1 /*-
2 * Copyright (c) 2008 Isilon Inc http://www.isilon.com/
3 * Authors: Doug Rabson <dfr@rabson.org>
4 * Developed with Red Inc: Alfred Perlstein <alfred@freebsd.org>
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 */
27
28 #include <sys/cdefs.h>
29 __FBSDID("$FreeBSD$");
30
31 #include <sys/param.h>
32 #include <sys/lock.h>
33 #include <sys/malloc.h>
34 #include <sys/md5.h>
35 #include <sys/kobj.h>
36 #include <sys/mbuf.h>
37 #include <crypto/rc4/rc4.h>
38
39 #include <kgssapi/gssapi.h>
40 #include <kgssapi/gssapi_impl.h>
41
42 #include "kcrypto.h"
43
44 static void
arcfour_init(struct krb5_key_state * ks)45 arcfour_init(struct krb5_key_state *ks)
46 {
47 static struct timeval lastwarn;
48
49 ks->ks_priv = NULL;
50 if (ratecheck(&lastwarn, &krb5_warn_interval))
51 gone_in(13, "RC4 cipher for Kerberos GSS");
52 }
53
54 static void
arcfour_destroy(struct krb5_key_state * ks)55 arcfour_destroy(struct krb5_key_state *ks)
56 {
57
58 }
59
60 static void
arcfour_set_key(struct krb5_key_state * ks,const void * in)61 arcfour_set_key(struct krb5_key_state *ks, const void *in)
62 {
63 void *kp = ks->ks_key;
64
65 if (kp != in)
66 bcopy(in, kp, 16);
67 }
68
69 static void
arcfour_random_to_key(struct krb5_key_state * ks,const void * in)70 arcfour_random_to_key(struct krb5_key_state *ks, const void *in)
71 {
72
73 arcfour_set_key(ks, in);
74 }
75
76 static void
arcfour_hmac(uint8_t * key,uint8_t * data,size_t datalen,uint8_t * result)77 arcfour_hmac(uint8_t *key, uint8_t *data, size_t datalen,
78 uint8_t *result)
79 {
80 uint8_t buf[64];
81 MD5_CTX md5;
82 int i;
83
84 for (i = 0; i < 16; i++)
85 buf[i] = key[i] ^ 0x36;
86 for (; i < 64; i++)
87 buf[i] = 0x36;
88
89 MD5Init(&md5);
90 MD5Update(&md5, buf, 64);
91 MD5Update(&md5, data, datalen);
92 MD5Final(result, &md5);
93
94 for (i = 0; i < 16; i++)
95 buf[i] = key[i] ^ 0x5c;
96 for (; i < 64; i++)
97 buf[i] = 0x5c;
98
99 MD5Init(&md5);
100 MD5Update(&md5, buf, 64);
101 MD5Update(&md5, result, 16);
102 MD5Final(result, &md5);
103 }
104
105 static void
arcfour_derive_key(const struct krb5_key_state * ks,uint32_t usage,uint8_t * newkey)106 arcfour_derive_key(const struct krb5_key_state *ks, uint32_t usage,
107 uint8_t *newkey)
108 {
109 uint8_t t[4];
110
111 t[0] = (usage >> 24);
112 t[1] = (usage >> 16);
113 t[2] = (usage >> 8);
114 t[3] = (usage >> 0);
115 if (ks->ks_class->ec_type == ETYPE_ARCFOUR_HMAC_MD5_56) {
116 uint8_t L40[14] = "fortybits";
117 bcopy(t, L40 + 10, 4);
118 arcfour_hmac(ks->ks_key, L40, 14, newkey);
119 memset(newkey + 7, 0xab, 9);
120 } else {
121 arcfour_hmac(ks->ks_key, t, 4, newkey);
122 }
123 }
124
125 static int
rc4_crypt_int(void * rs,void * buf,u_int len)126 rc4_crypt_int(void *rs, void *buf, u_int len)
127 {
128
129 rc4_crypt(rs, buf, buf, len);
130 return (0);
131 }
132
133 static void
arcfour_encrypt(const struct krb5_key_state * ks,struct mbuf * inout,size_t skip,size_t len,void * ivec,size_t ivlen)134 arcfour_encrypt(const struct krb5_key_state *ks, struct mbuf *inout,
135 size_t skip, size_t len, void *ivec, size_t ivlen)
136 {
137 struct rc4_state rs;
138 uint8_t newkey[16];
139
140 arcfour_derive_key(ks, 0, newkey);
141
142 /*
143 * If we have an IV, then generate a new key from it using HMAC.
144 */
145 if (ivec) {
146 uint8_t kk[16];
147 arcfour_hmac(newkey, ivec, ivlen, kk);
148 rc4_init(&rs, kk, 16);
149 } else {
150 rc4_init(&rs, newkey, 16);
151 }
152
153 m_apply(inout, skip, len, rc4_crypt_int, &rs);
154 }
155
156 static int
MD5Update_int(void * ctx,void * buf,u_int len)157 MD5Update_int(void *ctx, void *buf, u_int len)
158 {
159
160 MD5Update(ctx, buf, len);
161 return (0);
162 }
163
164 static void
arcfour_checksum(const struct krb5_key_state * ks,int usage,struct mbuf * inout,size_t skip,size_t inlen,size_t outlen)165 arcfour_checksum(const struct krb5_key_state *ks, int usage,
166 struct mbuf *inout, size_t skip, size_t inlen, size_t outlen)
167 {
168 MD5_CTX md5;
169 uint8_t Ksign[16];
170 uint8_t t[4];
171 uint8_t sgn_cksum[16];
172
173 arcfour_hmac(ks->ks_key, "signaturekey", 13, Ksign);
174
175 t[0] = usage >> 0;
176 t[1] = usage >> 8;
177 t[2] = usage >> 16;
178 t[3] = usage >> 24;
179
180 MD5Init(&md5);
181 MD5Update(&md5, t, 4);
182 m_apply(inout, skip, inlen, MD5Update_int, &md5);
183 MD5Final(sgn_cksum, &md5);
184
185 arcfour_hmac(Ksign, sgn_cksum, 16, sgn_cksum);
186 m_copyback(inout, skip + inlen, outlen, sgn_cksum);
187 }
188
189 struct krb5_encryption_class krb5_arcfour_encryption_class = {
190 "arcfour-hmac-md5", /* name */
191 ETYPE_ARCFOUR_HMAC_MD5, /* etype */
192 0, /* flags */
193 1, /* blocklen */
194 1, /* msgblocklen */
195 8, /* checksumlen */
196 128, /* keybits */
197 16, /* keylen */
198 arcfour_init,
199 arcfour_destroy,
200 arcfour_set_key,
201 arcfour_random_to_key,
202 arcfour_encrypt,
203 arcfour_encrypt,
204 arcfour_checksum
205 };
206
207 struct krb5_encryption_class krb5_arcfour_56_encryption_class = {
208 "arcfour-hmac-md5-56", /* name */
209 ETYPE_ARCFOUR_HMAC_MD5_56, /* etype */
210 0, /* flags */
211 1, /* blocklen */
212 1, /* msgblocklen */
213 8, /* checksumlen */
214 128, /* keybits */
215 16, /* keylen */
216 arcfour_init,
217 arcfour_destroy,
218 arcfour_set_key,
219 arcfour_random_to_key,
220 arcfour_encrypt,
221 arcfour_encrypt,
222 arcfour_checksum
223 };
224