Permalink
Browse files

Respecify OpenSSL back-end internals in terms of krb5_key.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/enc-perf@22941 dc483132-0cff-0310-8789-dd5450dbe970
  • Loading branch information...
1 parent 5d48326 commit 39c48c2d187494df8b07cffcf8a6cc85c2f62e86 ghudson committed Oct 19, 2009
@@ -44,6 +44,7 @@ krb5int_aes_string_to_key(const struct krb5_enc_provider *enc,
unsigned long iter_count;
krb5_data out;
static const krb5_data usage = { KV5M_DATA, 8, "kerberos" };
+ krb5_key tempkey = NULL;
krb5_error_code err;
if (params) {
@@ -66,25 +67,25 @@ krb5int_aes_string_to_key(const struct krb5_enc_provider *enc,
if (iter_count >= MAX_ITERATION_COUNT)
return KRB5_ERR_BAD_S2K_PARAMS;
- /*
- * Dense key space, no parity bits or anything, so take a shortcut
- * and use the key contents buffer for the generated bytes.
- */
+ /* Use the output keyblock contents for temporary space. */
out.data = (char *) key->contents;
out.length = key->length;
if (out.length != 16 && out.length != 32)
return KRB5_CRYPTO_INTERNAL;
err = krb5int_pbkdf2_hmac_sha1 (&out, iter_count, string, salt);
- if (err) {
- memset(out.data, 0, out.length);
- return err;
- }
+ if (err)
+ goto cleanup;
- err = krb5_derive_key (enc, key, key, &usage);
- if (err) {
- memset(out.data, 0, out.length);
- return err;
- }
- return 0;
+ err = krb5_k_create_key (NULL, key, &tempkey);
+ if (err)
+ goto cleanup;
+
+ err = krb5_derive_keyblock (enc, tempkey, key, &usage);
+
+cleanup:
+ if (err)
+ memset (out.data, 0, out.length);
+ krb5_k_free_key (NULL, tempkey);
+ return err;
}
@@ -65,11 +65,12 @@ case 7: /* tgs-req authenticator */
krb5_error_code
krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
const struct krb5_hash_provider *hash,
- const krb5_keyblock *key, krb5_keyusage usage,
+ krb5_key key, krb5_keyusage usage,
const krb5_data *ivec, const krb5_data *input,
krb5_data *output)
{
krb5_keyblock k1, k2, k3;
+ krb5_key k3key = NULL;
krb5_data d1, d2, d3, salt, plaintext, checksum, ciphertext, confounder;
krb5_keyusage ms_usage;
size_t keylength, keybytes, blocksize, hashsize;
@@ -84,7 +85,7 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
d1.data=malloc(d1.length);
if (d1.data == NULL)
return (ENOMEM);
- k1 = *key;
+ k1 = key->keyblock;
k1.length=d1.length;
k1.contents= (void *) d1.data;
@@ -94,7 +95,7 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
free(d1.data);
return (ENOMEM);
}
- k2 = *key;
+ k2 = key->keyblock;
k2.length=d2.length;
k2.contents=(void *) d2.data;
@@ -105,7 +106,7 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
free(d2.data);
return (ENOMEM);
}
- k3 = *key;
+ k3 = key->keyblock;
k3.length=d3.length;
k3.contents= (void *) d3.data;
@@ -141,7 +142,7 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
/* begin the encryption, computer K1 */
ms_usage=krb5int_arcfour_translate_usage(usage);
- if (key->enctype == ENCTYPE_ARCFOUR_HMAC_EXP) {
+ if (key->keyblock.enctype == ENCTYPE_ARCFOUR_HMAC_EXP) {
strncpy(salt.data, krb5int_arcfour_l40, salt.length);
store_32_le(ms_usage, salt.data+10);
} else {
@@ -152,19 +153,27 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
memcpy(k2.contents, k1.contents, k2.length);
- if (key->enctype==ENCTYPE_ARCFOUR_HMAC_EXP)
+ if (key->keyblock.enctype==ENCTYPE_ARCFOUR_HMAC_EXP)
memset(k1.contents+7, 0xab, 9);
ret=krb5_c_random_make_octets(/* XXX */ 0, &confounder);
memcpy(plaintext.data+confounder.length, input->data, input->length);
if (ret)
goto cleanup;
- krb5_hmac(hash, &k2, 1, &plaintext, &checksum);
+ ret = krb5int_hmac_keyblock(hash, &k2, 1, &plaintext, &checksum);
+ if (ret)
+ goto cleanup;
+
+ ret = krb5int_hmac_keyblock(hash, &k1, 1, &checksum, &d3);
