2 * Copyright (c) 2014 Michihiro NAKAJIMA
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 #include "archive_platform.h"
32 #include "archive_cryptor_private.h"
35 * On systems that do not support any recognized crypto libraries,
36 * this file will normally define no usable symbols.
38 * But some compilers and linkers choke on empty object files, so
39 * define a public symbol that will always exist. This could
40 * be removed someday if this file gains another always-present
43 int __libarchive_cryptor_build_hack(void) {
47 #ifdef ARCHIVE_CRYPTOR_USE_Apple_CommonCrypto
50 pbkdf2_sha1(const char *pw, size_t pw_len, const uint8_t *salt,
51 size_t salt_len, unsigned rounds, uint8_t *derived_key,
52 size_t derived_key_len)
54 CCKeyDerivationPBKDF(kCCPBKDF2, (const char *)pw,
55 pw_len, salt, salt_len, kCCPRFHmacAlgSHA1, rounds,
56 derived_key, derived_key_len);
60 #elif defined(_WIN32) && !defined(__CYGWIN__) && defined(HAVE_BCRYPT_H)
62 #pragma comment(lib, "Bcrypt.lib")
66 pbkdf2_sha1(const char *pw, size_t pw_len, const uint8_t *salt,
67 size_t salt_len, unsigned rounds, uint8_t *derived_key,
68 size_t derived_key_len)
71 BCRYPT_ALG_HANDLE hAlg;
73 status = BCryptOpenAlgorithmProvider(&hAlg, BCRYPT_SHA1_ALGORITHM,
74 MS_PRIMITIVE_PROVIDER, BCRYPT_ALG_HANDLE_HMAC_FLAG);
75 if (!BCRYPT_SUCCESS(status))
78 status = BCryptDeriveKeyPBKDF2(hAlg,
79 (PUCHAR)(uintptr_t)pw, (ULONG)pw_len,
80 (PUCHAR)(uintptr_t)salt, (ULONG)salt_len, rounds,
81 (PUCHAR)derived_key, (ULONG)derived_key_len, 0);
83 BCryptCloseAlgorithmProvider(hAlg, 0);
85 return (BCRYPT_SUCCESS(status)) ? 0: -1;
88 #elif defined(HAVE_LIBNETTLE) && defined(HAVE_NETTLE_PBKDF2_H)
91 pbkdf2_sha1(const char *pw, size_t pw_len, const uint8_t *salt,
92 size_t salt_len, unsigned rounds, uint8_t *derived_key,
93 size_t derived_key_len) {
94 pbkdf2_hmac_sha1((unsigned)pw_len, (const uint8_t *)pw, rounds,
95 salt_len, salt, derived_key_len, derived_key);
99 #elif defined(HAVE_LIBCRYPTO) && defined(HAVE_PKCS5_PBKDF2_HMAC_SHA1)
102 pbkdf2_sha1(const char *pw, size_t pw_len, const uint8_t *salt,
103 size_t salt_len, unsigned rounds, uint8_t *derived_key,
104 size_t derived_key_len) {
106 PKCS5_PBKDF2_HMAC_SHA1(pw, pw_len, salt, salt_len, rounds,
107 derived_key_len, derived_key);
115 pbkdf2_sha1(const char *pw, size_t pw_len, const uint8_t *salt,
116 size_t salt_len, unsigned rounds, uint8_t *derived_key,
117 size_t derived_key_len) {
118 (void)pw; /* UNUSED */
119 (void)pw_len; /* UNUSED */
120 (void)salt; /* UNUSED */
121 (void)salt_len; /* UNUSED */
122 (void)rounds; /* UNUSED */
123 (void)derived_key; /* UNUSED */
124 (void)derived_key_len; /* UNUSED */
125 return -1; /* UNSUPPORTED */
130 #ifdef ARCHIVE_CRYPTOR_USE_Apple_CommonCrypto
131 # if MAC_OS_X_VERSION_MAX_ALLOWED < 1090
132 # define kCCAlgorithmAES kCCAlgorithmAES128
136 aes_ctr_init(archive_crypto_ctx *ctx, const uint8_t *key, size_t key_len)
140 ctx->key_len = key_len;
141 memcpy(ctx->key, key, key_len);
142 memset(ctx->nonce, 0, sizeof(ctx->nonce));
