aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--file.go4
-rw-r--r--gen.go59
-rw-r--r--main.go26
-rw-r--r--main_test.go16
-rw-r--r--orig/lib/bcrypt_pbkdf.369
-rw-r--r--orig/lib/bcrypt_pbkdf.c169
6 files changed, 321 insertions, 22 deletions
diff --git a/file.go b/file.go
index 4f3d449..68737ad 100644
--- a/file.go
+++ b/file.go
@@ -34,6 +34,10 @@ func Parse(r io.Reader) (File, error) {
if !strings.HasPrefix(comment, commentHdr) {
return File{}, errors.New("expected untrusted header")
}
+ // Backward compatibility with original signify
+ if len(comment) > 1024 {
+ return File{}, errors.New("comment line too long")
+ }
comment = comment[len(commentHdr):]
b64, err := buf.ReadBytes('\n')
if err != nil {
diff --git a/gen.go b/gen.go
new file mode 100644
index 0000000..21b90a2
--- /dev/null
+++ b/gen.go
@@ -0,0 +1,59 @@
+package main
+
+import (
+ "crypto/rand"
+ "crypto/sha512"
+ "fmt"
+
+ "golang.org/x/crypto/ed25519"
+)
+
+func Generate(pubkeyfile, seckeyfile, comment string, rounds int) error {
+ pub, sec, err := ed25519.GenerateKey(rand.Reader)
+ if err != nil {
+ return err
+ }
+
+ digest := sha512.Sum512(sec)
+ enckey := new(EncKey)
+ copy(enckey.PKAlg[:], PKAlg[:])
+ copy(enckey.KDFAlg[:], KDFAlg[:])
+ copy(enckey.SecKey[:], sec[:])
+ enckey.KDFRounds = uint32(rounds)
+ // KDF
+ rand.Read(enckey.KeyNum[:])
+ rand.Read(enckey.Salt[:])
+ copy(enckey.Checksum[:], digest[:len(enckey.Checksum)])
+
+ sb64, err := enckey.Marshal()
+ if err != nil {
+ return err
+ }
+
+ sfile := File{
+ Comment: fmt.Sprintf("%s secret key", comment),
+ B64: sb64,
+ }
+ if err := sfile.EncodeFile(seckeyfile); err != nil {
+ return err
+ }
+
+ pubkey := new(PubKey)
+ copy(pubkey.PKAlg[:], PKAlg[:])
+ copy(pubkey.KeyNum[:], enckey.KeyNum[:])
+ copy(pubkey.PubKey[:], pub[:])
+
+ pb64, err := enckey.Marshal()
+ if err != nil {
+ return err
+ }
+ pfile := File{
+ Comment: fmt.Sprintf("%s public key", comment),
+ B64: pb64,
+ }
+ if err := pfile.EncodeFile(pubkeyfile); err != nil {
+ return err
+ }
+
+ return nil
+}
diff --git a/main.go b/main.go
index 7e26857..422eb4f 100644
--- a/main.go
+++ b/main.go
@@ -5,9 +5,6 @@ import (
"encoding/base64"
"flag"
"fmt"
- "os"
-
- "golang.org/x/crypto/ed25519"
)
var (
@@ -16,9 +13,10 @@ var (
)
const (
- verFailed = "signature verfication failed"
- verOK = "Signature Verfied"
- KeyNumLen = 8
+ verFailed = "signature verfication failed"
+ verOK = "Signature Verfied"
+ KeyNumLen = 8
+ DefaultRounds = 42
)
/*
@@ -68,19 +66,3 @@ func main() {
ms, _ := ss.Marshal()
fmt.Println(string(ms))
}
-
-func Generate(pubFile, secFile, comment string, rounds int) error {
- pub, sec, err := ed25519.GenerateKey(rand.Reader)
- if err != nil {
- return err
- }
- b64 := base64.NewEncoder(base64.StdEncoding, os.Stdout)
- fmt.Println("pub", len(pub), pub)
- b64.Write(pub)
- fmt.Println("sec", len(sec), sec)
- b64.Write(sec)
- return nil
-}
-
-func Sign() {}
-func Verify() {}
diff --git a/main_test.go b/main_test.go
new file mode 100644
index 0000000..1ea7dc7
--- /dev/null
+++ b/main_test.go
@@ -0,0 +1,16 @@
+package main
+
+import (
+ "testing"
+
+ "golang.org/x/crypto/bcrypt"
+)
+
+func TestBcrypt(t *testing.T) {
+ pw := "test"
+ ret, err := bcrypt.GenerateFromPassword([]byte(pw), 10)
+ if err != nil {
+ t.Error(err)
+ }
+ t.Log(ret)
+}
diff --git a/orig/lib/bcrypt_pbkdf.3 b/orig/lib/bcrypt_pbkdf.3
new file mode 100644
index 0000000..eb43d43
--- /dev/null
+++ b/orig/lib/bcrypt_pbkdf.3
@@ -0,0 +1,69 @@
+.\" $OpenBSD: bcrypt_pbkdf.3,v 1.6 2014/11/25 03:37:12 tedu Exp $
+.\"
+.\" Copyright (c) 2012 Ted Unangst <tedu@openbsd.org>
+.\"
+.\" Permission to use, copy, modify, and distribute this software for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\"
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+.\"
+.Dd $Mdocdate: November 25 2014 $
+.Dt BCRYPT_PBKDF 3
+.Os
+.Sh NAME
+.Nm bcrypt_pbkdf
+.Nd bcrypt password-based key derivation function
+.Sh SYNOPSIS
+.In util.h
+.Ft int
+.Fn bcrypt_pbkdf "const char *pass" "size_t pass_len" "const uint8_t *salt" \
+ "size_t salt_len" "uint8_t *key" "size_t key_len" "unsigned int rounds"
+.Sh DESCRIPTION
+The
+.Nm
+function converts a password into a byte array suitable for use as
+an encryption key.
