- tor-commits - lists.torproject.org

[tor/maint-0.2.2] Merge remote-tracking branch 'rransom-tor/safecookie-022-v3' into maint-0.2.2
by nickm＠torproject.org 26 Mar '12

26 Mar '12

commit 6dcbfec82d1a76cf19dd385b1b91841189c8c4ab Merge: 650e2aa e111e37 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 26 14:03:29 2012 -0400 Merge remote-tracking branch 'rransom-tor/safecookie-022-v3' into maint-0.2.2 src/or/connection.c | 1 + src/or/control.c | 159 ++++++++++++++++++++++++++++++++++++++++++++++++++- src/or/or.h | 6 ++ 3 files changed, 164 insertions(+), 2 deletions(-)

1 0

[tor/maint-0.2.2] Safe cookie authentication gets a changes file
by nickm＠torproject.org 26 Mar '12

26 Mar '12

commit 9740f067c4bed47beb63483be4f4636167a04019 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 26 14:06:27 2012 -0400 Safe cookie authentication gets a changes file --- changes/safecookie | 9 +++++++++ 1 files changed, 9 insertions(+), 0 deletions(-) diff --git a/changes/safecookie b/changes/safecookie new file mode 100644 index 0000000..fd7d7af --- /dev/null +++ b/changes/safecookie @@ -0,0 +1,9 @@ + o Security Features: + - Provide controllers with a safer way to implement the cookie + authentication mechanism. With the old method, if another locally + running program could convince a controller that it was the Tor + process, then that program could trick the contoller into + telling it the contents of an arbitrary 32-byte file. The new + "SAFECOOKIE" authentication method uses a challenge-response + approach to prevent this. Fixes bug 5185, implements proposal 193. +

1 0

[tor/master] Add a sha256 hmac function, with tests
by nickm＠torproject.org 26 Mar '12

