From b35f20cd8ecdc8308a3201e55752fb0443ec6ae4 Mon Sep 17 00:00:00 2001 From: Jan Cholasta Date: Tue, 17 Apr 2012 11:03:23 -0400 Subject: UTIL: Add HMAC-SHA-1 function --- src/tests/crypto-tests.c | 36 ++++++++++++ src/util/crypto/libcrypto/crypto_hmac_sha1.c | 31 ++++++++++ src/util/crypto/nss/nss_hmac_sha1.c | 88 ++++++++++++++++++++++++++++ src/util/crypto/sss_crypto.h | 8 +++ 4 files changed, 163 insertions(+) create mode 100644 src/util/crypto/libcrypto/crypto_hmac_sha1.c create mode 100644 src/util/crypto/nss/nss_hmac_sha1.c (limited to 'src') diff --git a/src/tests/crypto-tests.c b/src/tests/crypto-tests.c index ba584668d..2e792bbd6 100644 --- a/src/tests/crypto-tests.c +++ b/src/tests/crypto-tests.c @@ -91,6 +91,41 @@ START_TEST(test_encrypt_decrypt) } END_TEST +START_TEST(test_hmac_sha1) +{ + const char *message = "test message"; + const char *keys[] = { + "short", + "proper6789012345678901234567890123456789012345678901234567890123", + "longlonglonglonglonglonglonglonglonglonglonglonglonglonglonglonglong", + NULL }; + const char *results[] = { + "\x2b\x27\x53\x07\x17\xd8\xc0\x8f\x97\x27\xdd\xb3\xec\x41\xd8\xa3\x94\x97\xaa\x35", + "\x37\xe7\x0a\x6f\x71\x0b\xa9\x93\x81\x53\x8f\x5c\x06\x83\x44\x2f\xc9\x41\xe3\xed", + "\xbd\x99\xa7\x7f\xfc\x5e\xde\x04\x32\x7f\x7b\x71\x4d\xc0\x3f\x51\x2d\x25\x01\x28", + NULL }; + unsigned char out[SSS_SHA1_LENGTH]; + int ret, expected; + int i; + +#ifdef HAVE_NSS + expected = EOK; +#elif HAVE_LIBCRYPTO + expected = ENOSYS; +#else +#error Unknown crypto back end +#endif + + for (i = 0; keys[i]; i++) { + ret = sss_hmac_sha1((const unsigned char *)keys[i], strlen(keys[i]), + (const unsigned char *)message, strlen(message), + out); + fail_if(ret != expected); + fail_if(ret == EOK && memcmp(out, results[i], SSS_SHA1_LENGTH) != 0); + } +} +END_TEST + Suite *crypto_suite(void) { Suite *s = suite_create("sss_crypto"); @@ -102,6 +137,7 @@ Suite *crypto_suite(void) tcase_add_test(tc, test_nss_init); #endif tcase_add_test(tc, test_encrypt_decrypt); + tcase_add_test(tc, test_hmac_sha1); /* Add all test cases to the test suite */ suite_add_tcase(s, tc); diff --git a/src/util/crypto/libcrypto/crypto_hmac_sha1.c b/src/util/crypto/libcrypto/crypto_hmac_sha1.c new file mode 100644 index 000000000..32acd25ac --- /dev/null +++ b/src/util/crypto/libcrypto/crypto_hmac_sha1.c @@ -0,0 +1,31 @@ +/* + Authors: + Jan Cholasta + + Copyright (C) 2012 Red Hat + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "util/util.h" + +int sss_hmac_sha1(const unsigned char *key, + size_t key_len, + const unsigned char *in, + size_t in_len, + unsigned char *out) +{ + DEBUG(SSSDBG_CRIT_FAILURE, ("sss_hmac_sha1 not implemented.\n")); + return ENOSYS; +} diff --git a/src/util/crypto/nss/nss_hmac_sha1.c b/src/util/crypto/nss/nss_hmac_sha1.c new file mode 100644 index 000000000..6faa09aee --- /dev/null +++ b/src/util/crypto/nss/nss_hmac_sha1.c @@ -0,0 +1,88 @@ +/* + Authors: + Jan Cholasta + + Copyright (C) 2012 Red Hat + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ +/* + NSS does not provide public API for HMAC, so we implement it ourselves. + + See RFC 2104 for details on the algorithm. +*/ + +#include "util/util.h" +#include "util/crypto/sss_crypto.h" +#include "util/crypto/nss/nss_util.h" + +#include + +#define HMAC_SHA1_BLOCKSIZE 64 + +int sss_hmac_sha1(const unsigned char *key, + size_t key_len, + const unsigned char *in, + size_t in_len, + unsigned char *out) +{ + int ret; + unsigned char ikey[HMAC_SHA1_BLOCKSIZE], okey[HMAC_SHA1_BLOCKSIZE]; + size_t i; + HASHContext *sha1; + unsigned char hash[SSS_SHA1_LENGTH]; + unsigned int res_len; + + ret = nspr_nss_init(); + if (ret != EOK) { + return ret; + } + + sha1 = HASH_Create(HASH_AlgSHA1); + if (!sha1) { + return ENOMEM; + } + + if (key_len > HMAC_SHA1_BLOCKSIZE) { + /* keys longer than blocksize are shortened */ + HASH_Begin(sha1); + HASH_Update(sha1, key, key_len); + HASH_End(sha1, ikey, &res_len, SSS_SHA1_LENGTH); + memset(ikey + SSS_SHA1_LENGTH, 0, HMAC_SHA1_BLOCKSIZE - SSS_SHA1_LENGTH); + } else { + /* keys shorter than blocksize are zero-padded */ + memcpy(ikey, key, key_len); + memset(ikey + key_len, 0, HMAC_SHA1_BLOCKSIZE - key_len); + } + + /* HMAC(key, msg) = HASH(key XOR opad, HASH(key XOR ipad, msg)) */ + for (i = 0; i < HMAC_SHA1_BLOCKSIZE; i++) { + okey[i] = ikey[i] ^ 0x5c; + ikey[i] ^= 0x36; + } + + HASH_Begin(sha1); + HASH_Update(sha1, ikey, HMAC_SHA1_BLOCKSIZE); + HASH_Update(sha1, in, in_len); + HASH_End(sha1, hash, &res_len, SSS_SHA1_LENGTH); + + HASH_Begin(sha1); + HASH_Update(sha1, okey, HMAC_SHA1_BLOCKSIZE); + HASH_Update(sha1, hash, SSS_SHA1_LENGTH); + HASH_End(sha1, out, &res_len, SSS_SHA1_LENGTH); + + HASH_Destroy(sha1); + + return EOK; +} diff --git a/src/util/crypto/sss_crypto.h b/src/util/crypto/sss_crypto.h index 7b3e5e09c..5b40ecfc4 100644 --- a/src/util/crypto/sss_crypto.h +++ b/src/util/crypto/sss_crypto.h @@ -19,6 +19,14 @@ unsigned char *sss_base64_decode(TALLOC_CTX *mem_ctx, const char *in, size_t *outsize); +#define SSS_SHA1_LENGTH 20 + +int sss_hmac_sha1(const unsigned char *key, + size_t key_len, + const unsigned char *in, + size_t in_len, + unsigned char *out); + int sss_password_encrypt(TALLOC_CTX *mem_ctx, const char *password, int plen, enum obfmethod meth, char **obfpwd); -- cgit