Author: bct Date: 2007-09-16 06:16:45 +0200 (Sun, 16 Sep 2007) New Revision: 8820
Added: trunk/src/common/crypto.py Modified: trunk/src/common/stanza_session.py Log: split common crypto operations into a separate module
Added: trunk/src/common/crypto.py =================================================================== --- trunk/src/common/crypto.py (rev 0) +++ trunk/src/common/crypto.py 2007-09-16 04:16:45 UTC (rev 8820) @@ -0,0 +1,73 @@ +# common crypto functions (mostly specific to XEP-0116, but useful elsewhere) + +# convert a large integer to a big-endian bitstring +def encode_mpi(n): + if n >= 256: + return encode_mpi(n / 256) + chr(n % 256) + else: + return chr(n) + +# convert a large integer to a big-endian bitstring, padded with \x00s to +# 16 bytes +def encode_mpi_with_padding(n): + ret = encode_mpi(n) + + mod = len(ret) % 16 + if mod != 0: + ret = ((16 - mod) * '\x00') + ret + + return ret + +# convert a big-endian bitstring to an integer +def decode_mpi(s): + if len(s) == 0: + return 0 + else: + return 256 * decode_mpi(s[:-1]) + ord(s[-1]) + +def sha256(string): + sh = SHA256.new() + sh.update(string) + return sh.digest() + +base28_chr = "acdefghikmopqruvwxy123456789" + +def sas_28x5(m_a, form_b): + sha = sha256(m_a + form_b + 'Short Authentication String') + lsb24 = decode_mpi(sha[-3:]) + return base28(lsb24) + +def base28(n): + if n >= 28: + return base28(n / 28) + base28_chr[n % 28] + else: + return base28_chr[n] + +def random_bytes(bytes): + return os.urandom(bytes) + +def generate_nonce(): + return random_bytes(8) + +# generate a random number between 'bottom' and 'top' +def srand(bottom, top): + # minimum number of bytes needed to represent that range + bytes = int(math.ceil(math.log(top - bottom, 256))) + + # in retrospect, this is horribly inadequate. + return (decode_mpi(random_bytes(bytes)) % (top - bottom)) + bottom + +# a faster version of (base ** exp) % mod +# taken from http://lists.danga.com/pipermail/yadis/2005-September/001445.html +def powmod(base, exp, mod): + square = base % mod + result = 1 + + while exp > 0: + if exp & 1: # exponent is odd + result = (result * square) % mod + + square = (square * square) % mod + exp /= 2 + + return result
Modified: trunk/src/common/stanza_session.py =================================================================== --- trunk/src/common/stanza_session.py 2007-09-15 13:38:55 UTC (rev 8819) +++ trunk/src/common/stanza_session.py 2007-09-16 04:16:45 UTC (rev 8820) @@ -12,6 +12,7 @@ import time
from common import dh +from common import crypto import xmpp.c14n
import base64 @@ -164,43 +165,18 @@ kc_s = property(get_kc_s, set_kc_s) kc_o = property(get_kc_o, set_kc_o) - # convert a large integer to a big-endian bitstring - def encode_mpi(self, n): - if n >= 256: - return self.encode_mpi(n / 256) + chr(n % 256) - else: - return chr(n) - - # convert a large integer to a big-endian bitstring, padded with \x00s to - # 16 bytes - def encode_mpi_with_padding(self, n): - ret = self.encode_mpi(n) - - mod = len(ret) % 16 - if mod != 0: - ret = ((16 - mod) * '\x00') + ret - - return ret - - # convert a big-endian bitstring to an integer - def decode_mpi(self, s): - if len(s) == 0: - return 0 - else: - return 256 * self.decode_mpi(s[:-1]) + ord(s[-1]) - def encryptcounter(self): self.c_s = (self.c_s + 1) % (2 ** self.n) - return self.encode_mpi_with_padding(self.c_s) + return crypto.encode_mpi_with_padding(self.c_s) def decryptcounter(self): self.c_o = (self.c_o + 1) % (2 ** self.n) - return self.encode_mpi_with_padding(self.c_o) + return crypto.encode_mpi_with_padding(self.c_o)
