cryptohome/libscrypt_compat.cc - mirrors/cros/chromiumos/platform2 - Git at Google

 // Copyright 2020 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

 #include "cryptohome/libscrypt_compat.h"

 #include <openssl/aes.h>
 #include <openssl/evp.h>

 #include <base/bits.h>
 #include <base/sys_byteorder.h>
 #include <brillo/secure_blob.h>
 #include <crypto/scoped_openssl_types.h>

 #include "cryptohome/cryptolib.h"

 namespace cryptohome {

 // Callers of this library need to allocate the salt and key, so the sizes are
 // exposed.
 constexpr size_t kLibScryptSaltSize = 32;

 constexpr size_t kLibScryptDerivedKeySize = 64;

 namespace {

 constexpr size_t kLibScryptHeaderSize = 96;

 constexpr size_t kLibScryptSubHeaderSize = 48;

 constexpr size_t kLibScryptHeaderBytesToHMAC = 64;

 constexpr char kLibScryptHeaderMagic[] = "scrypt";

 // Bytes 33-64 of the derived key are used for the HMAC key.
 constexpr size_t kLibScryptHMACKeyOffset = 32;

 constexpr size_t kLibScryptHMACSize = 32;

 constexpr size_t kLibScryptIVSize = 16;

 // libscrypt places data into a uint8_t[96] array in C style. This lays it out
 // as a more readable struct, but it must be tightly packed to be compatible
 // with the array.
 #pragma pack(push, 1)
 struct LibScryptHeader {
   // This is always "scrypt".
   char magic[6];
   // This is set to 0.
   uint8_t header_reserved_byte;
   // The log base 2 of the N-factor (i.e. 10 for 1024).
   uint8_t log_n;
   // The r and p params used to generate this key.
   uint32_t r_factor;
   uint32_t p_factor;
   // A salt which is unique to each encryption. Note that this is a bit odd and
   // in new scrypt code it's better to use a unique *nonce* in the AES
   // encryption.
   uint8_t salt[32];
   // This is a checksum of the first 48 bytes of the header (all fields up to
   // and including the salt).
   uint8_t check_sum[16];
   // This is an HMAC over the first 64 bytes of the header (all fields up to and
   // including the check_sum). Why there is a check_sum and an HMAC is
   // confusing, since they cover the same data. But the key given to the HMAC is
   // the last 32 bytes of the |derived_key|, and so it verifies that the
   // password is the proper passsord for this encrypted blob.
   uint8_t signature[kLibScryptHMACSize];
 };
 #pragma pack(pop)

 static_assert(sizeof(LibScryptHeader) == kLibScryptHeaderSize,
               "LibScryptHeader struct is packed wrong and will not be byte "
               "compatible with existing data");

 // This generates the header which is specific to libscrypt. It's inserted at
 // the beginning |output|.
 void GenerateHeader(const brillo::SecureBlob& salt,
                     const brillo::SecureBlob& derived_key,
                     const ScryptParameters& params,
                     LibScryptHeader* header_struct) {
   DCHECK_EQ(kLibScryptSaltSize, salt.size());

   *header_struct = {
       {'s', 'c', 'r', 'y', 'p', 't'},
       0,
       static_cast<uint8_t>(base::bits::Log2Ceiling(params.n_factor)),
       base::ByteSwap(params.r_factor),
       base::ByteSwap(params.p_factor)};

   memcpy(&header_struct->salt, salt.data(), sizeof(header_struct->salt));

   // Add the header check sum.
   uint8_t* header_ptr = reinterpret_cast<uint8_t*>(header_struct);
   brillo::Blob header_blob_to_hash(header_ptr,
                                    header_ptr + kLibScryptSubHeaderSize);
   brillo::Blob sha = CryptoLib::Sha256(header_blob_to_hash);
   memcpy(&header_struct->check_sum[0], sha.data(),
          sizeof(header_struct->check_sum));

   // Add the header signature (used for verifying the passsword).
   brillo::SecureBlob key_hmac(derived_key.begin() + kLibScryptHMACKeyOffset,
                               derived_key.end());
   brillo::Blob data_to_hmac(header_ptr,
                             header_ptr + kLibScryptHeaderBytesToHMAC);
   brillo::SecureBlob hmac = CryptoLib::HmacSha256(key_hmac, data_to_hmac);
   memcpy(&header_struct->signature[0], hmac.data(),
          sizeof(header_struct->signature));
 }

 bool VerifyDerivedKey(const brillo::SecureBlob& encrypted_blob,
                       const brillo::SecureBlob& derived_key) {
   const LibScryptHeader* header =
       reinterpret_cast<const LibScryptHeader*>(encrypted_blob.data());
   const uint8_t* header_ptr = reinterpret_cast<const uint8_t*>(header);