26 Mar '12

commit a5704b1c624c9a808f52f3a125339f00e2b9a378 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 13 11:38:13 2011 -0400 Add a sha256 hmac function, with tests (cherry picked from commit fdbb9cdf746bbf0c39c34188baa8872471183ff7) --- src/common/crypto.c | 68 +++++++++++++++++++++++++++++++++++++++++++++ src/common/crypto.h | 3 ++ src/test/test_crypto.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 141 insertions(+), 1 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 235bd88..88e48ef 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -1714,6 +1714,74 @@ crypto_hmac_sha1(char *hmac_out, (unsigned char*)hmac_out, NULL); } +/** Compute the HMAC-SHA-256 of the msg_len bytes in msg, using + * the key of length key_len. Store the DIGEST_LEN-byte result + * in hmac_out. + */ +void +crypto_hmac_sha256(char *hmac_out, + const char *key, size_t key_len, + const char *msg, size_t msg_len) +{ +#if (OPENSSL_VERSION_NUMBER >= 0x00908000l) + /* If we've got OpenSSL >=0.9.8 we can use its hmac implementation. */ + tor_assert(key_len < INT_MAX); + tor_assert(msg_len < INT_MAX); + HMAC(EVP_sha256(), key, (int)key_len, (unsigned char*)msg, (int)msg_len, + (unsigned char*)hmac_out, NULL); +#else + /* OpenSSL doesn't have an EVP implementation for SHA256. We'll need + to do HMAC on our own. + + HMAC isn't so hard: To compute HMAC(key, msg): + 1. If len(key) > blocksize, key = H(key). + 2. If len(key) < blocksize, right-pad key up to blocksize with 0 bytes. + 3. let ipad = key xor 0x363636363636....36 + let opad = key xor 0x5c5c5c5c5c5c....5c + The result is H(opad | H( ipad | msg ) ) + */ +#define BLOCKSIZE 64 +#define DIGESTSIZE 32 + uint8_t k[BLOCKSIZE]; + uint8_t pad[BLOCKSIZE]; + uint8_t d[DIGESTSIZE]; + int i; + SHA256_CTX st; + + tor_assert(key_len < INT_MAX); + tor_assert(msg_len < INT_MAX); + + if (key_len <= BLOCKSIZE) { + memset(k, 0, sizeof(k)); + memcpy(k, key, key_len); /* not time invariant in key_len */ + } else { + SHA256((const uint8_t *)key, key_len, k); + memset(k+DIGESTSIZE, 0, sizeof(k)-DIGESTSIZE); + } + for (i = 0; i < BLOCKSIZE; ++i) + pad[i] = k[i] ^ 0x36; + SHA256_Init(&st); + SHA256_Update(&st, pad, BLOCKSIZE); + SHA256_Update(&st, (uint8_t*)msg, msg_len); + SHA256_Final(d, &st); + + for (i = 0; i < BLOCKSIZE; ++i) + pad[i] = k[i] ^ 0x5c; + SHA256_Init(&st); + SHA256_Update(&st, pad, BLOCKSIZE); + SHA256_Update(&st, d, DIGESTSIZE); + SHA256_Final((uint8_t*)hmac_out, &st); + + /* Now clear everything. */ + memset(k, 0, sizeof(k)); + memset(pad, 0, sizeof(pad)); + memset(d, 0, sizeof(d)); + memset(&st, 0, sizeof(st)); +#undef BLOCKSIZE +#undef DIGESTSIZE +#endif +} + /* DH */ /** Shared P parameter for our circuit-crypto DH key exchanges. */ diff --git a/src/common/crypto.h b/src/common/crypto.h index 1a8c81f..a0ee075 100644 --- a/src/common/crypto.h +++ b/src/common/crypto.h @@ -195,6 +195,9 @@ void crypto_digest_assign(crypto_digest_env_t *into, void crypto_hmac_sha1(char *hmac_out, const char *key, size_t key_len, const char *msg, size_t msg_len); +void crypto_hmac_sha256(char *hmac_out, + const char *key, size_t key_len, + const char *msg, size_t msg_len); /* Key negotiation */ #define DH_TYPE_CIRCUIT 1 diff --git a/src/test/test_crypto.c b/src/test/test_crypto.c index 121af27..85a4e92 100644 --- a/src/test/test_crypto.c +++ b/src/test/test_crypto.c @@ -231,7 +231,7 @@ test_crypto_sha(void) { crypto_digest_env_t *d1 = NULL, *d2 = NULL; int i; - char key[80]; + char key[160]; char digest[32]; char data[50]; char d_out1[DIGEST_LEN], d_out2[DIGEST256_LEN]; @@ -276,6 +276,75 @@ test_crypto_sha(void) test_streq(hex_str(digest, 20), "AA4AE5E15272D00E95705637CE8A3B55ED402112"); + /* Test HMAC-SHA256 with test cases from wikipedia and RFC 4231 */ + + /* Case empty (wikipedia) */ + crypto_hmac_sha256(digest, "", 0, "", 0); + test_streq(hex_str(digest, 32), + "B613679A0814D9EC772F95D778C35FC5FF1697C493715653C6C712144292C5AD"); + + /* Case quick-brown (wikipedia) */ + crypto_hmac_sha256(digest, "key", 3, + "The quick brown fox jumps over the lazy dog", 43); + test_streq(hex_str(digest, 32), + "F7BC83F430538424B13298E6AA6FB143EF4D59A14946175997479DBC2D1A3CD8"); + + /* "Test Case 1" from RFC 4231 */ + memset(key, 0x0b, 20); + crypto_hmac_sha256(digest, key, 20, "Hi There", 8); + test_memeq_hex(digest, + "b0344c61d8db38535ca8afceaf0bf12b" + "881dc200c9833da726e9376c2e32cff7"); + + /* "Test Case 2" from RFC 4231 */ + memset(key, 0x0b, 20); + crypto_hmac_sha256(digest, "Jefe", 4, "what do ya want for nothing?", 28); + test_memeq_hex(digest, + "5bdcc146bf60754e6a042426089575c7" + "5a003f089d2739839dec58b964ec3843"); + + /* "Test case 3" from RFC 4231 */ + memset(key, 0xaa, 20); + memset(data, 0xdd, 50); + crypto_hmac_sha256(digest, key, 20, data, 50); + test_memeq_hex(digest, + "773ea91e36800e46854db8ebd09181a7" + "2959098b3ef8c122d9635514ced565fe"); + + /* "Test case 4" from RFC 4231 */ + base16_decode(key, 25, + "0102030405060708090a0b0c0d0e0f10111213141516171819", 50); + memset(data, 0xcd, 50); + crypto_hmac_sha256(digest, key, 25, data, 50); + test_memeq_hex(digest, + "82558a389a443c0ea4cc819899f2083a" + "85f0faa3e578f8077a2e3ff46729665b"); + + /* "Test case 5" from RFC 4231 */ + memset(key, 0x0c, 20); + crypto_hmac_sha256(digest, key, 20, "Test With Truncation", 20); + test_memeq_hex(digest, + "a3b6167473100ee06e0c796c2955552b"); + + /* "Test case 6" from RFC 4231 */ + memset(key, 0xaa, 131); + crypto_hmac_sha256(digest, key, 131, + "Test Using Larger Than Block-Size Key - Hash Key First", + 54); + test_memeq_hex(digest, + "60e431591ee0b67f0d8a26aacbf5b77f" + "8e0bc6213728c5140546040f0ee37f54"); + + /* "Test case 7" from RFC 4231 */ + memset(key, 0xaa, 131); + crypto_hmac_sha256(digest, key, 131, + "This is a test using a larger than block-size key and a " + "larger than block-size data. The key needs to be hashed " + "before being used by the HMAC algorithm.", 152); + test_memeq_hex(digest, + "9b09ffa71b942fcb27635fbcd5b0e944" + "bfdc63644f0713938a7f51535c3a35e2"); + /* Incremental digest code. */ d1 = crypto_new_digest_env(); test_assert(d1);