def sign(self, string): if self.negotiated['sign_algs'] == (XmlDsig + 'rsa-sha256'): - hash = self.sha256(string) - return self.encode_mpi(gajim.pubkey.sign(hash, '')[0]) + hash = crypto.sha256(string) + return crypto.encode_mpi(gajim.pubkey.sign(hash, '')[0])
def encrypt_stanza(self, stanza): encryptable = filter(lambda x: x.getName() not in ('error', 'amp', @@ -229,31 +205,13 @@
m_content = ''.join(map(str, c.getChildren())) c.NT.mac = base64.b64encode(self.hmac(self.km_s, m_content + \ - self.encode_mpi(old_en_counter))) + crypto.encode_mpi(old_en_counter)))
return stanza
def hmac(self, key, content): return HMAC.new(key, content, self.hash_alg).digest()
- def sha256(self, string): - sh = SHA256.new() - sh.update(string) - return sh.digest() - - base28_chr = "acdefghikmopqruvwxy123456789" - - def sas_28x5(self, m_a, form_b): - sha = self.sha256(m_a + form_b + 'Short Authentication String') - lsb24 = self.decode_mpi(sha[-3:]) - return self.base28(lsb24) - - def base28(self, n): - if n >= 28: - return self.base28(n / 28) + self.base28_chr[n % 28] - else: - return self.base28_chr[n] - def generate_initiator_keys(self, k): return (self.hmac(k, 'Initiator Cipher Key'), self.hmac(k, 'Initiator MAC Key'), @@ -279,13 +237,6 @@
return self.encrypter.encrypt(encryptable)
- # FIXME: use a real PRNG - def random_bytes(self, bytes): - return os.urandom(bytes) - - def generate_nonce(self): - return self.random_bytes(8) - def decrypt_stanza(self, stanza): c = stanza.getTag(name='c', namespace='http://www.xmpp.org/extensions/xep-0200.html#ns') @@ -298,7 +249,7 @@
received_mac = base64.b64decode(c.getTagData('mac')) calculated_mac = self.hmac(self.km_o, macable + \ - self.encode_mpi_with_padding(self.c_o)) + crypto.encode_mpi_with_padding(self.c_o))
if not calculated_mac == received_mac: raise exceptions.DecryptionError, 'bad signature' @@ -325,7 +276,7 @@ return ["may", "mustnot"] else: return ["mustnot", "may"] - + def get_shared_secret(self, e, y, p): if (not 1 < e < (p - 1)): raise exceptions.NegotiationError, "invalid DH value" @@ -341,14 +292,14 @@ m_o = base64.b64decode(form['mac']) id_o = base64.b64decode(form['identity'])
- m_o_calculated = self.hmac(self.km_o, self.encode_mpi(self.c_o) + id_o) + m_o_calculated = self.hmac(self.km_o, crypto.encode_mpi(self.c_o) + id_o)
if m_o_calculated != m_o: raise exceptions.NegotiationError, 'calculated m_%s differs from received m_%s' % (i_o, i_o)
if i_o == 'a' and self.sas_algs == 'sas28x5': # XXX not necessary if there's a verified retained secret - self.sas = self.sas_28x5(m_o, self.form_s) + self.sas = crypto.sas_28x5(m_o, self.form_s)
if self.negotiated['recv_pubkey']: plaintext = self.decrypt(id_o) @@ -363,7 +314,7 @@ if self.negotiated['sign_algs'] == (XmlDsig + 'rsa-sha256'): keyvalue = parsed.getTag(name='RSAKeyValue', namespace=XmlDsig)
- n, e = map(lambda x: self.decode_mpi(base64.b64decode( + n, e = map(lambda x: crypto.decode_mpi(base64.b64decode( keyvalue.getTagData(x))), ('Modulus', 'Exponent')) eir_pubkey = RSA.construct((n,long(e)))
@@ -374,14 +325,14 @@
enc_sig = parsed.getTag(name='SignatureValue', namespace=XmlDsig).getData() - signature = (self.decode_mpi(base64.b64decode(enc_sig)),) + signature = (crypto.decode_mpi(base64.b64decode(enc_sig)),) else: mac_o = self.decrypt(id_o) pubkey_o = ''