   // Verify the password.
   brillo::SecureBlob key_hmac(derived_key.begin() + kLibScryptHMACKeyOffset,
                               derived_key.end());
   brillo::Blob data_to_hmac(header_ptr,
                             header_ptr + kLibScryptHeaderBytesToHMAC);
   brillo::SecureBlob hmac = CryptoLib::HmacSha256(key_hmac, data_to_hmac);
   if (brillo::SecureMemcmp(header->signature, hmac.data(),
                            kLibScryptHMACSize) != 0) {
     LOG(ERROR) << "hmac verification failed.";
     return false;
   }

   return true;
 }

 }  // namespace

 // static
 bool LibScryptCompat::Encrypt(const brillo::SecureBlob& derived_key,
                               const brillo::SecureBlob& salt,
                               const brillo::SecureBlob& data_to_encrypt,
                               const ScryptParameters& params,
                               brillo::SecureBlob* encrypted_data) {
   encrypted_data->resize(data_to_encrypt.size() + kLibScryptHeaderSize +
                          kLibScryptHMACSize);

   LibScryptHeader header_struct;
   GenerateHeader(salt, derived_key, params, &header_struct);
   memcpy(encrypted_data->data(), &header_struct, sizeof(header_struct));

   brillo::SecureBlob aes_key(derived_key.begin(),
                              derived_key.end() - kLibScryptHMACKeyOffset);
   // libscrypt uses a 0 IV for every message. This is safe _ONLY_ because
   // libscrypt mixes the passphrase with a new salt, generating a new derived
   // key, FOR EACH ENCRYPTION. DO NOT CALL THIS ENCRYPTION method multiple times
   // with the same key, it is only safe under this limited circumstances.
   brillo::SecureBlob iv(kLibScryptIVSize, 0);
   brillo::SecureBlob aes_ciphertext;

   if (!CryptoLib::AesEncryptSpecifyBlockMode(
           data_to_encrypt, 0, data_to_encrypt.size(), aes_key, iv,
           CryptoLib::kPaddingStandard, CryptoLib::kCtr, &aes_ciphertext)) {
     LOG(ERROR) << "AesEncryptSpecifyBlockMode failed.";
     return false;
   }
   memcpy(encrypted_data->data() + sizeof(header_struct), aes_ciphertext.data(),
          aes_ciphertext.size());

   brillo::SecureBlob key_hmac(derived_key.begin() + kLibScryptHMACKeyOffset,
                               derived_key.end());
   brillo::Blob data_to_hmac(
       encrypted_data->begin(),
       encrypted_data->begin() + aes_ciphertext.size() + kLibScryptHeaderSize);
   brillo::SecureBlob hmac = CryptoLib::HmacSha256(key_hmac, data_to_hmac);

   memcpy(encrypted_data->data() + sizeof(header_struct) + aes_ciphertext.size(),
          hmac.data(), kLibScryptHMACSize);

   return true;
 }

 // static
 bool LibScryptCompat::ParseHeader(const brillo::SecureBlob& encrypted_blob,
                                   ScryptParameters* out_params,
                                   brillo::SecureBlob* salt) {
   if (encrypted_blob.size() < kLibScryptHeaderSize + kLibScryptHMACSize) {
     LOG(ERROR) << "Incomplete header present.";
     return false;
   }

   const LibScryptHeader* header =
       reinterpret_cast<const LibScryptHeader*>(encrypted_blob.data());
   if (brillo::SecureMemcmp(header->magic, kLibScryptHeaderMagic,
                            strlen(kLibScryptHeaderMagic)) != 0) {
     LOG(ERROR) << "wrong header text present";
     return false;
   }

   if (header->header_reserved_byte != 0) {
     LOG(ERROR) << "Wrong reserved byte present";
     return false;
   }

   // Verify the header checksum before returning any information.
   const uint8_t* header_ptr = reinterpret_cast<const uint8_t*>(header);
   brillo::Blob header_blob_to_hash(header_ptr,
                                    header_ptr + kLibScryptSubHeaderSize);
   brillo::Blob sha = CryptoLib::Sha256(header_blob_to_hash);
   if (brillo::SecureMemcmp(sha.data(), header->check_sum,
                            sizeof(header->check_sum)) != 0) {
     LOG(ERROR) << "Wrong checksum present.";
     return false;
   }

