summaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/include/ChangeLog18
-rw-r--r--src/include/k5-int.h15
-rw-r--r--src/include/krb5.hin7
-rw-r--r--src/lib/crypto/ChangeLog19
-rw-r--r--src/lib/crypto/Makefile.in12
-rw-r--r--src/lib/crypto/dk/ChangeLog12
-rw-r--r--src/lib/crypto/dk/Makefile.in3
-rw-r--r--src/lib/crypto/dk/dk.h5
-rw-r--r--src/lib/crypto/dk/dk_prf.c64
-rw-r--r--src/lib/crypto/etypes.c100
-rw-r--r--src/lib/crypto/keyblocks.c79
-rw-r--r--src/lib/crypto/libk5crypto.exports5
-rw-r--r--src/lib/crypto/prf.c87
-rw-r--r--src/lib/crypto/t_prf.c89
-rw-r--r--src/lib/krb5/krb/ChangeLog6
-rw-r--r--src/lib/krb5/krb/deltat.c44
-rw-r--r--src/lib/krb5/krb/init_keyblock.c22
-rw-r--r--src/lib/krb5/krb/kfree.c9
-rw-r--r--src/lib/krb5_32.def2
19 files changed, 531 insertions, 67 deletions
diff --git a/src/include/ChangeLog b/src/include/ChangeLog
index 60ee43c878..f8bf8f334c 100644
--- a/src/include/ChangeLog
+++ b/src/include/ChangeLog
@@ -1,3 +1,7 @@
+2005-05-19 Sam Hartman <hartmans@mit.edu>
+
+ * k5-int.h (krb5int_c_ free_keyblock init_keyblock free_keyblock_contents): new
+
2005-05-13 Ken Raeburn <raeburn@mit.edu>
* configure.in: Deleted, content merged into ../configure.in.
@@ -6,6 +10,12 @@
($(srcdir)/krb5/autoconf.stmp): Use $(thisconfigdir) when
locating configure.in and autom4te.cache.
+2005-05-06 Sam Hartman <hartmans@mit.edu>
+
+
+ * krb5.hin: Add krb5_c_prf_length
+
+
2005-04-28 Ken Raeburn <raeburn@mit.edu>
* k5-int.h: Include fcntl.h only if HAVE_FCNTL_H is defined.
@@ -106,6 +116,7 @@
(k5_debug_make_loc): Change "lineno" to type int.
(k5_debug_make_loc): Likewise for argument "line".
+
2005-01-04 Jeffrey Altman <jaltman@mit.edu>
* krb5.hin: add prototype for krb5_is_thread_safe
@@ -124,11 +135,18 @@
* krb5.hin: Flag krb5_principal2salt as KRB5_CALLCONV_WRONG.
+
2004-12-08 Ken Raeburn <raeburn@mit.edu>
* k5-int.h (KRB5INT_ACCESS_STRUCT_VERSION): Bump to 9.
(struct _krb5int_access): Add function pointer field use_dns_kdc.
+2004-12-07 Sam Hartman <hartmans@mit.edu>
+
+ * k5-int.h: Add prf_length to the keytype function
+
+ * krb5.hin: Add krb5_c_prf
+
2004-12-06 Ken Raeburn <raeburn@mit.edu>
* k5-thread.h [DEBUG_THREADS_STATS]: Include string.h and
diff --git a/src/include/k5-int.h b/src/include/k5-int.h
index 5c62c14767..03a416a213 100644
--- a/src/include/k5-int.h
+++ b/src/include/k5-int.h
@@ -609,16 +609,23 @@ typedef krb5_error_code (*krb5_crypt_func) (const struct krb5_enc_provider *enc,
typedef krb5_error_code (*krb5_str2key_func) (const struct krb5_enc_provider *enc, const krb5_data *string,
const krb5_data *salt, const krb5_data *parm, krb5_keyblock *key);
+typedef krb5_error_code (*krb5_prf_func)(
+ const struct krb5_enc_provider *enc, const struct krb5_hash_provider *hash,
+ const krb5_keyblock *key,
+ krb5_data *in, krb5_data *out);
+
struct krb5_keytypes {
krb5_enctype etype;
char *in_string;
char *out_string;
const struct krb5_enc_provider *enc;
const struct krb5_hash_provider *hash;
+ size_t prf_length;
krb5_encrypt_length_func encrypt_len;
krb5_crypt_func encrypt;
krb5_crypt_func decrypt;
krb5_str2key_func str2key;
+ krb5_prf_func prf;
krb5_cksumtype required_ctype;
};
@@ -707,6 +714,14 @@ krb5_error_code krb5int_c_combine_keys
(krb5_context context, krb5_keyblock *key1, krb5_keyblock *key2,
krb5_keyblock *outkey);
+void krb5int_c_free_keyblock
+(krb5_context, krb5_keyblock *key);
+void krb5int_c_free_keyblock_contents
+ (krb5_context, krb5_keyblock *);
+krb5_error_code krb5int_c_init_keyblock
+ (krb5_context, krb5_enctype enctype,
+ size_t length, krb5_keyblock **out);
+
/*
* Internal - for cleanup.
