lib:crypto: Add implementation of GKDI key derivation

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/lib/crypto/gkdi.c b/lib/crypto/gkdi.c
index e049cf96baca2d0d6008b261b4000e8643a90935..6799dcfd70ec9e3517052b244b18d55f69f53e5f 100644 (file)
--- a/lib/crypto/gkdi.c
+++ b/lib/crypto/gkdi.c
@@ -18,4 +18,379 @@
    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 
+#include "includes.h"
+#include <gnutls/gnutls.h>
+#include <gnutls/crypto.h>
+
+#include "lib/crypto/gnutls_helpers.h"
+
+#include "lib/util/bytearray.h"
+
+#include "librpc/gen_ndr/ndr_security.h"
+#include "librpc/gen_ndr/gkdi.h"
+#include "librpc/gen_ndr/ndr_gkdi.h"
+
 #include "lib/crypto/gkdi.h"
+
+static const uint8_t kds_service[] = {
+       /* “KDS service” as a NULL‐terminated UTF‐16LE string. */
+       'K', 0, 'D', 0, 'S', 0, ' ', 0, 's', 0, 'e', 0,
+       'r', 0, 'v', 0, 'i', 0, 'c', 0, 'e', 0, 0,   0,
+};
+
+struct GkdiContextShort {
+       uint8_t buf[sizeof((struct GUID_ndr_buf){}.buf) + sizeof(int32_t) +
+                   sizeof(int32_t) + sizeof(int32_t)];
+};
+
+static NTSTATUS make_gkdi_context(const struct GkdiDerivationCtx *ctx,
+                                 struct GkdiContextShort *out_ctx)
+{
+       enum ndr_err_code ndr_err;
+       DATA_BLOB b = {.data = out_ctx->buf, .length = sizeof out_ctx->buf};
+
+       if (ctx->target_security_descriptor.length) {
+               return NT_STATUS_INVALID_PARAMETER;
+       }
+
+       ndr_err = ndr_push_struct_into_fixed_blob(
+               &b, ctx, (ndr_push_flags_fn_t)ndr_push_GkdiDerivationCtx);
+       if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+               return ndr_map_error2ntstatus(ndr_err);
+       }
+
+       return NT_STATUS_OK;
+}
+
+static NTSTATUS make_gkdi_context_security_descriptor(
+       TALLOC_CTX *mem_ctx,
+       const struct GkdiDerivationCtx *ctx,
+       const DATA_BLOB security_descriptor,
+       DATA_BLOB *out_ctx)
+{
+       enum ndr_err_code ndr_err;
+       struct GkdiDerivationCtx ctx_with_sd = *ctx;
+
+       if (ctx_with_sd.target_security_descriptor.length) {
+               return NT_STATUS_INVALID_PARAMETER;
+       }
+
+       ctx_with_sd.target_security_descriptor = security_descriptor;
+
+       ndr_err = ndr_push_struct_blob(out_ctx,
+                                      mem_ctx,
+                                      &ctx_with_sd,
+                                      (ndr_push_flags_fn_t)
+                                              ndr_push_GkdiDerivationCtx);
+       if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+               return ndr_map_error2ntstatus(ndr_err);
+       }
+
+       return NT_STATUS_OK;
+}
+
+struct GkdiContext {
+       struct GkdiDerivationCtx ctx;
+       gnutls_mac_algorithm_t algorithm;
+};
+
+gnutls_mac_algorithm_t get_sp800_108_mac_algorithm(
+       const struct KdfAlgorithm kdf_algorithm)
+{
+       switch (kdf_algorithm.id) {
+       case KDF_ALGORITHM_SP800_108_CTR_HMAC:
+               switch (kdf_algorithm.param.sp800_108) {
+               case KDF_PARAM_SHA1:
+                       return GNUTLS_MAC_SHA1;
+               case KDF_PARAM_SHA256:
+                       return GNUTLS_MAC_SHA256;
+               case KDF_PARAM_SHA384:
+                       return GNUTLS_MAC_SHA384;
+               case KDF_PARAM_SHA512:
+                       return GNUTLS_MAC_SHA512;
+               }
+               break;
+       }
+
+       return GNUTLS_MAC_UNKNOWN;
+}
+
+static NTSTATUS GkdiContext(const struct ProvRootKey *const root_key,
+                           struct GkdiContext *const ctx)
+{
+       NTSTATUS status = NT_STATUS_OK;
+       gnutls_mac_algorithm_t algorithm = GNUTLS_MAC_UNKNOWN;
+
+       if (ctx == NULL) {
+               status = NT_STATUS_INVALID_PARAMETER;
+               goto out;
+       }
+
+       if (root_key == NULL) {
+               status = NT_STATUS_INVALID_PARAMETER;
+               goto out;
+       }
+
+       if (root_key->version != root_key_version_1) {
+               status = NT_STATUS_NOT_SUPPORTED;
+               goto out;
+       }
+
+       if (root_key->data.length != GKDI_KEY_LEN) {
+               status = NT_STATUS_NOT_SUPPORTED;
+               goto out;
+       }
+
