1 /*
   2  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
   3  * Use is subject to license terms.
   4  */
   5 
   6 
   7 /*
   8  * lib/crypto/des/string2key.c
   9  *
  10  * based on lib/crypto/des/string2key.c from MIT V5 
  11  * and on lib/des/afs_string_to_key.c from UMD.
  12  * constructed by Mark Eichin, Cygnus Support, 1995.
  13  * made thread-safe by Ken Raeburn, MIT, 2001.
  14  */
  15 
  16 /*
  17  * Copyright 2001 by the Massachusetts Institute of Technology.
  18  * All Rights Reserved.
  19  *
  20  * Export of this software from the United States of America may
  21  *   require a specific license from the United States Government.
  22  *   It is the responsibility of any person or organization contemplating
  23  *   export to obtain such a license before exporting.
  24  * 
  25  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
  26  * distribute this software and its documentation for any purpose and
  27  * without fee is hereby granted, provided that the above copyright
  28  * notice appear in all copies and that both that copyright notice and
  29  * this permission notice appear in supporting documentation, and that
  30  * the name of M.I.T. not be used in advertising or publicity pertaining
  31  * to distribution of the software without specific, written prior
  32  * permission.  Furthermore if you modify this software you must label
  33  * your software as modified software and not distribute it in such a
  34  * fashion that it might be confused with the original M.I.T. software.
  35  * M.I.T. makes no representations about the suitability of
  36  * this software for any purpose.  It is provided "as is" without express
  37  * or implied warranty.
  38  */
  39 
  40 /*
  41  * Copyright (C) 1998 by the FundsXpress, INC.
  42  * 
  43  * All rights reserved.
  44  * 
  45  * Export of this software from the United States of America may require
  46  * a specific license from the United States Government.  It is the
  47  * responsibility of any person or organization contemplating export to
  48  * obtain such a license before exporting.
  49  * 
  50  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
  51  * distribute this software and its documentation for any purpose and
  52  * without fee is hereby granted, provided that the above copyright
  53  * notice appear in all copies and that both that copyright notice and
  54  * this permission notice appear in supporting documentation, and that
  55  * the name of FundsXpress. not be used in advertising or publicity pertaining
  56  * to distribution of the software without specific, written prior
  57  * permission.  FundsXpress makes no representations about the suitability of
  58  * this software for any purpose.  It is provided "as is" without express
  59  * or implied warranty.
  60  * 
  61  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
  62  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
  63  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  64  */
  65 
  66 #include "k5-int.h"
  67 #include "des_int.h"
  68 #include <ctype.h>
  69 
  70 #define afs_crypt mit_afs_crypt
  71 char *afs_crypt (const char *, const char *, char *);
  72 
  73 #undef min
  74 #define min(a,b) ((a)>(b)?(b):(a))
  75 
  76 /*ARGSUSED*/
  77 krb5_error_code
  78 mit_afs_string_to_key (krb5_context context,
  79                     krb5_keyblock *keyblock, const krb5_data *data,
  80                     const krb5_data *salt)
  81 {
  82     /* Solaris Kerberos */
  83     krb5_error_code retval = KRB5_PROG_ETYPE_NOSUPP;
  84   /* totally different approach from MIT string2key. */
  85   /* much of the work has already been done by the only caller 
  86      which is mit_des_string_to_key; in particular, *keyblock is already 
  87      set up. */
  88   
  89     char *realm = salt->data;
  90     unsigned int i, j;
  91     krb5_octet *key = keyblock->contents;
  92     /* Solaris Kerberos */
  93     krb5_keyblock usekey;
  94 
  95     if (data->length <= 8) {
  96       /* One block only.  Run afs_crypt and use the first eight
  97          returned bytes after the copy of the (fixed) salt.
