1 /* 2 * WPA Supplicant / Crypto wrapper for LibTomCrypt (for internal TLSv1) 3 * Copyright (c) 2005-2006, Jouni Malinen <j (at) w1.fi> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Alternatively, this software may be distributed under the terms of BSD 10 * license. 11 * 12 * See README and COPYING for more details. 13 */ 14 15 #include "includes.h" 16 #include <tomcrypt.h> 17 18 #include "common.h" 19 #include "crypto.h" 20 21 #ifndef mp_init_multi 22 #define mp_init_multi ltc_init_multi 23 #define mp_clear_multi ltc_deinit_multi 24 #define mp_unsigned_bin_size(a) ltc_mp.unsigned_size(a) 25 #define mp_to_unsigned_bin(a, b) ltc_mp.unsigned_write(a, b) 26 #define mp_read_unsigned_bin(a, b, c) ltc_mp.unsigned_read(a, b, c) 27 #define mp_exptmod(a,b,c,d) ltc_mp.exptmod(a,b,c,d) 28 #endif 29 30 31 int md4_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) 32 { 33 hash_state md; 34 size_t i; 35 36 md4_init(&md); 37 for (i = 0; i < num_elem; i++) 38 md4_process(&md, addr[i], len[i]); 39 md4_done(&md, mac); 40 return 0; 41 } 42 43 44 void des_encrypt(const u8 *clear, const u8 *key, u8 *cypher) 45 { 46 u8 pkey[8], next, tmp; 47 int i; 48 symmetric_key skey; 49 50 /* Add parity bits to the key */ 51 next = 0; 52 for (i = 0; i < 7; i++) { 53 tmp = key[i]; 54 pkey[i] = (tmp >> i) | next | 1; 55 next = tmp << (7 - i); 56 } 57 pkey[i] = next | 1; 58 59 des_setup(pkey, 8, 0, &skey); 60 des_ecb_encrypt(clear, cypher, &skey); 61 des_done(&skey); 62 } 63 64 65 int md5_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) 66 { 67 hash_state md; 68 size_t i; 69 70 md5_init(&md); 71 for (i = 0; i < num_elem; i++) 72 md5_process(&md, addr[i], len[i]); 73 md5_done(&md, mac); 74 return 0; 75 } 76 77 78 int sha1_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) 79 { 80 hash_state md; 81 size_t i; 82 83 sha1_init(&md); 84 for (i = 0; i < num_elem; i++) 85 sha1_process(&md, addr[i], len[i]); 86 sha1_done(&md, mac); 87 return 0; 88 } 89 90 91 void * aes_encrypt_init(const u8 *key, size_t len) 92 { 93 symmetric_key *skey; 94 skey = os_malloc(sizeof(*skey)); 95 if (skey == NULL) 96 return NULL; 97 if (aes_setup(key, len, 0, skey) != CRYPT_OK) { 98 os_free(skey); 99 return NULL; 100 } 101 return skey; 102 } 103 104 105 void aes_encrypt(void *ctx, const u8 *plain, u8 *crypt) 106 { 107 symmetric_key *skey = ctx; 108 aes_ecb_encrypt(plain, crypt, skey); 109 } 110 111 112 void aes_encrypt_deinit(void *ctx) 113 { 114 symmetric_key *skey = ctx; 115 aes_done(skey); 116 os_free(skey); 117 } 118 119 120 void * aes_decrypt_init(const u8 *key, size_t len) 121 { 122 symmetric_key *skey; 123 skey = os_malloc(sizeof(*skey)); 124 if (skey == NULL) 125 return NULL; 126 if (aes_setup(key, len, 0, skey) != CRYPT_OK) { 127 os_free(skey); 128 return NULL; 129 } 130 return skey; 131 } 132 133 134 void aes_decrypt(void *ctx, const u8 *crypt, u8 *plain) 135 { 136 symmetric_key *skey = ctx; 137 aes_ecb_encrypt(plain, (u8 *) crypt, skey); 138 } 139 140 141 void aes_decrypt_deinit(void *ctx) 142 { 143 symmetric_key *skey = ctx; 144 aes_done(skey); 145 os_free(skey); 146 } 147 148 149 struct crypto_hash { 150 enum crypto_hash_alg alg; 151 int error; 152 union { 153 hash_state md; 