   // Now parse the parameters.
   if (header->log_n < 1 || header->log_n > 63) {
     LOG(ERROR) << "Invalid logN present in header.";
     return false;
   }

   out_params->n_factor = static_cast<uint64_t>(1) << header->log_n;
   out_params->r_factor = base::ByteSwap(header->r_factor);
   out_params->p_factor = base::ByteSwap(header->p_factor);
   salt->assign(header->salt, header->salt + kLibScryptSaltSize);

   return true;
 }

 // static
 bool LibScryptCompat::Decrypt(const brillo::SecureBlob& encrypted_data,
                               const brillo::SecureBlob& derived_key,
                               brillo::SecureBlob* decrypted_data) {
   if (!VerifyDerivedKey(encrypted_data, derived_key))
     return false;

   // lib scrypt appends an HMAC.
   brillo::SecureBlob key_hmac(derived_key.begin() + kLibScryptHMACKeyOffset,
                               derived_key.end());
   brillo::Blob data_to_hmac(encrypted_data.begin(),
                             encrypted_data.end() - kLibScryptHMACSize);
   brillo::SecureBlob hmac = CryptoLib::HmacSha256(key_hmac, data_to_hmac);
   brillo::SecureBlob hmac_from_blob(encrypted_data.end() - kLibScryptHMACSize,
                                     encrypted_data.end());
   if (brillo::SecureMemcmp(hmac.data(), hmac_from_blob.data(),
                            kLibScryptHMACSize) != 0) {
     return false;
   }

   brillo::SecureBlob aes_key(derived_key.begin(),
                              derived_key.end() - kLibScryptHMACKeyOffset);
   // libscrypt uses a 0 IV for every message. This is safe _ONLY_ because
   // libscrypt mixes the passphrase with a new salt, generating a new derived
   // key, FOR EACH ENCRYPTION.
   brillo::SecureBlob iv(kLibScryptIVSize, 0);
   brillo::SecureBlob data_to_decrypt(
       encrypted_data.begin() + kLibScryptHeaderSize,
       encrypted_data.end() - kLibScryptHMACSize);

   if (!CryptoLib::AesDecryptSpecifyBlockMode(
           data_to_decrypt, 0, data_to_decrypt.size(), aes_key, iv,
           CryptoLib::kPaddingStandard, CryptoLib::kCtr, decrypted_data)) {
     LOG(ERROR) << "AesDecryptSpecifyBlockMode failed.";
     return false;
   }
   return true;
 }

 }  // namespace cryptohome
	// Copyright 2020 The Chromium OS Authors. All rights reserved.
	// Use of this source code is governed by a BSD-style license that can be
	// found in the LICENSE file.

	#include "cryptohome/libscrypt_compat.h"

	#include <openssl/aes.h>
	#include <openssl/evp.h>

	#include <base/bits.h>
	#include <base/sys_byteorder.h>
	#include <brillo/secure_blob.h>
	#include <crypto/scoped_openssl_types.h>

	#include "cryptohome/cryptolib.h"

	namespace cryptohome {

	// Callers of this library need to allocate the salt and key, so the sizes are
	// exposed.
	constexpr size_t kLibScryptSaltSize = 32;

	constexpr size_t kLibScryptDerivedKeySize = 64;

	namespace {

	constexpr size_t kLibScryptHeaderSize = 96;

	constexpr size_t kLibScryptSubHeaderSize = 48;

	constexpr size_t kLibScryptHeaderBytesToHMAC = 64;

	constexpr char kLibScryptHeaderMagic[] = "scrypt";

	// Bytes 33-64 of the derived key are used for the HMAC key.
	constexpr size_t kLibScryptHMACKeyOffset = 32;

	constexpr size_t kLibScryptHMACSize = 32;

	constexpr size_t kLibScryptIVSize = 16;

	// libscrypt places data into a uint8_t[96] array in C style. This lays it out
	// as a more readable struct, but it must be tightly packed to be compatible
	// with the array.
	#pragma pack(push, 1)
	struct LibScryptHeader {
	// This is always "scrypt".
	char magic[6];
	// This is set to 0.
	uint8_t header_reserved_byte;
	// The log base 2 of the N-factor (i.e. 10 for 1024).
	uint8_t log_n;
	// The r and p params used to generate this key.
	uint32_t r_factor;
	uint32_t p_factor;
	// A salt which is unique to each encryption. Note that this is a bit odd and
	// in new scrypt code it's better to use a unique nonce in the AES
	// encryption.
	uint8_t salt[32];
	// This is a checksum of the first 48 bytes of the header (all fields up to
	// and including the salt).
	uint8_t check_sum[16];
	// This is an HMAC over the first 64 bytes of the header (all fields up to and
	// including the check_sum). Why there is a check_sum and an HMAC is
	// confusing, since they cover the same data. But the key given to the HMAC is
	// the last 32 bytes of the \|derived_key\|, and so it verifies that the
	// password is the proper passsord for this encrypted blob.
	uint8_t signature[kLibScryptHMACSize];
	};
	#pragma pack(pop)

	static_assert(sizeof(LibScryptHeader) == kLibScryptHeaderSize,
	"LibScryptHeader struct is packed wrong and will not be byte "
	"compatible with existing data");