1 0

[tor/master] Merge commit 'a5704b1c624c9a808f52f3a125339f00e2b9a378' into maint-0.2.2
by nickm＠torproject.org 26 Mar '12

26 Mar '12

commit 650e2aac46ed9857eed1863cefda45c632bb21eb Merge: ec1bc8a a5704b1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 26 13:59:49 2012 -0400 Merge commit 'a5704b1c624c9a808f52f3a125339f00e2b9a378' into maint-0.2.2 src/common/crypto.c | 68 +++++++++++++++++++++++++++++++++++++++++++++ src/common/crypto.h | 3 ++ src/test/test_crypto.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 141 insertions(+), 1 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.2'
by nickm＠torproject.org 26 Mar '12

26 Mar '12

commit f5c59eb28a82b5dbdf9e08955cd6129e8b824c4e Merge: 2f3ec43 650e2aa Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 26 14:02:11 2012 -0400 Merge remote-tracking branch 'origin/maint-0.2.2' This is an "-s ours" commit to avoid taking a5704b1c624c9a808f5, which was a cherry-picked backport of fdbb9cdf746bbf0c39c34 to add a SHA256-HMAC function.

1 0

[tor/master] Use a given name in the bug5090 message, at its holder's request.
by nickm＠torproject.org 26 Mar '12

26 Mar '12

commit ec1bc8a979f744d70eabbf9ef37b3f9504c09cfe Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 9 14:50:46 2012 -0500 Use a given name in the bug5090 message, at its holder's request. --- changes/bug5090 | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/changes/bug5090 b/changes/bug5090 index 5e323de..d47858c 100644 --- a/changes/bug5090 +++ b/changes/bug5090 @@ -2,6 +2,6 @@ - Detect and reject certain misformed escape sequences in configuration values. Previously, these values would cause us to crash if received in a torrc file or over an (authenticated) control port. Bug found by - Esteban Manchado Velázquez. Patch by "flupzor." Fix for bug 5090; - bugfix on 0.2.0.16-alpha. - + Esteban Manchado Velázquez. Patch by Alexander Schrijver. Fix for + bug 5090; bugfix on 0.2.0.16-alpha. +

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.2'
by nickm＠torproject.org 26 Mar '12

26 Mar '12

commit 2f3ec43e5b4ee3aed0c69ee5b1d11b170f8eb88a Merge: e103509 ec1bc8a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 26 13:57:51 2012 -0400 Merge remote-tracking branch 'origin/maint-0.2.2' Conflicts: changes/bug5090 bug5090 was already merged and corrected in the master branch's changelog.

1 0

[tor/maint-0.2.2] Add a sha256 hmac function, with tests
by nickm＠torproject.org 26 Mar '12