  98 
  99          Since the returned bytes are alphanumeric, the output is
 100          limited to 2**48 possibilities; for each byte, only 64
 101          possible values can be used.  */
 102       unsigned char password[9]; /* trailing nul for crypt() */
 103       char afs_crypt_buf[16];
 104 
 105       memset (password, 0, sizeof (password));
 106       memcpy (password, realm, min (salt->length, 8));
 107       for (i=0; i<8; i++)
 108         if (isupper(password[i]))
 109           password[i] = tolower(password[i]);
 110       for (i=0; i<data->length; i++)
 111         password[i] ^= data->data[i];
 112       for (i=0; i<8; i++)
 113         if (password[i] == '\0')
 114           password[i] = 'X';
 115       password[8] = '\0';
 116       /* Out-of-bounds salt characters are equivalent to a salt string
 117          of "p1".  */
 118       strncpy((char *) key,
 119               (char *) afs_crypt((char *) password, "#~", afs_crypt_buf) + 2,
 120               8);
 121       for (i=0; i<8; i++)
 122         key[i] <<= 1;
 123       /* now fix up key parity again */
 124       mit_des_fixup_key_parity(key);
 125       /* clean & free the input string */
 126       memset(password, 0, (size_t) sizeof(password));
 127 
 128       /* Solaris Kerberos: Success */
 129       retval = 0;
 130     } else {
 131       /* Multiple blocks.  Do a CBC checksum, twice, and use the
 132          result as the new key.  */
 133       mit_des_cblock ikey, tkey;
 134       unsigned int pw_len = salt->length+data->length;
 135       unsigned char *password = malloc(pw_len+1);
 136       if (!password) return ENOMEM;
 137 
 138       /* Some bound checks from the original code are elided here as
 139          the malloc above makes sure we have enough storage. */
 140       memcpy (password, data->data, data->length);
 141       for (i=data->length, j = 0; j < salt->length; i++, j++) {
 142         password[i] = realm[j];
 143         if (isupper(password[i]))
 144           password[i] = tolower(password[i]);
 145       }
 146         
 147       memcpy (ikey, "kerberos", sizeof(ikey));
 148       memcpy (tkey, ikey, sizeof(tkey));
 149       mit_des_fixup_key_parity (tkey);
 150 
 151     /* Solaris Kerberos */
 152       usekey.enctype = ENCTYPE_DES_CBC_CRC;
 153       usekey.contents = tkey;
 154       usekey.length = 8;
 155       retval = mit_des_cbc_cksum (context, (unsigned char *)password,
 156                                 tkey, i, &usekey, ikey);
 157 
 158       memcpy (ikey, tkey, sizeof(ikey));
 159       mit_des_fixup_key_parity (tkey);
 160       /* Solaris Kerberos */
 161       if (usekey.hKey != CK_INVALID_HANDLE) {
 162          (void) C_DestroyObject(krb_ctx_hSession(context), usekey.hKey);
 163          usekey.hKey = CK_INVALID_HANDLE;
 164       }
 165       usekey.contents = tkey;
 166       usekey.length = 8;
 167       retval = mit_des_cbc_cksum (context, (unsigned char *) password,
 168                                 key, i, &usekey, ikey);
 169 
 170       /* now fix up key parity again */
 171       mit_des_fixup_key_parity(key);
 172       
 173       /* Solaris Kerberos */
 174       if (usekey.hKey != CK_INVALID_HANDLE) {
 175          (void) C_DestroyObject(krb_ctx_hSession(context), usekey.hKey);
 176          usekey.hKey = CK_INVALID_HANDLE;
 177       }
 178       /* clean & free the input string */
 179       memset(password, 0, (size_t) pw_len);
 180       krb5_xfree(password);
 181     }
 182 #if 0
 183     /* must free here because it was copied for this special case */
 184     krb5_xfree(salt->data);
 185 #endif
 186 
 187     return retval;
 188 }
 189 
 190 
 191 /* Portions of this code:
 192    Copyright 1989 by the Massachusetts Institute of Technology
 193    */
 194  
 195 /*
 196  * Copyright (c) 1990 Regents of The University of Michigan.
 197  * All Rights Reserved.