154 hmac_state hmac; 155 } u; 156 }; 157 158 159 struct crypto_hash * crypto_hash_init(enum crypto_hash_alg alg, const u8 *key, 160 size_t key_len) 161 { 162 struct crypto_hash *ctx; 163 164 ctx = os_zalloc(sizeof(*ctx)); 165 if (ctx == NULL) 166 return NULL; 167 168 ctx->alg = alg; 169 170 switch (alg) { 171 case CRYPTO_HASH_ALG_MD5: 172 if (md5_init(&ctx->u.md) != CRYPT_OK) 173 goto fail; 174 break; 175 case CRYPTO_HASH_ALG_SHA1: 176 if (sha1_init(&ctx->u.md) != CRYPT_OK) 177 goto fail; 178 break; 179 case CRYPTO_HASH_ALG_HMAC_MD5: 180 if (hmac_init(&ctx->u.hmac, find_hash("md5"), key, key_len) != 181 CRYPT_OK) 182 goto fail; 183 break; 184 case CRYPTO_HASH_ALG_HMAC_SHA1: 185 if (hmac_init(&ctx->u.hmac, find_hash("sha1"), key, key_len) != 186 CRYPT_OK) 187 goto fail; 188 break; 189 default: 190 goto fail; 191 } 192 193 return ctx; 194 195 fail: 196 os_free(ctx); 197 return NULL; 198 } 199 200 void crypto_hash_update(struct crypto_hash *ctx, const u8 *data, size_t len) 201 { 202 if (ctx == NULL || ctx->error) 203 return; 204 205 switch (ctx->alg) { 206 case CRYPTO_HASH_ALG_MD5: 207 ctx->error = md5_process(&ctx->u.md, data, len) != CRYPT_OK; 208 break; 209 case CRYPTO_HASH_ALG_SHA1: 210 ctx->error = sha1_process(&ctx->u.md, data, len) != CRYPT_OK; 211 break; 212 case CRYPTO_HASH_ALG_HMAC_MD5: 213 case CRYPTO_HASH_ALG_HMAC_SHA1: 214 ctx->error = hmac_process(&ctx->u.hmac, data, len) != CRYPT_OK; 215 break; 216 } 217 } 218 219 220 int crypto_hash_finish(struct crypto_hash *ctx, u8 *mac, size_t *len) 221 { 222 int ret = 0; 223 unsigned long clen; 224 225 if (ctx == NULL) 226 return -2; 227 228 if (mac == NULL || len == NULL) { 229 os_free(ctx); 230 return 0; 231 } 232 233 if (ctx->error) { 234 os_free(ctx); 235 return -2; 236 } 237 238 switch (ctx->alg) { 239 case CRYPTO_HASH_ALG_MD5: 240 if (*len < 16) { 241 *len = 16; 242 os_free(ctx); 243 return -1; 244 } 245 *len = 16; 246 if (md5_done(&ctx->u.md, mac) != CRYPT_OK) 247 ret = -2; 248 break; 249 case CRYPTO_HASH_ALG_SHA1: 250 if (*len < 20) { 251 *len = 20; 252 os_free(ctx); 253 return -1; 254 } 255 *len = 20; 256 if (sha1_done(&ctx->u.md, mac) != CRYPT_OK) 257 ret = -2; 258 break; 259 case CRYPTO_HASH_ALG_HMAC_SHA1: 260 if (*len < 20) { 261 *len = 20; 262 os_free(ctx); 263 return -1; 264 } 265 /* continue */ 266 case CRYPTO_HASH_ALG_HMAC_MD5: 267 if (*len < 16) { 268 *len = 16; 269 os_free(ctx); 270 return -1; 271 } 272 clen = *len; 273 if (hmac_done(&ctx->u.hmac, mac, &clen) != CRYPT_OK) { 274 os_free(ctx); 275 return -1; 276 } 277 *len = clen; 278 break; 279 default: 280 ret = -2; 281 break; 282 } 283 284 os_free(ctx); 285 286 return ret; 287 } 288 289 290 struct crypto_cipher { 291 int rc4; 292 union { 293 symmetric_CBC cbc; 294 struct { 295 size_t used_bytes; 296 u8 key[16]; 297 size_t keylen; 298 } rc4; 299 } u; 300 }; 301 302 303 struct crypto_cipher * crypto_cipher_init(enum crypto_cipher_alg alg, 304 const u8 *iv, const u8 *key, 305 size_t key_len) 306 { 307 struct crypto_cipher *ctx; 308 int idx, res, rc4 = 0; 309 310 switch (alg) { 311 case CRYPTO_CIPHER_ALG_AES: 312 idx = find_cipher("aes"); 313 break; 314 case CRYPTO_CIPHER_ALG_3DES: 315 idx = find_cipher("3des"); 316 break; 317 