Respecify OpenSSL back-end internals in terms of krb5_key

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/enc-perf@22941 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/crypto/openssl/aes/aes_s2k.c b/src/lib/crypto/openssl/aes/aes_s2k.c
index 1383be11a2d4492b40fbe92ba63c310f2f3010b9..db6553e25a811a78422c9c025b76071b4957c968 100644 (file)
--- a/src/lib/crypto/openssl/aes/aes_s2k.c
+++ b/src/lib/crypto/openssl/aes/aes_s2k.c
@@ -44,6 +44,7 @@ krb5int_aes_string_to_key(const struct krb5_enc_provider *enc,
     unsigned long iter_count;
     krb5_data out;
     static const krb5_data usage = { KV5M_DATA, 8, "kerberos" };
+    krb5_key tempkey = NULL;
     krb5_error_code err;
 
     if (params) {
@@ -66,25 +67,25 @@ krb5int_aes_string_to_key(const struct krb5_enc_provider *enc,
     if (iter_count >= MAX_ITERATION_COUNT)
        return KRB5_ERR_BAD_S2K_PARAMS;
 
-    /*
-     * Dense key space, no parity bits or anything, so take a shortcut
-     * and use the key contents buffer for the generated bytes.
-     */
+    /* Use the output keyblock contents for temporary space. */
     out.data = (char *) key->contents;
     out.length = key->length;
     if (out.length != 16 && out.length != 32)
        return KRB5_CRYPTO_INTERNAL;
 
     err = krb5int_pbkdf2_hmac_sha1 (&out, iter_count, string, salt);
-    if (err) {
-       memset(out.data, 0, out.length);
-       return err;
-    }
+    if (err)
+       goto cleanup;
 
-    err = krb5_derive_key (enc, key, key, &usage);
-    if (err) {
-       memset(out.data, 0, out.length);
-       return err;
-    }
-    return 0;
+    err = krb5_k_create_key (NULL, key, &tempkey);
+    if (err)
+       goto cleanup;
+
+    err = krb5_derive_keyblock (enc, tempkey, key, &usage);
+
+cleanup:
+    if (err)
+       memset (out.data, 0, out.length);
+    krb5_k_free_key (NULL, tempkey);
+    return err;
 }

diff --git a/src/lib/crypto/openssl/arcfour/arcfour.c b/src/lib/crypto/openssl/arcfour/arcfour.c
index 687f276b01bbfc382a60b0983fff4b4c84986ade..2c89b99b827059774f0835b7c58992d190ba388f 100644 (file)
--- a/src/lib/crypto/openssl/arcfour/arcfour.c
+++ b/src/lib/crypto/openssl/arcfour/arcfour.c
@@ -65,11 +65,12 @@ case 7:                             /* tgs-req authenticator */
 krb5_error_code
 krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
                     const struct krb5_hash_provider *hash,
-                    const krb5_keyblock *key, krb5_keyusage usage,
+                    krb5_key key, krb5_keyusage usage,
                     const krb5_data *ivec, const krb5_data *input,
                     krb5_data *output)
 {
   krb5_keyblock k1, k2, k3;
+  krb5_key k3key = NULL;
   krb5_data d1, d2, d3, salt, plaintext, checksum, ciphertext, confounder;
   krb5_keyusage ms_usage;
   size_t keylength, keybytes, blocksize, hashsize;
@@ -84,7 +85,7 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
   d1.data=malloc(d1.length);
   if (d1.data == NULL)
     return (ENOMEM);
-  k1 = *key;
+  k1 = key->keyblock;
   k1.length=d1.length;
   k1.contents= (void *) d1.data;
 
@@ -94,7 +95,7 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
     free(d1.data);
     return (ENOMEM);
   }
-  k2 = *key;
+  k2 = key->keyblock;
   k2.length=d2.length;
   k2.contents=(void *) d2.data;
 
@@ -105,7 +106,7 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
     free(d2.data);
     return (ENOMEM);
   }
-  k3 = *key;
+  k3 = key->keyblock;
   k3.length=d3.length;
   k3.contents= (void *) d3.data;
 
@@ -141,7 +142,7 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
 
   /* begin the encryption, computer K1 */
   ms_usage=krb5int_arcfour_translate_usage(usage);
-  if (key->enctype == ENCTYPE_ARCFOUR_HMAC_EXP) {
+  if (key->keyblock.enctype == ENCTYPE_ARCFOUR_HMAC_EXP) {
     strncpy(salt.data, krb5int_arcfour_l40, salt.length);
     store_32_le(ms_usage, salt.data+10);
   } else {
@@ -152,7 +153,7 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
 
   memcpy(k2.contents, k1.contents, k2.length);
 
-  if (key->enctype==ENCTYPE_ARCFOUR_HMAC_EXP)
+  if (key->keyblock.enctype==ENCTYPE_ARCFOUR_HMAC_EXP)
     memset(k1.contents+7, 0xab, 9);
 
   ret=krb5_c_random_make_octets(/* XXX */ 0, &confounder);
@@ -160,11 +161,19 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
   if (ret)
     goto cleanup;
 
-  krb5_hmac(hash, &k2, 1, &plaintext, &checksum);
+  ret = krb5int_hmac_keyblock(hash, &k2, 1, &plaintext, &checksum);
+  if (ret)
+    goto cleanup;
+
+  ret = krb5int_hmac_keyblock(hash, &k1, 1, &checksum, &d3);
+  if (ret)
+    goto cleanup;
 
-  krb5_hmac(hash, &k1, 1, &checksum, &d3);
+  ret = krb5_k_create_key(NULL, &k3, &k3key);
+  if (ret)
+    goto cleanup;
 
