wip on struct authobj interface

diff --git a/README_CR b/README_CR
index a55e91675bad2bb5cae18dd12bf731a4c7582029..96e24f5d3dbcf635884ce61c13504424ea002828 100644 (file)
--- a/README_CR
+++ b/README_CR
@@ -7,13 +7,18 @@ user record:
                data:
                        shared-secret
                        payload
                data:
                        shared-secret
                        payload

-                       crc
+                       sha1(
+                               shared-secret
+                               payload
+                       )

                key:
                        hmac-sha1:
                                data:
                key:
                        hmac-sha1:
                                data:

-                                       userid
-                                       password
-                                       seqno
+                                       sha1(
+                                               userid
+                                               password
+                                               seqno
+                                       )

                                key:
                                        shared-secret
 
                                key:
                                        shared-secret
 

diff --git a/authobj.c b/authobj.c
index d2b6b7dee263124064ced1cdff93f470953f92dc..eefc92b04b149b7a8bf4b8d866350a441f0ef4f7 100644 (file)
--- a/authobj.c
+++ b/authobj.c
@@ -7,70 +7,125 @@
 #include "serial.h"
 #include "crypto.h"
 #include "authobj.h"
 #include "serial.h"
 #include "crypto.h"
 #include "authobj.h"

+#include "pcsc_cr.h"

 
 

-int make_challenge(const char *id, const char *pass, const char *nonce,
-               unsigned char *challenge, int *challengesize)
+struct _hash_obj {
+       const char *err;
+       unsigned char hash[HASHSIZE];
+};
+
+static struct _hash_obj
+make_challenge(const char *uid, const char *pass, const char *nonce)

 {
 {

+       struct _hash_obj ho = {0};
+       unsigned long rc;

        serializer_t srl;
        serializer_t srl;

+       int datasize = strlen(uid) + strlen(pass) + strlen(nonce) +
+                       4 * sizeof(short);
+       unsigned char *data = alloca(datasize);
+       int hashsize = sizeof(ho.hash);

 
 

-       serial_init(&srl, challenge, *challengesize);
-       if (serial_put(&srl, id, strlen(id)) != strlen(id))
-               return aoe_serial;
-       if (serial_put(&srl, pass, strlen(pass)) != strlen(pass))
-               return aoe_serial;
-       if (serial_put(&srl, nonce, strlen(nonce)) != strlen(nonce))
-               return aoe_serial;
-       if (serial_put(&srl, NULL, 0) != 0)
-               return aoe_serial;
-       *challengesize = serial_size(&srl);
-       return 0;
+       serial_init(&srl, data, datasize);
+       if (serial_put(&srl, uid, strlen(uid)) != strlen(uid)) {
+               ho.err = "challenge: serialization of uid failed";
+       } else if (serial_put(&srl, pass, strlen(pass)) != strlen(pass)) {
+               ho.err = "challenge: serialization of pass failed";
+       } else if (serial_put(&srl, nonce, strlen(nonce)) != strlen(nonce)) {
+               ho.err = "challenge: serialization of nonce failed";
+       } else if (serial_put(&srl, NULL, 0) != 0) {
+               ho.err = "challenge: serialization of terminator failed";
+       }
+       if (!ho.err) {
+               if ((rc = hash(data, serial_size(&srl), &ho.hash, &hashsize))) {
+                       ho.err = crypto_errstr(rc);
+               } else if (hashsize != sizeof(ho.hash)) {
+                       ho.err = "challenge: hash size is wrong";
+               }
+       }
+       memset(data, 0, datasize);
+       return ho;
+}
+
+static struct _hash_obj
+make_key(const unsigned char *challenge, const int challengesize,
+       const unsigned char *secret, const int secsize)
+{
+       struct _hash_obj ho = {0};
+       unsigned long rc;
+       int keysize = sizeof(ho.hash);
+
+       if ((rc = hmac(secret, secsize, challenge, challengesize,
+                       &ho.hash, &keysize))) {
+               ho.err = crypto_errstr(rc);
+       } else if (keysize != sizeof(ho.hash)) {
+               ho.err = "make_key: hash size is wrong";
+       }
+       return ho;

