Skip to content

Commit

Permalink
Respecify OpenSSL back-end internals in terms of krb5_key.
Browse files Browse the repository at this point in the history 
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/enc-perf@22941 dc483132-0cff-0310-8789-dd5450dbe970
  • Loading branch information
ghudson committed Oct 19, 2009
1 parent 5d48326 commit 39c48c2
Show file tree
Hide file tree
Showing 9 changed files with 177 additions and 133 deletions.
29 changes: 15 additions & 14 deletions src/lib/crypto/openssl/aes/aes_s2k.c
View file
Expand Up @@ -44,6 +44,7 @@ krb5int_aes_string_to_key(const struct krb5_enc_provider *enc,
unsigned long iter_count;
krb5_data out;
static const krb5_data usage = { KV5M_DATA, 8, "kerberos" };
krb5_key tempkey = NULL;
krb5_error_code err;

if (params) {
Expand All @@ -66,25 +67,25 @@ krb5int_aes_string_to_key(const struct krb5_enc_provider *enc,
if (iter_count >= MAX_ITERATION_COUNT)
return KRB5_ERR_BAD_S2K_PARAMS;

/*
* Dense key space, no parity bits or anything, so take a shortcut
* and use the key contents buffer for the generated bytes.
*/
/* Use the output keyblock contents for temporary space. */
out.data = (char *) key->contents;
out.length = key->length;
if (out.length != 16 && out.length != 32)
return KRB5_CRYPTO_INTERNAL;

err = krb5int_pbkdf2_hmac_sha1 (&out, iter_count, string, salt);
if (err) {
memset(out.data, 0, out.length);
return err;
}
if (err)
goto cleanup;

err = krb5_derive_key (enc, key, key, &usage);
if (err) {
memset(out.data, 0, out.length);
return err;
}
return 0;
err = krb5_k_create_key (NULL, key, &tempkey);
if (err)
goto cleanup;

err = krb5_derive_keyblock (enc, tempkey, key, &usage);

cleanup:
if (err)
memset (out.data, 0, out.length);
krb5_k_free_key (NULL, tempkey);
return err;
}
50 changes: 32 additions & 18 deletions src/lib/crypto/openssl/arcfour/arcfour.c
View file
Expand Up @@ -65,11 +65,12 @@ case 7: /* tgs-req authenticator */
krb5_error_code
krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
const struct krb5_hash_provider *hash,
const krb5_keyblock *key, krb5_keyusage usage,
krb5_key key, krb5_keyusage usage,
const krb5_data *ivec, const krb5_data *input,
krb5_data *output)
{
krb5_keyblock k1, k2, k3;
krb5_key k3key = NULL;
krb5_data d1, d2, d3, salt, plaintext, checksum, ciphertext, confounder;
krb5_keyusage ms_usage;
size_t keylength, keybytes, blocksize, hashsize;
Expand All @@ -84,7 +85,7 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
d1.data=malloc(d1.length);
if (d1.data == NULL)
return (ENOMEM);
k1 = *key;
k1 = key->keyblock;
k1.length=d1.length;
k1.contents= (void *) d1.data;

Expand All @@ -94,7 +95,7 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
free(d1.data);
return (ENOMEM);
}
k2 = *key;
k2 = key->keyblock;
k2.length=d2.length;
k2.contents=(void *) d2.data;

Expand All @@ -105,7 +106,7 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
free(d2.data);
return (ENOMEM);
}
k3 = *key;
k3 = key->keyblock;
k3.length=d3.length;
k3.contents= (void *) d3.data;

Expand Down Expand Up @@ -141,7 +142,7 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,

/* begin the encryption, computer K1 */
ms_usage=krb5int_arcfour_translate_usage(usage);
if (key->enctype == ENCTYPE_ARCFOUR_HMAC_EXP) {
if (key->keyblock.enctype == ENCTYPE_ARCFOUR_HMAC_EXP) {
strncpy(salt.data, krb5int_arcfour_l40, salt.length);
store_32_le(ms_usage, salt.data+10);
} else {
Expand All @@ -152,19 +153,27 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,

memcpy(k2.contents, k1.contents, k2.length);

if (key->enctype==ENCTYPE_ARCFOUR_HMAC_EXP)
if (key->keyblock.enctype==ENCTYPE_ARCFOUR_HMAC_EXP)
memset(k1.contents+7, 0xab, 9);

ret=krb5_c_random_make_octets(/* XXX */ 0, &confounder);
memcpy(plaintext.data+confounder.length, input->data, input->length);
if (ret)
goto cleanup;

krb5_hmac(hash, &k2, 1, &plaintext, &checksum);
ret = krb5int_hmac_keyblock(hash, &k2, 1, &plaintext, &checksum);
if (ret)
goto cleanup;

ret = krb5int_hmac_keyblock(hash, &k1, 1, &checksum, &d3);
if (ret)
goto cleanup;

krb5_hmac(hash, &k1, 1, &checksum, &d3);
ret = krb5_k_create_key(NULL, &k3, &k3key);
if (ret)
goto cleanup;

