Skip to content

Commit 7ffe377

Browse files
arekinatharekinath
committedAug 17, 2019
ebox: fix up support for multiple recovery configs
·
v0.11.2v0.3.0
1 parent ae4e3ef commit 7ffe377

File tree

4 files changed

+126
-21
lines changed

4 files changed

+126
-21
lines changed
 

‎docs/box-ebox-formats.adoc

+35-15
Original file line numberDiff line numberDiff line change
@@ -221,6 +221,11 @@ authenticates the output data (so we can detect corrupted shares reliably), and
221221
allows the storage of additional data that is only available after recovery (a
222222
useful feature for RFD77).
223223

224+
Since there is only one encrypted recovery box for the entire ebox structure, to
225+
prevent cross-use of shares between different recovery configurations, each
226+
recovery config encodes a different intermediate key. This is XOR'd with
227+
a per-recovery nonce to retrieve the actual symmetric key for the recovery box.
228+
224229
The two possible processes for arriving at the final key from an ebox are
225230
shown below:
226231

@@ -234,23 +239,36 @@ shown below:
234239
|
235240
|
236241
| +--------------+
237-
+---------------------------+------------------->|Final key |
238-
^ +--------------+
239-
|
240-
|
241-
|
242-
+-----------------+-----+ unseal +------+ GF^256 SS +-----+-------+
242+
+-----------------------------+----------------->|Final key |
243+
^ +--------------+
244+
|
245+
|
246+
|
247+
+-----------------+-----+ unseal +------+ GF^256 SS +------+------+
243248
|Recovery config | box +---------->|share +--------+ |recovery box +-----> "(additional info)"
244249
| +-----+ +------+ | |contents |
245250
| N=2 | box +---------->|share +--------+ +-------------+
246-
| +-----+ +------+ | ^
247-
| | box | | |
248-
+-----------------+-----+ | | aes256-gcm
249-
| |
250-
| +--------+---+
251-
+------>|intermediate|
252-
|key |
253-
+------------+
251+
| +-----+ +------+ | ^
252+
| | box | | |
253+
+-----------------+-----+ v | aes256-gcm
254+
| nonce |-------. +-----+ |
255+
+-----------------------+ '------. | | +------+------+
256+
'------>| XOR +------>|intermediate |
257+
| | |key |
258+
+-----+ +-------------+
259+
^
260+
+-----------------+-----+ unseal +------+ GF^256 SS |
261+
|Recovery config | box +---------->|share +--------+ |
262+
| +-----+ +------+ | |
263+
| N=3 | box +---------->|share +--------+ |
264+
| +-----+ +------+ | |
265+
| | box +---------->|share +--------+ |
266+
+ +-----+ +------+ v |
267+
| | box | +-----+ |
268+
+-----------------------+ | | |
269+
| nonce |----------------------->| XOR +-----------'
270+
+-----------------------+ | |
271+
+-----+
254272
255273
....
256274

@@ -312,7 +330,7 @@ format-breaking change and bump the top-level version number in the structure.
312330
+----------+---------------------------+
313331
| uint8[2] : magic | <--- always 0xEB, 0x0C
314332
+----------+---------------------------+ +---------+---+
315-
| uint8 : version | <--- 2 |TEMPLATE : 1 |
333+
| uint8 : version | <--- 3 |TEMPLATE : 1 |
316334
+----------+---------------------------+ |KEY : 2 |
317335
| uint8 : type | <------------------|STREAM : 3 |
318336
+==========+===========================+ +---------+---+
@@ -335,6 +353,8 @@ format-breaking change and bump the top-level version number in the structure.
335353
| | uint8 : N | <--- always 1 if "(config type = PRIMARY)"
336354
repeat ----+ +----------+---------------------------+
337355
| | uint8 : number of parts (M) |
356+
| +----------+---------------------------+
357+
| | string8 : config nonce | <--- always 0 bytes if "(config type = PRIMARY)"
338358
| .- +==========+===========================+
339359
repeat --- | --+ | ... : part information | -------.
340360
'-- '- +==========+===========================+ |

‎ebox.c

+83-6
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,10 @@ struct ebox_config {
119119
/* key for collecting challenge-responses */
120120
struct sshkey *ec_chalkey;
121121

122+
/* nonce for uniquifying recovery keys */
123+
uint8_t *ec_nonce;
124+
size_t ec_noncelen;
125+
122126
void *ec_priv;
123127
};
124128