*/
diff --git a/src/include/krb5.hin b/src/include/krb5.hin
index 230295d018..ff17139614 100644
--- a/src/include/krb5.hin
+++ b/src/include/krb5.hin
@@ -437,6 +437,13 @@ krb5_error_code KRB5_CALLCONV
(krb5_context context, const krb5_keyblock *key, krb5_data *state);
krb5_error_code KRB5_CALLCONV
+ krb5_c_prf (krb5_context, const krb5_keyblock *,
+ krb5_data *in, krb5_data *out);
+
+krb5_error_code KRB5_CALLCONV
+ krb5_c_prf_length (krb5_context, krb5_enctype, size_t *outlen);
+
+krb5_error_code KRB5_CALLCONV
krb5_c_make_random_key
(krb5_context context, krb5_enctype enctype,
krb5_keyblock *k5_random_key);
diff --git a/src/lib/crypto/ChangeLog b/src/lib/crypto/ChangeLog
index fa03524a3a..6f6d28dfba 100644
--- a/src/lib/crypto/ChangeLog
+++ b/src/lib/crypto/ChangeLog
@@ -1,3 +1,22 @@
+2005-05-19 Sam Hartman <hartmans@mit.edu>
+
+ * keyblocks.c : File to contain memory management for keyblocks
+ moved from libkrb5
+
+ * Makefile.in (SRCS): keyblocks.c is new
+
+ * etypes.c: Add PRF for AES
+
+ * Makefile.in (t_prf$(EXEEXT)): New output for prf test framework
+
+2005-05-18 Sam Hartman <hartmans@mit.edu>
+
+ * Makefile.in : Add prf.c
+
+ * prf.c t_prf.c: New file
+
+ * etypes.c: Adjust structures to support the PRF declarations.
+
2005-03-15 Jeffrey Altman <jaltman@mit.edu>
* keyed_cksum.c: (krb5_c_is_keyed_cksum): this is a boolean
diff --git a/src/lib/crypto/Makefile.in b/src/lib/crypto/Makefile.in
index 5c1d94c2e5..62cbddfe2c 100644
--- a/src/lib/crypto/Makefile.in
+++ b/src/lib/crypto/Makefile.in
@@ -16,6 +16,7 @@ PROG_RPATH=$(KRB5_LIBDIR)
EXTRADEPSRCS=\
$(srcdir)/t_nfold.c \
$(srcdir)/t_encrypt.c \
+ $(srcdir)/t_prf.c \
$(srcdir)/t_prng.c \
$(srcdir)/t_hmac.c \
$(srcdir)/t_pkcs5.c \
@@ -47,6 +48,7 @@ STLIBOBJS=\
enctype_to_string.o \
etypes.o \
hmac.o \
+ keyblocks.o \
keyed_cksum.o \
keyed_checksum_types.o \
make_checksum.o \
@@ -55,6 +57,7 @@ STLIBOBJS=\
nfold.o \
old_api_glue.o \
pbkdf2.o \
+ prf.o \
prng.o \
state.o \
string_to_cksumtype.o \
@@ -80,6 +83,7 @@ OBJS=\
$(OUTPRE)enctype_to_string.$(OBJEXT) \
$(OUTPRE)etypes.$(OBJEXT) \
$(OUTPRE)hmac.$(OBJEXT) \
+ $(OUTPRE)keyblocks.$(OBJEXT) \
$(OUTPRE)keyed_cksum.$(OBJEXT) \
$(OUTPRE)keyed_checksum_types.$(OBJEXT) \
$(OUTPRE)make_checksum.$(OBJEXT) \
@@ -88,6 +92,7 @@ OBJS=\
$(OUTPRE)nfold.$(OBJEXT) \
$(OUTPRE)old_api_glue.$(OBJEXT) \
$(OUTPRE)pbkdf2.$(OBJEXT) \
+ $(OUTPRE)prf.$(OBJEXT) \
$(OUTPRE)prng.$(OBJEXT) \
$(OUTPRE)state.$(OBJEXT) \
$(OUTPRE)string_to_cksumtype.$(OBJEXT) \
@@ -113,6 +118,7 @@ SRCS=\
$(srcdir)/enctype_to_string.c \
$(srcdir)/etypes.c \
$(srcdir)/hmac.c \
+ $(srcdir)/keyblocks.c \
$(srcdir)/keyed_cksum.c \
$(srcdir)/keyed_checksum_types.c\
$(srcdir)/make_checksum.c \
@@ -121,6 +127,7 @@ SRCS=\
$(srcdir)/nfold.c \
$(srcdir)/old_api_glue.c \
$(srcdir)/pbkdf2.c \
+ $(srcdir)/prf.c \
$(srcdir)/prng.c \
$(srcdir)/state.c \
$(srcdir)/string_to_cksumtype.c \
@@ -170,7 +177,7 @@ libcrypto.lib:
clean-unix:: clean-liblinks clean-libs clean-libobjs
-check-unix:: t_nfold t_encrypt t_prng t_hmac t_pkcs5
+check-unix:: t_nfold t_encrypt t_prf t_prng t_hmac t_pkcs5
$(RUN_SETUP) ./t_nfold
$(RUN_SETUP) ./t_encrypt
$(RUN_SETUP) ./t_prng <$(srcdir)/t_prng.seed >t_prng.output && \
@@ -185,6 +192,9 @@ t_nfold$(EXEEXT): t_nfold.$(OBJEXT) nfold.$(OBJEXT)
t_encrypt$(EXEEXT): t_encrypt.$(OBJEXT) nfold.$(OBJEXT) $(CRYPTO_DEPLIB)
$(CC_LINK) -o $@ t_encrypt.$(OBJEXT) -lkrb5 -lk5crypto -lcom_err $(SUPPORT_LIB)
+t_prf$(EXEEXT): t_prf.$(OBJEXT)
+ $(CC_LINK) -o $@ t_prf.$(OBJEXT) -lkrb5 -lk5crypto -lcom_err $(SUPPORT_LIB)
+
t_prng$(EXEEXT): t_prng.$(OBJEXT)
$(CC_LINK) -o $@ t_prng.$(OBJEXT) -lk5crypto -lcom_err $(SUPPORT_LIB)
diff --git a/src/lib/crypto/dk/ChangeLog b/src/lib/crypto/dk/ChangeLog
index 3430370afa..5e98867007 100644
--- a/src/lib/crypto/dk/ChangeLog
+++ b/src/lib/crypto/dk/ChangeLog
@@ -1,3 +1,15 @@
+2005-05-19 Sam Hartman <hartmans@mit.edu>
+
+ * dk_prf.c (krb5int_dk_prf): Use k5crypto versions of keyblock memory management
+
+2004-12-09 Sam Hartman <hartmans@mit.edu>
+
+ * dk.h: Add krb5_dk_prf
+
+ * Makefile.in (SRCS): Add dk_prf.c
+
+ * dk_prf.c (krb5int_dk_prf): New function
+
2004-03-17 Ken Raeburn <raeburn@mit.edu>
* derive.c (krb5_random2key): Don't compile.
