Head

GCC Code Coverage Report

Directory:	./		Exec	Total	Coverage
File:	usr.sbin/radiusctl/chap_ms.c	Lines:	0	124	0.0 %
Date:	2017-11-07	Branches:	0	10	0.0 %


/*	$OpenBSD: chap_ms.c,v 1.1 2015/07/21 04:06:04 yasuoka Exp $	*/

/*
 * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org>
 * Copyright (c) 1997-2001 Brian Somers <brian@Awfulhak.org>
 * Copyright (c) 1997 Gabor Kincses <gabor@acm.org>
 * Copyright (c) 1995 Eric Rosenquist
 *
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
  */

#include <sys/types.h>

#include <ctype.h>
#include <string.h>
#include <stdio.h>

#include <openssl/evp.h>
#include <openssl/des.h>
#include <openssl/md4.h>
#include <openssl/md5.h>
#include <openssl/sha.h>

#include "chap_ms.h"

/*
 * Documentation & specifications:
 *
 * MS-CHAP (CHAP80)	RFC2433
 * MS-CHAP-V2 (CHAP81)	RFC2759
 * MPPE key management	RFC3079
 *
 * Security analysis:
 * Schneier/Mudge/Wagner, "MS-CHAP-v2", Oct 99
 * "It is unclear to us why this protocol is so complicated."
 */

static u_int8_t sha1_pad1[40] = {
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};

static u_int8_t sha1_pad2[40] = {
	0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
	0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
	0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
	0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2
};

u_int8_t	 get7bits(u_int8_t *, int);
void		 mschap_des_addparity(u_int8_t *, u_int8_t *);
void		 mschap_des_encrypt(u_int8_t *, u_int8_t *, u_int8_t *);
void		 mschap_challenge_response(u_int8_t *, u_int8_t *, u_int8_t *);

u_int8_t
get7bits(u_int8_t *in, int start)
{
	u_int	 word;

	word = (u_int)in[start / 8] << 8;
	word |= (u_int)in[start / 8 + 1];
	word >>= 15 - (start % 8 + 7);

	return (word & 0xfe);
}

/* IN  56 bit DES key missing parity bits
   OUT 64 bit DES key with parity bits added */
void
mschap_des_addparity(u_int8_t *key, u_int8_t *des_key)
{
	des_key[0] = get7bits(key,  0);
	des_key[1] = get7bits(key,  7);
	des_key[2] = get7bits(key, 14);
	des_key[3] = get7bits(key, 21);
	des_key[4] = get7bits(key, 28);
	des_key[5] = get7bits(key, 35);
	des_key[6] = get7bits(key, 42);
	des_key[7] = get7bits(key, 49);

	DES_set_odd_parity((DES_cblock *)des_key);
}

void
mschap_des_encrypt(u_int8_t *clear, u_int8_t *key, u_int8_t *cipher)
{
	DES_cblock		des_key;
	DES_key_schedule	key_schedule;

	mschap_des_addparity(key, des_key);

	DES_set_key(&des_key, &key_schedule);
	DES_ecb_encrypt((DES_cblock *)clear, (DES_cblock *)cipher,
	    &key_schedule, 1);
}

void
mschap_challenge_response(u_int8_t *challenge, u_int8_t *pwhash,
    u_int8_t *response)
{
	u_int8_t	 padpwhash[21 + 1];

	bzero(&padpwhash, sizeof(padpwhash));
	memcpy(padpwhash, pwhash, MSCHAP_HASH_SZ);

	mschap_des_encrypt(challenge, padpwhash + 0, response + 0);
	mschap_des_encrypt(challenge, padpwhash + 7, response + 8);
	mschap_des_encrypt(challenge, padpwhash + 14, response + 16);
}

void
mschap_ntpassword_hash(u_int8_t *in, int inlen, u_int8_t *hash)
{
	EVP_MD_CTX	 ctx;
	u_int		 mdlen;

