Adding upstream version 2.2.40.upstream/2.2.40

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 613 insertions, 0 deletions

diff --git a/g10/t-stutter.c b/g10/t-stutter.c
new file mode 100644
index 0000000..503a920
--- /dev/null
+++ b/g10/t-stutter.c
@@ -0,0 +1,613 @@
+/* t-stutter.c - Test the stutter exploit.
+ * Copyright (C) 2016 g10 Code GmbH
+ *
+ * This file is part of GnuPG.
+ *
+ * GnuPG is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuPG is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <https://www.gnu.org/licenses/>.
+ */
+
+/* This test is based on the paper: "An Attack on CFB Mode Encryption
+ * as Used by OpenPGP."  This attack uses a padding oracle to decrypt
+ * the first two bytes of each block (which are normally 16 bytes
+ * large).  Concretely, if an attacker can use this attack if it can
+ * sense whether the quick integrity check failed.  See RFC 4880,
+ * Section 5.7 for an explanation of this quick check.
+ *
+ * The concrete attack, as described in the paper, only works for
+ * PKT_ENCRYPTED packets; it does not work for PKT_ENCRYPTED_MDC
+ * packets, which use a slightly different CFB mode (they don't
+ * include a sync after the IV).  But, small modifications should
+ * allow the attack to work for PKT_ENCRYPTED_MDC packets.
+ *
+ * The cost of this attack is 2^15 + i * 2^15 oracle queries, where i
+ * is the number of blocks the attack wants to decrypt.  This attack
+ * is completely unfeasible when gpg is used interactively, but it
+ * could work when used as a service.
+ *
+ * How to generate a test message:
+ *
+ *   $ echo 0123456789abcdefghijklmnopqrstuvwxyz | \
+ *         gpg --disable-mdc -z 0 -c  > msg.asc
+ *   $ gpg --list-packets msg.asc
+ *   # Make sure the encryption packet contains a literal packet (without
+ *   # any nesting).
+ *   $ gpgsplit msg.asc
+ *   $ gpg --show-session-key -d msg.asc
+ *   $ ./t-stutter --debug SESSION_KEY 000002-009.encrypted
+ */
+
+#include <config.h>
+#include <errno.h>
+#include <ctype.h>
+
+#include "gpg.h"
+#include "main.h"
+#include "../common/types.h"
+#include "../common/util.h"
+#include "dek.h"
+#include "../common/logging.h"
+
+#include "test.c"
+
+static void
+log_hexdump (byte *buffer, int length)
+{
+  int written = 0;
+
+  fprintf (stderr, "%d bytes:\n", length);
+  while (length > 0)
+    {
+      int have = length > 16 ? 16 : length;
+      int i;
+      char formatted[2 * 16 + 1];
+      char text[16 + 1];
+
+      fprintf (stderr, "%-8d ", written);
+      bin2hex (buffer, have, formatted);
+      for (i = 0; i < 16; i ++)
+        {
+          if (i % 2 == 0)
+            fputc (' ', stderr);
+          if (i % 8 == 0)
+            fputc (' ', stderr);
+
+          if (i < have)
+            fwrite (&formatted[2 * i], 2, 1, stderr);
+          else
+            fwrite ("  ", 2, 1, stderr);
+        }
+
+      for (i = 0; i < have; i ++)
+        {
+          if (isprint (buffer[i]))
+            text[i] = buffer[i];
+          else
+            text[i] = '.';
+        }
+      text[i] = 0;
+
+      fprintf (stderr, "    ");
+      if (strlen (text) > 8)
+        {
+          fwrite (text, 8, 1, stderr);
+          fputc (' ', stderr);
+          fwrite (&text[8], strlen (text) - 8, 1, stderr);
+        }
+      else
+        fwrite (text, strlen (text), 1, stderr);
+      fputc ('\n', stderr);
+
+      buffer += have;
+      length -= have;
+      written += have;
+    }
+
+  return;
+}
+
+static char *
+hexstr (const byte *bytes)
+{