+       algorithm = get_sp800_108_mac_algorithm(root_key->kdf_algorithm);
+       if (algorithm == GNUTLS_MAC_UNKNOWN) {
+               status = NT_STATUS_NOT_SUPPORTED;
+               goto out;
+       }
+
+       /*
+        * The context comprises the GUID corresponding to the root key, the
+        * GKID (which we shall initialize to zero), and the encoded target
+        * security descriptor (which will initially be empty).
+        */
+       *ctx = (struct GkdiContext){
+               .ctx = {.guid = root_key->id,
+                       .l0_idx = 0,
+                       .l1_idx = 0,
+                       .l2_idx = 0,
+                       .target_security_descriptor = {}},
+               .algorithm = algorithm,
+       };
+out:
+       return status;
+}
+
+static NTSTATUS compute_l1_seed_key(
+       TALLOC_CTX *mem_ctx,
+       struct GkdiContext *ctx,
+       const DATA_BLOB security_descriptor,
+       const struct ProvRootKey *const root_key,
+       const struct Gkid gkid,
+       uint8_t key[static const GKDI_KEY_LEN])
+{
+       NTSTATUS status = NT_STATUS_OK;
+       struct GkdiContextShort short_ctx;
+       int8_t n;
+
+       ctx->ctx.l0_idx = gkid.l0_idx;
+       ctx->ctx.l1_idx = -1;
+       ctx->ctx.l2_idx = -1;
+
+       status = make_gkdi_context(&ctx->ctx, &short_ctx);
+       if (!NT_STATUS_IS_OK(status)) {
+               goto out;
+       }
+
+       /* Derive an L0 seed key with GKID = (L0, −1, −1). */
+
+       status = samba_gnutls_sp800_108_derive_key(root_key->data.data,
+                                                  root_key->data.length,
+                                                  NULL,
+                                                  0,
+                                                  kds_service,
+                                                  sizeof kds_service,
+                                                  short_ctx.buf,
+                                                  sizeof short_ctx.buf,
+                                                  ctx->algorithm,
+                                                  key,
+                                                  GKDI_KEY_LEN);
+       if (!NT_STATUS_IS_OK(status)) {
+               goto out;
+       }
+
+       /* Derive an L1 seed key with GKID = (L0, 31, −1). */
+
+       ctx->ctx.l1_idx = 31;
+
+       {
+               DATA_BLOB security_descriptor_ctx;
+
+               status = make_gkdi_context_security_descriptor(
+                       mem_ctx,
+                       &ctx->ctx,
+                       security_descriptor,
+                       &security_descriptor_ctx);
+               if (!NT_STATUS_IS_OK(status)) {
+                       goto out;
+               }
+
+               status = samba_gnutls_sp800_108_derive_key(
+                       key,
+                       GKDI_KEY_LEN,
+                       NULL,
+                       0,
+                       kds_service,
+                       sizeof kds_service,
+                       security_descriptor_ctx.data,
+                       security_descriptor_ctx.length,
+                       ctx->algorithm,
+                       key,
+                       GKDI_KEY_LEN);
+               data_blob_free(&security_descriptor_ctx);
+               if (!NT_STATUS_IS_OK(status)) {
+                       goto out;
+               }
+       }
+
+       for (n = 30; n >= gkid.l1_idx; --n) {
+               /* Derive an L1 seed key with GKID = (L0, n, −1). */
+
+               ctx->ctx.l1_idx = n;
+
+               status = make_gkdi_context(&ctx->ctx, &short_ctx);
+               if (!NT_STATUS_IS_OK(status)) {
+                       goto out;
+               }
+
+               status = samba_gnutls_sp800_108_derive_key(key,
+                                                          GKDI_KEY_LEN,
+                                                          NULL,
+                                                          0,
+                                                          kds_service,
+                                                          sizeof kds_service,
+                                                          short_ctx.buf,
+                                                          sizeof short_ctx.buf,
