sshbcrypt.c

/*
 * 'bcrypt' password hash function, for PuTTY's import/export of
 * OpenSSH encrypted private key files.
 *
 * This is not really the same as the original bcrypt; OpenSSH has
 * modified it in various ways, and of course we have to do the same.
 */

#include <stddef.h>
#include <string.h>
#include "ssh.h"
#include "sshblowf.h"

BlowfishContext *bcrypt_setup(const unsigned char *key,
                              int keybytes,
                              const unsigned char *salt,
                              int saltbytes)
{
  int i;
  BlowfishContext *ctx;

  ctx = blowfish_make_context();
  blowfish_initkey(ctx);
  blowfish_expandkey(ctx, key, keybytes, salt, saltbytes);

  /* Original bcrypt replaces this fixed loop count with the
   * variable cost. OpenSSH instead iterates the whole thing more
   * than once if it wants extra rounds. */
  for (i = 0; i < 64; i++) {
    blowfish_expandkey(ctx, salt, saltbytes, NULL, 0);
    blowfish_expandkey(ctx, key, keybytes, NULL, 0);
  }

  return ctx;
}

void bcrypt_hash(const unsigned char *key,
                 int keybytes,
                 const unsigned char *salt,
                 int saltbytes,
                 unsigned char output[32])
{
  BlowfishContext *ctx;
  int i;

  ctx = bcrypt_setup(key, keybytes, salt, saltbytes);
  /* This was quite a nice starting string until it ran into
   * little-endian Blowfish :-/ */
  memcpy(output, "cyxOmorhcitawolBhsiftawSanyDetim", 32);
  for (i = 0; i < 64; i++) {
    blowfish_lsb_encrypt_ecb(output, 32, ctx);
  }
  blowfish_free_context(ctx);
}

void bcrypt_genblock(int counter,
                     const unsigned char hashed_passphrase[64],
                     const unsigned char *salt,
                     int saltbytes,
                     unsigned char output[32])
{
  SHA512_State shastate;
  unsigned char hashed_salt[64];
  unsigned char countbuf[4];

  /* Hash the input salt with the counter value optionally suffixed
   * to get our real 32-byte salt */
  SHA512_Init(&shastate);
  SHA512_Bytes(&shastate, salt, saltbytes);
  if (counter) {
    PUT_32BIT_MSB_FIRST(countbuf, counter);
    SHA512_Bytes(&shastate, countbuf, 4);
  }
  SHA512_Final(&shastate, hashed_salt);

  bcrypt_hash(hashed_passphrase, 64, hashed_salt, 64, output);

  smemclr(&shastate, sizeof(shastate));
  smemclr(&hashed_salt, sizeof(hashed_salt));
}

void openssh_bcrypt(const char *passphrase,
                    const unsigned char *salt,
                    int saltbytes,
                    int rounds,
                    unsigned char *out,
                    int outbytes)
{
  unsigned char hashed_passphrase[64];
  unsigned char block[32], outblock[32];
  const unsigned char *thissalt;
  int thissaltbytes;
  int modulus, residue, i, j, round;

  /* Hash the passphrase to get the bcrypt key material */
  SHA512_Simple(passphrase, strlen(passphrase), hashed_passphrase);

  /* We output key bytes in a scattered fashion to meld all output
   * key blocks into all parts of the output. To do this, we pick a
   * modulus, and we output the key bytes to indices of out[] in the
   * following order: first the indices that are multiples of the
   * modulus, then the ones congruent to 1 mod modulus, etc. Each of
   * those passes consumes exactly one block output from
   * bcrypt_genblock, so we must pick a modulus large enough that at
   * most 32 bytes are used in the pass. */
  modulus = (outbytes + 31) / 32;

  for (residue = 0; residue < modulus; residue++) {
    /* Our output block of data is the XOR of all blocks generated
     * by bcrypt in the following loop */
    memset(outblock, 0, sizeof(outblock));

    thissalt = salt;
    thissaltbytes = saltbytes;
    for (round = 0; round < rounds; round++) {
      bcrypt_genblock(round == 0 ? residue + 1 : 0,
                      hashed_passphrase,
                      thissalt,
                      thissaltbytes,
                      block);
      /* Each subsequent bcrypt call reuses the previous one's
       * output as its salt */
      thissalt = block;
      thissaltbytes = 32;

      for (i = 0; i < 32; i++)
        outblock[i] ^= block[i];
    }

    for (i = residue, j = 0; i < outbytes; i += modulus, j++)
      out[i] = outblock[j];
  }
  smemclr(&hashed_passphrase, sizeof(hashed_passphrase));
}