Home | History | Annotate | Line # | Download | only in libcrypt
crypt-argon2.c revision 1.22 
      1 /*	$NetBSD: crypt-argon2.c,v 1.22 2024/07/23 22:37:11 riastradh Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 2009 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  *
     16  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     17  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     18  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     19  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     20  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     21  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     22  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     23  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     24  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     25  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     26  * POSSIBILITY OF SUCH DAMAGE.
     27  */
     28 
     29 #include <sys/cdefs.h>
     30 __RCSID("$NetBSD: crypt-argon2.c,v 1.22 2024/07/23 22:37:11 riastradh Exp $");
     31 
     32 #include <sys/resource.h>
     33 #include <sys/param.h>
     34 #include <sys/sysctl.h>
     35 #include <sys/syslimits.h>
     36 
     37 #include <stdlib.h>
     38 #include <stdio.h>
     39 #include <unistd.h>
     40 #include <stdio.h>
     41 #include <string.h>
     42 #include <time.h>
     43 #include <pwd.h>
     44 #include <errno.h>
     45 #include <argon2.h>
     46 
     47 #include <err.h>
     48 #include "crypt.h"
     49 
     50 crypt_private int
     51 estimate_argon2_params(argon2_type, uint32_t *,
     52     uint32_t *, uint32_t *);
     53 
     54 /* defaults pulled from run.c */
     55 #define HASHLEN		32
     56 #define T_COST_DEF 	3
     57 #define LOG_M_COST_DEF 	12 /* 2^12 = 4 MiB */
     58 #define LANES_DEF 	1
     59 #define THREADS_DEF 	1
     60 #define OUTLEN_DEF 	32
     61 #define MAX_PASS_LEN 	128
     62 
     63 #define ARGON2_CONTEXT_INITIALIZER	\
     64 	{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, \
     65 	T_COST_DEF, LOG_M_COST_DEF,\
     66 	LANES_DEF, THREADS_DEF, \
     67 	ARGON2_VERSION_NUMBER, 0, 0, ARGON2_DEFAULT_FLAGS}
     68 
     69 #define ARGON2_ARGON2_STR	"argon2"
     70 #define ARGON2_ARGON2I_STR	"argon2i"
     71 #define ARGON2_ARGON2D_STR	"argon2d"
     72 #define ARGON2_ARGON2ID_STR	"argon2id"
     73 
     74 /*
     75  * Unpadded Base64 calculations are taken from the Apache2/CC-0
     76  * licensed libargon2 for compatibility
     77  */
     78 
     79 /*
     80  * Some macros for constant-time comparisons. These work over values in
     81  * the 0..255 range. Returned value is 0x00 on "false", 0xFF on "true".
     82  */
     83 #define EQ(x, y) ((((0U - ((unsigned)(x) ^ (unsigned)(y))) >> 8) & 0xFF) ^ 0xFF)
     84 #define GT(x, y) ((((unsigned)(y) - (unsigned)(x)) >> 8) & 0xFF)
     85 #define GE(x, y) (GT(y, x) ^ 0xFF)
     86 #define LT(x, y) GT(y, x)
     87 #define LE(x, y) GE(y, x)
     88 
     89 static unsigned
     90 b64_char_to_byte(int c)
     91 {
     92     unsigned x;
     93 
     94     x = (GE(c, 'A') & LE(c, 'Z') & (c - 'A')) |
     95         (GE(c, 'a') & LE(c, 'z') & (c - ('a' - 26))) |
     96         (GE(c, '0') & LE(c, '9') & (c - ('0' - 52))) | (EQ(c, '+') & 62) |
     97         (EQ(c, '/') & 63);
     98     return x | (EQ(x, 0) & (EQ(c, 'A') ^ 0xFF));
     99 }
    100 
    101 static const char *
    102 from_base64(void *dst, size_t *dst_len, const char *src)
    103 {
    104 	size_t len;
    105 	unsigned char *buf;
    106 	unsigned acc, acc_len;
    107 
    108 	buf = (unsigned char *)dst;
    109 	len = 0;
    110 	acc = 0;
    111 	acc_len = 0;
    112 	for (;;) {
    113 		unsigned d;
    114 
    115 		d = b64_char_to_byte(*src);
    116 		if (d == 0xFF) {
    117 			break;
    118 		}
    119 		src++;
    120 		acc = (acc << 6) + d;
    121 		acc_len += 6;
    122 		if (acc_len >= 8) {
    123 			acc_len -= 8;
    124 			if ((len++) >= *dst_len) {
    125 				return NULL;
    126 			}
    127 			*buf++ = (acc >> acc_len) & 0xFF;
    128 		}
    129 	}
    130 
    131 	/*
    132 	 * If the input length is equal to 1 modulo 4 (which is
    133 	 * invalid), then there will remain 6 unprocessed bits;
    134 	 * otherwise, only 0, 2 or 4 bits are buffered. The buffered
    135 	 * bits must also all be zero.