143 ctx->encr_pos = AES_BLOCK_SIZE;
144 r = CCCryptorCreateWithMode(kCCEncrypt, kCCModeECB, kCCAlgorithmAES,
145 ccNoPadding, NULL, key, key_len, NULL, 0, 0, 0, &ctx->ctx);
146 return (r == kCCSuccess)? 0: -1;
150 aes_ctr_encrypt_counter(archive_crypto_ctx *ctx)
152 CCCryptorRef ref = ctx->ctx;
155 r = CCCryptorReset(ref, NULL);
156 if (r != kCCSuccess && r != kCCUnimplemented)
158 r = CCCryptorUpdate(ref, ctx->nonce, AES_BLOCK_SIZE, ctx->encr_buf,
159 AES_BLOCK_SIZE, NULL);
160 return (r == kCCSuccess)? 0: -1;
164 aes_ctr_release(archive_crypto_ctx *ctx)
166 memset(ctx->key, 0, ctx->key_len);
167 memset(ctx->nonce, 0, sizeof(ctx->nonce));
171 #elif defined(_WIN32) && !defined(__CYGWIN__) && defined(HAVE_BCRYPT_H)
174 aes_ctr_init(archive_crypto_ctx *ctx, const uint8_t *key, size_t key_len)
176 BCRYPT_ALG_HANDLE hAlg;
177 BCRYPT_KEY_HANDLE hKey;
178 DWORD keyObj_len, aes_key_len;
182 BCRYPT_KEY_LENGTHS_STRUCT key_lengths;
188 case 16: aes_key_len = 128; break;
189 case 24: aes_key_len = 192; break;
190 case 32: aes_key_len = 256; break;
193 status = BCryptOpenAlgorithmProvider(&hAlg, BCRYPT_AES_ALGORITHM,
194 MS_PRIMITIVE_PROVIDER, 0);
195 if (!BCRYPT_SUCCESS(status))
197 status = BCryptGetProperty(hAlg, BCRYPT_KEY_LENGTHS, (PUCHAR)&key_lengths,
198 sizeof(key_lengths), &result, 0);
199 if (!BCRYPT_SUCCESS(status)) {
200 BCryptCloseAlgorithmProvider(hAlg, 0);
203 if (key_lengths.dwMinLength > aes_key_len
204 || key_lengths.dwMaxLength < aes_key_len) {
205 BCryptCloseAlgorithmProvider(hAlg, 0);
208 status = BCryptGetProperty(hAlg, BCRYPT_OBJECT_LENGTH, (PUCHAR)&keyObj_len,
209 sizeof(keyObj_len), &result, 0);
210 if (!BCRYPT_SUCCESS(status)) {
211 BCryptCloseAlgorithmProvider(hAlg, 0);
214 keyObj = (PBYTE)HeapAlloc(GetProcessHeap(), 0, keyObj_len);
215 if (keyObj == NULL) {
216 BCryptCloseAlgorithmProvider(hAlg, 0);
219 status = BCryptSetProperty(hAlg, BCRYPT_CHAINING_MODE,
220 (PUCHAR)BCRYPT_CHAIN_MODE_ECB, sizeof(BCRYPT_CHAIN_MODE_ECB), 0);
221 if (!BCRYPT_SUCCESS(status)) {
222 BCryptCloseAlgorithmProvider(hAlg, 0);
223 HeapFree(GetProcessHeap(), 0, keyObj);
226 status = BCryptGenerateSymmetricKey(hAlg, &hKey,
228 (PUCHAR)(uintptr_t)key, (ULONG)key_len, 0);
229 if (!BCRYPT_SUCCESS(status)) {
230 BCryptCloseAlgorithmProvider(hAlg, 0);
231 HeapFree(GetProcessHeap(), 0, keyObj);
237 ctx->keyObj = keyObj;
238 ctx->keyObj_len = keyObj_len;
239 ctx->encr_pos = AES_BLOCK_SIZE;
245 aes_ctr_encrypt_counter(archive_crypto_ctx *ctx)
250 status = BCryptEncrypt(ctx->hKey, (PUCHAR)ctx->nonce, AES_BLOCK_SIZE,
251 NULL, NULL, 0, (PUCHAR)ctx->encr_buf, AES_BLOCK_SIZE,
253 return BCRYPT_SUCCESS(status) ? 0 : -1;
257 aes_ctr_release(archive_crypto_ctx *ctx)
260 if (ctx->hAlg != NULL) {
261 BCryptCloseAlgorithmProvider(ctx->hAlg, 0);
263 BCryptDestroyKey(ctx->hKey);
265 HeapFree(GetProcessHeap(), 0, ctx->keyObj);
268 memset(ctx, 0, sizeof(*ctx));
272 #elif defined(HAVE_LIBNETTLE) && defined(HAVE_NETTLE_AES_H)
275 aes_ctr_init(archive_crypto_ctx *ctx, const uint8_t *key, size_t key_len)
