Mercurial > dropbear
annotate fuzzer-kexecdh.c @ 1672:3a97f14c0235
Add Chacha20-Poly1305, AES128-GCM and AES256-GCM support (#93)
* Add Chacha20-Poly1305 authenticated encryption
* Add general AEAD approach.
* Add [email protected] algo using LibTomCrypt chacha and
poly1305 routines.
Chacha20-Poly1305 is generally faster than AES256 on CPU w/o dedicated
AES instructions, having the same key size.
Compiling in will add ~5,5kB to binary size on x86-64.
function old new delta
chacha_crypt - 1397 +1397
_poly1305_block - 608 +608
poly1305_done - 595 +595
dropbear_chachapoly_crypt - 457 +457
.rodata 26976 27392 +416
poly1305_process - 290 +290
poly1305_init - 221 +221
chacha_setup - 218 +218
encrypt_packet 1068 1270 +202
dropbear_chachapoly_getlength - 147 +147
decrypt_packet 756 897 +141
chacha_ivctr64 - 137 +137
read_packet 543 637 +94
dropbear_chachapoly_start - 94 +94
read_kex_algos 792 880 +88
chacha_keystream - 69 +69
dropbear_mode_chachapoly - 48 +48
sshciphers 280 320 +40
dropbear_mode_none 24 48 +24
dropbear_mode_ctr 24 48 +24
dropbear_mode_cbc 24 48 +24
dropbear_chachapoly_mac - 24 +24
dropbear_chachapoly - 24 +24
gen_new_keys 848 854 +6
------------------------------------------------------------------------------
(add/remove: 14/0 grow/shrink: 10/0 up/down: 5388/0) Total: 5388 bytes
* Add AES128-GCM and AES256-GCM authenticated encryption
* Add general AES-GCM mode.
* Add [email protected] and [email protected] algo using
LibTomCrypt gcm routines.
AES-GCM is combination of AES CTR mode and GHASH, slower than AES-CTR on
CPU w/o dedicated AES/GHASH instructions therefore disabled by default.
Compiling in will add ~6kB to binary size on x86-64.
function old new delta
gcm_process - 1060 +1060
.rodata 26976 27808 +832
gcm_gf_mult - 820 +820
gcm_add_aad - 660 +660
gcm_shift_table - 512 +512
gcm_done - 471 +471
gcm_add_iv - 384 +384
gcm_init - 347 +347
dropbear_gcm_crypt - 309 +309
encrypt_packet 1068 1270 +202
decrypt_packet 756 897 +141
gcm_reset - 118 +118
read_packet 543 637 +94
read_kex_algos 792 880 +88
sshciphers 280 360 +80
gcm_mult_h - 80 +80
dropbear_gcm_start - 62 +62
dropbear_mode_gcm - 48 +48
dropbear_mode_none 24 48 +24
dropbear_mode_ctr 24 48 +24
dropbear_mode_cbc 24 48 +24
dropbear_ghash - 24 +24
dropbear_gcm_getlength - 24 +24
gen_new_keys 848 854 +6
------------------------------------------------------------------------------
(add/remove: 14/0 grow/shrink: 10/0 up/down: 6434/0) Total: 6434 bytes
| author | Vladislav Grishenko <themiron@users.noreply.github.com> |
|---|---|
| date | Mon, 25 May 2020 20:50:25 +0500 |
| parents | a57822db3eac |
| children |
| rev | line source |
|---|---|
| 1589 | 1 #include "fuzz.h" |
| 2 #include "session.h" | |
| 3 #include "fuzz-wrapfd.h" | |
| 4 #include "debug.h" | |
| 5 #include "runopts.h" | |
| 6 #include "algo.h" | |
| 7 #include "bignum.h" | |
| 8 | |
| 9 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { | |
| 10 static int once = 0; | |
| 11 static const struct dropbear_kex *ecdh[3]; /* 256, 384, 521 */ | |
| 12 static struct key_context* keep_newkeys = NULL; | |
|
1592
46506b32650a
reduce number of params so it doesn't hit a timeout
Matt Johnston <matt@ucc.asn.au>
parents:
1589
diff
changeset
|
13 /* number of generated parameters is limited by the timeout for the first run */ |
|
1595
4fe7cc9e45eb
reduce number of dh parameters so fuzzer doesn't timeout
Matt Johnston <matt@ucc.asn.au>
parents:
1592
diff
changeset
|
14 #define NUM_PARAMS 80 |
| 1589 | 15 static struct kex_ecdh_param *ecdh_params[NUM_PARAMS]; |
| 16 | |
| 17 if (!once) { | |
| 18 fuzz_common_setup(); | |
| 19 fuzz_svr_setup(); | |
| 20 | |
| 21 /* ses gets zeroed by fuzz_set_input */ | |
| 22 keep_newkeys = (struct key_context*)m_malloc(sizeof(struct key_context)); | |
| 23 ecdh[0] = fuzz_get_algo(sshkex, "ecdh-sha2-nistp256"); | |
| 24 ecdh[1] = fuzz_get_algo(sshkex, "ecdh-sha2-nistp384"); | |
| 25 ecdh[2] = fuzz_get_algo(sshkex, "ecdh-sha2-nistp521"); | |
| 26 assert(ecdh[0]); | |
| 27 assert(ecdh[1]); | |
| 28 assert(ecdh[2]); | |
| 29 keep_newkeys->algo_hostkey = DROPBEAR_SIGNKEY_ECDSA_NISTP256; | |
| 30 ses.newkeys = keep_newkeys; | |
| 31 | |
| 32 /* Pre-generate parameters */ | |
| 33 int i; | |
| 34 for (i = 0; i < NUM_PARAMS; i++) { | |
| 35 ses.newkeys->algo_kex = ecdh[i % 3]; | |
| 36 ecdh_params[i] = gen_kexecdh_param(); | |
| 37 } | |
| 38 | |
| 39 once = 1; | |
| 40 } | |
| 41 | |
| 42 if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) { | |
| 43 return 0; | |
| 44 } | |
| 45 | |
| 46 m_malloc_set_epoch(1); | |
| 47 | |
| 48 if (setjmp(fuzz.jmp) == 0) { | |
| 49 /* Based on recv_msg_kexdh_init()/send_msg_kexdh_reply() | |
| 50 with DROPBEAR_KEX_ECDH */ | |
| 51 ses.newkeys = keep_newkeys; | |
| 52 | |
| 53 /* random choice of ecdh 256, 384, 521 */ | |
| 54 unsigned char b = buf_getbyte(fuzz.input); | |
| 55 ses.newkeys->algo_kex = ecdh[b % 3]; | |
| 56 | |
| 57 /* Choose from the collection of ecdh params */ | |
| 58 unsigned int e = buf_getint(fuzz.input); | |
| 59 struct kex_ecdh_param *ecdh_param = ecdh_params[e % NUM_PARAMS]; | |
| 60 | |
| 61 buffer * ecdh_qs = buf_getstringbuf(fuzz.input); | |
| 62 | |
|
1606
98d2b125eb89
kexhashbuf was much to small in kex fuzzers
Matt Johnston <matt@ucc.asn.au>
parents:
1595
diff
changeset
|
63 ses.kexhashbuf = buf_new(KEXHASHBUF_MAX_INTS); |
| 1589 | 64 kexecdh_comb_key(ecdh_param, ecdh_qs, svr_opts.hostkey); |
| 65 | |
| 1609 | 66 mp_clear(ses.dh_K); |
| 1589 | 67 m_free(ses.dh_K); |
| 68 buf_free(ecdh_qs); | |
| 69 | |
| 1609 | 70 buf_free(ses.hash); |
| 71 buf_free(ses.session_id); | |
| 72 /* kexhashbuf is freed in kexdh_comb_key */ | |
| 73 | |
| 1589 | 74 m_malloc_free_epoch(1, 0); |
| 75 } else { | |
| 76 m_malloc_free_epoch(1, 1); | |
| 77 TRACE(("dropbear_exit longjmped")) | |
| 78 /* dropbear_exit jumped here */ | |
| 79 } | |
| 80 | |
| 81 return 0; | |
| 82 } |