	// This generates the header which is specific to libscrypt. It's inserted at
	// the beginning \|output\|.
	void GenerateHeader(const brillo::SecureBlob& salt,
	const brillo::SecureBlob& derived_key,
	const ScryptParameters& params,
	LibScryptHeader* header_struct) {
	DCHECK_EQ(kLibScryptSaltSize, salt.size());

	*header_struct = {
	{'s', 'c', 'r', 'y', 'p', 't'},
	0,
	static_cast<uint8_t>(base::bits::Log2Ceiling(params.n_factor)),
	base::ByteSwap(params.r_factor),
	base::ByteSwap(params.p_factor)};

	memcpy(&header_struct->salt, salt.data(), sizeof(header_struct->salt));

	// Add the header check sum.
	uint8_t* header_ptr = reinterpret_cast<uint8_t*>(header_struct);
	brillo::Blob header_blob_to_hash(header_ptr,
	header_ptr + kLibScryptSubHeaderSize);
	brillo::Blob sha = CryptoLib::Sha256(header_blob_to_hash);
	memcpy(&header_struct->check_sum[0], sha.data(),
	sizeof(header_struct->check_sum));

	// Add the header signature (used for verifying the passsword).
	brillo::SecureBlob key_hmac(derived_key.begin() + kLibScryptHMACKeyOffset,
	derived_key.end());
	brillo::Blob data_to_hmac(header_ptr,
	header_ptr + kLibScryptHeaderBytesToHMAC);
	brillo::SecureBlob hmac = CryptoLib::HmacSha256(key_hmac, data_to_hmac);
	memcpy(&header_struct->signature[0], hmac.data(),
	sizeof(header_struct->signature));
	}

	bool VerifyDerivedKey(const brillo::SecureBlob& encrypted_blob,
	const brillo::SecureBlob& derived_key) {
	const LibScryptHeader* header =
	reinterpret_cast<const LibScryptHeader*>(encrypted_blob.data());
	const uint8_t* header_ptr = reinterpret_cast<const uint8_t*>(header);

	// Verify the password.
	brillo::SecureBlob key_hmac(derived_key.begin() + kLibScryptHMACKeyOffset,
	derived_key.end());
	brillo::Blob data_to_hmac(header_ptr,
	header_ptr + kLibScryptHeaderBytesToHMAC);
	brillo::SecureBlob hmac = CryptoLib::HmacSha256(key_hmac, data_to_hmac);
	if (brillo::SecureMemcmp(header->signature, hmac.data(),
	kLibScryptHMACSize) != 0) {
	LOG(ERROR) << "hmac verification failed.";
	return false;
	}

	return true;
	}

	} // namespace

	// static
	bool LibScryptCompat::Encrypt(const brillo::SecureBlob& derived_key,
	const brillo::SecureBlob& salt,
	const brillo::SecureBlob& data_to_encrypt,
	const ScryptParameters& params,
	brillo::SecureBlob* encrypted_data) {
	encrypted_data->resize(data_to_encrypt.size() + kLibScryptHeaderSize +
	kLibScryptHMACSize);

	LibScryptHeader header_struct;
	GenerateHeader(salt, derived_key, params, &header_struct);
	memcpy(encrypted_data->data(), &header_struct, sizeof(header_struct));

	brillo::SecureBlob aes_key(derived_key.begin(),
	derived_key.end() - kLibScryptHMACKeyOffset);
	// libscrypt uses a 0 IV for every message. This is safe _ONLY_ because
	// libscrypt mixes the passphrase with a new salt, generating a new derived
	// key, FOR EACH ENCRYPTION. DO NOT CALL THIS ENCRYPTION method multiple times
	// with the same key, it is only safe under this limited circumstances.
	brillo::SecureBlob iv(kLibScryptIVSize, 0);
	brillo::SecureBlob aes_ciphertext;

	if (!CryptoLib::AesEncryptSpecifyBlockMode(
	data_to_encrypt, 0, data_to_encrypt.size(), aes_key, iv,
	CryptoLib::kPaddingStandard, CryptoLib::kCtr, &aes_ciphertext)) {
	LOG(ERROR) << "AesEncryptSpecifyBlockMode failed.";
	return false;
	}
	memcpy(encrypted_data->data() + sizeof(header_struct), aes_ciphertext.data(),
	aes_ciphertext.size());