+  static int i;
+  static char bufs[100][7];
+
+  i ++;
+  if (i == 100)
+    i = 0;
+
+  sprintf (bufs[i], "0x%02X%02X", bytes[0], bytes[1]);
+  return bufs[i];
+}
+
+/* xor the two bytes starting at A with the two bytes starting at B
+   and return the result.  */
+static byte *
+bufxor2 (const byte *a, const byte *b)
+{
+  static int i;
+  static char bufs[100][2];
+
+  i ++;
+  if (i == 100)
+    i = 0;
+
+  bufs[i][0] = a[0] ^ b[0];
+  bufs[i][1] = a[1] ^ b[1];
+  return bufs[i];
+}
+
+/* The session key stays constant.  */
+static DEK dek;
+int blocksize;
+
+/* Decode the session key, which is in the format output by gpg
+   --show-session-key.  */
+static void
+parse_session_key (char *session_key)
+{
+  char *tail;
+  char *p = session_key;
+
+  errno = 0;
+  dek.algo = strtol (p, &tail, 10);
+  if (errno || (tail && *tail != ':'))
+    log_fatal ("Invalid session key specification.  "
+               "Expected: cipher-id:HEXADECIMAL-CHRACTERS\n");
+
+  /* Skip the ':'.  */
+  p = tail + 1;
+
+  if (strlen (p) % 2 != 0)
+    log_fatal ("Session key must consist of an even number of hexadecimal characters.\n");
+
+  dek.keylen = strlen (p) / 2;
+  log_assert (dek.keylen <= sizeof (dek.key));
+
+  if (hex2bin (p, dek.key, dek.keylen) == -1)
+    log_fatal ("Session key must only contain hexadecimal characters\n");
+
+  blocksize = openpgp_cipher_get_algo_blklen (dek.algo);
+  if ( !blocksize || blocksize > 16 )
+    log_fatal ("unsupported blocksize %u\n", blocksize );
+
+  return;
+}
+
+/* The ciphertext, the plaintext as decrypted by the good session key,
+   and the cfb stream (derived from the ciphertext and the
+   plaintext).  */
+static int msg_len;
+static byte *msg;
+static byte *msg_plaintext;
+static byte *msg_cfb;
+
+/* Whether we need to resynchronize the CFB after writing the random
+   data (this is the case for encrypted packets, but not encrypted and
+   integrity protected packets).  */
+static int sync;
+
+static int
+block_offset (int i)
+{
+  int extra = 0;
+
+  log_assert (i >= 1);
+  /* Make sure blocksize has been initialized.  */
+  log_assert (blocksize);
+
+  if (i > 2)
+    {
+      i -= 2;
+      extra = blocksize + 2;
+    }
+  return (i - 1) * blocksize + extra;
+}
+
+/* Return the ith block from TEXT.  The first block is labeled 1.
+   Note: consistent with the OpenPGP message format, the second block
+   (i=2) is just 2 bytes.  */
+static byte *
+block (byte *text, int len, int i)
+{
+  int offset = block_offset (i);
+
+  log_assert (offset < len);
+  return &text[offset];
+}
+
+/* Return true if the quick integrity check passes.  Also, if
+   PLAINTEXTP is not NULL, return the decrypted plaintext in
+   *PLAINTEXTP.  If CFBP is not NULL, return the CFB byte stream in
+   *CFBP.  */
+static int
+oracle (int debug, byte *ciphertext, int len, byte **plaintextp, byte **cfbp)
+{
+  int rc = 0;
+  unsigned nprefix;
+  gcry_cipher_hd_t cipher_hd = NULL;
+  byte *plaintext = NULL;
+  byte *cfb = NULL;
+
+  /* Make sure DEK was initialized.  */
+  log_assert (dek.algo);
+  log_assert (dek.keylen);
+  log_assert (blocksize);
+
+  nprefix = blocksize;
+  if (len < nprefix + 2)
+    {
+       /* An invalid message.  We can't check that during parsing
+          because we may not know the used cipher then.  */
+      rc = gpg_error (GPG_ERR_INV_PACKET);
+      goto leave;
+    }
+
+  rc = openpgp_cipher_open (&cipher_hd, dek.algo,
+			    GCRY_CIPHER_MODE_CFB,
+			    (! sync /* ed->mdc_method || dek.algo >= 100 */ ?
