switching to ECDHE cryptography f, implementation is incomplete and INSECURE, do not use for anything but testing

6 files changed, 20 insertions, 195 deletions

diff --git a/src/util/crypto_aes.c b/src/util/crypto_aes.c
index d5c36d703..11b894f69 100644
--- a/src/util/crypto_aes.c
+++ b/src/util/crypto_aes.c
@@ -42,29 +42,6 @@ GNUNET_CRYPTO_aes_create_session_key (struct GNUNET_CRYPTO_AesSessionKey *key)
 {
   gcry_randomize (&key->key[0], GNUNET_CRYPTO_AES_KEY_LENGTH,
                   GCRY_STRONG_RANDOM);
-  key->crc32 =
-      htonl (GNUNET_CRYPTO_crc32_n (key, GNUNET_CRYPTO_AES_KEY_LENGTH));
-}
-
-
-/**
- * Check that a new session key is well-formed.
- *
- * @return GNUNET_OK if the key is valid
- */
-int
-GNUNET_CRYPTO_aes_check_session_key (const struct GNUNET_CRYPTO_AesSessionKey
-                                     *key)
-{
-  uint32_t crc;
-
-  crc = GNUNET_CRYPTO_crc32_n (key, GNUNET_CRYPTO_AES_KEY_LENGTH);
-  if (ntohl (key->crc32) != crc)
-  {
-    GNUNET_break_op (0);
-    return GNUNET_SYSERR;
-  }
-  return GNUNET_OK;
 }
 
 
@@ -85,12 +62,6 @@ setup_cipher (gcry_cipher_hd_t *handle,
 {
   int rc;
 
-  if (GNUNET_OK !=
-      GNUNET_CRYPTO_aes_check_session_key (sessionkey))
-  {
-    GNUNET_break (0);
-    return GNUNET_SYSERR;
-  }
   GNUNET_assert (0 ==
                  gcry_cipher_open (handle, GCRY_CIPHER_AES256,
                                    GCRY_CIPHER_MODE_CFB, 0));
diff --git a/src/util/crypto_hash.c b/src/util/crypto_hash.c
index 04225b3dc..fca66aed4 100644
--- a/src/util/crypto_hash.c
+++ b/src/util/crypto_hash.c
@@ -419,8 +419,6 @@ GNUNET_CRYPTO_hash_to_aes_key (const struct GNUNET_HashCode * hc,
                  GNUNET_CRYPTO_AES_KEY_LENGTH +
                  sizeof (struct GNUNET_CRYPTO_AesInitializationVector));
   memcpy (skey, hc, GNUNET_CRYPTO_AES_KEY_LENGTH);
-  skey->crc32 =
-      htonl (GNUNET_CRYPTO_crc32_n (skey, GNUNET_CRYPTO_AES_KEY_LENGTH));
   memcpy (iv, &((char *) hc)[GNUNET_CRYPTO_AES_KEY_LENGTH],
           sizeof (struct GNUNET_CRYPTO_AesInitializationVector));
 }
diff --git a/src/util/gnunet-ecc.c b/src/util/gnunet-ecc.c
index b19fc1998..d7f1dd58d 100644
--- a/src/util/gnunet-ecc.c
+++ b/src/util/gnunet-ecc.c
@@ -65,38 +65,12 @@ struct GNUNET_CRYPTO_EccPrivateKey
 