    136 	 */
    137 	if (acc_len > 4 || (acc & (((unsigned)1 << acc_len) - 1)) != 0) {
    138 		return NULL;
    139 	}
    140 	*dst_len = len;
    141 	return src;
    142 }
    143 
    144 /*
    145  * Used to find default parameters that perform well on the host
    146  * machine.  Inputs should dereference to either 0 (to estimate),
    147  * or desired value.
    148  */
    149 crypt_private int
    150 estimate_argon2_params(argon2_type atype, uint32_t *etime,
    151     uint32_t *ememory, uint32_t *ethreads)
    152 {
    153 	const int mib[] = { CTL_HW, HW_USERMEM64 };
    154 	struct timespec tp1, tp2, delta;
    155 	char tmp_salt[16];
    156 	char tmp_pwd[16];
    157 	uint32_t tmp_hash[32];
    158 	char tmp_encoded[256];
    159 	struct rlimit rlim;
    160 	uint64_t max_mem; /* usermem64 returns bytes */
    161 	size_t max_mem_sz = sizeof(max_mem);
    162 	/* low values from argon2 test suite... */
    163 	uint32_t memory = 256; /* 256k; argon2 wants kilobytes */
    164 	uint32_t time = 3;
    165 	uint32_t threads = 1;
    166 
    167 	if (*ememory < ARGON2_MIN_MEMORY) {
    168 		/*
    169 		 * attempt to find a reasonble bound for memory use
    170 		 */
    171 		if (sysctl(mib, __arraycount(mib),
    172 		    &max_mem, &max_mem_sz, NULL, 0) < 0) {
    173 			goto error;
    174 		}
    175 		if (getrlimit(RLIMIT_AS, &rlim) < 0)
    176 			goto error;
    177 		if (max_mem > rlim.rlim_cur && rlim.rlim_cur != RLIM_INFINITY)
    178 			max_mem = rlim.rlim_cur;
    179 
    180 		/*
    181 		 * Note that adding memory also greatly slows the algorithm.
    182 		 * Do we need to be concerned about memory usage during
    183 		 * concurrent connections?
