[Pkg-loop-aes-commits] r1360 - in /upstream/aespipe: ./
current/ChangeLog current/Makefile.in
current/README current/aespipe.1 current/aespipe.c
xam at users.alioth.debian.org
xam at users.alioth.debian.org
Sat Feb 24 20:50:31 CET 2007
Author: xam
Date: Sat Feb 24 20:50:31 2007
New Revision: 1360
URL: http://svn.debian.org/wsvn/pkg-loop-aes/?sc=1&rev=1360
Log:
r1368 at dp: max | 2007-02-24 20:25:32 +0100
Import aespipe v2.3d
Modified:
upstream/aespipe/ (props changed)
upstream/aespipe/current/ChangeLog
upstream/aespipe/current/Makefile.in
upstream/aespipe/current/README
upstream/aespipe/current/aespipe.1
upstream/aespipe/current/aespipe.c
Propchange: upstream/aespipe/
------------------------------------------------------------------------------
--- svk:merge (original)
+++ svk:merge Sat Feb 24 20:50:31 2007
@@ -1,1 +1,1 @@
-21abe0f1-f0ee-4de9-8a33-02d62b012b6b:/local/pkg-loop-aes/upstream/aespipe:1367
+21abe0f1-f0ee-4de9-8a33-02d62b012b6b:/local/pkg-loop-aes/upstream/aespipe:1368
Modified: upstream/aespipe/current/ChangeLog
URL: http://svn.debian.org/wsvn/pkg-loop-aes/upstream/aespipe/current/ChangeLog?rev=1360&op=diff
==============================================================================
--- upstream/aespipe/current/ChangeLog (original)
+++ upstream/aespipe/current/ChangeLog Sat Feb 24 20:50:31 2007
@@ -68,3 +68,8 @@
aespipe-v2.3c October 28 2006
- Changed aespipe program to output error message if gpg program does
not exist when gpg encrypted key file is used.
+
+aespipe-v2.3d February 23 2007
+ - Added compatibility for two obsolete key setup methods, "-H unhashed1"
+ and "-H unhashed2". Patch from Jordan Ritter.
+ - Added "-P file" command line option.
Modified: upstream/aespipe/current/Makefile.in
URL: http://svn.debian.org/wsvn/pkg-loop-aes/upstream/aespipe/current/Makefile.in?rev=1360&op=diff
==============================================================================
--- upstream/aespipe/current/Makefile.in (original)
+++ upstream/aespipe/current/Makefile.in Sat Feb 24 20:50:31 2007
@@ -1,9 +1,9 @@
#
# Makefile.in
#
-# Written by Jari Ruusu, November 19 2004
+# Written by Jari Ruusu, February 18 2007
#
-# Copyright 2002,2003,2004 by Jari Ruusu.
+# Copyright 2002-2007 by Jari Ruusu.
# Redistribution of this file is permitted under the GNU Public License.
#
@@ -72,13 +72,21 @@
@GPGWORKPART@$(MAKE) test-part2 CT=AES128 HF=sha256 ITER=0 GK="-K gpgkey3.asc -G test-dir1" MD=fabe7422f534820838dfd4571ba14ade MD5WORK=test-part at MD5WORKPART@
@GPGWORKPART@$(MAKE) test-part2 CT=AES192 HF=sha384 ITER=0 GK="-K gpgkey3.asc -G test-dir1" MD=3eadc976525f9df7e18d56676ec730c8 MD5WORK=test-part at MD5WORKPART@
@GPGWORKPART@$(MAKE) test-part2 CT=AES256 HF=sha512 ITER=0 GK="-K gpgkey3.asc -G test-dir1" MD=3be488a60dd77bcab9fbeba4a428c3d5 MD5WORK=test-part at MD5WORKPART@
+ echo 1234567890123456789012345678901 >test-file4
+ $(MAKE) test-part2 CT=AES HF=unhashed1 ITER=0 GK= MD=293b09053055af7ca5235dc6a5bc0b74 MD5WORK=test-part at MD5WORKPART@
+ echo 12345678901234567890123456789012 >test-file4
+ $(MAKE) test-part2 CT=AES HF=unhashed1 ITER=0 GK= MD=6b157917570250ef4370bf9acae49279 MD5WORK=test-part at MD5WORKPART@
+ echo 123456789012345678901234567890123456789012 >test-file4
+ $(MAKE) test-part2 CT=AES HF=unhashed1 ITER=0 GK= MD=6b157917570250ef4370bf9acae49279 MD5WORK=test-part at MD5WORKPART@
