denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implemented EdDSA for IKEv2 using a pro forma Identity hash function

Browse Source
This commit is contained in:
Andreas Steffen
2016-12-14 11:15:48 +01:00
committed by Tobias Brunner
parent d47ad3d67e
commit f2eb367adc
6 changed files with 140 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/sa/ikev2/tasks/ike_init.c
+32
View File
@@ -159,6 +159,10 @@ static void send_supported_hash_algorithms(private_ike_init_t *this,
auth_cfg_t *auth;
auth_rule_t rule;
uintptr_t config;
int written;
size_t len = BUF_LEN;
char buf[len];
char *pos = buf;
char *plugin_name;
algos = hash_algorithm_set_create();
@@ -205,11 +209,23 @@ static void send_supported_hash_algorithms(private_ike_init_t *this,
while (enumerator->enumerate(enumerator, &hash))
{
writer->write_uint16(writer, hash);
/* generate debug output */
written = snprintf(pos, len, " %N", hash_algorithm_short_names,
hash);
if (written > 0 && written < len)
{
pos += written;
len -= written;
}
}
enumerator->destroy(enumerator);
message->add_notify(message, FALSE, SIGNATURE_HASH_ALGORITHMS,
writer->get_buf(writer));
writer->destroy(writer);
*pos = '\0';
DBG2(DBG_CFG, "sending supported signature hash algorithms:%s", buf);
}
algos->destroy(algos);
}
@@ -222,6 +238,10 @@ static void handle_supported_hash_algorithms(private_ike_init_t *this,
{
bio_reader_t *reader;
uint16_t algo;
int written;
size_t len = BUF_LEN;
char buf[len];
char *pos = buf;
bool added = FALSE;
reader = bio_reader_create(notify->get_notification_data(notify));
@@ -231,10 +251,22 @@ static void handle_supported_hash_algorithms(private_ike_init_t *this,
{
this->keymat->add_hash_algorithm(this->keymat, algo);
added = TRUE;
/* generate debug output */
written = snprintf(pos, len, " %N", hash_algorithm_short_names,
algo);
if (written > 0 && written < len)
{
pos += written;
len -= written;
}
}
}
reader->destroy(reader);
*pos = '\0';
DBG2(DBG_CFG, "received supported signature hash algorithms:%s", buf);
if (added)
{
this->ike_sa->enable_extension(this->ike_sa, EXT_SIGNATURE_AUTH);
src/libstrongswan/credentials/auth_cfg.c
+31 -17
View File
@@ -1,7 +1,7 @@
/*
* Copyright (C) 2008-2016 Tobias Brunner
* Copyright (C) 2007-2009 Martin Willi
* Copyright (C) 2016 Andreas Steffeb
* Copyright (C) 2016 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -547,22 +547,24 @@ METHOD(auth_cfg_t, add_pubkey_constraints, void,
signature_scheme_t scheme;
key_type_t key;
} schemes[] = {
{ "md5", SIGN_RSA_EMSA_PKCS1_MD5, KEY_RSA, },
{ "sha1", SIGN_RSA_EMSA_PKCS1_SHA1, KEY_RSA, },
{ "sha224", SIGN_RSA_EMSA_PKCS1_SHA2_224, KEY_RSA, },
{ "sha256", SIGN_RSA_EMSA_PKCS1_SHA2_256, KEY_RSA, },
{ "sha384", SIGN_RSA_EMSA_PKCS1_SHA2_384, KEY_RSA, },
{ "sha512", SIGN_RSA_EMSA_PKCS1_SHA2_512, KEY_RSA, },
{ "sha1", SIGN_ECDSA_WITH_SHA1_DER, KEY_ECDSA, },
{ "sha256", SIGN_ECDSA_WITH_SHA256_DER, KEY_ECDSA, },
{ "sha384", SIGN_ECDSA_WITH_SHA384_DER, KEY_ECDSA, },
{ "sha512", SIGN_ECDSA_WITH_SHA512_DER, KEY_ECDSA, },
{ "sha256", SIGN_ECDSA_256, KEY_ECDSA, },
{ "sha384", SIGN_ECDSA_384, KEY_ECDSA, },
{ "sha512", SIGN_ECDSA_521, KEY_ECDSA, },
{ "sha256", SIGN_BLISS_WITH_SHA2_256, KEY_BLISS, },
{ "sha384", SIGN_BLISS_WITH_SHA2_384, KEY_BLISS, },
{ "sha512", SIGN_BLISS_WITH_SHA2_512, KEY_BLISS, },
{ "md5", SIGN_RSA_EMSA_PKCS1_MD5, KEY_RSA, },
{ "sha1", SIGN_RSA_EMSA_PKCS1_SHA1, KEY_RSA, },
{ "sha224", SIGN_RSA_EMSA_PKCS1_SHA2_224, KEY_RSA, },
{ "sha256", SIGN_RSA_EMSA_PKCS1_SHA2_256, KEY_RSA, },
{ "sha384", SIGN_RSA_EMSA_PKCS1_SHA2_384, KEY_RSA, },