diff --git a/src/lib/crypto/dk/Makefile.in b/src/lib/crypto/dk/Makefile.in
index 83a7c8d78a..89046a4c99 100644
--- a/src/lib/crypto/dk/Makefile.in
+++ b/src/lib/crypto/dk/Makefile.in
@@ -18,6 +18,7 @@ STLIBOBJS=\
dk_decrypt.o \
dk_encrypt.o \
derive.o \
+ dk_prf.o \
stringtokey.o
OBJS=\
@@ -25,12 +26,14 @@ OBJS=\
$(OUTPRE)dk_decrypt.$(OBJEXT) \
$(OUTPRE)dk_encrypt.$(OBJEXT) \
$(OUTPRE)derive.$(OBJEXT) \
+ $(OUTPRE)dk_prf.$(OBJEXT) \
$(OUTPRE)stringtokey.$(OBJEXT)
SRCS=\
$(srcdir)/checksum.c \
$(srcdir)/dk_decrypt.c \
$(srcdir)/dk_encrypt.c \
+ $(srcdir)/dk_prf.c \
$(srcdir)/derive.c \
$(srcdir)/stringtokey.c
diff --git a/src/lib/crypto/dk/dk.h b/src/lib/crypto/dk/dk.h
index 1d742ce164..47bda6ebf2 100644
--- a/src/lib/crypto/dk/dk.h
+++ b/src/lib/crypto/dk/dk.h
@@ -69,6 +69,11 @@ krb5_error_code krb5int_dk_string_to_key
const krb5_data *string, const krb5_data *salt,
const krb5_data *params, krb5_keyblock *key);
+krb5_error_code
+krb5int_dk_prf(const struct krb5_enc_provider *enc,
+ const struct krb5_hash_provider *hash,
+ const krb5_keyblock *key, const krb5_data *in, krb5_data *out);
+
krb5_error_code krb5_derive_key
(const struct krb5_enc_provider *enc,
const krb5_keyblock *inkey,
diff --git a/src/lib/crypto/dk/dk_prf.c b/src/lib/crypto/dk/dk_prf.c
new file mode 100644
index 0000000000..ec64caf16b
--- /dev/null
+++ b/src/lib/crypto/dk/dk_prf.c
@@ -0,0 +1,64 @@
+/*
+ * lib/crypto/dk/prf.c
+ *
+ * Copyright (C) 2004 by the Massachusetts Institute of Technology.
+ * All rights reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. Furthermore if you modify this software you must label
+ * your software as modified software and not distribute it in such a
+ * fashion that it might be confused with the original M.I.T. software.
+ * M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ *
+ *
+ * This file contains an implementation of the RFC 3961 PRF for
+ *simplified profile enctypes.
+ */
+
+#include "k5-int.h"
+#include "dk.h"
+
+krb5_error_code
+krb5int_dk_prf (const struct krb5_enc_provider *enc,
+ const struct krb5_hash_provider *hash,
+ const krb5_keyblock *key,
+ const krb5_data *in, krb5_data *out)
+{
+ krb5_data tmp;
+ krb5_data prfconst;
+ krb5_keyblock *kp = NULL;
+ krb5_error_code ret = 0;
+
+ prfconst.data = (char *) "prf";
+ prfconst.length = 3;
+ tmp.length = hash->hashsize;
+ tmp.data = malloc(hash->hashsize);
+ if (tmp.data == NULL)
+ return ENOMEM;
+ hash->hash(1, in, &tmp);
+ tmp.length = (tmp.length/enc->block_size)*enc->block_size; /*truncate to block size*/
+ ret = krb5int_c_init_keyblock(0, key->enctype,
+ key->length, &kp);
+ if (ret == 0)
+ ret = krb5_derive_key(enc, key, kp, &prfconst);
+ if (ret == 0)
+ ret = enc->encrypt(kp, NULL, &tmp, out);
+ if (kp)
+ krb5int_c_free_keyblock(0, kp);
+ free (tmp.data);
+ return ret;
+}
diff --git a/src/lib/crypto/etypes.c b/src/lib/crypto/etypes.c
index 0a153743ad..4273e2826e 100644
--- a/src/lib/crypto/etypes.c
+++ b/src/lib/crypto/etypes.c
@@ -44,110 +44,170 @@ const struct krb5_keytypes krb5_enctypes_list[] = {
{ ENCTYPE_DES_CBC_CRC,
"des-cbc-crc", "DES cbc mode with CRC-32",
&krb5int_enc_des, &krb5int_hash_crc32,
+ 8,
krb5_old_encrypt_length, krb5_old_encrypt, krb5_old_decrypt,
- krb5int_des_string_to_key, CKSUMTYPE_RSA_MD5 },
+ krb5int_des_string_to_key,
