// PAK is an encrypted key exchange protocol designed by Philip MacKenzie et al.
// It is patented and use outside Plan 9 requires you get a license.
// (All other EKE protocols are patented as well, by Lucent or others.)
#include <u.h>
#include <libc.h>
#include <mp.h>
#include <libsec.h>
#include "SConn.h"
#include "secstore.h"

extern int verbose;

char VERSION[] = "secstore";
static char *feedback[] = {"alpha","bravo","charlie","delta","echo","foxtrot","golf","hotel"};

typedef struct PAKparams{
       mpint *q, *p, *r, *g;
} PAKparams;

static PAKparams *pak;

// from seed EB7B6E35F7CD37B511D96C67D6688CC4DD440E1E
static void
initPAKparams(void)
{
       if(pak)
               return;
       pak = (PAKparams*)emalloc(sizeof(*pak));
       pak->q = strtomp("E0F0EF284E10796C5A2A511E94748BA03C795C13", nil, 16, nil);
       pak->p = strtomp("C41CFBE4D4846F67A3DF7DE9921A49D3B42DC33728427AB159CEC8CBB"
               "DB12B5F0C244F1A734AEB9840804EA3C25036AD1B61AFF3ABBC247CD4B384224567A86"
               "3A6F020E7EE9795554BCD08ABAD7321AF27E1E92E3DB1C6E7E94FAAE590AE9C48F96D9"
               "3D178E809401ABE8A534A1EC44359733475A36A70C7B425125062B1142D",
               nil, 16, nil);
       pak->r = strtomp("DF310F4E54A5FEC5D86D3E14863921E834113E060F90052AD332B3241"
               "CEF2497EFA0303D6344F7C819691A0F9C4A773815AF8EAECFB7EC1D98F039F17A32A7E"
               "887D97251A927D093F44A55577F4D70444AEBD06B9B45695EC23962B175F266895C67D"
               "21C4656848614D888A4", nil, 16, nil);
       pak->g = strtomp("2F1C308DC46B9A44B52DF7DACCE1208CCEF72F69C743ADD4D23271734"
               "44ED6E65E074694246E07F9FD4AE26E0FDDD9F54F813C40CB9BCD4338EA6F242AB94CD"
               "410E676C290368A16B1A3594877437E516C53A6EEE5493A038A017E955E218E7819734"
               "E3E2A6E0BAE08B14258F8C03CC1B30E0DDADFCF7CEDF0727684D3D255F1",
               nil, 16, nil);
}

// H = (sha(ver,C,sha(passphrase)))^r mod p,
// a hash function expensive to attack by brute force.
static void
longhash(char *ver, char *C, uchar *passwd, mpint *H)
{
       uchar *Cp;
       int i, n, nver, nC;
       uchar buf[140], key[1];

       nver = strlen(ver);
       nC = strlen(C);
       n = nver + nC + SHA1dlen;
       Cp = (uchar*)emalloc(n);
       memmove(Cp, ver, nver);
       memmove(Cp+nver, C, nC);
       memmove(Cp+nver+nC, passwd, SHA1dlen);
       for(i = 0; i < 7; i++){
               key[0] = 'A'+i;
               hmac_sha1(Cp, n, key, sizeof key, buf+i*SHA1dlen, nil);
       }
       memset(Cp, 0, n);
       free(Cp);
       betomp(buf, sizeof buf, H);
       mpmod(H, pak->p, H);
       mpexp(H, pak->r, pak->p, H);
}

// Hi = H^-1 mod p
char *
PAK_Hi(char *C, char *passphrase, mpint *H, mpint *Hi)
{
       uchar passhash[SHA1dlen];

       sha1((uchar *)passphrase, strlen(passphrase), passhash, nil);
       initPAKparams();
       longhash(VERSION, C, passhash, H);
       mpinvert(H, pak->p, Hi);
       return mptoa(Hi, 64, nil, 0);
}

// another, faster, hash function for each party to
// confirm that the other has the right secrets.
static void
shorthash(char *mess, char *C, char *S, char *m, char *mu, char *sigma, char *Hi, uchar *digest)
{
       SHA1state *state;

       state = sha1((uchar*)mess, strlen(mess), 0, 0);
       state = sha1((uchar*)C, strlen(C), 0, state);
       state = sha1((uchar*)S, strlen(S), 0, state);
       state = sha1((uchar*)m, strlen(m), 0, state);
       state = sha1((uchar*)mu, strlen(mu), 0, state);
       state = sha1((uchar*)sigma, strlen(sigma), 0, state);
       state = sha1((uchar*)Hi, strlen(Hi), 0, state);
       state = sha1((uchar*)mess, strlen(mess), 0, state);
       state = sha1((uchar*)C, strlen(C), 0, state);
       state = sha1((uchar*)S, strlen(S), 0, state);
       state = sha1((uchar*)m, strlen(m), 0, state);
       state = sha1((uchar*)mu, strlen(mu), 0, state);
       state = sha1((uchar*)sigma, strlen(sigma), 0, state);
       sha1((uchar*)Hi, strlen(Hi), digest, state);
}

