Home | History | Annotate | Download | only in common
      1 /*
      2  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
      3  *
      4  * Redistribution and use in source and binary forms, with or without
      5  * modification, are permitted provided that the following conditions
      6  * are met:
      7  * 1. Redistributions of source code must retain the above copyright
      8  *    notice, this list of conditions and the following disclaimer.
      9  * 2. Redistributions in binary form must reproduce the above copyright
     10  *    notice, this list of conditions and the following disclaimer in the
     11  *    documentation and/or other materials provided with the distribution.
     12  *
     13  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     14  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     15  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     16  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     17  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     18  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     19  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     20  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     21  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     22  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     23  */
     24 
     25 #include "includes.h"
     26 RCSID("$OpenBSD: ssh-dss.c,v 1.17 2002/07/04 10:41:47 markus Exp $");
     27 
     28 #pragma ident	"%Z%%M%	%I%	%E% SMI"
     29 
     30 #include <openssl/bn.h>
     31 #include <openssl/evp.h>
     32 
     33 #include "xmalloc.h"
     34 #include "buffer.h"
     35 #include "bufaux.h"
     36 #include "compat.h"
     37 #include "log.h"
     38 #include "key.h"
     39 #include "ssh-dss.h"
     40 
     41 #define INTBLOB_LEN	20
     42 #define SIGBLOB_LEN	(2*INTBLOB_LEN)
     43 
     44 int
     45 ssh_dss_sign(Key *key, u_char **sigp, u_int *lenp,
     46     u_char *data, u_int datalen)
     47 {
     48 	DSA_SIG *sig;
     49 	const EVP_MD *evp_md = EVP_sha1();
     50 	EVP_MD_CTX md;
     51 	u_char digest[EVP_MAX_MD_SIZE], sigblob[SIGBLOB_LEN];
     52 	u_int rlen, slen, len, dlen;
     53 	Buffer b;
     54 
     55 	if (key == NULL || key->type != KEY_DSA || key->dsa == NULL) {
     56 		error("ssh_dss_sign: no DSA key");
     57 		return -1;
     58 	}
     59 	EVP_DigestInit(&md, evp_md);
     60 	EVP_DigestUpdate(&md, data, datalen);
     61 	EVP_DigestFinal(&md, digest, &dlen);
     62 
     63 	sig = DSA_do_sign(digest, dlen, key->dsa);
     64 	memset(digest, 'd', sizeof(digest));
     65 
     66 	if (sig == NULL) {
     67 		error("ssh_dss_sign: sign failed");
     68 		return -1;
     69 	}
     70 
     71 	rlen = BN_num_bytes(sig->r);
     72 	slen = BN_num_bytes(sig->s);
     73 	if (rlen > INTBLOB_LEN || slen > INTBLOB_LEN) {
     74 		error("bad sig size %u %u", rlen, slen);
     75 		DSA_SIG_free(sig);
     76 		return -1;
     77 	}
     78 	memset(sigblob, 0, SIGBLOB_LEN);
     79 	BN_bn2bin(sig->r, sigblob+ SIGBLOB_LEN - INTBLOB_LEN - rlen);
     80 	BN_bn2bin(sig->s, sigblob+ SIGBLOB_LEN - slen);
     81 	DSA_SIG_free(sig);
     82 
     83 	if (datafellows & SSH_BUG_SIGBLOB) {
     84 		if (lenp != NULL)
     85 			*lenp = SIGBLOB_LEN;
     86 		if (sigp != NULL) {
     87 			*sigp = xmalloc(SIGBLOB_LEN);
     88 			memcpy(*sigp, sigblob, SIGBLOB_LEN);
     89 		}
     90 	} else {
     91 		/* ietf-drafts */
     92 		buffer_init(&b);
     93 		buffer_put_cstring(&b, "ssh-dss");
     94 		buffer_put_string(&b, sigblob, SIGBLOB_LEN);
     95 		len = buffer_len(&b);
     96 		if (lenp != NULL)
     97 			*lenp = len;
     98 		if (sigp != NULL) {
     99 			*sigp = xmalloc(len);
    100 			memcpy(*sigp, buffer_ptr(&b), len);
    101 		}
    102 		buffer_free(&b);
    103 	}
    104 	return 0;
    105 }
    106 int
    107 ssh_dss_verify(Key *key, u_char *signature, u_int signaturelen,
    108     u_char *data, u_int datalen)
    109 {
    110 	DSA_SIG *sig;
    111 	const EVP_MD *evp_md = EVP_sha1();
    112 	EVP_MD_CTX md;
    113 	u_char digest[EVP_MAX_MD_SIZE], *sigblob;
    114 	u_int len, dlen;
    115 	int rlen, ret;
    116 	Buffer b;
    117 
    118 	if (key == NULL || key->type != KEY_DSA || key->dsa == NULL) {
    119 		error("ssh_dss_verify: no DSA key");
    120 		return -1;
    121 	}
    122 
    123 	/* fetch signature */
    124 	if (datafellows & SSH_BUG_SIGBLOB) {
    125 		sigblob = signature;
    126 		len = signaturelen;
    127 	} else {
    128 		/* ietf-drafts */
    129 		char *ktype;
    130 		buffer_init(&b);
    131 		buffer_append(&b, signature, signaturelen);
    132 		ktype = buffer_get_string(&b, NULL);
    133 		if (strcmp("ssh-dss", ktype) != 0) {
    134 			error("ssh_dss_verify: cannot handle type %s", ktype);
    135 			buffer_free(&b);
    136 			xfree(ktype);
    137 			return -1;
    138 		}
    139 		xfree(ktype);
    140 		sigblob = buffer_get_string(&b, &len);
    141 		rlen = buffer_len(&b);
    142 		buffer_free(&b);
    143 		if (rlen != 0) {
    144 			error("ssh_dss_verify: "
    145 			    "remaining bytes in signature %d", rlen);
    146 			xfree(sigblob);
    147 			return -1;
    148 		}
    149 	}
    150 
    151 	if (len != SIGBLOB_LEN) {
    152 		fatal("bad sigbloblen %u != SIGBLOB_LEN", len);
    153 	}
    154 
    155 	/* parse signature */
    156 	if ((sig = DSA_SIG_new()) == NULL)
    157 		fatal("ssh_dss_verify: DSA_SIG_new failed");
    158 	if ((sig->r = BN_new()) == NULL)
    159 		fatal("ssh_dss_verify: BN_new failed");
    160 	if ((sig->s = BN_new()) == NULL)
    161 		fatal("ssh_dss_verify: BN_new failed");
    162 	BN_bin2bn(sigblob, INTBLOB_LEN, sig->r);
    163 	BN_bin2bn(sigblob+ INTBLOB_LEN, INTBLOB_LEN, sig->s);
    164 
    165 	if (!(datafellows & SSH_BUG_SIGBLOB)) {
    166 		memset(sigblob, 0, len);
    167 		xfree(sigblob);
    168 	}
    169 
    170 	/* sha1 the data */
    171 	EVP_DigestInit(&md, evp_md);
    172 	EVP_DigestUpdate(&md, data, datalen);
    173 	EVP_DigestFinal(&md, digest, &dlen);
    174 
    175 	ret = DSA_do_verify(digest, dlen, sig, key->dsa);
    176 	memset(digest, 'd', sizeof(digest));
    177 
    178 	DSA_SIG_free(sig);
    179 
    180 	debug("ssh_dss_verify: signature %s",
    181 	    ret == 1 ? "correct" : ret == 0 ? "incorrect" : "error");
    182 	return ret;
    183 }
    184