+ NULL, /*PRF*/
+ CKSUMTYPE_RSA_MD5 },
{ ENCTYPE_DES_CBC_MD4,
"des-cbc-md4", "DES cbc mode with RSA-MD4",
&krb5int_enc_des, &krb5int_hash_md4,
+ 8,
krb5_old_encrypt_length, krb5_old_encrypt, krb5_old_decrypt,
- krb5int_des_string_to_key, CKSUMTYPE_RSA_MD4 },
+ krb5int_des_string_to_key,
+ NULL, /*PRF*/
+ CKSUMTYPE_RSA_MD4 },
{ ENCTYPE_DES_CBC_MD5,
"des-cbc-md5", "DES cbc mode with RSA-MD5",
&krb5int_enc_des, &krb5int_hash_md5,
+ 8,
krb5_old_encrypt_length, krb5_old_encrypt, krb5_old_decrypt,
- krb5int_des_string_to_key, CKSUMTYPE_RSA_MD5 },
+ krb5int_des_string_to_key,
+ NULL, /*PRF*/
+CKSUMTYPE_RSA_MD5 },
{ ENCTYPE_DES_CBC_MD5,
"des", "DES cbc mode with RSA-MD5", /* alias */
&krb5int_enc_des, &krb5int_hash_md5,
+ 8,
krb5_old_encrypt_length, krb5_old_encrypt, krb5_old_decrypt,
- krb5int_des_string_to_key, CKSUMTYPE_RSA_MD5 },
+ krb5int_des_string_to_key,
+ NULL, /*PRF*/
+ CKSUMTYPE_RSA_MD5 },
{ ENCTYPE_DES_CBC_RAW,
"des-cbc-raw", "DES cbc mode raw",
&krb5int_enc_des, NULL,
+ 8,
krb5_raw_encrypt_length, krb5_raw_encrypt, krb5_raw_decrypt,
- krb5int_des_string_to_key, 0 },
+ krb5int_des_string_to_key,
+ NULL, /*PRF*/
+ 0 },
{ ENCTYPE_DES3_CBC_RAW,
"des3-cbc-raw", "Triple DES cbc mode raw",
&krb5int_enc_des3, NULL,
+ 8,
krb5_raw_encrypt_length, krb5_raw_encrypt, krb5_raw_decrypt,
- krb5int_dk_string_to_key, 0 },
+ krb5int_dk_string_to_key,
+ NULL, /*PRF*/
+ 0 },
{ ENCTYPE_DES3_CBC_SHA1,
"des3-cbc-sha1", "Triple DES cbc mode with HMAC/sha1",
&krb5int_enc_des3, &krb5int_hash_sha1,
+ 8,
krb5_dk_encrypt_length, krb5_dk_encrypt, krb5_dk_decrypt,
- krb5int_dk_string_to_key, CKSUMTYPE_HMAC_SHA1_DES3 },
+ krb5int_dk_string_to_key,
+ NULL, /*PRF*/
+ CKSUMTYPE_HMAC_SHA1_DES3 },
{ ENCTYPE_DES3_CBC_SHA1, /* alias */
"des3-hmac-sha1", "Triple DES cbc mode with HMAC/sha1",
&krb5int_enc_des3, &krb5int_hash_sha1,
+ 8,
krb5_dk_encrypt_length, krb5_dk_encrypt, krb5_dk_decrypt,
- krb5int_dk_string_to_key, CKSUMTYPE_HMAC_SHA1_DES3 },
+ krb5int_dk_string_to_key,
+ NULL, /*PRF*/
+ CKSUMTYPE_HMAC_SHA1_DES3 },
{ ENCTYPE_DES3_CBC_SHA1, /* alias */
"des3-cbc-sha1-kd", "Triple DES cbc mode with HMAC/sha1",
&krb5int_enc_des3, &krb5int_hash_sha1,
+ 8,
krb5_dk_encrypt_length, krb5_dk_encrypt, krb5_dk_decrypt,
- krb5int_dk_string_to_key, CKSUMTYPE_HMAC_SHA1_DES3 },
+ krb5int_dk_string_to_key,
+ NULL, /*PRF*/
+ CKSUMTYPE_HMAC_SHA1_DES3 },
{ ENCTYPE_DES_HMAC_SHA1,
"des-hmac-sha1", "DES with HMAC/sha1",
&krb5int_enc_des, &krb5int_hash_sha1,
+ 8,
krb5_dk_encrypt_length, krb5_dk_encrypt, krb5_dk_decrypt,
- krb5int_dk_string_to_key, 0 },
+ krb5int_dk_string_to_key,
+ NULL, /*PRF*/
+ 0 },
{ ENCTYPE_ARCFOUR_HMAC,
"arcfour-hmac","ArcFour with HMAC/md5", &krb5int_enc_arcfour,
- &krb5int_hash_md5, krb5_arcfour_encrypt_length, krb5_arcfour_encrypt,
+ &krb5int_hash_md5,
+ 0,
+krb5_arcfour_encrypt_length, krb5_arcfour_encrypt,
krb5_arcfour_decrypt, krb5int_arcfour_string_to_key,
+ NULL, /*PRF*/
CKSUMTYPE_HMAC_MD5_ARCFOUR },
{ ENCTYPE_ARCFOUR_HMAC, /* alias */
"rc4-hmac", "ArcFour with HMAC/md5", &krb5int_enc_arcfour,
- &krb5int_hash_md5, krb5_arcfour_encrypt_length, krb5_arcfour_encrypt,
+ &krb5int_hash_md5,
+ 0,
+ krb5_arcfour_encrypt_length, krb5_arcfour_encrypt,
krb5_arcfour_decrypt, krb5int_arcfour_string_to_key,
+ NULL, /*PRF*/
CKSUMTYPE_HMAC_MD5_ARCFOUR },
