crypto.h 14.7 KB
Newer Older
1
/* Copyright (c) 2001, Matej Pfajfar.
Roger Dingledine's avatar
Roger Dingledine committed
2
 * Copyright (c) 2001-2004, Roger Dingledine.
3
 * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
4
 * Copyright (c) 2007-2017, The Tor Project, Inc. */
5
6
/* See LICENSE for licensing information */

Nick Mathewson's avatar
Nick Mathewson committed
7
/**
8
 * \file crypto.h
Nick Mathewson's avatar
Nick Mathewson committed
9
 *
10
 * \brief Headers for crypto.c
Nick Mathewson's avatar
Nick Mathewson committed
11
12
 **/

13
14
#ifndef TOR_CRYPTO_H
#define TOR_CRYPTO_H
15

16
17
#include "orconfig.h"

18
#include <stdio.h>
19
#include "torint.h"
20
#include "testsupport.h"
21
#include "compat.h"
22
#include "util.h"
23

24
25
#include "keccak-tiny/keccak-tiny.h"

Nick Mathewson's avatar
Nick Mathewson committed
26
/** Length of the output of our message digest. */
27
#define DIGEST_LEN 20
Nick Mathewson's avatar
Nick Mathewson committed
28
/** Length of the output of our second (improved) message digests.  (For now
29
 * this is just sha256, but it could be any other 256-bit digest.) */
Nick Mathewson's avatar
Nick Mathewson committed
30
#define DIGEST256_LEN 32
31
32
/** Length of the output of our 64-bit optimized message digests (SHA512). */
#define DIGEST512_LEN 64
33
/** Length of our symmetric cipher's keys of 128-bit. */
34
#define CIPHER_KEY_LEN 16
35
/** Length of our symmetric cipher's IV of 128-bit. */
36
#define CIPHER_IV_LEN 16
37
38
/** Length of our symmetric cipher's keys of 256-bit. */
#define CIPHER256_KEY_LEN 32
Nick Mathewson's avatar
Nick Mathewson committed
39
/** Length of our public keys. */
40
#define PK_BYTES (1024/8)
Nick Mathewson's avatar
Nick Mathewson committed
41
/** Length of our DH keys. */
42
#define DH_BYTES (1024/8)
43

David Goulet's avatar
David Goulet committed
44
45
46
/** Length of a sha1 message digest when encoded in base32 with trailing =
 * signs removed. */
#define BASE32_DIGEST_LEN 32
Nick Mathewson's avatar
Nick Mathewson committed
47
48
/** Length of a sha1 message digest when encoded in base64 with trailing =
 * signs removed. */
49
#define BASE64_DIGEST_LEN 27
Nick Mathewson's avatar
Nick Mathewson committed
50
51
52
/** Length of a sha256 message digest when encoded in base64 with trailing =
 * signs removed. */
#define BASE64_DIGEST256_LEN 43
53
54
55
/** Length of a sha512 message digest when encoded in base64 with trailing =
 * signs removed. */
#define BASE64_DIGEST512_LEN 86
56

57
/** Constant used to indicate OAEP padding for public-key encryption */
58
#define PK_PKCS1_OAEP_PADDING 60002
59

Nick Mathewson's avatar
Nick Mathewson committed
60
/** Number of bytes added for PKCS1-OAEP padding. */
61
62
#define PKCS1_OAEP_PADDING_OVERHEAD 42

Nick Mathewson's avatar
Nick Mathewson committed
63
/** Length of encoded public key fingerprints, including space; but not
64
 * including terminating NUL. */
65
#define FINGERPRINT_LEN 49
66
67
/** Length of hex encoding of SHA1 digest, not including final NUL. */
#define HEX_DIGEST_LEN 40
Nick Mathewson's avatar
Nick Mathewson committed
68
69
/** Length of hex encoding of SHA256 digest, not including final NUL. */
#define HEX_DIGEST256_LEN 64
70
71
/** Length of hex encoding of SHA512 digest, not including final NUL. */
#define HEX_DIGEST512_LEN 128
Nick Mathewson's avatar
Nick Mathewson committed
72
73