+The password and salt values are combined and repeatedly hashed
+.Ar rounds
+times.
+The salt value should be randomly generated beforehand.
+The repeated hashing is designed to thwart discovery of the key via
+password guessing attacks.
+The higher the number of rounds, the slower each attempt will be.
+.\" A minimum value of at least 4 is recommended.
+.Sh RETURN VALUES
+The
+.Fn bcrypt_pbkdf
+function returns 0 to indicate success and \-1 for failure.
+.\" .Sh EXAMPLES
+.\" .Sh ERRORS
+.Sh SEE ALSO
+.Xr bcrypt 3
+.Sh STANDARDS
+.Rs
+.%A Niels Provos and David Mazieres
+.%D June 1999
+.%T A Future-Adaptable Password Scheme
+.Re
+.Pp
+.Rs
+.%A B. Kaliski
+.%D September 2000
+.%R RFC 2898
+.%T PKCS #5: Password-Based Cryptography Specification Version 2.0
+.Re
+.\" .Sh HISTORY
+.\" .Sh AUTHORS
+.Sh CAVEATS
+This implementation deviates slightly from the PBKDF2 standard by mixing
+output key bits nonlinearly.
+By mixing the output bytes together, an attacker is required to perform
+all of the work without taking any shortcuts.
+.\" .Sh BUGS
diff --git a/orig/lib/bcrypt_pbkdf.c b/orig/lib/bcrypt_pbkdf.c
new file mode 100644
index 0000000..cde347c
--- /dev/null
+++ b/orig/lib/bcrypt_pbkdf.c
@@ -0,0 +1,169 @@
+/* $OpenBSD: bcrypt_pbkdf.c,v 1.13 2015/01/12 03:20:04 tedu Exp $ */
+/*
+ * Copyright (c) 2013 Ted Unangst <tedu@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/types.h>
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <blf.h>
+#include <sha2.h>
+#include <string.h>
+#include <util.h>
+
+#define MINIMUM(a,b) (((a) < (b)) ? (a) : (b))
+
+/*
+ * pkcs #5 pbkdf2 implementation using the "bcrypt" hash
+ *
+ * The bcrypt hash function is derived from the bcrypt password hashing
+ * function with the following modifications:
+ * 1. The input password and salt are preprocessed with SHA512.
+ * 2. The output length is expanded to 256 bits.
+ * 3. Subsequently the magic string to be encrypted is lengthened and modifed
+ * to "OxychromaticBlowfishSwatDynamite"
+ * 4. The hash function is defined to perform 64 rounds of initial state
+ * expansion. (More rounds are performed by iterating the hash.)
+ *
+ * Note that this implementation pulls the SHA512 operations into the caller
+ * as a performance optimization.
+ *
+ * One modification from official pbkdf2. Instead of outputting key material
+ * linearly, we mix it. pbkdf2 has a known weakness where if one uses it to
+ * generate (e.g.) 512 bits of key material for use as two 256 bit keys, an
+ * attacker can merely run once through the outer loop, but the user
+ * always runs it twice. Shuffling output bytes requires computing the
+ * entirety of the key material to assemble any subkey. This is something a
+ * wise caller could do; we just do it for you.