277 ctx->key_len = key_len;
278 memcpy(ctx->key, key, key_len);
279 memset(ctx->nonce, 0, sizeof(ctx->nonce));
280 ctx->encr_pos = AES_BLOCK_SIZE;
281 memset(&ctx->ctx, 0, sizeof(ctx->ctx));
286 aes_ctr_encrypt_counter(archive_crypto_ctx *ctx)
288 aes_set_encrypt_key(&ctx->ctx, ctx->key_len, ctx->key);
289 aes_encrypt(&ctx->ctx, AES_BLOCK_SIZE, ctx->encr_buf, ctx->nonce);
294 aes_ctr_release(archive_crypto_ctx *ctx)
296 memset(ctx, 0, sizeof(*ctx));
300 #elif defined(HAVE_LIBCRYPTO)
303 aes_ctr_init(archive_crypto_ctx *ctx, const uint8_t *key, size_t key_len)
305 if ((ctx->ctx = EVP_CIPHER_CTX_new()) == NULL)
309 case 16: ctx->type = EVP_aes_128_ecb(); break;
310 case 24: ctx->type = EVP_aes_192_ecb(); break;
311 case 32: ctx->type = EVP_aes_256_ecb(); break;
312 default: ctx->type = NULL; return -1;
315 ctx->key_len = key_len;
316 memcpy(ctx->key, key, key_len);
317 memset(ctx->nonce, 0, sizeof(ctx->nonce));
318 ctx->encr_pos = AES_BLOCK_SIZE;
319 EVP_CIPHER_CTX_init(ctx->ctx);
324 aes_ctr_encrypt_counter(archive_crypto_ctx *ctx)
329 r = EVP_EncryptInit_ex(ctx->ctx, ctx->type, NULL, ctx->key, NULL);
332 r = EVP_EncryptUpdate(ctx->ctx, ctx->encr_buf, &outl, ctx->nonce,
334 if (r == 0 || outl != AES_BLOCK_SIZE)
340 aes_ctr_release(archive_crypto_ctx *ctx)
342 EVP_CIPHER_CTX_free(ctx->ctx);
343 memset(ctx->key, 0, ctx->key_len);
344 memset(ctx->nonce, 0, sizeof(ctx->nonce));
350 #define ARCHIVE_CRYPTOR_STUB
353 aes_ctr_init(archive_crypto_ctx *ctx, const uint8_t *key, size_t key_len)
355 (void)ctx; /* UNUSED */
356 (void)key; /* UNUSED */
357 (void)key_len; /* UNUSED */
362 aes_ctr_encrypt_counter(archive_crypto_ctx *ctx)
364 (void)ctx; /* UNUSED */
369 aes_ctr_release(archive_crypto_ctx *ctx)
371 (void)ctx; /* UNUSED */
377 #ifdef ARCHIVE_CRYPTOR_STUB
379 aes_ctr_update(archive_crypto_ctx *ctx, const uint8_t * const in,
380 size_t in_len, uint8_t * const out, size_t *out_len)
382 (void)ctx; /* UNUSED */
383 (void)in; /* UNUSED */
384 (void)in_len; /* UNUSED */
385 (void)out; /* UNUSED */
386 (void)out_len; /* UNUSED */
387 aes_ctr_encrypt_counter(ctx); /* UNUSED */ /* Fix unused function warning */
393 aes_ctr_increase_counter(archive_crypto_ctx *ctx)
395 uint8_t *const nonce = ctx->nonce;
398 for (j = 0; j < 8; j++) {
405 aes_ctr_update(archive_crypto_ctx *ctx, const uint8_t * const in,
406 size_t in_len, uint8_t * const out, size_t *out_len)
408 uint8_t *const ebuf = ctx->encr_buf;
409 unsigned pos = ctx->encr_pos;
410 unsigned max = (unsigned)((in_len < *out_len)? in_len: *out_len);
413 for (i = 0; i < max; ) {
414 if (pos == AES_BLOCK_SIZE) {
415 aes_ctr_increase_counter(ctx);
416 if (aes_ctr_encrypt_counter(ctx) != 0)
418 while (max -i >= AES_BLOCK_SIZE) {
419 for (pos = 0; pos < AES_BLOCK_SIZE; pos++)
420 out[i+pos] = in[i+pos] ^ ebuf[pos];
422 aes_ctr_increase_counter(ctx);
423 if (aes_ctr_encrypt_counter(ctx) != 0)
430 out[i] = in[i] ^ ebuf[pos++];
438 #endif /* ARCHIVE_CRYPTOR_STUB */
441 const struct archive_cryptor __archive_cryptor =