2
0

p5_crpt2.c 9.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322
  1. /* p5_crpt2.c */
  2. /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  3. * project 1999.
  4. */
  5. /* ====================================================================
  6. * Copyright (c) 1999-2006 The OpenSSL Project. All rights reserved.
  7. *
  8. * Redistribution and use in source and binary forms, with or without
  9. * modification, are permitted provided that the following conditions
  10. * are met:
  11. *
  12. * 1. Redistributions of source code must retain the above copyright
  13. * notice, this list of conditions and the following disclaimer.
  14. *
  15. * 2. Redistributions in binary form must reproduce the above copyright
  16. * notice, this list of conditions and the following disclaimer in
  17. * the documentation and/or other materials provided with the
  18. * distribution.
  19. *
  20. * 3. All advertising materials mentioning features or use of this
  21. * software must display the following acknowledgment:
  22. * "This product includes software developed by the OpenSSL Project
  23. * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24. *
  25. * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26. * endorse or promote products derived from this software without
  27. * prior written permission. For written permission, please contact
  28. * licensing@OpenSSL.org.
  29. *
  30. * 5. Products derived from this software may not be called "OpenSSL"
  31. * nor may "OpenSSL" appear in their names without prior written
  32. * permission of the OpenSSL Project.
  33. *
  34. * 6. Redistributions of any form whatsoever must retain the following
  35. * acknowledgment:
  36. * "This product includes software developed by the OpenSSL Project
  37. * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38. *
  39. * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40. * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42. * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43. * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46. * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48. * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49. * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50. * OF THE POSSIBILITY OF SUCH DAMAGE.
  51. * ====================================================================
  52. *
  53. * This product includes cryptographic software written by Eric Young
  54. * (eay@cryptsoft.com). This product includes software written by Tim
  55. * Hudson (tjh@cryptsoft.com).
  56. *
  57. */
  58. #include <stdio.h>
  59. #include <stdlib.h>
  60. #include "cryptlib.h"
  61. #if !defined(OPENSSL_NO_HMAC) && !defined(OPENSSL_NO_SHA)
  62. #include <openssl/x509.h>
  63. #include <openssl/evp.h>
  64. #include <openssl/hmac.h>
  65. #include "evp_locl.h"
  66. /* set this to print out info about the keygen algorithm */
  67. /* #define DEBUG_PKCS5V2 */
  68. #ifdef DEBUG_PKCS5V2
  69. static void h__dump (const unsigned char *p, int len);
  70. #endif
  71. /* This is an implementation of PKCS#5 v2.0 password based encryption key
  72. * derivation function PBKDF2.
  73. * SHA1 version verified against test vectors posted by Peter Gutmann
  74. * <pgut001@cs.auckland.ac.nz> to the PKCS-TNG <pkcs-tng@rsa.com> mailing list.
  75. */
  76. int PKCS5_PBKDF2_HMAC(const char *pass, int passlen,
  77. const unsigned char *salt, int saltlen, int iter,
  78. const EVP_MD *digest,
  79. int keylen, unsigned char *out)
  80. {
  81. unsigned char digtmp[EVP_MAX_MD_SIZE], *p, itmp[4];
  82. int cplen, j, k, tkeylen, mdlen;
  83. unsigned long i = 1;
  84. HMAC_CTX hctx;
  85. mdlen = EVP_MD_size(digest);
  86. if (mdlen < 0)
  87. return 0;
  88. HMAC_CTX_init(&hctx);
  89. p = out;
  90. tkeylen = keylen;
  91. if(!pass)
  92. passlen = 0;
  93. else if(passlen == -1)
  94. passlen = strlen(pass);
  95. while(tkeylen)
  96. {
  97. if(tkeylen > mdlen)
  98. cplen = mdlen;
  99. else
  100. cplen = tkeylen;
  101. /* We are unlikely to ever use more than 256 blocks (5120 bits!)
  102. * but just in case...