+ echo 1234567890123456789012345678901234567890123 >test-file4
+ $(MAKE) test-part2 CT=AES HF=unhashed1 ITER=0 GK= MD=e12fd55fbae9fc0e03517593e253e239 MD5WORK=test-part at MD5WORKPART@
rm -f -r test-file[12345] test-dir1
@echo "*** Test results ok ***"
test-part2:
./aespipe -p 3 -e $(CT) -H $(HF) -C $(ITER) $(GK) <test-file3 >test-file1 3<test-file4
$(MAKE) $(MD5WORK)
cmp test-file2 test-file5
- ./aespipe -d -p 3 -e $(CT) -H $(HF) -C $(ITER) $(GK) <test-file1 >test-file2 3<test-file4
+ ./aespipe -d -P test-file4 -e $(CT) -H $(HF) -C $(ITER) $(GK) <test-file1 >test-file2
cmp test-file3 test-file2
test-part3:
md5sum test-file1 >test-file2
Modified: upstream/aespipe/current/README
URL: http://svn.debian.org/wsvn/pkg-loop-aes/upstream/aespipe/current/README?rev=1360&op=diff
==============================================================================
--- upstream/aespipe/current/README (original)
+++ upstream/aespipe/current/README Sat Feb 24 20:50:31 2007
@@ -1,6 +1,6 @@
-Written by Jari Ruusu <jariruusu at users.sourceforge.net>, October 28 2006
-
-Copyright 2002-2006 by Jari Ruusu.
+Written by Jari Ruusu <jariruusu at users.sourceforge.net>, February 23 2007
+
+Copyright 2002-2007 by Jari Ruusu.
Redistribution of this file is permitted under the GNU Public License.
@@ -27,7 +27,7 @@
Latest version of this package can be found at:
http://loop-aes.sourceforge.net/
- http://members.surfeu.fi/ce6c8edf/ (limited downloads)
+ http://koti.tnnet.fi/jari.ruusu/linux/
2. How to compile aespipe program
Modified: upstream/aespipe/current/aespipe.1
URL: http://svn.debian.org/wsvn/pkg-loop-aes/upstream/aespipe/current/aespipe.1?rev=1360&op=diff
==============================================================================
--- upstream/aespipe/current/aespipe.1 (original)
+++ upstream/aespipe/current/aespipe.1 Sat Feb 24 20:50:31 2007
@@ -1,4 +1,4 @@
-.TH AESPIPE 1 "November 19 2004" "LINUX" "COMMANDS"
+.TH AESPIPE 1 "February 18 2007" "LINUX" "COMMANDS"
.SH NAME
aespipe \- AES encrypting or decrypting pipe
.SH SYNOPSIS
@@ -22,25 +22,20 @@
extra 65th key as additional input to MD5 IV computation. See -K option for
more information about how to enable multi-key-v3 mode.
+Recommended key setup mode is multi-key-v3, which is based on gpg encrypted
+key files. In this mode, the passphrase is protected against optimized
+dictionary attacks via salting and key iteration of gpg. Passphrase length
+should be 20 characters or more.
+
Single-key mode preserves input size at 16 byte granularity. Multi-key mode
preserves input size at 512 byte granularity. If input size is not multiple
of 16 or 512 bytes, input data is padded with null bytes so that both input
and output sizes are multiples of 16 or 512 bytes.
-
-Password string has a minimum length of 20 characters (or 1 character when
-using rmd160 password hash). Optional password seed (salt) and key iteration
-count can be used to slow down dictionary attacks. Password seed is appended
-to user supplied password before password is hashed using one way hash. If
-password iteration count is specified, password hash output is encrypted N
-thousand times using AES-256. Unique seed prevents an adversary from
-precomputing hashes of passwords in his dictionary in advance, and thus
-making an optimized attack slower. Large password iteration count makes
-dictionary attack painfully slow.
