1 /*
2 * This file is part of John the Ripper password cracker,
3 * Copyright (c) 2016 JimF
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted.
7 *
8 * There's ABSOLUTELY NO WARRANTY, express or implied.
9 *
10 * Functions and data which is common among the GPG crackers
11 * (CPU, OpenCL)
12 */
13
14 #include <stdio.h>
15 #include <string.h>
16 #include <assert.h>
17 #include <openssl/blowfish.h>
18 #include <openssl/ripemd.h>
19 #include <openssl/cast.h>
20 #include <openssl/camellia.h>
21 #include <openssl/bn.h>
22 #include <openssl/dsa.h>
23 #include <openssl/des.h>
24 #include <openssl/aes.h> /* AES_cfb128_encrypt() */
25
26 #include "twofish.h"
27 #include "idea-JtR.h"
28 #include "sha2.h"
29 #include "md5.h"
30 #include "formats.h"
31 #include "memory.h"
32 #include "common.h"
33 #include "gpg_common.h"
34 #include "loader.h"
35
36 #if !AC_BUILT && OPENSSL_VERSION_NUMBER >= 0x10100000
37 #define HAVE_DSA_GET0_PQG 1
38 #endif
39
40 struct gpg_common_custom_salt *gpg_common_cur_salt;
41
42 struct fmt_tests gpg_common_gpg_tests[] = {
43 /* SHA1-CAST5 salt-iter */
44 {"$gpg$*1*667*2048*387de4c9e2c1018aed84af75922ecaa92d1bc68d48042144c77dfe168de1fd654e4db77bfbc60ec68f283483382413cbfddddcfad714922b2d558f8729f705fbf973ab1839e756c26207a4bc8796eeb567bf9817f73a2a81728d3e4bc0894f62ad96e04e60752d84ebc01316703b0fd0f618f6120289373347027924606712610c583b25be57c8a130bc4dd796964f3f03188baa057d6b8b1fd36675af94d45847eeefe7fff63b755a32e8abe26b7f3f58bb091e5c7b9250afe2180b3d0abdd2c1db3d4fffe25e17d5b7d5b79367d98c523a6c280aafef5c1975a42fd97242ba86ced73c5e1a9bcab82adadd11ef2b64c3aad23bc930e62fc8def6b1d362e954795d87fa789e5bc2807bfdc69bba7e66065e3e3c2df0c25eab0fde39fbe54f32b26f07d88f8b05202e55874a1fa37d540a5af541e28370f27fe094ca8758cd7ff7b28df1cbc475713d7604b1af22fd758ebb3a83876ed83f003285bc8fdc7a5470f7c5a9e8a93929941692a9ff9f1bc146dcc02aab47e2679297d894f28b62da16c8baa95cd393d838fa63efc9d3f88de93dc970c67022d5dc88dce25decec8848f8e6f263d7c2c0238d36aa0013d7edefd43dac1299a54eb460d9b82cb53cf86fcb7c8d5dba95795a1adeb729a705b47b8317594ac3906424b2c0e425343eca019e53d927e6bc32688bd9e87ee808fb1d8eeee8ab938855131b839776c7da79a33a6d66e57eadb430ef04809009794e32a03a7e030b8792be5d53ceaf480ffd98633d1993c43f536a90bdbec8b9a827d0e0a49155450389beb53af5c214c4ec09712d83b175671358d8e9d54da7a8187f72aaaca5203372841af9b89a07b8aadecafc0f2901b8aec13a5382c6f94712d629333b301afdf52bdfa62534de2b10078cd4d0e781c88efdfe4e5252e39a236af449d4d62081cee630ab*3*254*2*3*8*b1fdf3772bb57e1f*65536*2127ccd55e721ba0", "polished"},
45 /* SHA1-CAST5 salt-iter */
46 {"$gpg$*1*668*2048*e5f3ef815854f90dfdc3ad61c9c92e512a53d7203b8a5665a8b00ac5ed92340a6ed74855b976fc451588cc5d51776b71657830f2c311859022a25412ee6746622febff8184824454c15a50d64c18b097af28d3939f5c5aa9589060f25923b8f7247e5a2130fb8241b8cc07a33f70391de7f54d84703d2537b4d1c307bdf824c6be24c6e36501e1754cc552551174ed51a2f958d17c6a5bd3b4f75d7979537ee1d5dcd974876afb93f2bcda7468a589d8dba9b36afbe019c9086d257f3f047e3ff896e52783f13219989307bf277e04a5d949113fc4efcc747334f307a448b949ee61b1db326892a9198789f9253994a0412dd704d9e083000b63fa07096d9d547e3235f7577ecd49199c9c3edfa3e43f65d6c506363d23c21561707f790e17ea25b7a7fce863b3c952218a3ac649002143c9b02df5c47ed033b9a1462d515580b10ac79ebdca61babb020400115f1e9fad26318a32294034ea4cbaf681c7b1de12c4ddb99dd4e39e6c8f13a322826dda4bb0ad22981b17f9e0c4d50d7203e205fb2ee6ded117a87e47b58f58f442635837f2debc6fcfbaebba09cff8b2e855d48d9b96c9a9fb020f66c97dffe53bba316ef756c797557f2334331eecaedf1ab331747dc0af6e9e1e4c8e2ef9ed2889a5facf72f1c43a24a6591b2ef5128ee872d299d32f8c0f1edf2bcc35f453ce27c534862ba2c9f60b65b641e5487f5be53783d79e8c1e5f62fe336d8854a8121946ea14c49e26ff2b2db36cef81390da7b7a8d31f7e131dccc32e6828a32b13f7a56a28d0a28afa8705adbf60cb195b602dd8161d8b6d8feff12b16eb1ac463eaa6ae0fd9c2d906d43d36543ef33659a04cf4e69e99b8455d666139e8860879d7e933e6c5d995dd13e6aaa492b21325f23cbadb1bc0884093ac43651829a6fe5fe4c138aff867eac253569d0dc6*3*254*2*3*8*e318a03635a19291*65536*06af8a67764f5674", "blingbling"},
47 /* SHA1-CAST5 salt-iter */
48 {"$gpg$*1*668*2048*8487ca407790457c30467936e109d968bdff7fa4f4d87b0af92e2384627ca546f2898e5f77c00300db87a3388476e2de74f058b8743c2d59ada316bc81c79fdd31e403e46390e3e614f81187fb0ae4ca26ed53a0822ace48026aa8a8f0abdf17d17d72dfa1eba7a763bbd72f1a1a8c020d02d7189bd95b12368155697f5e4e013f7c81f671ca320e72b61def43d3e2cb3d23d105b19fe161f2789a3c81363639b4258c855c5acd1dd6596c46593b2bfec23d319b58d4514196b2e41980fbb05f376a098049f3258f9cdf1628c6ff780963e2c8dc26728d33c6733fbac6e415bd16d924a087269e8351dd1c6129d1ac7925f19d7c9a9ed3b08a53e207ffbfba1d43891da68e39749775b38cbe9e6831def4b4297ce7446d09944583367f58205a4f986d5a84c8cf3871a7e2b6c4e2c94ff1df51cd94aecf7a76cd6991a785c66c78f686e6c47add9e27a6b00a2e709f1383f131e3b83b05c812b2ec76e732d713b780c381b0785f136cd00de7afa0276c95c5f0bb3a4b6ad484d56e390c11f9d975729ae1665189190fd131f49109f899735fd2c2efbafd8b971b196d18aeff70decc9768381f0b2243a05db99bd5911d5b94770ee315e1fe3ab0e090aa460d2c8d06a06fef254fd5fa8967386f1f5d37ea6f667215965eefe3fc6bc131f2883c02925a2a4f05dabc48f05867e68bb68741b6fb3193b7c51b7d053f6fd45108e496b9f8f2810fa75ffe454209e2249f06cc1bfc838a97436ebd64001b9619513bcb519132ce39435ed0d7c84ec0c6013e786eef5f9e23738debc70a68a389040e8caad6bd5bb486e43395e570f8780d3f1d837d2dc2657bbded89f76b06c28c5a58ecaa25a225d3d4513ee8dc8655907905590737b971035f690ac145b2d4322ecc86831f36b39d1490064b2aa27b23084a3a0b029e49a52b6a608219*3*254*2*3*8*0409f810febe5e05*65536*ce0e64511258eecc", "njokuani."},
49 /* SHA1-CAST5 salt-iter */
50 {"$gpg$*1*348*1024*e5fbff62d94b41de7fc9f3dd93685aa6e03a2c0fcd75282b25892c74922ec66c7327933087304d34d1f5c0acca5659b704b34a67b0d8dedcb53a10aee14c2615527696705d3ab826d53af457b346206c96ef4980847d02129677c5e21045abe1a57be8c0bf7495b2040d7db0169c70f59994bba4c9a13451d38b14bd13d8fe190cdc693ee207d8adfd8f51023b7502c7c8df5a3c46275acad6314d4d528df37896f7b9e53adf641fe444e18674d59cf46d5a6dffdc2f05e077346bf42fe35937e95f644a58a2370012d993c5008e6d6ff0c66c6d0d0b2f1c22961b6d12563a117897675f6b317bc71e4f2dbf6b9fff23186da2724a584d70401136e8c500784df462ea6548db4eecc782e79afe52fd8c1106c7841c085b8d44465d7a1910161d6c707a377a72f85c39fcb4ee58e6b2f617b6c4b173a52f171854f0e1927fa9fcd9d5799e16d840f06234698cfc333f0ad42129e618c2b9c5b29b17b7*3*254*2*3*8*7353cf09958435f9*9961472*efadea6cd5f3e5a7", "openwall"},
51 /* SHA1-CAST5 salt-iter */
52 {"$gpg$*1*668*2048*97b296b60904f6d505344b5b0aa277b0f40de05788a39cd9c39b14a56b607bd5db65e8da6111149a1725d06a4b52bdddf0e467e26fe13f72aa5570a0ea591eec2e24d3e9dd7534f26ec9198c8056ea1c03a88161fec88afd43474d31bf89756860c2bc6a6bc9e2a4a2fc6fef30f8cd2f74da6c301ccd5863f3240d1a2db7cbaa2df3a8efe0950f6200cbc10556393583a6ebb2e041095fc62ae3a9e4a0c5c830d73faa72aa8167b7b714ab85d927382d77bbfffb3f7c8184711e81cf9ec2ca03906e151750181500238f7814d2242721b2307baa9ea66e39b10a4fdad30ee6bff50d79ceac604618e74469ae3c80e7711c16fc85233a9eac39941a564b38513c1591502cde7cbd47a4d02a5d7d5ceceb7ff920ee40c29383bd7779be1e00b60354dd86ca514aa30e8f1523efcffdac1292198fe96983cb989a259a4aa475ed9b4ce34ae2282b3ba0169b2e82f9dee476eff215db33632cdcc72a65ba2e68d8e3f1fed90aaa68c4c886927b733144fb7225f1208cd6a108e675cc0cb11393db7451d883abb6adc58699393b8b7b7e19c8584b6fc95720ced39eabaa1124f423cc70f38385c4e9c4b4eeb39e73e891da01299c0e6ce1e97e1750a5c615e28f486c6a0e4da52c15285e7cf26ac859f5f4190e2804ad81ba4f8403e6358fbf1d48c7d593c3bac20a403010926877db3b9d7d0aaacd713a2b9833aff88d1e6b4d228532a66fe68449ad0d706ca7563fe8c2ec77062cc33244a515f2023701c052f0dd172b7914d497fdaefabd91a199d6cb2b62c71472f52c65d6a67d97d7713d39e91f347d2bc73b421fb5c6c6ba028555e5a92a535aabf7a4234d6ea8a315d8e6dcc82087cc76ec8a7b2366cecf176647538968e804541b79a1b602156970d1b943eb2641f2b123e45d7cace9f2dc84b704938fa8c7579a859ef87eca46*3*254*2*3*8*d911a3f73b050340*2097152*347e15bee29eb77d", "password"},
53 /* SHA256-AES256 salt-iter */
54 {"$gpg$*1*348*1024*8f58917c41a894a4a3cdc138161c111312e404a1a27bb19f3234656c805ca9374bbfce59750688c6d84ba2387a4cd48330f504812cf074eba9c4da11d057d0a2662e3c7d9969e1256e40a56cce925fba29f4975ddb8619004def3502a0e7cf2ec818695c158243f21da34440eea1fec20418c7cf7dbe2230279ba9858201c00ae1d412aea1f59a66538fb739a15297ff9de39860e2782bf60a3979a5577a448925a0bc2d24c6bf3d09500046487a60bf5945e1a37b73a93eebb15cfd08c5279a942e150affbbe0d3084ab8aef2b6d9f16dc37b84334d91b80cf6f7b6c2e82d3c2be42afd39827dac16b4581be2d2f01d9703f2b19c16e149414fdfdcf8794aa90804e4b1dac8725bd0b0be52513848973eeadd5ec06d8a1da8ac072800fcc9c579172b58d39db5bc00bc0d7a21cf85fb6c7ce10f64edde425074cb9d1b4b078790aed2a46e79dc7fa4b8f3751111a2ff06f083a20c7d73d6bbc747e0*3*254*8*9*16*5b68d216aa46f2c1ed0f01234ebb6e06*131072*6c18b4661b884405", "openwall"},
55 /* RIPEMD160-AES256 salt-iter */
56 {"$gpg$*1*348*1024*7fc751702c5b678089bbd667000172649b029906ed59ba163bb4418cf384f6e39d07cd4763f874f1afbdacf1ed33544321ad9e664d6428c1865b8ea7d9026b558cc1f9c139ca771c6ceca03d57af635fc9140a3f5d2bec7117a98e6561cbe7efedcee129cf7dc1de39a7b92b7d3e17f45c54bba8ce8b0c8eb73611af8f44d5551c101ebe3d7466e1ae393fbf928bb297de0ce7e64f180bc76c770e72ca5da0c27a3abaf208d51c831f9f9f885269d28aa73a93c2be0185cc71f99381635a8e7c4c48fbe77620bb19a829c62dfed5e9e088fad12ea99003117886715c88a2f9926580d47d99a7f2b38f518bc011051c57c6c6c407bf9944b279db8456a6a4d1d5811558aaf8c108c6157cbeb297d26ab407c8c5d6a0038374f903a93e78ba857d97dc71d709faf0824d7bf092a36c4df2932bb4fd2c967fcbeb296a4ee3f45e550de04e62371ed9874068d9025e0fcf136a823ef0af9ce24f7ed4cc8b*3*254*3*9*16*3a9305fd67934b258d749739a360a6dd*131072*316217f7c4782365", "openwall"},
57 /* SHA1-CAST5 salt-iter, DSA key */
58 {"$gpg$*17*42*1024*d974ae70cfbf8ab058b2e1d898add67ab1272535e8c4b9c5bd671adce22d08d5db941a60e0715b4f0c9d*3*254*2*3*8*a9e85673bb9199d8*11534336*71e35b85cddfe2af", "crackme"},
59 /* MD5-CAST5 salt-iter */
60 {"$gpg$*17*42*1024*002170c3c5778fdbeedd788a1eda3827ef7d6d73491c022d5b76d33ff70ccae8d243aab7e2f40afcb4a4*3*254*1*3*8*019e084555546803*65536*49afdb670acda6c6", "MD5-CAST5-openwall"},
61 /* gpg --s2k-mode 0 --gen-key*/