 
 /**
- * Create a new private key. Caller must free return value.
- *
- * @return fresh private key
- */
-static struct GNUNET_CRYPTO_EccPrivateKey *
-ecc_key_create ()
-{
-  struct GNUNET_CRYPTO_EccPrivateKey *ret;
-  gcry_sexp_t s_key;
-  gcry_sexp_t s_keyparam;
-
-  GNUNET_assert (0 ==
-                 gcry_sexp_build (&s_keyparam, NULL,
-                                  "(genkey(ecc(nbits %d)(ecc-use-e 3:257)))",
-                                  2048));
-  GNUNET_assert (0 == gcry_pk_genkey (&s_key, s_keyparam));
-  gcry_sexp_release (s_keyparam);
-#if EXTRA_CHECKS
-  GNUNET_assert (0 == gcry_pk_testkey (s_key));
-#endif
-  ret = GNUNET_malloc (sizeof (struct GNUNET_CRYPTO_EccPrivateKey));
-  ret->sexp = s_key;
-  return ret;
-}
-
-
-/**
  * Create a flat file with a large number of key pairs for testing.
  */
 static void
 create_keys (const char *fn)
 {
+  static char pad[GNUNET_TESTING_HOSTKEYFILESIZE];
   FILE *f;
   struct GNUNET_CRYPTO_EccPrivateKey *pk;
   struct GNUNET_CRYPTO_EccPrivateKeyBinaryEncoded *enc;
@@ -116,28 +90,34 @@ create_keys (const char *fn)
   {    
     fprintf (stderr,
              ".");
-    if (NULL == (pk = ecc_key_create ()))
+    if (NULL == (pk = GNUNET_CRYPTO_ecc_key_create ()))
     {
        GNUNET_break (0);
        break;
     }
     enc = GNUNET_CRYPTO_ecc_encode_key (pk);
-    if (htons (enc->size) != fwrite (enc, 1, htons (enc->size), f))
-      {
-        fprintf (stderr,
-                 _("\nFailed to write to `%s': %s\n"),
-                 fn,
-                 STRERROR (errno));
-        GNUNET_CRYPTO_ecc_key_free (pk);
-        GNUNET_free (enc);
-        break;
-      }
+    GNUNET_assert (ntohs (enc->size) <= GNUNET_TESTING_HOSTKEYFILESIZE);
+    if ( (ntohs (enc->size) != fwrite (enc, 1, ntohs (enc->size), f)) ||
+         (GNUNET_TESTING_HOSTKEYFILESIZE - ntohs (enc->size)
+          != fwrite (pad, 1, GNUNET_TESTING_HOSTKEYFILESIZE - ntohs (enc->size), f)) )
+    {
+      fprintf (stderr,
+               _("\nFailed to write to `%s': %s\n"),
+               fn,
+               STRERROR (errno));
+      GNUNET_CRYPTO_ecc_key_free (pk);
+      GNUNET_free (enc);
+      break;
+    }
     GNUNET_CRYPTO_ecc_key_free (pk);
     GNUNET_free (enc);
   }
-  if (0 == make_keys)
+  if (UINT_MAX == make_keys)
+    fprintf (stderr,
+             _("\nFinished!\n"));
+  else
     fprintf (stderr,
-             _("Finished!\n"));
+             _("\nError, %u keys not generated\n"), make_keys);
   fclose (f);
 }
 
diff --git a/src/util/gnunet-rsa.c b/src/util/gnunet-rsa.c
index 917ee50f4..1e7132d3f 100644
--- a/src/util/gnunet-rsa.c
+++ b/src/util/gnunet-rsa.c
@@ -25,7 +25,6 @@
  */
 #include "platform.h"
 #include "gnunet_util_lib.h"
-#include "gnunet_testing_lib.h"
 #include <gcrypt.h>
 
 
@@ -49,107 +48,6 @@ static int print_short_identity;
  */
 static int weak_random;
 
-/**
- * Option set to create a bunch of keys at once.
- */
-static unsigned int make_keys;
-
-/**
- * The private information of an RSA key pair.
- * NOTE: this must match the definition in crypto_ksk.c and crypto_rsa.c!
- */
-struct GNUNET_CRYPTO_RsaPrivateKey
-{
-  gcry_sexp_t sexp;
-};
-
-
-/**
- * Create a new private key. Caller must free return value.
- *
- * @return fresh private key
- */
-static struct GNUNET_CRYPTO_RsaPrivateKey *
-rsa_key_create ()
-{
-  struct GNUNET_CRYPTO_RsaPrivateKey *ret;
-  gcry_sexp_t s_key;
-  gcry_sexp_t s_keyparam;
-
-  GNUNET_assert (0 ==
-                 gcry_sexp_build (&s_keyparam, NULL,
-                                  "(genkey(rsa(nbits %d)(rsa-use-e 3:257)))",
-                                  2048));
-  GNUNET_assert (0 == gcry_pk_genkey (&s_key, s_keyparam));
-  gcry_sexp_release (s_keyparam);
-#if EXTRA_CHECKS
-  GNUNET_assert (0 == gcry_pk_testkey (s_key));
-#endif
-  ret = GNUNET_malloc (sizeof (struct GNUNET_CRYPTO_RsaPrivateKey));
-  ret->sexp = s_key;
-  return ret;
-}
-
-
-/**
- * Create a flat file with a large number of key pairs for testing.
- */
-static void
-create_keys (const char *fn)
-{
-  FILE *f;
-  struct GNUNET_CRYPTO_RsaPrivateKey *pk;
-  struct GNUNET_CRYPTO_RsaPrivateKeyBinaryEncoded *enc;
-
-  if (NULL == (f = fopen (fn, "w+")))
-    {
-      fprintf (stderr,
-               _("Failed to open `%s': %s\n"),
-               fn,
-               STRERROR (errno));
-      return;
-    }
-  fprintf (stderr,
-           _("Generating %u keys, please wait"),
-           make_keys);
-  while (0 < make_keys--)
-  {    
-    fprintf (stderr,
-             ".");
-    if (NULL == (pk = rsa_key_create ()))
-    {
-       GNUNET_break (0);
-       break;
-    }
-    enc = GNUNET_CRYPTO_rsa_encode_key (pk);
-    if (GNUNET_TESTING_HOSTKEYFILESIZE != htons (enc->len))
-    {
-      /* sometimes we get a different key length because 'd' or 'u' start
-         with leading bits; skip those... */
-      GNUNET_CRYPTO_rsa_key_free (pk);
-      GNUNET_free (enc);
-      make_keys++;
-      continue;
-    }
-    if (htons (enc->len) != fwrite (enc, 1, htons (enc->len), f))
-      {
-        fprintf (stderr,
-                 _("\nFailed to write to `%s': %s\n"),
-                 fn,
-                 STRERROR (errno));
-        GNUNET_CRYPTO_rsa_key_free (pk);
-        GNUNET_free (enc);
-        break;
-      }
-    GNUNET_CRYPTO_rsa_key_free (pk);
-    GNUNET_free (enc);
-  }
-  if (0 == make_keys)
-    fprintf (stderr,
-             _("Finished!\n"));
-  fclose (f);
-}
-
 