{ ENCTYPE_ARCFOUR_HMAC, /* alias */
"arcfour-hmac-md5", "ArcFour with HMAC/md5", &krb5int_enc_arcfour,
- &krb5int_hash_md5, krb5_arcfour_encrypt_length, krb5_arcfour_encrypt,
+ &krb5int_hash_md5,
+ 0,
+ krb5_arcfour_encrypt_length, krb5_arcfour_encrypt,
krb5_arcfour_decrypt, krb5int_arcfour_string_to_key,
+ NULL, /*PRF*/
CKSUMTYPE_HMAC_MD5_ARCFOUR },
{ ENCTYPE_ARCFOUR_HMAC_EXP,
"arcfour-hmac-exp", "Exportable ArcFour with HMAC/md5",
&krb5int_enc_arcfour,
- &krb5int_hash_md5, krb5_arcfour_encrypt_length, krb5_arcfour_encrypt,
+ &krb5int_hash_md5,
+ 0,
+ krb5_arcfour_encrypt_length, krb5_arcfour_encrypt,
krb5_arcfour_decrypt, krb5int_arcfour_string_to_key,
+ NULL, /*PRF*/
CKSUMTYPE_HMAC_MD5_ARCFOUR },
{ ENCTYPE_ARCFOUR_HMAC_EXP, /* alias */
"rc4-hmac-exp", "Exportable ArcFour with HMAC/md5",
&krb5int_enc_arcfour,
- &krb5int_hash_md5, krb5_arcfour_encrypt_length, krb5_arcfour_encrypt,
+ &krb5int_hash_md5,
+ 0,
+ krb5_arcfour_encrypt_length, krb5_arcfour_encrypt,
krb5_arcfour_decrypt, krb5int_arcfour_string_to_key,
+ NULL, /*PRF*/
CKSUMTYPE_HMAC_MD5_ARCFOUR },
{ ENCTYPE_ARCFOUR_HMAC_EXP, /* alias */
"arcfour-hmac-md5-exp", "Exportable ArcFour with HMAC/md5",
&krb5int_enc_arcfour,
- &krb5int_hash_md5, krb5_arcfour_encrypt_length, krb5_arcfour_encrypt,
+ &krb5int_hash_md5,
+ 0,
+ krb5_arcfour_encrypt_length, krb5_arcfour_encrypt,
krb5_arcfour_decrypt, krb5int_arcfour_string_to_key,
+ NULL, /*PRF*/
CKSUMTYPE_HMAC_MD5_ARCFOUR },
{ ENCTYPE_AES128_CTS_HMAC_SHA1_96,
"aes128-cts-hmac-sha1-96", "AES-128 CTS mode with 96-bit SHA-1 HMAC",
&krb5int_enc_aes128, &krb5int_hash_sha1,
+ 16,
krb5int_aes_encrypt_length, krb5int_aes_dk_encrypt, krb5int_aes_dk_decrypt,
- krb5int_aes_string_to_key, CKSUMTYPE_HMAC_SHA1_96_AES128 },
+ krb5int_aes_string_to_key,
+ krb5int_dk_prf,
+ CKSUMTYPE_HMAC_SHA1_96_AES128 },
{ ENCTYPE_AES128_CTS_HMAC_SHA1_96, /* alias */
"aes128-cts", "AES-128 CTS mode with 96-bit SHA-1 HMAC",
&krb5int_enc_aes128, &krb5int_hash_sha1,
+ 16,
krb5int_aes_encrypt_length, krb5int_aes_dk_encrypt, krb5int_aes_dk_decrypt,
- krb5int_aes_string_to_key, CKSUMTYPE_HMAC_SHA1_96_AES128 },
+ krb5int_aes_string_to_key,
+ krb5int_dk_prf,
+ CKSUMTYPE_HMAC_SHA1_96_AES128 },
{ ENCTYPE_AES256_CTS_HMAC_SHA1_96,
"aes256-cts-hmac-sha1-96", "AES-256 CTS mode with 96-bit SHA-1 HMAC",
&krb5int_enc_aes256, &krb5int_hash_sha1,
+ 16,
krb5int_aes_encrypt_length, krb5int_aes_dk_encrypt, krb5int_aes_dk_decrypt,
- krb5int_aes_string_to_key, CKSUMTYPE_HMAC_SHA1_96_AES256 },
+ krb5int_aes_string_to_key,
+ krb5int_dk_prf,
+ CKSUMTYPE_HMAC_SHA1_96_AES256 },
{ ENCTYPE_AES256_CTS_HMAC_SHA1_96, /* alias */
"aes256-cts", "AES-256 CTS mode with 96-bit SHA-1 HMAC",
&krb5int_enc_aes256, &krb5int_hash_sha1,
+ 16,
krb5int_aes_encrypt_length, krb5int_aes_dk_encrypt, krb5int_aes_dk_decrypt,
- krb5int_aes_string_to_key, CKSUMTYPE_HMAC_SHA1_96_AES256 },
+ krb5int_aes_string_to_key,
+ krb5int_dk_prf,
+ CKSUMTYPE_HMAC_SHA1_96_AES256 },
};
const int krb5_enctypes_length =
diff --git a/src/lib/crypto/keyblocks.c b/src/lib/crypto/keyblocks.c
new file mode 100644
index 0000000000..02ff677d17
--- /dev/null
+++ b/src/lib/crypto/keyblocks.c
@@ -0,0 +1,79 @@
+/*
+ * lib/crypto/keyblocks.c
+ *
+ * Copyright (C) 2002, 2005 by the Massachusetts Institute of Technology.