62 {"$gpg$*1*668*2048*98515325c60af7a5f9466fd3c51fb49e6001567145dba5bb60a23d3c108a86b83793617b63e3fdfd94a07886782feb555e92366aeecb172ad7614ad6a6bbf137aa75a1d44dc550485b2103d194c691f1bf44301fc0d337e00d2b319958f709b4ca0b5cb7af119931abd99dfb75650210fc66be32af0b3dddaf362ef3504ef76cda787b28e17bc173d9c4ff4829713c9ee5d5282df443c7fc112e79da47091cf671b87179b8ce900873321c180ebc45d11a95aaf27610231b6abf1f22f71fdddd694334a752662ae4d62de122f1ff2ba95ba5fab7e5a498edd389d014926dd91c1769bfdd00d65123a8ec3e31d70e0ffe04eb8ef69648b9895c4cd5afc1e0ec81fa032e1b17c876b30241d1f5464535dfd7cf13f31c1bc1aa6150070afb491cca8afe4af9df174a49d1b8ebffe65298fc85ada9cf1ec61db243792d878bf4fdb12592f1a493912340010b173b4ccd49be7f1bc3565e9bdc601c5ecb01253979f64282fb34970d1d7ad1d13987032cda00a74d1d3117393a0cee73c2303fe4c5ba3938959956abfde9f5f24a7590a8d2224c2f2ca2bbc699841bf23f04e9a2a2974dfdd091462b1e93f47b8e3fcd75009f2f50839b3720f33cabc41adf17b4353ec8bc997f449b5fe4f320b8bf0e5e392386e0ef9b665a3680405e7c022a37e2ebeb2c41294455d97783f22137d4051f07ea215f91fa417d378496f5930cbc13dd942249d265c3d4a36e1e1fbed147153f2c3e3d4a43bec4606fcba57e2e4783240062285757ba39e1cc01b8506314a438fb99306a2dbb0cae1dbb5410965a8342cffa4ffcae8e79198404507c4f8d39cc3979c3f407d5d91ed6335e069087a975221c78b02726f234e64ff746a5e814997bbaa11f2885c0d00f242dff3138ff2556d577c125765f0fd08dfa66795ba810e3bb90efcfd9f5c3cb643bdf*0*254*2*3*8*01942c062e4b5eb0", "openwall@12345"},
63 /* gpg --s2k-mode 1 --gen-key, old GnuPG versions (e.g GnuPG 1.0.3), uses *new* hash format */
64 {"$gpg$*17*24*1024*b0d0b23529f968c0d05fa8caf38445c5bca5c2523ae6cc87*1*255*2*3*8*c5efc5bab719aa63*0*a0ccc71dedfce4d3*128*bb0ccf0f171fbb6438d94fdf24b749461c63902c4dca06f2d5580bca5837899431f1cbc7ccd56db8c9136a4ac7230a21eb6ab51a7c7a24fe23e99dd546eeb07cadb96372b0cb4a7dc2ba31e399d779e8ffa87f6f16c22ab54226a8a565550cfe98bee81001a810749327dca46f4ce7eb4f9726a00069026cb89f9533599cacdb*20*ec99ac865efa5aa7a9f1da411107e02e8e41daf5*128*16ed223362bb289889bf15c0ef3ce88b94892d57ea486f7cd63a1f8f83da3c28a6ee3879787c654c97e4824c75b0efd7f36db36947dfb8c9b1cfe0562c4e7d8b2b600973b9b379a1891200941b3a17361e49ccf157b0797a9d2f7535da0455c8d822b669ed6fc5fec56c71ad5df6fd9d4a4b67458b2e576a144ba2d0f49eff72*128*7991ba80eae8aa9d8adb38ae3c91fe771b7dc0a6f30fdc45d357acd5fcae1176245807972c39748880080d609f4c7e11a6c30d7ad144d848838e4ace2d9716c6e27edb6ef6ca453d7a8a3b0320fe721bc094e891b73f4515f3e34f52dfbf002108b0412bf54142b4d2c411fee99fd0b459de0a3825dc5be078b6e48d7aa5ceae", "wtf@123"},
65 /* gpg --s2k-mode 1 --gen-key, old GnuPG versions (e.g GnuPG 1.0.3), uses *new* hash format, ElGamal */
66 {"$gpg$*16*36*1024*0a4c2fb9d1ff24b817212a9cc0d3f2d84184a368ff3a04c337566812d037e5fe28933eaa*1*255*2*3*8*b312f3046fdb046c*0*a0ccc71dedfce4d3*128*f9235c132a796b0fd67f59567cf01dcf0a4ebbc8607a1033cefd2d52be40334e8cfba60737751b1bf16e36399340698656255917ca65f1f6f7806f05f686889ef7dc7030dd17dc9b45a1e1f01ab8d8a676d5a1759ac65bd1e2e50282f9926b44a156f7fea5e4ae5883e10f533efb9cd857efb84d23062f9741b4bd2ba70abcb3*1*05*128*e67deba19288e87c93829194698d10169e1f42eb43bba46b563037177ee09801a824fc9be2796fd24f4438c1a72f2e8587e6507ab1a408695a46709b87cc171366eef9ee86bd7935dd0ef6d4efdba738d7d8cb40dfe0f3dec996ebe2153fec9c091b5be0d31e398d8de75de4e346e299a07603242846b87f2b90ed82f9143786", "wtf@123"},
67 /* gpg --homedir . --s2k-cipher-algo 3des --simple-sk-checksum --gen-key */
68 {"$gpg$*1*650*2048*13f86b7b625701ea33f1d9e3bfc64d70f696a8ae42fb40ba128ae248aabea98e5d1f1a2ffa10e7ead6fde1d0d652de653965098f770a20abe95fe253428dd39856b8ce84c28699164766c864b7ca61723f6f49be4d8304814a522dd7f2798580dead66a55da5203ead2e4499ec8ca6c08e13e7c6b117cfd9381fb32bdeb5d022bc21197f0c095a8e2153809f295194f5f07f55f3c547af1094cc077a1aace9005c7b57558ec4042a1f312b512861a7038d10377df6a98e03239568f556e1e3e2cd1578c621268c3f95b1a4c6ba54dc484fd9b31d561438c68c740f71d8f2ff30ca9747ea350d70a6d1cc6cbaf4f13ecbc366df574ea313859c687ef7c5dc132250aac0982462f7327d3b384c14bd02eec7c460088d3f4439ef8696dcc60f86479a4593259cb300c466f153bc59cea6a2604da1d55e0b02dd673f7b52005349a5356373f49640f26e77af2b94ff2705c7b476993e3ac0845d2c582b769a3e06e9024e518fbf6c459ee9b158f94a12ac65cd720113f88f7dd2af26466d271e67c1a79707e33d6d72189d6b566019720889706c23f66217d20bba7d7174c048e333322fa3fc8a56a176fb2fb14e4f2660dd657c98b91dc80885b26ad7ea30d8ed0e0a88f2467f266d4b0087039a7a502d7db91d2a1286173fbaa0b6781bfe4f4b12ebd28be9b11e26214a83aebbe6cb7bc95a27ebef8c6c20c62cf709d89feb389a577d6c9be9bf1bd4034309ceebbbc0f307ca378051a1e283afdb0dd8a6ad72d2bede3d0f96c30c49b5e0a8bce3e009c4f786258d3d4fa8e0ec35c9bbff056d3648f8d8a03c20edf79757cfb26b6f3682661492052118eb33a92d407c5d4aed72635dededbbf5b46894e9e045416fbab0d5d6f680dea8fa6df38e9dbe4587ab5e5ca77e85b969295fd30a*3*255*2*2*8*7ecb79e68cd01a71*65536*2355a3ead8a0a3c5*256*d7d5db86ab15ca6d9b9138e90d60b9d4697d9535f6f990a930a5cb250a6c367e90e24cd60b3165dd654786c7e94b18fe48760b7cd123e4fefc8a0ffa18ab9e81c9e0b63f7e925483b29c3e639ed02f195cfb5f24b89e5cd802f08f81b63b6602827a95bdbf720c4fe043affb195fb66e1bce7bad691317451038fd9dade9e3a6e0ce2eb9293258434a02cb9134789bed94dd71df0d82192e12c50c60d52005eb85ced465b8992dc1de0899442f7cf26ea676e9db9fa3e28ba98f498d7c63de69394030726e1b1651928f17fc7464a58a3a2c1a683737962282d90bcd781fdab03a85b0b4114c5fcb83777d5ded28bf895b65a322adf7b9a8007e4315f48e9131", "openwall"},
69 /* gpg --homedir . --s2k-cipher-algo 3des --simple-sk-checksum --gen-key */
70 {"$gpg$*1*650*2048*72624bb7243579c0c77cf1e64565251e0ac9d0dcb2f4b98fa54e1678ee4234409efe464a117b21aff978907cfbf19eb2547d44e3a2e6f7db5bfceb4af2391992f30ff55a292d0c011f05c3ab27a1a3fde1a9fd1fbf05c7e5d200f4b7941efe42b4c5dd8abee6ee3d57c4899e023399c8cfd8d9735e095857b71723ded660d9bd705dba9eb373fab976cd73569934d7dec08f9f0b8451ca15d21549dd4d09b3e7cf832645cdbcb4bac84a963c8d7bfde301fcba31d3e935bbb8a0db483583c8077ea16cfda128e1eef42588082c0038cd9f35bb77f82d138f75ba7640250c4dc49ab60f0ce138999ea6c267a256b3e5d0e0ef30fef9c943462fcb3f0df38f069a3b027e15f36bf353ca4c0340ea9e8963d49136fa47872e0fa62c75345d40b7fe794b676c5e5d9bf50f90f4465b68630fbf72e5c46721b4877c30f004cfc2cfd78903dcfa5893ce9bea86d4be7e933a2d41e55024fb6529a7197da2f4dff4ac7689666b27cad49d640d1fdde37801cf8285818884c41465afb450d6c4cb0de21211a7cafd86399398cc18492cf4b3810bbfe1c08f8b293d1c78ed3a4cfacf92d9633e86fc5591a94d514d7b45af4729c801d405645699201c4a8dea32a9098a86f5a3a7526b42676aa1179b47f070390b9c84b17fafc4a2607d3247b34fafae369f31a63e85a8179db35c9038b616fcaad621cd91bcbbe3e96b2fe09e18d0da0492b66dd9d106eb4617975dea8e9b00b9bdea1b0d9c0737dc168d83be812c91076a3c4430bdd289bec60e1b0c8b314a7886256d95ae01cb4246cae94daaa50ef2b7ed498089872e1296dd5679ea0bbfd6e4ff704124dabbddb572e38fa83fff143bf2946d3e563d7de8cc62e1d51900d3db28c9e80dc5b4b8662268d62141106c111597f38131830ecbea*3*255*2*2*8*b58b33e5bcc1d3cd*65536*2355a3ead8a0a3c5*256*bd18b0eeba7c8dd316d1a60f0828ed50aea29afa2eee307cdbbc5df3e641167136d9d659d67a412215fe577d999c4672ca4e6e0af006469b828868e334062d4b442785c616081ad9c758278564174e74d9a9bf17553b065717053d534cbc4eeb32b0f64a6b110b5f434878b6a05730ea6e5f317c84a41a3ddbe2d9ef9693c34b5e87515056395444198fba8e9542adf9276cb9147447d79f774b94a40f6ea32377f1da1ea9f40e08a9b678737fab7ee77b764a9ed7b36848ac77d5b60c0f5075fa5f130e215dab20401e944078a6d905fa54cb094bf967f1620105aaeba95d1db2925ea045e83808713f71c60ca5dfe9c20e895eb637e53dfa54629d71670971", "openwall"},
71 /* GPG symmetric encryption, "gpg -c", https://id0-rsa.pub/problem/1/ */
72 {"$gpg$*0*63*1c890c019b24ce46afd906500094ad1afde4d56b9666dee9568cf2d47315b36e501b340813a62b8b82b72492b00a4595941ebd96de8eab636a00210bc57a13*3*18*2*9*65536*20538c8d69964d96", "password"},
73 /* Challenge6_pro_Company2_hard.pgp (without MDC) */
74 {"$gpg$*0*100*2cc874cb99956585bdf31bc7122540e21043c42e5be9cdeca20daf0dea294bcd15163d4dddc8ecc62b7eaadff213185601ed7431c92c83c4510c19c906f40f8eb865c33cb4be87a63dad7ed882387781d866bbc2c98604c6ee9411a1f0bc5306301913e4*3*9*2*3*5242880*d80b2eb1fddeeda8", "3Pseuderanthemum"},
75 /* Following three hashes were generated from PGP Zip files using gpg2john */
76 {"$gpg$*0*168*24d65b6ca7821043f03882a939aaa1f8d5c4ce7d26d7e83386968903582ca809f6cc7ffddfcb31d27e8945a672ec0e36530d6cbd7ac01318d5658a1121234b4987886ee9d6cfd493f5447dc5e40938e23fc2b70be967ab5ceb516052fc3798d2ccaab57b3ffe42870cba93497539a1b16d8eaf87abfaba81cf0787c87335f25290bbef02eabae5f7c090cab2410adc85f7c6e5210bda57f68acad41cb4f03e6cbf71e32f9fada60a*3*18*2*9*4063232*59092e506c1a856a", "12345678"},
77 {"$gpg$*0*59*044511b6335c3d392c5cb43b56d9bd6ea9e2ba9818d6d9202bdfe1e83d4540f490bf96e17c790b063ec5c61423f031d535c96602431d8153e62392*3*18*2*9*4063232*ab38a8d3fce03b86", "openwall"},
78 {"$gpg$*0*169*33d74e46b0d2c693981a91a30f24af0f6a849a37c61207c03149d5f1a301e247d0bee59476fb604ab622c282bce2b7ef30044ea0e1a9a4167738b2432477cc709f88442111297be0b007567ee56646c245e19524f7a4103abfa35994015ca88b056c62b84c6606d82727d0b24d996efe68e5531652755915115e37e1b60d989c36b9fd09de965ea229740f4c87312d5bb0eb6dc72e68647231831ab3e930fae0ccded0c12166b1b722*3*18*2*9*2097152*4a6b94697208f151", "openwall"},
79 /* gpg --gen-key --s2k-digest-algo SHA512 --s2k-cipher-algo AES */
80 {"$gpg$*1*668*2048*1de86a75cca20667506b71e729cf77e10ec148a948a94199910506e783eba52bf074f5d1d1f4819adbe28c7b51b464069ba3e44fceb62eef3038d3dfe8f7bc6012c9abc35769439730a8aabe99e4603fd2201303e82b413617d8fbaf95fdaee3d16d38a74df86a814f487e78b5c84093187529ebc54232a945628205b2eaf13ffeb41f94b1482a73f3aeb97f297d2398d94be2782a1f24244430cf251553dce8571c99ccbd6fe46e6863b25fe132420d1f49acdf9bf413c2155a794b5cf45cea8bc4d958fee20b5523cc42343a106fca60068f93aedd6d4f6021bee5a22b70969c1c8369a615de3f46867bc9364d0cdde141672c102ae42cb338c21d0ec6dd4eec923345201b3b3f97e94b7f60defb2a733616cdcd50c4254689441ab25d3ffe8adb56ef6654f35b446f05a56eef24a4bcdd52cc2b4590667f56d31c6182a757ad0ca1d1377cb04ac3a0711b25cb978ce51f19b5affe648153fa96ee3204b4043478ea20903aa7ff7f2f71cfcff802de73d709776d2dcf611d2936366c7a42edd7ab12ce4cf354eef5c27118ee89f3bb6f9de37b8e64e6db3071ea0b6de83ed27568e25672b56eacad2fee9a8872ea17b6a5fef7e14c3fece236842d2cef0c2044dbdcb2a3b317f64aaad1703844e0ebe1a5e0a90f137b62735d65dc51cf0357abe7ffd25d41d0e23fa9fc03b1be7b73f6fb8a9db04aed18cec473b0c93ffd981cc54cfd779e116c46ee621f3aa4b2e16a8ab8017a234cf26ac77f433e4544bd5761c8b263ae1b8023f6d1aca73bae1d2da5bbf7824406f5e2ff976fbf6e4b9484f020e9346648435d341de2e06a9e607059f847c5007a078dec2f08f466fc219ea5c4762d678af9b4737466e6af46edab495305a4d30124cc30d67fd3d38787cf763e362fe4484722e22b5f584e7cf64ec2c05390252a23583da9ca*3*254*10*7*16*5dfa8dd3acc0c05f3b1666f0e9243ef9*65536*75807ba0c8e4917f", "12345678"},
