1 /* $OpenBSD: cipher.c,v 1.123 2024/08/23 04:51:00 deraadt Exp $ */
2 /*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * All rights reserved
6 *
7 * As far as I am concerned, the code I have written for this software
8 * can be used freely for any purpose. Any derived versions of this
9 * software must be clearly marked as such, and if the derived work is
10 * incompatible with the protocol description in the RFC file, it must be
11 * called by a name other than "ssh" or "Secure Shell".
12 *
13 *
14 * Copyright (c) 1999 Niels Provos. All rights reserved.
15 * Copyright (c) 1999, 2000 Markus Friedl. All rights reserved.
16 *
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions
19 * are met:
20 * 1. Redistributions of source code must retain the above copyright
21 * notice, this list of conditions and the following disclaimer.
22 * 2. Redistributions in binary form must reproduce the above copyright
23 * notice, this list of conditions and the following disclaimer in the
24 * documentation and/or other materials provided with the distribution.
25 *
26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36 */
37
38 #include <sys/types.h>
39
40 #include <string.h>
41 #include <stdarg.h>
42 #include <stdio.h>
43
44 #include "cipher.h"
45 #include "misc.h"
46 #include "sshbuf.h"
47 #include "ssherr.h"
48 #include "digest.h"
49
50 #ifndef WITH_OPENSSL
51 #define EVP_CIPHER_CTX void
52 #endif
53
54 struct sshcipher_ctx {
55 int plaintext;
56 int encrypt;
57 EVP_CIPHER_CTX *evp;
58 struct chachapoly_ctx *cp_ctx;
59 struct aesctr_ctx ac_ctx; /* XXX union with evp? */
60 const struct sshcipher *cipher;
61 };
62
63 struct sshcipher {
64 char *name;
65 u_int block_size;
66 u_int key_len;
67 u_int iv_len; /* defaults to block_size */
68 u_int auth_len;
69 u_int flags;
70 #define CFLAG_CBC (1<<0)
71 #define CFLAG_CHACHAPOLY (1<<1)
72 #define CFLAG_AESCTR (1<<2)
73 #define CFLAG_NONE (1<<3)
74 #define CFLAG_INTERNAL CFLAG_NONE /* Don't use "none" for packets */
75 #ifdef WITH_OPENSSL
76 const EVP_CIPHER *(*evptype)(void);
77 #else
78 void *ignored;
79 #endif
80 };
81
82 static const struct sshcipher ciphers[] = {
83 #ifdef WITH_OPENSSL
84 { "3des-cbc", 8, 24, 0, 0, CFLAG_CBC, EVP_des_ede3_cbc },
85 { "aes128-cbc", 16, 16, 0, 0, CFLAG_CBC, EVP_aes_128_cbc },
86 { "aes192-cbc", 16, 24, 0, 0, CFLAG_CBC, EVP_aes_192_cbc },
87 { "aes256-cbc", 16, 32, 0, 0, CFLAG_CBC, EVP_aes_256_cbc },
88 { "aes128-ctr", 16, 16, 0, 0, 0, EVP_aes_128_ctr },
89 { "aes192-ctr", 16, 24, 0, 0, 0, EVP_aes_192_ctr },
90 { "aes256-ctr", 16, 32, 0, 0, 0, EVP_aes_256_ctr },
91 { "aes128-gcm@openssh.com",
92 16, 16, 12, 16, 0, EVP_aes_128_gcm },
93 { "aes256-gcm@openssh.com",
94 16, 32, 12, 16, 0, EVP_aes_256_gcm },
95 #else
96 { "aes128-ctr", 16, 16, 0, 0, CFLAG_AESCTR, NULL },
97 { "aes192-ctr", 16, 24, 0, 0, CFLAG_AESCTR, NULL },
98 { "aes256-ctr", 16, 32, 0, 0, CFLAG_AESCTR, NULL },
99 #endif
100 { "chacha20-poly1305@openssh.com",
101 8, 64, 0, 16, CFLAG_CHACHAPOLY, NULL },
102 { "none", 8, 0, 0, 0, CFLAG_NONE, NULL },