// On input, conn provides an open channel to the server;
//      C is the name this client calls itself;
//      pass is the user's passphrase
// On output, session secret has been set in conn
//      (unless return code is negative, which means failure).
//    If pS is not nil, it is set to the (alloc'd) name the server calls itself.
int
PAKclient(SConn *conn, char *C, char *pass, char **pS)
{
       char *mess, *mess2, *eol, *S, *hexmu, *ks, *hexm, *hexsigma = nil, *hexHi;
       char kc[2*SHA1dlen+1];
       uchar digest[SHA1dlen];
       int rc = -1, n;
       mpint *x, *m = mpnew(0), *mu = mpnew(0), *sigma = mpnew(0);
       mpint *H = mpnew(0), *Hi = mpnew(0);

       hexHi = PAK_Hi(C, pass, H, Hi);
       if(verbose)
               fprint(2, "%s\n", feedback[H->p[0]&0x7]);  // provide a clue to catch typos

       // random 1<=x<=q-1; send C, m=g**x H
       x = mprand(240, genrandom, nil);
       mpmod(x, pak->q, x);
       if(mpcmp(x, mpzero) == 0)
               mpassign(mpone, x);
       mpexp(pak->g, x, pak->p, m);
       mpmul(m, H, m);
       mpmod(m, pak->p, m);
       hexm = mptoa(m, 64, nil, 0);
       mess = (char*)emalloc(2*Maxmsg+2);
       mess2 = mess+Maxmsg+1;
       snprint(mess, Maxmsg, "%s\tPAK\nC=%s\nm=%s\n", VERSION, C, hexm);
       conn->write(conn, (uchar*)mess, strlen(mess));

       // recv g**y, S, check hash1(g**xy)
       if(readstr(conn, mess) < 0){
               fprint(2, "%s: error: %s\n", argv0, mess);
               writerr(conn, "couldn't read g**y");
               goto done;
       }
       eol = strchr(mess, '\n');
       if(strncmp("mu=", mess, 3) != 0 || !eol || strncmp("\nk=", eol, 3) != 0){
               writerr(conn, "verifier syntax error");
               goto done;
       }
       hexmu = mess+3;
       *eol = 0;
       ks = eol+3;
       eol = strchr(ks, '\n');
       if(!eol || strncmp("\nS=", eol, 3) != 0){
               writerr(conn, "verifier syntax error for secstore 1.0");
               goto done;
       }
       *eol = 0;
       S = eol+3;
       eol = strchr(S, '\n');
       if(!eol){
               writerr(conn, "verifier syntax error for secstore 1.0");
               goto done;
       }
       *eol = 0;
       if(pS)
               *pS = estrdup(S);
       strtomp(hexmu, nil, 64, mu);
       mpexp(mu, x, pak->p, sigma);
       hexsigma = mptoa(sigma, 64, nil, 0);
       shorthash("server", C, S, hexm, hexmu, hexsigma, hexHi, digest);
       enc64(kc, sizeof kc, digest, SHA1dlen);
       if(strcmp(ks, kc) != 0){
               writerr(conn, "verifier didn't match");
               goto done;
       }

       // send hash2(g**xy)
       shorthash("client", C, S, hexm, hexmu, hexsigma, hexHi, digest);
       enc64(kc, sizeof kc, digest, SHA1dlen);
       snprint(mess2, Maxmsg, "k'=%s\n", kc);
       conn->write(conn, (uchar*)mess2, strlen(mess2));

       // set session key
       shorthash("session", C, S, hexm, hexmu, hexsigma, hexHi, digest);
       memset(hexsigma, 0, strlen(hexsigma));
       n = conn->secret(conn, digest, 0);
       memset(digest, 0, SHA1dlen);
       if(n < 0){
               writerr(conn, "can't set secret");
               goto done;
       }

       rc = 0;
done:
       mpfree(x);
       mpfree(sigma);
       mpfree(mu);
       mpfree(m);
       mpfree(Hi);
       mpfree(H);
       free(hexsigma);
       free(hexHi);
       free(hexm);
       free(mess);
       return rc;
}