	EVP_DigestInit(&ctx, EVP_md4());
	EVP_DigestUpdate(&ctx, in, inlen);
	EVP_DigestFinal(&ctx, hash, &mdlen);
}

void
mschap_challenge_hash(u_int8_t *peer_challenge, u_int8_t *auth_challenge,
    u_int8_t *username, int usernamelen, u_int8_t *challenge)
{
	EVP_MD_CTX	 ctx;
	u_int8_t	 md[SHA_DIGEST_LENGTH];
	u_int		 mdlen;
	u_int8_t	*name;

	if ((name = strrchr(username, '\\')) == NULL)
		name = username;
	else
		name++;

	EVP_DigestInit(&ctx, EVP_sha1());
	EVP_DigestUpdate(&ctx, peer_challenge, MSCHAPV2_CHALLENGE_SZ);
	EVP_DigestUpdate(&ctx, auth_challenge, MSCHAPV2_CHALLENGE_SZ);
	EVP_DigestUpdate(&ctx, name, strlen(name));
	EVP_DigestFinal(&ctx, md, &mdlen);

	memcpy(challenge, md, MSCHAP_CHALLENGE_SZ);
}

void
mschap_nt_response(u_int8_t *auth_challenge, u_int8_t *peer_challenge,
    u_int8_t *username, int usernamelen, u_int8_t *password, int passwordlen,
    u_int8_t *response)
{
	u_int8_t challenge[MSCHAP_CHALLENGE_SZ];
	u_int8_t password_hash[MSCHAP_HASH_SZ];

	mschap_challenge_hash(peer_challenge, auth_challenge,
	    username, usernamelen, challenge);

	mschap_ntpassword_hash(password, passwordlen, password_hash);
	mschap_challenge_response(challenge, password_hash, response);
}

void
mschap_auth_response(u_int8_t *password, int passwordlen,
    u_int8_t *ntresponse, u_int8_t *auth_challenge, u_int8_t *peer_challenge,
    u_int8_t *username, int usernamelen, u_int8_t *auth_response)
{
	EVP_MD_CTX	 ctx;
	u_int8_t	 password_hash[MSCHAP_HASH_SZ];
	u_int8_t	 password_hash2[MSCHAP_HASH_SZ];
	u_int8_t	 challenge[MSCHAP_CHALLENGE_SZ];
	u_int8_t	 md[SHA_DIGEST_LENGTH], *ptr;
	u_int		 mdlen;
	int		 i;
	const u_int8_t	 hex[] = "0123456789ABCDEF";
	static u_int8_t	 magic1[39] = {
		0x4D, 0x61, 0x67, 0x69, 0x63, 0x20, 0x73, 0x65, 0x72, 0x76,
		0x65, 0x72, 0x20, 0x74, 0x6F, 0x20, 0x63, 0x6C, 0x69, 0x65,
		0x6E, 0x74, 0x20, 0x73, 0x69, 0x67, 0x6E, 0x69, 0x6E, 0x67,
		0x20, 0x63, 0x6F, 0x6E, 0x73, 0x74, 0x61, 0x6E, 0x74
	};
	static u_int8_t	 magic2[41] = {
		0x50, 0x61, 0x64, 0x20, 0x74, 0x6F, 0x20, 0x6D, 0x61, 0x6B,
		0x65, 0x20, 0x69, 0x74, 0x20, 0x64, 0x6F, 0x20, 0x6D, 0x6F,
		0x72, 0x65, 0x20, 0x74, 0x68, 0x61, 0x6E, 0x20, 0x6F, 0x6E,
		0x65, 0x20, 0x69, 0x74, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6F,
		0x6E
	};

	mschap_ntpassword_hash(password, passwordlen, password_hash);
	mschap_ntpassword_hash(password_hash, MSCHAP_HASH_SZ, password_hash2);

	EVP_DigestInit(&ctx, EVP_sha1());
	EVP_DigestUpdate(&ctx, password_hash2, sizeof(password_hash2));
	EVP_DigestUpdate(&ctx, ntresponse, 24);
	EVP_DigestUpdate(&ctx, magic1, 39);
	EVP_DigestFinal(&ctx, md, &mdlen);

	mschap_challenge_hash(peer_challenge, auth_challenge,
	    username, usernamelen, challenge);