  103. */
  104. itmp[0] = (unsigned char)((i >> 24) & 0xff);
  105. itmp[1] = (unsigned char)((i >> 16) & 0xff);
  106. itmp[2] = (unsigned char)((i >> 8) & 0xff);
  107. itmp[3] = (unsigned char)(i & 0xff);
  108. if (!HMAC_Init_ex(&hctx, pass, passlen, digest, NULL)
  109. || !HMAC_Update(&hctx, salt, saltlen)
  110. || !HMAC_Update(&hctx, itmp, 4)
  111. || !HMAC_Final(&hctx, digtmp, NULL))
  112. {
  113. HMAC_CTX_cleanup(&hctx);
  114. return 0;
  115. }
  116. memcpy(p, digtmp, cplen);
  117. for(j = 1; j < iter; j++)
  118. {
  119. HMAC(digest, pass, passlen,
  120. digtmp, mdlen, digtmp, NULL);
  121. for(k = 0; k < cplen; k++)
  122. p[k] ^= digtmp[k];
  123. }
  124. tkeylen-= cplen;
  125. i++;
  126. p+= cplen;
  127. }
  128. HMAC_CTX_cleanup(&hctx);
  129. #ifdef DEBUG_PKCS5V2
  130. fprintf(stderr, "Password:\n");
  131. h__dump (pass, passlen);
  132. fprintf(stderr, "Salt:\n");
  133. h__dump (salt, saltlen);
  134. fprintf(stderr, "Iteration count %d\n", iter);
  135. fprintf(stderr, "Key:\n");
  136. h__dump (out, keylen);
  137. #endif
  138. return 1;
  139. }
  140. int PKCS5_PBKDF2_HMAC_SHA1(const char *pass, int passlen,
  141. const unsigned char *salt, int saltlen, int iter,
  142. int keylen, unsigned char *out)
  143. {
  144. return PKCS5_PBKDF2_HMAC(pass, passlen, salt, saltlen, iter, EVP_sha1(),
  145. keylen, out);
  146. }
  147. #ifdef DO_TEST
  148. main()
  149. {
  150. unsigned char out[4];
  151. unsigned char salt[] = {0x12, 0x34, 0x56, 0x78};
  152. PKCS5_PBKDF2_HMAC_SHA1("password", -1, salt, 4, 5, 4, out);
  153. fprintf(stderr, "Out %02X %02X %02X %02X\n",
  154. out[0], out[1], out[2], out[3]);
  155. }
  156. #endif
  157. /* Now the key derivation function itself. This is a bit evil because
  158. * it has to check the ASN1 parameters are valid: and there are quite a
  159. * few of them...
  160. */
  161. int PKCS5_v2_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
  162. ASN1_TYPE *param, const EVP_CIPHER *c, const EVP_MD *md,
  163. int en_de)
  164. {
  165. const unsigned char *pbuf;
  166. int plen;
  167. PBE2PARAM *pbe2 = NULL;
  168. const EVP_CIPHER *cipher;
  169. int rv = 0;
  170. if (param == NULL || param->type != V_ASN1_SEQUENCE ||
  171. param->value.sequence == NULL) {
  172. EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN,EVP_R_DECODE_ERROR);
  173. goto err;
  174. }
  175. pbuf = param->value.sequence->data;
  176. plen = param->value.sequence->length;
  177. if(!(pbe2 = d2i_PBE2PARAM(NULL, &pbuf, plen))) {
  178. EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN,EVP_R_DECODE_ERROR);
  179. goto err;
  180. }
  181. /* See if we recognise the key derivation function */
  182. if(OBJ_obj2nid(pbe2->keyfunc->algorithm) != NID_id_pbkdf2) {
  183. EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN,
  184. EVP_R_UNSUPPORTED_KEY_DERIVATION_FUNCTION);
  185. goto err;
  186. }
  187. /* lets see if we recognise the encryption algorithm.