{ "sha512", SIGN_RSA_EMSA_PKCS1_SHA2_512, KEY_RSA, },
{ "sha1", SIGN_ECDSA_WITH_SHA1_DER, KEY_ECDSA, },
{ "sha256", SIGN_ECDSA_WITH_SHA256_DER, KEY_ECDSA, },
{ "sha384", SIGN_ECDSA_WITH_SHA384_DER, KEY_ECDSA, },
{ "sha512", SIGN_ECDSA_WITH_SHA512_DER, KEY_ECDSA, },
{ "sha256", SIGN_ECDSA_256, KEY_ECDSA, },
{ "sha384", SIGN_ECDSA_384, KEY_ECDSA, },
{ "sha512", SIGN_ECDSA_521, KEY_ECDSA, },
{ "sha256", SIGN_BLISS_WITH_SHA2_256, KEY_BLISS, },
{ "sha384", SIGN_BLISS_WITH_SHA2_384, KEY_BLISS, },
{ "sha512", SIGN_BLISS_WITH_SHA2_512, KEY_BLISS, },
{ "identity", SIGN_ED25519, KEY_ED25519, },
{ "identity", SIGN_ED448, KEY_ED448, },
};
if (expected_strength != AUTH_RULE_MAX)
@@ -592,6 +594,18 @@ METHOD(auth_cfg_t, add_pubkey_constraints, void,
is_ike = strpfx(token, "ike:");
continue;
}
if (streq(token, "ed25519") || streq(token, "ike:ed25519"))
{
expected_type = KEY_ED25519;
is_ike = strpfx(token, "ike:");
continue;
}
if (streq(token, "ed448") || streq(token, "ike:ed448"))
{
expected_type = KEY_ED448;
is_ike = strpfx(token, "ike:");
continue;
}
if (streq(token, "bliss") || streq(token, "ike:bliss"))
{
expected_type = KEY_BLISS;
src/libstrongswan/plugins/curve25519/Makefile.am
+1
View File
@@ -23,6 +23,7 @@ libstrongswan_curve25519_la_SOURCES = \
curve25519_dh.h curve25519_dh.c \
curve25519_drv.h curve25519_drv.c \
curve25519_drv_portable.h curve25519_drv_portable.c \
curve25519_identity_hasher.h curve25519_identity_hasher.c \
curve25519_plugin.h curve25519_plugin.c
libstrongswan_curve25519_la_LDFLAGS = -module -avoid-version
src/libstrongswan/plugins/curve25519/curve25519_identity_hasher.c
+25
View File
@@ -0,0 +1,25 @@
/*
* Copyright (C) 2016 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "curve25519_identity_hasher.h"
/*
* Described in header.
*/
curve25519_identity_hasher_t *curve25519_identity_hasher_create(hash_algorithm_t algo)
{
/* since the identity hasher is never actually used, always return NULL */
return NULL;
}
src/libstrongswan/plugins/curve25519/curve25519_identity_hasher.h
+47
View File
@@ -0,0 +1,47 @@
/*
* Copyright (C) 2016 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup curve25519_identity_hasher curve25519_identity_hasher
* @{ @ingroup curve25519_p
*/
#ifndef CURVE25519_IDENTITY_HASHER_H_
#define CURVE25519_IDENTITY_HASHER_H_
typedef struct curve25519_identity_hasher_t curve25519_identity_hasher_t;
#include <crypto/hashers/hasher.h>
/**
* Implementation of hasher_t interface using the Identity algorithm.
*/
struct curve25519_identity_hasher_t {
/**
* Implements hasher_t interface.
*/
hasher_t hasher_interface;
};
/**
* Creates a new curve25519_identity_hasher_t.
*
* @param algo algorithm, must be HASH_IDENTITY
* @return curve25519_identity_hasher_t object
*/
curve25519_identity_hasher_t *curve25519_identity_hasher_create(hash_algorithm_t algo);
#endif /** CURVE25519_IDENTITY_HASHER_H_ @}*/
src/libstrongswan/plugins/curve25519/curve25519_plugin.c
+4
View File
@@ -20,6 +20,7 @@
#include "curve25519_dh.h"
#include "curve25519_private_key.h"
#include "curve25519_public_key.h"
#include "curve25519_identity_hasher.h"
#include <library.h>
@@ -65,6 +66,9 @@ METHOD(plugin_t, get_features, int,
/* Ed25519 signature verification scheme, public */
PLUGIN_PROVIDE(PUBKEY_VERIFY, SIGN_ED25519),
PLUGIN_DEPENDS(HASHER, HASH_SHA512),
/* register a pro forma identity hasher */
PLUGIN_REGISTER(HASHER, curve25519_identity_hasher_create),
PLUGIN_PROVIDE(HASHER, HASH_IDENTITY),
};
*features = f;
return countof(f);