	EVP_DigestInit(&ctx, EVP_sha1());
	EVP_DigestUpdate(&ctx, md, sizeof(md));
	EVP_DigestUpdate(&ctx, challenge, sizeof(challenge));
	EVP_DigestUpdate(&ctx, magic2, 41);
	EVP_DigestFinal(&ctx, md, &mdlen);

	/*
	 * Encode the value of 'Digest' as "S=" followed by
	 * 40 ASCII hexadecimal digits and return it in
	 * AuthenticatorResponse.
	 * For example,
	 *   "S=0123456789ABCDEF0123456789ABCDEF01234567"
	 */
	ptr = auth_response;
	*ptr++ = 'S';
	*ptr++ = '=';
	for (i = 0; i < SHA_DIGEST_LENGTH; i++) {
		*ptr++ = hex[md[i] >> 4];
		*ptr++ = hex[md[i] & 0x0f];
	}
}

void
mschap_masterkey(u_int8_t *password_hash2, u_int8_t *ntresponse,
    u_int8_t *masterkey)
{
	u_int8_t	 md[SHA_DIGEST_LENGTH];
	u_int		 mdlen;
	EVP_MD_CTX	 ctx;
	static u_int8_t	 magic1[27] = {
		0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74,
		0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d,
		0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79
	};

	EVP_DigestInit(&ctx, EVP_sha1());
	EVP_DigestUpdate(&ctx, password_hash2, MSCHAP_HASH_SZ);
	EVP_DigestUpdate(&ctx, ntresponse, 24);
	EVP_DigestUpdate(&ctx, magic1, 27);
	EVP_DigestFinal(&ctx, md, &mdlen);

	memcpy(masterkey, md, 16);
}

void
mschap_asymetric_startkey(u_int8_t *masterkey, u_int8_t *sessionkey,
    int sessionkeylen, int issend, int isserver)
{
	EVP_MD_CTX	 ctx;
	u_int8_t	 md[SHA_DIGEST_LENGTH];
	u_int		 mdlen;
	u_int8_t	*s;
	static u_int8_t	 magic2[84] = {
		0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
		0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
		0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
		0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79,
		0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73,
		0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65,
		0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
		0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
		0x6b, 0x65, 0x79, 0x2e
	};
	static u_int8_t	 magic3[84] = {
		0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
		0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
		0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
		0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
		0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68,
		0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73,
		0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73,
		0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20,
		0x6b, 0x65, 0x79, 0x2e
	};

	if (issend)
		s = isserver ? magic3 : magic2;
	else
		s = isserver ? magic2 : magic3;

	EVP_DigestInit(&ctx, EVP_sha1());
	EVP_DigestUpdate(&ctx, masterkey, 16);
	EVP_DigestUpdate(&ctx, sha1_pad1, 40);
	EVP_DigestUpdate(&ctx, s, 84);
	EVP_DigestUpdate(&ctx, sha1_pad2, 40);
	EVP_DigestFinal(&ctx, md, &mdlen);

	memcpy(sessionkey, md, sessionkeylen);
}

void
mschap_msk(u_int8_t *password, int passwordlen,
    u_int8_t *ntresponse, u_int8_t *msk)
{
	u_int8_t	 password_hash[MSCHAP_HASH_SZ];
	u_int8_t	 password_hash2[MSCHAP_HASH_SZ];
	u_int8_t	 masterkey[MSCHAP_MASTERKEY_SZ];
	u_int8_t	 sendkey[MSCHAP_MASTERKEY_SZ];
	u_int8_t	 recvkey[MSCHAP_MASTERKEY_SZ];

	mschap_ntpassword_hash(password, passwordlen, password_hash);
	mschap_ntpassword_hash(password_hash, MSCHAP_HASH_SZ, password_hash2);

	mschap_masterkey(password_hash2, ntresponse, masterkey);
	mschap_asymetric_startkey(masterkey, recvkey, sizeof(recvkey), 0, 1);
	mschap_asymetric_startkey(masterkey, sendkey, sizeof(sendkey), 1, 1);