 198  *
 199  * Permission to use, copy, modify, and distribute this software
 200  * and its documentation for any purpose and without fee is hereby
 201  * granted, provided that the above copyright notice appears in all
 202  * copies and that both that copyright notice and this permission
 203  * notice appear in supporting documentation, and that the name of
 204  * The University of Michigan not be used in advertising or
 205  * publicity pertaining to distribution of the software without
 206  * specific, written prior permission. This software is supplied as
 207  * is without expressed or implied warranties of any kind.
 208  *
 209  *      ITD Research Systems
 210  *      University of Michigan
 211  *      535 W. William Street
 212  *      Ann Arbor, Michigan
 213  *      +1-313-936-2652
 214  *      netatalk@terminator.cc.umich.edu
 215  */
 216 
 217 static void krb5_afs_crypt_setkey (char*, char*, char(*)[48]);
 218 static void krb5_afs_encrypt (char*,char*,char (*)[48]);
 219 
 220 /*
 221  * Initial permutation,
 222  */
 223 static const char       IP[] = {
 224         58,50,42,34,26,18,10, 2,
 225         60,52,44,36,28,20,12, 4,
 226         62,54,46,38,30,22,14, 6,
 227         64,56,48,40,32,24,16, 8,
 228         57,49,41,33,25,17, 9, 1,
 229         59,51,43,35,27,19,11, 3,
 230         61,53,45,37,29,21,13, 5,
 231         63,55,47,39,31,23,15, 7,
 232 };
 233  
 234 /*
 235  * Final permutation, FP = IP^(-1)
 236  */
 237 static const char       FP[] = {
 238         40, 8,48,16,56,24,64,32,
 239         39, 7,47,15,55,23,63,31,
 240         38, 6,46,14,54,22,62,30,
 241         37, 5,45,13,53,21,61,29,
 242         36, 4,44,12,52,20,60,28,
 243         35, 3,43,11,51,19,59,27,
 244         34, 2,42,10,50,18,58,26,
 245         33, 1,41, 9,49,17,57,25,
 246 };
 247  
 248 /*
 249  * Permuted-choice 1 from the key bits to yield C and D.
 250  * Note that bits 8,16... are left out: They are intended for a parity check.
 251  */
 252 static const char       PC1_C[] = {
 253         57,49,41,33,25,17, 9,
 254          1,58,50,42,34,26,18,
 255         10, 2,59,51,43,35,27,
 256         19,11, 3,60,52,44,36,
 257 };
 258  
 259 static const char       PC1_D[] = {
 260         63,55,47,39,31,23,15,
 261          7,62,54,46,38,30,22,
 262         14, 6,61,53,45,37,29,
 263         21,13, 5,28,20,12, 4,
 264 };
 265  
 266 /*
 267  * Sequence of shifts used for the key schedule.
 268  */
 269 static const char       shifts[] = {
 270         1,1,2,2,2,2,2,2,1,2,2,2,2,2,2,1,
 271 };
 272  
 273 /*
 274  * Permuted-choice 2, to pick out the bits from
 275  * the CD array that generate the key schedule.
 276  */
 277 static const char       PC2_C[] = {
 278         14,17,11,24, 1, 5,
 279          3,28,15, 6,21,10,
 280         23,19,12, 4,26, 8,
 281         16, 7,27,20,13, 2,
 282 };
 283  
 284 static const char       PC2_D[] = {
 285         41,52,31,37,47,55,
 286         30,40,51,45,33,48,
 287         44,49,39,56,34,53,
 288         46,42,50,36,29,32,
 289 };
 290  
 291 /*
 292  * The E bit-selection table.
 293  */
 294 static const char       e[] = {
 295         32, 1, 2, 3, 4, 5,
 296          4, 5, 6, 7, 8, 9,
 297          8, 9,10,11,12,13,
 298         12,13,14,15,16,17,
 299         16,17,18,19,20,21,
 300         20,21,22,23,24,25,
 301         24,25,26,27,28,29,
 302         28,29,30,31,32, 1,
 303 };
 304  
 305 /*
 306  * P is a permutation on the selected combination
 307  * of the current L and key.