26 Mar '12

commit a5704b1c624c9a808f52f3a125339f00e2b9a378 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 13 11:38:13 2011 -0400 Add a sha256 hmac function, with tests (cherry picked from commit fdbb9cdf746bbf0c39c34188baa8872471183ff7) --- src/common/crypto.c | 68 +++++++++++++++++++++++++++++++++++++++++++++ src/common/crypto.h | 3 ++ src/test/test_crypto.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 141 insertions(+), 1 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 235bd88..88e48ef 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -1714,6 +1714,74 @@ crypto_hmac_sha1(char *hmac_out, (unsigned char*)hmac_out, NULL); } +/** Compute the HMAC-SHA-256 of the msg_len bytes in msg, using + * the key of length key_len. Store the DIGEST_LEN-byte result + * in hmac_out. + */ +void +crypto_hmac_sha256(char *hmac_out, + const char *key, size_t key_len, + const char *msg, size_t msg_len) +{ +#if (OPENSSL_VERSION_NUMBER >= 0x00908000l) + /* If we've got OpenSSL >=0.9.8 we can use its hmac implementation. */ + tor_assert(key_len < INT_MAX); + tor_assert(msg_len < INT_MAX); + HMAC(EVP_sha256(), key, (int)key_len, (unsigned char*)msg, (int)msg_len, + (unsigned char*)hmac_out, NULL); +#else + /* OpenSSL doesn't have an EVP implementation for SHA256. We'll need + to do HMAC on our own. + + HMAC isn't so hard: To compute HMAC(key, msg): + 1. If len(key) > blocksize, key = H(key). + 2. If len(key) < blocksize, right-pad key up to blocksize with 0 bytes. + 3. let ipad = key xor 0x363636363636....36 + let opad = key xor 0x5c5c5c5c5c5c....5c + The result is H(opad | H( ipad | msg ) ) + */ +#define BLOCKSIZE 64 +#define DIGESTSIZE 32 + uint8_t k[BLOCKSIZE]; + uint8_t pad[BLOCKSIZE]; + uint8_t d[DIGESTSIZE]; + int i; + SHA256_CTX st; + + tor_assert(key_len < INT_MAX); + tor_assert(msg_len < INT_MAX); + + if (key_len <= BLOCKSIZE) { + memset(k, 0, sizeof(k)); + memcpy(k, key, key_len); /* not time invariant in key_len */ + } else { + SHA256((const uint8_t *)key, key_len, k); + memset(k+DIGESTSIZE, 0, sizeof(k)-DIGESTSIZE); + } + for (i = 0; i < BLOCKSIZE; ++i) + pad[i] = k[i] ^ 0x36; + SHA256_Init(&st); + SHA256_Update(&st, pad, BLOCKSIZE); + SHA256_Update(&st, (uint8_t*)msg, msg_len); + SHA256_Final(d, &st); + + for (i = 0; i < BLOCKSIZE; ++i) + pad[i] = k[i] ^ 0x5c; + SHA256_Init(&st); + SHA256_Update(&st, pad, BLOCKSIZE); + SHA256_Update(&st, d, DIGESTSIZE); + SHA256_Final((uint8_t*)hmac_out, &st); + + /* Now clear everything. */ + memset(k, 0, sizeof(k)); + memset(pad, 0, sizeof(pad)); + memset(d, 0, sizeof(d)); + memset(&st, 0, sizeof(st)); +#undef BLOCKSIZE +#undef DIGESTSIZE +#endif +} + /* DH */ /** Shared P parameter for our circuit-crypto DH key exchanges. */ diff --git a/src/common/crypto.h b/src/common/crypto.h index 1a8c81f..a0ee075 100644 --- a/src/common/crypto.h +++ b/src/common/crypto.h @@ -195,6 +195,9 @@ void crypto_digest_assign(crypto_digest_env_t *into, void crypto_hmac_sha1(char *hmac_out, const char *key, size_t key_len, const char *msg, size_t msg_len); +void