+ * All rights reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. Furthermore if you modify this software you must label
+ * your software as modified software and not distribute it in such a
+ * fashion that it might be confused with the original M.I.T. software.
+ * M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ *
+ *
+ * krb5_init_keyblock- a function to set up
+ * an empty keyblock
+ */
+
+
+#include "k5-int.h"
+#include <assert.h>
+
+krb5_error_code krb5int_c_init_keyblock
+ (krb5_context context, krb5_enctype enctype,
+ size_t length, krb5_keyblock **out)
+{
+ krb5_keyblock *kb;
+ kb = malloc (sizeof(krb5_keyblock));
+ assert (out);
+ *out = NULL;
+ if (!kb) {
+ return ENOMEM;
+ }
+ kb->magic = KV5M_KEYBLOCK;
+ kb->enctype = enctype;
+ kb->length = length;
+ if(length) {
+ kb->contents = malloc (length);
+ if(!kb->contents) {
+ free (kb);
+ return ENOMEM;
+ }
+ } else {
+ kb->contents = NULL;
+ }
+ *out = kb;
+ return 0;
+}
+
+
+void KRB5_CALLCONV
+krb5int_c_free_keyblock(krb5_context context, register krb5_keyblock *val)
+{
+ krb5_free_keyblock_contents(context, val);
+ krb5_xfree(val);
+}
+
+void
+krb5int_c_free_keyblock_contents(krb5_context context, register krb5_keyblock *key)
+{
+ if (key->contents) {
+ krb5int_zap_data (key->contents, key->length);
+ krb5_xfree(key->contents);
+ key->contents = 0;
+ }
+}
diff --git a/src/lib/crypto/libk5crypto.exports b/src/lib/crypto/libk5crypto.exports
index 744b1de489..b06f2e427b 100644
--- a/src/lib/crypto/libk5crypto.exports
+++ b/src/lib/crypto/libk5crypto.exports
@@ -25,6 +25,8 @@ krb5_c_is_keyed_cksum
krb5_c_keyed_checksum_types
krb5_c_make_checksum
krb5_c_make_random_key
+krb5_c_prf
+krb5_c_prf_length
krb5_c_random_add_entropy
krb5_c_random_make_octets
krb5_c_random_os_entropy
@@ -88,6 +90,9 @@ krb5int_arcfour_string_to_key
krb5int_arcfour_translate_usage
krb5int_c_combine_keys
krb5int_c_mandatory_cksumtype
+krb5int_c_free_keyblock
+krb5int_c_free_keyblock_contents
+krb5int_c_init_keyblock
krb5int_c_mit_des_zeroblock
krb5int_default_free_state
krb5int_des3_cbc_decrypt
diff --git a/src/lib/crypto/prf.c b/src/lib/crypto/prf.c
new file mode 100644
index 0000000000..f52564db42
--- /dev/null
+++ b/src/lib/crypto/prf.c
@@ -0,0 +1,87 @@
+/*
+ * lib/crypto/prf.c
+ *
+ * Copyright (C) 2004 by the Massachusetts Institute of Technology.
+ * All rights reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. Furthermore if you modify this software you must label
+ * your software as modified software and not distribute it in such a
+ * fashion that it might be confused with the original M.I.T. software.
+ * M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ *
+ *
+ * This contains the implementation of krb5_c_prf, which will find
+ *the enctype-specific PRF and then generate pseudo-random data. This
+ *function yields krb5_c_prf_length bytes of output.
+ */
+
+
+#include "k5-int.h"
+#include "etypes.h"
+
+#include <assert.h>
+
+krb5_error_code KRB5_CALLCONV
+krb5_c_prf_length(krb5_context context, krb5_enctype enctype,
+ size_t *len)
+{
+ int i;
+ assert (len);
+
+ for (i=0; i<krb5_enctypes_length; i++) {
+ if (krb5_enctypes_list[i].etype == enctype)
+ break;
+ }
+
+ if (i == krb5_enctypes_length)
+ return(KRB5_BAD_ENCTYPE);
+
+ *len = krb5_enctypes_list[i].prf_length;
+ return 0;
+
+}
+
+krb5_error_code KRB5_CALLCONV
+krb5_c_prf(krb5_context context, const krb5_keyblock *key,
+krb5_data *input, krb5_data *output)
+{
+ int i;
+ size_t len;
+ assert(input && output);
+ assert (output->data);
+
+
+ for (i=0; i<krb5_enctypes_length; i++) {
+ if (krb5_enctypes_list[i].etype == key->enctype)
+ break;
+ }
+
+ if (i == krb5_enctypes_length)
+ return(KRB5_BAD_ENCTYPE);
+
+ output->magic = KV5M_DATA;
+ if (!krb5_enctypes_list[i].prf)
+ return (KRB5_CRYPTO_INTERNAL);
+ krb5_c_prf_length (context, key->enctype, &len);
+ if( len != output->length)
+ return (KRB5_CRYPTO_INTERNAL);
+ return((*(krb5_enctypes_list[i].prf))
+ (krb5_enctypes_list[i].enc, krb5_enctypes_list[i].hash,
+ key, input, output));
+}
+
diff --git a/src/lib/crypto/t_prf.c b/src/lib/crypto/t_prf.c
new file mode 100644
index 0000000000..f11784b3d1
--- /dev/null
+++ b/src/lib/crypto/t_prf.c
@@ -0,0 +1,89 @@
+/*
+ * lib/crypto/t_prf.c
+ *
+ * Copyright (C) 2004 by the Massachusetts Institute of Technology.