case CRYPTO_CIPHER_ALG_DES: 318 idx = find_cipher("des"); 319 break; 320 case CRYPTO_CIPHER_ALG_RC2: 321 idx = find_cipher("rc2"); 322 break; 323 case CRYPTO_CIPHER_ALG_RC4: 324 idx = -1; 325 rc4 = 1; 326 break; 327 default: 328 return NULL; 329 } 330 331 ctx = os_zalloc(sizeof(*ctx)); 332 if (ctx == NULL) 333 return NULL; 334 335 if (rc4) { 336 ctx->rc4 = 1; 337 if (key_len > sizeof(ctx->u.rc4.key)) { 338 os_free(ctx); 339 return NULL; 340 } 341 ctx->u.rc4.keylen = key_len; 342 os_memcpy(ctx->u.rc4.key, key, key_len); 343 } else { 344 res = cbc_start(idx, iv, key, key_len, 0, &ctx->u.cbc); 345 if (res != CRYPT_OK) { 346 wpa_printf(MSG_DEBUG, "LibTomCrypt: Cipher start " 347 "failed: %s", error_to_string(res)); 348 os_free(ctx); 349 return NULL; 350 } 351 } 352 353 return ctx; 354 } 355 356 int crypto_cipher_encrypt(struct crypto_cipher *ctx, const u8 *plain, 357 u8 *crypt, size_t len) 358 { 359 int res; 360 361 if (ctx->rc4) { 362 if (plain != crypt) 363 os_memcpy(crypt, plain, len); 364 rc4_skip(ctx->u.rc4.key, ctx->u.rc4.keylen, 365 ctx->u.rc4.used_bytes, crypt, len); 366 ctx->u.rc4.used_bytes += len; 367 return 0; 368 } 369 370 res = cbc_encrypt(plain, crypt, len, &ctx->u.cbc); 371 if (res != CRYPT_OK) { 372 wpa_printf(MSG_DEBUG, "LibTomCrypt: CBC encryption " 373 "failed: %s", error_to_string(res)); 374 return -1; 375 } 376 return 0; 377 } 378 379 380 int crypto_cipher_decrypt(struct crypto_cipher *ctx, const u8 *crypt, 381 u8 *plain, size_t len) 382 { 383 int res; 384 385 if (ctx->rc4) { 386 if (plain != crypt) 387 os_memcpy(plain, crypt, len); 388 rc4_skip(ctx->u.rc4.key, ctx->u.rc4.keylen, 389 ctx->u.rc4.used_bytes, plain, len); 390 ctx->u.rc4.used_bytes += len; 391 return 0; 392 } 393 394 res = cbc_decrypt(crypt, plain, len, &ctx->u.cbc); 395 if (res != CRYPT_OK) { 396 wpa_printf(MSG_DEBUG, "LibTomCrypt: CBC decryption " 397 "failed: %s", error_to_string(res)); 398 return -1; 399 } 400 401 return 0; 402 } 403 404 405 void crypto_cipher_deinit(struct crypto_cipher *ctx) 406 { 407 if (!ctx->rc4) 408 cbc_done(&ctx->u.cbc); 409 os_free(ctx); 410 } 411 412 413 struct crypto_public_key { 414 rsa_key rsa; 415 }; 416 417 struct crypto_private_key { 418 rsa_key rsa; 419 }; 420 421 422 struct crypto_public_key * crypto_public_key_import(const u8 *key, size_t len) 423 { 424 int res; 425 struct crypto_public_key *pk; 426 427 pk = os_zalloc(sizeof(*pk)); 428 if (pk == NULL) 429 return NULL; 430 431 res = rsa_import(key, len, &pk->rsa); 432 if (res != CRYPT_OK) { 433 wpa_printf(MSG_ERROR, "LibTomCrypt: Failed to import " 434 "public key (res=%d '%s')", 435 res, error_to_string(res)); 436 os_free(pk); 437 return NULL; 438 } 439 440 if (pk->rsa.type != PK_PUBLIC) { 441 wpa_printf(MSG_ERROR, "LibTomCrypt: Public key was not of " 442 "correct type"); 443 rsa_free(&pk->rsa); 444 os_free(pk); 445 return NULL; 446 } 447 448 return pk; 449 } 450 451 452 struct crypto_private_key * crypto_private_key_import(const u8 *key, 453 size_t len, 454 const char *passwd) 455 { 456 int res; 457 struct crypto_private_key *pk; 458 459 pk = os_zalloc(sizeof(*pk)); 460 if (pk == NULL) 461 return NULL; 462 463 res = rsa_import(key, len, &pk->rsa); 464 if (res != CRYPT_OK) { 