+                                                          ctx->algorithm,
+                                                          key,
+                                                          GKDI_KEY_LEN);
+               if (!NT_STATUS_IS_OK(status)) {
+                       goto out;
+               }
+       }
+
+out:
+       return status;
+}
+
+static NTSTATUS derive_l2_seed_key(struct GkdiContext *ctx,
+                                  const struct Gkid gkid,
+                                  uint8_t key[static const GKDI_KEY_LEN])
+{
+       NTSTATUS status = NT_STATUS_OK;
+       int8_t n;
+
+       ctx->ctx.l0_idx = gkid.l0_idx;
+       ctx->ctx.l1_idx = gkid.l1_idx;
+
+       for (n = 31; n >= gkid.l2_idx; --n) {
+               struct GkdiContextShort short_ctx;
+
+               /* Derive an L2 seed key with GKID = (L0, L1, n). */
+
+               ctx->ctx.l2_idx = n;
+
+               status = make_gkdi_context(&ctx->ctx, &short_ctx);
+               if (!NT_STATUS_IS_OK(status)) {
+                       goto out;
+               }
+
+               status = samba_gnutls_sp800_108_derive_key(key,
+                                                          GKDI_KEY_LEN,
+                                                          NULL,
+                                                          0,
+                                                          kds_service,
+                                                          sizeof kds_service,
+                                                          short_ctx.buf,
+                                                          sizeof short_ctx.buf,
+                                                          ctx->algorithm,
+                                                          key,
+                                                          GKDI_KEY_LEN);
+               if (!NT_STATUS_IS_OK(status)) {
+                       goto out;
+               }
+       }
+
+out:
+       return status;
+}
+
+static enum GkidType gkid_key_type(const struct Gkid gkid)
+{
+       if (gkid.l0_idx == -1) {
+               return GKID_DEFAULT;
+       }
+
+       if (gkid.l1_idx == -1) {
+               return GKID_L0_SEED_KEY;
+       }
+
+       if (gkid.l2_idx == -1) {
+               return GKID_L1_SEED_KEY;
+       }
+
+       return GKID_L2_SEED_KEY;
+}
+
+static bool gkid_is_valid(const struct Gkid gkid)
+{
+       if (gkid.l0_idx < -1) {
+               return false;
+       }
+
+       if (gkid.l1_idx < -1 || gkid.l1_idx >= gkdi_l1_key_iteration) {
+               return false;
+       }
+
+       if (gkid.l2_idx < -1 || gkid.l2_idx >= gkdi_l2_key_iteration) {
+               return false;
+       }
+
+       if (gkid.l0_idx == -1 && gkid.l1_idx != -1) {
+               return false;
+       }
+
+       if (gkid.l1_idx == -1 && gkid.l2_idx != -1) {
+               return false;
+       }
+
+       return true;
+}
+
+NTSTATUS compute_seed_key(
+       TALLOC_CTX *mem_ctx,
+       const DATA_BLOB target_security_descriptor,
+       const struct ProvRootKey *const root_key,
+       const struct Gkid gkid,
+       uint8_t key[static const GKDI_KEY_LEN])
+{
+       NTSTATUS status = NT_STATUS_OK;
+       enum GkidType gkid_type;
+       struct GkdiContext ctx;
+
+       if (!gkid_is_valid(gkid)) {
+               status = NT_STATUS_INVALID_PARAMETER;
+               goto out;
+       }
+
+       gkid_type = gkid_key_type(gkid);
+       if (gkid_type < GKID_L1_SEED_KEY) {
+               /* Don’t allow derivation of L0 seed keys. */
+               status = NT_STATUS_INVALID_PARAMETER;
+               goto out;
+       }
+
+       status = GkdiContext(root_key, &ctx);
+       if (!NT_STATUS_IS_OK(status)) {
+               goto out;
+       }
+
+       status = compute_l1_seed_key(
+               mem_ctx, &ctx, target_security_descriptor, root_key, gkid, key);
+       if (!NT_STATUS_IS_OK(status)) {
+               goto out;
+       }
+
+       if (gkid_type == GKID_L2_SEED_KEY) {
+               status = derive_l2_seed_key(&ctx, gkid, key);
+               if (!NT_STATUS_IS_OK(status)) {
+                       goto out;
+               }
+       }
+
+out:
+       return status;
+}