+                             0 : GCRY_CIPHER_ENABLE_SYNC));
+  if (rc)
+    log_fatal ("Failed to open cipher: %s\n", gpg_strerror (rc));
+
+  rc = gcry_cipher_setkey (cipher_hd, dek.key, dek.keylen);
+  if (gpg_err_code (rc) == GPG_ERR_WEAK_KEY)
+    {
+      log_info ("WARNING: message was encrypted with"
+                " a weak key in the symmetric cipher.\n");
+      rc=0;
+    }
+  else if( rc )
+    log_fatal ("key setup failed: %s\n", gpg_strerror (rc));
+
+  gcry_cipher_setiv (cipher_hd, NULL, 0);
+
+  if (debug)
+    {
+      log_debug ("Encrypted data:\n");
+      log_hexdump(ciphertext, len);
+    }
+  plaintext = xmalloc_clear (len);
+  gcry_cipher_decrypt (cipher_hd, plaintext, blocksize + 2,
+                       ciphertext, blocksize + 2);
+  gcry_cipher_sync (cipher_hd);
+  if (len > blocksize+2)
+    gcry_cipher_decrypt (cipher_hd,
+                         &plaintext[blocksize+2], len-(blocksize+2),
+                         &ciphertext[blocksize+2], len-(blocksize+2));
+
+  if (debug)
+    {
+      log_debug ("Decrypted data:\n");
+      log_hexdump (plaintext, len);
+      log_debug ("R_{b-1,b} = %s\n", hexstr (&plaintext[blocksize - 2]));
+      log_debug ("R_{b+1,b+2} = %s\n", hexstr (&plaintext[blocksize]));
+    }
+
+  if (cfbp || debug)
+    {
+      int i;
+      cfb = xmalloc (len);
+      for (i = 0; i < len; i ++)
+        cfb[i] = plaintext[i] ^ ciphertext[i];
+
+      log_assert (len >= blocksize + 2);
+
+      if (debug)
+        {
+          log_debug ("cfb:\n");
+          log_hexdump (cfb, len);
+
+          log_debug ("E_k([C_1]_{1,2}) = C_2 xor R (%s xor %s) = %s\n",
+                    hexstr (&ciphertext[blocksize]),
+                    hexstr (&plaintext[blocksize]),
+                    hexstr (bufxor2 (&ciphertext[blocksize],
+                                     &plaintext[blocksize])));
+          if (len >= blocksize + 4)
+            log_debug ("D = Ek([C1]_{3-b} || C_2)_{1-2} (%s) xor C2 (%s) xor E_k(0)_{b-1,b} (%s) = %s\n",
+                       hexstr (&cfb[blocksize + 2]),
+                       hexstr (&ciphertext[blocksize]),
+                       hexstr (&cfb[blocksize - 2]),
+                       hexstr (bufxor2 (bufxor2 (&cfb[blocksize + 2],
+                                                 &ciphertext[blocksize]),
+                                        &cfb[blocksize - 2])));
+        }
+    }
+
+  if (plaintext[nprefix-2] != plaintext[nprefix]
+      || plaintext[nprefix-1] != plaintext[nprefix+1])
+    {
+      rc = gpg_error (GPG_ERR_BAD_KEY);
+      goto leave;
+    }
+
+ leave:
+  if (! rc && plaintextp)
+    *plaintextp = plaintext;
+  else
+    xfree (plaintext);
+
+  if (! rc && cfbp)
+    *cfbp = cfb;
+  else
+    xfree (cfb);
+
+  if (cipher_hd)
+    gcry_cipher_close (cipher_hd);
+  return rc;
+}
+
+/* Query the oracle with D=D for block B.  */
+static int
+oracle_test (unsigned int d, int b, int debug)
+{
+  byte probe[32 + 2];
+
+  log_assert (blocksize + 2 <= sizeof probe);
+  log_assert (d < 256 * 256);
+
+  if (b == 1)
+    memcpy (probe, &msg[2], blocksize);
+  else
+    memcpy (probe, block (msg, msg_len, b), blocksize);
+
+  probe[blocksize] = d >> 8;
+  probe[blocksize + 1] = d & 0xff;
+
+  if (debug)
+    log_debug ("oracle (0x%04X):\n", d);
+
+  return oracle (debug, probe, blocksize + 2, NULL, NULL) == 0;
+}
+
+static void
+do_test (int argc, char *argv[])
+{
+  int i;