-  ret=(*(enc->encrypt))(&k3, ivec, &plaintext, &ciphertext);
+  ret=(*(enc->encrypt))(k3key, ivec, &plaintext, &ciphertext);
 
  cleanup:
   memset(d1.data, 0, d1.length);
@@ -185,11 +194,12 @@ krb5_arcfour_encrypt(const struct krb5_enc_provider *enc,
 krb5_error_code
 krb5_arcfour_decrypt(const struct krb5_enc_provider *enc,
                     const struct krb5_hash_provider *hash,
-                    const krb5_keyblock *key, krb5_keyusage usage,
+                    krb5_key key, krb5_keyusage usage,
                     const krb5_data *ivec, const krb5_data *input,
                     krb5_data *output)
 {
   krb5_keyblock k1,k2,k3;
+  krb5_key k3key;
   krb5_data d1,d2,d3,salt,ciphertext,plaintext,checksum;
   krb5_keyusage ms_usage;
   size_t keybytes, keylength, hashsize, blocksize;
@@ -204,7 +214,7 @@ krb5_arcfour_decrypt(const struct krb5_enc_provider *enc,
   d1.data=malloc(d1.length);
   if (d1.data == NULL)
     return (ENOMEM);
-  k1 = *key;
+  k1 = key->keyblock;
   k1.length=d1.length;
   k1.contents= (void *) d1.data;
 
@@ -214,7 +224,7 @@ krb5_arcfour_decrypt(const struct krb5_enc_provider *enc,
     free(d1.data);
     return (ENOMEM);
   }
-  k2 = *key;
+  k2 = key->keyblock;
   k2.length=d2.length;
   k2.contents= (void *) d2.data;
 
@@ -225,7 +235,7 @@ krb5_arcfour_decrypt(const struct krb5_enc_provider *enc,
     free(d2.data);
     return (ENOMEM);
   }
-  k3 = *key;
+  k3 = key->keyblock;
   k3.length=d3.length;
   k3.contents= (void *) d3.data;
 
@@ -258,7 +268,7 @@ krb5_arcfour_decrypt(const struct krb5_enc_provider *enc,
   /* We may have to try two ms_usage values; see below. */
   do {
       /* compute the salt */
-      if (key->enctype == ENCTYPE_ARCFOUR_HMAC_EXP) {
+      if (key->keyblock.enctype == ENCTYPE_ARCFOUR_HMAC_EXP) {
          strncpy(salt.data, krb5int_arcfour_l40, salt.length);
          store_32_le(ms_usage, salt.data + 10);
       } else {
@@ -271,18 +281,22 @@ krb5_arcfour_decrypt(const struct krb5_enc_provider *enc,
 
       memcpy(k2.contents, k1.contents, k2.length);
 
-      if (key->enctype == ENCTYPE_ARCFOUR_HMAC_EXP)
+      if (key->keyblock.enctype == ENCTYPE_ARCFOUR_HMAC_EXP)
          memset(k1.contents + 7, 0xab, 9);
 
-      ret = krb5_hmac(hash, &k1, 1, &checksum, &d3);
+      ret = krb5int_hmac_keyblock(hash, &k1, 1, &checksum, &d3);
       if (ret)
          goto cleanup;
 
-      ret = (*(enc->decrypt))(&k3, ivec, &ciphertext, &plaintext);
+      ret = krb5_k_create_key(NULL, &k3, &k3key);
+      if (ret)
+       goto cleanup;
+      ret = (*(enc->decrypt))(k3key, ivec, &ciphertext, &plaintext);
+      krb5_k_free_key(NULL, k3key);
       if (ret)
          goto cleanup;
 
-      ret = krb5_hmac(hash, &k2, 1, &plaintext, &d1);
+      ret = krb5int_hmac_keyblock(hash, &k2, 1, &plaintext, &d1);
       if (ret)
          goto cleanup;
 

diff --git a/src/lib/crypto/openssl/arcfour/arcfour.h b/src/lib/crypto/openssl/arcfour/arcfour.h
index be408febc632d7519ff8662da7d91409a3ed5918..1a2876437d96e0e9f98bef92c36b031f9b023380 100644 (file)
--- a/src/lib/crypto/openssl/arcfour/arcfour.h
+++ b/src/lib/crypto/openssl/arcfour/arcfour.h
@@ -10,7 +10,7 @@ krb5_arcfour_encrypt_length(const struct krb5_enc_provider *,
 extern 
 krb5_error_code krb5_arcfour_encrypt(const struct krb5_enc_provider *,
                        const struct krb5_hash_provider *,
-                       const krb5_keyblock *,
+                       krb5_key,
                        krb5_keyusage,
                        const krb5_data *,
                        const krb5_data *,
@@ -19,7 +19,7 @@ krb5_error_code krb5_arcfour_encrypt(const struct krb5_enc_provider *,
 extern 
 krb5_error_code krb5_arcfour_decrypt(const struct krb5_enc_provider *,
                        const struct krb5_hash_provider *,
-                       const krb5_keyblock *,
+                       krb5_key,
                        krb5_keyusage,
                        const krb5_data *,
                        const krb5_data *,
@@ -34,10 +34,5 @@ extern krb5_error_code krb5int_arcfour_string_to_key(
 
 extern const struct krb5_enc_provider krb5int_enc_arcfour;
 extern const struct krb5_aead_provider krb5int_aead_arcfour;
- krb5_error_code krb5int_arcfour_prf(
-                                        const struct krb5_enc_provider *enc,
-                                        const struct krb5_hash_provider *hash,
-                                        const krb5_keyblock *key,
-                                        const krb5_data *in, krb5_data *out);
 
