '!') {
if (!EVP_DecryptInit_ex(&ctx, EVP_aes_256_cbc(), NULL, key, (unsigned char *)(ciphertext + 1)))
goto error;
ciphertext += 17;
len -= 17;
} else {
if (!EVP_DecryptInit_ex(&ctx, EVP_aes_256_ecb(), NULL, key, NULL))
goto error;
}
if (!EVP_DecryptUpdate(&ctx, (unsigned char *)plaintext, &out_len, (unsigned char *)ciphertext, len))
goto error;
len = out_len;
if (!EVP_DecryptFinal_ex(&ctx, (unsigned char *)(plaintext + out_len), &out_len))
goto error;
len += out_len;
plaintext[len] = '\0';
EVP_CIPHER_CTX_cleanup(&ctx);
return plaintext;
error:
EVP_CIPHER_CTX_cleanup(&ctx);
secure_clear(plaintext, len + AES_BLOCK_SIZE + 1);
free(plaintext);
return NULL;
}
