123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328 |
- /* One way encryption based on the SHA512-based Unix crypt implementation.
- *
- * Written by Ulrich Drepper <drepper at redhat.com> in 2007 [1].
- * Modified by Zack Weinberg <zackw at panix.com> in 2017, 2018.
- * Composed by Björn Esser <besser82 at fedoraproject.org> in 2018.
- * Modified by Björn Esser <besser82 at fedoraproject.org> in 2020.
- * Modified by Steffen Jaeckel <jaeckel-floss at eyet-services.de> in 2020.
- * To the extent possible under law, the named authors have waived all
- * copyright and related or neighboring rights to this work.
- *
- * See https://creativecommons.org/publicdomain/zero/1.0/ for further
- * details.
- *
- * This file is a modified except from [2], lines 1403 up to 1676.
- *
- * [1] https://www.akkadia.org/drepper/sha-crypt.html
- * [2] https://www.akkadia.org/drepper/SHA-crypt.txt
- */
- #include "crypt-port.h"
- #include "alg-sha512.h"
- #include <errno.h>
- #include <stdio.h>
- #include <stdlib.h>
- #if INCLUDE_sha512crypt
- /* Define our magic string to mark salt for SHA512 "encryption"
- replacement. */
- static const char sha512_salt_prefix[] = "$6$";
- /* Prefix for optional rounds specification. */
- static const char sha512_rounds_prefix[] = "rounds=";
- /* Maximum salt string length. */
- #define SALT_LEN_MAX 16
- /* Default number of rounds if not explicitly specified. */
- #define ROUNDS_DEFAULT 5000
- /* Minimum number of rounds. */
- #define ROUNDS_MIN 1000
- /* Maximum number of rounds. */
- #define ROUNDS_MAX 999999999
- /* The maximum possible length of a SHA512-hashed password string,
- including the terminating NUL character. Prefix (including its NUL)
- + rounds tag ("rounds=$" = "rounds=\0") + strlen(ROUNDS_MAX)
- + salt (up to SALT_LEN_MAX chars) + '$' + hash (86 chars). */
- #define LENGTH_OF_NUMBER(n) (sizeof #n - 1)
- #define SHA512_HASH_LENGTH \
- (sizeof (sha512_salt_prefix) + sizeof (sha512_rounds_prefix) + \
- LENGTH_OF_NUMBER (ROUNDS_MAX) + SALT_LEN_MAX + 1 + 86)
- static_assert (SHA512_HASH_LENGTH <= CRYPT_OUTPUT_SIZE,
- "CRYPT_OUTPUT_SIZE is too small for SHA512");
- /* A sha512_buffer holds all of the sensitive intermediate data. */
- struct sha512_buffer
- {
- SHA512_CTX ctx;
- uint8_t result[64];
- uint8_t p_bytes[64];
- uint8_t s_bytes[64];
- };
- static_assert (sizeof (struct sha512_buffer) <= ALG_SPECIFIC_SIZE,
- "ALG_SPECIFIC_SIZE is too small for SHA512");
- /* Subroutine of _xcrypt_crypt_sha512crypt_rn: Feed CTX with LEN bytes of a
- virtual byte sequence consisting of BLOCK repeated over and over
- indefinitely. */
- static void
- sha512_process_recycled_bytes (unsigned char block[64], size_t len,
- SHA512_CTX *ctx)
- {
- size_t cnt;
- for (cnt = len; cnt >= 64; cnt -= 64)
- SHA512_Update (ctx, block, 64);
- SHA512_Update (ctx, block, cnt);
- }
- void
- crypt_sha512crypt_rn (const char *phrase, size_t phr_size,
- const char *setting, size_t ARG_UNUSED (set_size),
- uint8_t *output, size_t out_size,
- void *scratch, size_t scr_size)
- {
- /* This shouldn't ever happen, but... */
- if (out_size < SHA512_HASH_LENGTH
- || scr_size < sizeof (struct sha512_buffer))
- {
- errno = ERANGE;
- return;
- }
- struct sha512_buffer *buf = scratch;
- SHA512_CTX *ctx = &buf->ctx;
- uint8_t *result = buf->result;
- uint8_t *p_bytes = buf->p_bytes;