typedef enum {
74
75
  DIGEST_SHA1 = 0,
  DIGEST_SHA256 = 1,
76
  DIGEST_SHA512 = 2,
77
78
  DIGEST_SHA3_256 = 3,
  DIGEST_SHA3_512 = 4,
Nick Mathewson's avatar
Nick Mathewson committed
79
} digest_algorithm_t;
80
#define  N_DIGEST_ALGORITHMS (DIGEST_SHA3_512+1)
81
#define  N_COMMON_DIGEST_ALGORITHMS (DIGEST_SHA256+1)
82

83
/** A set of all the digests we commonly compute, taken on a single
84
 * string.  Any digests that are shorter than 512 bits are right-padded
85
86
 * with 0 bits.
 *
87
 * Note that this representation wastes 44 bytes for the SHA1 case, so
88
89
90
91
 * don't use it for anything where we need to allocate a whole bunch at
 * once.
 **/
typedef struct {
92
  char d[N_COMMON_DIGEST_ALGORITHMS][DIGEST256_LEN];
93
} common_digests_t;
94

95
typedef struct crypto_pk_t crypto_pk_t;
96
typedef struct aes_cnt_cipher crypto_cipher_t;
97
typedef struct crypto_digest_t crypto_digest_t;
98
typedef struct crypto_xof_t crypto_xof_t;
99
typedef struct crypto_dh_t crypto_dh_t;
100

101
102
103
104
105
106
107
#define DIGEST_CHECKPOINT_BYTES (SIZEOF_VOID_P + SIZEOF_SHA_CTX)
/** Structure used to temporarily save the a digest object. Only implemented
 * for SHA1 digest for now. */
typedef struct crypto_digest_checkpoint_t {
  uint8_t mem[DIGEST_CHECKPOINT_BYTES];
} crypto_digest_checkpoint_t;

108
/* global state */
109
int crypto_early_init(void) ATTR_WUR;
110
111
int crypto_global_init(int hardwareAccel,
                       const char *accelName,
112
                       const char *accelPath) ATTR_WUR;
113
114
115
116
#ifdef USE_DMALLOC
int crypto_use_tor_alloc_functions(void);
#endif

117
void crypto_thread_cleanup(void);
Nick Mathewson's avatar
Nick Mathewson committed
118
int crypto_global_cleanup(void);
119
120

/* environment setup */
Ola Bini's avatar
Ola Bini committed
121
MOCK_DECL(crypto_pk_t *,crypto_pk_new,(void));
122
void crypto_pk_free_(crypto_pk_t *env);
123
#define crypto_pk_free(pk) FREE_AND_NULL(crypto_pk_t, crypto_pk_free_, (pk))
124

125
void crypto_set_tls_dh_prime(void);
126
crypto_cipher_t *crypto_cipher_new(const char *key);
127
crypto_cipher_t *crypto_cipher_new_with_bits(const char *key, int bits);
128
crypto_cipher_t *crypto_cipher_new_with_iv(const char *key, const char *iv);
129
130
131
crypto_cipher_t *crypto_cipher_new_with_iv_and_bits(const uint8_t *key,
                                                    const uint8_t *iv,
                                                    int bits);
132
void crypto_cipher_free_(crypto_cipher_t *env);
133
134
#define crypto_cipher_free(c) \
  FREE_AND_NULL(crypto_cipher_t, crypto_cipher_free_, (c))
135
136

/* public key crypto */
Ola Bini's avatar
Ola Bini committed
137
MOCK_DECL(int, crypto_pk_generate_key_with_bits,(crypto_pk_t *env, int bits));
138
139
#define crypto_pk_generate_key(env)                     \
  crypto_pk_generate_key_with_bits((env), (PK_BYTES*8))
140