81 /* gpg --gen-key --s2k-digest-algo SHA224 --s2k-cipher-algo Twofish */
82 {"$gpg$*1*348*1024*d34b480dff5b275826f7e429b8f27c43f94c4db41740df16fcbca68dfa2e73d8f35dc3bdbf0847b71c5c4a5f3b1259cb2f9387026343b302f8dfb0a57d042cfa5d28a4729ae995cd695ab05db0300305df9b4a03f36c1368466eaf6d8a58e193bfaf9d14680732481bb4b6fbf6fbfb4d4731fadc6cb6dd5a13b71d7fe95cc06a2299fb6082742affde071b610beba076b692c2bb214aa8c513c826d80bf6424f86ae9d2c62483b35e7c55959c954040cb40c676abad542c3fc7a9406dcef6e290408fb4c4f64d67185ead007d753c923a12a603b23601f09ee96a3fedf322eca02c29497cc3228018079fe935feffb871261100807d5a000389bf2b9baa18e37dc485bfebfe43b58b53ab0d9d96e1c770ec65085dfecc45538f570afabd823f56bd43af49747b9c6e28951cd43d3f4652f8619064dd9b449e6b7b1887e6c8e329e537664d1ab1538bae0e075aa15901034d844a43e317ab607088f70*3*254*11*10*16*24ff5d0153905789635d463a626f13a0*65536*c5538cead34df464", "123456"},
83 /* gpg --gen-key --s2k-digest-algo SHA384 --s2k-cipher-algo Blowfish */
84 {"$gpg$*1*668*2048*d875c0d3f173363879b40a3b9566de49ee222a4613648c50886cd39a11291517f6eb5e40fd752524495b07abab266ccaab0b24f50c87f4b91b1638ad62a3ee0387e41f44ab40dfe6fa54d3b589fed9ce65e33ff5bd7df220de91f65cb94c4feb290e0313522a957d32c6304ef6c68b449f1d21482cb90f4033b8993282029901d74f175283a8a950fbfa1a682dad90b147f5ae36791b019ab25994b95087657add312538b382ae86e4a3ff4f1d4b95eba062412f755f525d0ac4f0dbf3a30ab427bcfab6194ef6b10b73bc8752377e53f13d5985c0887774e54b9c857df6adeadda87291c47fdbf8fa7a400bf2e495955d88bb2ed3363b8f6f065059d99af452bef8c234c152d0cf241a14b81346838bbb455ae692b0e5a2905556af215eba3ec1804c28115c933d9264d6282b7c0923d375202485a25ea75b66ce6ee8bed214a1431f2a927f3d7859e96076edd9565ef61578f455b6d25bbcec7e2cfd3b83350168ece7facc65ee49518437cb5161a657773dd9e40946bb2a9609cbb3a07b906f18fcc88f6f9cb344020c32ec2918e7501923f6e6343db3afc7007e3bb5b443828193b073c3dd61657405d0c5532ecf42f745f674d2449c88825076046d75faa892ff7d077c44c1709490680279db7ed90e2676bd3573c2e2ee879054120b870fe1743082e6340f5812c73937d3876ebd9a4ad84913aa7784c7be8ac8410e9ab680e88c47a5c869f837ee224ccc6443f6ac36a92d682fc1a7db2f0bb6cb30e5be1d17bbfc5163471a55cc47eeef2c27ce49f0cec48d1d7a5769b5f42bf93eb6bd61643c49cbf7b75b1d6118653f45a84777bc604144d8ccd6814f32a3ef80e45cb507d91767d1334171041bf3f586ec803000c67baaf57a74c228fa986522129f5cb3aa85a3f44373e5f8c47951f892d58a923cde68e659632c0267*3*254*9*4*8*29b4190538078f46*65536*5f8d833d2266d429", "abcdef"},
85 /* gpg --gen-key --s2k-digest-algo SHA512 --s2k-cipher-algo idea */
86 {"$gpg$*1*668*2048*a83b3cf2f3662290d890569cd9787828ea71fd946f303db9f8cdc9c4400285af8689605a1a853f0d6850b002e9579fbc91a0702206cbd958dad1ff2aafbcb8db13c5188bf5694e5af98300e6711775bec0a0c882bf84883d96f9ab03a827b2cb719c63ab32b729bd4657d6990403d95fab3e1e53bfccb65c2fe9b4a17d2d779e01612b3d7f4ebdd92a7dbc8c111b68021c4479f8d4b9a12c0b686e66fbfc3d498186f17d8668e53efe233d2b0d01f8315180afe42bfdc4c02c2054a7f2d3063963dd14375a87604bee5eeedea89d5148cf1df108d338f51f6d814188e313b90eb8b65fb55bff87a8b3e86becc7b836a417dce1f32648fc156efe89df46f51f4beed6cf5c1cc449b4651e1b2d1a2eafdcd91987d1dcf06a885ef621699c171b27db2932f7c61cba5aaf320ff694b6c8cc08342ade9e6b53f2e943cf0e1e73de0e891a37992e7b01396c59051b28459532e375d2026af2605e08f6f8aadf3981f52aab3ccd5a727256f997f9c51d3a5b1c48e80fe5398ca7f3c8150ad00389c7d87d705001c5b587edff657c4a9ad16eb8860fcf179a271c913696c3178e3742ca39cd9e85a3a9558f6550a3c10ebc2ab4791f7761cd4e5bd0b0d1cd3becfe3bc94681ba5ead47dd81cedec1a7607b843b9369afd8bac1dcd0efa5e751cb5f5510367ecbf89f72764ff0e513ff76d75e1085ac7cbf2b377ee2d379bf46cb166cf03d06aeeefb8028f4b1a0f0626ffe3a7e0d672538ed55df96406d51073c92317dd6d057b749727a78be1636c3ab1be2586df97f56a20e8df099ffb4542ab34c23e0984bc9a4918230bf5e06d06b3321c7404b87cff50ffa73a959cff0ecebf3407f59055ba6d934e4ae818734f1eef05904bcfa3226a1e008d52974a2fffda74004739b1c75895da34b95ce4b1a1023f878667dd29efac7c6867adf59*3*254*10*1*8*bcd00fecc8fcf1a9*65536*2ef2aa27d53d3b10", "qwerty"},
87 /* gpg -o out.gpg --cipher-algo 3DES --no-mdc --symmetric --compress-level 0 --s2k-mode 3 --s2k-count 1 secret.txt */
88 {"$gpg$*0*36*c8ebbe8116a24a2c5f7e81c1588c225e39e41bfe1b3bede92e2914443ade5651efe9c949*3*9*2*2*1024*2f4ddf3395af20a6", "qwertyzxcvb12345"},
89 /* gpg -o out.gpg --cipher-algo IDEA --no-mdc --symmetric --compress-level 0 --s2k-mode 3 --s2k-count 1 secret.txt */
90 {"$gpg$*0*36*73426e4ec660c94430cf8551a3a3d8e2fc710d018b31271d83fd5098ff2e29b6734fdbca*3*9*2*1*1024*c77703dc5a6b398b", "qwertyzxcvb12345"},
91 /* gpg -o out.gpg --cipher-algo CAST5 --force-mdc --symmetric --compress-level 0 --s2k-mode 3 --s2k-count 1 secret.txt */
92 {"$gpg$*0*58*190111fef479fda732000fe7ead411eb778bfe101cf71c6a8a5fbf96b7d8e99dbbad901c37c88d213e1306a953d9aa9a04244509693f16856061*3*18*2*3*1024*d3e886db68fbfa0f", "qwertyzxcvb12345"},
93 /* gpg -o out.gpg --cipher-algo twofish --no-mdc --symmetric --compress-level 0 --s2k-mode 3 --s2k-count 1 secret.txt, has mdc in spite of "--no-mdc" flag */
94 {"$gpg$*0*66*c87c9a0e7e7f7299129645f2f352076f8d9c29c830e7d21b28ee45fbfe2a31fcb70900fd8031e896035d672847c9b9c59f1fd802290d3d6992c45eb3d27e95cc0990*3*18*2*10*1024*45216ac170f04fd5", "qwertyzxcvb12345"},
95 /* PGP 8.0 for Windows, AES-256 with missing mdc */
96 {"$gpg$*0*44*cfa1353f691dfa09e1f2001fe81a50f67b7d38a69d4d909a5ec665f2691304c092b5136e4c691368fb006973*3*9*2*9*65536*f3d4f603c697cf18", "openwall123"},
97 /* PGP 8.0 for Windows, Twofish with missing mdc */
98 {"$gpg$*0*44*eaf7c0fd70579388927f1c85395e6f76a73234639a792c0a08c8ede8397ac09e105bc6eca51632367d572348*3*9*2*10*65536*048af401a552dca6", "openwall"},
99 /* PGP Desktop 9.0.2 */
100 {"$gpg$*0*66*c54842eed9b536e1fafad46aa233a6c158bd1fcabeed6b91531d8331a3452466d02446586b9b6837b510efbe95bb9f91c92d258be82f65092483812b896af3d4aa28*3*18*2*9*65536*b2688a012358b7fa", "openwall"},
101 {NULL}
102 };
103
104 // mul is at most (PLAINTEXT_LENGTH + SALT_LENGTH)
105 #define KEYBUFFER_LENGTH ((PLAINTEXT_LENGTH + SALT_LENGTH) * 64)
106
107 // Returns the block size (in bytes) of a given cipher
gpg_common_blockSize(char algorithm)108 uint32_t gpg_common_blockSize(char algorithm)
109 {
110 switch (algorithm) {
111 case CIPHER_CAST5:
112 return CAST_BLOCK;
113 case CIPHER_BLOWFISH:
114 return BF_BLOCK;
115 case CIPHER_IDEA:
116 return 8;
117 case CIPHER_AES128:
118 case CIPHER_AES192:
119 case CIPHER_AES256:
120 return AES_BLOCK_SIZE;
121 case CIPHER_CAMELLIA128:
122 case CIPHER_CAMELLIA192:
123 case CIPHER_CAMELLIA256:
124 return CAMELLIA_BLOCK_SIZE;
125 case CIPHER_TWOFISH:
126 return 16;
127 case CIPHER_3DES:
128 return 8;
129 default:
130 break;
131 }
132 return 0;
133 }
134
135 // Returns the key size (in bytes) of a given cipher
gpg_common_keySize(char algorithm)136 uint32_t gpg_common_keySize(char algorithm)
137 {
138 switch (algorithm) {
139 case CIPHER_CAST5:
140 return CAST_KEY_LENGTH; // 16
141 case CIPHER_BLOWFISH:
142 return 16;
143 case CIPHER_AES128:
144 return 16;
145 case CIPHER_AES192:
146 return 24;
147 case CIPHER_AES256:
148 return 32;
149 case CIPHER_IDEA:
150 return 16;
151 case CIPHER_3DES:
152 return 24;
153 case CIPHER_TWOFISH:
154 return 32;
155 case CIPHER_CAMELLIA128:
156 return 16;
157 case CIPHER_CAMELLIA192:
158 return 24;
159 case CIPHER_CAMELLIA256:
160 return 32;
161 default: break;
162 }
163 assert(0);
164 return 0;
165 }
166
gpg_common_valid_cipher_algorithm(int cipher_algorithm)167 static int gpg_common_valid_cipher_algorithm(int cipher_algorithm)
168 {
169 switch(cipher_algorithm) {
170 case CIPHER_CAST5: return 1;
171 case CIPHER_BLOWFISH: return 1;
172 case CIPHER_AES128: return 1;
173 case CIPHER_AES192: return 1;
174 case CIPHER_AES256: return 1;
175 case CIPHER_IDEA: return 1;
176 case CIPHER_3DES: return 1;
177 case CIPHER_TWOFISH: return 1;
178 case CIPHER_CAMELLIA128: return 1;
179 case CIPHER_CAMELLIA192: return 1;
180 case CIPHER_CAMELLIA256: return 1;
181 }
182
183 return 0;
184 }
185
gpg_common_valid_hash_algorithm(int hash_algorithm,int spec,int isCPU)186 static int gpg_common_valid_hash_algorithm(int hash_algorithm, int spec, int isCPU)
187 {
188 static int warn_once = 1;
189
190 if (spec == SPEC_SIMPLE || spec == SPEC_SALTED) {
191 if (!isCPU)
192 goto print_warn_once;
193 switch (hash_algorithm) {
194 case HASH_SHA1: return 1;
195 case HASH_MD5: return 1;
196 case 0: return 1; // http://www.ietf.org/rfc/rfc1991.txt
197 }
198 }
199 if (spec == SPEC_ITERATED_SALTED) {
200 if (!isCPU) {
201 if (hash_algorithm == HASH_SHA1 || hash_algorithm == HASH_SHA256 || hash_algorithm == HASH_SHA512)
202 return 1;
203 goto print_warn_once;
204 }
205 switch (hash_algorithm) {
206 case HASH_SHA1: return 1;
207 case HASH_MD5: return 1;
208 case HASH_RIPEMD160: return 1;
209 case HASH_SHA256: return 1;
210 case HASH_SHA384: return 1;
211 case HASH_SHA512: return 1;
212 case HASH_SHA224: return 1;
213 }
214 }
215 return 0;
216
217 print_warn_once:
218 if (warn_once) {
219 fprintf(stderr,
220 "Error: This GPG OpenCL format does not support the requested S2K type!\n");
221 warn_once = 0;
222 }
223 return 0;
224 }
225
gpg_common_valid(char * ciphertext,struct fmt_main * self,int is_CPU_format)226 int gpg_common_valid(char *ciphertext, struct fmt_main *self, int is_CPU_format)
227 {
228 char *ctcopy, *keeptr, *p;
229 int res,j,spec,usage,algorithm,ex_flds=0;
230 int symmetric_mode = 0, extra;
231
232 if (strncmp(ciphertext, FORMAT_TAG, FORMAT_TAG_LEN) != 0)
233 return 0;
234 ctcopy = strdup(ciphertext);
235 keeptr = ctcopy;
236 ctcopy += FORMAT_TAG_LEN; /* skip over "$gpg$" marker and '*' */
237 if ((p = strtokm(ctcopy, "*")) == NULL) /* algorithm */
238 goto err;
239 if (!isdec(p))
240 goto err;
241 algorithm = atoi(p); // FIXME: which values are valid?