@@ -194,6 +198,7 @@ enum ebox_part_tag {
194198
enum ebox_version {
195199
EBOX_V1 = 0x01,
196200
EBOX_V2 = 0x02,
201+
EBOX_V3 = 0x03,
197202
EBOX_VNEXT,
198203
EBOX_VMIN = EBOX_V1
199204
};
@@ -1099,6 +1104,7 @@ ebox_config_free(struct ebox_config *config)
10991104
return;
11001105
if (config->ec_chalkey != NULL)
11011106
sshkey_free(config->ec_chalkey);
1107+
freezero(config->ec_nonce, config->ec_noncelen);
11021108
free(config->ec_priv);
11031109
for (part = config->ec_parts; part != NULL; part = npart) {
11041110
npart = part->ep_next;
@@ -1944,6 +1950,20 @@ sshbuf_get_ebox_config(struct sshbuf *buf, const struct ebox *ebox,
19441950
"ebox config has unknown type: 0x%02x", tconfig->etc_type);
19451951
goto out;
19461952
}
1953+
if (ebox->e_version >= EBOX_V3) {
1954+
rc = sshbuf_get_string8(buf, &config->ec_nonce,
1955+
&config->ec_noncelen);
1956+
if (rc) {
1957+
err = ssherrf("sshbuf_get_string8", rc);
1958+
goto out;
1959+
}
1960+
if (config->ec_noncelen > 0 &&
1961+
tconfig->etc_type != EBOX_RECOVERY) {
1962+
err = errf("InvalidConfig", NULL,
1963+
"ebox config is PRIMARY but has config nonce");
1964+
goto out;
1965+
}
1966+
}
19471967
if (tconfig->etc_type == EBOX_PRIMARY &&
19481968
tconfig->etc_n > 1) {
19491969
err = errf("InvalidConfig", NULL,
@@ -2276,6 +2296,19 @@ sshbuf_put_ebox_config(struct sshbuf *buf, struct ebox *ebox,
22762296
return (ssherrf("sshbuf_put_u8", rc));
22772297
}
22782298

2299+
if (config->ec_noncelen > 0 && config->ec_nonce != NULL) {
2300+
VERIFY3S(ebox->e_version, >=, EBOX_V3);
2301+
VERIFY3S(tconfig->etc_type, ==, EBOX_RECOVERY);
2302+
rc = sshbuf_put_string8(buf, config->ec_nonce,
2303+
config->ec_noncelen);
2304+
if (rc)
2305+
return (ssherrf("sshbuf_put_string8", rc));
2306+
} else {
2307+
rc = sshbuf_put_u8(buf, 0);
2308+
if (rc)
2309+
return (ssherrf("sshbuf_put_u8", rc));
2310+
}
2311+
22792312
part = config->ec_parts;
22802313
for (; part != NULL; part = part->ep_next) {
22812314
if ((err = sshbuf_put_ebox_part(buf, ebox, part)))
@@ -2597,6 +2630,7 @@ ebox_create(const struct ebox_tpl *tpl, const uint8_t *key, size_t keylen,
25972630
struct ebox_part *ppart, *npart;
25982631
size_t plainlen;
25992632
uint8_t *plain;
2633+
uint8_t *configkey;
26002634
struct sshbuf *buf;
26012635
struct piv_ecdh_box *pbox;
26022636
sss_Keyshare *share, *shares = NULL;
@@ -2650,10 +2684,23 @@ ebox_create(const struct ebox_tpl *tpl, const uint8_t *key, size_t keylen,
26502684
/* sss_* only supports 32-byte keys */
26512685
VERIFY3U(box->e_rcv_key.b_len, ==, 32);
26522686

2687+
nconfig->ec_nonce = calloc(1, box->e_rcv_key.b_len);
2688+
nconfig->ec_noncelen = box->e_rcv_key.b_len;
2689+
VERIFY(nconfig->ec_nonce != NULL);
2690+
arc4random_buf(nconfig->ec_nonce, keylen);
2691+
2692+
configkey = calloc_conceal(1, nconfig->ec_noncelen);
2693+
for (i = 0; i < nconfig->ec_noncelen; ++i) {
2694+
configkey[i] = nconfig->ec_nonce[i] ^
2695+
box->e_rcv_key.b_data[i];
2696+
}
2697+
26532698
shareslen = tconfig->etc_m * sizeof (sss_Keyshare);
26542699
shares = calloc_conceal(1, shareslen);
2655-
sss_create_keyshares(shares, box->e_rcv_key.b_data,
2656-
tconfig->etc_m, tconfig->etc_n);
2700+
sss_create_keyshares(shares, configkey, tconfig->etc_m,
2701+
tconfig->etc_n);
2702+
2703+
freezero(configkey, nconfig->ec_noncelen);
26572704
}
26582705