    184 		 */
    185 		max_mem /= 1000000; /* bytes down to mb */
    186 		if (max_mem > 30000) {
    187 			memory = 32768;
    188 		} else if (max_mem > 15000) {
    189 			memory = 16384;
    190 		} else if (max_mem > 7000) {
    191 			memory = 8192;
    192 		} else if (max_mem > 3000) {
    193 			memory = 4096;
    194 		} else if (max_mem > 900) {
    195 			memory = 1024;
    196 		} else if (max_mem > 24) {
    197 			memory = 256;
    198 		} else {
    199 			memory = ARGON2_MIN_MEMORY;
    200 		}
    201 	} else {
    202 		memory = *ememory;
    203 	}
    204 
    205 	if (*etime < ARGON2_MIN_TIME) {
    206 		/*
    207 		 * just fill these with random stuff since we'll immediately
    208 		 * discard them after calculating hashes for 1 second
    209 		 */
    210 		arc4random_buf(tmp_pwd, sizeof(tmp_pwd));
    211 		arc4random_buf(tmp_salt, sizeof(tmp_salt));
    212 
    213 		if (clock_gettime(CLOCK_MONOTONIC, &tp1) == -1)
    214 			goto error;
    215 		for (; time < ARGON2_MAX_TIME; ++time) {
    216 			if (argon2_hash(time, memory, threads,
    217 			    tmp_pwd, sizeof(tmp_pwd),
    218 			    tmp_salt, sizeof(tmp_salt),
    219 			    tmp_hash, sizeof(tmp_hash),
    220 			    tmp_encoded, sizeof(tmp_encoded),
    221 			    atype, ARGON2_VERSION_NUMBER) != ARGON2_OK) {
    222 				goto reset;
    223 			}
    224 			if (clock_gettime(CLOCK_MONOTONIC, &tp2) == -1)
    225 				break;
    226 			if (timespeccmp(&tp1, &tp2, >))
    227 				break; /* broken system... */
    228 			timespecsub(&tp2, &tp1, &delta);
    229 			if (delta.tv_sec >= 1)
    230 				break;
    231 		}
    232 	} else {
    233 		time = *etime;
    234 	}
    235 
    236 error:
    237 	*etime = time;
    238 	*ememory = memory;
    239 	*ethreads = threads;
    240 	return 0;
    241 reset:
    242 	time = 3;
    243 	memory = 256;
    244 	threads = 1;
    245 	goto error;
    246 }
    247 
    248 
    249 /* process params to argon2 */
    250 /* we don't force param order as input, */
    251 /* but we do provide the expected order to argon2 api */
    252 static int
    253 decode_option(argon2_context *ctx, argon2_type *atype, const char *option)
    254 {
    255 	size_t tmp = 0;
    256         char *in = 0, *inp;
    257         char *a = 0;
    258         char *p = 0;
    259 	size_t sl;
    260 	int error = 0;
    261 
    262         in = (char *)strdup(option);
    263 	inp = in;
    264 
    265 	if (*inp == '$') inp++;
    266 
    267 	a = strsep(&inp, "$");
    268 
    269 	sl = strlen(a);
    270 
    271 	if (sl == strlen(ARGON2_ARGON2I_STR) &&
    272 	   !(strcmp(ARGON2_ARGON2I_STR, a))) {
    273 		*atype=Argon2_i;
    274 	} else if (sl == strlen(ARGON2_ARGON2D_STR) &&
    275 	        !(strcmp(ARGON2_ARGON2D_STR, a))) {
    276 		*atype=Argon2_d;
    277 	}
    278 	else if (sl == strlen(ARGON2_ARGON2ID_STR) &&
    279 	        !(strcmp(ARGON2_ARGON2ID_STR, a))) {
    280 		*atype=Argon2_id;
    281 	} else { /* default to id, we assume simple mistake */
    282 		/* don't abandon yet */
    283 		*atype=Argon2_id;
    284 	}
    285 
    286 	a = strsep(&inp, "$");
    287 
    288 	/* parse the version number of the hash, if it's there */
    289 	if (strncmp(a, "v=", 2) == 0) {
    290 		a += 2;
    291 		if ((getnum(a, &tmp))<0) { /* on error, default to current */
    292 			/* should start thinking about aborting */
    293 			ctx->version = ARGON2_VERSION_10;
    294 		} else {
    295 			ctx->version = tmp;
    296 		}
    297 		a = strsep(&inp, "$");
    298 	} else {
    299 		/*
    300 		 * This is a parameter list, not a version number, use the
    301 		 * default version.