 #endif /* ARCFOUR_H */

diff --git a/src/lib/crypto/openssl/arcfour/arcfour_aead.c b/src/lib/crypto/openssl/arcfour/arcfour_aead.c
index cff7d66d65e3a2842bdae5727656bacc32489af3..4896afaaf4bb0297350102f368762f5ae369a576 100644 (file)
--- a/src/lib/crypto/openssl/arcfour/arcfour_aead.c
+++ b/src/lib/crypto/openssl/arcfour/arcfour_aead.c
@@ -82,7 +82,7 @@ static krb5_error_code
 krb5int_arcfour_encrypt_iov(const struct krb5_aead_provider *aead,
                            const struct krb5_enc_provider *enc,
                            const struct krb5_hash_provider *hash,
-                           const krb5_keyblock *key,
+                           krb5_key key,
                            krb5_keyusage usage,
                            const krb5_data *ivec,
                            krb5_crypto_iov *data,
@@ -91,6 +91,7 @@ krb5int_arcfour_encrypt_iov(const struct krb5_aead_provider *aead,
     krb5_error_code ret;
     krb5_crypto_iov *header, *trailer;
     krb5_keyblock k1, k2, k3;
+    krb5_key k3key = NULL;
     krb5_data d1, d2, d3;
     krb5_data checksum, confounder, header_data;
     krb5_keyusage ms_usage;
@@ -126,15 +127,15 @@ krb5int_arcfour_encrypt_iov(const struct krb5_aead_provider *aead,
            data[i].data.length = 0;
     }
 
-    ret = alloc_derived_key(enc, &k1, &d1, key);
+    ret = alloc_derived_key(enc, &k1, &d1, &key->keyblock);
     if (ret != 0)
        goto cleanup;
 
-    ret = alloc_derived_key(enc, &k2, &d2, key);
+    ret = alloc_derived_key(enc, &k2, &d2, &key->keyblock);
     if (ret != 0)
        goto cleanup;
 
-    ret = alloc_derived_key(enc, &k3, &d3, key);
+    ret = alloc_derived_key(enc, &k3, &d3, &key->keyblock);
     if (ret != 0)
        goto cleanup;
 
@@ -144,7 +145,7 @@ krb5int_arcfour_encrypt_iov(const struct krb5_aead_provider *aead,
 
     ms_usage = krb5int_arcfour_translate_usage(usage);
 
-    if (key->enctype == ENCTYPE_ARCFOUR_HMAC_EXP) {
+    if (key->keyblock.enctype == ENCTYPE_ARCFOUR_HMAC_EXP) {
        strncpy(salt.data, krb5int_arcfour_l40, salt.length);
        store_32_le(ms_usage, salt.data + 10);
     } else {
@@ -157,7 +158,7 @@ krb5int_arcfour_encrypt_iov(const struct krb5_aead_provider *aead,
 
     memcpy(k2.contents, k1.contents, k2.length);
 
-    if (key->enctype == ENCTYPE_ARCFOUR_HMAC_EXP)
+    if (key->keyblock.enctype == ENCTYPE_ARCFOUR_HMAC_EXP)
        memset(k1.contents + 7, 0xAB, 9);
 
     header->data.length = hash->hashsize + CONFOUNDERLENGTH;
@@ -176,15 +177,19 @@ krb5int_arcfour_encrypt_iov(const struct krb5_aead_provider *aead,
     header->data.length -= hash->hashsize;
     header->data.data   += hash->hashsize;
 
-    ret = krb5int_hmac_iov(hash, &k2, data, num_data, &checksum);
+    ret = krb5int_hmac_iov_keyblock(hash, &k2, data, num_data, &checksum);
     if (ret != 0)
        goto cleanup;
 
-    ret = krb5_hmac(hash, &k1, 1, &checksum, &d3);
+    ret = krb5int_hmac_keyblock(hash, &k1, 1, &checksum, &d3);
     if (ret != 0)
        goto cleanup;
 
-    ret = enc->encrypt_iov(&k3, ivec, data, num_data);
+    ret = krb5_k_create_key(NULL, &k3, &k3key);
+    if (ret != 0)
+       goto cleanup;
+
+    ret = enc->encrypt_iov(k3key, ivec, data, num_data);
     if (ret != 0)
        goto cleanup;
 
@@ -204,6 +209,7 @@ cleanup:
        free(d3.data);
     }
 
+    krb5_k_free_key(NULL, k3key);
     return ret;
 }
 
@@ -211,7 +217,7 @@ static krb5_error_code
 krb5int_arcfour_decrypt_iov(const struct krb5_aead_provider *aead,
                            const struct krb5_enc_provider *enc,
                            const struct krb5_hash_provider *hash,
-                           const krb5_keyblock *key,
+                           krb5_key key,
                            krb5_keyusage usage,
                            const krb5_data *ivec,
                            krb5_crypto_iov *data,
@@ -220,6 +226,7 @@ krb5int_arcfour_decrypt_iov(const struct krb5_aead_provider *aead,
     krb5_error_code ret;
     krb5_crypto_iov *header, *trailer;
     krb5_keyblock k1, k2, k3;
+    krb5_key k3key = NULL;
     krb5_data d1, d2, d3;
     krb5_data checksum, header_data;
     krb5_keyusage ms_usage;
@@ -240,15 +247,15 @@ krb5int_arcfour_decrypt_iov(const struct krb5_aead_provider *aead,
     if (trailer != NULL && trailer->data.length != 0)
        return KRB5_BAD_MSIZE;
     
-    ret = alloc_derived_key(enc, &k1, &d1, key);
+    ret = alloc_derived_key(enc, &k1, &d1, &key->keyblock);
     if (ret != 0)
        goto cleanup;
 
-    ret = alloc_derived_key(enc, &k2, &d2, key);
+    ret = alloc_derived_key(enc, &k2, &d2, &key->keyblock);
     if (ret != 0)
        goto cleanup;
 
-    ret = alloc_derived_key(enc, &k3, &d3, key);
+    ret = alloc_derived_key(enc, &k3, &d3, &key->keyblock);
     if (ret != 0)
        goto cleanup;
 
@@ -258,7 +265,7 @@ krb5int_arcfour_decrypt_iov(const struct krb5_aead_provider *aead,
 
     ms_usage = krb5int_arcfour_translate_usage(usage);
 