.SH OPTIONS
.IP "\fB\-C \fIitercountk\fP"
-Runs hashed password through \fIitercountk\fP thousand iterations of AES-256
+Runs hashed passphrase through \fIitercountk\fP thousand iterations of AES-256
before using it for data encryption. This consumes lots of CPU cycles at
-program start time but not thereafter. In combination with password seed
+program start time but not thereafter. In combination with passphrase seed
this slows down dictionary attacks. Iteration is not done in multi-key mode.
.IP "\fB\-d\fP"
Decrypt data. If this option is not specified, default operation is to
@@ -48,8 +43,8 @@
.IP "\fB\-e \fIencryption\fP"
Following \fIencryption\fP types are recognized: AES128 (default), AES192
and AES256. Encryption type names are case insensitive. AES128 defaults to
-using SHA-256 password hash, AES192 defaults to using SHA-384 password hash,
-and AES256 defaults to using SHA-512 password hash.
+using SHA-256 passphrase hash, AES192 defaults to using SHA-384 passphrase hash,
+and AES256 defaults to using SHA-512 passphrase hash.
.IP "\fB\-G \fIgpghome\fP"
Set gpg home directory to \fIgpghome\fP, so that gpg uses public/private
keys on \fIgpghome\fP directory. This is only used when gpgkey file needs to
@@ -57,10 +52,12 @@
symmetric cipher only, public/private keys are not required and this option
has no effect.
.IP "\fB\-H \fIphash\fP"
-Uses \fIphash\fP function to hash password. Available hash functions are
-sha256, sha384, sha512 and rmd160. Hash type names are case insensitive.
+Uses \fIphash\fP function to hash passphrase. Available hash functions are
+sha256, sha384, sha512 and rmd160. unhashed1 and unhashed2 functions also
+exist for compatibility with some obsolete implementations. Hash type names
+are case insensitive.
.IP "\fB\-K \fIgpgkey\fP"
-Password is piped to gpg so that gpg can decrypt file \fIgpgkey\fP which
+Passphrase is piped to gpg so that gpg can decrypt file \fIgpgkey\fP which
contains the real keys that are used to encrypt data. If decryption requires
public/private keys and gpghome is not specified, all users use their own
gpg public/private keys to decrypt \fIgpgkey\fP. Decrypted \fIgpgkey\fP
@@ -70,28 +67,46 @@
additional input to MD5 IV computation.
.IP "\fB\-O \fIsectornumber\fP"
Set IV offset in 512 byte units. Default is zero. Data is encrypted in 512
-byte CBC chains and each 512 byte chain starts with unique IV. This option
-can be used to start encryption or decryption in middle of some existing
-encrypted disk image.
+byte CBC chains and each 512 byte chain starts with IV whose computation
+depends on offset within the data. This option can be used to start
+encryption or decryption in middle of some existing encrypted disk image.
.IP "\fB\-p \fIfdnumber\fP"
-Read the password from file descriptor \fIfdnumber\fP instead of the
+Read the passphrase from file descriptor \fIfdnumber\fP instead of the
terminal. If -K option is not being used (no gpg key file), then aespipe
attempts to read 65 keys from \fIpasswdfd\fP, each key at least 20
characters and separated by newline. If aespipe successfully reads 64 or 65
keys, then aespipe is put to multi-key mode. If aespipe encounters
end-of-file before 64 keys are read, then only first key is used in
single-key mode.
+.IP "\fB\-P \fIcleartextkey\fP"
+Read the passphrase from file \fIcleartextkey\fP instead of the terminal. If
+-K option is not being used (no gpg key file), then aespipe attempts to read
+65 keys from \fIcleartextkey\fP, each key at least 20 characters and
+separated by newline. If aespipe successfully reads 64 or 65 keys, then
+aespipe is put to multi-key mode. If aespipe encounters end-of-file before
+64 keys are read, then only first key is used in single-key mode. If both -p
+and -P options are used, then -p option takes precedence. These are
+equivalent:
+
+aespipe -p3 -K foo.gpg -e AES128 ... 3<someFileName
+
+aespipe -P someFileName -K foo.gpg -e AES128 ...