141
int crypto_pk_read_private_key_from_filename(crypto_pk_t *env,
142
                                             const char *keyfile);
143
int crypto_pk_write_public_key_to_string(crypto_pk_t *env,
144
                                         char **dest, size_t *len);
145
int crypto_pk_write_private_key_to_string(crypto_pk_t *env,
146
                                          char **dest, size_t *len);
147
int crypto_pk_read_public_key_from_string(crypto_pk_t *env,
148
                                          const char *src, size_t len);
149
int crypto_pk_read_private_key_from_string(crypto_pk_t *env,
150
                                           const char *s, ssize_t len);
151
int crypto_pk_write_private_key_to_filename(crypto_pk_t *env,
152
                                            const char *fname);
153

154
int crypto_pk_check_key(crypto_pk_t *env);
155
156
157
int crypto_pk_cmp_keys(const crypto_pk_t *a, const crypto_pk_t *b);
int crypto_pk_eq_keys(const crypto_pk_t *a, const crypto_pk_t *b);
size_t crypto_pk_keysize(const crypto_pk_t *env);
158
159
160
161
162
int crypto_pk_num_bits(crypto_pk_t *env);
crypto_pk_t *crypto_pk_dup_key(crypto_pk_t *orig);
crypto_pk_t *crypto_pk_copy_full(crypto_pk_t *orig);
int crypto_pk_key_is_private(const crypto_pk_t *key);
int crypto_pk_public_exponent_ok(crypto_pk_t *env);
163

164
int crypto_pk_public_encrypt(crypto_pk_t *env, char *to, size_t tolen,
165
                             const char *from, size_t fromlen, int padding);
166
int crypto_pk_private_decrypt(crypto_pk_t *env, char *to, size_t tolen,
167
                              const char *from, size_t fromlen,
168
                              int padding, int warnOnFailure);
169
170
171
172
173
174
MOCK_DECL(int, crypto_pk_public_checksig,(const crypto_pk_t *env,
                                          char *to, size_t tolen,
                                          const char *from, size_t fromlen));
MOCK_DECL(int, crypto_pk_public_checksig_digest,(crypto_pk_t *env,
                                         const char *data, size_t datalen,
                                         const char *sig, size_t siglen));
175
int crypto_pk_private_sign(const crypto_pk_t *env, char *to, size_t tolen,
176
                           const char *from, size_t fromlen);
177
int crypto_pk_private_sign_digest(crypto_pk_t *env, char *to, size_t tolen,
178
                                  const char *from, size_t fromlen);
179
int crypto_pk_obsolete_public_hybrid_encrypt(crypto_pk_t *env, char *to,
180
                                    size_t tolen,
181
                                    const char *from, size_t fromlen,
182
                                    int padding, int force);
183
int crypto_pk_obsolete_private_hybrid_decrypt(crypto_pk_t *env, char *to,
184
                                     size_t tolen,
185
                                     const char *from, size_t fromlen,
186
                                     int padding, int warnOnFailure);
187

188
189
int crypto_pk_asn1_encode(crypto_pk_t *pk, char *dest, size_t dest_len);
crypto_pk_t *crypto_pk_asn1_decode(const char *str, size_t len);
190
int crypto_pk_get_digest(const crypto_pk_t *pk, char *digest_out);
Nick Mathewson's avatar
Nick Mathewson committed
191
192
int crypto_pk_get_common_digests(crypto_pk_t *pk,
                                 common_digests_t *digests_out);
193
int crypto_pk_get_fingerprint(crypto_pk_t *pk, char *fp_out,int add_space);
194
int crypto_pk_get_hashed_fingerprint(crypto_pk_t *pk, char *fp_out);
195

196
197
198
int crypto_pk_base64_encode(const crypto_pk_t *pk, char **priv_out);
crypto_pk_t *crypto_pk_base64_decode(const char *str, size_t len);

199
/* symmetric crypto */
200
const char *crypto_cipher_get_key(crypto_cipher_t *env);
201

202
int crypto_cipher_encrypt(crypto_cipher_t *env, char *to,
203
                          const char *from, size_t fromlen);
204
int crypto_cipher_decrypt(crypto_cipher_t *env, char *to,
205
                          const char *from, size_t fromlen);
206
void crypto_cipher_crypt_inplace(crypto_cipher_t *env, char *d, size_t len);
207