-    if (key->enctype == ENCTYPE_ARCFOUR_HMAC_EXP) {
+    if (key->keyblock.enctype == ENCTYPE_ARCFOUR_HMAC_EXP) {
        strncpy(salt.data, krb5int_arcfour_l40, salt.length);
        store_32_le(ms_usage, (unsigned char *)salt.data + 10);
     } else {
@@ -271,7 +278,7 @@ krb5int_arcfour_decrypt_iov(const struct krb5_aead_provider *aead,
 
     memcpy(k2.contents, k1.contents, k2.length);
 
-    if (key->enctype == ENCTYPE_ARCFOUR_HMAC_EXP)
+    if (key->keyblock.enctype == ENCTYPE_ARCFOUR_HMAC_EXP)
        memset(k1.contents + 7, 0xAB, 9);
 
     checksum.data = header->data.data;
@@ -281,15 +288,19 @@ krb5int_arcfour_decrypt_iov(const struct krb5_aead_provider *aead,
     header->data.length -= hash->hashsize;
     header->data.data   += hash->hashsize;
 
-    ret = krb5_hmac(hash, &k1, 1, &checksum, &d3);
+    ret = krb5int_hmac_keyblock(hash, &k1, 1, &checksum, &d3);
+    if (ret != 0)
+       goto cleanup;
+
+    ret = krb5_k_create_key(NULL, &k3, &k3key);
     if (ret != 0)
        goto cleanup;
 
-    ret = enc->decrypt_iov(&k3, ivec, data, num_data);
+    ret = enc->decrypt_iov(k3key, ivec, data, num_data);
     if (ret != 0)
        goto cleanup;
 
-    ret = krb5int_hmac_iov(hash, &k2, data, num_data, &d1);
+    ret = krb5int_hmac_iov_keyblock(hash, &k2, data, num_data, &d1);
     if (ret != 0)
        goto cleanup;
 
@@ -314,6 +325,7 @@ cleanup:
        free(d3.data);
     }
 
+    krb5_k_free_key(NULL, k3key);
     return ret;
 }
 

diff --git a/src/lib/crypto/openssl/enc_provider/aes.c b/src/lib/crypto/openssl/enc_provider/aes.c
index 81d30630035d9d5b06b2744a533b2eed68d124eb..76f81d41e1c5a64fdcd7daba3e7ce98fd56e6eeb 100644 (file)
--- a/src/lib/crypto/openssl/enc_provider/aes.c
+++ b/src/lib/crypto/openssl/enc_provider/aes.c
@@ -36,22 +36,22 @@
 
 /* proto's */
 static krb5_error_code
-cts_enc(const krb5_keyblock *key, const krb5_data *ivec,
+cts_enc(krb5_key key, const krb5_data *ivec,
                    const krb5_data *input, krb5_data *output);
 static krb5_error_code
-cbc_enc(const krb5_keyblock *key, const krb5_data *ivec,
+cbc_enc(krb5_key key, const krb5_data *ivec,
                    const krb5_data *input, krb5_data *output);
 static krb5_error_code
-cts_decr(const krb5_keyblock *key, const krb5_data *ivec,
+cts_decr(krb5_key key, const krb5_data *ivec,
                    const krb5_data *input, krb5_data *output);
 static krb5_error_code
-cbc_decr(const krb5_keyblock *key, const krb5_data *ivec,
+cbc_decr(krb5_key key, const krb5_data *ivec,
                    const krb5_data *input, krb5_data *output);
 static krb5_error_code
-cts_encr_iov(const krb5_keyblock *key, const krb5_data *ivec,
+cts_encr_iov(krb5_key key, const krb5_data *ivec,
                     krb5_crypto_iov *data, size_t num_data, size_t dlen);
 static krb5_error_code
-cts_decr_iov(const krb5_keyblock *key, const krb5_data *ivec,
+cts_decr_iov(krb5_key key, const krb5_data *ivec,
                     krb5_crypto_iov *data, size_t num_data, size_t dlen);
 
 #define NUM_BITS 8
@@ -69,7 +69,7 @@ map_mode(unsigned int len)
 }
 
 static krb5_error_code
-cbc_enc(const krb5_keyblock *key, const krb5_data *ivec,
+cbc_enc(krb5_key key, const krb5_data *ivec,
                    const krb5_data *input, krb5_data *output)
 {
     int             ret = 0, tmp_len = 0;
@@ -77,7 +77,7 @@ cbc_enc(const krb5_keyblock *key, const krb5_data *ivec,
     unsigned char  *tmp_buf = NULL;
     EVP_CIPHER_CTX  ciph_ctx;
 
-    key_buf = OPENSSL_malloc(key->length);
+    key_buf = OPENSSL_malloc(key->keyblock.length);
     if (!key_buf)
         return ENOMEM;
 
@@ -87,11 +87,11 @@ cbc_enc(const krb5_keyblock *key, const krb5_data *ivec,
         OPENSSL_free(key_buf);
         return ENOMEM;
     }
-    memcpy(key_buf, key->contents, key->length);
+    memcpy(key_buf, key->keyblock.contents, key->keyblock.length);
 
     EVP_CIPHER_CTX_init(&ciph_ctx);
 
-    ret = EVP_EncryptInit_ex(&ciph_ctx, map_mode(key->length),
+    ret = EVP_EncryptInit_ex(&ciph_ctx, map_mode(key->keyblock.length),
                   NULL, key_buf, (ivec) ? (unsigned char*)ivec->data : NULL);
 
     if (ret == 1){
@@ -112,7 +112,7 @@ cbc_enc(const krb5_keyblock *key, const krb5_data *ivec,
         ret = KRB5_CRYPTO_INTERNAL;
     }
 
-    memset(key_buf, 0, key->length);
+    memset(key_buf, 0, key->keyblock.length);
     memset(tmp_buf, 0, input->length);
     OPENSSL_free(key_buf);
     OPENSSL_free(tmp_buf);
@@ -121,7 +121,7 @@ cbc_enc(const krb5_keyblock *key, const krb5_data *ivec,
 }
 
 static krb5_error_code
-cbc_decr(const krb5_keyblock *key, const krb5_data *ivec,
+cbc_decr(krb5_key key, const krb5_data *ivec,
                    const krb5_data *input, krb5_data *output)
 {
     int              ret = 0, tmp_len = 0;
@@ -129,7 +129,7 @@ cbc_decr(const krb5_keyblock *key, const krb5_data *ivec,
     unsigned char   *tmp_buf = NULL;
     EVP_CIPHER_CTX   ciph_ctx;
 
