/src/libssh/src/kdf.c

Source
/*
 * This file is part of the SSH Library
 *
 * Copyright (c) 2009 by Aris Adamantiadis
 * Copyrihgt (c) 2018 Red Hat, Inc.
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

#include "config.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <limits.h>

#include "libssh/priv.h"
#include "libssh/crypto.h"
#include "libssh/buffer.h"
#include "libssh/session.h"
#include "libssh/misc.h"
#include "libssh/dh.h"
#include "libssh/ssh2.h"
#include "libssh/pki.h"
#include "libssh/bignum.h"

#include "libssh/string.h"


/* The following implements the SSHKDF for crypto backend that
 * do not have a native implementation */
struct ssh_mac_ctx_struct {
    enum ssh_kdf_digest digest_type;
    union {
        SHACTX sha1_ctx;
        SHA256CTX sha256_ctx;
        SHA384CTX sha384_ctx;
        SHA512CTX sha512_ctx;
    } ctx;
};

static ssh_mac_ctx ssh_mac_ctx_init(enum ssh_kdf_digest type)
{
    ssh_mac_ctx ctx = malloc(sizeof(struct ssh_mac_ctx_struct));
    if (ctx == NULL) {
        return NULL;
    }

    ctx->digest_type = type;
    switch (type) {
    case SSH_KDF_SHA1:
        ctx->ctx.sha1_ctx = sha1_init();
        if (ctx->ctx.sha1_ctx == NULL) {
            goto err;
        }
        return ctx;
    case SSH_KDF_SHA256:
        ctx->ctx.sha256_ctx = sha256_init();
        if (ctx->ctx.sha256_ctx == NULL) {
            goto err;
        }
        return ctx;
    case SSH_KDF_SHA384:
        ctx->ctx.sha384_ctx = sha384_init();
        if (ctx->ctx.sha384_ctx == NULL) {
            goto err;
        }
        return ctx;
    case SSH_KDF_SHA512:
        ctx->ctx.sha512_ctx = sha512_init();
        if (ctx->ctx.sha512_ctx == NULL) {
            goto err;
        }
        return ctx;
    }
err:
    SAFE_FREE(ctx);
    return NULL;
}

static void ssh_mac_ctx_free(ssh_mac_ctx ctx)
{
    if (ctx == NULL) {
        return;
    }

    switch (ctx->digest_type) {
    case SSH_KDF_SHA1:
        sha1_ctx_free(ctx->ctx.sha1_ctx);
        break;
    case SSH_KDF_SHA256:
        sha256_ctx_free(ctx->ctx.sha256_ctx);
        break;
    case SSH_KDF_SHA384:
        sha384_ctx_free(ctx->ctx.sha384_ctx);
        break;
    case SSH_KDF_SHA512:
        sha512_ctx_free(ctx->ctx.sha512_ctx);
        break;
    }
    SAFE_FREE(ctx);
}

static int ssh_mac_update(ssh_mac_ctx ctx, const void *data, size_t len)
{
    switch (ctx->digest_type) {
    case SSH_KDF_SHA1:
        return sha1_update(ctx->ctx.sha1_ctx, data, len);
    case SSH_KDF_SHA256:
        return sha256_update(ctx->ctx.sha256_ctx, data, len);
    case SSH_KDF_SHA384:
        return sha384_update(ctx->ctx.sha384_ctx, data, len);
    case SSH_KDF_SHA512:
        return sha512_update(ctx->ctx.sha512_ctx, data, len);
    }
    return SSH_ERROR;
}

static int ssh_mac_final(unsigned char *md, ssh_mac_ctx ctx)
{
    int rc = SSH_ERROR;

    switch (ctx->digest_type) {
    case SSH_KDF_SHA1:
        rc = sha1_final(md, ctx->ctx.sha1_ctx);
        break;
    case SSH_KDF_SHA256:
        rc = sha256_final(md, ctx->ctx.sha256_ctx);
        break;
    case SSH_KDF_SHA384:
        rc = sha384_final(md, ctx->ctx.sha384_ctx);
        break;
    case SSH_KDF_SHA512:
        rc = sha512_final(md, ctx->ctx.sha512_ctx);
        break;
    }
    SAFE_FREE(ctx);
    return rc;
}