208
int crypto_cipher_encrypt_with_iv(const char *key,
209
210
                                  char *to, size_t tolen,
                                  const char *from, size_t fromlen);
211
int crypto_cipher_decrypt_with_iv(const char *key,
212
213
214
                                  char *to, size_t tolen,
                                  const char *from, size_t fromlen);

215
/* SHA-1 and other digests. */
216
int crypto_digest(char *digest, const char *m, size_t len);
Nick Mathewson's avatar
Nick Mathewson committed
217
218
int crypto_digest256(char *digest, const char *m, size_t len,
                     digest_algorithm_t algorithm);
219
220
int crypto_digest512(char *digest, const char *m, size_t len,
                     digest_algorithm_t algorithm);
221
int crypto_common_digests(common_digests_t *ds_out, const char *m, size_t len);
222
struct smartlist_t;
223
224
225
226
227
void crypto_digest_smartlist_prefix(char *digest_out, size_t len_out,
                                    const char *prepend,
                                    const struct smartlist_t *lst,
                                    const char *append,
                                    digest_algorithm_t alg);
228
229
230
void crypto_digest_smartlist(char *digest_out, size_t len_out,
                             const struct smartlist_t *lst, const char *append,
                             digest_algorithm_t alg);
231
const char *crypto_digest_algorithm_get_name(digest_algorithm_t alg);
232
size_t crypto_digest_algorithm_get_length(digest_algorithm_t alg);
233
int crypto_digest_algorithm_parse_name(const char *name);
234
235
crypto_digest_t *crypto_digest_new(void);
crypto_digest_t *crypto_digest256_new(digest_algorithm_t algorithm);
236
crypto_digest_t *crypto_digest512_new(digest_algorithm_t algorithm);
237
void crypto_digest_free_(crypto_digest_t *digest);
238
239
#define crypto_digest_free(d) \
  FREE_AND_NULL(crypto_digest_t, crypto_digest_free_, (d))
240
void crypto_digest_add_bytes(crypto_digest_t *digest, const char *data,
241
                             size_t len);
242
void crypto_digest_get_digest(crypto_digest_t *digest,
243
                              char *out, size_t out_len);
244
crypto_digest_t *crypto_digest_dup(const crypto_digest_t *digest);
245
246
247
248
void crypto_digest_checkpoint(crypto_digest_checkpoint_t *checkpoint,
                              const crypto_digest_t *digest);
void crypto_digest_restore(crypto_digest_t *digest,
                           const crypto_digest_checkpoint_t *checkpoint);
249
250
void crypto_digest_assign(crypto_digest_t *into,
                          const crypto_digest_t *from);
251
252
253
void crypto_hmac_sha256(char *hmac_out,
                        const char *key, size_t key_len,
                        const char *msg, size_t msg_len);
254
255
256
257
void crypto_mac_sha3_256(uint8_t *mac_out, size_t len_out,
                         const uint8_t *key, size_t key_len,
                         const uint8_t *msg, size_t msg_len);

258
259
260
crypto_xof_t *crypto_xof_new(void);
void crypto_xof_add_bytes(crypto_xof_t *xof, const uint8_t *data, size_t len);
void crypto_xof_squeeze_bytes(crypto_xof_t *xof, uint8_t *out, size_t len);
261
void crypto_xof_free_(crypto_xof_t *xof);
262
263
#define crypto_xof_free(xof) \
  FREE_AND_NULL(crypto_xof_t, crypto_xof_free_, (xof))
264