-    key_buf = OPENSSL_malloc(key->length);
+    key_buf = OPENSSL_malloc(key->keyblock.length);
     if (!key_buf)
         return ENOMEM;
 
@@ -139,11 +139,11 @@ cbc_decr(const krb5_keyblock *key, const krb5_data *ivec,
         OPENSSL_free(key_buf);
         return ENOMEM;
     }
-    memcpy(key_buf, key->contents, key->length);
+    memcpy(key_buf, key->keyblock.contents, key->keyblock.length);
 
     EVP_CIPHER_CTX_init(&ciph_ctx);
 
-    ret = EVP_DecryptInit_ex(&ciph_ctx, map_mode(key->length),
+    ret = EVP_DecryptInit_ex(&ciph_ctx, map_mode(key->keyblock.length),
                   NULL, key_buf, (ivec) ? (unsigned char*)ivec->data : NULL);
     if (ret == 1) {
         EVP_CIPHER_CTX_set_padding(&ciph_ctx,0); 
@@ -164,7 +164,7 @@ cbc_decr(const krb5_keyblock *key, const krb5_data *ivec,
         ret = KRB5_CRYPTO_INTERNAL;
     }
 
-    memset(key_buf, 0, key->length);
+    memset(key_buf, 0, key->keyblock.length);
     memset(tmp_buf, 0, input->length);
     OPENSSL_free(key_buf);
     OPENSSL_free(tmp_buf);
@@ -173,7 +173,7 @@ cbc_decr(const krb5_keyblock *key, const krb5_data *ivec,
 }
 
 static krb5_error_code
-cts_enc(const krb5_keyblock *key, const krb5_data *ivec,
+cts_enc(krb5_key key, const krb5_data *ivec,
                    const krb5_data *input, krb5_data *output)
 {
     int             ret = 0, tmp_len = 0;
@@ -194,7 +194,8 @@ cts_enc(const krb5_keyblock *key, const krb5_data *ivec,
         return ENOMEM;
     tmp_len = input->length;
 
-    AES_set_encrypt_key(key->contents, NUM_BITS * key->length, &enck);
+    AES_set_encrypt_key(key->keyblock.contents,
+                       NUM_BITS * key->keyblock.length, &enck);
 
     size = CRYPTO_cts128_encrypt((unsigned char *)input->data, tmp_buf,
                                  input->length, &enck,
@@ -217,7 +218,7 @@ cts_enc(const krb5_keyblock *key, const krb5_data *ivec,
 }
 
 static krb5_error_code
-cts_decr(const krb5_keyblock *key, const krb5_data *ivec,
+cts_decr(krb5_key key, const krb5_data *ivec,
                    const krb5_data *input, krb5_data *output)
 {
     int    ret = 0, tmp_len = 0;
@@ -238,7 +239,8 @@ cts_decr(const krb5_keyblock *key, const krb5_data *ivec,
         return ENOMEM;
     tmp_len = input->length;
 
-    AES_set_decrypt_key(key->contents, NUM_BITS * key->length, &deck);
+    AES_set_decrypt_key(key->keyblock.contents,
+                       NUM_BITS * key->keyblock.length, &deck);
 
     size = CRYPTO_cts128_decrypt((unsigned char *)input->data, tmp_buf,
                                  input->length, &deck,
@@ -261,7 +263,7 @@ cts_decr(const krb5_keyblock *key, const krb5_data *ivec,
 }
 
 static krb5_error_code
-cts_encr_iov(const krb5_keyblock *key,
+cts_encr_iov(krb5_key key,
                        const krb5_data *ivec,
                        krb5_crypto_iov *data,
                        size_t num_data, size_t dlen)
@@ -313,7 +315,8 @@ cts_encr_iov(const krb5_keyblock *key,
         if (tlen > dlen) break;
     }
 
-    AES_set_encrypt_key(key->contents, NUM_BITS * key->length, &enck);
+    AES_set_encrypt_key(key->keyblock.contents,
+                       NUM_BITS * key->keyblock.length, &enck);
 
     size = CRYPTO_cts128_encrypt((unsigned char *)dbuf, oblock, dlen, &enck,
                                  iv_cts, (cbc128_f)AES_cbc_encrypt);
@@ -336,7 +339,7 @@ cts_encr_iov(const krb5_keyblock *key,
 }
 
 static krb5_error_code
-cts_decr_iov(const krb5_keyblock *key,
+cts_decr_iov(krb5_key key,
                        const krb5_data *ivec,
                        krb5_crypto_iov *data,
                        size_t num_data, size_t dlen)
@@ -373,7 +376,8 @@ cts_decr_iov(const krb5_keyblock *key,
     memset(oblock, 0, oblock_len);
     memset(dbuf, 0, dlen);
 