	/* 16 bytes receive key + 16 bytes send key + 32 bytes 0 padding */
	bzero(msk, MSCHAP_MSK_SZ);
	memcpy(msk, &recvkey, sizeof(recvkey));
	memcpy(msk + sizeof(recvkey), &sendkey, sizeof(sendkey));
}

void
mschap_radiuskey(u_int8_t *plain, const u_int8_t *crypted,
    const u_int8_t *authenticator, const u_int8_t *secret)
{
	EVP_MD_CTX	 ctx;
	u_int8_t	 b[MD5_DIGEST_LENGTH], p[32];
	u_int		 i, mdlen;

	EVP_DigestInit(&ctx, EVP_md5());
	EVP_DigestUpdate(&ctx, secret, strlen(secret));
	EVP_DigestUpdate(&ctx, authenticator, 16);
	EVP_DigestUpdate(&ctx, crypted, 2);
	EVP_DigestFinal(&ctx, b, &mdlen);

	for (i = 0; i < mdlen; i++) {
		p[i] = b[i] ^ crypted[i+2];
	}

	EVP_DigestInit(&ctx, EVP_md5());
	EVP_DigestUpdate(&ctx, secret, strlen(secret));
	EVP_DigestUpdate(&ctx, crypted + 2, mdlen);
	EVP_DigestFinal(&ctx, b, &mdlen);

	for (i = 0; i < mdlen; i++) {
		p[i+16] = b[i] ^ crypted[i+18];
	}

	memcpy(plain, p+1, 16);
}


Generated by: GCOVR (Version 3.3)