 }
 
 }
 

-int make_authobj(const char *id, const char *pass, const char *nonce,
+static struct _hash_obj
+fetch_key(const unsigned char *challenge, const int challengesize)
+{
+       struct _hash_obj ho = {0};
+       int rc;
+       int keysize = sizeof(ho.hash);
+
+       if ((rc = pcsc_cr(challenge, challengesize, ho.hash, &keysize))) {
+               ho.err = pcsc_errstr(rc);
+       }
+       return ho;
+}
+
+static struct _auth_obj
+make_authobj(const unsigned char *key, const int keysize,

                const unsigned char *secret, const int secsize,
                const unsigned char *secret, const int secsize,

-               const unsigned char *payload, const int paysize,
-               unsigned char *buffer, int *bufsize)
+               const unsigned char *payload, const int paysize)

 {
 {

+       struct _auth_obj ao = {0};
+       unsigned long rc;

        unsigned char *data;
        int datasize;
        unsigned char datahash[HASHSIZE];
        int datahashsize = HASHSIZE;
        unsigned char *data;
        int datasize;
        unsigned char datahash[HASHSIZE];
        int datahashsize = HASHSIZE;

-       unsigned char *challenge;
-       int challengesize;
-       unsigned char key[HASHSIZE];
-       int keysize = HASHSIZE;

        serializer_t srl;
 
        datasize = ((secsize + paysize + HASHSIZE + 4 * sizeof(short) - 1) /
                        CBLKSIZE + 1) * CBLKSIZE;
        data = alloca(datasize);
        serial_init(&srl, data, datasize);
        serializer_t srl;
 
        datasize = ((secsize + paysize + HASHSIZE + 4 * sizeof(short) - 1) /
                        CBLKSIZE + 1) * CBLKSIZE;
        data = alloca(datasize);
        serial_init(&srl, data, datasize);

-       if (serial_put(&srl, secret, secsize) != secsize) return aoe_serial;
-       if (serial_put(&srl, payload, paysize) != paysize) return aoe_serial;
-       if (hash(data, serial_size(&srl), datahash, &datahashsize))
-               return aoe_size;
-       if (serial_put(&srl, datahash, datahashsize) != datahashsize)
-               return aoe_serial;
-       if (serial_put(&srl, NULL, 0) != 0) return aoe_serial;
-       datasize = ((serial_size(&srl) -1) / CBLKSIZE + 1) * CBLKSIZE;
-
-       challengesize = ((strlen(id) + strlen(pass) + strlen(nonce) +
-                       4 * sizeof(short) - 1) / CBLKSIZE + 1) * CBLKSIZE;
-       challenge = alloca(challengesize);
-       if (make_challenge(id, pass, nonce, challenge, &challengesize))
-               return aoe_serial;
-
-       if (hmac(secret, secsize, challenge, challengesize,
-               key, &keysize)) return aoe_crypt;
-
-       if (*bufsize < datasize) return aoe_size;
-       if (encrypt(key, CBLKSIZE, data, buffer, datasize)) return aoe_crypt;
-       *bufsize = datasize;
+       if (serial_put(&srl, secret, secsize) != secsize) {
+               ao.err = "authobj: serialization of secret failed";
+       } else if (serial_put(&srl, payload, paysize) != paysize) {
+               ao.err = "authobj: serialization of payload failed";
+       } else if ((rc = hash(data, serial_size(&srl),
+                               datahash, &datahashsize))) {
+               ao.err = crypto_errstr(rc);
+       } else if (serial_put(&srl, datahash, datahashsize) != datahashsize) {
+               ao.err = "authobj: serialization of hash failed";
+       } else if (serial_put(&srl, NULL, 0) != 0) {
+               ao.err = "authobj: serialization of terminator failed";
+       }