diff --git a/lib/crypto/gkdi.h b/lib/crypto/gkdi.h
index b6c18a8f6ae3ff52de94eea2212a2b2ac2a89574..892bcc4b380d6c051d550d8c8269e14d64140ea5 100644 (file)
--- a/lib/crypto/gkdi.h
+++ b/lib/crypto/gkdi.h
@@ -23,10 +23,77 @@
 
 #include <stdint.h>
 
+#include <gnutls/gnutls.h>
+
+#include "lib/util/data_blob.h"
+
+#include "libcli/util/ntstatus.h"
+
+#include "librpc/gen_ndr/misc.h"
+#include "lib/util/time.h"
+#include "talloc.h"
+
+enum KdfAlgorithmId {
+       KDF_ALGORITHM_SP800_108_CTR_HMAC,
+};
+
+enum KdfSp800_108Param {
+       KDF_PARAM_SHA1,
+       KDF_PARAM_SHA256,
+       KDF_PARAM_SHA384,
+       KDF_PARAM_SHA512,
+};
+
+struct KdfAlgorithm {
+       union {
+               enum KdfSp800_108Param sp800_108;
+       } param;
+       enum KdfAlgorithmId id;
+};
+
+enum {
+       root_key_version_1 = 1,
+};
+
+struct ProvRootKey {
+       struct GUID id;
+       DATA_BLOB data;
+       NTTIME create_time;
+       NTTIME use_start_time;
+       const char *domain_id;
+       struct KdfAlgorithm kdf_algorithm;
+       int32_t version;
+};
+
+struct Gkid {
+       int32_t l0_idx;
+       int8_t l1_idx; /* [range(0, 31)] */
+       int8_t l2_idx; /* [range(0, 31)] */
+};
+
+enum GkidType {
+       GKID_DEFAULT = -1,
+       GKID_L0_SEED_KEY = 0,
+       GKID_L1_SEED_KEY = 1,
+       GKID_L2_SEED_KEY = 2,
+};
+
 static const int gkdi_l1_key_iteration = 32;
 static const int gkdi_l2_key_iteration = 32;
 
 static const int64_t gkdi_key_cycle_duration = 360000000000;
 static const int64_t gkdi_max_clock_skew = 3000000000;
 
+#define GKDI_KEY_LEN 64
+
+gnutls_mac_algorithm_t get_sp800_108_mac_algorithm(
+       const struct KdfAlgorithm kdf_algorithm);
+
+NTSTATUS compute_seed_key(
+       TALLOC_CTX *mem_ctx,
+       const DATA_BLOB target_security_descriptor,
+       const struct ProvRootKey *const root_key,
+       const struct Gkid gkid,
+       uint8_t out[static const GKDI_KEY_LEN]);
+
 #endif /* LIB_CRYPTO_GKDI_H */

diff --git a/lib/crypto/wscript b/lib/crypto/wscript
index d39e7cbc8cb6718232050c8eac9118b9e8704499..1c94a8300b93d937de747a52c7e8a6c0251618c3 100644 (file)
--- a/lib/crypto/wscript
+++ b/lib/crypto/wscript
@@ -28,7 +28,12 @@ def build(bld):
                         ''')
 
     bld.SAMBA_SUBSYSTEM('gkdi',
-                        source='gkdi.c')
+                        source='gkdi.c',
+                        deps='''
+                        talloc
+                        GNUTLS_HELPERS
+                        NDR_GKDI
+                        ''')
 
     bld.SAMBA_PYTHON('python_crypto',
                      source='py_crypto.c',

diff --git a/librpc/idl/gkdi.idl b/librpc/idl/gkdi.idl
index e57e95b6c6e22d84f1e07dacbf53901cc97baf6e..233a7a05b4a691787e7ddb69da78dba8a9a36719 100644 (file)
--- a/librpc/idl/gkdi.idl
+++ b/librpc/idl/gkdi.idl
@@ -104,6 +104,14 @@ interface gkdi
                uint8 generator[key_length];
        } FfcDhParameters;
 
+       typedef [public] struct {
+               GUID guid;
+               int32 l0_idx;
+               int32 l1_idx;
+               int32 l2_idx;
+               [flag(NDR_REMAINING)] DATA_BLOB target_security_descriptor;
+       } GkdiDerivationCtx;
+
        HRESULT gkdi_GetKey(
                [in] uint32 target_sd_len,
                [in] [size_is(target_sd_len)] [ref] char *target_sd,