int sshkdf_derive_key(struct ssh_crypto_struct *crypto,
                      unsigned char *key,
                      size_t key_len,
                      uint8_t key_type,
                      unsigned char *output,
                      size_t requested_len)
{
    /* Can't use VLAs with Visual Studio, so allocate the biggest
     * digest buffer we can possibly need */
    unsigned char digest[DIGEST_MAX_LEN];
    size_t output_len = crypto->digest_len;
    ssh_mac_ctx ctx;
    int rc;

    if (DIGEST_MAX_LEN < crypto->digest_len) {
        return -1;
    }

    ctx = ssh_mac_ctx_init(crypto->digest_type);
    if (ctx == NULL) {
        return -1;
    }

    rc = ssh_mac_update(ctx, key, key_len);
    if (rc != SSH_OK) {
        ssh_mac_ctx_free(ctx);
        return -1;
    }
    rc = ssh_mac_update(ctx, crypto->secret_hash, crypto->digest_len);
    if (rc != SSH_OK) {
        ssh_mac_ctx_free(ctx);
        return -1;
    }
    rc = ssh_mac_update(ctx, &key_type, 1);
    if (rc != SSH_OK) {
        ssh_mac_ctx_free(ctx);
        return -1;
    }
    rc = ssh_mac_update(ctx, crypto->session_id, crypto->session_id_len);
    if (rc != SSH_OK) {
        ssh_mac_ctx_free(ctx);
        return -1;
    }
    rc = ssh_mac_final(digest, ctx);
    if (rc != SSH_OK) {
        return -1;
    }

    if (requested_len < output_len) {
        output_len = requested_len;
    }
    memcpy(output, digest, output_len);

    while (requested_len > output_len) {
        ctx = ssh_mac_ctx_init(crypto->digest_type);
        if (ctx == NULL) {
            return -1;
        }
        rc = ssh_mac_update(ctx, key, key_len);
        if (rc != SSH_OK) {
            ssh_mac_ctx_free(ctx);
            return -1;
        }
        rc = ssh_mac_update(ctx, crypto->secret_hash, crypto->digest_len);
        if (rc != SSH_OK) {
            ssh_mac_ctx_free(ctx);
            return -1;
        }
        rc = ssh_mac_update(ctx, output, output_len);
        if (rc != SSH_OK) {
            ssh_mac_ctx_free(ctx);
            return -1;
        }
        rc = ssh_mac_final(digest, ctx);
        if (rc != SSH_OK) {
            return -1;
        }
        if (requested_len < output_len + crypto->digest_len) {
            memcpy(output + output_len, digest, requested_len - output_len);
        } else {
            memcpy(output + output_len, digest, crypto->digest_len);
        }
        output_len += crypto->digest_len;
    }