242 if (algorithm == 0) { // files using GPG symmetric encryption?
243 symmetric_mode = 1;
244 }
245 if ((p = strtokm(NULL, "*")) == NULL) /* datalen */
246 goto err;
247 if (!isdec(p))
248 goto err;
249 res = atoi(p);
250 if (!symmetric_mode) {
251 if ((p = strtokm(NULL, "*")) == NULL) /* bits */
252 goto err;
253 if (!isdec(p)) // FIXME: bits == 0 allowed?
254 goto err;
255 }
256 if ((p = strtokm(NULL, "*")) == NULL) /* data */
257 goto err;
258 if (hexlenl(p, &extra) != res*2 || extra)
259 goto err;
260 if ((p = strtokm(NULL, "*")) == NULL) /* spec */
261 goto err;
262 if (!isdec(p))
263 goto err;
264 spec = atoi(p);
265 if ((p = strtokm(NULL, "*")) == NULL) /* usage */
266 goto err;
267 if (!isdec(p))
268 goto err;
269 usage = atoi(p);
270 if (!symmetric_mode) {
271 if (usage != 0 && usage != 254 && usage != 255) // && usage != 1)
272 goto err;
273 } else {
274 if (usage != 9 && usage != 18) // https://tools.ietf.org/html/rfc4880
275 goto err;
276 if (!bench_or_test_running && usage == 9) {
277 self->params.flags |= FMT_NOT_EXACT;
278 }
279 }
280 if ((p = strtokm(NULL, "*")) == NULL) /* hash_algorithm */
281 goto err;
282 if (!isdec(p))
283 goto err;
284 res = atoi(p);
285 if (!gpg_common_valid_hash_algorithm(res, spec, is_CPU_format))
286 goto err;
287 if ((p = strtokm(NULL, "*")) == NULL) /* cipher_algorithm */
288 goto err;
289 if (!isdec(p))
290 goto err;
291 res = atoi(p);
292 if (!gpg_common_valid_cipher_algorithm(res))
293 goto err;
294 if (!symmetric_mode) {
295 if ((p = strtokm(NULL, "*")) == NULL) /* ivlen */
296 goto err;
297 if (!isdec(p))
298 goto err;
299 res = atoi(p);
300 if (res != 8 && res != 16)
301 goto err;
302 if ((p = strtokm(NULL, "*")) == NULL) /* iv */
303 goto err;
304 if (hexlenl(p, &extra) != res*2 || extra)
305 goto err;
306 }
307 /* handle "SPEC_SIMPLE" correctly */
308 if ((spec != 0 || usage == 255))
309 ;
310 else if (spec == 0) {
311 MEM_FREE(keeptr);
312 return 1;
313 }
314 if ((p = strtokm(NULL, "*")) == NULL) /* count */
315 goto err;
316 if (!isdec(p)) // FIXME: count == 0 allowed?
317 goto err;
318 if ((p = strtokm(NULL, "*")) == NULL) /* salt */
319 goto err;
320 if (hexlenl(p, &extra) != SALT_LENGTH*2 || extra)
321 goto err;
322 /*
323 * For some test vectors, there are no more fields,
324 * for others, there are (and need to be checked)
325 * this logic taken from what happens in salt()
326 */
327 if (usage == 255 && spec == 1 && algorithm == 17) {
328 /* old hashes will crash!, "gpg --s2k-mode 1 --gen-key" */
329 ex_flds = 4; /* handle p, q, g, y */
330 } else if (usage == 255 && spec == 1 && algorithm == 16) {
331 /* ElGamal */
332 ex_flds = 3; /* handle p, g, y */
333 } else if (usage == 255 && spec == 1) {
334 /* RSA */
335 ex_flds = 1; /* handle p */
336 } else if (usage == 255 && spec == 3 && algorithm == 1) {
337 /* gpg --homedir . --s2k-cipher-algo 3des --simple-sk-checksum --gen-key */
338 // PKA_RSA_ENCSIGN
339 ex_flds = 1; /* handle p */
340 } else if (usage == 255 && spec == 3 && algorithm == 17) {
341 // NEW stuff
342 // PKA_DSA
343 ex_flds = 4; /* handle p, q, g, y */
344 } else if (usage == 255 && spec == 3 && algorithm == 16) {
345 // NEW stuff
346 // PKA_ELGAMAL
347 ex_flds = 3; /* handle p, g, y */
348 } else {
349 /* NOT sure what to do here, probably nothing */
350 }
351
352 p = strtokm(NULL, "*"); /* NOTE, do not goto err if null, we WANT p nul if there are no fields */
353
354 if (symmetric_mode) {
355 goto good;
356 }
357
358 for (j = 0; j < ex_flds; ++j) { /* handle extra p, q, g, y fields */
359 if (!p) /* check for null p */
360 goto err;
361 if (!isdec(p))
362 goto err;
363 res = atoi(p);
364 if ((p = strtokm(NULL, "*")) == NULL)
365 goto err;
366 if (hexlenl(p, &extra) != res*2 || extra)
367 goto err;
368 p = strtokm(NULL, "*"); /* NOTE, do not goto err if null, we WANT p nul if there are no fields */
369 }
370
371 if (p) /* at this point, there should be NO trailing stuff left from the hash. */
372 goto err;
373
374 good:
375 MEM_FREE(keeptr);
376 return 1;
377
378 err:
379 MEM_FREE(keeptr);
380 return 0;
381 }
382
383 // For all generator functions below:
384 // Max keysize is 32, min hashsize is 16. So numHashes is 1 or 2.
S2KSimpleSHA1Generator(char * password,unsigned char * key,int length)385 static void S2KSimpleSHA1Generator(char *password, unsigned char *key, int length)
386 {
387 SHA_CTX ctx;
388 uint32_t numHashes = (length + SHA_DIGEST_LENGTH - 1) / SHA_DIGEST_LENGTH;
389 int i, j;
390
391 for (i = 0; i < numHashes; i++) {
392 SHA1_Init(&ctx);
393 for (j = 0; j < i; j++) {
394 SHA1_Update(&ctx, "\0", 1);
395 }
396 SHA1_Update(&ctx, password, strlen(password));
397 SHA1_Final(key + (i * SHA_DIGEST_LENGTH), &ctx);
398 }
399 }
400
S2KSimpleMD5Generator(char * password,unsigned char * key,int length)401 static void S2KSimpleMD5Generator(char *password, unsigned char *key, int length)
402 {
403 MD5_CTX ctx;
404 uint32_t numHashes = (length + MD5_DIGEST_LENGTH - 1) / MD5_DIGEST_LENGTH;
405 int i, j;
406
407 for (i = 0; i < numHashes; i++) {
408 MD5_Init(&ctx);
409 for (j = 0; j < i; j++) {
410 MD5_Update(&ctx, "\0", 1);
411 }
412 MD5_Update(&ctx, password, strlen(password));
413 MD5_Final(key + (i * MD5_DIGEST_LENGTH), &ctx);
414 }
415 }
416
417
S2KSaltedSHA1Generator(char * password,unsigned char * key,int length)418 static void S2KSaltedSHA1Generator(char *password, unsigned char *key, int length)
419 {
420 SHA_CTX ctx;
421 uint32_t numHashes = (length + SHA_DIGEST_LENGTH - 1) / SHA_DIGEST_LENGTH;
422 int i, j;
423
424 for (i = 0; i < numHashes; i++) {
425 SHA1_Init(&ctx);
426 for (j = 0; j < i; j++) {
427 SHA1_Update(&ctx, "\0", 1);
428 }
429 SHA1_Update(&ctx, gpg_common_cur_salt->salt, SALT_LENGTH);
430 SHA1_Update(&ctx, password, strlen(password));
431 SHA1_Final(key + (i * SHA_DIGEST_LENGTH), &ctx);
432 }
433 }
434
S2KSaltedMD5Generator(char * password,unsigned char * key,int length)435 static void S2KSaltedMD5Generator(char *password, unsigned char *key, int length)
436 {
437 MD5_CTX ctx;
438 uint32_t numHashes = (length + MD5_DIGEST_LENGTH - 1) / MD5_DIGEST_LENGTH;
439 int i, j;
440
441 for (i = 0; i < numHashes; i++) {
442 MD5_Init(&ctx);
443 for (j = 0; j < i; j++) {
444 MD5_Update(&ctx, "\0", 1);
445 }
446 MD5_Update(&ctx, gpg_common_cur_salt->salt, SALT_LENGTH);
447 MD5_Update(&ctx, password, strlen(password));
448 MD5_Final(key + (i * MD5_DIGEST_LENGTH), &ctx);
449 }
450 }
451
452 //#define LEAN
453
454 // Note, using this as 'test-bed' for writing the GPU code.
455 // trying to minimize variables, reusing them if possible.
S2KItSaltedSHA1Generator(char * password,unsigned char * key,int key_len)456 static void S2KItSaltedSHA1Generator(char *password, unsigned char *key, int key_len)
457 {
458 // vars needed to 'fake' data like we see on GPU
459 unsigned char *salt = gpg_common_cur_salt->salt;
460 uint32_t _count = gpg_common_cur_salt->count;
461
462 SHA_CTX ctx;
463 uint32_t password_length = strlen(password);
464 const uint32_t tl = password_length + SALT_LENGTH;
465 uint32_t i, j, n, count;
466 #ifdef LEAN
467 uint8_t keybuf[128 + 64+1 + PLAINTEXT_LENGTH + SALT_LENGTH];
468 #else
469 unsigned char keybuf[KEYBUFFER_LENGTH + 256];
470 uint32_t bs;
471 #endif
472
473 for (i = 0;;++i) {
474 count = _count;
475 SHA1_Init(&ctx);
476 #ifdef LEAN
477 for (j=0;j<i;++j)
478 keybuf[j] = 0;
479 n = j;
480 memcpy(keybuf + j, salt, SALT_LENGTH);
481 memcpy(keybuf + j + SALT_LENGTH, password, password_length);
482 j += tl;
483
484 while (j < 128 + 64+1) {
485 memcpy(keybuf + j, keybuf + n, tl);
486 j += tl;
487 }
488
489 SHA1_Update(&ctx, keybuf, 64);
490 count -= (64-i);
491 j = 64;
492 while (count >= 64) {
493 SHA1_Update(&ctx, &keybuf[j], 64);
494 count -= 64;
495 j = j % tl + 64;
496 }
497 if (count) SHA1_Update(&ctx, &keybuf[j], count);
498 #else
499 // Find multiplicator
500 n = 1;
501 while (n < tl && ((64 * n) % tl)) {
502 ++n;
503 }
504 // this is an optimization for oSSL builds (NOT for GPU I think)
505 // it does gain us about 10%, more for length 2/4/8/16 passwords
506 // which is case 1
507 #define BIGGER_SMALL_BUFS 1
508 #if BIGGER_SMALL_BUFS
509 if (n < 7) {
510 // evenly divisible multiples of each count. We simply want
511 // to cut down on the calls to SHA1_Update, I think.
