diff --git a/.gitignore b/.gitignore index 5efea5a..cd89cfe 100644 --- a/.gitignore +++ b/.gitignore @@ -3,7 +3,7 @@ Makefile config.h *.log config.status -scrypt +scrypt-genpass *.o stamp-h1 .deps/ diff --git a/Makefile.in b/Makefile.in index a6e2d56..2d32445 100644 --- a/Makefile.in +++ b/Makefile.in @@ -177,8 +177,7 @@ scrypt_SOURCES = main.c \ lib/util/memlimit.c \ lib/util/readpass.c \ lib/util/warn.c \ - lib/scryptenc/scryptenc.c \ - lib/scryptenc/scryptenc_cpuperf.c \ + lib/genpass/genpass.c \ lib/crypto/crypto_aesctr.c \ lib/crypto/sha256.c \ lib/crypto/crypto_scrypt-@SCRYPTVER@.c diff --git a/lib/genpass/genpass.c b/lib/genpass/genpass.c index 3b7fd0f..f032a2f 100644 --- a/lib/genpass/genpass.c +++ b/lib/genpass/genpass.c @@ -199,7 +199,7 @@ err0: } static int -scryptenc_setup(uint8_t header[96], uint8_t dk[64], +genpass(uint8_t dk[64], const uint8_t * passwd, size_t passwdlen, size_t maxmem, double maxmemfrac, double maxtime) { @@ -228,379 +228,6 @@ scryptenc_setup(uint8_t header[96], uint8_t dk[64], if (crypto_scrypt(passwd, passwdlen, salt, 32, N, r, p, dk, 64)) return (3); - /* Construct the file header. */ - memcpy(header, "scrypt", 6); - header[6] = 0; - header[7] = logN; - be32enc(&header[8], r); - be32enc(&header[12], p); - memcpy(&header[16], salt, 32); - - /* Add header checksum. */ - SHA256_Init(&ctx); - SHA256_Update(&ctx, header, 48); - SHA256_Final(hbuf, &ctx); - memcpy(&header[48], hbuf, 16); - - /* Add header signature (used for verifying password). */ - HMAC_SHA256_Init(&hctx, key_hmac, 32); - HMAC_SHA256_Update(&hctx, header, 64); - HMAC_SHA256_Final(hbuf, &hctx); - memcpy(&header[64], hbuf, 32); - /* Success! */ return (0); } - -static int -scryptdec_setup(const uint8_t header[96], uint8_t dk[64], - const uint8_t * passwd, size_t passwdlen, - size_t maxmem, double maxmemfrac, double maxtime) -{ - uint8_t salt[32]; - uint8_t hbuf[32]; - int logN; - uint32_t r; - uint32_t p; - uint64_t N; - SHA256_CTX ctx; - uint8_t * key_hmac = &dk[32]; - HMAC_SHA256_CTX hctx; - int rc; - - /* Parse N, r, p, salt. */ - logN = header[7]; - r = be32dec(&header[8]); - p = be32dec(&header[12]); - memcpy(salt, &header[16], 32); - - /* Verify header checksum. */ - SHA256_Init(&ctx); - SHA256_Update(&ctx, header, 48); - SHA256_Final(hbuf, &ctx); - if (memcmp(&header[48], hbuf, 16)) - return (7); - - /* - * Check whether the provided parameters are valid and whether the - * key derivation function can be computed within the allowed memory - * and CPU time. - */ - if ((rc = checkparams(maxmem, maxmemfrac, maxtime, logN, r, p)) != 0) - return (rc); - - /* Compute the derived keys. */ - N = (uint64_t)(1) << logN; - if (crypto_scrypt(passwd, passwdlen, salt, 32, N, r, p, dk, 64)) - return (3); - - /* Check header signature (i.e., verify password). */ - HMAC_SHA256_Init(&hctx, key_hmac, 32); - HMAC_SHA256_Update(&hctx, header, 64); - HMAC_SHA256_Final(hbuf, &hctx); - if (memcmp(hbuf, &header[64], 32)) - return (11); - - /* Success! */ - return (0); -} - -/** - * scryptenc_buf(inbuf, inbuflen, outbuf, passwd, passwdlen, - * maxmem, maxmemfrac, maxtime): - * Encrypt inbuflen bytes from inbuf, writing the resulting inbuflen + 128 - * bytes to outbuf. - */ -int -scryptenc_buf(const uint8_t * inbuf, size_t inbuflen, uint8_t * outbuf, - const uint8_t * passwd, size_t passwdlen, - size_t maxmem, double maxmemfrac, double maxtime) -{ - uint8_t dk[64]; - uint8_t hbuf[32]; - uint8_t header[96]; - uint8_t * key_enc = dk; - uint8_t * key_hmac = &dk[32]; - int rc; - HMAC_SHA256_CTX hctx; - AES_KEY key_enc_exp; - struct crypto_aesctr * AES; - - /* Generate the header and derived key. */ - if ((rc = scryptenc_setup(header, dk, passwd, passwdlen, - maxmem, maxmemfrac, maxtime)) != 0) - return (rc); - - /* Copy header into output buffer. */ - memcpy(outbuf, header, 96); - - /* Encrypt data. */ - if (AES_set_encrypt_key(key_enc, 256, &key_enc_exp)) - return (5); - if ((AES = crypto_aesctr_init(&key_enc_exp, 0)) == NULL) - return (6); - crypto_aesctr_stream(AES, inbuf, &outbuf[96], inbuflen); - crypto_aesctr_free(AES); - - /* Add signature. */ - HMAC_SHA256_Init(&hctx, key_hmac, 32); - HMAC_SHA256_Update(&hctx, outbuf, 96 + inbuflen); - HMAC_SHA256_Final(hbuf, &hctx); - memcpy(&outbuf[96 + inbuflen], hbuf, 32); - - /* Zero sensitive data. */ - memset(dk, 0, 64); - memset(&key_enc_exp, 0, sizeof(AES_KEY)); - - /* Success! */ - return (0); -} - -/** - * scryptdec_buf(inbuf, inbuflen, outbuf, outlen, passwd, passwdlen, - * maxmem, maxmemfrac, maxtime): - * Decrypt inbuflen bytes fro inbuf, writing the result into outbuf and the - * decrypted data length to outlen. The allocated length of outbuf must - * be at least inbuflen. - */ -int -scryptdec_buf(const uint8_t * inbuf, size_t inbuflen, uint8_t * outbuf, - size_t * outlen, const uint8_t * passwd, size_t passwdlen, - size_t maxmem, double maxmemfrac, double maxtime) -{ - uint8_t hbuf[32]; - uint8_t dk[64]; - uint8_t * key_enc = dk; - uint8_t * key_hmac = &dk[32]; - int rc; - HMAC_SHA256_CTX hctx; - AES_KEY key_enc_exp; - struct crypto_aesctr * AES; - - /* - * All versions of the scrypt format will start with "scrypt" and - * have at least 7 bytes of header. - */ - if ((inbuflen < 7) || (memcmp(inbuf, "scrypt", 6) != 0)) - return (7); - - /* Check the format. */ - if (inbuf[6] != 0) - return (8); - - /* We must have at least 128 bytes. */ - if (inbuflen < 128) - return (7); - - /* Parse the header and generate derived keys. */ - if ((rc = scryptdec_setup(inbuf, dk, passwd, passwdlen, - maxmem, maxmemfrac, maxtime)) != 0) - return (rc); - - /* Decrypt data. */ - if (AES_set_encrypt_key(key_enc, 256, &key_enc_exp)) - return (5); - if ((AES = crypto_aesctr_init(&key_enc_exp, 0)) == NULL) - return (6); - crypto_aesctr_stream(AES, &inbuf[96], outbuf, inbuflen - 128); - crypto_aesctr_free(AES); - *outlen = inbuflen - 128; - - /* Verify signature. */ - HMAC_SHA256_Init(&hctx, key_hmac, 32); - HMAC_SHA256_Update(&hctx, inbuf, inbuflen - 32); - HMAC_SHA256_Final(hbuf, &hctx); - if (memcmp(hbuf, &inbuf[inbuflen - 32], 32)) - return (7); - - /* Zero sensitive data. */ - memset(dk, 0, 64); - memset(&key_enc_exp, 0, sizeof(AES_KEY)); - - /* Success! */ - return (0); -} - -/** - * scryptenc_file(infile, outfile, passwd, passwdlen, - * maxmem, maxmemfrac, maxtime): - * Read a stream from infile and encrypt it, writing the resulting stream to - * outfile. - */ -int -scryptenc_file(FILE * infile, FILE * outfile, - const