103
104 { NULL, 0, 0, 0, 0, 0, NULL }
105 };
106
107 /*--*/
108
109 /* Returns a comma-separated list of supported ciphers. */
110 char *
cipher_alg_list(char sep,int auth_only)111 cipher_alg_list(char sep, int auth_only)
112 {
113 char *tmp, *ret = NULL;
114 size_t nlen, rlen = 0;
115 const struct sshcipher *c;
116
117 for (c = ciphers; c->name != NULL; c++) {
118 if ((c->flags & CFLAG_INTERNAL) != 0)
119 continue;
120 if (auth_only && c->auth_len == 0)
121 continue;
122 if (ret != NULL)
123 ret[rlen++] = sep;
124 nlen = strlen(c->name);
125 if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL) {
126 free(ret);
127 return NULL;
128 }
129 ret = tmp;
130 memcpy(ret + rlen, c->name, nlen + 1);
131 rlen += nlen;
132 }
133 return ret;
134 }
135
136 const char *
compression_alg_list(int compression)137 compression_alg_list(int compression)
138 {
139 #ifdef WITH_ZLIB
140 return compression ? "zlib@openssh.com,none" :
141 "none,zlib@openssh.com";
142 #else
143 return "none";
144 #endif
145 }
146
147 u_int
cipher_blocksize(const struct sshcipher * c)148 cipher_blocksize(const struct sshcipher *c)
149 {
150 return (c->block_size);
151 }
152
153 u_int
cipher_keylen(const struct sshcipher * c)154 cipher_keylen(const struct sshcipher *c)
155 {
156 return (c->key_len);
157 }
158
159 u_int
cipher_seclen(const struct sshcipher * c)160 cipher_seclen(const struct sshcipher *c)
161 {
162 if (strcmp("3des-cbc", c->name) == 0)
163 return 14;
164 return cipher_keylen(c);
165 }
166
167 u_int
cipher_authlen(const struct sshcipher * c)168 cipher_authlen(const struct sshcipher *c)
169 {
170 return (c->auth_len);
171 }
172
173 u_int
cipher_ivlen(const struct sshcipher * c)174 cipher_ivlen(const struct sshcipher *c)
175 {
176 /*
177 * Default is cipher block size, except for chacha20+poly1305 that
178 * needs no IV. XXX make iv_len == -1 default?
179 */
180 return (c->iv_len != 0 || (c->flags & CFLAG_CHACHAPOLY) != 0) ?
181 c->iv_len : c->block_size;
182 }
183
184 u_int
cipher_is_cbc(const struct sshcipher * c)185 cipher_is_cbc(const struct sshcipher *c)
186 {
187 return (c->flags & CFLAG_CBC) != 0;
188 }
189
190 u_int
cipher_ctx_is_plaintext(struct sshcipher_ctx * cc)191 cipher_ctx_is_plaintext(struct sshcipher_ctx *cc)
192 {
193 return cc->plaintext;
194 }
195
196 const struct sshcipher *
cipher_by_name(const char * name)197 cipher_by_name(const char *name)
198 {
199 const struct sshcipher *c;
200 for (c = ciphers; c->name != NULL; c++)
201 if (strcmp(c->name, name) == 0)
202 return c;
203 return NULL;
204 }
205
206 #define CIPHER_SEP ","
207 int
ciphers_valid(const char * names)208 ciphers_valid(const char *names)
209 {
210 const struct sshcipher *c;
211 char *cipher_list, *cp;
212 char *p;
213
214 if (names == NULL || strcmp(names, "") == 0)
215 return 0;
216 if ((cipher_list = cp = strdup(names)) == NULL)
217 return 0;
218 for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0';
219 (p = strsep(&cp, CIPHER_SEP))) {
220 c = cipher_by_name(p);