 
 

-       return 0;
+       if (!ao.err) {
+               unsigned long lrc;
+               int osize = ((serial_size(&srl) -1) / CBLKSIZE + 1) * CBLKSIZE;
+
+               if ((ao.buffer = malloc(osize)) == NULL) {
+                       ao.err = "authobj: malloc failed";
+               } else if ((lrc = encrypt(key, CBLKSIZE, data,
+                                       ao.buffer, osize))) {
+                       ao.err = crypto_errstr(lrc);
+               } else {
+                       ao.authobj = ao.buffer;
+                       ao.authsize = osize;
+               }
+       }
+
+       memset(data, 0, datasize);
+       return ao;

 }
 
 }
 

-int parse_authobj(const unsigned char *key, const int keysize,
+static int parse_authobj(const unsigned char *key, const int keysize,

                const unsigned char *buffer, const int bufsize,
                unsigned char *secret, int *secsize,
                unsigned char *payload, int *paysize)
                const unsigned char *buffer, const int bufsize,
                unsigned char *secret, int *secsize,
                unsigned char *payload, int *paysize)


@@ -85,20 +140,90 @@ int parse_authobj(const unsigned char *key, const int keysize,
        int theirhashsize = HASHSIZE;
 
        if (decrypt(key, CBLKSIZE, buffer, data, datasize))
        int theirhashsize = HASHSIZE;
 
        if (decrypt(key, CBLKSIZE, buffer, data, datasize))

-               return aoe_crypt;
+               return 1;

        serial_init(&srl, data, datasize);
        tsize = *secsize;
        *secsize = serial_get(&srl, secret, tsize);
        serial_init(&srl, data, datasize);
        tsize = *secsize;
        *secsize = serial_get(&srl, secret, tsize);

-       if (*secsize > tsize || *secsize <= 0) return aoe_serial;
+       if (*secsize > tsize || *secsize <= 0) return 1;

        tsize = *paysize;
        *paysize = serial_get(&srl, payload, tsize);
        tsize = *paysize;
        *paysize = serial_get(&srl, payload, tsize);

-       if (*paysize > tsize || *paysize <= 0) return aoe_serial;
+       if (*paysize > tsize || *paysize <= 0) return 1;

        if (hash(data, serial_size(&srl), myhash, &myhashsize))
        if (hash(data, serial_size(&srl), myhash, &myhashsize))

-               return aoe_crypt;
+               return 1;

        theirhashsize = serial_get(&srl, theirhash, theirhashsize);
        theirhashsize = serial_get(&srl, theirhash, theirhashsize);

-       if (theirhashsize != HASHSIZE) return aoe_data;
+       if (theirhashsize != HASHSIZE) return 1;

        if ((myhashsize != theirhashsize) ||
            memcmp(myhash, theirhash, myhashsize))
        if ((myhashsize != theirhashsize) ||
            memcmp(myhash, theirhash, myhashsize))

-               return aoe_data;
+               return 1;