	brillo::SecureBlob key_hmac(derived_key.begin() + kLibScryptHMACKeyOffset,
	derived_key.end());
	brillo::Blob data_to_hmac(
	encrypted_data->begin(),
	encrypted_data->begin() + aes_ciphertext.size() + kLibScryptHeaderSize);
	brillo::SecureBlob hmac = CryptoLib::HmacSha256(key_hmac, data_to_hmac);

	memcpy(encrypted_data->data() + sizeof(header_struct) + aes_ciphertext.size(),
	hmac.data(), kLibScryptHMACSize);

	return true;
	}

	// static
	bool LibScryptCompat::ParseHeader(const brillo::SecureBlob& encrypted_blob,
	ScryptParameters* out_params,
	brillo::SecureBlob* salt) {
	if (encrypted_blob.size() < kLibScryptHeaderSize + kLibScryptHMACSize) {
	LOG(ERROR) << "Incomplete header present.";
	return false;
	}

	const LibScryptHeader* header =
	reinterpret_cast<const LibScryptHeader*>(encrypted_blob.data());
	if (brillo::SecureMemcmp(header->magic, kLibScryptHeaderMagic,
	strlen(kLibScryptHeaderMagic)) != 0) {
	LOG(ERROR) << "wrong header text present";
	return false;
	}

	if (header->header_reserved_byte != 0) {
	LOG(ERROR) << "Wrong reserved byte present";
	return false;
	}

	// Verify the header checksum before returning any information.
	const uint8_t* header_ptr = reinterpret_cast<const uint8_t*>(header);
	brillo::Blob header_blob_to_hash(header_ptr,
	header_ptr + kLibScryptSubHeaderSize);
	brillo::Blob sha = CryptoLib::Sha256(header_blob_to_hash);
	if (brillo::SecureMemcmp(sha.data(), header->check_sum,
	sizeof(header->check_sum)) != 0) {
	LOG(ERROR) << "Wrong checksum present.";
	return false;
	}

	// Now parse the parameters.
	if (header->log_n < 1 \|\| header->log_n > 63) {
	LOG(ERROR) << "Invalid logN present in header.";
	return false;
	}

	out_params->n_factor = static_cast<uint64_t>(1) << header->log_n;
	out_params->r_factor = base::ByteSwap(header->r_factor);
	out_params->p_factor = base::ByteSwap(header->p_factor);
	salt->assign(header->salt, header->salt + kLibScryptSaltSize);

	return true;
	}

	// static
	bool LibScryptCompat::Decrypt(const brillo::SecureBlob& encrypted_data,
	const brillo::SecureBlob& derived_key,
	brillo::SecureBlob* decrypted_data) {
	if (!VerifyDerivedKey(encrypted_data, derived_key))
	return false;

	// lib scrypt appends an HMAC.
	brillo::SecureBlob key_hmac(derived_key.begin() + kLibScryptHMACKeyOffset,
	derived_key.end());
	brillo::Blob data_to_hmac(encrypted_data.begin(),
	encrypted_data.end() - kLibScryptHMACSize);
	brillo::SecureBlob hmac = CryptoLib::HmacSha256(key_hmac, data_to_hmac);
	brillo::SecureBlob hmac_from_blob(encrypted_data.end() - kLibScryptHMACSize,
	encrypted_data.end());
	if (brillo::SecureMemcmp(hmac.data(), hmac_from_blob.data(),
	kLibScryptHMACSize) != 0) {
	return false;
	}

	brillo::SecureBlob aes_key(derived_key.begin(),
	derived_key.end() - kLibScryptHMACKeyOffset);
	// libscrypt uses a 0 IV for every message. This is safe _ONLY_ because
	// libscrypt mixes the passphrase with a new salt, generating a new derived
	// key, FOR EACH ENCRYPTION.
	brillo::SecureBlob iv(kLibScryptIVSize, 0);
	brillo::SecureBlob data_to_decrypt(
	encrypted_data.begin() + kLibScryptHeaderSize,
	encrypted_data.end() - kLibScryptHMACSize);

	if (!CryptoLib::AesDecryptSpecifyBlockMode(
	data_to_decrypt, 0, data_to_decrypt.size(), aes_key, iv,
	CryptoLib::kPaddingStandard, CryptoLib::kCtr, decrypted_data)) {
	LOG(ERROR) << "AesDecryptSpecifyBlockMode failed.";
	return false;
	}
	return true;
	}

	} // namespace cryptohome