 308  */
 309 static const char       P[] = {
 310         16, 7,20,21,
 311         29,12,28,17,
 312          1,15,23,26,
 313          5,18,31,10,
 314          2, 8,24,14,
 315         32,27, 3, 9,
 316         19,13,30, 6,
 317         22,11, 4,25,
 318 };
 319  
 320 /*
 321  * The 8 selection functions.
 322  * For some reason, they give a 0-origin
 323  * index, unlike everything else.
 324  */
 325 static const char       S[8][64] = {
 326         {14, 4,13, 1, 2,15,11, 8, 3,10, 6,12, 5, 9, 0, 7,
 327           0,15, 7, 4,14, 2,13, 1,10, 6,12,11, 9, 5, 3, 8,
 328           4, 1,14, 8,13, 6, 2,11,15,12, 9, 7, 3,10, 5, 0,
 329          15,12, 8, 2, 4, 9, 1, 7, 5,11, 3,14,10, 0, 6,13},
 330  
 331         {15, 1, 8,14, 6,11, 3, 4, 9, 7, 2,13,12, 0, 5,10,
 332           3,13, 4, 7,15, 2, 8,14,12, 0, 1,10, 6, 9,11, 5,
 333           0,14, 7,11,10, 4,13, 1, 5, 8,12, 6, 9, 3, 2,15,
 334          13, 8,10, 1, 3,15, 4, 2,11, 6, 7,12, 0, 5,14, 9},
 335  
 336         {10, 0, 9,14, 6, 3,15, 5, 1,13,12, 7,11, 4, 2, 8,
 337          13, 7, 0, 9, 3, 4, 6,10, 2, 8, 5,14,12,11,15, 1,
 338          13, 6, 4, 9, 8,15, 3, 0,11, 1, 2,12, 5,10,14, 7,
 339           1,10,13, 0, 6, 9, 8, 7, 4,15,14, 3,11, 5, 2,12},
 340  
 341         { 7,13,14, 3, 0, 6, 9,10, 1, 2, 8, 5,11,12, 4,15,
 342          13, 8,11, 5, 6,15, 0, 3, 4, 7, 2,12, 1,10,14, 9,
 343          10, 6, 9, 0,12,11, 7,13,15, 1, 3,14, 5, 2, 8, 4,
 344           3,15, 0, 6,10, 1,13, 8, 9, 4, 5,11,12, 7, 2,14},
 345  
 346         { 2,12, 4, 1, 7,10,11, 6, 8, 5, 3,15,13, 0,14, 9,
 347          14,11, 2,12, 4, 7,13, 1, 5, 0,15,10, 3, 9, 8, 6,
 348           4, 2, 1,11,10,13, 7, 8,15, 9,12, 5, 6, 3, 0,14,
 349          11, 8,12, 7, 1,14, 2,13, 6,15, 0, 9,10, 4, 5, 3},
 350  
 351         {12, 1,10,15, 9, 2, 6, 8, 0,13, 3, 4,14, 7, 5,11,
 352          10,15, 4, 2, 7,12, 9, 5, 6, 1,13,14, 0,11, 3, 8,
 353           9,14,15, 5, 2, 8,12, 3, 7, 0, 4,10, 1,13,11, 6,
 354           4, 3, 2,12, 9, 5,15,10,11,14, 1, 7, 6, 0, 8,13},
 355  
 356         { 4,11, 2,14,15, 0, 8,13, 3,12, 9, 7, 5,10, 6, 1,
 357          13, 0,11, 7, 4, 9, 1,10,14, 3, 5,12, 2,15, 8, 6,
 358           1, 4,11,13,12, 3, 7,14,10,15, 6, 8, 0, 5, 9, 2,
 359           6,11,13, 8, 1, 4,10, 7, 9, 5, 0,15,14, 2, 3,12},
 360  
 361         {13, 2, 8, 4, 6,15,11, 1,10, 9, 3,14, 5, 0,12, 7,
 362           1,15,13, 8,10, 3, 7, 4,12, 5, 6,11, 0,14, 9, 2,
 363           7,11, 4, 1, 9,12,14, 2, 0, 6,10,13,15, 3, 5, 8,
 364           2, 1,14, 7, 4,10, 8,13,15,12, 9, 0, 3, 5, 6,11},
 365 };
 366  
 367  
 368 char *afs_crypt(const char *pw, const char *salt,
 369                 /* must be at least 16 bytes */
 370                 char *iobuf)
 371 {
 372         int i, j, c;
 373         int temp;
 374         char block[66];
 375         char E[48];
 376         /*
 377          * The key schedule.