221 if (c == NULL || (c->flags & CFLAG_INTERNAL) != 0) {
222 free(cipher_list);
223 return 0;
224 }
225 }
226 free(cipher_list);
227 return 1;
228 }
229
230 const char *
cipher_warning_message(const struct sshcipher_ctx * cc)231 cipher_warning_message(const struct sshcipher_ctx *cc)
232 {
233 if (cc == NULL || cc->cipher == NULL)
234 return NULL;
235 /* XXX repurpose for CBC warning */
236 return NULL;
237 }
238
239 int
cipher_init(struct sshcipher_ctx ** ccp,const struct sshcipher * cipher,const u_char * key,u_int keylen,const u_char * iv,u_int ivlen,int do_encrypt)240 cipher_init(struct sshcipher_ctx **ccp, const struct sshcipher *cipher,
241 const u_char *key, u_int keylen, const u_char *iv, u_int ivlen,
242 int do_encrypt)
243 {
244 struct sshcipher_ctx *cc = NULL;
245 int ret = SSH_ERR_INTERNAL_ERROR;
246 #ifdef WITH_OPENSSL
247 const EVP_CIPHER *type;
248 int klen;
249 #endif
250
251 *ccp = NULL;
252 if ((cc = calloc(1, sizeof(*cc))) == NULL)
253 return SSH_ERR_ALLOC_FAIL;
254
255 cc->plaintext = (cipher->flags & CFLAG_NONE) != 0;
256 cc->encrypt = do_encrypt;
257
258 if (keylen < cipher->key_len ||
259 (iv != NULL && ivlen < cipher_ivlen(cipher))) {
260 ret = SSH_ERR_INVALID_ARGUMENT;
261 goto out;
262 }
263
264 cc->cipher = cipher;
265 if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) {
266 cc->cp_ctx = chachapoly_new(key, keylen);
267 ret = cc->cp_ctx != NULL ? 0 : SSH_ERR_INVALID_ARGUMENT;
268 goto out;
269 }
270 if ((cc->cipher->flags & CFLAG_NONE) != 0) {
271 ret = 0;
272 goto out;
273 }
274 #ifndef WITH_OPENSSL
275 if ((cc->cipher->flags & CFLAG_AESCTR) != 0) {
276 aesctr_keysetup(&cc->ac_ctx, key, 8 * keylen, 8 * ivlen);
277 aesctr_ivsetup(&cc->ac_ctx, iv);
278 ret = 0;
279 goto out;
280 }
281 ret = SSH_ERR_INVALID_ARGUMENT;
282 goto out;
283 #else /* WITH_OPENSSL */
284 type = (*cipher->evptype)();
285 if ((cc->evp = EVP_CIPHER_CTX_new()) == NULL) {
286 ret = SSH_ERR_ALLOC_FAIL;
287 goto out;
288 }
289 if (EVP_CipherInit(cc->evp, type, NULL, (u_char *)iv,
290 (do_encrypt == CIPHER_ENCRYPT)) == 0) {
291 ret = SSH_ERR_LIBCRYPTO_ERROR;
292 goto out;
293 }
294 if (cipher_authlen(cipher) &&
295 !EVP_CIPHER_CTX_ctrl(cc->evp, EVP_CTRL_GCM_SET_IV_FIXED,
296 -1, (u_char *)iv)) {
297 ret = SSH_ERR_LIBCRYPTO_ERROR;
298 goto out;
299 }
300 klen = EVP_CIPHER_CTX_key_length(cc->evp);
301 if (klen > 0 && keylen != (u_int)klen) {
302 if (EVP_CIPHER_CTX_set_key_length(cc->evp, keylen) == 0) {
303 ret = SSH_ERR_LIBCRYPTO_ERROR;
304 goto out;
305 }
306 }
307 if (EVP_CipherInit(cc->evp, NULL, (u_char *)key, NULL, -1) == 0) {
308 ret = SSH_ERR_LIBCRYPTO_ERROR;
309 goto out;
310 }
311 ret = 0;
312 #endif /* WITH_OPENSSL */
313 out:
314 if (ret == 0) {
315 /* success */
316 *ccp = cc;
317 } else {
318 if (cc != NULL) {
319 #ifdef WITH_OPENSSL
320 EVP_CIPHER_CTX_free(cc->evp);
321 #endif /* WITH_OPENSSL */
322 freezero(cc, sizeof(*cc));
323 }
324 }
325 return ret;
326 }
327
328 /*
329 * cipher_crypt() operates as following:
330 * Copy 'aadlen' bytes (without en/decryption) from 'src' to 'dest'.