+  int debug = 0;
+  char *filename = NULL;
+  int help = 0;
+
+  byte *raw_data;
+  int raw_data_len;
+
+  (void)current_test_group_failed;
+  for (i = 1; i < argc; i ++)
+    {
+      if (strcmp (argv[i], "--debug") == 0)
+        debug = 1;
+      else if (! blocksize)
+        parse_session_key (argv[i]);
+      else if (! filename)
+        filename = argv[i];
+      else
+        {
+          help = 1;
+          break;
+        }
+    }
+
+  if (! blocksize && ! filename && (filename = prepend_srcdir ("t-stutter-data.asc")))
+    /* Try defaults.  */
+    {
+      parse_session_key ("9:9274A8EC128E850C6DDDF9EAC68BFA84FC7BC05F340DA41D78C93D0640C7C503");
+    }
+
+  if (help || ! blocksize || ! filename)
+    log_fatal ("Usage: %s [--debug] SESSION_KEY ENCRYPTED_PKT\n", argv[0]);
+
+  /* Don't read more than a KB.  */
+  raw_data_len = 1024;
+  raw_data = xmalloc (raw_data_len);
+
+  {
+    FILE *fp;
+    int r;
+
+    fp = fopen (filename, "r");
+    if (! fp)
+      log_fatal ("Opening %s: %s\n", filename, strerror (errno));
+    r = fread (raw_data, 1, raw_data_len, fp);
+    fclose (fp);
+
+    /* We need at least the random data, the encrypted and literal
+       packets' headers and some body.  */
+    if (r < (blocksize + 2 /* Random data.  */
+             + 2 * blocksize /* Header + some plaintext.  */))
+      log_fatal ("Not enough data (need at least %d bytes of plain text): %s.\n",
+                 blocksize + 2, strerror (errno));
+    raw_data_len = r;
+
+    if (debug)
+      {
+        log_debug ("First few bytes of the raw data:\n");
+        log_hexdump (raw_data, raw_data_len > 8 ? 8 : raw_data_len);
+      }
+  }
+
+  /* Parse the packet's header.  */
+  {
+    int ctb = raw_data[0];
+    int new_format = ctb & (1 << 7);
+    int pkttype = (ctb & ((1 << 5) - 1)) >> (new_format ? 0 : 2);
+    int hdrlen;
+
+    if (new_format)
+      {
+        if (debug)
+          log_debug ("len encoded: 0x%x (%d)\n", raw_data[1], raw_data[1]);
+        if (raw_data[1] < 192)
+          hdrlen = 2;
+        else if (raw_data[1] < 224)
+          hdrlen = 3;
+        else if (raw_data[1] == 255)
+          hdrlen = 5;
+        else
+          hdrlen = 2;
+      }
+    else
+      {
+        int lentype = ctb & 0x3;
+        if (lentype == 0)
+          hdrlen = 2;
+        else if (lentype == 1)
+          hdrlen = 3;
+        else if (lentype == 2)
+          hdrlen = 5;
+        else
+          /* Indeterminate.  */
+          hdrlen = 1;
+      }
+
+    if (debug)
+      log_debug ("ctb = %x; %s format, hdrlen: %d, packet: %s\n",
+                 ctb, new_format ? "new" : "old",
+                 hdrlen,
+                 pkttype_str (pkttype));
+
+    if (! (pkttype == PKT_ENCRYPTED || pkttype == PKT_ENCRYPTED_MDC))
+      log_fatal ("%s does not contain an encrypted packet, but a %s.\n",
+                 filename, pkttype_str (pkttype));
+
+    if (pkttype == PKT_ENCRYPTED_MDC)
+      {
+        /* The first byte following the header is the version, which
+           is 1.  */
+        log_assert (raw_data[hdrlen] == 1);
+        hdrlen ++;
+        sync = 0;
+      }
+    else
+      sync = 1;
+
+    msg = &raw_data[hdrlen];
+    msg_len = raw_data_len - hdrlen;
+  }
+
+  log_assert (msg_len >= blocksize + 2);
+
+  {
+    /* This can at least partially be guessed.  So we just assume that
+       it is known.  */
+    int d;
+    int found;