 378          * Generated from the key.
 379          */
 380         char KS[16][48];
 381  
 382         for(i=0; i<66; i++)
 383                 block[i] = 0;
 384         /* Solaris Kerberos */
 385         for(i=0; ((c= *pw) != 0) && i<64; pw++){
 386                 for(j=0; j<7; j++, i++)
 387                         block[i] = (c>>(6-j)) & 01;
 388                 i++;
 389         }
 390         
 391         krb5_afs_crypt_setkey(block, E, KS);
 392 
 393         for(i=0; i<66; i++)
 394                 block[i] = 0;
 395 
 396         for(i=0;i<2;i++){
 397                 c = *salt++;
 398                 iobuf[i] = c;
 399                 if(c>'Z') c -= 6;
 400                 if(c>'9') c -= 7;
 401                 c -= '.';
 402                 for(j=0;j<6;j++){
 403                         if((c>>j) & 01){
 404                                 temp = E[6*i+j];
 405                                 E[6*i+j] = E[6*i+j+24];
 406                                 E[6*i+j+24] = temp;
 407                                 }
 408                         }
 409                 }
 410         
 411         for(i=0; i<25; i++)
 412                 krb5_afs_encrypt(block,E,KS);
 413         
 414         for(i=0; i<11; i++){
 415                 c = 0;
 416                 for(j=0; j<6; j++){
 417                         c <<= 1;
 418                         c |= block[6*i+j];
 419                         }
 420                 c += '.';
 421                 if(c>'9') c += 7;
 422                 if(c>'Z') c += 6;
 423                 iobuf[i+2] = c;
 424         }
 425         iobuf[i+2] = 0;
 426         if(iobuf[1]==0)
 427                 iobuf[1] = iobuf[0];
 428         return(iobuf);
 429 }
 430 
 431 /*
 432  * Set up the key schedule from the key.
 433  */
 434  
 435 static void krb5_afs_crypt_setkey(char *key, char *E, char (*KS)[48])
 436 {
 437         register int i, j, k;
 438         int t;
 439         /*
 440          * The C and D arrays used to calculate the key schedule.
 441          */
 442         char C[28], D[28];
 443  
 444         /*
 445          * First, generate C and D by permuting
 446          * the key.  The low order bit of each
 447          * 8-bit char is not used, so C and D are only 28
 448          * bits apiece.
 449          */
 450         for (i=0; i<28; i++) {
 451                 C[i] = key[PC1_C[i]-1];
 452                 D[i] = key[PC1_D[i]-1];
 453         }
 454         /*
 455          * To generate Ki, rotate C and D according
 456          * to schedule and pick up a permutation
 457          * using PC2.
 458          */
 459         for (i=0; i<16; i++) {
 460                 /*
 461                  * rotate.
 462                  */
 463                 for (k=0; k<shifts[i]; k++) {
 464                         t = C[0];
 465                         for (j=0; j<28-1; j++)
 466                                 C[j] = C[j+1];
 467                         C[27] = t;
 468                         t = D[0];
 469                         for (j=0; j<28-1; j++)
 470                                 D[j] = D[j+1];
 471                         D[27] = t;
 472                 }
 473                 /*
 474                  * get Ki. Note C and D are concatenated.