331 * These bytes are treated as additional authenticated data for
332 * authenticated encryption modes.
333 * En/Decrypt 'len' bytes at offset 'aadlen' from 'src' to 'dest'.
334 * Use 'authlen' bytes at offset 'len'+'aadlen' as the authentication tag.
335 * This tag is written on encryption and verified on decryption.
336 * Both 'aadlen' and 'authlen' can be set to 0.
337 */
338 int
cipher_crypt(struct sshcipher_ctx * cc,u_int seqnr,u_char * dest,const u_char * src,u_int len,u_int aadlen,u_int authlen)339 cipher_crypt(struct sshcipher_ctx *cc, u_int seqnr, u_char *dest,
340 const u_char *src, u_int len, u_int aadlen, u_int authlen)
341 {
342 if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) {
343 return chachapoly_crypt(cc->cp_ctx, seqnr, dest, src,
344 len, aadlen, authlen, cc->encrypt);
345 }
346 if ((cc->cipher->flags & CFLAG_NONE) != 0) {
347 memcpy(dest, src, aadlen + len);
348 return 0;
349 }
350 #ifndef WITH_OPENSSL
351 if ((cc->cipher->flags & CFLAG_AESCTR) != 0) {
352 if (aadlen)
353 memcpy(dest, src, aadlen);
354 aesctr_encrypt_bytes(&cc->ac_ctx, src + aadlen,
355 dest + aadlen, len);
356 return 0;
357 }
358 return SSH_ERR_INVALID_ARGUMENT;
359 #else
360 if (authlen) {
361 u_char lastiv[1];
362
363 if (authlen != cipher_authlen(cc->cipher))
364 return SSH_ERR_INVALID_ARGUMENT;
365 /* increment IV */
366 if (!EVP_CIPHER_CTX_ctrl(cc->evp, EVP_CTRL_GCM_IV_GEN,
367 1, lastiv))
368 return SSH_ERR_LIBCRYPTO_ERROR;
369 /* set tag on decryption */
370 if (!cc->encrypt &&
371 !EVP_CIPHER_CTX_ctrl(cc->evp, EVP_CTRL_GCM_SET_TAG,
372 authlen, (u_char *)src + aadlen + len))
373 return SSH_ERR_LIBCRYPTO_ERROR;
374 }
375 if (aadlen) {
376 if (authlen &&
377 EVP_Cipher(cc->evp, NULL, (u_char *)src, aadlen) < 0)
378 return SSH_ERR_LIBCRYPTO_ERROR;
379 memcpy(dest, src, aadlen);
380 }
381 if (len % cc->cipher->block_size)
382 return SSH_ERR_INVALID_ARGUMENT;
383 if (EVP_Cipher(cc->evp, dest + aadlen, (u_char *)src + aadlen,
384 len) < 0)
385 return SSH_ERR_LIBCRYPTO_ERROR;
386 if (authlen) {
387 /* compute tag (on encrypt) or verify tag (on decrypt) */
388 if (EVP_Cipher(cc->evp, NULL, NULL, 0) < 0)
389 return cc->encrypt ?