512 //const uint32_t incs[] = {0,16,16,15,16,15,18,14,16,18};
513 const uint32_t incs[] = {0,8,8,9,8,10,12};
514 n = incs[n];
515 }
516 #endif
517 bs = n * 64;
518 j = 0;
519 if (i) {
520 for (j = 0; j < i; j++) {
521 keybuf[j] = 0;
522 }
523 }
524 n = j;
525
526 memcpy(keybuf + j, salt, SALT_LENGTH);
527 memcpy(keybuf + j + SALT_LENGTH, password, password_length);
528 j += tl;
529 while (j+i <= bs+64) { // bs+64 since we need 1 'pre' block that may be dirty.
530 memcpy(keybuf + j, keybuf + n, tl);
531 j += tl;
532 }
533 // first buffer 'may' have appended nulls. So we may actually
534 // be processing LESS than 64 bytes of the count. Thus we have
535 // -i in the count expression.
536 SHA1_Update(&ctx, keybuf, 64);
537 count -= (64-i);
538 while (count > bs) {
539 SHA1_Update(&ctx, keybuf + 64, bs);
540 count -= bs;
541 }
542 if (count) SHA1_Update(&ctx, keybuf + 64, count);
543 #endif
544 SHA1_Final(keybuf, &ctx);
545 j = i * SHA_DIGEST_LENGTH;
546 for (n = 0; j < key_len && n < SHA_DIGEST_LENGTH; ++j, ++n)
547 key[j] = keybuf[n];
548 if (j == key_len)
549 return;
550 }
551 }
552
553
S2KItSaltedSHA256Generator(char * password,unsigned char * key,int length)554 static void S2KItSaltedSHA256Generator(char *password, unsigned char *key, int length)
555 {
556 unsigned char keybuf[KEYBUFFER_LENGTH];
557 SHA256_CTX ctx;
558 int i, j;
559 int32_t tl;
560 int32_t mul;
561 int32_t bs;
562 uint8_t *bptr;
563 int32_t n;
564
565 uint32_t numHashes = (length + SHA256_DIGEST_LENGTH - 1) / SHA256_DIGEST_LENGTH;
566 memcpy(keybuf, gpg_common_cur_salt->salt, SALT_LENGTH);
567
568 // TODO: This is not very efficient with multiple hashes
569 // NOTE, with 32 bit hash digest, we should never have numHashes > 1 if
570 // all keys being requested are 32 bytes or less.
571 for (i = 0; i < numHashes; i++) {
572 SHA256_Init(&ctx);
573 for (j = 0; j < i; j++) {
574 SHA256_Update(&ctx, "\0", 1);
575 }
576 // Find multiplicator
577 tl = strlen(password) + SALT_LENGTH;
578 mul = 1;
579 while (mul < tl && ((64 * mul) % tl)) {
580 ++mul;
581 }
582 // Try to feed the hash function with 64-byte blocks
583 bs = mul * 64;
584 bptr = keybuf + tl;
585 n = bs / tl;
586 memcpy(keybuf + SALT_LENGTH, password, strlen(password));
587 while (n-- > 1) {
588 memcpy(bptr, keybuf, tl);
589 bptr += tl;
590 }
591 n = gpg_common_cur_salt->count / bs;
592 while (n-- > 0) {
593 SHA256_Update(&ctx, keybuf, bs);
594 }
595 SHA256_Update(&ctx, keybuf, gpg_common_cur_salt->count % bs);
596 SHA256_Final(key + (i * SHA256_DIGEST_LENGTH), &ctx);
597 }
598 }
599
S2KItSaltedSHA224Generator(char * password,unsigned char * key,int length)600 static void S2KItSaltedSHA224Generator(char *password, unsigned char *key, int length)
601 {
602 unsigned char keybuf[KEYBUFFER_LENGTH];
603 SHA256_CTX ctx;
604 int i, j;
605 int32_t tl;
606 int32_t mul;
607 int32_t bs;
608 uint8_t *bptr;
609 int32_t n;
610
611 uint32_t numHashes = (length + SHA224_DIGEST_LENGTH - 1) / SHA224_DIGEST_LENGTH;
612 memcpy(keybuf, gpg_common_cur_salt->salt, SALT_LENGTH);
613
614 // TODO: This is not very efficient with multiple hashes
615 // NOTE, with 32 bit hash digest, we should never have numHashes > 1 if
616 // all keys being requested are 32 bytes or less.
617 for (i = 0; i < numHashes; i++) {
618 SHA224_Init(&ctx);
619 for (j = 0; j < i; j++) {
620 SHA224_Update(&ctx, "\0", 1);
621 }
622 // Find multiplicator
623 tl = strlen(password) + SALT_LENGTH;
624 mul = 1;
625 while (mul < tl && ((64 * mul) % tl)) {
626 ++mul;
627 }
628 // Try to feed the hash function with 64-byte blocks
629 bs = mul * 64;
630 bptr = keybuf + tl;
631 n = bs / tl;
632 memcpy(keybuf + SALT_LENGTH, password, strlen(password));
633 while (n-- > 1) {
634 memcpy(bptr, keybuf, tl);
635 bptr += tl;
636 }
637 n = gpg_common_cur_salt->count / bs;
638 while (n-- > 0) {
639 SHA224_Update(&ctx, keybuf, bs);
640 }
641 SHA224_Update(&ctx, keybuf, gpg_common_cur_salt->count % bs);
642 SHA224_Final(key + (i * SHA224_DIGEST_LENGTH), &ctx);
643 }
644 }
645
S2KItSaltedSHA512Generator(char * password,unsigned char * key,int length)646 static void S2KItSaltedSHA512Generator(char *password, unsigned char *key, int length)
647 {
648 // keybuf needs to be twice as large, since we group to 128 byte blocks.
649 unsigned char keybuf[KEYBUFFER_LENGTH*2];
650 SHA512_CTX ctx;
651 int i, j;
652 int32_t tl;
653 int32_t mul;
654 int32_t bs;
655 uint8_t *bptr;
656 int32_t n;
657
658 uint32_t numHashes = (length + SHA512_DIGEST_LENGTH - 1) / SHA512_DIGEST_LENGTH;
659 memcpy(keybuf, gpg_common_cur_salt->salt, SALT_LENGTH);
660
661 // TODO: This is not very efficient with multiple hashes
662 // NOTE, with 64 bit hash digest, we should never have numHashes > 1 if
663 // all keys being requested are 32 bytes or less.
664 for (i = 0; i < numHashes; i++) {
665 SHA512_Init(&ctx);
666 for (j = 0; j < i; j++) {
667 SHA512_Update(&ctx, "\0", 1);
668 }
669 // Find multiplicator
670 tl = strlen(password) + SALT_LENGTH;
671 mul = 1;
672 while (mul < tl && ((128 * mul) % tl)) {
673 ++mul;
674 }
675 // Try to feed the hash function with 128-byte blocks
676 bs = mul * 128;
677 bptr = keybuf + tl;
678 n = bs / tl;
679 memcpy(keybuf + SALT_LENGTH, password, strlen(password));
680 while (n-- > 1) {
681 memcpy(bptr, keybuf, tl);
682 bptr += tl;
683 }
684 n = gpg_common_cur_salt->count / bs;
685 while (n-- > 0) {
686 SHA512_Update(&ctx, keybuf, bs);
687 }
688 SHA512_Update(&ctx, keybuf, gpg_common_cur_salt->count % bs);
689 SHA512_Final(key + (i * SHA512_DIGEST_LENGTH), &ctx);
690 }
691 }
692
S2KItSaltedSHA384Generator(char * password,unsigned char * key,int length)693 static void S2KItSaltedSHA384Generator(char *password, unsigned char *key, int length)
694 {
695 // keybuf needs to be twice as large, since we group to 128 byte blocks.
696 unsigned char keybuf[KEYBUFFER_LENGTH*2];
697 SHA512_CTX ctx;
698 int i, j;
699 int32_t tl;
700 int32_t mul;
701 int32_t bs;
702 uint8_t *bptr;
703 int32_t n;
704
705 uint32_t numHashes = (length + SHA384_DIGEST_LENGTH - 1) / SHA384_DIGEST_LENGTH;
706 memcpy(keybuf, gpg_common_cur_salt->salt, SALT_LENGTH);
707
708 // TODO: This is not very efficient with multiple hashes
709 // NOTE, with 64 bit hash digest, we should never have numHashes > 1 if
710 // all keys being requested are 32 bytes or less.
711 for (i = 0; i < numHashes; i++) {
712 SHA384_Init(&ctx);
713 for (j = 0; j < i; j++) {
714 SHA384_Update(&ctx, "\0", 1);
715 }
716 // Find multiplicator
717 tl = strlen(password) + SALT_LENGTH;
718 mul = 1;
719 while (mul < tl && ((128 * mul) % tl)) {
720 ++mul;
721 }
722 // Try to feed the hash function with 128-byte blocks
723 bs = mul * 128;
724 bptr = keybuf + tl;
725 n = bs / tl;
726 memcpy(keybuf + SALT_LENGTH, password, strlen(password));
727 while (n-- > 1) {
728 memcpy(bptr, keybuf, tl);
729 bptr += tl;
730 }
731 n = gpg_common_cur_salt->count / bs;
732 while (n-- > 0) {
733 SHA384_Update(&ctx, keybuf, bs);
734 }
735 SHA384_Update(&ctx, keybuf, gpg_common_cur_salt->count % bs);
736 SHA384_Final(key + (i * SHA384_DIGEST_LENGTH), &ctx);
737 }
738 }
739
S2KItSaltedRIPEMD160Generator(char * password,unsigned char * key,int length)740 static void S2KItSaltedRIPEMD160Generator(char *password, unsigned char *key, int length)
741 {
742 unsigned char keybuf[KEYBUFFER_LENGTH + 256];
743 RIPEMD160_CTX ctx;
744 int i, j;
745 int32_t tl;
746 int32_t mul;
747 int32_t bs;
748 uint8_t *bptr, *sptr;
749 int32_t n, n2, n3;
750
751 uint32_t numHashes = (length + RIPEMD160_DIGEST_LENGTH - 1) / RIPEMD160_DIGEST_LENGTH;
752
753 for (i = 0; i < numHashes; i++) {
754 RIPEMD160_Init(&ctx);
755 // Find multiplicator
756 tl = strlen(password) + SALT_LENGTH;
757 mul = 1;
758 // +i added for leading nulls
759 while (mul < tl && ((64 * mul) % tl)) {
760 ++mul;
761 }
762 bptr = keybuf;
763 if (i) {
764 for (j = 0; j < i; j++) {
765 *bptr++ = 0;
766 }
767 }
768 // Try to feed the hash function with 64-byte blocks
769 bs = mul * 64;
770 n = bs / tl;
771 // compute n2. it is the count we 'really' need to completely fill at lease 1 buffer past normal.
772 n2 = n;
773 n3 = bs;
774 while (n3 < bs+64) {
775 ++n2;
776 n3 += tl;
777 }
778 n3 = n2;
779 sptr = bptr;
780 memcpy(bptr, gpg_common_cur_salt->salt, SALT_LENGTH);
781 bptr += SALT_LENGTH;
782 memcpy(bptr, password, strlen(password));
783 bptr += strlen(password);
784 while (n2-- > 1) {
785 memcpy(bptr, sptr, tl);
786 bptr += tl;
787 }
788 // note first 64 byte block is handled specially, SO we have to remove the
789 // number of bytes of salt-pw contained within that block, from the count
790 // value when computing count/bs and count%bs. The correct amount of bytes
791 // processed is (64 - i)
792 n = (gpg_common_cur_salt->count - (64-i)) / bs;
793 // first buffer 'may' have appended nulls. BUT we may actually be processing
794 // LESS than 64 bytes of the count.