    return 0;
}

Coverage Report

Created: 2026-03-24 06:51

Line	Count	Source
1		/*
2		* This file is part of the SSH Library
3		*
4		* Copyright (c) 2009 by Aris Adamantiadis
5		* Copyrihgt (c) 2018 Red Hat, Inc.
6		*
7		* This library is free software; you can redistribute it and/or
8		* modify it under the terms of the GNU Lesser General Public
9		* License as published by the Free Software Foundation; either
10		* version 2.1 of the License, or (at your option) any later version.
11		*
12		* This library is distributed in the hope that it will be useful,
13		* but WITHOUT ANY WARRANTY; without even the implied warranty of
14		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15		* Lesser General Public License for more details.
16		*
17		* You should have received a copy of the GNU Lesser General Public
18		* License along with this library; if not, write to the Free Software
19		* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20		*/
21
22		#include "config.h"
23		#include <stdio.h>
24		#include <stdlib.h>
25		#include <string.h>
26		#include <limits.h>
27
28		#include "libssh/priv.h"
29		#include "libssh/crypto.h"
30		#include "libssh/buffer.h"
31		#include "libssh/session.h"
32		#include "libssh/misc.h"
33		#include "libssh/dh.h"
34		#include "libssh/ssh2.h"
35		#include "libssh/pki.h"
36		#include "libssh/bignum.h"
37
38		#include "libssh/string.h"
39
40
41		/* The following implements the SSHKDF for crypto backend that
42		* do not have a native implementation */
43		struct ssh_mac_ctx_struct {
44		enum ssh_kdf_digest digest_type;
45		union {
46		SHACTX sha1_ctx;
47		SHA256CTX sha256_ctx;
48		SHA384CTX sha384_ctx;
49		SHA512CTX sha512_ctx;
50		} ctx;
51		};
52
53		static ssh_mac_ctx ssh_mac_ctx_init(enum ssh_kdf_digest type)
54	0	{
55	0	ssh_mac_ctx ctx = malloc(sizeof(struct ssh_mac_ctx_struct));
56	0	if (ctx == NULL) {
57	0	return NULL;
58	0	}
59
60	0	ctx->digest_type = type;
61	0	switch (type) {
62	0	case SSH_KDF_SHA1:
63	0	ctx->ctx.sha1_ctx = sha1_init();
64	0	if (ctx->ctx.sha1_ctx == NULL) {
65	0	goto err;
66	0	}
67	0	return ctx;
68	0	case SSH_KDF_SHA256:
69	0	ctx->ctx.sha256_ctx = sha256_init();
70	0	if (ctx->ctx.sha256_ctx == NULL) {
71	0	goto err;
72	0	}
73	0	return ctx;
74	0	case SSH_KDF_SHA384:
75	0	ctx->ctx.sha384_ctx = sha384_init();
76	0	if (ctx->ctx.sha384_ctx == NULL) {
77	0	goto err;
78	0	}
79	0	return ctx;
80	0	case SSH_KDF_SHA512:
81	0	ctx->ctx.sha512_ctx = sha512_init();
82	0	if (ctx->ctx.sha512_ctx == NULL) {
83	0	goto err;
84	0	}
85	0	return ctx;
86	0	}
87	0	err:
88	0	SAFE_FREE(ctx);
89	0	return NULL;
90	0	}
91
92		static void ssh_mac_ctx_free(ssh_mac_ctx ctx)
93	0	{
94	0	if (ctx == NULL) {
95	0	return;
96	0	}
97
98	0	switch (ctx->digest_type) {
99	0	case SSH_KDF_SHA1:
100	0	sha1_ctx_free(ctx->ctx.sha1_ctx);
101	0	break;
102	0	case SSH_KDF_SHA256:
103	0	sha256_ctx_free(ctx->ctx.sha256_ctx);
104	0	break;
105	0	case SSH_KDF_SHA384:
106	0	sha384_ctx_free(ctx->ctx.sha384_ctx);
107	0	break;
108	0	case SSH_KDF_SHA512:
109	0	sha512_ctx_free(ctx->ctx.sha512_ctx);
110	0	break;
111	0	}
112	0	SAFE_FREE(ctx);
113	0	}
114
115		static int ssh_mac_update(ssh_mac_ctx ctx, const void *data, size_t len)
116	0	{
117	0	switch (ctx->digest_type) {
118	0	case SSH_KDF_SHA1:
119	0	return sha1_update(ctx->ctx.sha1_ctx, data, len);
120	0	case SSH_KDF_SHA256:
121	0	return sha256_update(ctx->ctx.sha256_ctx, data, len);
122	0	case SSH_KDF_SHA384:
123	0	return sha384_update(ctx->ctx.sha384_ctx, data, len);
124	0	case SSH_KDF_SHA512:
125	0	return sha512_update(ctx->ctx.sha512_ctx, data, len);
126	0	}
127	0	return SSH_ERROR;
128	0	}
129
130		static int ssh_mac_final(unsigned char *md, ssh_mac_ctx ctx)
131	0	{
132	0	int rc = SSH_ERROR;
133
134	0	switch (ctx->digest_type) {
135	0	case SSH_KDF_SHA1:
136	0	rc = sha1_final(md, ctx->ctx.sha1_ctx);
137	0	break;
138	0	case SSH_KDF_SHA256:
139	0	rc = sha256_final(md, ctx->ctx.sha256_ctx);
140	0	break;
141	0	case SSH_KDF_SHA384:
142	0	rc = sha384_final(md, ctx->ctx.sha384_ctx);
143	0	break;
144	0	case SSH_KDF_SHA512:
145	0	rc = sha512_final(md, ctx->ctx.sha512_ctx);
146	0	break;
147	0	}
148	0	SAFE_FREE(ctx);
149	0	return rc;
150	0	}
151
152		int sshkdf_derive_key(struct ssh_crypto_struct *crypto,
153		unsigned char *key,
154		size_t key_len,
155		uint8_t key_type,
156		unsigned char *output,
157		size_t requested_len)
158	0	{
159		/* Can't use VLAs with Visual Studio, so allocate the biggest
160		* digest buffer we can possibly need */
161	0	unsigned char digest[DIGEST_MAX_LEN];
162	0	size_t output_len = crypto->digest_len;
163	0	ssh_mac_ctx ctx;
164	0	int rc;
165
166	0	if (DIGEST_MAX_LEN < crypto->digest_len) {
167	0	return -1;
168	0	}
169
170	0	ctx = ssh_mac_ctx_init(crypto->digest_type);
171	0	if (ctx == NULL) {
172	0	return -1;
173	0	}
174
175	0	rc = ssh_mac_update(ctx, key, key_len);
176	0	if (rc != SSH_OK) {
177	0	ssh_mac_ctx_free(ctx);
178	0	return -1;
179	0	}
180	0	rc = ssh_mac_update(ctx, crypto->secret_hash, crypto->digest_len);
181	0	if (rc != SSH_OK) {
182	0	ssh_mac_ctx_free(ctx);
183	0	return -1;
184	0	}
185	0	rc = ssh_mac_update(ctx, &key_type, 1);
186	0	if (rc != SSH_OK) {
187	0	ssh_mac_ctx_free(ctx);
188	0	return -1;
189	0	}
190	0	rc = ssh_mac_update(ctx, crypto->session_id, crypto->session_id_len);
191	0	if (rc != SSH_OK) {
192	0	ssh_mac_ctx_free(ctx);
193	0	return -1;
194	0	}
195	0	rc = ssh_mac_final(digest, ctx);
196	0	if (rc != SSH_OK) {
197	0	return -1;
198	0	}
199
200	0	if (requested_len < output_len) {
201	0	output_len = requested_len;
202	0	}
203	0	memcpy(output, digest, output_len);
204
205	0	while (requested_len > output_len) {
206	0	ctx = ssh_mac_ctx_init(crypto->digest_type);
207	0	if (ctx == NULL) {
208	0	return -1;
209	0	}
210	0	rc = ssh_mac_update(ctx, key, key_len);
211	0	if (rc != SSH_OK) {
212	0	ssh_mac_ctx_free(ctx);
213	0	return -1;
214	0	}
215	0	rc = ssh_mac_update(ctx, crypto->secret_hash, crypto->digest_len);
216	0	if (rc != SSH_OK) {
217	0	ssh_mac_ctx_free(ctx);
218	0	return -1;
219	0	}
220	0	rc = ssh_mac_update(ctx, output, output_len);
221	0	if (rc != SSH_OK) {
222	0	ssh_mac_ctx_free(ctx);
223	0	return -1;
224	0	}
225	0	rc = ssh_mac_final(digest, ctx);
226	0	if (rc != SSH_OK) {
227	0	return -1;
228	0	}
229	0	if (requested_len < output_len + crypto->digest_len) {
230	0	memcpy(output + output_len, digest, requested_len - output_len);
231	0	} else {
232	0	memcpy(output + output_len, digest, crypto->digest_len);
233	0	}
234	0	output_len += crypto->digest_len;
235	0	}
236
237	0	return 0;
238	0	}