390 SSH_ERR_LIBCRYPTO_ERROR : SSH_ERR_MAC_INVALID;
391 if (cc->encrypt &&
392 !EVP_CIPHER_CTX_ctrl(cc->evp, EVP_CTRL_GCM_GET_TAG,
393 authlen, dest + aadlen + len))
394 return SSH_ERR_LIBCRYPTO_ERROR;
395 }
396 return 0;
397 #endif
398 }
399
400 /* Extract the packet length, including any decryption necessary beforehand */
401 int
cipher_get_length(struct sshcipher_ctx * cc,u_int * plenp,u_int seqnr,const u_char * cp,u_int len)402 cipher_get_length(struct sshcipher_ctx *cc, u_int *plenp, u_int seqnr,
403 const u_char *cp, u_int len)
404 {
405 if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0)
406 return chachapoly_get_length(cc->cp_ctx, plenp, seqnr,
407 cp, len);
408 if (len < 4)
409 return SSH_ERR_MESSAGE_INCOMPLETE;
410 *plenp = PEEK_U32(cp);
411 return 0;
412 }
413
414 void
cipher_free(struct sshcipher_ctx * cc)415 cipher_free(struct sshcipher_ctx *cc)
416 {
417 if (cc == NULL)
418 return;
419 if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) {
420 chachapoly_free(cc->cp_ctx);
421 cc->cp_ctx = NULL;
422 } else if ((cc->cipher->flags & CFLAG_AESCTR) != 0)
423 explicit_bzero(&cc->ac_ctx, sizeof(cc->ac_ctx));
424 #ifdef WITH_OPENSSL
425 EVP_CIPHER_CTX_free(cc->evp);
426 cc->evp = NULL;
427 #endif
428 freezero(cc, sizeof(*cc));
429 }
430
431 int
cipher_get_keyiv(struct sshcipher_ctx * cc,u_char * iv,size_t len)432 cipher_get_keyiv(struct sshcipher_ctx *cc, u_char *iv, size_t len)
433 {
434 #ifdef WITH_OPENSSL
435 const struct sshcipher *c = cc->cipher;
436 int evplen;
437 #endif
438
439 if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) {
440 if (len != 0)
441 return SSH_ERR_INVALID_ARGUMENT;
442 return 0;
443 }
444 if ((cc->cipher->flags & CFLAG_AESCTR) != 0) {
445 if (len != sizeof(cc->ac_ctx.ctr))
446 return SSH_ERR_INVALID_ARGUMENT;
447 memcpy(iv, cc->ac_ctx.ctr, len);
448 return 0;
449 }
450 if ((cc->cipher->flags & CFLAG_NONE) != 0)
451 return 0;
452
453 #ifdef WITH_OPENSSL
454 evplen = EVP_CIPHER_CTX_iv_length(cc->evp);
455 if (evplen == 0)
456 return 0;
457 else if (evplen < 0)
458 return SSH_ERR_LIBCRYPTO_ERROR;
459 if ((size_t)evplen != len)
460 return SSH_ERR_INVALID_ARGUMENT;
461 if (cipher_authlen(c)) {
462 if (!EVP_CIPHER_CTX_ctrl(cc->evp, EVP_CTRL_GCM_IV_GEN, len, iv))
463 return SSH_ERR_LIBCRYPTO_ERROR;
464 } else if (!EVP_CIPHER_CTX_get_iv(cc->evp, iv, len))
465 return SSH_ERR_LIBCRYPTO_ERROR;
466 #endif
467 return 0;
468 }
469
470 int
cipher_set_keyiv(struct sshcipher_ctx * cc,const u_char * iv,size_t len)471 cipher_set_keyiv(struct sshcipher_ctx *cc, const u_char *iv, size_t len)
472 {
473 #ifdef WITH_OPENSSL
474 const struct sshcipher *c = cc->cipher;
475 int evplen = 0;
476 #endif
477
478 if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0)
479 return 0;
480 if ((cc->cipher->flags & CFLAG_NONE) != 0)
481 return 0;
482
483 #ifdef WITH_OPENSSL
484 evplen = EVP_CIPHER_CTX_iv_length(cc->evp);
485 if (evplen <= 0)
486 return SSH_ERR_LIBCRYPTO_ERROR;
487 if ((size_t)evplen != len)
488 return SSH_ERR_INVALID_ARGUMENT;
489 if (cipher_authlen(c)) {
490 /* XXX iv arg is const, but EVP_CIPHER_CTX_ctrl isn't */
491 if (!EVP_CIPHER_CTX_ctrl(cc->evp,
492 EVP_CTRL_GCM_SET_IV_FIXED, -1, (void *)iv))
493 return SSH_ERR_LIBCRYPTO_ERROR;
494 } else if (!EVP_CIPHER_CTX_set_iv(cc->evp, iv, evplen))
495 return SSH_ERR_LIBCRYPTO_ERROR;
496 #endif
497 return 0;
498 }
499
500