-    AES_set_decrypt_key(key->contents, NUM_BITS * key->length, &deck);
+    AES_set_decrypt_key(key->keyblock.contents,
+                       NUM_BITS * key->keyblock.length, &deck);
 
     tlen = 0;
     for (;;) {
@@ -411,7 +415,7 @@ cts_decr_iov(const krb5_keyblock *key,
 }
 
 krb5_error_code
-krb5int_aes_encrypt(const krb5_keyblock *key, const krb5_data *ivec,
+krb5int_aes_encrypt(krb5_key key, const krb5_data *ivec,
                    const krb5_data *input, krb5_data *output)
 {
     int  ret = 0;
@@ -426,7 +430,7 @@ krb5int_aes_encrypt(const krb5_keyblock *key, const krb5_data *ivec,
 }
 
 krb5_error_code
-krb5int_aes_decrypt(const krb5_keyblock *key, const krb5_data *ivec,
+krb5int_aes_decrypt(krb5_key key, const krb5_data *ivec,
                    const krb5_data *input, krb5_data *output)
 {
     int ret = 0;
@@ -445,7 +449,7 @@ krb5int_aes_decrypt(const krb5_keyblock *key, const krb5_data *ivec,
 }
 
 static krb5_error_code
-krb5int_aes_encrypt_iov(const krb5_keyblock *key,
+krb5int_aes_encrypt_iov(krb5_key key,
                        const krb5_data *ivec,
                        krb5_crypto_iov *data,
                        size_t num_data)
@@ -470,7 +474,7 @@ krb5int_aes_encrypt_iov(const krb5_keyblock *key,
 }
 
 static krb5_error_code
-krb5int_aes_decrypt_iov(const krb5_keyblock *key,
+krb5int_aes_decrypt_iov(krb5_key key,
                        const krb5_data *ivec,
                        krb5_crypto_iov *data,
                        size_t num_data)

diff --git a/src/lib/crypto/openssl/enc_provider/des.c b/src/lib/crypto/openssl/enc_provider/des.c
index 4965c6e6fa4dd78e07b478960274bcf7cde62234..a4208eefcbebd36235bb8481d754ffab2103d51f 100644 (file)
--- a/src/lib/crypto/openssl/enc_provider/des.c
+++ b/src/lib/crypto/openssl/enc_provider/des.c
@@ -11,11 +11,11 @@
 #define DES_KEY_BYTES   7
 
 static krb5_error_code
-validate(const krb5_keyblock *key, const krb5_data *ivec,
+validate(krb5_key key, const krb5_data *ivec,
                       const krb5_data *input, const krb5_data *output)
 {
-    /* key->enctype was checked by the caller */
-    if (key->length != KRB5_MIT_DES_KEYSIZE)
+    /* key->keyblock.enctype was checked by the caller */
+    if (key->keyblock.length != KRB5_MIT_DES_KEYSIZE)
         return(KRB5_BAD_KEYSIZE);
     if ((input->length%8) != 0)
         return(KRB5_BAD_MSIZE);
@@ -28,7 +28,7 @@ validate(const krb5_keyblock *key, const krb5_data *ivec,
 }
 
 static krb5_error_code
-validate_iov(const krb5_keyblock *key, const krb5_data *ivec,
+validate_iov(krb5_key key, const krb5_data *ivec,
                           const krb5_crypto_iov *data, size_t num_data)
 {
     size_t i, input_length;
@@ -39,7 +39,7 @@ validate_iov(const krb5_keyblock *key, const krb5_data *ivec,
             input_length += iov->data.length;
     }
 
-    if (key->length != KRB5_MIT_DES3_KEYSIZE)
+    if (key->keyblock.length != KRB5_MIT_DES3_KEYSIZE)
         return(KRB5_BAD_KEYSIZE);
     if ((input_length%DES_BLOCK_SIZE) != 0)
         return(KRB5_BAD_MSIZE);
@@ -50,7 +50,7 @@ validate_iov(const krb5_keyblock *key, const krb5_data *ivec,
 }
 
 static krb5_error_code
-k5_des_encrypt(const krb5_keyblock *key, const krb5_data *ivec,
+k5_des_encrypt(krb5_key key, const krb5_data *ivec,
            const krb5_data *input, krb5_data *output)
 {
     int              ret = 0, tmp_len = 0;
@@ -63,8 +63,8 @@ k5_des_encrypt(const krb5_keyblock *key, const krb5_data *ivec,
     if (ret)
         return ret;
 
-    keybuf=key->contents;
-    keybuf[key->length] = '\0';
+    keybuf=key->keyblock.contents;
+    keybuf[key->keyblock.length] = '\0';
 
     tmp_buf_len = output->length*2;
     tmp_buf=OPENSSL_malloc(tmp_buf_len);
@@ -103,10 +103,10 @@ k5_des_encrypt(const krb5_keyblock *key, const krb5_data *ivec,
 
 
 static krb5_error_code
-k5_des_decrypt(const krb5_keyblock *key, const krb5_data *ivec,
+k5_des_decrypt(krb5_key key, const krb5_data *ivec,
            const krb5_data *input, krb5_data *output)
 {
-    /* key->enctype was checked by the caller */
+    /* key->keyblock.enctype was checked by the caller */
     int              ret = 0, tmp_len = 0;
     unsigned char   *keybuf  = NULL;
     unsigned char   *tmp_buf;
@@ -116,8 +116,8 @@ k5_des_decrypt(const krb5_keyblock *key, const krb5_data *ivec,
     if (ret)
         return ret;
 
-    keybuf=key->contents;
-    keybuf[key->length] = '\0';
+    keybuf=key->keyblock.contents;
+    keybuf[key->keyblock.length] = '\0';
 
     tmp_buf=OPENSSL_malloc(output->length);
     if (!tmp_buf)
@@ -152,7 +152,7 @@ k5_des_decrypt(const krb5_keyblock *key, const krb5_data *ivec,
 }
 
 static krb5_error_code
-k5_des_encrypt_iov(const krb5_keyblock *key,
+k5_des_encrypt_iov(krb5_key key,
             const krb5_data *ivec,
             krb5_crypto_iov *data,
             size_t num_data)
@@ -176,8 +176,8 @@ k5_des_encrypt_iov(const krb5_keyblock *key,
     IOV_BLOCK_STATE_INIT(&input_pos);
     IOV_BLOCK_STATE_INIT(&output_pos);
 