Line	Branch	Exec	Source
1			/* $OpenBSD: chap_ms.c,v 1.1 2015/07/21 04:06:04 yasuoka Exp $ */
2
3			/*
4			* Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org>
5			* Copyright (c) 1997-2001 Brian Somers <brian@Awfulhak.org>
6			* Copyright (c) 1997 Gabor Kincses <gabor@acm.org>
7			* Copyright (c) 1995 Eric Rosenquist
8			*
9			* All rights reserved.
10			*
11			* Redistribution and use in source and binary forms, with or without
12			* modification, are permitted provided that the following conditions
13			* are met:
14			* 1. Redistributions of source code must retain the above copyright
15			* notice, this list of conditions and the following disclaimer.
16			* 2. Redistributions in binary form must reproduce the above copyright
17			* notice, this list of conditions and the following disclaimer in the
18			* documentation and/or other materials provided with the distribution.
19			*
20			* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
21			* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22			* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23			* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
24			* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25			* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26			* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27			* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28			* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29			* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30			* SUCH DAMAGE.
31			*/
32
33			#include <sys/types.h>
34
35			#include <ctype.h>
36			#include <string.h>
37			#include <stdio.h>
38
39			#include <openssl/evp.h>
40			#include <openssl/des.h>
41			#include <openssl/md4.h>
42			#include <openssl/md5.h>
43			#include <openssl/sha.h>
44
45			#include "chap_ms.h"
46
47			/*
48			* Documentation & specifications:
49			*
50			* MS-CHAP (CHAP80) RFC2433
51			* MS-CHAP-V2 (CHAP81) RFC2759
52			* MPPE key management RFC3079
53			*
54			* Security analysis:
55			* Schneier/Mudge/Wagner, "MS-CHAP-v2", Oct 99
56			* "It is unclear to us why this protocol is so complicated."
57			*/
58
59			static u_int8_t sha1_pad1[40] = {
60			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
61			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
62			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
63			0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
64			};
65
66			static u_int8_t sha1_pad2[40] = {
67			0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
68			0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
69			0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
70			0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2
71			};
72
73			u_int8_t get7bits(u_int8_t *, int);
74			void mschap_des_addparity(u_int8_t , u_int8_t );
75			void mschap_des_encrypt(u_int8_t , u_int8_t , u_int8_t *);
76			void mschap_challenge_response(u_int8_t , u_int8_t , u_int8_t *);
77
78			u_int8_t
79			get7bits(u_int8_t *in, int start)
80			{
81			u_int word;
82
83			word = (u_int)in[start / 8] << 8;
84			word \|= (u_int)in[start / 8 + 1];
85			word >>= 15 - (start % 8 + 7);
86
87			return (word & 0xfe);
88			}
89
90			/* IN 56 bit DES key missing parity bits
91			OUT 64 bit DES key with parity bits added */
92			void
93			mschap_des_addparity(u_int8_t key, u_int8_t des_key)
94			{
95			des_key[0] = get7bits(key, 0);
96			des_key[1] = get7bits(key, 7);
97			des_key[2] = get7bits(key, 14);
98			des_key[3] = get7bits(key, 21);
99			des_key[4] = get7bits(key, 28);
100			des_key[5] = get7bits(key, 35);
101			des_key[6] = get7bits(key, 42);
102			des_key[7] = get7bits(key, 49);
103
104			DES_set_odd_parity((DES_cblock *)des_key);
105			}
106
107			void
108			mschap_des_encrypt(u_int8_t clear, u_int8_t key, u_int8_t *cipher)
109			{
110			DES_cblock des_key;
111			DES_key_schedule key_schedule;
112
113			mschap_des_addparity(key, des_key);
114
115			DES_set_key(&des_key, &key_schedule);
116			DES_ecb_encrypt((DES_cblock )clear, (DES_cblock )cipher,
117			&key_schedule, 1);
118			}
119
120			void
121			mschap_challenge_response(u_int8_t challenge, u_int8_t pwhash,
122			u_int8_t *response)
123			{
124			u_int8_t padpwhash[21 + 1];
125