465 wpa_printf(MSG_ERROR, "LibTomCrypt: Failed to import " 466 "private key (res=%d '%s')", 467 res, error_to_string(res)); 468 os_free(pk); 469 return NULL; 470 } 471 472 if (pk->rsa.type != PK_PRIVATE) { 473 wpa_printf(MSG_ERROR, "LibTomCrypt: Private key was not of " 474 "correct type"); 475 rsa_free(&pk->rsa); 476 os_free(pk); 477 return NULL; 478 } 479 480 return pk; 481 } 482 483 484 struct crypto_public_key * crypto_public_key_from_cert(const u8 *buf, 485 size_t len) 486 { 487 /* No X.509 support in LibTomCrypt */ 488 return NULL; 489 } 490 491 492 static int pkcs1_generate_encryption_block(u8 block_type, size_t modlen, 493 const u8 *in, size_t inlen, 494 u8 *out, size_t *outlen) 495 { 496 size_t ps_len; 497 u8 *pos; 498 499 /* 500 * PKCS #1 v1.5, 8.1: 501 * 502 * EB = 00 || BT || PS || 00 || D 503 * BT = 00 or 01 for private-key operation; 02 for public-key operation 504 * PS = k-3-||D||; at least eight octets 505 * (BT=0: PS=0x00, BT=1: PS=0xff, BT=2: PS=pseudorandom non-zero) 506 * k = length of modulus in octets (modlen) 507 */ 508 509 if (modlen < 12 || modlen > *outlen || inlen > modlen - 11) { 510 wpa_printf(MSG_DEBUG, "PKCS #1: %s - Invalid buffer " 511 "lengths (modlen=%lu outlen=%lu inlen=%lu)", 512 __func__, (unsigned long) modlen, 513 (unsigned long) *outlen, 514 (unsigned long) inlen); 515 return -1; 516 } 517 518 pos = out; 519 *pos++ = 0x00; 520 *pos++ = block_type; /* BT */ 521 ps_len = modlen - inlen - 3; 522 switch (block_type) { 523 case 0: 524 os_memset(pos, 0x00, ps_len); 525 pos += ps_len; 526 break; 527 case 1: 528 os_memset(pos, 0xff, ps_len); 529 pos += ps_len; 530 break; 531 case 2: 532 if (os_get_random(pos, ps_len) < 0) { 533 wpa_printf(MSG_DEBUG, "PKCS #1: %s - Failed to get " 534 "random data for PS", __func__); 535 return -1; 536 } 537 while (ps_len--) { 538 if (*pos == 0x00) 539 *pos = 0x01; 540 pos++; 541 } 542 break; 543 default: 544 wpa_printf(MSG_DEBUG, "PKCS #1: %s - Unsupported block type " 545 "%d", __func__, block_type); 546 return -1; 547 } 548 *pos++ = 0x00; 549 os_memcpy(pos, in, inlen); /* D */ 550 551 return 0; 552 } 553 554 555 static int crypto_rsa_encrypt_pkcs1(int block_type, rsa_key *key, int key_type, 556 const u8 *in, size_t inlen, 557 u8 *out, size_t *outlen) 558 { 559 unsigned long len, modlen; 560 int res; 561 562 modlen = mp_unsigned_bin_size(key->N); 563 564 if (pkcs1_generate_encryption_block(block_type, modlen, in, inlen, 565 out, outlen) < 0) 566 return -1; 567 568 len = *outlen; 569 res = rsa_exptmod(out, modlen, out, &len, key_type, key); 570 if (res != CRYPT_OK) { 571 wpa_printf(MSG_DEBUG, "LibTomCrypt: rsa_exptmod failed: %s", 572 error_to_string(res)); 573 return -1; 574 } 575 *outlen = len; 576 577 return 0; 578 } 579 580 581 int crypto_public_key_encrypt_pkcs1_v15(struct crypto_public_key *key, 582 const u8 *in, size_t inlen, 583 u8 *out, size_t *outlen) 584 { 585 return crypto_rsa_encrypt_pkcs1(2, &key->rsa, PK_PUBLIC, in, inlen, 586 out, outlen); 587 } 588 589 590 int crypto_private_key_sign_pkcs1(struct crypto_private_key *key, 591 const u8 *in, size_t inlen, 592 u8 *out, size_t *outlen) 593 { 594 return crypto_rsa_encrypt_pkcs1(1, &key->rsa, PK_PRIVATE, in, inlen, 