// On input,
//      mess contains first message;
//      name is name this server should call itself.
// On output, session secret has been set in conn;
//      if pw!=nil, then *pw points to PW struct for authenticated user.
//      returns -1 if error
int
PAKserver(SConn *conn, char *S, char *mess, PW **pwp)
{
       int rc = -1, n;
       char mess2[Maxmsg+1], *eol;
       char *C, ks[41], *kc, *hexm, *hexmu = nil, *hexsigma = nil, *hexHi = nil;
       uchar digest[SHA1dlen];
       mpint *H = mpnew(0), *Hi = mpnew(0);
       mpint *y = nil, *m = mpnew(0), *mu = mpnew(0), *sigma = mpnew(0);
       PW *pw = nil;

       // secstore version and algorithm
       snprint(mess2,Maxmsg,"%s\tPAK\n", VERSION);
       n = strlen(mess2);
       if(strncmp(mess,mess2,n) != 0){
               writerr(conn, "protocol should start with ver alg");
               return -1;
       }
       mess += n;
       initPAKparams();

       // parse first message into C, m
       eol = strchr(mess, '\n');
       if(strncmp("C=", mess, 2) != 0 || !eol){
               fprint(2, "%s: mess[1]=%s\n", argv0, mess);
               writerr(conn, "PAK version mismatch");
               goto done;
       }
       C = mess+2;
       *eol = 0;
       hexm = eol+3;
       eol = strchr(hexm, '\n');
       if(strncmp("m=", hexm-2, 2) != 0 || !eol){
               writerr(conn, "PAK version mismatch");
               goto done;
       }
       *eol = 0;
       strtomp(hexm, nil, 64, m);
       mpmod(m, pak->p, m);

       // lookup client
       if((pw = getPW(C,0)) == nil) {
               snprint(mess2, sizeof mess2, "%r");
               writerr(conn, mess2);
               goto done;
       }
       if(mpcmp(m, mpzero) == 0) {
               writerr(conn, "account exists");
               freePW(pw);
               pw = nil;
               goto done;
       }
       hexHi = mptoa(pw->Hi, 64, nil, 0);

       // random y, mu=g**y, sigma=g**xy
       y = mprand(240, genrandom, nil);
       mpmod(y, pak->q, y);
       if(mpcmp(y, mpzero) == 0){
               mpassign(mpone, y);
       }
       mpexp(pak->g, y, pak->p, mu);
       mpmul(m, pw->Hi, m);
       mpmod(m, pak->p, m);
       mpexp(m, y, pak->p, sigma);

       // send g**y, hash1(g**xy)
       hexmu = mptoa(mu, 64, nil, 0);
       hexsigma = mptoa(sigma, 64, nil, 0);
       shorthash("server", C, S, hexm, hexmu, hexsigma, hexHi, digest);
       enc64(ks, sizeof ks, digest, SHA1dlen);
       snprint(mess2, sizeof mess2, "mu=%s\nk=%s\nS=%s\n", hexmu, ks, S);
       conn->write(conn, (uchar*)mess2, strlen(mess2));

       // recv hash2(g**xy)
       if(readstr(conn, mess2) < 0){
               writerr(conn, "couldn't read verifier");
               goto done;
       }
       eol = strchr(mess2, '\n');
       if(strncmp("k'=", mess2, 3) != 0 || !eol){
               writerr(conn, "verifier syntax error");
               goto done;
       }
       kc = mess2+3;
       *eol = 0;
       shorthash("client", C, S, hexm, hexmu, hexsigma, hexHi, digest);
       enc64(ks, sizeof ks, digest, SHA1dlen);
       if(strcmp(ks, kc) != 0) {
               rc = -2;
               goto done;
       }

       // set session key
       shorthash("session", C, S, hexm, hexmu, hexsigma, hexHi, digest);
       n = conn->secret(conn, digest, 1);
       if(n < 0){
               writerr(conn, "can't set secret");
               goto done;
       }

       rc = 0;
done:
       if(rc<0 && pw){
               pw->failed++;
               putPW(pw);
       }
       if(rc==0 && pw && pw->failed>0){
               pw->failed = 0;
               putPW(pw);
       }
       if(pwp)
               *pwp = pw;
       else
               freePW(pw);
       free(hexsigma);
       free(hexHi);
       free(hexmu);
       mpfree(y);
       mpfree(sigma);
       mpfree(mu);
       mpfree(m);
       mpfree(Hi);
       mpfree(H);
       return rc;
}

You are viewing proxied material from sdf.org. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.