795 RIPEMD160_Update(&ctx, keybuf, 64);
796 while (n-- > 0) {
797 RIPEMD160_Update(&ctx, &keybuf[64], bs);
798 }
799 RIPEMD160_Update(&ctx, &keybuf[64], (gpg_common_cur_salt->count - (64-i)) % bs);
800 RIPEMD160_Final(key + (i * RIPEMD160_DIGEST_LENGTH), &ctx);
801 }
802 }
S2KItSaltedMD5Generator(char * password,unsigned char * key,int length)803 static void S2KItSaltedMD5Generator(char *password, unsigned char *key, int length)
804 {
805 MD5_CTX ctx;
806 unsigned char keybuf[KEYBUFFER_LENGTH];
807 int i, j;
808 int32_t tl;
809 int32_t mul;
810 int32_t bs;
811 uint8_t *bptr;
812 int32_t n;
813
814 uint32_t numHashes = (length + MD5_DIGEST_LENGTH - 1) / MD5_DIGEST_LENGTH;
815 memcpy(keybuf, gpg_common_cur_salt->salt, SALT_LENGTH);
816 // TODO: This is not very efficient with multiple hashes
817 for (i = 0; i < numHashes; i++) {
818 MD5_Init(&ctx);
819 for (j = 0; j < i; j++) {
820 MD5_Update(&ctx, "\0", 1);
821 }
822 // Find multiplicator
823 tl = strlen(password) + SALT_LENGTH;
824 mul = 1;
825 while (mul < tl && ((64 * mul) % tl)) {
826 ++mul;
827 }
828
829 // Try to feed the hash function with 64-byte blocks
830 bs = mul * 64;
831 bptr = keybuf + tl;
832 n = bs / tl;
833 memcpy(keybuf + SALT_LENGTH, password, strlen(password));
834 while (n-- > 1) {
835 memcpy(bptr, keybuf, tl);
836 bptr += tl;
837 }
838 n = gpg_common_cur_salt->count / bs;
839 while (n-- > 0) {
840 MD5_Update(&ctx, keybuf, bs);
841 }
842 MD5_Update(&ctx, keybuf, gpg_common_cur_salt->count % bs);
843 MD5_Final(key + (i * MD5_DIGEST_LENGTH), &ctx);
844 }
845 }
846
gpg_common_get_salt(char * ciphertext)847 void *gpg_common_get_salt(char *ciphertext)
848 {
849 char *ctcopy = strdup(ciphertext);
850 char *keeptr = ctcopy;
851 int i;
852 char *p;
853 struct gpg_common_custom_salt cs, *psalt;
854 static unsigned char *ptr;
855
856 memset(&cs, 0, sizeof(cs));
857 if (!ptr) ptr = mem_alloc_tiny(sizeof(struct gpg_common_custom_salt*),sizeof(struct gpg_common_custom_salt*));
858 ctcopy += FORMAT_TAG_LEN; /* skip over "$gpg$" marker and first '*' */
859 p = strtokm(ctcopy, "*");
860 cs.pk_algorithm = atoi(p);
861 if (cs.pk_algorithm == 0) {
862 cs.symmetric_mode = 1;
863 }
864 p = strtokm(NULL, "*");
865 cs.datalen = atoi(p);
866
867 /* Ok, now we 'know' the size of the dyna salt, so we can allocate */
868 /* note the +64 is due to certain algo's reading dirty data, up to 64 bytes past end */
869 psalt = mem_calloc(sizeof(struct gpg_common_custom_salt) + cs.datalen + 64, 1);
870 psalt->pk_algorithm = cs.pk_algorithm;
871 psalt->symmetric_mode = cs.symmetric_mode;
872 psalt->datalen = cs.datalen;
873
874 /* from now on we use psalt */
875 if (!psalt->symmetric_mode) {
876 p = strtokm(NULL, "*");
877 psalt->bits = atoi(p);
878 }
879 p = strtokm(NULL, "*");
880
881 for (i = 0; i < psalt->datalen; i++)
882 psalt->data[i] =
883 atoi16[ARCH_INDEX(p[i * 2])] * 16 +
884 atoi16[ARCH_INDEX(p[i * 2 + 1])];
885 p = strtokm(NULL, "*");
886 psalt->spec = atoi(p);
887 p = strtokm(NULL, "*");
888 psalt->usage = atoi(p);
889 p = strtokm(NULL, "*");
890 psalt->hash_algorithm = atoi(p);
891 p = strtokm(NULL, "*");
892 psalt->cipher_algorithm = atoi(p);
893 if (!psalt->symmetric_mode) {
894 p = strtokm(NULL, "*");
895 psalt->ivlen = atoi(p);
896 p = strtokm(NULL, "*");
897 for (i = 0; i < psalt->ivlen; i++)
898 psalt->iv[i] =
899 atoi16[ARCH_INDEX(p[i * 2])] * 16 +
900 atoi16[ARCH_INDEX(p[i * 2 + 1])];
901 }
902 p = strtokm(NULL, "*");
903 /* handle "SPEC_SIMPLE" correctly */
904 if (psalt->spec != SPEC_SIMPLE || psalt->usage == 255) {
905 psalt->count = atoi(p);
906 p = strtokm(NULL, "*");
907 for (i = 0; i < SALT_LENGTH; i++)
908 psalt->salt[i] =
909 atoi16[ARCH_INDEX(p[i * 2])] * 16 +
910 atoi16[ARCH_INDEX(p[i * 2 + 1])];
911 }
912 if (psalt->usage == 255 && (psalt->spec == SPEC_SALTED || psalt->spec == SPEC_ITERATED_SALTED) && psalt->pk_algorithm == PKA_DSA) {
913 /* old hashes will crash!, "gpg --s2k-mode 1 --gen-key" */
914 p = strtokm(NULL, "*");
915 psalt->pl = atoi(p);
916 p = strtokm(NULL, "*");
917 for (i = 0; i < strlen(p) / 2; i++)
918 psalt->p[i] = atoi16[ARCH_INDEX(p[i * 2])] * 16 +
919 atoi16[ARCH_INDEX(p[i * 2 + 1])];
920 p = strtokm(NULL, "*");
921 psalt->ql = atoi(p);
922 p = strtokm(NULL, "*");
923 for (i = 0; i < strlen(p) / 2; i++)
924 psalt->q[i] = atoi16[ARCH_INDEX(p[i * 2])] * 16 +
925 atoi16[ARCH_INDEX(p[i * 2 + 1])];
926 p = strtokm(NULL, "*");
927 psalt->gl = atoi(p);
928 p = strtokm(NULL, "*");
929 for (i = 0; i < strlen(p) / 2; i++)
930 psalt->g[i] = atoi16[ARCH_INDEX(p[i * 2])] * 16 +
931 atoi16[ARCH_INDEX(p[i * 2 + 1])];
932 p = strtokm(NULL, "*");
933 psalt->yl = atoi(p);
934 p = strtokm(NULL, "*");
935 for (i = 0; i < strlen(p) / 2; i++)
936 psalt->y[i] = atoi16[ARCH_INDEX(p[i * 2])] * 16 +
937 atoi16[ARCH_INDEX(p[i * 2 + 1])];
938 }
939 if (psalt->usage == 255 && (psalt->spec == SPEC_SALTED || psalt->spec == SPEC_ITERATED_SALTED) && (psalt->pk_algorithm == PKA_ELGAMAL || psalt->pk_algorithm == PKA_EG)) {
940 /* ElGamal */
941 p = strtokm(NULL, "*");
942 psalt->pl = atoi(p);
943 p = strtokm(NULL, "*");
944 for (i = 0; i < strlen(p) / 2; i++)
945 psalt->p[i] = atoi16[ARCH_INDEX(p[i * 2])] * 16 +
946 atoi16[ARCH_INDEX(p[i * 2 + 1])];
947 p = strtokm(NULL, "*");
948 psalt->gl = atoi(p);
949 p = strtokm(NULL, "*");
950 for (i = 0; i < strlen(p) / 2; i++)
951 psalt->g[i] = atoi16[ARCH_INDEX(p[i * 2])] * 16 +
952 atoi16[ARCH_INDEX(p[i * 2 + 1])];
953 p = strtokm(NULL, "*");
954 psalt->yl = atoi(p);
955 p = strtokm(NULL, "*");
956 for (i = 0; i < strlen(p) / 2; i++)
957 psalt->y[i] = atoi16[ARCH_INDEX(p[i * 2])] * 16 +
958 atoi16[ARCH_INDEX(p[i * 2 + 1])];
959 }
960 if (psalt->usage == 255 && psalt->pk_algorithm == PKA_RSA_ENCSIGN) {
961 /* RSA */
962 p = strtokm(NULL, "*");
963 psalt->nl = atoi(p);
964 p = strtokm(NULL, "*");
965 for (i = 0; i < strlen(p) / 2; i++)
966 psalt->n[i] = atoi16[ARCH_INDEX(p[i * 2])] * 16 +
967 atoi16[ARCH_INDEX(p[i * 2 + 1])];
968 }
969
970 MEM_FREE(keeptr);
971
972 // Set up the key generator
973 switch(psalt->spec) {
974 case SPEC_ITERATED_SALTED:
975 {
976 switch(psalt->hash_algorithm) {
977 case HASH_SHA1:
978 psalt->s2kfun = S2KItSaltedSHA1Generator;
979 break;
980 case HASH_MD5:
981 psalt->s2kfun = S2KItSaltedMD5Generator;
982 break;
983 case HASH_SHA256:
984 psalt->s2kfun = S2KItSaltedSHA256Generator;
985 break;
986 case HASH_RIPEMD160:
987 psalt->s2kfun = S2KItSaltedRIPEMD160Generator;
988 break;
989 case HASH_SHA512:
990 psalt->s2kfun = S2KItSaltedSHA512Generator;
991 break;
992 case HASH_SHA384:
993 psalt->s2kfun = S2KItSaltedSHA384Generator;
994 break;
995 case HASH_SHA224:
996 psalt->s2kfun = S2KItSaltedSHA224Generator;
997 break;
998 default: break;
999 }
1000 }
1001 break;
1002 case SPEC_SALTED:
1003 {
1004 switch(psalt->hash_algorithm) {
1005 case HASH_SHA1:
1006 psalt->s2kfun = S2KSaltedSHA1Generator;
1007 break;
1008 case HASH_MD5:
1009 psalt->s2kfun = S2KSaltedMD5Generator;
1010 break;
1011 default:
1012 // WTF? (see gpg_common_valid_hash_algorithm() function)
1013 psalt->s2kfun = S2KSaltedSHA1Generator;
1014 break;
1015 }
1016 }
1017 break;
1018 case SPEC_SIMPLE:
1019 {
1020 switch(psalt->hash_algorithm) {
1021 case HASH_SHA1:
1022 psalt->s2kfun = S2KSimpleSHA1Generator;
1023 break;
1024 case HASH_MD5:
1025 psalt->s2kfun = S2KSimpleMD5Generator;
1026 break;
1027 default:
1028 psalt->s2kfun = S2KSimpleSHA1Generator; // WTF?
1029 break;
1030 }
1031 }
1032 break;
1033 }
1034 assert(psalt->s2kfun != NULL);
1035
1036 // set the JtR core linkage stuff for this dyna_salt
1037 psalt->dsalt.salt_alloc_needs_free = 1; // we used mem_calloc, so JtR CAN free our pointer when done with them.
1038 psalt->dsalt.salt_cmp_offset = SALT_CMP_OFF(struct gpg_common_custom_salt, datalen);
1039 psalt->dsalt.salt_cmp_size = SALT_CMP_SIZE(struct gpg_common_custom_salt, datalen, data, psalt->datalen);
1040
1041 memcpy(ptr, &psalt, sizeof(struct gpg_common_custom_salt*));
1042 return (void*)ptr;
1043 }
give_multi_precision_integer(unsigned char * buf,int len,int * key_bytes,unsigned char * out)1044 static int give_multi_precision_integer(unsigned char *buf, int len, int *key_bytes, unsigned char *out)
1045 {
1046 int bytes;
1047 int i;
1048 int bits = buf[len] * 256;
1049 len++;
1050 bits += buf[len];
1051 len++;
1052 bytes = (bits + 7) / 8;
1053 *key_bytes = bytes;
1054
1055 for (i = 0; i < bytes; i++)
1056 out[i] = buf[len++];
1057
1058 return bytes + 2;
1059 }
1060
1061 // borrowed from "passe-partout" project
check_dsa_secret_key(DSA * dsa)1062 static int check_dsa_secret_key(DSA *dsa)
1063 {
1064 int error;
1065 int rc = -1;
1066 #if HAVE_DSA_GET0_PQG
1067 const BIGNUM *p, *q, *g, *pub_key, *priv_key;
1068 #endif
1069 BIGNUM *res = BN_new();
1070 BN_CTX *ctx = BN_CTX_new();
1071
1072 if (!res) {
1073 fprintf(stderr, "failed to allocate result BN in check_dsa_secret_key()\n");
1074 error();
1075 }
1076 if (!ctx) {
1077 fprintf(stderr, "failed to allocate BN_CTX ctx in check_dsa_secret_key()\n");
1078 error();
1079 }
1080
1081 #if HAVE_DSA_GET0_PQG
1082 DSA_get0_pqg(dsa, &p, &q, &g);
1083 DSA_get0_key(dsa, &pub_key, &priv_key);
1084 error = BN_mod_exp(res, g, priv_key, p, ctx);
1085 #else
1086 error = BN_mod_exp(res, dsa->g, dsa->priv_key, dsa->p, ctx);
1087 #endif
1088
1089 if ( error == 0 ) {
1090 goto freestuff;
1091 }
1092
1093 #if HAVE_DSA_GET0_PQG
1094 rc = BN_cmp(res, pub_key);
1095 #else
1096 rc = BN_cmp(res, dsa->pub_key);
1097 #endif
1098
1099 freestuff:
1100
1101 BN_CTX_free(ctx);
1102 BN_free(res);
1103 #if !HAVE_DSA_GET0_PQG
1104 BN_free(dsa->g);
1105 BN_free(dsa->q);
1106 BN_free(dsa->p);
1107 BN_free(dsa->pub_key);
1108 BN_free(dsa->priv_key);
1109 #endif
1110 return rc;
1111 }
1112
1113 typedef struct {
1114 BIGNUM *p; /* prime */
1115 BIGNUM *g; /* group generator */
1116 BIGNUM *y; /* g^x mod p */
1117 BIGNUM *x; /* secret exponent */
1118 } ElGamal_secret_key;
1119
1120 // borrowed from GnuPG
check_elg_secret_key(ElGamal_secret_key * elg)1121 static int check_elg_secret_key(ElGamal_secret_key *elg)
1122 {
1123 int error;
1124 int rc = -1;
1125 BIGNUM *res = BN_new();
1126 BN_CTX *ctx = BN_CTX_new();
1127 if (!res) {
1128 fprintf(stderr, "failed to allocate result BN in check_elg_secret_key()\n");
1129 error();
1130 }
1131 if (!ctx) {
1132 fprintf(stderr, "failed to allocate BN_CTX ctx in chec_elg_secret_key()\n");
1133 error();
1134 }
1135
1136 error = BN_mod_exp(res, elg->g, elg->x, elg->p, ctx);
1137 if ( error == 0 ) {
1138 goto freestuff;
1139 }
1140
1141 rc = BN_cmp(res, elg->y);
1142
1143 freestuff:
1144
1145 BN_CTX_free(ctx);
1146 BN_free(res);
1147 BN_free(elg->g);
1148 BN_free(elg->p);
1149 BN_free(elg->y);
1150 BN_free(elg->x);
1151
1152 return rc;
1153 }
1154
1155 typedef struct {
1156 BIGNUM *p;
1157 BIGNUM *q;
1158 BIGNUM *n;
1159 } RSA_secret_key;
1160
1161 // borrowed from GnuPG
check_rsa_secret_key(RSA_secret_key * rsa)1162 static int check_rsa_secret_key(RSA_secret_key *rsa)
1163 {
1164 int error;
1165 int rc = -1;
1166 BIGNUM *res = BN_new();
1167 BN_CTX *ctx = BN_CTX_new();
1168 if (!res) {
1169 fprintf(stderr, "failed to allocate result BN in check_rsa_secret_key()\n");
1170 error();
1171 }
1172 if (!ctx) {
1173 fprintf(stderr, "failed to allocate BN_CTX ctx in chec_rsa_secret_key()\n");
1174 error();
1175 }
1176
1177 error = BN_mul(res, rsa->p, rsa->q, ctx);
1178 if ( error == 0 ) {
1179 goto freestuff;
1180 }
1181
1182 rc = BN_cmp(res, rsa->n); // p * q == n
1183
1184 freestuff:
1185
1186 BN_CTX_free(ctx);
1187 BN_free(res);
1188 BN_free(rsa->p);
1189 BN_free(rsa->q);
1190 BN_free(rsa->n);
1191
1192 return rc;
1193 }
1194
gpg_common_check(unsigned char * keydata,int ks)1195 int gpg_common_check(unsigned char *keydata, int ks)
1196 {
1197 // Decrypt first data block in order to check the first two bits of
1198 // the MPI. If they are correct, there's a good chance that the
1199 // password is correct, too.
