From: Nikos Mavrogiannopoulos Date: Mon, 7 Feb 2011 19:13:59 +0000 (+0100) Subject: Removed gnutls_psk_netconf_derive_key. X-Git-Tag: gnutls_2_99_0~297 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8d63e87199485f15adf91c411243f3121f1b07e1;p=thirdparty%2Fgnutls.git Removed gnutls_psk_netconf_derive_key. --- diff --git a/NEWS b/NEWS index 4c6b45a73a..ba01bd7eac 100644 --- a/NEWS +++ b/NEWS @@ -27,6 +27,7 @@ it can verify a certificate chain against a list of certificates. ** API and ABI modifications: gnutls_cipher_add_auth: ADDED gnutls_cipher_tag: ADDED +gnutls_psk_netconf_derive_key: REMOVED gnutls_certificate_verify_peers: REMOVED gnutls_session_set_finished_function: REMOVED gnutls_ext_register: REMOVED @@ -112,7 +113,6 @@ gnutls_x509_crl_sign2: DEPRECATED (use: gnutls_x509_crl_privkey_sign) gnutls_x509_privkey_sign_data: DEPRECATED (use: gnutls_privkey_sign_data2) gnutls_x509_privkey_sign_hash: DEPRECATED (use: gnutls_privkey_sign_hash2) gnutls_x509_privkey_verify_data: DEPRECATED (use: gnutls_pubkey_verify_data) -gnutls_psk_netconf_derive_key: DEPRECATED gnutls_session_set_finished_function: DEPRECATED gnutls_x509_crt_verify_hash: DEPRECATED (use: gnutls_pubkey_verify_hash) gnutls_x509_crt_verify_data: DEPRECATED (use: gnutls_pubkey_verify_data) diff --git a/doc/cha-auth.texi b/doc/cha-auth.texi index f02fd97a95..73e8c23665 100644 --- a/doc/cha-auth.texi +++ b/doc/cha-auth.texi @@ -341,13 +341,6 @@ by sending a hint. In the server, specify the hint by calling the hint, for example in the callback function, using @ref{gnutls_psk_client_get_hint}. -There is no mechanism to derive a PSK key from a password -specified by the TLS PSK document@footnote{GnuTLS used to provide -@code{gnutls_psk_netconf_derive_key} which follows the algorithm -specified in @file{draft-ietf-netconf-tls-02.txt}. This method -is deprecated and might be removed in later versions of GnuTLS.}. -For password-based authentication check @ref{Authentication using SRP}. - Some helper functions such as: @itemize diff --git a/doc/cha-programs.texi b/doc/cha-programs.texi index 1a892ac08c..60b3514c77 100644 --- a/doc/cha-programs.texi +++ b/doc/cha-programs.texi @@ -792,20 +792,12 @@ Usage : psktool [options] -u, --username username specify username. -p, --passwd FILE specify a password file. - -n, --netconf-hint HINT - derive key from Netconf password, using - HINT as the psk_identity_hint. -s, --keysize SIZE specify the key size in bytes. -v, --version prints the program's version number -h, --help shows this help text @end verbatim -Normally the file will generate random keys for the indicate username. -You may also derive PSK keys from passwords, using the algorithm -specified in @file{draft-ietf-netconf-tls-02.txt}. The algorithm -needs a PSK identity hint, which you specify using -@code{--netconf-hint}. To derive a PSK key from a password with an -empty PSK identity hint, using @code{--netconf-hint ""}. +Normally the file will generate random keys for the indicated username. @node Invoking srptool @section Invoking srptool diff --git a/lib/Makefile.am b/lib/Makefile.am index f7654b3602..e96e6deb62 100644 --- a/lib/Makefile.am +++ b/lib/Makefile.am @@ -60,7 +60,7 @@ SRP_COBJECTS = ext_srp.c gnutls_srp.c auth_srp.c auth_srp_passwd.c \ auth_srp_sb64.c auth_srp_rsa.c PSK_COBJECTS = auth_psk.c auth_psk_passwd.c gnutls_psk.c \ - auth_dhe_psk.c gnutls_psk_netconf.c + auth_dhe_psk.c SESSION_TICKET_COBJECTS = ext_session_ticket.c diff --git a/lib/gnutls_psk_netconf.c b/lib/gnutls_psk_netconf.c deleted file mode 100644 index 