- uint8_t *s_bytes = buf->s_bytes;
- char *cp = (char *)output;
- const char *salt = setting;
- size_t salt_size;
- size_t cnt;
- /* Default number of rounds. */
- size_t rounds = ROUNDS_DEFAULT;
- bool rounds_custom = false;
- /* Find beginning of salt string. The prefix should normally always
- be present. Just in case it is not. */
- if (strncmp (sha512_salt_prefix, salt, sizeof (sha512_salt_prefix) - 1) == 0)
- /* Skip salt prefix. */
- salt += sizeof (sha512_salt_prefix) - 1;
- if (strncmp (salt, sha512_rounds_prefix, sizeof (sha512_rounds_prefix) - 1)
- == 0)
- {
- const char *num = salt + sizeof (sha512_rounds_prefix) - 1;
- /* Do not allow an explicit setting of zero rounds, nor of the
- default number of rounds, nor leading zeroes on the rounds. */
- if (!(*num >= '1' && *num <= '9'))
- {
- errno = EINVAL;
- return;
- }
- errno = 0;
- char *endp;
- rounds = strtoul (num, &endp, 10);
- if (endp == num || *endp != '$'
- || rounds < ROUNDS_MIN
- || rounds > ROUNDS_MAX
- || errno)
- {
- errno = EINVAL;
- return;
- }
- salt = endp + 1;
- rounds_custom = true;
- }
- /* The salt ends at the next '$' or the end of the string.
- Ensure ':' does not appear in the salt (it is used as a separator in /etc/passwd).
- Also check for '\n', as in /etc/passwd the whole parameters of the user data must
- be on a single line. */
- salt_size = strcspn (salt, "$:\n");
- if (!(salt[salt_size] == '$' || !salt[salt_size]))
- {
- errno = EINVAL;
- return;
- }
- /* Ensure we do not use more salt than SALT_LEN_MAX. */
- if (salt_size > SALT_LEN_MAX)
- salt_size = SALT_LEN_MAX;
- /* Compute alternate SHA512 sum with input PHRASE, SALT, and PHRASE. The
- final result will be added to the first context. */
- SHA512_Init (ctx);
- /* Add phrase. */
- SHA512_Update (ctx, phrase, phr_size);
- /* Add salt. */
- SHA512_Update (ctx, salt, salt_size);
- /* Add phrase again. */
- SHA512_Update (ctx, phrase, phr_size);
- /* Now get result of this (64 bytes) and add it to the other
- context. */
- SHA512_Final (result, ctx);
- /* Prepare for the real work. */
- SHA512_Init (ctx);
- /* Add the phrase string. */
- SHA512_Update (ctx, phrase, phr_size);
- /* The last part is the salt string. This must be at most 8
- characters and it ends at the first `$' character (for
- compatibility with existing implementations). */
- SHA512_Update (ctx, salt, salt_size);
- /* Add for any character in the phrase one byte of the alternate sum. */
- for (cnt = phr_size; cnt > 64; cnt -= 64)
- SHA512_Update (ctx, result, 64);
- SHA512_Update (ctx, result, cnt);
- /* Take the binary representation of the length of the phrase and for every
- 1 add the alternate sum, for every 0 the phrase. */
- for (cnt = phr_size; cnt > 0; cnt >>= 1)
- if ((cnt & 1) != 0)
- SHA512_Update (ctx, result, 64);
- else
- SHA512_Update (ctx, phrase, phr_size);
- /* Create intermediate result. */
- SHA512_Final (result, ctx);
- /* Start computation of P byte sequence. */
- SHA512_Init (ctx);
- /* For every character in the password add the entire password. */
- for (cnt = 0; cnt < phr_size; ++cnt)
- SHA512_Update (ctx, phrase, phr_size);
- /* Finish the digest. */
- SHA512_Final (p_bytes, ctx);
- /* Start computation of S byte sequence. */
- SHA512_Init (ctx);
- /* For every character in the password add the entire password. */
- for (cnt = 0; cnt < (size_t) 16 + (size_t) result[0]; ++cnt)