+
+In first line of above example, in addition to normal open file descriptors
+(0==stdin 1==stdout 2==stderr), shell opens the file and passes open file
+descriptor to started aespipe program. In second line of above example,
+aespipe opens the file itself.
.IP "\fB\-q\fP"
Be quiet and don't complain about write errors.
.IP "\fB\-S \fIpseed\fP"
-Sets encryption password seed \fIpseed\fP which is appended to user supplied
-password before hashing. Using different seeds makes dictionary attacks
-slower but does not prevent them if user supplied password is guessable.
+Sets encryption passphrase seed \fIpseed\fP which is appended to user supplied
+passphrase before hashing. Using different seeds makes dictionary attacks
+slower but does not prevent them if user supplied passphrase is guessable.
Seed is not used in multi-key mode.
.IP "\fB\-T\fP"
-Asks password twice instead of just once.
+Asks passphrase twice instead of just once.
.IP "\fB\-w \fInumber\fP"
-Wait \fInumber\fP seconds before asking password.
+Wait \fInumber\fP seconds before asking passphrase.
.SH RETURN VALUE
.B aespipe
returns 0 on success, nonzero on failure.
Modified: upstream/aespipe/current/aespipe.c
URL: http://svn.debian.org/wsvn/pkg-loop-aes/upstream/aespipe/current/aespipe.c?rev=1360&op=diff
==============================================================================
--- upstream/aespipe/current/aespipe.c (original)
+++ upstream/aespipe/current/aespipe.c Sat Feb 24 20:50:31 2007
@@ -1,9 +1,9 @@
/*
* aespipe.c
*
- * Written by Jari Ruusu, October 27 2006
+ * Written by Jari Ruusu, February 18 2007
*
- * Copyright 2002-2006 by Jari Ruusu.
+ * Copyright 2002-2007 by Jari Ruusu.
* Redistribution of this file is permitted under the GNU Public License.
*
* AES encrypting or decrypting "pipe", reads from stdin, writes to stdout
@@ -61,6 +61,7 @@
int passAskTwice = 0;
char *gpgKeyFile = (char *)0;
char *gpgHomeDir = (char *)0;
+char *clearTextKeyFile = (char *)0;
char *passIterThousands = (char *)0;
int complainWriteErr = 1;
unsigned int waitSeconds = 0;
@@ -297,14 +298,24 @@
char *sGetPass(int minLen)
{
char *p, *s, *seed;
- int i, ask2;
+ int i, ask2, close_psw_fd = 0;
if(passFDnumber < 0) {
+ if(clearTextKeyFile) {
+ if((passFDnumber = open(clearTextKeyFile, O_RDONLY)) == -1) {
+ fprintf(stderr, "Error: unable to open %s for reading\n", clearTextKeyFile);
+ return NULL;
+ }
+ close_psw_fd = 1;
+ goto contReadFrom_psw;
+ }
p = getPass("Password: ");
ask2 = passAskTwice;
} else {
+ contReadFrom_psw:
if(gpgKeyFile && gpgKeyFile[0]) {
p = get_FD_pass(passFDnumber);
+ if(close_psw_fd) close(passFDnumber);
} else {
int x = 0;
while(x < 66) {
@@ -313,6 +324,7 @@
if(strlen(multiKeyPass[x]) < AESPIPE_PASSWORD_MIN_LENGTH) break;
x++;
}
+ if(close_psw_fd) close(passFDnumber);
warnAboutBadKeyData(x);
if(x >= 65) {
multiKeyMode = 65;
@@ -375,6 +387,49 @@
}
strcat(s, seed);
return(s);
+}
+
+/* obsolete */
