+++ /dev/null
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-/* lib/crypto/krb/checksum_cbc.c */
-/*
- * Copyright (C) 2009 by the Massachusetts Institute of Technology.
- * All rights reserved.
- *
- * Export of this software from the United States of America may
- * require a specific license from the United States Government.
- * It is the responsibility of any person or organization contemplating
- * export to obtain such a license before exporting.
- *
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission. Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose. It is provided "as is" without express
- * or implied warranty.
- */
-
-/* CBC checksum, which computes the ivec resulting from CBC encryption of the
- * input. */
-
-#include "crypto_int.h"
-
-krb5_error_code
-krb5int_cbc_checksum(const struct krb5_cksumtypes *ctp,
- krb5_key key, krb5_keyusage usage,
- const krb5_crypto_iov *data, size_t num_data,
- krb5_data *output)
-{
- if (ctp->enc->cbc_mac == NULL)
- return KRB5_CRYPTO_INTERNAL;
- return ctp->enc->cbc_mac(key, data, num_data, NULL, output);
-}
+++ /dev/null
-/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
-/* lib/crypto/krb/checksum_confounder.c */
-/*
- * Copyright (C) 2009 by the Massachusetts Institute of Technology.
- * All rights reserved.
- *
- * Export of this software from the United States of America may
- * require a specific license from the United States Government.
- * It is the responsibility of any person or organization contemplating
- * export to obtain such a license before exporting.
- *
- * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
- * distribute this software and its documentation for any purpose and
- * without fee is hereby granted, provided that the above copyright
- * notice appear in all copies and that both that copyright notice and
- * this permission notice appear in supporting documentation, and that
- * the name of M.I.T. not be used in advertising or publicity pertaining
- * to distribution of the software without specific, written prior
- * permission. Furthermore if you modify this software you must label
- * your software as modified software and not distribute it in such a
- * fashion that it might be confused with the original M.I.T. software.
- * M.I.T. makes no representations about the suitability of
- * this software for any purpose. It is provided "as is" without express
- * or implied warranty.
- */
-
-/*
- * Confounder checksum implementation, using tokens of the form:
- * enc(xorkey, confounder | hash(confounder | data))
- * where xorkey is the key XOR'd with 0xf0 bytes.
- */
-
-#include "crypto_int.h"
-
-/* Derive a key by XOR with 0xF0 bytes. */
-static krb5_error_code
-mk_xorkey(krb5_key origkey, krb5_key *xorkey)
-{
- krb5_error_code retval = 0;
- unsigned char *xorbytes;
- krb5_keyblock xorkeyblock;
- size_t i = 0;
-
- xorbytes = k5memdup(origkey->keyblock.contents, origkey->keyblock.length,
- &retval);
- if (xorbytes == NULL)
- return retval;
- for (i = 0; i < origkey->keyblock.length; i++)
- xorbytes[i] ^= 0xf0;
-
- /* Do a shallow copy here. */
- xorkeyblock = origkey->keyblock;
- xorkeyblock.contents = xorbytes;
-
- retval = krb5_k_create_key(0, &xorkeyblock, xorkey);
- zapfree(xorbytes, origkey->keyblock.length);
- return retval;
-}
-
-krb5_error_code
-krb5int_confounder_checksum(const struct krb5_cksumtypes *ctp,
- krb5_key key, krb5_keyusage usage,
- const krb5_crypto_iov *data, size_t num_data,
- krb5_data *output)
-{
- krb5_error_code ret;
- krb5_data conf, hashval;
- krb5_key xorkey = NULL;
- krb5_crypto_iov *hash_iov, iov;
- size_t blocksize = ctp->enc->block_size, hashsize = ctp->hash->hashsize;
-
- /* Partition the output buffer into confounder and hash. */
- conf = make_data(output->data, blocksize);
- hashval = make_data(output->data + blocksize, hashsize);
-
- /* Create the confounder. */
- ret = krb5_c_random_make_octets(NULL, &conf);
- if (ret != 0)
- return ret;
-
- ret = mk_xorkey(key, &xorkey);
- if (ret)
- return ret;
-
- /* Hash the confounder, then the input data. */
- hash_iov = k5calloc(num_data + 1, sizeof(krb5_crypto_iov), &ret);
- if (hash_iov == NULL)
- goto cleanup;
- hash_iov[0].flags = KRB5_CRYPTO_TYPE_DATA;
- hash_iov[0].data = conf;
- memcpy(hash_iov + 1, data, num_data * sizeof(krb5_crypto_iov));
- ret = ctp->hash->hash(hash_iov, num_data + 1, &hashval);
- if (ret != 0)
- goto cleanup;
-
- /* Confounder and hash are in output buffer; encrypt them in place. */