c7l_form = self.c7lize_mac_id(form)
- content = self.n_s + self.n_o + self.encode_mpi(dh_i) + pubkey_o + content = self.n_s + self.n_o + crypto.encode_mpi(dh_i) + pubkey_o
if sigmai: self.form_o = c7l_form @@ -393,7 +344,7 @@ mac_o_calculated = self.hmac(self.ks_o, content) if self.negotiated['recv_pubkey']: - hash = self.sha256(mac_o_calculated) + hash = crypto.sha256(mac_o_calculated)
if not eir_pubkey.verify(hash, signature): raise exceptions.NegotiationError, 'public key signature verification failed!' @@ -404,9 +355,10 @@ def make_identity(self, form, dh_i): if self.negotiated['send_pubkey']: if self.negotiated['sign_algs'] == (XmlDsig + 'rsa-sha256'): - fields = (gajim.pubkey.n, gajim.pubkey.e) + pubkey = gajim.interface.get_pubkey(self.conn.name) + fields = (pubkey.n, pubkey.e)
- cb_fields = map(lambda f: base64.b64encode(self.encode_mpi(f)), fields) + cb_fields = map(lambda f: base64.b64encode(crypto.encode_mpi(f)), fields)
pubkey_s = '<RSAKeyValue xmlns="http://www.w3.org/2000/09/xmldsig#"><Modulus>%s</Modulus><Exponent>%s</Exponent></RSAKeyValue>' % tuple(cb_fields) else: @@ -415,7 +367,7 @@ form_s2 = ''.join(map(lambda el: xmpp.c14n.c14n(el), form.getChildren()))
old_c_s = self.c_s - content = self.n_o + self.n_s + self.encode_mpi(dh_i) + pubkey_s + self.form_s + form_s2 + content = self.n_o + self.n_s + crypto.encode_mpi(dh_i) + pubkey_s + self.form_s + form_s2
mac_s = self.hmac(self.ks_s, content)
@@ -432,12 +384,12 @@ else: id_s = self.encrypt(mac_s)
- m_s = self.hmac(self.km_s, self.encode_mpi(old_c_s) + id_s) + m_s = self.hmac(self.km_s, crypto.encode_mpi(old_c_s) + id_s)
if self.status == 'requested-e2e' and self.sas_algs == 'sas28x5': # we're alice; check for a retained secret # if none exists, prompt the user with the SAS - self.sas = self.sas_28x5(m_s, self.form_o) + self.sas = crypto.sas_28x5(m_s, self.form_o)
if self.sigmai: self.check_identity() @@ -482,7 +434,7 @@ x.addChild(node=xmpp.DataField(name='sas_algs', value='sas28x5', typ='hidden')) x.addChild(node=xmpp.DataField(name='sign_algs', value='http://www.w3.org/2000/09/xmldsig#rsa-sha256', typ='hidden'))
- self.n_s = self.generate_nonce() + self.n_s = crypto.generate_nonce() x.addChild(node=xmpp.DataField(name='my_nonce', value=base64.b64encode(self.n_s), typ='hidden'))
@@ -607,17 +559,17 @@
bytes = int(self.n / 8)
- self.n_s = self.generate_nonce() + self.n_s = crypto.generate_nonce()
- self.c_o = self.decode_mpi(self.random_bytes(bytes)) # n-bit random number + self.c_o = crypto.decode_mpi(crypto.random_bytes(bytes)) # n-bit random number self.c_s = self.c_o ^ (2 ** (self.n - 1))
- self.y = self.srand(2 ** (2 * self.n - 1), p - 1) - self.d = self.powmod(g, self.y, p) + self.y = crypto.srand(2 ** (2 * self.n - 1), p - 1) + self.d = crypto.powmod(g, self.y, p)
to_add = { 'my_nonce': self.n_s, - 'dhkeys': self.encode_mpi(self.d), - 'counter': self.encode_mpi(self.c_o), + 'dhkeys': crypto.encode_mpi(self.d), + 'counter': crypto.encode_mpi(self.c_o), 'nonce': self.n_o }
for name in to_add: @@ -688,7 +640,7 @@
result = xmpp.DataForm(typ='result')
- self.c_s = self.decode_mpi(base64.b64decode(form['counter'])) + self.c_s = crypto.decode_mpi(base64.b64decode(form['counter'])) self.c_o = self.c_s ^ (2 ** (self.n - 1))
self.n_o = base64.b64decode(form['my_nonce']) @@ -698,7 +650,7 @@ x = self.xes[mod_p] e = self.es[mod_p]