1200 unsigned char ivec[32];
1201 unsigned char *out;
1202 int tmp = 0;
1203 uint32_t num_bits = 0;
1204 int checksumOk;
1205 int i;
1206 uint8_t checksum[SHA_DIGEST_LENGTH];
1207 SHA_CTX ctx;
1208 int block_size = 8;
1209
1210 // out is used for more than just data. So if datalen is 'small', but
1211 // other things (like mpz integer creation) are needed, we know that
1212 // our sizes will not overflow.
1213 out = mem_alloc((gpg_common_cur_salt->datalen) + 0x10000);
1214 // Quick Hack
1215 if (!gpg_common_cur_salt->symmetric_mode)
1216 memcpy(ivec, gpg_common_cur_salt->iv, gpg_common_blockSize(gpg_common_cur_salt->cipher_algorithm));
1217 else
1218 memset(ivec, 0, gpg_common_blockSize(gpg_common_cur_salt->cipher_algorithm));
1219
1220 switch (gpg_common_cur_salt->cipher_algorithm) {
1221 case CIPHER_IDEA: {
1222 IDEA_KEY_SCHEDULE iks;
1223 JtR_idea_set_encrypt_key(keydata, &iks);
1224 JtR_idea_cfb64_encrypt(gpg_common_cur_salt->data, out, SALT_LENGTH, &iks, ivec, &tmp, IDEA_DECRYPT);
1225 }
1226 break;
1227 case CIPHER_CAST5: {
1228 CAST_KEY ck;
1229 CAST_set_key(&ck, ks, keydata);
1230 CAST_cfb64_encrypt(gpg_common_cur_salt->data, out, CAST_BLOCK, &ck, ivec, &tmp, CAST_DECRYPT);
1231 }
1232 break;
1233 case CIPHER_BLOWFISH: {
1234 BF_KEY ck;
1235 BF_set_key(&ck, ks, keydata);
1236 BF_cfb64_encrypt(gpg_common_cur_salt->data, out, BF_BLOCK, &ck, ivec, &tmp, BF_DECRYPT);
1237 }
1238 break;
1239 case CIPHER_AES128:
1240 case CIPHER_AES192:
1241 case CIPHER_AES256: {
1242 AES_KEY ck;
1243 AES_set_encrypt_key(keydata, ks * 8, &ck);
1244 AES_cfb128_encrypt(gpg_common_cur_salt->data, out, AES_BLOCK_SIZE, &ck, ivec, &tmp, AES_DECRYPT);
1245 }
1246 break;
1247 case CIPHER_3DES: {
1248 DES_cblock key1, key2, key3;
1249 DES_cblock divec;
1250 DES_key_schedule ks1, ks2, ks3;
1251 int num = 0;
1252 memcpy(key1, keydata + 0, 8);
1253 memcpy(key2, keydata + 8, 8);
1254 memcpy(key3, keydata + 16, 8);
1255 memcpy(divec, ivec, 8);
1256 DES_set_key((DES_cblock *)key1, &ks1);
1257 DES_set_key((DES_cblock *)key2, &ks2);
1258 DES_set_key((DES_cblock *)key3, &ks3);
1259 DES_ede3_cfb64_encrypt(gpg_common_cur_salt->data, out, SALT_LENGTH, &ks1, &ks2, &ks3, &divec, &num, DES_DECRYPT);
1260 }
1261 break;
1262 case CIPHER_CAMELLIA128:
1263 case CIPHER_CAMELLIA192:
1264 case CIPHER_CAMELLIA256: {
1265 CAMELLIA_KEY ck;
1266 Camellia_set_key(keydata, ks * 8, &ck);
1267 Camellia_cfb128_encrypt(gpg_common_cur_salt->data, out, CAMELLIA_BLOCK_SIZE, &ck, ivec, &tmp, CAMELLIA_DECRYPT);
1268 }
1269 break;
1270 case CIPHER_TWOFISH: {
1271 Twofish_key ck;
1272 Twofish_prepare_key(keydata, ks, &ck);
1273 Twofish_Decrypt_cfb128(&ck, gpg_common_cur_salt->data, out, 16, ivec);
1274 }
1275 break;
1276 default:
1277 printf("(check) Unknown Cipher Algorithm %d ;(\n", gpg_common_cur_salt->cipher_algorithm);
1278 break;
1279 }
1280
1281 if (!gpg_common_cur_salt->symmetric_mode) {
1282 num_bits = ((out[0] << 8) | out[1]);
1283 if (num_bits < MIN_BN_BITS || num_bits > gpg_common_cur_salt->bits) {
1284 MEM_FREE(out);
1285 return 0;
1286 }
1287 }
1288 // Decrypt all data
1289 if (!gpg_common_cur_salt->symmetric_mode)
1290 memcpy(ivec, gpg_common_cur_salt->iv, gpg_common_blockSize(gpg_common_cur_salt->cipher_algorithm));
1291 else
1292 memset(ivec, 0, gpg_common_blockSize(gpg_common_cur_salt->cipher_algorithm));
1293 tmp = 0;
1294 switch (gpg_common_cur_salt->cipher_algorithm) {
1295 case CIPHER_IDEA: {
1296 IDEA_KEY_SCHEDULE iks;
1297 JtR_idea_set_encrypt_key(keydata, &iks);
1298 if (gpg_common_cur_salt->symmetric_mode && gpg_common_cur_salt->usage == 9) {
1299 JtR_idea_cfb64_encrypt(gpg_common_cur_salt->data, out, block_size + 2, &iks, ivec, &tmp, IDEA_DECRYPT);
1300 tmp = 0;
1301 memcpy(ivec, gpg_common_cur_salt->data + 2, block_size); // GCRY_CIPHER_ENABLE_SYNC, cipher_sync from libgcrypt
1302 JtR_idea_cfb64_encrypt(gpg_common_cur_salt->data + block_size + 2, out + block_size + 2, gpg_common_cur_salt->datalen - block_size - 2, &iks, ivec, &tmp, IDEA_DECRYPT);
1303 } else {
1304 JtR_idea_cfb64_encrypt(gpg_common_cur_salt->data, out, gpg_common_cur_salt->datalen, &iks, ivec, &tmp, IDEA_DECRYPT);
1305 }
1306 }
1307 break;
1308 case CIPHER_CAST5: {
1309 CAST_KEY ck;
1310 CAST_set_key(&ck, ks, keydata);
1311 if (gpg_common_cur_salt->symmetric_mode && gpg_common_cur_salt->usage == 9) {
1312 // handle PGP's weird CFB mode, do this for each cipher with block-size <= 8, take care of block-size!
1313 CAST_cfb64_encrypt(gpg_common_cur_salt->data, out, block_size + 2, &ck, ivec, &tmp, CAST_DECRYPT);
1314 tmp = 0;
1315 memcpy(ivec, gpg_common_cur_salt->data + 2, block_size); // GCRY_CIPHER_ENABLE_SYNC, cipher_sync from libgcrypt
1316 CAST_cfb64_encrypt(gpg_common_cur_salt->data + block_size + 2, out + block_size + 2, gpg_common_cur_salt->datalen - block_size - 2, &ck, ivec, &tmp, CAST_DECRYPT);
1317 } else {
1318 CAST_cfb64_encrypt(gpg_common_cur_salt->data, out, gpg_common_cur_salt->datalen, &ck, ivec, &tmp, CAST_DECRYPT);
1319 }
1320 }
1321 break;
1322 case CIPHER_BLOWFISH: {
1323 BF_KEY ck;
1324 BF_set_key(&ck, ks, keydata);
1325 BF_cfb64_encrypt(gpg_common_cur_salt->data, out, gpg_common_cur_salt->datalen, &ck, ivec, &tmp, BF_DECRYPT);
1326 }
1327 break;
1328 case CIPHER_AES128:
1329 case CIPHER_AES192:
1330 case CIPHER_AES256: {
1331 AES_KEY ck;
1332 AES_set_encrypt_key(keydata, ks * 8, &ck);
1333 block_size = 16;
1334 if (gpg_common_cur_salt->symmetric_mode && gpg_common_cur_salt->usage == 9) {
1335 AES_cfb128_encrypt(gpg_common_cur_salt->data, out, block_size + 2, &ck, ivec, &tmp, AES_DECRYPT);
1336 tmp = 0;
1337 memcpy(ivec, gpg_common_cur_salt->data + 2, block_size);
1338 AES_cfb128_encrypt(gpg_common_cur_salt->data + block_size + 2, out + block_size + 2, gpg_common_cur_salt->datalen - block_size - 2, &ck, ivec, &tmp, AES_DECRYPT);
1339 } else {
1340 AES_cfb128_encrypt(gpg_common_cur_salt->data, out, gpg_common_cur_salt->datalen, &ck, ivec, &tmp, AES_DECRYPT);
1341 }
1342 }
1343 break;
1344 case CIPHER_3DES: {
1345 DES_cblock key1, key2, key3;
1346 DES_cblock divec;
1347 DES_key_schedule ks1, ks2, ks3;
1348 int num = 0;
1349 memcpy(key1, keydata + 0, 8);
1350 memcpy(key2, keydata + 8, 8);
1351 memcpy(key3, keydata + 16, 8);
1352 memcpy(divec, ivec, 8);
1353 DES_set_key((DES_cblock *) key1, &ks1);
1354 DES_set_key((DES_cblock *) key2, &ks2);
1355 DES_set_key((DES_cblock *) key3, &ks3);
1356 if (gpg_common_cur_salt->symmetric_mode && gpg_common_cur_salt->usage == 9) {
1357 DES_ede3_cfb64_encrypt(gpg_common_cur_salt->data, out, block_size + 2, &ks1, &ks2, &ks3, &divec, &num, DES_DECRYPT);
1358 num = 0;
1359 memcpy(divec, gpg_common_cur_salt->data + 2, block_size); // GCRY_CIPHER_ENABLE_SYNC, cipher_sync from libgcrypt
1360 DES_ede3_cfb64_encrypt(gpg_common_cur_salt->data + block_size + 2, out + block_size + 2, gpg_common_cur_salt->datalen - block_size - 2, &ks1, &ks2, &ks3, &divec, &num, DES_DECRYPT);
1361 } else {
1362 DES_ede3_cfb64_encrypt(gpg_common_cur_salt->data, out, gpg_common_cur_salt->datalen, &ks1, &ks2, &ks3, &divec, &num, DES_DECRYPT);
1363 }
1364 }
1365 break;
1366 case CIPHER_CAMELLIA128:
1367 case CIPHER_CAMELLIA192:
1368 case CIPHER_CAMELLIA256: {
1369 CAMELLIA_KEY ck;
1370 Camellia_set_key(keydata, ks * 8, &ck);
1371 Camellia_cfb128_encrypt(gpg_common_cur_salt->data, out, gpg_common_cur_salt->datalen, &ck, ivec, &tmp, CAMELLIA_DECRYPT);
1372 }
1373 break;
1374 case CIPHER_TWOFISH: {
1375 Twofish_key ck;
1376 Twofish_prepare_key(keydata, ks, &ck);
1377
1378 block_size = 16;
1379 if (gpg_common_cur_salt->symmetric_mode && gpg_common_cur_salt->usage == 9) {
1380 Twofish_Decrypt_cfb128(&ck, gpg_common_cur_salt->data, out, block_size + 2, ivec);
1381 tmp = 0;
1382 memcpy(ivec, gpg_common_cur_salt->data + 2, block_size);
1383 Twofish_Decrypt_cfb128(&ck, gpg_common_cur_salt->data + block_size + 2, out + block_size + 2, gpg_common_cur_salt->datalen - block_size - 2, ivec);
1384 } else {
1385 Twofish_Decrypt_cfb128(&ck, gpg_common_cur_salt->data, out, gpg_common_cur_salt->datalen, ivec);
1386 }
1387 }
1388 break;
1389 default:
1390 break;
1391 }
1392
1393 if (gpg_common_cur_salt->symmetric_mode && gpg_common_cur_salt->usage == 18) { // uses zero IV (see g10/encrypt.c)!