595 out, outlen); 596 } 597 598 599 void crypto_public_key_free(struct crypto_public_key *key) 600 { 601 if (key) { 602 rsa_free(&key->rsa); 603 os_free(key); 604 } 605 } 606 607 608 void crypto_private_key_free(struct crypto_private_key *key) 609 { 610 if (key) { 611 rsa_free(&key->rsa); 612 os_free(key); 613 } 614 } 615 616 617 int crypto_public_key_decrypt_pkcs1(struct crypto_public_key *key, 618 const u8 *crypt, size_t crypt_len, 619 u8 *plain, size_t *plain_len) 620 { 621 int res; 622 unsigned long len; 623 u8 *pos; 624 625 len = *plain_len; 626 res = rsa_exptmod(crypt, crypt_len, plain, &len, PK_PUBLIC, 627 &key->rsa); 628 if (res != CRYPT_OK) { 629 wpa_printf(MSG_DEBUG, "LibTomCrypt: rsa_exptmod failed: %s", 630 error_to_string(res)); 631 return -1; 632 } 633 634 /* 635 * PKCS #1 v1.5, 8.1: 636 * 637 * EB = 00 || BT || PS || 00 || D 638 * BT = 01 639 * PS = k-3-||D|| times FF 640 * k = length of modulus in octets 641 */ 642 643 if (len < 3 + 8 + 16 /* min hash len */ || 644 plain[0] != 0x00 || plain[1] != 0x01 || plain[2] != 0xff) { 645 wpa_printf(MSG_INFO, "LibTomCrypt: Invalid signature EB " 646 "structure"); 647 return -1; 648 } 649 650 pos = plain + 3; 651 while (pos < plain + len && *pos == 0xff) 652 pos++; 653 if (pos - plain - 2 < 8) { 654 /* PKCS #1 v1.5, 8.1: At least eight octets long PS */ 655 wpa_printf(MSG_INFO, "LibTomCrypt: Too short signature " 656 "padding"); 657 return -1; 658 } 659 660 if (pos + 16 /* min hash len */ >= plain + len || *pos != 0x00) { 661 wpa_printf(MSG_INFO, "LibTomCrypt: Invalid signature EB " 662 "structure (2)"); 663 return -1; 664 } 665 pos++; 666 len -= pos - plain; 667 668 /* Strip PKCS #1 header */ 669 os_memmove(plain, pos, len); 670 *plain_len = len; 671 672 return 0; 673 } 674 675 676 int crypto_global_init(void) 677 { 678 ltc_mp = tfm_desc; 679 /* TODO: only register algorithms that are really needed */ 680 if (register_hash(&md4_desc) < 0 || 681 register_hash(&md5_desc) < 0 || 682 register_hash(&sha1_desc) < 0 || 683 register_cipher(&aes_desc) < 0 || 684 register_cipher(&des_desc) < 0 || 685 register_cipher(&des3_desc) < 0) { 686 wpa_printf(MSG_ERROR, "TLSv1: Failed to register " 687 "hash/cipher functions"); 688 return -1; 689 } 690 691 return 0; 692 } 693 694 695 void crypto_global_deinit(void) 696 { 697 } 698 699 700 #ifdef CONFIG_MODEXP 701 702 int crypto_mod_exp(const u8 *base, size_t base_len, 703 const u8 *power, size_t power_len, 704 const u8 *modulus, size_t modulus_len, 705 u8 *result, size_t *result_len) 706 { 707 void *b, *p, *m, *r; 708 709 if (mp_init_multi(&b, &p, &m, &r, NULL) != CRYPT_OK) 710 return -1; 711 712 if (mp_read_unsigned_bin(b, (u8 *) base, base_len) != CRYPT_OK || 713 mp_read_unsigned_bin(p, (u8 *) power, power_len) != CRYPT_OK || 714 mp_read_unsigned_bin(m, (u8 *) modulus, modulus_len) != CRYPT_OK) 715 goto fail; 716 717 if (mp_exptmod(b, p, m, r) != CRYPT_OK) 718 goto fail; 719 720 *result_len = mp_unsigned_bin_size(r); 721 if (mp_to_unsigned_bin(r, result) != CRYPT_OK) 722 goto fail; 723 724 mp_clear_multi(b, p, m, r, NULL); 725 return 0; 726 727 fail: 728 mp_clear_multi(b, p, m, r, NULL); 729 return -1; 730 } 731 732 #endif /* CONFIG_MODEXP */ 733