ret=(*(enc->encrypt))(&k3, ivec, &plaintext, &ciphertext);
ret=(*(enc->encrypt))(k3key, ivec, &plaintext, &ciphertext);

cleanup:
memset(d1.data, 0, d1.length);
Expand All @@ -185,11 +194,12 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
krb5_error_code
krb5_arcfour_decrypt(const struct krb5_enc_provider *enc,
const struct krb5_hash_provider *hash,
const krb5_keyblock *key, krb5_keyusage usage,
krb5_key key, krb5_keyusage usage,
const krb5_data *ivec, const krb5_data *input,
krb5_data *output)
{
krb5_keyblock k1,k2,k3;
krb5_key k3key;
krb5_data d1,d2,d3,salt,ciphertext,plaintext,checksum;
krb5_keyusage ms_usage;
size_t keybytes, keylength, hashsize, blocksize;
Expand All @@ -204,7 +214,7 @@ krb5_arcfour_decrypt(const struct krb5_enc_provider *enc,
d1.data=malloc(d1.length);
if (d1.data == NULL)
return (ENOMEM);
k1 = *key;
k1 = key->keyblock;
k1.length=d1.length;
k1.contents= (void *) d1.data;

Expand All @@ -214,7 +224,7 @@ krb5_arcfour_decrypt(const struct krb5_enc_provider *enc,
free(d1.data);
return (ENOMEM);
}
k2 = *key;
k2 = key->keyblock;
k2.length=d2.length;
k2.contents= (void *) d2.data;

Expand All @@ -225,7 +235,7 @@ krb5_arcfour_decrypt(const struct krb5_enc_provider *enc,
free(d2.data);
return (ENOMEM);
}
k3 = *key;
k3 = key->keyblock;
k3.length=d3.length;
k3.contents= (void *) d3.data;

Expand Down Expand Up @@ -258,7 +268,7 @@ krb5_arcfour_decrypt(const struct krb5_enc_provider *enc,
/* We may have to try two ms_usage values; see below. */
do {
/* compute the salt */
if (key->enctype == ENCTYPE_ARCFOUR_HMAC_EXP) {
if (key->keyblock.enctype == ENCTYPE_ARCFOUR_HMAC_EXP) {
strncpy(salt.data, krb5int_arcfour_l40, salt.length);
store_32_le(ms_usage, salt.data + 10);
} else {
Expand All @@ -271,18 +281,22 @@ krb5_arcfour_decrypt(const struct krb5_enc_provider *enc,

memcpy(k2.contents, k1.contents, k2.length);

if (key->enctype == ENCTYPE_ARCFOUR_HMAC_EXP)
if (key->keyblock.enctype == ENCTYPE_ARCFOUR_HMAC_EXP)
memset(k1.contents + 7, 0xab, 9);

ret = krb5_hmac(hash, &k1, 1, &checksum, &d3);
ret = krb5int_hmac_keyblock(hash, &k1, 1, &checksum, &d3);
if (ret)
goto cleanup;

ret = (*(enc->decrypt))(&k3, ivec, &ciphertext, &plaintext);
ret = krb5_k_create_key(NULL, &k3, &k3key);
if (ret)
goto cleanup;
ret = (*(enc->decrypt))(k3key, ivec, &ciphertext, &plaintext);
krb5_k_free_key(NULL, k3key);
if (ret)
goto cleanup;

ret = krb5_hmac(hash, &k2, 1, &plaintext, &d1);
ret = krb5int_hmac_keyblock(hash, &k2, 1, &plaintext, &d1);
if (ret)
goto cleanup;

Expand Down
9 changes: 2 additions & 7 deletions src/lib/crypto/openssl/arcfour/arcfour.h
View file
Expand Up @@ -10,7 +10,7 @@ krb5_arcfour_encrypt_length(const struct krb5_enc_provider *,
extern
krb5_error_code krb5_arcfour_encrypt(const struct krb5_enc_provider *,
const struct krb5_hash_provider *,
const krb5_keyblock *,
krb5_key,
krb5_keyusage,
const krb5_data *,
const krb5_data *,
Expand All @@ -19,7 +19,7 @@ krb5_error_code krb5_arcfour_encrypt(const struct krb5_enc_provider *,
extern
krb5_error_code krb5_arcfour_decrypt(const struct krb5_enc_provider *,
const struct krb5_hash_provider *,
const krb5_keyblock *,
krb5_key,
krb5_keyusage,
const krb5_data *,
const krb5_data *,
Expand All @@ -34,10 +34,5 @@ extern krb5_error_code krb5int_arcfour_string_to_key(

extern const struct krb5_enc_provider krb5int_enc_arcfour;
extern const struct krb5_aead_provider krb5int_aead_arcfour;
krb5_error_code krb5int_arcfour_prf(
const struct krb5_enc_provider *enc,
const struct krb5_hash_provider *hash,
const krb5_keyblock *key,
const krb5_data *in, krb5_data *out);

#endif /* ARCFOUR_H */

0 comments on commit 39c48c2

Please sign in to comment.