 475                  */
 476                 for (j=0; j<24; j++) {
 477                         KS[i][j] = C[PC2_C[j]-1];
 478                         KS[i][j+24] = D[PC2_D[j]-28-1];
 479                 }
 480         }
 481  
 482 #if 0
 483         for(i=0;i<48;i++) {
 484                 E[i] = e[i];
 485         }
 486 #else
 487         memcpy(E, e, 48);
 488 #endif
 489 }
 490  
 491 /*
 492  * The payoff: encrypt a block.
 493  */
 494  
 495 static void krb5_afs_encrypt(char *block, char *E, char (*KS)[48])
 496 {
 497         const long edflag = 0;
 498         int i, ii;
 499         int t, j, k;
 500         char tempL[32];
 501         char f[32];
 502         /*
 503          * The current block, divided into 2 halves.
 504          */
 505         char L[64];
 506         char *const R = &L[32];
 507         /*
 508          * The combination of the key and the input, before selection.
 509          */
 510         char preS[48];
 511 
 512         /*
 513          * First, permute the bits in the input
 514          */
 515         for (j=0; j<64; j++)
 516                 L[j] = block[IP[j]-1];
 517         /*
 518          * Perform an encryption operation 16 times.
 519          */
 520         for (ii=0; ii<16; ii++) {
 521                 /*
 522                  * Set direction
 523                  */
 524                 if (edflag)
 525                         i = 15-ii;
 526                 else
 527                         i = ii;
 528                 /*
 529                  * Save the R array,
 530                  * which will be the new L.
 531                  */
 532 #if 0
 533                 for (j=0; j<32; j++)
 534                         tempL[j] = R[j];
 535 #else
 536                 memcpy(tempL, R, 32);
 537 #endif
 538                 /*
 539                  * Expand R to 48 bits using the E selector;
 540                  * exclusive-or with the current key bits.
 541                  */
 542                 for (j=0; j<48; j++)
 543                         preS[j] = R[E[j]-1] ^ KS[i][j];
 544                 /*
 545                  * The pre-select bits are now considered
 546                  * in 8 groups of 6 bits each.
 547                  * The 8 selection functions map these
 548                  * 6-bit quantities into 4-bit quantities
 549                  * and the results permuted
 550                  * to make an f(R, K).
 551                  * The indexing into the selection functions
 552                  * is peculiar; it could be simplified by
 553                  * rewriting the tables.
 554                  */
 555                 for (j=0; j<8; j++) {
 556                         t = 6*j;
 557                         k = S[j][(preS[t+0]<<5)+
 558                                 (preS[t+1]<<3)+
 559                                 (preS[t+2]<<2)+
 560                                 (preS[t+3]<<1)+
 561                                 (preS[t+4]<<0)+
 562                                 (preS[t+5]<<4)];
 563                         t = 4*j;
 564                                 f[t+0] = (k>>3)&01;
 565                                 f[t+1] = (k>>2)&01;
 566                                 f[t+2] = (k>>1)&01;
 567                                 f[t+3] = (k>>0)&01;
 568                 }
 569                 /*
 570                  * The new R is L ^ f(R, K).
 571                  * The f here has to be permuted first, though.
 572                  */
 573                 for (j=0; j<32; j++)
 574                         R[j] = L[j] ^ f[P[j]-1];
 575                 /*
 576                  * Finally, the new L (the original R)
 577                  * is copied back.
 578                  */
 579 #if 0
 580                 for (j=0; j<32; j++)
 581                         L[j] = tempL[j];
 582 #else
 583                 memcpy(L, tempL, 32);
 584 #endif
 585         }
 586         /*
 587          * The output L and R are reversed.
 588          */
 589         for (j=0; j<32; j++) {
 590                 t = L[j];
 591                 L[j] = R[j];
 592                 R[j] = t;
 593         }
 594         /*
 595          * The final output
 596          * gets the inverse permutation of the very original.
 597          */
 598         for (j=0; j<64; j++)
 599                 block[j] = L[FP[j]-1];
 600 }