+ */
+
+#define BCRYPT_WORDS 8
+#define BCRYPT_HASHSIZE (BCRYPT_WORDS * 4)
+
+static void
+bcrypt_hash(uint8_t *sha2pass, uint8_t *sha2salt, uint8_t *out)
+{
+ blf_ctx state;
+ uint8_t ciphertext[BCRYPT_HASHSIZE] =
+ "OxychromaticBlowfishSwatDynamite";
+ uint32_t cdata[BCRYPT_WORDS];
+ int i;
+ uint16_t j;
+ size_t shalen = SHA512_DIGEST_LENGTH;
+
+ /* key expansion */
+ Blowfish_initstate(&state);
+ Blowfish_expandstate(&state, sha2salt, shalen, sha2pass, shalen);
+ for (i = 0; i < 64; i++) {
+ Blowfish_expand0state(&state, sha2salt, shalen);
+ Blowfish_expand0state(&state, sha2pass, shalen);
+ }
+
+ /* encryption */
+ j = 0;
+ for (i = 0; i < BCRYPT_WORDS; i++)
+ cdata[i] = Blowfish_stream2word(ciphertext, sizeof(ciphertext),
+ &j);
+ for (i = 0; i < 64; i++)
+ blf_enc(&state, cdata, sizeof(cdata) / sizeof(uint64_t));
+
+ /* copy out */
+ for (i = 0; i < BCRYPT_WORDS; i++) {
+ out[4 * i + 3] = (cdata[i] >> 24) & 0xff;
+ out[4 * i + 2] = (cdata[i] >> 16) & 0xff;
+ out[4 * i + 1] = (cdata[i] >> 8) & 0xff;
+ out[4 * i + 0] = cdata[i] & 0xff;
+ }
+
+ /* zap */
+ explicit_bzero(ciphertext, sizeof(ciphertext));
+ explicit_bzero(cdata, sizeof(cdata));
+ explicit_bzero(&state, sizeof(state));
+}
+
+int
+bcrypt_pbkdf(const char *pass, size_t passlen, const uint8_t *salt, size_t saltlen,
+ uint8_t *key, size_t keylen, unsigned int rounds)
+{
+ SHA2_CTX ctx;
+ uint8_t sha2pass[SHA512_DIGEST_LENGTH];
+ uint8_t sha2salt[SHA512_DIGEST_LENGTH];
+ uint8_t out[BCRYPT_HASHSIZE];
+ uint8_t tmpout[BCRYPT_HASHSIZE];
+ uint8_t countsalt[4];
+ size_t i, j, amt, stride;
+ uint32_t count;
+ size_t origkeylen = keylen;
+
+ /* nothing crazy */
+ if (rounds < 1)
+ return -1;
+ if (passlen == 0 || saltlen == 0 || keylen == 0 ||
+ keylen > sizeof(out) * sizeof(out))
+ return -1;
+ stride = (keylen + sizeof(out) - 1) / sizeof(out);
+ amt = (keylen + stride - 1) / stride;
+
+ /* collapse password */
+ SHA512Init(&ctx);
+ SHA512Update(&ctx, pass, passlen);
+ SHA512Final(sha2pass, &ctx);
+
+
+ /* generate key, sizeof(out) at a time */
+ for (count = 1; keylen > 0; count++) {
+ countsalt[0] = (count >> 24) & 0xff;
+ countsalt[1] = (count >> 16) & 0xff;
+ countsalt[2] = (count >> 8) & 0xff;
+ countsalt[3] = count & 0xff;
+
+ /* first round, salt is salt */
+ SHA512Init(&ctx);
+ SHA512Update(&ctx, salt, saltlen);
+ SHA512Update(&ctx, countsalt, sizeof(countsalt));
+ SHA512Final(sha2salt, &ctx);
+ bcrypt_hash(sha2pass, sha2salt, tmpout);
+ memcpy(out, tmpout, sizeof(out));
+
+ for (i = 1; i < rounds; i++) {
+ /* subsequent rounds, salt is previous output */
+ SHA512Init(&ctx);
+ SHA512Update(&ctx, tmpout, sizeof(tmpout));
+ SHA512Final(sha2salt, &ctx);
+ bcrypt_hash(sha2pass, sha2salt, tmpout);
+ for (j = 0; j < sizeof(out); j++)
+ out[j] ^= tmpout[j];
+ }
+
+ /*
+ * pbkdf2 deviation: output the key material non-linearly.
+ */
+ amt = MINIMUM(amt, keylen);
+ for (i = 0; i < amt; i++) {
+ size_t dest = i * stride + (count - 1);
+ if (dest >= origkeylen)
+ break;
+ key[dest] = out[i];
+ }
+ keylen -= i;
+ }
+
+ /* zap */
+ explicit_bzero(&ctx, sizeof(ctx));
+ explicit_bzero(out, sizeof(out));
+
+ return 0;
+}