- self.d = self.decode_mpi(base64.b64decode(form['dhkeys'])) + self.d = crypto.decode_mpi(base64.b64decode(form['dhkeys']))
self.k = self.get_shared_secret(self.d, x, p)
@@ -720,7 +672,7 @@
rshashes = [base64.b64encode(rshash) for rshash in rshashes] result.addChild(node=xmpp.DataField(name='rshashes', value=rshashes)) - result.addChild(node=xmpp.DataField(name='dhkeys', value=base64.b64encode(self.encode_mpi(e)))) + result.addChild(node=xmpp.DataField(name='dhkeys', value=base64.b64encode(crypto.encode_mpi(e)))) self.form_o = ''.join(map(lambda el: xmpp.c14n.c14n(el), form.getChildren()))
@@ -752,10 +704,10 @@ assert field in form.asDict(), "alice's form didn't have a %s field" % field
# 4.5.1 generating provisory session keys - e = self.decode_mpi(base64.b64decode(form['dhkeys'])) + e = crypto.decode_mpi(base64.b64decode(form['dhkeys'])) p = dh.primes[self.modp]
- if self.sha256(self.encode_mpi(e)) != self.negotiated['He']: + if crypto.sha256(crypto.encode_mpi(e)) != self.negotiated['He']: raise exceptions.NegotiationError, 'SHA256(e) != He'
k = self.get_shared_secret(e, self.y, p) @@ -778,19 +730,20 @@ srs = secret break
- # other shared secret, we haven't got one. + # other shared secret + # (we're not using one) oss = ''
- k = self.sha256(k + srs + oss) + k = crypto.sha256(k + srs + oss)
self.kc_s, self.km_s, self.ks_s = self.generate_responder_keys(k) self.kc_o, self.km_o, self.ks_o = self.generate_initiator_keys(k)
# 4.5.5 if srs: - srshash = self.hmac(srs, 'Shared Retained Secret') + srshash = crypto.hmac(srs, 'Shared Retained Secret') else: - srshash = self.random_bytes(32) + srshash = crypto.random_bytes(32)
x.addChild(node=xmpp.DataField(name='FORM_TYPE', value='urn:xmpp:ssn')) x.addChild(node=xmpp.DataField(name='nonce', value=base64.b64encode(self.n_o))) @@ -823,7 +776,7 @@ break
oss = '' - k = self.sha256(self.k + srs + oss) + k = crypto.sha256(self.k + srs + oss) del self.k
self.do_retained_secret(k, srs) @@ -857,14 +810,6 @@ self.check_identity() gajim.interface.save_new_secret(account, bjid, new_srs)
- # generate a random number between 'bottom' and 'top' - def srand(self, bottom, top): - # minimum number of bytes needed to represent that range - bytes = int(math.ceil(math.log(top - bottom, 256))) - - # in retrospect, this is horribly inadequate. - return (self.decode_mpi(self.random_bytes(bytes)) % (top - bottom)) + bottom - def make_dhfield(self, modp_options, sigmai): dhs = []
@@ -872,39 +817,24 @@ p = dh.primes[modp] g = dh.generators[modp]
- x = self.srand(2 ** (2 * self.n - 1), p - 1) + x = crypto.srand(2 ** (2 * self.n - 1), p - 1)
# XXX this may be a source of performance issues - e = self.powmod(g, x, p) + e = crypto.powmod(g, x, p)
self.xes[modp] = x self.es[modp] = e
if sigmai: - dhs.append(base64.b64encode(self.encode_mpi(e))) + dhs.append(base64.b64encode(crypto.encode_mpi(e))) name = 'dhkeys' else: - He = self.sha256(self.encode_mpi(e)) + He = crypto.sha256(crypto.encode_mpi(e)) dhs.append(base64.b64encode(He)) name = 'dhhashes'
return xmpp.DataField(name=name, typ='hidden', value=dhs)
- # a faster version of (base ** exp) % mod - # taken from http://lists.danga.com/pipermail/yadis/2005-September/001445.html - def powmod(self, base, exp, mod): - square = base % mod - result = 1 - - while exp > 0: - if exp & 1: # exponent is odd - result = (result * square) % mod - - square = (square * square) % mod - exp /= 2 - - return result - def terminate_e2e(self): self.terminate()