+    const byte *m1;
+    byte e_k_zero[2];
+
+    if (oracle (debug, msg, msg_len, &msg_plaintext, &msg_cfb) == 0)
+      {
+        if (debug)
+          log_debug ("Session key appears to be good.\n");
+      }
+    else
+      log_fatal ("Session key is bad!\n");
+
+    m1 = &msg_plaintext[blocksize + 2];
+    if (debug)
+      log_debug ("First two bytes of plaintext are: %02X (%c) %02X (%c)\n",
+                 m1[0], isprint (m1[0]) ? m1[0] : '?',
+                 m1[1], isprint (m1[1]) ? m1[1] : '?');
+
+    for (d = 0; d < 256 * 256; d ++)
+      if ((found = oracle_test (d, 1, 0)))
+        break;
+
+    if (! found)
+      log_fatal ("Failed to find d!\n");
+
+    if (debug)
+      oracle_test (d, 1, 1);
+
+    if (debug)
+      log_debug ("D = %d (%x) looks good.\n", d, d);
+
+    {
+      byte *c2 = block (msg, msg_len, 2);
+      byte D[2] = { d >> 8, d & 0xFF };
+      byte *c3 = block (msg, msg_len, 3);
+
+      memcpy (e_k_zero,
+              bufxor2 (bufxor2 (c2, D),
+                       bufxor2 (c3, m1)),
+              sizeof (e_k_zero));
+
+      if (debug)
+        {
+          log_debug ("C2 = %s\n", hexstr (c2));
+          log_debug ("D = %s\n", hexstr (D));
+          log_debug ("C3 = %s\n", hexstr (c3));
+          log_debug ("M = %s\n", hexstr (m1));
+          log_debug ("E_k([C1]_{3-b} || C_2) = C3 xor M1 = %s\n",
+                     hexstr (bufxor2 (c3, m1)));
+          log_debug ("E_k(0)_{b-1,b} = %s\n", hexstr (e_k_zero));
+        }
+    }
+
+    /* Figure out the first 2 bytes of M2... (offset 16 & 17 of the
+       plain text assuming the blocksize == 16 or bytes 34 & 35 of the
+       decrypted cipher text, i.e., C4).  */
+    for (i = 1; block_offset (i + 3) + 2 <= msg_len; i ++)
+      {
+        byte e_k_prime[2];
+        byte m[2];
+        byte *ct = block (msg, msg_len, i + 2);
+        byte *pt = block (msg_plaintext, msg_len, 2 + i + 1);
+
+        for (d = 0; d < 256 * 256; d ++)
+          if (oracle_test (d, i + 2, 0))
+            {
+              found = 1;
+              break;
+            }
+
+        if (! found)
+          log_fatal ("Failed to find a valid d for block %d\n", i);
+
+        if (debug)
+          log_debug ("Block %d: oracle: D = %04X passes integrity check\n",
+                     i, d);
+
+        {
+          byte D[2] = { d >> 8, d & 0xFF };
+          memcpy (e_k_prime,
+                  bufxor2 (bufxor2 (&ct[blocksize - 2], D), e_k_zero),
+                  sizeof (e_k_prime));
+
+          memcpy (m, bufxor2 (e_k_prime, block (msg, msg_len, i + 3)),
+                  sizeof (m));
+        }
+
+        if (debug)
+          log_debug ("=> block %d starting at %zd starts with: "
+                     "%s (%c%c)\n",
+                     i, (size_t) pt - (size_t) msg_plaintext,
+                     hexstr (m),
+                     isprint (m[0]) ? m[0] : '?', isprint (m[1]) ? m[1] : '?');
+
+        if (m[0] != pt[0] || m[1] != pt[1])
+          {
+            log_debug ("oracle attack failed!  Expected %s (%c%c), got %s\n",
+                       hexstr (pt),
+                       isprint (pt[0]) ? pt[0] : '?',
+                       isprint (pt[1]) ? pt[1] : '?',
+                       hexstr (m));
+            tests_failed++;
+          }
+      }
+
+    if (i == 1)
+      log_fatal ("Message is too short, nothing to test.\n");
+  }
+
+  xfree (filename);
+}