1df072bcf9..0000000000 --- a/lib/gnutls_psk_netconf.c +++ /dev/null @@ -1,140 +0,0 @@ -/* - * Copyright (C) 2008, 2010 Free Software Foundation, Inc. - * - * Author: Simon Josefsson - * - * This file is part of GnuTLS. - * - * The GnuTLS is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public License - * as published by the Free Software Foundation; either version 2.1 of - * the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, - * USA - * - */ - -/* Functions to support draft-ietf-netconf-tls-01.txt. */ - -#include -#include -#include - -#ifdef ENABLE_PSK - - -/*- - * gnutls_psk_netconf_derive_key: - * @password: zero terminated string containing password. - * @psk_identity: zero terminated string with PSK identity. - * @psk_identity_hint: zero terminated string with PSK identity hint. - * @output_key: output variable, contains newly allocated *data pointer. - * - * This function will derive a PSK key from a password, for use with - * the Netconf protocol. - * - * Returns: %GNUTLS_E_SUCCESS on success, or an error code. - * - * Since: 2.4.0 - * Deprecated in: 2.11.0 - -*/ -int -gnutls_psk_netconf_derive_key (const char *password, - const char *psk_identity, - const char *psk_identity_hint, - gnutls_datum_t * output_key) -{ - const char netconf_key_pad[] = "Key Pad for Netconf"; - size_t sha1len = _gnutls_hash_get_algo_len (GNUTLS_DIG_SHA1); - size_t hintlen = strlen (psk_identity_hint); - digest_hd_st dig; - char *inner; - size_t innerlen; - int rc; - - /* - * PSK = SHA-1(SHA-1(psk_identity + "Key Pad for Netconf" + password) + - * psk_identity_hint) - * - */ - - rc = _gnutls_hash_init (&dig, GNUTLS_DIG_SHA1); - if (rc < 0) - { - gnutls_assert (); - return rc; - } - - rc = _gnutls_hash (&dig, psk_identity, strlen (psk_identity)); - if (rc < 0) - { - gnutls_assert (); - _gnutls_hash_deinit (&dig, NULL); - return rc; - } - - rc = _gnutls_hash (&dig, netconf_key_pad, strlen (netconf_key_pad)); - if (rc < 0) - { - gnutls_assert (); - _gnutls_hash_deinit (&dig, NULL); - return rc; - } - - rc = _gnutls_hash (&dig, password, strlen (password)); - if (rc < 0) - { - gnutls_assert (); - _gnutls_hash_deinit (&dig, NULL); - return rc; - } - - innerlen = sha1len + hintlen; - inner = gnutls_malloc (innerlen); - _gnutls_hash_deinit (&dig, inner); - if (inner == NULL) - { - gnutls_assert (); - return GNUTLS_E_MEMORY_ERROR; - } - - memcpy (inner + sha1len, psk_identity_hint, hintlen); - - rc = _gnutls_hash_init (&dig, GNUTLS_DIG_SHA1); - if (rc < 0) - { - gnutls_assert (); - gnutls_free (inner); - return rc; - } - - rc = _gnutls_hash (&dig, inner, innerlen); - gnutls_free (inner); - if (rc < 0) - { - gnutls_assert (); - _gnutls_hash_deinit (&dig, NULL); - return rc; - } - - output_key->data = gnutls_malloc (sha1len); - _gnutls_hash_deinit (&dig, output_key->data); - if (output_key->data == NULL) - { - gnutls_assert (); - return GNUTLS_E_MEMORY_ERROR; - } - output_key->size = sha1len; - - return 0; -} - -#endif /* ENABLE_PSK */ diff --git a/lib/includes/gnutls/compat.h b/lib/includes/gnutls/compat.h index 46673cb2d8..fed5795455 100644 --- a/lib/includes/gnutls/compat.h +++ b/lib/includes/gnutls/compat.h @@ -177,13 +177,6 @@ gnutls_sign_func gnutls_sign_callback_get (gnutls_session_t session, void **userdata) _GNUTLS_GCC_ATTR_DEPRECATED; - int gnutls_psk_netconf_derive_key (const char *password, - const char *psk_identity, - const char *psk_identity_hint, - gnutls_datum_t * - output_key) - _GNUTLS_GCC_ATTR_DEPRECATED; - /* This is a very dangerous and error-prone function. * Use gnutls_privkey_sign_hash2() instead. */