blob: 96b1565d232a9f0131ed8e2fcd78954fbaa9796c [file] [log] [blame]
Damien Millera664e872000-04-16 11:52:47 +10001/*
2 * Copyright (c) 2000 Markus Friedl. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
Damien Millera664e872000-04-16 11:52:47 +100012 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
24
25#include "includes.h"
Ben Lindstrom46c16222000-12-22 01:43:59 +000026RCSID("$OpenBSD: ssh-dss.c,v 1.2 2000/12/19 23:17:58 markus Exp $");
Damien Millera664e872000-04-16 11:52:47 +100027
28#include "ssh.h"
29#include "xmalloc.h"
30#include "buffer.h"
31#include "bufaux.h"
32#include "compat.h"
33
34#include <openssl/bn.h>
Damien Millera664e872000-04-16 11:52:47 +100035#include <openssl/rsa.h>
36#include <openssl/dsa.h>
37#include <openssl/evp.h>
Damien Millera664e872000-04-16 11:52:47 +100038
Damien Millera664e872000-04-16 11:52:47 +100039#include "key.h"
40
41#define INTBLOB_LEN 20
42#define SIGBLOB_LEN (2*INTBLOB_LEN)
43
Damien Millera664e872000-04-16 11:52:47 +100044int
Damien Miller0bc1bd82000-11-13 22:57:25 +110045ssh_dss_sign(
Damien Millera664e872000-04-16 11:52:47 +100046 Key *key,
Ben Lindstrom46c16222000-12-22 01:43:59 +000047 u_char **sigp, int *lenp,
48 u_char *data, int datalen)
Damien Millera664e872000-04-16 11:52:47 +100049{
Ben Lindstrom46c16222000-12-22 01:43:59 +000050 u_char *digest;
51 u_char *ret;
Damien Millera664e872000-04-16 11:52:47 +100052 DSA_SIG *sig;
53 EVP_MD *evp_md = EVP_sha1();
54 EVP_MD_CTX md;
Ben Lindstrom46c16222000-12-22 01:43:59 +000055 u_int rlen;
56 u_int slen;
57 u_int len;
58 u_char sigblob[SIGBLOB_LEN];
Damien Millera664e872000-04-16 11:52:47 +100059 Buffer b;
60
61 if (key == NULL || key->type != KEY_DSA || key->dsa == NULL) {
Damien Miller0bc1bd82000-11-13 22:57:25 +110062 error("ssh_dss_sign: no DSA key");
Damien Millera664e872000-04-16 11:52:47 +100063 return -1;
64 }
65 digest = xmalloc(evp_md->md_size);
66 EVP_DigestInit(&md, evp_md);
Damien Millereba71ba2000-04-29 23:57:08 +100067 EVP_DigestUpdate(&md, data, datalen);
Damien Millera664e872000-04-16 11:52:47 +100068 EVP_DigestFinal(&md, digest, NULL);
69
70 sig = DSA_do_sign(digest, evp_md->md_size, key->dsa);
Damien Millereba71ba2000-04-29 23:57:08 +100071 if (sig == NULL) {
Damien Miller0bc1bd82000-11-13 22:57:25 +110072 fatal("ssh_dss_sign: cannot sign");
Damien Millereba71ba2000-04-29 23:57:08 +100073 }
Damien Millera664e872000-04-16 11:52:47 +100074
75 rlen = BN_num_bytes(sig->r);
76 slen = BN_num_bytes(sig->s);
77 if (rlen > INTBLOB_LEN || slen > INTBLOB_LEN) {
78 error("bad sig size %d %d", rlen, slen);
79 DSA_SIG_free(sig);
80 return -1;
81 }
82 debug("sig size %d %d", rlen, slen);
83
84 memset(sigblob, 0, SIGBLOB_LEN);
85 BN_bn2bin(sig->r, sigblob+ SIGBLOB_LEN - INTBLOB_LEN - rlen);
86 BN_bn2bin(sig->s, sigblob+ SIGBLOB_LEN - slen);
87 DSA_SIG_free(sig);
88
Damien Miller30c3d422000-05-09 11:02:59 +100089 if (datafellows & SSH_BUG_SIGBLOB) {
Damien Millera664e872000-04-16 11:52:47 +100090 debug("datafellows");
91 ret = xmalloc(SIGBLOB_LEN);
92 memcpy(ret, sigblob, SIGBLOB_LEN);
93 if (lenp != NULL)
94 *lenp = SIGBLOB_LEN;
95 if (sigp != NULL)
96 *sigp = ret;
97 } else {
98 /* ietf-drafts */
99 buffer_init(&b);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100100 buffer_put_cstring(&b, "ssh-dss");
Damien Millera664e872000-04-16 11:52:47 +1000101 buffer_put_string(&b, sigblob, SIGBLOB_LEN);
102 len = buffer_len(&b);
103 ret = xmalloc(len);
104 memcpy(ret, buffer_ptr(&b), len);
105 buffer_free(&b);
106 if (lenp != NULL)
107 *lenp = len;
108 if (sigp != NULL)
109 *sigp = ret;
110 }
111 return 0;
112}
113int
Damien Miller0bc1bd82000-11-13 22:57:25 +1100114ssh_dss_verify(
Damien Millera664e872000-04-16 11:52:47 +1000115 Key *key,
Ben Lindstrom46c16222000-12-22 01:43:59 +0000116 u_char *signature, int signaturelen,
117 u_char *data, int datalen)
Damien Millera664e872000-04-16 11:52:47 +1000118{
119 Buffer b;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000120 u_char *digest;