126			bzero(&padpwhash, sizeof(padpwhash));
127			memcpy(padpwhash, pwhash, MSCHAP_HASH_SZ);
128
129			mschap_des_encrypt(challenge, padpwhash + 0, response + 0);
130			mschap_des_encrypt(challenge, padpwhash + 7, response + 8);
131			mschap_des_encrypt(challenge, padpwhash + 14, response + 16);
132			}
133
134			void
135			mschap_ntpassword_hash(u_int8_t in, int inlen, u_int8_t hash)
136			{
137			EVP_MD_CTX ctx;
138			u_int mdlen;
139
140			EVP_DigestInit(&ctx, EVP_md4());
141			EVP_DigestUpdate(&ctx, in, inlen);
142			EVP_DigestFinal(&ctx, hash, &mdlen);
143			}
144
145			void
146			mschap_challenge_hash(u_int8_t peer_challenge, u_int8_t auth_challenge,
147			u_int8_t username, int usernamelen, u_int8_t challenge)
148			{
149			EVP_MD_CTX ctx;
150			u_int8_t md[SHA_DIGEST_LENGTH];
151			u_int mdlen;
152			u_int8_t *name;
153
154			if ((name = strrchr(username, '\\')) == NULL)
155			name = username;
156			else
157			name++;
158
159			EVP_DigestInit(&ctx, EVP_sha1());
160			EVP_DigestUpdate(&ctx, peer_challenge, MSCHAPV2_CHALLENGE_SZ);
161			EVP_DigestUpdate(&ctx, auth_challenge, MSCHAPV2_CHALLENGE_SZ);
162			EVP_DigestUpdate(&ctx, name, strlen(name));
163			EVP_DigestFinal(&ctx, md, &mdlen);
164
165			memcpy(challenge, md, MSCHAP_CHALLENGE_SZ);
166			}
167
168			void
169			mschap_nt_response(u_int8_t auth_challenge, u_int8_t peer_challenge,
170			u_int8_t username, int usernamelen, u_int8_t password, int passwordlen,
171			u_int8_t *response)
172			{
173			u_int8_t challenge[MSCHAP_CHALLENGE_SZ];
174			u_int8_t password_hash[MSCHAP_HASH_SZ];
175
176			mschap_challenge_hash(peer_challenge, auth_challenge,
177			username, usernamelen, challenge);
178
179			mschap_ntpassword_hash(password, passwordlen, password_hash);
180			mschap_challenge_response(challenge, password_hash, response);
181			}
182
183			void
184			mschap_auth_response(u_int8_t *password, int passwordlen,
185			u_int8_t ntresponse, u_int8_t auth_challenge, u_int8_t *peer_challenge,
186			u_int8_t username, int usernamelen, u_int8_t auth_response)
187			{
188			EVP_MD_CTX ctx;
189			u_int8_t password_hash[MSCHAP_HASH_SZ];
190			u_int8_t password_hash2[MSCHAP_HASH_SZ];
191			u_int8_t challenge[MSCHAP_CHALLENGE_SZ];
192			u_int8_t md[SHA_DIGEST_LENGTH], *ptr;
193			u_int mdlen;
194			int i;
195			const u_int8_t hex[] = "0123456789ABCDEF";
196			static u_int8_t magic1[39] = {
197			0x4D, 0x61, 0x67, 0x69, 0x63, 0x20, 0x73, 0x65, 0x72, 0x76,
198			0x65, 0x72, 0x20, 0x74, 0x6F, 0x20, 0x63, 0x6C, 0x69, 0x65,
199			0x6E, 0x74, 0x20, 0x73, 0x69, 0x67, 0x6E, 0x69, 0x6E, 0x67,
200			0x20, 0x63, 0x6F, 0x6E, 0x73, 0x74, 0x61, 0x6E, 0x74
201			};
202			static u_int8_t magic2[41] = {
203			0x50, 0x61, 0x64, 0x20, 0x74, 0x6F, 0x20, 0x6D, 0x61, 0x6B,
204			0x65, 0x20, 0x69, 0x74, 0x20, 0x64, 0x6F, 0x20, 0x6D, 0x6F,
205			0x72, 0x65, 0x20, 0x74, 0x68, 0x61, 0x6E, 0x20, 0x6F, 0x6E,
206			0x65, 0x20, 0x69, 0x74, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6F,
207			0x6E
208			};
209
210			mschap_ntpassword_hash(password, passwordlen, password_hash);
211			mschap_ntpassword_hash(password_hash, MSCHAP_HASH_SZ, password_hash2);
212
213			EVP_DigestInit(&ctx, EVP_sha1());
214			EVP_DigestUpdate(&ctx, password_hash2, sizeof(password_hash2));
215			EVP_DigestUpdate(&ctx, ntresponse, 24);
216			EVP_DigestUpdate(&ctx, magic1, 39);
217			EVP_DigestFinal(&ctx, md, &mdlen);
218
219			mschap_challenge_hash(peer_challenge, auth_challenge,
220			username, usernamelen, challenge);
221
222			EVP_DigestInit(&ctx, EVP_sha1());
223			EVP_DigestUpdate(&ctx, md, sizeof(md));
224			EVP_DigestUpdate(&ctx, challenge, sizeof(challenge));
225			EVP_DigestUpdate(&ctx, magic2, 41);
226			EVP_DigestFinal(&ctx, md, &mdlen);
227
228			/*
229			* Encode the value of 'Digest' as "S=" followed by
230			* 40 ASCII hexadecimal digits and return it in
231			* AuthenticatorResponse.
232			* For example,
233			* "S=0123456789ABCDEF0123456789ABCDEF01234567"
234			*/
235			ptr = auth_response;
236			*ptr++ = 'S';
237			*ptr++ = '=';
238			for (i = 0; i < SHA_DIGEST_LENGTH; i++) {
239			*ptr++ = hex[md[i] >> 4];
240			*ptr++ = hex[md[i] & 0x0f];
241			}
242			}
243
244			void
245			mschap_masterkey(u_int8_t password_hash2, u_int8_t ntresponse,
246			u_int8_t *masterkey)