26592706
ppart = NULL;
@@ -2739,6 +2786,12 @@ ebox_unlock(struct ebox *ebox, struct ebox_config *config)
27392786
"least one part box to be unlocked"));
27402787
}
27412788

2789+
size_t
2790+
ebox_config_nonce_len(const struct ebox_config *config)
2791+
{
2792+
return (config->ec_noncelen);
2793+
}
2794+
27422795
errf_t *
27432796
ebox_recover(struct ebox *ebox, struct ebox_config *config)
27442797
{
@@ -2750,6 +2803,8 @@ ebox_recover(struct ebox *ebox, struct ebox_config *config)
27502803
errf_t *err;
27512804
int rc;
27522805
uint8_t tag;
2806+
uint8_t *configkey;
2807+
size_t cklen;
27532808
sss_Keyshare *share, *shares = NULL;
27542809

27552810
if (ebox->e_key != NULL || ebox->e_keylen > 0) {
@@ -2794,10 +2849,32 @@ ebox_recover(struct ebox *ebox, struct ebox_config *config)
27942849
goto out;
27952850
}
27962851

2797-
ebox->e_rcv_key.b_data = calloc_conceal(1, sizeof (sss_Keyshare));
2798-
ebox->e_rcv_key.b_len = sizeof (sss_Keyshare);
2799-
sss_combine_keyshares(ebox->e_rcv_key.b_data,
2800-
(const sss_Keyshare *)shares, n);
2852+
/* sss_* only supports 32-byte keys */
2853+
ebox->e_rcv_key.b_len = (cklen = 32);
2854+
ebox->e_rcv_key.b_data = calloc_conceal(1, cklen);
2855+
2856+
configkey = calloc_conceal(1, cklen);
2857+
sss_combine_keyshares(configkey, (const sss_Keyshare *)shares, n);
2858+
2859+
if (config->ec_noncelen > 0 && config->ec_nonce != NULL) {
2860+
if (config->ec_noncelen < cklen) {
2861+
free(ebox->e_rcv_key.b_data);
2862+
freezero(configkey, cklen);
2863+
freezero(shares, m * sizeof (sss_Keyshare));
2864+
return (errf("RecoveryFailed", errf("BadConfigNonce",
2865+
NULL, "recovery config nonce has bad length: %zu "
2866+
"(need %zu bytes)", config->ec_noncelen, cklen),
2867+
"ebox recovery failed"));
2868+
}
2869+
VERIFY3U(config->ec_noncelen, ==, cklen);
2870+
for (i = 0; i < cklen; ++i) {
2871+
ebox->e_rcv_key.b_data[i] = configkey[i] ^
2872+
config->ec_nonce[i];
2873+
}
2874+
} else {
2875+
bcopy(configkey, ebox->e_rcv_key.b_data, cklen);
2876+
}
2877+
free(configkey);
28012878

28022879
err = ebox_decrypt_recovery(ebox);
28032880
if (err) {

‎ebox.h

+1
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,7 @@ void ebox_free(struct ebox *box);
156156
uint ebox_version(const struct ebox *ebox);
157157
enum ebox_type ebox_type(const struct ebox *ebox);
158158
uint ebox_ephem_count(const struct ebox *ebox);
159+
size_t ebox_config_nonce_len(const struct ebox_config *config);
159160

160161
const char *ebox_cipher(const struct ebox *box);
161162
const uint8_t *ebox_key(const struct ebox *box, size_t *len);

‎pivy-box.c

+7
Original file line numberDiff line numberDiff line change
@@ -1408,6 +1408,7 @@ cmd_key_info(int argc, char *argv[])
14081408
struct sshbuf *buf;
14091409
struct ebox *ebox;
14101410
struct ebox_tpl *tpl;
1411+
struct ebox_config *config = NULL;
14111412
errf_t *error;
14121413

14131414
buf = read_stdin_b64(EBOX_MAX_SIZE);
@@ -1433,6 +1434,12 @@ cmd_key_info(int argc, char *argv[])
14331434
fprintf(stderr, "ephemeral keys: %u\n", ebox_ephem_count(ebox));
14341435
fprintf(stderr, "recovery cipher: %s\n", ebox_cipher(ebox));
14351436

1437+
while ((config = ebox_next_config(ebox, config)) != NULL) {
1438+
size_t len = ebox_config_nonce_len(config);
1439+
if (len > 0)
1440+
fprintf(stderr, "per-config nonce: %zu bytes\n", len);
1441+
}
1442+
14361443
tpl = ebox_tpl(ebox);
14371444
print_tpl(stderr, tpl);
14381445

0 commit comments

Comments
 (0)
Please sign in to comment.