+ * All rights reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. Furthermore if you modify this software you must label
+ * your software as modified software and not distribute it in such a
+ * fashion that it might be confused with the original M.I.T. software.
+ * M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ * This file contains tests for the PRF code in Kerberos. IT reads
+ *an input file, and writes an output file. It is assumed that the
+ *output file will be diffed against expected output to see whether
+ *regression tests pass. The input file is a very primitive format.
+ *It includes an enctype and to be string2keyed followed by a number of bytes of input
+ *length, followed by that many bytes of input. The program outputs
+ *krb5_c_prf of that input and key as a hex string.
+ */
+
+#include "k5-int.h"
+#include <assert.h>
+
+int main () {
+ krb5_error_code ret;
+ krb5_data input, output;
+ krb5_keyblock *key = NULL;
+ unsigned int in_length;
+ unsigned int i;
+ while (1) {
+ krb5_enctype enctype;
+ char s[1025];
+
+ if (scanf( "%d", &enctype) == EOF)
+ break;
+ if (scanf("%1024s", &s[0]) == EOF)
+ break;
+ assert (krb5_init_keyblock(0, enctype, 0, &key) == 0);
+ input.data = &s[0];
+ input.length = strlen(s);
+ assert(krb5_c_string_to_key (0, enctype, &input, &input, key) == 0);
+
+ if (scanf("%u", &in_length) == EOF)
+ break;
+
+ if (in_length ) {
+ unsigned int lc;
+ assert ((input.data = malloc(in_length)) != NULL);
+ for (lc = in_length; lc > 0; lc--) {
+ scanf ("%2x", &i);
+ input.data[in_length-lc] = (unsigned) (i&0xff);
+ }
+ input.length = in_length;
+ assert (krb5_c_prf_length(0, enctype, &i) == 0);
+ assert (output.data = malloc(i));
+ output.length = i;
+ assert (krb5_c_prf(0, key, &input, &output) == 0);
+
+ free (input.data);
+ input.data = NULL;
+ }
+ for (; i > 0; i--) {
+ printf ("%02x",
+ (unsigned int) ((unsigned char ) output.data[output.length-i]));
+ }
+ printf ("\n");
+
+ free (output.data);
+ output.data = NULL;
+ krb5_free_keyblock(0, key);
+ key = NULL;
+ }
+
+ return (0);
+}
diff --git a/src/lib/krb5/krb/ChangeLog b/src/lib/krb5/krb/ChangeLog
index 26ae8fe04f..01f9e49560 100644
--- a/src/lib/krb5/krb/ChangeLog
+++ b/src/lib/krb5/krb/ChangeLog
@@ -1,3 +1,9 @@
+2005-05-19 Sam Hartman <hartmans@mit.edu>
+
+ * kfree.c (krb5_free_keyblock_contents krb5_free_keyblock): Make
+ stubs into libk5crypto so that libk5crypto can call these.
+ * init_keyblock.c (krb5_init_keyblock): As above.
+
2005-04024 Jeffrey Altman <jaltman@mit.edu>
* get_creds.c:
diff --git a/src/lib/krb5/krb/deltat.c b/src/lib/krb5/krb/deltat.c
index 770234de5d..2541591f89 100644
--- a/src/lib/krb5/krb/deltat.c
+++ b/src/lib/krb5/krb/deltat.c
@@ -1,7 +1,7 @@
-/* A Bison parser, made by GNU Bison 1.875c. */
+/* A Bison parser, made by GNU Bison 1.875d. */
/* Skeleton parser for Yacc-like parsing with Bison,
- Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003 Free Software Foundation, Inc.
+ Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004 Free Software Foundation, Inc.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -187,6 +187,13 @@ typedef union YYSTYPE { int val; } YYSTYPE;
#if ! defined (yyoverflow) || YYERROR_VERBOSE
+# ifndef YYFREE
+# define YYFREE free
+# endif
+# ifndef YYMALLOC
+# define YYMALLOC malloc
+# endif
+
/* The parser invokes alloca or malloc; define the necessary symbols. */
# ifdef YYSTACK_USE_ALLOCA
@@ -211,8 +218,8 @@ typedef union YYSTYPE { int val; } YYSTYPE;
# include <stdlib.h> /* INFRINGES ON USER NAME SPACE */
# define YYSIZE_T size_t
# endif
-# define YYSTACK_ALLOC malloc
-# define YYSTACK_FREE free
+# define YYSTACK_ALLOC YYMALLOC
+# define YYSTACK_FREE YYFREE
# endif
#endif /* ! defined (yyoverflow) || YYERROR_VERBOSE */
@@ -224,7 +231,7 @@ typedef union YYSTYPE { int val; } YYSTYPE;
/* A type that is properly aligned for any stack member. */
union yyalloc
{
- short yyss;
+ short int yyss;
YYSTYPE yyvs;
};
@@ -234,7 +241,7 @@ union yyalloc
/* The size of an array large to enough to hold all stacks, each with
N elements. */
# define YYSTACK_BYTES(N) \
- ((N) * (sizeof (short) + sizeof (YYSTYPE)) \
+ ((N) * (sizeof (short int) + sizeof (YYSTYPE)) \
+ YYSTACK_GAP_MAXIMUM)
/* Copy COUNT objects from FROM to TO. The source and destination do
@@ -276,7 +283,7 @@ union yyalloc
#if defined (__STDC__) || defined (__cplusplus)
typedef signed char yysigned_char;
#else
- typedef short yysigned_char;
+ typedef short int yysigned_char;
#endif
/* YYFINAL -- State number of the termination state. */
@@ -378,7 +385,7 @@ static const char *const yytname[] =
# ifdef YYPRINT
/* YYTOKNUM[YYLEX-NUM] -- Internal token number corresponding to
token YYLEX-NUM. */
-static const unsigned short yytoknum[] =
+static const unsigned short int yytoknum[] =
{
0, 256, 257, 258, 259, 260, 45, 58, 100, 104,
109, 115, 261
@@ -580,12 +587,12 @@ do { \
#if defined (__STDC__) || defined (__cplusplus)
static void
-yy_stack_print (short *bottom, short *top)
+yy_stack_print (short int *bottom, short int *top)
#else
static void
yy_stack_print (bottom, top)
- short *bottom;
- short *top;
+ short int *bottom;
+ short int *top;
#endif
{
YYFPRINTF (stderr, "Stack now");
@@ -852,9 +859,9 @@ int yynerrs;
to reallocate them elsewhere. */
/* The state stack. */
- short yyssa[YYINITDEPTH];
- short *yyss = yyssa;
- register short *yyssp;
+ short int yyssa[YYINITDEPTH];
+ short int *yyss = yyssa;
+ register short int *yyssp;
/* The semantic value stack. */
YYSTYPE yyvsa[YYINITDEPTH];
@@ -891,6 +898,7 @@ int yynerrs;
yyssp = yyss;
yyvsp = yyvs;
+
goto yysetstate;
/*------------------------------------------------------------.
@@ -916,7 +924,7 @@ int yynerrs;
these so that the &'s don't force the real ones into
memory. */
YYSTYPE *yyvs1 = yyvs;
- short *yyss1 = yyss;
+ short int *yyss1 = yyss;
/* Each stack pointer address is followed by the size of the
@@ -944,7 +952,7 @@ int yynerrs;
yystacksize = YYMAXDEPTH;
{
- short *yyss1 = yyss;
+ short int *yyss1 = yyss;
union yyalloc *yyptr =
(union yyalloc *) YYSTACK_ALLOC (YYSTACK_BYTES (yystacksize));
if (! yyptr)
@@ -1151,8 +1159,8 @@ yyreduce:
}
-/* Line 993 of yacc.c. */
-#line 1156 "deltat.c"
+/* Line 1010 of yacc.c. */
+#line 1164 "deltat.c"
yyvsp -= yylen;
yyssp -= yylen;
diff --git a/src/lib/krb5/krb/init_keyblock.c b/src/lib/krb5/krb/init_keyblock.c
index a6feeeaf19..3be842ac86 100644
--- a/src/lib/krb5/krb/init_keyblock.c
+++ b/src/lib/krb5/krb/init_keyblock.c
@@ -37,25 +37,5 @@ krb5_error_code KRB5_CALLCONV krb5_init_keyblock
(krb5_context context, krb5_enctype enctype,
size_t length, krb5_keyblock **out)
{
- krb5_keyblock *kb;
- kb = malloc (sizeof(krb5_keyblock));
- assert (out);
- *out = NULL;
- if (!kb) {
- return ENOMEM;
- }
- kb->magic = KV5M_KEYBLOCK;
- kb->enctype = enctype;
- kb->length = length;
- if(length) {
- kb->contents = malloc (length);
- if(!kb->contents) {
- free (kb);
- return ENOMEM;
- }
- } else {
- kb->contents = NULL;
- }
- *out = kb;
- return 0;
+ return krb5int_c_init_keyblock (context, enctype, length, out);
}
diff --git a/src/lib/krb5/krb/kfree.c b/src/lib/krb5/krb/kfree.c
index 4700439715..39bb1f2128 100644
--- a/src/lib/krb5/krb/kfree.c
+++ b/src/lib/krb5/krb/kfree.c
@@ -340,18 +340,13 @@ krb5_free_kdc_req(krb5_context context, krb5_kdc_req *val)
void KRB5_CALLCONV
krb5_free_keyblock_contents(krb5_context context, register krb5_keyblock *key)
{
- if (key->contents) {
- memset(key->contents, 0, key->length);
- krb5_xfree(key->contents);
- key->contents = 0;
- }
+ krb5int_c_free_keyblock_contents (context, key);
}
void KRB5_CALLCONV
krb5_free_keyblock(krb5_context context, register krb5_keyblock *val)
{
- krb5_free_keyblock_contents(context, val);
- krb5_xfree(val);
+ krb5int_c_free_keyblock (context, val);
}
diff --git a/src/lib/krb5_32.def b/src/lib/krb5_32.def
index 0125d2630e..012d6f7bfa 100644
--- a/src/lib/krb5_32.def
+++ b/src/lib/krb5_32.def
@@ -64,6 +64,8 @@ EXPORTS
krb5_c_keyed_checksum_types
krb5_c_make_checksum
krb5_c_make_random_key
+krb5_c_prf
+krb5_c_prf_length
krb5_c_random_make_octets
krb5_c_random_seed
krb5_c_string_to_key
generated by cgit (git 2.34.1) at 2024-09-29 07:21:48 +0000