crypto_hmac_sha256(char *hmac_out, + const char *key, size_t key_len, + const char *msg, size_t msg_len); /* Key negotiation */ #define DH_TYPE_CIRCUIT 1 diff --git a/src/test/test_crypto.c b/src/test/test_crypto.c index 121af27..85a4e92 100644 --- a/src/test/test_crypto.c +++ b/src/test/test_crypto.c @@ -231,7 +231,7 @@ test_crypto_sha(void) { crypto_digest_env_t *d1 = NULL, *d2 = NULL; int i; - char key[80]; + char key[160]; char digest[32]; char data[50]; char d_out1[DIGEST_LEN], d_out2[DIGEST256_LEN]; @@ -276,6 +276,75 @@ test_crypto_sha(void) test_streq(hex_str(digest, 20), "AA4AE5E15272D00E95705637CE8A3B55ED402112"); + /* Test HMAC-SHA256 with test cases from wikipedia and RFC 4231 */ + + /* Case empty (wikipedia) */ + crypto_hmac_sha256(digest, "", 0, "", 0); + test_streq(hex_str(digest, 32), + "B613679A0814D9EC772F95D778C35FC5FF1697C493715653C6C712144292C5AD"); + + /* Case quick-brown (wikipedia) */ + crypto_hmac_sha256(digest, "key", 3, + "The quick brown fox jumps over the lazy dog", 43); + test_streq(hex_str(digest, 32), + "F7BC83F430538424B13298E6AA6FB143EF4D59A14946175997479DBC2D1A3CD8"); + + /* "Test Case 1" from RFC 4231 */ + memset(key, 0x0b, 20); + crypto_hmac_sha256(digest, key, 20, "Hi There", 8); + test_memeq_hex(digest, + "b0344c61d8db38535ca8afceaf0bf12b" + "881dc200c9833da726e9376c2e32cff7"); + + /* "Test Case 2" from RFC 4231 */ + memset(key, 0x0b, 20); + crypto_hmac_sha256(digest, "Jefe", 4, "what do ya want for nothing?", 28); + test_memeq_hex(digest, + "5bdcc146bf60754e6a042426089575c7" + "5a003f089d2739839dec58b964ec3843"); + + /* "Test case 3" from RFC 4231 */ + memset(key, 0xaa, 20); + memset(data, 0xdd, 50); + crypto_hmac_sha256(digest, key, 20, data, 50); + test_memeq_hex(digest, + "773ea91e36800e46854db8ebd09181a7" + "2959098b3ef8c122d9635514ced565fe"); + + /* "Test case 4" from RFC 4231 */ + base16_decode(key, 25, + "0102030405060708090a0b0c0d0e0f10111213141516171819", 50); + memset(data, 0xcd, 50); + crypto_hmac_sha256(digest, key, 25, data, 50); + test_memeq_hex(digest, + "82558a389a443c0ea4cc819899f2083a" + "85f0faa3e578f8077a2e3ff46729665b"); + + /* "Test case 5" from RFC 4231 */ + memset(key, 0x0c, 20); + crypto_hmac_sha256(digest, key, 20, "Test With Truncation", 20); + test_memeq_hex(digest, + "a3b6167473100ee06e0c796c2955552b"); + + /* "Test case 6" from RFC 4231 */ + memset(key, 0xaa, 131); + crypto_hmac_sha256(digest, key, 131, + "Test Using Larger Than Block-Size Key - Hash Key First", + 54); + test_memeq_hex(digest, + "60e431591ee0b67f0d8a26aacbf5b77f" + "8e0bc6213728c5140546040f0ee37f54"); + + /* "Test case 7" from RFC 4231 */ + memset(key, 0xaa, 131); + crypto_hmac_sha256(digest, key, 131, + "This is a test using a larger than block-size key and a " + "larger than block-size data. The key needs to be hashed " + "before being used by the HMAC algorithm.", 152); + test_memeq_hex(digest, + "9b09ffa71b942fcb27635fbcd5b0e944" + "bfdc63644f0713938a7f51535c3a35e2"); + /* Incremental digest code. */ d1 = crypto_new_digest_env(); test_assert(d1);

