oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

use IV for envelopeddata encryption, patch originally from Luke Howard

Browse Source 
<lukeh@padl.com>, tweeked by me.


git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@13773 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2004-04-25 14:20:07 +00:00
parent 34fa8c9204
commit 2b36497494
1 changed files with 39 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
lib/krb5/pkinit.c
View File

@@ -1218,6 +1218,7 @@ pk_rd_pa_reply_enckey(krb5_context context,
memset(&ed, 0, sizeof(ed)); memset(&ed, 0, sizeof(ed));
krb5_data_zero(&plain); krb5_data_zero(&plain);
krb5_data_zero(&eContent); krb5_data_zero(&eContent);
krb5_data_zero(&encryptedContent);
user_cert = sk_X509_value(ctx->id->cert, 0); user_cert = sk_X509_value(ctx->id->cert, 0);
@@ -1297,6 +1298,13 @@ pk_rd_pa_reply_enckey(krb5_context context,
goto out; goto out;
} }
if (ed.encryptedContentInfo.contentEncryptionAlgorithm.parameters == NULL){
krb5_set_error_string(context, "encryptedContent parameter missing");
ret = KRB5_BADMSGTYPE;
goto out;
}
if (heim_oid_cmp(&ed.encryptedContentInfo.contentEncryptionAlgorithm.algorithm, &heim_rc2CBC_oid) == 0) { if (heim_oid_cmp(&ed.encryptedContentInfo.contentEncryptionAlgorithm.algorithm, &heim_rc2CBC_oid) == 0) {
/* use rc2-cbc */ /* use rc2-cbc */
RC2CBCParameter params; RC2CBCParameter params;
@@ -1304,7 +1312,6 @@ pk_rd_pa_reply_enckey(krb5_context context,
plain.data = malloc(encryptedContent.length); plain.data = malloc(encryptedContent.length);
if (plain.data == NULL) { if (plain.data == NULL) {
free_octet_string(&encryptedContent);
krb5_set_error_string(context, "malloc - out of memory"); krb5_set_error_string(context, "malloc - out of memory");
ret = ENOMEM; ret = ENOMEM;
goto out; goto out;
@@ -1316,7 +1323,6 @@ pk_rd_pa_reply_enckey(krb5_context context,
&params, &params,
&size); &size);
if (ret) { if (ret) {
free_octet_string(&encryptedContent);
krb5_set_error_string(context, "failed decoding rc2 parameters"); krb5_set_error_string(context, "failed decoding rc2 parameters");
goto out; goto out;
} }
@@ -1357,11 +1363,29 @@ pk_rd_pa_reply_enckey(krb5_context context,
encryptedContent.length, &key, encryptedContent.length, &key,
params.iv.data, 0); params.iv.data, 0);
} }
free_octet_string(&encryptedContent); free_RC2CBCParameter(&params);
} else if (heim_oid_cmp(&ed.encryptedContentInfo.contentEncryptionAlgorithm.algorithm, } else if (heim_oid_cmp(&ed.encryptedContentInfo.contentEncryptionAlgorithm.algorithm,
&heim_des_ede3_cbc_oid) == 0) { &heim_des_ede3_cbc_oid) == 0) {
/* use des-ede3-cbc */ /* use des-ede3-cbc */
CBCParameter params;
ret = decode_CBCParameter(ed.encryptedContentInfo.contentEncryptionAlgorithm.parameters->data,
ed.encryptedContentInfo.contentEncryptionAlgorithm.parameters->length,
&params,
&size);
if (ret) {
krb5_set_error_string(context, "failed decoding des3 parameters");
goto out;
}
if (params.length != 8) {
free_CBCParameter(&params);
krb5_set_error_string(context, "des3 iv wrong size: %d",
params.length);
ret = KRB5_BADMSGTYPE;
goto out;
}
tmp_key.keytype = ETYPE_DES3_CBC_NONE; tmp_key.keytype = ETYPE_DES3_CBC_NONE;
ret = krb5_crypto_init(context, ret = krb5_crypto_init(context,
@@ -1369,16 +1393,17 @@ pk_rd_pa_reply_enckey(krb5_context context,
0, 0,
&crypto); &crypto);
if (ret) { if (ret) {
free_octet_string(&encryptedContent); free_CBCParameter(&params);
goto out; goto out;
} }
ret = krb5_decrypt(context, crypto, ret = krb5_decrypt_ivec(context, crypto,
0, 0,
encryptedContent.data, encryptedContent.data,
encryptedContent.length, encryptedContent.length,
&plain); &plain,
params.data);
free_CBCParameter(&params);
krb5_crypto_destroy(context, crypto); krb5_crypto_destroy(context, crypto);
free_octet_string(&encryptedContent);
if (ret) if (ret)
goto out; goto out;
@@ -1454,6 +1479,7 @@ pk_rd_pa_reply_enckey(krb5_context context,
if (host) if (host)
_krb5_pk_cert_free(host); _krb5_pk_cert_free(host);
free_oid(&eContentType); free_oid(&eContentType);
free_octet_string(&encryptedContent);
krb5_data_free(&eContent); krb5_data_free(&eContent);
krb5_free_keyblock_contents(context, &tmp_key); krb5_free_keyblock_contents(context, &tmp_key);
krb5_data_free(&plain); krb5_data_free(&plain);