uint8_t * passwd, size_t passwdlen, - size_t maxmem, double maxmemfrac, double maxtime) -{ - uint8_t buf[ENCBLOCK]; - uint8_t dk[64]; - uint8_t hbuf[32]; - uint8_t header[96]; - uint8_t * key_enc = dk; - uint8_t * key_hmac = &dk[32]; - size_t readlen; - HMAC_SHA256_CTX hctx; - AES_KEY key_enc_exp; - struct crypto_aesctr * AES; - int rc; - - /* Generate the header and derived key. */ - if ((rc = scryptenc_setup(header, dk, passwd, passwdlen, - maxmem, maxmemfrac, maxtime)) != 0) - return (rc); - - /* Hash and write the header. */ - HMAC_SHA256_Init(&hctx, key_hmac, 32); - HMAC_SHA256_Update(&hctx, header, 96); - if (fwrite(header, 96, 1, outfile) != 1) - return (12); - - /* - * Read blocks of data, encrypt them, and write them out; hash the - * data as it is produced. - */ - if (AES_set_encrypt_key(key_enc, 256, &key_enc_exp)) - return (5); - if ((AES = crypto_aesctr_init(&key_enc_exp, 0)) == NULL) - return (6); - do { - if ((readlen = fread(buf, 1, ENCBLOCK, infile)) == 0) - break; - crypto_aesctr_stream(AES, buf, buf, readlen); - HMAC_SHA256_Update(&hctx, buf, readlen); - if (fwrite(buf, 1, readlen, outfile) < readlen) - return (12); - } while (1); - crypto_aesctr_free(AES); - - /* Did we exit the loop due to a read error? */ - if (ferror(infile)) - return (13); - - /* Compute the final HMAC and output it. */ - HMAC_SHA256_Final(hbuf, &hctx); - if (fwrite(hbuf, 32, 1, outfile) != 1) - return (12); - - /* Zero sensitive data. */ - memset(dk, 0, 64); - memset(&key_enc_exp, 0, sizeof(AES_KEY)); - - /* Success! */ - return (0); -} - -/** - * scryptdec_file(infile, outfile, passwd, passwdlen, - * maxmem, maxmemfrac, maxtime): - * Read a stream from infile and decrypt it, writing the resulting stream to - * outfile. - */ -int -scryptdec_file(FILE * infile, FILE * outfile, - const uint8_t * passwd, size_t passwdlen, - size_t maxmem, double maxmemfrac, double maxtime) -{ - uint8_t buf[ENCBLOCK + 32]; - uint8_t header[96]; - uint8_t hbuf[32]; - uint8_t dk[64]; - uint8_t * key_enc = dk; - uint8_t * key_hmac = &dk[32]; - size_t buflen = 0; - size_t readlen; - HMAC_SHA256_CTX hctx; - AES_KEY key_enc_exp; - struct crypto_aesctr * AES; - int rc; - - /* - * Read the first 7 bytes of the file; all future version of scrypt - * are guaranteed to have at least 7 bytes of header. - */ - if (fread(header, 7, 1, infile) < 1) { - if (ferror(infile)) - return (13); - else - return (7); - } - - /* Do we have the right magic? */ - if (memcmp(header, "scrypt", 6)) - return (7); - if (header[6] != 0) - return (8); - - /* - * Read another 89 bytes of the file; version 0 of the srypt file - * format has a 96-byte header. - */ - if (fread(&header[7], 89, 1, infile) < 1) { - if (ferror(infile)) - return (13); - else - return (7); - } - - /* Parse the header and generate derived keys. */ - if ((rc = scryptdec_setup(header, dk, passwd, passwdlen, - maxmem, maxmemfrac, maxtime)) != 0) - return (rc); - - /* Start hashing with the header. */ - HMAC_SHA256_Init(&hctx, key_hmac, 32); - HMAC_SHA256_Update(&hctx, header, 96); - - /* - * We don't know how long the encrypted data block is (we can't know, - * since data can be streamed into 'scrypt enc') so we need to read - * data and decrypt