247			{
248			u_int8_t md[SHA_DIGEST_LENGTH];
249			u_int mdlen;
250			EVP_MD_CTX ctx;
251			static u_int8_t magic1[27] = {
252			0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74,
253			0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d,
254			0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79
255			};
256
257			EVP_DigestInit(&ctx, EVP_sha1());
258			EVP_DigestUpdate(&ctx, password_hash2, MSCHAP_HASH_SZ);
259			EVP_DigestUpdate(&ctx, ntresponse, 24);
260			EVP_DigestUpdate(&ctx, magic1, 27);
261			EVP_DigestFinal(&ctx, md, &mdlen);
262
263			memcpy(masterkey, md, 16);
264			}
265
266			void
267			mschap_asymetric_startkey(u_int8_t masterkey, u_int8_t sessionkey,
268			int sessionkeylen, int issend, int isserver)
269			{
270			EVP_MD_CTX ctx;
271			u_int8_t md[SHA_DIGEST_LENGTH];
272			u_int mdlen;
273			u_int8_t *s;
274			static u_int8_t magic2[84] = {
275			0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
276			0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
277			0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
278			0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79,
279			0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73,
280			0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65,
281			0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
282			0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
283			0x6b, 0x65, 0x79, 0x2e
284			};
285			static u_int8_t magic3[84] = {
286			0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
287			0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
288			0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
289			0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
290			0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68,
291			0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73,
292			0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73,
293			0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20,
294			0x6b, 0x65, 0x79, 0x2e
295			};
296
297			if (issend)
298			s = isserver ? magic3 : magic2;
299			else
300			s = isserver ? magic2 : magic3;
301
302			EVP_DigestInit(&ctx, EVP_sha1());
303			EVP_DigestUpdate(&ctx, masterkey, 16);
304			EVP_DigestUpdate(&ctx, sha1_pad1, 40);
305			EVP_DigestUpdate(&ctx, s, 84);
306			EVP_DigestUpdate(&ctx, sha1_pad2, 40);
307			EVP_DigestFinal(&ctx, md, &mdlen);
308
309			memcpy(sessionkey, md, sessionkeylen);
310			}
311
312			void
313			mschap_msk(u_int8_t *password, int passwordlen,
314			u_int8_t ntresponse, u_int8_t msk)
315			{
316			u_int8_t password_hash[MSCHAP_HASH_SZ];
317			u_int8_t password_hash2[MSCHAP_HASH_SZ];
318			u_int8_t masterkey[MSCHAP_MASTERKEY_SZ];
319			u_int8_t sendkey[MSCHAP_MASTERKEY_SZ];
320			u_int8_t recvkey[MSCHAP_MASTERKEY_SZ];
321
322			mschap_ntpassword_hash(password, passwordlen, password_hash);
323			mschap_ntpassword_hash(password_hash, MSCHAP_HASH_SZ, password_hash2);
324
325			mschap_masterkey(password_hash2, ntresponse, masterkey);
326			mschap_asymetric_startkey(masterkey, recvkey, sizeof(recvkey), 0, 1);
327			mschap_asymetric_startkey(masterkey, sendkey, sizeof(sendkey), 1, 1);
328
329			/* 16 bytes receive key + 16 bytes send key + 32 bytes 0 padding */
330			bzero(msk, MSCHAP_MSK_SZ);
331			memcpy(msk, &recvkey, sizeof(recvkey));
332			memcpy(msk + sizeof(recvkey), &sendkey, sizeof(sendkey));
333			}
334
335			void
336			mschap_radiuskey(u_int8_t plain, const u_int8_t crypted,
337			const u_int8_t authenticator, const u_int8_t secret)
338			{
339			EVP_MD_CTX ctx;
340			u_int8_t b[MD5_DIGEST_LENGTH], p[32];
341			u_int i, mdlen;
342
343			EVP_DigestInit(&ctx, EVP_md5());
344			EVP_DigestUpdate(&ctx, secret, strlen(secret));
345			EVP_DigestUpdate(&ctx, authenticator, 16);
346			EVP_DigestUpdate(&ctx, crypted, 2);
347			EVP_DigestFinal(&ctx, b, &mdlen);
348
349			for (i = 0; i < mdlen; i++) {
350			p[i] = b[i] ^ crypted[i+2];
351			}
352
353			EVP_DigestInit(&ctx, EVP_md5());
354			EVP_DigestUpdate(&ctx, secret, strlen(secret));
355			EVP_DigestUpdate(&ctx, crypted + 2, mdlen);
356			EVP_DigestFinal(&ctx, b, &mdlen);
357
358			for (i = 0; i < mdlen; i++) {
359			p[i+16] = b[i] ^ crypted[i+18];
360			}
361
362			memcpy(plain, p+1, 16);
363			}