1394 SHA1_Init(&ctx);
1395 SHA1_Update(&ctx, out, gpg_common_cur_salt->datalen - SHA_DIGEST_LENGTH);
1396 SHA1_Final(checksum, &ctx);
1397 if (memcmp(checksum, out + gpg_common_cur_salt->datalen - SHA_DIGEST_LENGTH, SHA_DIGEST_LENGTH) == 0) {
1398 MEM_FREE(out);
1399 return 1; /* we have a 20 byte verifier ;) */
1400 }
1401 MEM_FREE(out);
1402 return 0;
1403 } else if (gpg_common_cur_salt->symmetric_mode && gpg_common_cur_salt->usage == 9) {
1404 int ctb, new_ctb, pkttype, c, partial, lenbytes = 0;
1405 unsigned long pktlen;
1406 unsigned long idx = 0; // pointer in the "decrypted data + block_size + 2" stream
1407 unsigned char *p;
1408
1409 (void) pktlen;
1410 (void) partial;
1411
1412 // https://www.ietf.org/rfc/rfc2440.txt, http://www.ietf.org/rfc/rfc1991.txt,
1413 // and parse() from g10/parse-packet.c. This block contains code from GnuPG
1414 // which is copyrighted by FSF, Werner Koch, and g10 Code GmbH.
1415 if ((out[block_size + 1] != out[block_size - 1]) || (out[block_size] != out[block_size - 2]))
1416 goto bad;
1417 // The first byte of a packet is the so-called tag. The
1418 // highest bit must be set.
1419 p = &out[block_size + 2];
1420 ctb = p[0];
1421 if (!(ctb & 0x80)) {
1422 goto bad;
1423 }
1424
1425 // Immediately following the header is the length. There are
1426 // two formats: the old format and the new format. If bit 6
1427 // (where the least significant bit is bit 0) is set in the
1428 // tag, then we are dealing with a new format packet.
1429 // Otherwise, it is an old format packet.
1430 pktlen = 0;
1431 new_ctb = !!(ctb & 0x40);
1432 if (new_ctb) { // Used by PGP 8.0 from year 2002
1433 // Get the packet's type. This is encoded in the 6 least
1434 // significant bits of the tag.
1435 pkttype = ctb & 0x3f;
1436
1437 // Extract the packet's length. New format packets
1438 // have 4 ways to encode the packet length. The value
1439 // of the first byte determines the encoding and
1440 // partially determines the length. See section 4.2.2
1441 // of RFC 4880 for details.
1442 c = p[1];
1443 idx = 2;
1444 if (c < 192) {
1445 pktlen = c;
1446 } else if (c < 224) {
1447 pktlen = (c - 192) * 256;
1448 c = p[2];
1449 pktlen += c + 192;
1450 idx++;
1451 }
1452 else if (c == 255) {
1453 int i;
1454 char value[4];
1455 (void) value;
1456
1457 for (i = 0; i < 4; i ++) {
1458 c = p[2 + i];
1459 idx++;
1460 }
1461 // pktlen = buf32_to_ulong (value); // XXX
1462 } else {
1463 // Partial body length
1464 }
1465 } else { // This is an old format packet.
1466 // Extract the packet's type. This is encoded in bits 2-5.
1467 int i;
1468 pkttype = (ctb >> 2) & 0xf;
1469
1470 // The type of length encoding is encoded in bits 0-1 of the tag
1471 lenbytes = ((ctb & 3) == 3) ? 0 : (1 << (ctb & 3));
1472 if (!lenbytes) {
1473 pktlen = 0; // Don't know the value.
1474 // This isn't really partial, but we can treat it the same
1475 // in a "read until the end" sort of way.
1476 partial = 1;
1477 if (pkttype != 8 && pkttype != 11)
1478 goto bad;
1479 idx = 1;
1480 }
1481 else {
1482 for (i= 0; i < lenbytes; i++) {
1483 pktlen <<= 8;
1484 c = p[1 + i];
1485 pktlen |= c;
1486 }
1487 idx = 1 + lenbytes;
1488 }
1489 }
1490
1491 // Check packet type (double-check this)
1492 if (pkttype != 8 && pkttype != 11) // PKT_COMPRESSED, PKT_PLAINTEXT
1493 goto bad;
1494
1495 if (pkttype == 8) { // PKT_COMPRESSED, check for known compression algorithms
1496 c = p[idx];
1497 if (c != 0 && c != 1 && c != 2 && c != 3)
1498 goto bad;
1499 }
1500
1501 // Random note: MDC is only missing for ciphers with block size
1502 // <= 64 bits? No! PGP 8.0 can use AES-256, and still generate
1503 // output files with no MDC.
1504
1505 // This is the major source of false positives now!
1506 if (pkttype == 11) { // PKT_PLAINTEXT, there is not much we can do here? perhaps offer known-plaintext-attack feature to the user?
1507 // gpg -o sample_new_fp_qwertyzxcvb12345.gpg.txt --cipher-algo CAST5 --no-mdc --symmetric --compress-level 0 --s2k-mode 3 --s2k-count 1 secret.txt
1508 // printf("[DEBUG] lenbytes = %d, pktlen = %lu\n", lenbytes, pktlen);
1509 if (lenbytes == 0 && pktlen == 0) // heuristic, always safe?
1510 goto bad;
1511 if (pktlen > gpg_common_cur_salt->datalen) { // always safe?
1512 goto bad;
1513 }
1514 }
1515
1516 MEM_FREE(out);
1517 return 1;
1518 bad:
1519 MEM_FREE(out);
1520 return 0;
1521 }
1522
1523 // Verify
1524 checksumOk = 0;
1525 switch (gpg_common_cur_salt->usage) {
1526 case 254: {
1527 SHA1_Init(&ctx);
1528 SHA1_Update(&ctx, out, gpg_common_cur_salt->datalen - SHA_DIGEST_LENGTH);
1529 SHA1_Final(checksum, &ctx);
1530 if (memcmp(checksum, out + gpg_common_cur_salt->datalen - SHA_DIGEST_LENGTH, SHA_DIGEST_LENGTH) == 0) {
1531 MEM_FREE(out);
1532 return 1; /* we have a 20 byte verifier ;) */
1533 }
1534 MEM_FREE(out);
1535 return 0;
1536 } break;
1537 case 0:
1538 case 255: {
1539 // https://tools.ietf.org/html/rfc4880#section-3.7.2
1540 uint16_t sum = 0;
1541 for (i = 0; i < gpg_common_cur_salt->datalen - 2; i++) {
1542 sum += out[i];
1543 }
1544 if (sum == ((out[gpg_common_cur_salt->datalen - 2] << 8) | out[gpg_common_cur_salt->datalen - 1])) {
1545 checksumOk = 1;
1546 }
1547 checksumOk = 1; // We ignore the checksum now (as per TODO comment below!!)
1548 } break;
1549 default:
1550 break;
1551 }
1552 // If the checksum is ok, try to parse the first MPI of the private key
1553 // Stop relying on checksum altogether, GnuPG ignores it (after
1554 // documenting why though!)
1555 if (checksumOk) {
1556 BIGNUM *b = NULL;
1557 uint32_t blen = (num_bits + 7) / 8;
1558 int ret;
1559 if (gpg_common_cur_salt->datalen == 24 && blen != 20) { /* verifier 1 */
1560 MEM_FREE(out);
1561 return 0;
1562 }
1563 if (blen < gpg_common_cur_salt->datalen && ((b = BN_bin2bn(out + 2, blen, NULL)) != NULL)) {
1564 char *str = BN_bn2hex(b);
1565
1566 if (strlen(str) != blen * 2) { /* verifier 2 */
1567 OPENSSL_free(str);
1568 BN_free(b);
1569 MEM_FREE(out);
1570 return 0;
1571 }
1572 OPENSSL_free(str);
1573
1574 if (gpg_common_cur_salt->pk_algorithm == PKA_DSA) { /* DSA check */
1575 #if HAVE_DSA_GET0_PQG
1576 DSA *dsa = DSA_new();
1577 BIGNUM *p, *q, *g, *pub_key, *priv_key;
1578
1579 p = BN_bin2bn(gpg_common_cur_salt->p, gpg_common_cur_salt->pl, NULL);
1580 // puts(BN_bn2hex(dsa.p));
1581 q = BN_bin2bn(gpg_common_cur_salt->q, gpg_common_cur_salt->ql, NULL);
1582 // puts(BN_bn2hex(dsa.q));
1583 g = BN_bin2bn(gpg_common_cur_salt->g, gpg_common_cur_salt->gl, NULL);
1584 // puts(BN_bn2hex(dsa.g));
1585 priv_key = b;
1586 pub_key = BN_bin2bn(gpg_common_cur_salt->y, gpg_common_cur_salt->yl, NULL);
1587
1588 DSA_set0_pqg(dsa, p, q, g);
1589 DSA_set0_key(dsa, pub_key, priv_key);
1590
1591 // puts(BN_bn2hex(dsa.pub_key));
1592 ret = check_dsa_secret_key(dsa); /* verifier 3 */
1593 DSA_free(dsa);
1594 #else
1595 DSA dsa;
1596
1597 dsa.p = BN_bin2bn(gpg_common_cur_salt->p, gpg_common_cur_salt->pl, NULL);
1598 // puts(BN_bn2hex(dsa.p));
1599 dsa.q = BN_bin2bn(gpg_common_cur_salt->q, gpg_common_cur_salt->ql, NULL);
1600 // puts(BN_bn2hex(dsa.q));
1601 dsa.g = BN_bin2bn(gpg_common_cur_salt->g, gpg_common_cur_salt->gl, NULL);
1602 // puts(BN_bn2hex(dsa.g));
1603 dsa.priv_key = b;
1604 dsa.pub_key = BN_bin2bn(gpg_common_cur_salt->y, gpg_common_cur_salt->yl, NULL);
1605 // puts(BN_bn2hex(dsa.pub_key));
1606 ret = check_dsa_secret_key(&dsa); /* verifier 3 */
1607 #endif
1608 if (ret != 0) {
1609 MEM_FREE(out);
1610 return 0;
1611 }
1612 }
1613 if (gpg_common_cur_salt->pk_algorithm == PKA_ELGAMAL || gpg_common_cur_salt->pk_algorithm == PKA_EG) { /* ElGamal check */
1614 ElGamal_secret_key elg;
1615
1616 elg.p = BN_bin2bn(gpg_common_cur_salt->p, gpg_common_cur_salt->pl, NULL);
1617 // puts(BN_bn2hex(elg.p));
1618 elg.g = BN_bin2bn(gpg_common_cur_salt->g, gpg_common_cur_salt->gl, NULL);
1619 // puts(BN_bn2hex(elg.g));
1620 elg.x = b;
1621 // puts(BN_bn2hex(elg.x));
1622 elg.y = BN_bin2bn(gpg_common_cur_salt->y, gpg_common_cur_salt->yl, NULL);
1623 // puts(BN_bn2hex(elg.y));
1624 ret = check_elg_secret_key(&elg); /* verifier 3 */
1625 if (ret != 0) {
1626 MEM_FREE(out);
1627 return 0;
1628 }
1629 }
1630 if (gpg_common_cur_salt->pk_algorithm == PKA_RSA_ENCSIGN) { /* RSA check */
1631 RSA_secret_key rsa;
1632 // http://www.ietf.org/rfc/rfc4880.txt
1633 int length = 0;
1634
1635 length += give_multi_precision_integer(out, length, &gpg_common_cur_salt->dl, gpg_common_cur_salt->d);
1636 length += give_multi_precision_integer(out, length, &gpg_common_cur_salt->pl, gpg_common_cur_salt->p);
1637 length += give_multi_precision_integer(out, length, &gpg_common_cur_salt->ql, gpg_common_cur_salt->q);
1638
1639 rsa.n = BN_bin2bn(gpg_common_cur_salt->n, gpg_common_cur_salt->nl, NULL);
1640 rsa.p = BN_bin2bn(gpg_common_cur_salt->p, gpg_common_cur_salt->pl, NULL);
1641 rsa.q = BN_bin2bn(gpg_common_cur_salt->q, gpg_common_cur_salt->ql, NULL);
1642
1643 // b is not used. So we must free it, or we have a leak.
1644 BN_free(b);
1645 ret = check_rsa_secret_key(&rsa);
1646 if (ret != 0) {
1647 MEM_FREE(out);
1648 return 0;
1649 }
1650 }
1651 MEM_FREE(out);
1652 return 1;
1653 }
1654 }
1655 MEM_FREE(out);
1656 return 0;
1657 }
1658
1659 /*
1660 * Report gpg --s2k-count n as 1st tunable cost,
1661 * hash algorithm as 2nd tunable cost,
1662 * cipher algorithm as 3rd tunable cost.
1663 */
1664
gpg_common_gpg_s2k_count(void * salt)1665 unsigned int gpg_common_gpg_s2k_count(void *salt)
1666 {
1667 struct gpg_common_custom_salt *my_salt;
1668
1669 my_salt = *(struct gpg_common_custom_salt **)salt;
1670 if (my_salt->spec == SPEC_ITERATED_SALTED)
1671 /*
1672 * gpg --s2k-count is only meaningful
1673 * if --s2k-mode is 3, see man gpg
1674 */
1675 return (unsigned int) my_salt->count;
1676 else if (my_salt->spec == SPEC_SALTED)
1677 return 1; /* --s2k-mode 1 */
1678 else
1679 return 0; /* --s2k-mode 0 */
1680 }
1681
gpg_common_gpg_hash_algorithm(void * salt)1682 unsigned int gpg_common_gpg_hash_algorithm(void *salt)
1683 {
1684 struct gpg_common_custom_salt *my_salt;
1685
1686 my_salt = *(struct gpg_common_custom_salt **)salt;
1687 return (unsigned int) my_salt->hash_algorithm;
1688 }
gpg_common_gpg_cipher_algorithm(void * salt)1689 unsigned int gpg_common_gpg_cipher_algorithm(void *salt)
1690 {
1691 struct gpg_common_custom_salt *my_salt;
1692
1693 my_salt = *(struct gpg_common_custom_salt **)salt;
1694 return (unsigned int) my_salt->cipher_algorithm;
1695 }
1696