1 0

[tor/maint-0.2.2] Merge commit 'a5704b1c624c9a808f52f3a125339f00e2b9a378' into maint-0.2.2
by nickm＠torproject.org 26 Mar '12

26 Mar '12

commit 650e2aac46ed9857eed1863cefda45c632bb21eb Merge: ec1bc8a a5704b1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 26 13:59:49 2012 -0400 Merge commit 'a5704b1c624c9a808f52f3a125339f00e2b9a378' into maint-0.2.2 src/common/crypto.c | 68 +++++++++++++++++++++++++++++++++++++++++++++ src/common/crypto.h | 3 ++ src/test/test_crypto.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 141 insertions(+), 1 deletions(-)

1 0

r25568: {website} add tails keys to the endless list of keys very few check ca (website/trunk/docs/en)
by Andrew Lewman 26 Mar '12

26 Mar '12

Author: phobos Date: 2012-03-26 17:23:01 +0000 (Mon, 26 Mar 2012) New Revision: 25568 Modified: website/trunk/docs/en/signing-keys.wml Log: add tails keys to the endless list of keys very few check carefully per ticket 5474. Modified: website/trunk/docs/en/signing-keys.wml =================================================================== --- website/trunk/docs/en/signing-keys.wml 2012-03-26 15:44:07 UTC (rev 25567) +++ website/trunk/docs/en/signing-keys.wml 2012-03-26 17:23:01 UTC (rev 25568) @@ -34,6 +34,8 @@ <li>Robert Hogan (0x22F6856F) signs torsocks release tarballs.</li> <li>Sebastian Hahn (0xC5AA446D) signs Obfsproxy Tor Browser Bundles, and sometimes signs the Tor Browser Bundles.</li> + <li>The Tails team (0xBE2CD9C1) signs the Tails live system + releases.</li> <li>Other developers include Peter Palfrader (0xC82E0039, or its subkey 0xE1DEC577) and Jacob Appelbaum (0xE012B42D).</li> </ul> @@ -149,6 +151,11 @@ uid Jacob Appelbaum <jacob(a)torproject.org> uid Jacob Appelbaum <jacob(a)appelbaum.net> sub 4096R/437C9647 2011-04-19 [expires: 2012-04-18] + + pub 4096R/BE2CD9C1 2010-10-07 [expires: 2012-10-06] + Key fingerprint = 0D24 B36A A9A2 A651 7878 7645 1202 821C BE2C D9C1 + uid Tails developers (signing key) <tails(a)boum.org> + uid T(A)ILS developers (signing key) <amnesia(a)boum.org> </pre> </div>

1 0