- iov.flags = KRB5_CRYPTO_TYPE_DATA;
- iov.data = *output;
- ret = ctp->enc->encrypt(xorkey, NULL, &iov, 1);
-
-cleanup:
- free(hash_iov);
- krb5_k_free_key(NULL, xorkey);
- return ret;
-}
-
-krb5_error_code krb5int_confounder_verify(const struct krb5_cksumtypes *ctp,
- krb5_key key, krb5_keyusage usage,
- const krb5_crypto_iov *data,
- size_t num_data,
- const krb5_data *input,
- krb5_boolean *valid)
-{
- krb5_error_code ret;
- unsigned char *plaintext = NULL;
- krb5_key xorkey = NULL;
- krb5_data computed = empty_data();
- krb5_crypto_iov *hash_iov = NULL, iov;
- size_t blocksize = ctp->enc->block_size, hashsize = ctp->hash->hashsize;
-
- plaintext = k5memdup(input->data, input->length, &ret);
- if (plaintext == NULL)
- return ret;
-
- ret = mk_xorkey(key, &xorkey);
- if (ret != 0)
- goto cleanup;
-
- /* Decrypt the input checksum. */
- iov.flags = KRB5_CRYPTO_TYPE_DATA;
- iov.data = make_data(plaintext, input->length);
- ret = ctp->enc->decrypt(xorkey, NULL, &iov, 1);
- if (ret != 0)
- goto cleanup;
-
- /* Hash the confounder, then the input data. */
- hash_iov = k5calloc(num_data + 1, sizeof(krb5_crypto_iov), &ret);
- if (hash_iov == NULL)
- goto cleanup;
- hash_iov[0].flags = KRB5_CRYPTO_TYPE_DATA;
- hash_iov[0].data = make_data(plaintext, blocksize);
- memcpy(hash_iov + 1, data, num_data * sizeof(krb5_crypto_iov));
- ret = alloc_data(&computed, hashsize);
- if (ret != 0)
- goto cleanup;
- ret = ctp->hash->hash(hash_iov, num_data + 1, &computed);
- if (ret != 0)
- goto cleanup;
-
- /* Compare the decrypted hash to the computed one. */
- *valid = (k5_bcmp(plaintext + blocksize, computed.data, hashsize) == 0);
-
-cleanup:
- zapfree(plaintext, input->length);
- zapfree(computed.data, hashsize);
- free(hash_iov);
- krb5_k_free_key(NULL, xorkey);
- return ret;
-}
const krb5_crypto_iov *data,
size_t num_data,
krb5_data *output);
-krb5_error_code krb5int_cbc_checksum(const struct krb5_cksumtypes *ctp,
- krb5_key key, krb5_keyusage usage,
- const krb5_crypto_iov *data,
- size_t num_data,
- krb5_data *output);
krb5_error_code krb5int_hmacmd5_checksum(const struct krb5_cksumtypes *ctp,
krb5_key key, krb5_keyusage usage,
const krb5_crypto_iov *data,
krb5_key key, krb5_keyusage usage,
const krb5_crypto_iov *data,
size_t num_data, krb5_data *output);
-krb5_error_code krb5int_confounder_checksum(const struct krb5_cksumtypes *ctp,
- krb5_key key, krb5_keyusage usage,
- const krb5_crypto_iov *data,
- size_t num_data,
- krb5_data *output);
-krb5_error_code krb5int_confounder_verify(const struct krb5_cksumtypes *ctp,
- krb5_key key, krb5_keyusage usage,
- const krb5_crypto_iov *data,
- size_t num_data,
- const krb5_data *input,
- krb5_boolean *valid);
krb5_error_code krb5int_etm_checksum(const struct krb5_cksumtypes *ctp,
krb5_key key, krb5_keyusage usage,
const krb5_crypto_iov *data,
$(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
$(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
cf2.c crypto_int.h
-checksum_cbc.so checksum_cbc.po $(OUTPRE)checksum_cbc.$(OBJEXT): \
- $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
- $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
- $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/crypto_mod.h \
- $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
- $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
- $(top_srcdir)/include/socket-utils.h checksum_cbc.c \
- crypto_int.h
-checksum_confounder.so checksum_confounder.po $(OUTPRE)checksum_confounder.$(OBJEXT): \
- $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
- $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
- $(COM_ERR_DEPS) $(srcdir)/../builtin/aes/aes.h $(srcdir)/../builtin/crypto_mod.h \
- $(srcdir)/../builtin/sha2/sha2.h $(top_srcdir)/include/k5-buf.h \
- $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \
- $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \
- $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \
- $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
- $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
- $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
- $(top_srcdir)/include/socket-utils.h checksum_confounder.c \
- crypto_int.h
checksum_dk_cmac.so checksum_dk_cmac.po $(OUTPRE)checksum_dk_cmac.$(OBJEXT): \
$(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
$(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
projects / thirdparty / krb5.git / commitdiff