all of it except the final 32 bytes, then check - * if that final 32 bytes is the correct signature. - */ - if (AES_set_encrypt_key(key_enc, 256, &key_enc_exp)) - return (5); - if ((AES = crypto_aesctr_init(&key_enc_exp, 0)) == NULL) - return (6); - do { - /* Read data until we have more than 32 bytes of it. */ - if ((readlen = fread(&buf[buflen], 1, - ENCBLOCK + 32 - buflen, infile)) == 0) - break; - buflen += readlen; - if (buflen <= 32) - continue; - - /* - * Decrypt, hash, and output everything except the last 32 - * bytes out of what we have in our buffer. - */ - HMAC_SHA256_Update(&hctx, buf, buflen - 32); - crypto_aesctr_stream(AES, buf, buf, buflen - 32); - if (fwrite(buf, 1, buflen - 32, outfile) < buflen - 32) - return (12); - - /* Move the last 32 bytes to the start of the buffer. */ - memmove(buf, &buf[buflen - 32], 32); - buflen = 32; - } while (1); - crypto_aesctr_free(AES); - - /* Did we exit the loop due to a read error? */ - if (ferror(infile)) - return (13); - - /* Did we read enough data that we *might* have a valid signature? */ - if (buflen < 32) - return (7); - - /* Verify signature. */ - HMAC_SHA256_Final(hbuf, &hctx); - if (memcmp(hbuf, buf, 32)) - return (7); - - /* Zero sensitive data. */ - memset(dk, 0, 64); - memset(&key_enc_exp, 0, sizeof(AES_KEY)); - - return (0); -} diff --git a/lib/genpass/genpass.h b/lib/genpass/genpass.h index 7dc3dd3..05263d5 100644 --- a/lib/genpass/genpass.h +++ b/lib/genpass/genpass.h @@ -26,8 +26,8 @@ * This file was originally written by Colin Percival as part of the Tarsnap * online backup system. */ -#ifndef _SCRYPTENC_H_ -#define _SCRYPTENC_H_ +#ifndef _GENPASS_H_ +#define _GENPASS_H_ #include #include @@ -72,41 +72,8 @@ * 13 error reading input file */ -/** - * scryptenc_buf(inbuf, inbuflen, outbuf, passwd, passwdlen, - * maxmem, maxmemfrac, maxtime): - * Encrypt inbuflen bytes from inbuf, writing the resulting inbuflen + 128 - * bytes to outbuf. - */ -int scryptenc_buf(const uint8_t *, size_t, uint8_t *, - const uint8_t *, size_t, size_t, double, double); +int genpass(uint8_t header[96], uint8_t dk[64], + const uint8_t * passwd, size_t passwdlen, + size_t maxmem, double maxmemfrac, double maxtime); -/** - * scryptdec_buf(inbuf, inbuflen, outbuf, outlen, passwd, passwdlen, - * maxmem, maxmemfrac, maxtime): - * Decrypt inbuflen bytes from inbuf, writing the result into outbuf and the - * decrypted data length to outlen. The allocated length of outbuf must - * be at least inbuflen. - */ -int scryptdec_buf(const uint8_t *, size_t, uint8_t *, size_t *, - const uint8_t *, size_t, size_t, double, double); - -/** - * scryptenc_file(infile, outfile, passwd, passwdlen, - * maxmem, maxmemfrac, maxtime): - * Read a stream from infile and encrypt it, writing the resulting stream to - * outfile. - */ -int scryptenc_file(FILE *, FILE *, const uint8_t *, size_t, - size_t, double, double); - -/** - * scryptdec_file(infile, outfile, passwd, passwdlen, - * maxmem, maxmemfrac, maxtime): - * Read a stream from infile and decrypt it, writing the resulting stream to - * outfile. - */ -int scryptdec_file(FILE *, FILE *, const uint8_t *, size_t, - size_t, double, double); - -#endif /* !_SCRYPTENC_H_ */ +#endif /* !_GENPASS_H_ */