Damien Millera664e872000-04-16 11:52:47 +1000121 DSA_SIG *sig;
122 EVP_MD *evp_md = EVP_sha1();
123 EVP_MD_CTX md;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000124 u_char *sigblob;
Damien Millera664e872000-04-16 11:52:47 +1000125 char *txt;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000126 u_int len, dlen;
Damien Millera664e872000-04-16 11:52:47 +1000127 int rlen;
128 int ret;
129
130 if (key == NULL || key->type != KEY_DSA || key->dsa == NULL) {
Damien Miller0bc1bd82000-11-13 22:57:25 +1100131 error("ssh_dss_verify: no DSA key");
Damien Millera664e872000-04-16 11:52:47 +1000132 return -1;
133 }
134
Damien Miller30c3d422000-05-09 11:02:59 +1000135 if (!(datafellows & SSH_BUG_SIGBLOB) &&
136 signaturelen == SIGBLOB_LEN) {
137 datafellows |= ~SSH_BUG_SIGBLOB;
138 log("autodetect SSH_BUG_SIGBLOB");
139 } else if ((datafellows & SSH_BUG_SIGBLOB) &&
140 signaturelen != SIGBLOB_LEN) {
141 log("autoremove SSH_BUG_SIGBLOB");
142 datafellows &= ~SSH_BUG_SIGBLOB;
Damien Millera664e872000-04-16 11:52:47 +1000143 }
144
145 debug("len %d datafellows %d", signaturelen, datafellows);
146
147 /* fetch signature */
Damien Miller30c3d422000-05-09 11:02:59 +1000148 if (datafellows & SSH_BUG_SIGBLOB) {
Damien Millera664e872000-04-16 11:52:47 +1000149 sigblob = signature;
150 len = signaturelen;
151 } else {
152 /* ietf-drafts */
Damien Miller6536c7d2000-06-22 21:32:31 +1000153 char *ktype;
Damien Millera664e872000-04-16 11:52:47 +1000154 buffer_init(&b);
155 buffer_append(&b, (char *) signature, signaturelen);
156 ktype = buffer_get_string(&b, NULL);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100157 if (strcmp("ssh-dss", ktype) != 0) {
158 error("ssh_dss_verify: cannot handle type %s", ktype);
Damien Miller6536c7d2000-06-22 21:32:31 +1000159 buffer_free(&b);
160 return -1;
161 }
Ben Lindstrom46c16222000-12-22 01:43:59 +0000162 sigblob = (u_char *)buffer_get_string(&b, &len);
Damien Millera664e872000-04-16 11:52:47 +1000163 rlen = buffer_len(&b);
Damien Miller6536c7d2000-06-22 21:32:31 +1000164 if(rlen != 0) {
Damien Millera664e872000-04-16 11:52:47 +1000165 error("remaining bytes in signature %d", rlen);
Damien Miller6536c7d2000-06-22 21:32:31 +1000166 buffer_free(&b);
167 return -1;
168 }
Damien Millera664e872000-04-16 11:52:47 +1000169 buffer_free(&b);
Damien Miller6536c7d2000-06-22 21:32:31 +1000170 xfree(ktype);
Damien Millera664e872000-04-16 11:52:47 +1000171 }
172
173 if (len != SIGBLOB_LEN) {
174 fatal("bad sigbloblen %d != SIGBLOB_LEN", len);
175 }
176
177 /* parse signature */
178 sig = DSA_SIG_new();
179 sig->r = BN_new();
180 sig->s = BN_new();
181 BN_bin2bn(sigblob, INTBLOB_LEN, sig->r);
182 BN_bin2bn(sigblob+ INTBLOB_LEN, INTBLOB_LEN, sig->s);
Damien Miller30c3d422000-05-09 11:02:59 +1000183
184 if (!(datafellows & SSH_BUG_SIGBLOB)) {
Damien Millera664e872000-04-16 11:52:47 +1000185 memset(sigblob, 0, len);
186 xfree(sigblob);
187 }
188
Damien Millereba71ba2000-04-29 23:57:08 +1000189 /* sha1 the data */
Damien Miller0bc1bd82000-11-13 22:57:25 +1100190 dlen = evp_md->md_size;
191 digest = xmalloc(dlen);
Damien Millera664e872000-04-16 11:52:47 +1000192 EVP_DigestInit(&md, evp_md);
Damien Millereba71ba2000-04-29 23:57:08 +1000193 EVP_DigestUpdate(&md, data, datalen);
Damien Millera664e872000-04-16 11:52:47 +1000194 EVP_DigestFinal(&md, digest, NULL);
195
Damien Miller0bc1bd82000-11-13 22:57:25 +1100196 ret = DSA_do_verify(digest, dlen, sig, key->dsa);
Damien Millera664e872000-04-16 11:52:47 +1000197
Damien Miller0bc1bd82000-11-13 22:57:25 +1100198 memset(digest, 0, dlen);
Damien Millera664e872000-04-16 11:52:47 +1000199 xfree(digest);
200 DSA_SIG_free(sig);
201
202 switch (ret) {
203 case 1:
204 txt = "correct";
205 break;
206 case 0:
207 txt = "incorrect";
208 break;
209 case -1:
210 default:
211 txt = "error";
212 break;
213 }
Damien Miller0bc1bd82000-11-13 22:57:25 +1100214 debug("ssh_dss_verify: signature %s", txt);
Damien Millera664e872000-04-16 11:52:47 +1000215 return ret;
216}