+void unhashed1_hash_buffer(unsigned char *keyStr, int ile, unsigned char *keyBuf, int bufSize) {
+ int x, y, z, cnt = ile;
+ unsigned char *kp;
+
+ memset(keyBuf, 0, bufSize);
+ kp = keyStr;
+
+ for (x = 0; x < (bufSize * 8); x += 6) {
+ y = *kp++;
+
+ if (--cnt <= 0) {
+ kp = keyStr;
+ cnt = ile;
+ }
+
+ if ((y >= '0') && (y <= '9')) y -= '0';
+ else if((y >= 'A') && (y <= 'Z')) y -= ('A' - 10);
+ else if((y >= 'a') && (y <= 'z')) y -= ('a' - 36);
+ else if((y == '.') || (y == '/')) y += (62 - '.');
+ else y &= 63;
+
+ z = x >> 3;
+
+ if (z < bufSize) {
+ keyBuf[z] |= y << (x & 7);
+ }
+
+ z++;
+
+ if (z < bufSize) {
+ keyBuf[z] |= y >> (8 - (x & 7));
+ }
+ }
+}
+
+/* obsolete */
+void unhashed2_hash_buffer(unsigned char *keyStr, int ile, unsigned char *keyBuf, int bufSize) {
+ memset(keyBuf, 0, bufSize);
+ strncpy((char *)keyBuf, (char *)keyStr, bufSize - 1);
+ keyBuf[bufSize - 1] = 0;
}
void rmd160HashTwiceWithA(unsigned char *ib, int ile, unsigned char *ob, int ole)
@@ -567,11 +622,12 @@
if(!strcmp(*argv, "-") || (**argv != '-')) {
usage:
fprintf(stderr, "usage: %s [options] <inputfile >outputfile\n"
- "version 2.3c Copyright (c) 2002-2006 Jari Ruusu, (c) 2001 Dr Brian Gladman\n"
+ "version 2.3d Copyright (c) 2002-2007 Jari Ruusu, (c) 2001 Dr Brian Gladman\n"
"options: -e aes128|aes192|aes256 = set key length\n"
" -H sha256|sha384|sha512|rmd160 = set password hash function\n"
" -d = decrypt\n"
" -p num = read password from file descriptor num\n"
+ " -P file = read password from file\n"
" -S pseed = set password seed\n"
" -T = ask password twice\n"
" -q = don't complain about write errors\n"
@@ -600,6 +656,10 @@
if(!(*++(*argv) || (--argc && *++argv))) goto usage;
if(sscanf(*argv, "%d", &passFDnumber) != 1) goto usage;
goto nextArg;
+ case 'P':
+ if(!(*++(*argv) || (--argc && *++argv))) goto usage;
+ clearTextKeyFile = *argv;
+ goto nextArg;
case 'S':
if(!(*++(*argv) || (--argc && *++argv))) goto usage;
passSeedString = *argv;
@@ -648,7 +708,7 @@
} else if(!strcasecmp(efn, "aes192")) {
bits = 192;
hf = sha384_hash_buffer;
- } else if(strcasecmp(efn, "aes128")) {
+ } else if(strcasecmp(efn, "aes128") && strcasecmp(efn, "aes")) {
goto usage;
}
}
@@ -657,6 +717,8 @@
else if(!strcasecmp(hfn, "sha384")) hf = sha384_hash_buffer;
else if(!strcasecmp(hfn, "sha512")) hf = sha512_hash_buffer;
else if(!strcasecmp(hfn, "rmd160")) hf = rmd160HashTwiceWithA;
+ else if(!strcasecmp(hfn, "unhashed1")) hf = unhashed1_hash_buffer;
+ else if(!strcasecmp(hfn, "unhashed2")) hf = unhashed2_hash_buffer;
else goto usage;
}
@@ -664,6 +726,11 @@
pass = sGetPass((hf == rmd160HashTwiceWithA) ? 1 : AESPIPE_PASSWORD_MIN_LENGTH);
if(!pass) exit(1);
x = strlen(pass);
+ if(hf == unhashed1_hash_buffer) { /* obsolete compat */
+ bits = 128;
+ if(x >= 32) bits = 192;
+ if(x >= 43) bits = 256;
+ }
(*hf)((unsigned char *)pass, x, &hbu.hb[0], 32);
if(multiKeyMode) {
int r = 0, t;
More information about the Pkg-loop-aes-commits
mailing list