        return 0;
 }
        return 0;
 }

+
+struct _auth_obj new_authobj(const char *userid, const char *password,
+                               const char *nonce,
+                       const unsigned char *secret, const int secsize,
+                       const unsigned char *payload, const int paysize)
+{
+       struct _auth_obj ao = {0};
+       struct _hash_obj ho_chal, ho_key;
+
+       ho_chal = make_challenge(userid, password, nonce);
+       if (ho_chal.err) {
+               ao.err = ho_chal.err;
+               return ao;
+       }
+       ho_key = make_key(ho_chal.hash, sizeof(ho_chal.hash), secret, secsize);
+       if (ho_key.err) {
+               ao.err = ho_key.err;
+               return ao;
+       }
+       ao = make_authobj(ho_key.hash, sizeof(ho_key.hash),
+                       secret, secsize, payload, paysize);
+       memset(&ho_chal, 0, sizeof(ho_chal));
+       memset(&ho_key, 0, sizeof(ho_key));
+       return ao;
+}
+
+struct _auth_obj verify_authobj(const char *userid, const char *password,
+                               const char *oldnonce, const char *newnonce,
+                       const unsigned char *authobj, const int authsize)
+{
+       struct _auth_obj ao = {0};
+       struct _hash_obj ho_chal, ho_key;
+
+       ho_chal = make_challenge(userid, password, oldnonce);
+       if (ho_chal.err) {
+               ao.err = ho_chal.err;
+               return ao;
+       }
+       ho_key = fetch_key(ho_chal.hash, sizeof(ho_chal.hash));
+       if (ho_key.err) {
+               ao.err = ho_key.err;
+               return ao;
+       }
+       memset(&ho_chal, 0, sizeof(ho_chal));
+       memset(&ho_key, 0, sizeof(ho_key));
+       return ao;
+}
+
+struct _auth_obj reload_authobj(const char *userid, const char *password,
+                               const char *oldnonce, const char *newnonce,
+                       const unsigned char *authobj, const int authsize,
+                       const unsigned char *payload, const int paysize)
+{
+       struct _auth_obj ao = {0};
+       struct _hash_obj ho_chal, ho_key;
+
+       ho_chal = make_challenge(userid, password, oldnonce);
+       if (ho_chal.err) {
+               ao.err = ho_chal.err;
+               return ao;
+       }
+       ho_key = fetch_key(ho_chal.hash, sizeof(ho_chal.hash));
+       if (ho_key.err) {
+               ao.err = ho_key.err;
+               return ao;
+       }
+       memset(&ho_chal, 0, sizeof(ho_chal));
+       memset(&ho_key, 0, sizeof(ho_key));
+       return ao;
+}

diff --git a/authobj.h b/authobj.h
index cc5baedde5b827e5f12bc774f8dc6991c3dc2c22..b0756542671a0f68ff759e4d8b582b9c58283757 100644 (file)
--- a/authobj.h
+++ b/authobj.h
@@ -1,17 +1,30 @@
 #ifndef _AUTHOBJ_H
 #define _AUTHOBJ_H
 
 #ifndef _AUTHOBJ_H
 #define _AUTHOBJ_H
 

-enum aobj_err {aoe_serial, aoe_size, aoe_crypt, aoe_data};
+struct _auth_obj {
+       unsigned char *buffer;  /* to be free()'d if not NULL */
+       const char *err;        /* non-NULL if failed */
+       unsigned char *authobj;
+       int authsize;
+       unsigned char *payload;
+       int paylsize;
+};

 
 

-int make_challenge(const char *id, const char *pass, const char *nonce,
-               unsigned char *challenge, int *challengesize);
-int make_authobj(const char *id, const char *pass, const char *nonce,
-               const unsigned char *secret, const int secsize,
-               const unsigned char *payload, const int paysize,
-               unsigned char *buffer, int *bufsize);
-int parse_authobj(const unsigned char *key, const int keysize,
-               const unsigned char *buffer, const int bufsize,
-               unsigned char *secret, int *secsize,
-               unsigned char *payload, int *paysize);
+/* Construct new authobj from the given secret and other data */
+struct _auth_obj new_authobj(const char *userid, const char *password,
+                               const char *nonce,
+                       const unsigned char *secret, const int secsize,
+                       const unsigned char *payload, const int paysize);
+
+/* Unwrap old authobj, extract payload, construct new one with newnonce */
+struct _auth_obj verify_authobj(const char *userid, const char *password,
+                               const char *oldnonce, const char *newnonce,
+                       const unsigned char *authobj, const int authsize);
+
+/* Unwrap old authobj, replace the payload, construct new one with newnonce */
+struct _auth_obj reload_authobj(const char *userid, const char *password,
+                               const char *oldnonce, const char *newnonce,
+                       const unsigned char *authobj, const int authsize,
+                       const unsigned char *payload, const int paysize);

 
 #endif
 
 #endif