265
/* Key negotiation */
266
267
268
#define DH_TYPE_CIRCUIT 1
#define DH_TYPE_REND 2
#define DH_TYPE_TLS 3
269
crypto_dh_t *crypto_dh_new(int dh_type);
270
crypto_dh_t *crypto_dh_dup(const crypto_dh_t *dh);
271
272
273
int crypto_dh_get_bytes(crypto_dh_t *dh);
int crypto_dh_generate_public(crypto_dh_t *dh);
int crypto_dh_get_public(crypto_dh_t *dh, char *pubkey_out,
274
                         size_t pubkey_out_len);
275
ssize_t crypto_dh_compute_secret(int severity, crypto_dh_t *dh,
276
277
                             const char *pubkey, size_t pubkey_len,
                             char *secret_out, size_t secret_out_len);
278
void crypto_dh_free_(crypto_dh_t *dh);
279
#define crypto_dh_free(dh) FREE_AND_NULL(crypto_dh_t, crypto_dh_free_, (dh))
Nick Mathewson's avatar
Nick Mathewson committed
280
281
282
283
284
285
286
287
288

int crypto_expand_key_material_TAP(const uint8_t *key_in,
                                   size_t key_in_len,
                                   uint8_t *key_out, size_t key_out_len);
int crypto_expand_key_material_rfc5869_sha256(
                                    const uint8_t *key_in, size_t key_in_len,
                                    const uint8_t *salt_in, size_t salt_in_len,
                                    const uint8_t *info_in, size_t info_in_len,
                                    uint8_t *key_out, size_t key_out_len);
289

290
/* random numbers */
291
int crypto_seed_rng(void) ATTR_WUR;
292
293
MOCK_DECL(void,crypto_rand,(char *to, size_t n));
void crypto_rand_unmocked(char *to, size_t n);
294
void crypto_strongest_rand(uint8_t *out, size_t out_len);
295
int crypto_rand_int(unsigned int max);
296
int crypto_rand_int_range(unsigned int min, unsigned int max);
Nick Mathewson's avatar
Nick Mathewson committed
297
298
uint64_t crypto_rand_uint64_range(uint64_t min, uint64_t max);
time_t crypto_rand_time_range(time_t min, time_t max);
299
uint64_t crypto_rand_uint64(uint64_t max);
300
double crypto_rand_double(void);
301
302
struct tor_weak_rng_t;
void crypto_seed_weak_rng(struct tor_weak_rng_t *rng);
303
int crypto_init_siphash_key(void);
304

305
306
307
char *crypto_random_hostname(int min_rand_len, int max_rand_len,
                             const char *prefix, const char *suffix);

308
309
struct smartlist_t;
void *smartlist_choose(const struct smartlist_t *sl);
310
void smartlist_shuffle(struct smartlist_t *sl);
311

312
313
314
/** OpenSSL-based utility functions. */
void memwipe(void *mem, uint8_t byte, size_t sz);

315
316
/* Prototypes for private functions only used by tortls.c, crypto.c, and the
 * unit tests. */
317
318
319
struct rsa_st;
struct evp_pkey_st;
struct dh_st;
320
321
struct rsa_st *crypto_pk_get_rsa_(crypto_pk_t *env);
crypto_pk_t *crypto_new_pk_from_rsa_(struct rsa_st *rsa);
Ola Bini's avatar
Ola Bini committed
322
323
MOCK_DECL(struct evp_pkey_st *, crypto_pk_get_evp_pkey_,(crypto_pk_t *env,
                                                         int private));
324
struct dh_st *crypto_dh_get_dh_(crypto_dh_t *dh);
325
326

void crypto_add_spaces_to_fp(char *out, size_t outlen, const char *in);
327

328
#ifdef CRYPTO_PRIVATE
329

330
STATIC int crypto_force_rand_ssleay(void);
331
STATIC int crypto_strongest_rand_raw(uint8_t *out, size_t out_len);
332
333
334
335
336

#ifdef TOR_UNIT_TESTS
extern int break_strongest_rng_syscall;
extern int break_strongest_rng_fallback;
#endif
337
#endif /* defined(CRYPTO_PRIVATE) */
338

339
340
#ifdef TOR_UNIT_TESTS
void crypto_pk_assign_(crypto_pk_t *dest, const crypto_pk_t *src);
341
digest_algorithm_t crypto_digest_get_algorithm(crypto_digest_t *digest);
342
343
#endif

344
#endif /* !defined(TOR_CRYPTO_H) */
Nick Mathewson's avatar
Nick Mathewson committed
345