 /**
  * Main function that will be run by the scheduler.
@@ -174,11 +72,6 @@ run (void *cls, char *const *args, const char *cfgfile,
   }
   if (0 != weak_random)    
     GNUNET_CRYPTO_random_disable_entropy_gathering ();  
-  if (make_keys > 0)
-  {
-    create_keys (args[0]);
-    return;
-  }
   pk = GNUNET_CRYPTO_rsa_key_create_from_file (args[0]);
   if (NULL == pk)
     return;
@@ -225,9 +118,6 @@ int
 main (int argc, char *const*argv)
 {
   static const struct GNUNET_GETOPT_CommandLineOption options[] = {
-    { 'g', "generate-keys", "COUNT",
-      gettext_noop ("create COUNT public-private key pairs (for testing)"),
-      1, &GNUNET_GETOPT_set_uint, &make_keys },
     { 'p', "print-public-key", NULL,
       gettext_noop ("print the public key in ASCII format"),
       0, &GNUNET_GETOPT_set_one, &print_public_key },
diff --git a/src/util/test_crypto_aes.c b/src/util/test_crypto_aes.c
index 971e9afbe..88b51188e 100644
--- a/src/util/test_crypto_aes.c
+++ b/src/util/test_crypto_aes.c
@@ -95,17 +95,6 @@ verifyCrypto ()
   ret = 0;
 
   memcpy (key.key, raw_key, GNUNET_CRYPTO_AES_KEY_LENGTH);
-  key.crc32 =
-      htonl (GNUNET_CRYPTO_crc32_n (&key, GNUNET_CRYPTO_AES_KEY_LENGTH));
-
-  if (ntohl (key.crc32) != (unsigned int) 38125195LL)
-  {
-    printf ("Static key has different CRC: %u - %u\n", ntohl (key.crc32),
-            key.crc32);
-
-    ret = 1;
-    goto error;
-  }
 
   if (GNUNET_CRYPTO_AES_KEY_LENGTH !=
       GNUNET_CRYPTO_aes_encrypt (plain, GNUNET_CRYPTO_AES_KEY_LENGTH, &key,
diff --git a/src/util/test_crypto_aes_weak.c b/src/util/test_crypto_aes_weak.c
index 0b7ba5c54..201bfeb5d 100644
--- a/src/util/test_crypto_aes_weak.c
+++ b/src/util/test_crypto_aes_weak.c
@@ -91,9 +91,6 @@ testWeakKey ()
   weak_key.key[30] = (char) (0xaa);
   weak_key.key[31] = (char) (0xaa);
   /* memset(&weak_key, 0, 32); */
-  weak_key.crc32 =
-      htonl (GNUNET_CRYPTO_crc32_n (&weak_key, GNUNET_CRYPTO_AES_KEY_LENGTH));
-
   size =
       GNUNET_CRYPTO_aes_encrypt (WEAK_KEY_TESTSTRING,
                                  strlen (WEAK_KEY_TESTSTRING) + 1, &weak_key,