-    keybuf=key->contents;
-    keybuf[key->length] = '\0';
+    keybuf=key->keyblock.contents;
+    keybuf[key->keyblock.length] = '\0';
 
     ret = validate_iov(key, ivec, data, num_data);
     if (ret)
@@ -229,7 +229,7 @@ k5_des_encrypt_iov(const krb5_keyblock *key,
 }
 
 static krb5_error_code
-k5_des_decrypt_iov(const krb5_keyblock *key,
+k5_des_decrypt_iov(krb5_key key,
            const krb5_data *ivec,
            krb5_crypto_iov *data,
            size_t num_data)
@@ -254,8 +254,8 @@ k5_des_decrypt_iov(const krb5_keyblock *key,
     IOV_BLOCK_STATE_INIT(&input_pos);
     IOV_BLOCK_STATE_INIT(&output_pos);
 
-    keybuf=key->contents;
-    keybuf[key->length] = '\0';
+    keybuf=key->keyblock.contents;
+    keybuf[key->keyblock.length] = '\0';
 
     ret = validate_iov(key, ivec, data, num_data);
     if (ret)

diff --git a/src/lib/crypto/openssl/enc_provider/des3.c b/src/lib/crypto/openssl/enc_provider/des3.c
index 1dec8e27e21f928603a7d4b6cb3d28d7c757d3a1..e20e42e23d8cf4ea94f7b81fc04745e3ae230f04 100644 (file)
--- a/src/lib/crypto/openssl/enc_provider/des3.c
+++ b/src/lib/crypto/openssl/enc_provider/des3.c
@@ -11,12 +11,12 @@
 #define DES_BLOCK_SIZE  8
 
 static krb5_error_code
-validate(const krb5_keyblock *key, const krb5_data *ivec,
+validate(krb5_key key, const krb5_data *ivec,
                      const krb5_data *input, const krb5_data *output)
 {
-    /* key->enctype was checked by the caller */
+    /* key->keyblock.enctype was checked by the caller */
 
-    if (key->length != KRB5_MIT_DES3_KEYSIZE)
+    if (key->keyblock.length != KRB5_MIT_DES3_KEYSIZE)
        return(KRB5_BAD_KEYSIZE);
     if ((input->length%DES_BLOCK_SIZE) != 0)
        return(KRB5_BAD_MSIZE);
@@ -29,7 +29,7 @@ validate(const krb5_keyblock *key, const krb5_data *ivec,
 }
 
 static krb5_error_code
-validate_iov(const krb5_keyblock *key, const krb5_data *ivec,
+validate_iov(krb5_key key, const krb5_data *ivec,
                          const krb5_crypto_iov *data, size_t num_data)
 {
     size_t i, input_length;
@@ -40,7 +40,7 @@ validate_iov(const krb5_keyblock *key, const krb5_data *ivec,
            input_length += iov->data.length;
     }
 
-    if (key->length != KRB5_MIT_DES3_KEYSIZE)
+    if (key->keyblock.length != KRB5_MIT_DES3_KEYSIZE)
        return(KRB5_BAD_KEYSIZE);
     if ((input_length%DES_BLOCK_SIZE) != 0)
        return(KRB5_BAD_MSIZE);
@@ -51,7 +51,7 @@ validate_iov(const krb5_keyblock *key, const krb5_data *ivec,
 }
 
 static krb5_error_code
-k5_des3_encrypt(const krb5_keyblock *key, const krb5_data *ivec,
+k5_des3_encrypt(krb5_key key, const krb5_data *ivec,
                const krb5_data *input, krb5_data *output)
 {
     int              ret = 0, tmp_len = 0;
@@ -64,8 +64,8 @@ k5_des3_encrypt(const krb5_keyblock *key, const krb5_data *ivec,
     if (ret)
        return ret;
 
-    keybuf=key->contents;
-    keybuf[key->length] = '\0';
+    keybuf=key->keyblock.contents;
+    keybuf[key->keyblock.length] = '\0';
 
     tmp_buf_len = output->length * 2;
     tmp_buf = OPENSSL_malloc(tmp_buf_len);
@@ -104,7 +104,7 @@ k5_des3_encrypt(const krb5_keyblock *key, const krb5_data *ivec,
 }
 
 static krb5_error_code
-k5_des3_decrypt(const krb5_keyblock *key, const krb5_data *ivec,
+k5_des3_decrypt(krb5_key key, const krb5_data *ivec,
                const krb5_data *input, krb5_data *output)
 {
     int              ret = 0, tmp_len = 0;
@@ -117,8 +117,8 @@ k5_des3_decrypt(const krb5_keyblock *key, const krb5_data *ivec,
     if (ret)
        return ret;
 
-    keybuf=key->contents;
-    keybuf[key->length] = '\0';
+    keybuf=key->keyblock.contents;
+    keybuf[key->keyblock.length] = '\0';
 
     tmp_buf_len = output->length;
     tmp_buf=OPENSSL_malloc(tmp_buf_len);
@@ -156,7 +156,7 @@ k5_des3_decrypt(const krb5_keyblock *key, const krb5_data *ivec,
 }
 
 static krb5_error_code
-k5_des3_encrypt_iov(const krb5_keyblock *key,
+k5_des3_encrypt_iov(krb5_key key,
                    const krb5_data *ivec,
                    krb5_crypto_iov *data,
                    size_t num_data)
@@ -185,8 +185,8 @@ k5_des3_encrypt_iov(const krb5_keyblock *key,
     IOV_BLOCK_STATE_INIT(&input_pos);
     IOV_BLOCK_STATE_INIT(&output_pos);
 
-    keybuf=key->contents;
-    keybuf[key->length] = '\0';
+    keybuf=key->keyblock.contents;
+    keybuf[key->keyblock.length] = '\0';
 
     memset(oblock, 0, oblock_len);
 
@@ -236,7 +236,7 @@ k5_des3_encrypt_iov(const krb5_keyblock *key,
 }
 
 static krb5_error_code
-k5_des3_decrypt_iov(const krb5_keyblock *key,
+k5_des3_decrypt_iov(krb5_key key,
                    const krb5_data *ivec,
                    krb5_crypto_iov *data,
                    size_t num_data)
@@ -265,8 +265,8 @@ k5_des3_decrypt_iov(const krb5_keyblock *key,
     IOV_BLOCK_STATE_INIT(&input_pos);
     IOV_BLOCK_STATE_INIT(&output_pos);
 