+ if (ret)
+ goto cleanup;
- krb5_hmac(hash, &k1, 1, &checksum, &d3);
+ ret = krb5_k_create_key(NULL, &k3, &k3key);
+ if (ret)
+ goto cleanup;
- ret=(*(enc->encrypt))(&k3, ivec, &plaintext, &ciphertext);
+ ret=(*(enc->encrypt))(k3key, ivec, &plaintext, &ciphertext);
cleanup:
memset(d1.data, 0, d1.length);
@@ -185,11 +194,12 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
krb5_error_code
krb5_arcfour_decrypt(const struct krb5_enc_provider *enc,
const struct krb5_hash_provider *hash,
- const krb5_keyblock *key, krb5_keyusage usage,
+ krb5_key key, krb5_keyusage usage,
const krb5_data *ivec, const krb5_data *input,
krb5_data *output)
{
krb5_keyblock k1,k2,k3;
+ krb5_key k3key;
krb5_data d1,d2,d3,salt,ciphertext,plaintext,checksum;
krb5_keyusage ms_usage;
size_t keybytes, keylength, hashsize, blocksize;
@@ -204,7 +214,7 @@ krb5_arcfour_decrypt(const struct krb5_enc_provider *enc,
d1.data=malloc(d1.length);
if (d1.data == NULL)
return (ENOMEM);
- k1 = *key;
+ k1 = key->keyblock;
k1.length=d1.length;
k1.contents= (void *) d1.data;
@@ -214,7 +224,7 @@ krb5_arcfour_decrypt(const struct krb5_enc_provider *enc,
free(d1.data);
return (ENOMEM);
}
- k2 = *key;
+ k2 = key->keyblock;
k2.length=d2.length;
k2.contents= (void *) d2.data;
@@ -225,7 +235,7 @@ krb5_arcfour_decrypt(const struct krb5_enc_provider *enc,
free(d2.data);
return (ENOMEM);
}
- k3 = *key;
+ k3 = key->keyblock;
k3.length=d3.length;
k3.contents= (void *) d3.data;
@@ -258,7 +268,7 @@ krb5_arcfour_decrypt(const struct krb5_enc_provider *enc,
/* We may have to try two ms_usage values; see below. */
do {
/* compute the salt */
- if (key->enctype == ENCTYPE_ARCFOUR_HMAC_EXP) {
+ if (key->keyblock.enctype == ENCTYPE_ARCFOUR_HMAC_EXP) {
strncpy(salt.data, krb5int_arcfour_l40, salt.length);
store_32_le(ms_usage, salt.data + 10);
} else {
@@ -271,18 +281,22 @@ krb5_arcfour_decrypt(const struct krb5_enc_provider *enc,
memcpy(k2.contents, k1.contents, k2.length);
- if (key->enctype == ENCTYPE_ARCFOUR_HMAC_EXP)
+ if (key->keyblock.enctype == ENCTYPE_ARCFOUR_HMAC_EXP)
memset(k1.contents + 7, 0xab, 9);
- ret = krb5_hmac(hash, &k1, 1, &checksum, &d3);
+ ret = krb5int_hmac_keyblock(hash, &k1, 1, &checksum, &d3);
if (ret)
goto cleanup;
- ret = (*(enc->decrypt))(&k3, ivec, &ciphertext, &plaintext);
+ ret = krb5_k_create_key(NULL, &k3, &k3key);
+ if (ret)
+ goto cleanup;
+ ret = (*(enc->decrypt))(k3key, ivec, &ciphertext, &plaintext);
+ krb5_k_free_key(NULL, k3key);
if (ret)
goto cleanup;
- ret = krb5_hmac(hash, &k2, 1, &plaintext, &d1);
+ ret = krb5int_hmac_keyblock(hash, &k2, 1, &plaintext, &d1);
if (ret)
goto cleanup;
@@ -10,7 +10,7 @@ krb5_arcfour_encrypt_length(const struct krb5_enc_provider *,
extern
krb5_error_code krb5_arcfour_encrypt(const struct krb5_enc_provider *,
const struct krb5_hash_provider *,
- const krb5_keyblock *,
+ krb5_key,
krb5_keyusage,
const krb5_data *,
const krb5_data *,
@@ -19,7 +19,7 @@ krb5_error_code krb5_arcfour_encrypt(const struct krb5_enc_provider *,
extern
krb5_error_code krb5_arcfour_decrypt(const struct krb5_enc_provider *,
const struct krb5_hash_provider *,
- const krb5_keyblock *,
+ krb5_key,
krb5_keyusage,
const krb5_data *,
const krb5_data *,
@@ -34,10 +34,5 @@ extern krb5_error_code krb5int_arcfour_string_to_key(
extern const struct krb5_enc_provider krb5int_enc_arcfour;
extern const struct krb5_aead_provider krb5int_aead_arcfour;
- krb5_error_code krb5int_arcfour_prf(
- const struct krb5_enc_provider *enc,
- const struct krb5_hash_provider *hash,
- const krb5_keyblock *key,
- const krb5_data *in, krb5_data *out);
#endif /* ARCFOUR_H */
Oops, something went wrong.

0 comments on commit 39c48c2

Please sign in to comment.