- SHA512_Update (ctx, salt, salt_size);
- /* Finish the digest. */
- SHA512_Final (s_bytes, ctx);
- /* Repeatedly run the collected hash value through SHA512 to burn
- CPU cycles. */
- for (cnt = 0; cnt < rounds; ++cnt)
- {
- /* New context. */
- SHA512_Init (ctx);
- /* Add phrase or last result. */
- if ((cnt & 1) != 0)
- sha512_process_recycled_bytes (p_bytes, phr_size, ctx);
- else
- SHA512_Update (ctx, result, 64);
- /* Add salt for numbers not divisible by 3. */
- if (cnt % 3 != 0)
- sha512_process_recycled_bytes (s_bytes, salt_size, ctx);
- /* Add phrase for numbers not divisible by 7. */
- if (cnt % 7 != 0)
- sha512_process_recycled_bytes (p_bytes, phr_size, ctx);
- /* Add phrase or last result. */
- if ((cnt & 1) != 0)
- SHA512_Update (ctx, result, 64);
- else
- sha512_process_recycled_bytes (p_bytes, phr_size, ctx);
- /* Create intermediate result. */
- SHA512_Final (result, ctx);
- }
- /* Now we can construct the result string. It consists of four
- parts, one of which is optional. We already know that buflen is
- at least sha512_hash_length, therefore none of the string bashing
- below can overflow the buffer. */
- memcpy (cp, sha512_salt_prefix, sizeof (sha512_salt_prefix) - 1);
- cp += sizeof (sha512_salt_prefix) - 1;
- if (rounds_custom)
- {
- int n = snprintf (cp,
- SHA512_HASH_LENGTH - (sizeof (sha512_salt_prefix) - 1),
- "%s%zu$", sha512_rounds_prefix, rounds);
- cp += n;
- }
- memcpy (cp, salt, salt_size);
- cp += salt_size;
- *cp++ = '$';
- #define b64_from_24bit(B2, B1, B0, N) \
- do { \
- unsigned int w = ((((unsigned int)(B2)) << 16) | \
- (((unsigned int)(B1)) << 8) | \
- ((unsigned int)(B0))); \
- int n = (N); \
- while (n-- > 0) \
- { \
- *cp++ = b64t[w & 0x3f]; \
- w >>= 6; \
- } \
- } while (0)
- b64_from_24bit (result[0], result[21], result[42], 4);
- b64_from_24bit (result[22], result[43], result[1], 4);
- b64_from_24bit (result[44], result[2], result[23], 4);
- b64_from_24bit (result[3], result[24], result[45], 4);
- b64_from_24bit (result[25], result[46], result[4], 4);
- b64_from_24bit (result[47], result[5], result[26], 4);
- b64_from_24bit (result[6], result[27], result[48], 4);
- b64_from_24bit (result[28], result[49], result[7], 4);
- b64_from_24bit (result[50], result[8], result[29], 4);
- b64_from_24bit (result[9], result[30], result[51], 4);
- b64_from_24bit (result[31], result[52], result[10], 4);
- b64_from_24bit (result[53], result[11], result[32], 4);
- b64_from_24bit (result[12], result[33], result[54], 4);
- b64_from_24bit (result[34], result[55], result[13], 4);
- b64_from_24bit (result[56], result[14], result[35], 4);
- b64_from_24bit (result[15], result[36], result[57], 4);
- b64_from_24bit (result[37], result[58], result[16], 4);
- b64_from_24bit (result[59], result[17], result[38], 4);
- b64_from_24bit (result[18], result[39], result[60], 4);
- b64_from_24bit (result[40], result[61], result[19], 4);
- b64_from_24bit (result[62], result[20], result[41], 4);
- b64_from_24bit (0, 0, result[63], 2);
- *cp = '\0';
- }
- #ifndef NO_GENSALT
- void
- gensalt_sha512crypt_rn (unsigned long count,
- const uint8_t *rbytes, size_t nrbytes,
- uint8_t *output, size_t output_size)
- {
- gensalt_sha_rn ('6', SALT_LEN_MAX, ROUNDS_DEFAULT, ROUNDS_MIN, ROUNDS_MAX,
- count, rbytes, nrbytes, output, output_size);
- }
- #endif
- #endif
|