-    keybuf=key->contents;
-    keybuf[key->length] = '\0';
+    keybuf=key->keyblock.contents;
+    keybuf[key->keyblock.length] = '\0';
 
     memset(oblock, 0, oblock_len);
 

diff --git a/src/lib/crypto/openssl/enc_provider/rc4.c b/src/lib/crypto/openssl/enc_provider/rc4.c
index ae2f58f40690295507375a3cb91e4faf2e950f26..fd1c7238d6e69ef50ae7086b43a30a074820edec 100644 (file)
--- a/src/lib/crypto/openssl/enc_provider/rc4.c
+++ b/src/lib/crypto/openssl/enc_provider/rc4.c
@@ -15,7 +15,7 @@
 
 /* prototypes */
 static krb5_error_code
-k5_arcfour_docrypt(const krb5_keyblock *, const krb5_data *,
+k5_arcfour_docrypt(krb5_key, const krb5_data *,
            const krb5_data *, krb5_data *);
 static krb5_error_code 
 k5_arcfour_free_state ( krb5_data *state);
@@ -29,7 +29,7 @@ k5_arcfour_init_state (const krb5_keyblock *key,
 
 /* In-place rc4 crypto */
 static krb5_error_code
-k5_arcfour_docrypt(const krb5_keyblock *key, const krb5_data *state,
+k5_arcfour_docrypt(krb5_key key, const krb5_data *state,
            const krb5_data *input, krb5_data *output)
 {
     int ret = 0, tmp_len = 0;
@@ -37,14 +37,14 @@ k5_arcfour_docrypt(const krb5_keyblock *key, const krb5_data *state,
     unsigned char   *tmp_buf = NULL;
     EVP_CIPHER_CTX  ciph_ctx;
 
-    if (key->length != RC4_KEY_SIZE)
+    if (key->keyblock.length != RC4_KEY_SIZE)
         return(KRB5_BAD_KEYSIZE);
 
     if (input->length != output->length)
         return(KRB5_BAD_MSIZE);
 
-    keybuf=key->contents;
-    keybuf[key->length] = '\0';
+    keybuf=key->keyblock.contents;
+    keybuf[key->keyblock.length] = '\0';
 
     EVP_CIPHER_CTX_init(&ciph_ctx);
 
@@ -72,7 +72,7 @@ k5_arcfour_docrypt(const krb5_keyblock *key, const krb5_data *state,
 
 /* In-place IOV crypto */
 static krb5_error_code
-k5_arcfour_docrypt_iov(const krb5_keyblock *key,
+k5_arcfour_docrypt_iov(krb5_key key,
                const krb5_data *state,
                krb5_crypto_iov *data,
                size_t num_data)
@@ -84,8 +84,8 @@ k5_arcfour_docrypt_iov(const krb5_keyblock *key,
     krb5_crypto_iov *iov     = NULL;
     EVP_CIPHER_CTX  ciph_ctx;
 
-    keybuf=key->contents;
-    keybuf[key->length] = '\0';
+    keybuf=key->keyblock.contents;
+    keybuf[key->keyblock.length] = '\0';
 
     EVP_CIPHER_CTX_init(&ciph_ctx);
 

diff --git a/src/lib/crypto/openssl/hmac.c b/src/lib/crypto/openssl/hmac.c
index e0c8dec7968e50c598beedb08268ed6957e42904..658bc28f1055ff890fbb4aa9d08de866984410e1 100644 (file)
--- a/src/lib/crypto/openssl/hmac.c
+++ b/src/lib/crypto/openssl/hmac.c
@@ -32,8 +32,9 @@ map_digest(const struct krb5_hash_provider *hash)
 }
 
 krb5_error_code
-krb5_hmac(const struct krb5_hash_provider *hash, const krb5_keyblock *key,
-          unsigned int icount, const krb5_data *input, krb5_data *output)
+krb5int_hmac_keyblock(const struct krb5_hash_provider *hash,
+                     const krb5_keyblock *key, unsigned int icount,
+                     const krb5_data *input, krb5_data *output)
 {
     unsigned int i = 0, md_len = 0; 
     unsigned char md[EVP_MAX_MD_SIZE];
@@ -72,8 +73,10 @@ krb5_hmac(const struct krb5_hash_provider *hash, const krb5_keyblock *key,
 }
 
 krb5_error_code
-krb5int_hmac_iov(const struct krb5_hash_provider *hash, const krb5_keyblock *key,
-                 const krb5_crypto_iov *data, size_t num_data, krb5_data *output)
+krb5int_hmac_iov_keyblock(const struct krb5_hash_provider *hash,
+                          const krb5_keyblock *key,
+                          const krb5_crypto_iov *data, size_t num_data,
+                          krb5_data *output)
 {
     krb5_data *sign_data;
     size_t num_sign_data;
@@ -101,10 +104,25 @@ krb5int_hmac_iov(const struct krb5_hash_provider *hash, const krb5_keyblock *key
     }
 
     /* caller must store checksum in iov as it may be TYPE_TRAILER or TYPE_CHECKSUM */
-    ret = krb5_hmac(hash, key, num_sign_data, sign_data, output);
+    ret = krb5int_hmac_keyblock(hash, key, num_sign_data, sign_data, output);
 
     free(sign_data);
 
     return ret;
 }
 
+krb5_error_code
+krb5_hmac(const struct krb5_hash_provider *hash, krb5_key key,
+         unsigned int icount, const krb5_data *input, krb5_data *output)
+{
+    return krb5int_hmac_keyblock(hash, &key->keyblock, icount, input, output);
+}
+
+krb5_error_code
+krb5int_hmac_iov(const struct krb5_hash_provider *hash, krb5_key key,
+                const krb5_crypto_iov *data, size_t num_data,
+                krb5_data *output)
+{
+    return krb5int_hmac_iov_keyblock(hash, &key->keyblock, data, num_data,
+                                    output);
+}