  188. */
  189. cipher = EVP_get_cipherbyobj(pbe2->encryption->algorithm);
  190. if(!cipher) {
  191. EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN,
  192. EVP_R_UNSUPPORTED_CIPHER);
  193. goto err;
  194. }
  195. /* Fixup cipher based on AlgorithmIdentifier */
  196. if (!EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, en_de))
  197. goto err;
  198. if(EVP_CIPHER_asn1_to_param(ctx, pbe2->encryption->parameter) < 0) {
  199. EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN,
  200. EVP_R_CIPHER_PARAMETER_ERROR);
  201. goto err;
  202. }
  203. rv = PKCS5_v2_PBKDF2_keyivgen(ctx, pass, passlen,
  204. pbe2->keyfunc->parameter, c, md, en_de);
  205. err:
  206. PBE2PARAM_free(pbe2);
  207. return rv;
  208. }
  209. int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
  210. ASN1_TYPE *param,
  211. const EVP_CIPHER *c, const EVP_MD *md, int en_de)
  212. {
  213. unsigned char *salt, key[EVP_MAX_KEY_LENGTH];
  214. const unsigned char *pbuf;
  215. int saltlen, iter, plen;
  216. int rv = 0;
  217. unsigned int keylen = 0;
  218. int prf_nid, hmac_md_nid;
  219. PBKDF2PARAM *kdf = NULL;
  220. const EVP_MD *prfmd;
  221. if (EVP_CIPHER_CTX_cipher(ctx) == NULL)
  222. {
  223. EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN,EVP_R_NO_CIPHER_SET);
  224. goto err;
  225. }
  226. keylen = EVP_CIPHER_CTX_key_length(ctx);
  227. OPENSSL_assert(keylen <= sizeof key);
  228. /* Decode parameter */
  229. if(!param || (param->type != V_ASN1_SEQUENCE))
  230. {
  231. EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN,EVP_R_DECODE_ERROR);
  232. goto err;
  233. }
  234. pbuf = param->value.sequence->data;
  235. plen = param->value.sequence->length;
  236. if(!(kdf = d2i_PBKDF2PARAM(NULL, &pbuf, plen)) ) {
  237. EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN,EVP_R_DECODE_ERROR);
  238. goto err;
  239. }
  240. keylen = EVP_CIPHER_CTX_key_length(ctx);
  241. /* Now check the parameters of the kdf */
  242. if(kdf->keylength && (ASN1_INTEGER_get(kdf->keylength) != (int)keylen)){
  243. EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN,
  244. EVP_R_UNSUPPORTED_KEYLENGTH);
  245. goto err;
  246. }
  247. if (kdf->prf)
  248. prf_nid = OBJ_obj2nid(kdf->prf->algorithm);
  249. else
  250. prf_nid = NID_hmacWithSHA1;
  251. if (!EVP_PBE_find(EVP_PBE_TYPE_PRF, prf_nid, NULL, &hmac_md_nid, 0))
  252. {
  253. EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN, EVP_R_UNSUPPORTED_PRF);
  254. goto err;
  255. }
  256. prfmd = EVP_get_digestbynid(hmac_md_nid);
  257. if (prfmd == NULL)
  258. {
  259. EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN, EVP_R_UNSUPPORTED_PRF);
  260. goto err;
  261. }
  262. if(kdf->salt->type != V_ASN1_OCTET_STRING) {
  263. EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN,
  264. EVP_R_UNSUPPORTED_SALT_TYPE);
  265. goto err;
  266. }
  267. /* it seems that its all OK */
  268. salt = kdf->salt->value.octet_string->data;
  269. saltlen = kdf->salt->value.octet_string->length;
  270. iter = ASN1_INTEGER_get(kdf->iter);
  271. if(!PKCS5_PBKDF2_HMAC(pass, passlen, salt, saltlen, iter, prfmd,
  272. keylen, key))
  273. goto err;
  274. rv = EVP_CipherInit_ex(ctx, NULL, NULL, key, NULL, en_de);
  275. err:
  276. OPENSSL_cleanse(key, keylen);
  277. PBKDF2PARAM_free(kdf);
  278. return rv;
  279. }
  280. #ifdef DEBUG_PKCS5V2
  281. static void h__dump (const unsigned char *p, int len)
  282. {
  283. for (; len --; p++) fprintf(stderr, "%02X ", *p);
  284. fprintf(stderr, "\n");
  285. }
  286. #endif
  287. #endif