    302 		 */
    303 		ctx->version = ARGON2_VERSION_10;
    304 	}
    305 
    306 	/* parse labelled argon2 params */
    307 	/* m_cost (m)
    308 	 * t_cost (t)
    309 	 * threads (p)
    310 	 */
    311 	while ((p = strsep(&a, ","))) {
    312 		switch (*p) {
    313 			case 'm':
    314 				p += strlen("m=");
    315 				if ((getnum(p, &tmp)) < 0) {
    316 					--error;
    317 				} else {
    318 					ctx->m_cost = tmp;
    319 				}
    320 				break;
    321 			case 't':
    322 				p += strlen("t=");
    323 				if ((getnum(p, &tmp)) < 0) {
    324 					--error;
    325 				} else {
    326 					ctx->t_cost = tmp;
    327 				}
    328 				break;
    329 			case 'p':
    330 				p += strlen("p=");
    331 				if ((getnum(p, &tmp)) < 0) {
    332 					--error;
    333 				} else {
    334 					ctx->threads = tmp;
    335 				}
    336 				break;
    337 			default:
    338                                 free(in);
    339 				return -1;
    340 
    341 		}
    342 	}
    343 
    344 	a = strsep(&inp, "$");
    345 	if (a == NULL) {
    346 		free(in);
    347 		return -1;
    348  	}
    349 
    350 	sl = ctx->saltlen;
    351 
    352 	if (from_base64(ctx->salt, &sl, a) == NULL) {
    353 		free(in);
    354 		return -1;
    355 	}
    356 
    357 	ctx->saltlen = sl;
    358 
    359 	a = strsep(&inp, "$");
    360 
    361 	if (a) {
    362 		snprintf((char *)ctx->pwd, ctx->pwdlen, "%s", a);
    363 	} else {
    364 		/* don't care if passwd hash is missing */
    365 		/* if missing, most likely coming from */
    366 		/* pwhash or similar */
    367 	}
    368 
    369 	/* free our token buffer */
    370         free(in);
    371 
    372 	/* 0 on success, <0 otherwise */
    373         return error;
    374 }
    375 
    376 crypt_private char *
    377 __crypt_argon2(const char *pw, const char * salt)
    378 {
    379 	/* we use the libargon2 api to generate */
    380 	/* return code */
    381 	int rc = 0;
    382 	/* output buffer */
    383 	char ebuf[32];
    384 	/* argon2 variable, default to id */
    385 	argon2_type atype = Argon2_id;
    386 	/* default to current argon2 version */
    387 	/* argon2 context to collect params */
    388 	argon2_context ctx = ARGON2_CONTEXT_INITIALIZER;
    389 	/* argon2 encoded buffer */
    390 	char encodebuf[256];
    391 	/* argon2 salt buffer */
    392 	char saltbuf[128];
    393 	/* argon2 pwd buffer */
    394 	char pwdbuf[128];
    395 	/* returned static buffer */
    396 	static char rbuf[512];
    397 
    398 	/* clear buffers */
    399 	explicit_memset(rbuf, 0, sizeof(rbuf));
    400 
    401 	/* we use static buffers to avoid allocation */
    402 	/* and easier cleanup */
    403 	ctx.out = (uint8_t *)encodebuf;
    404 	ctx.outlen = sizeof(encodebuf);
    405 
    406 	ctx.salt = (uint8_t *)saltbuf;
    407 	ctx.saltlen = sizeof(saltbuf);
    408 
    409 	ctx.pwd = (uint8_t *)pwdbuf;
    410 	ctx.pwdlen = sizeof(pwdbuf);
    411 
    412 	/* decode salt string to argon2 params */
    413 	/* argon2 context for param collection */
    414 	rc = decode_option(&ctx, &atype, salt);
    415 
    416 	if (rc < 0) {
    417 		/* unable to parse input params */
    418 		return NULL;
    419 	}
    420 
    421 	rc = argon2_hash(ctx.t_cost, ctx.m_cost,
    422 	    ctx.threads, pw, strlen(pw), ctx.salt, ctx.saltlen,
    423 	    ebuf, sizeof(ebuf), encodebuf, sizeof(encodebuf),
    424 	    atype, ctx.version);
    425 
    426 	if (rc != ARGON2_OK) {
    427 		fprintf(stderr, "argon2: failed: %s\n",
    428 		    argon2_error_message(rc));
    429 		return NULL;
    430 	}
    431 
    432 	memcpy(rbuf, encodebuf, sizeof(encodebuf));
    433 
    434 	/* clear buffers */
    435 	explicit_memset(ebuf, 0, sizeof(ebuf));
    436 	explicit_memset(encodebuf, 0, sizeof(encodebuf));
    437 	explicit_memset(saltbuf, 0, sizeof(saltbuf));
    438 	explicit_memset(pwdbuf, 0, sizeof(pwdbuf));
    439 
    440 	/* return encoded str */
    441 	return rbuf;
    442 }
    443