-int send_metakey(connection_t *c)
-{
- char buffer[MAX_STRING_SIZE];
- int len, x;
-cp
- len = RSA_size(c->rsa_key);
-
- /* Allocate buffers for the meta key */
-
- if(!c->outkey)
- c->outkey = xmalloc(len);
-
- if(!c->outctx)
- c->outctx = xmalloc(sizeof(*c->outctx));
-cp
- /* Copy random data to the buffer */
-
- RAND_bytes(c->outkey, len);
-
- /* The message we send must be smaller than the modulus of the RSA key.
- By definition, for a key of k bits, the following formula holds:
-
- 2^(k-1) <= modulus < 2^(k)
-
- Where ^ means "to the power of", not "xor".
- This means that to be sure, we must choose our message < 2^(k-1).
- This can be done by setting the most significant bit to zero.
- */
-
- c->outkey[0] &= 0x7F;
-
- if(debug_lvl >= DEBUG_SCARY_THINGS)
- {
- bin2hex(c->outkey, buffer, len);
- buffer[len*2] = '\0';
- syslog(LOG_DEBUG, _("Generated random meta key (unencrypted): %s"), buffer);
- }
-
- /* Encrypt the random data
-
- We do not use one of the PKCS padding schemes here.
- This is allowed, because we encrypt a totally random string
- with a length equal to that of the modulus of the RSA key.
- */
-
- if(RSA_public_encrypt(len, c->outkey, buffer, c->rsa_key, RSA_NO_PADDING) != len)
- {
- syslog(LOG_ERR, _("Error during encryption of meta key for %s (%s)"), c->name, c->hostname);
- return -1;
- }
-cp
- /* Convert the encrypted random data to a hexadecimal formatted string */
-
- bin2hex(buffer, buffer, len);
- buffer[len*2] = '\0';
-
- /* Send the meta key */
-
- x = send_request(c, "%d %d %d %d %d %s", METAKEY,
- c->outcipher?c->outcipher->nid:0, c->outdigest?c->outdigest->type:0,
- c->outmaclength, c->outcompression, buffer);
-
- /* Further outgoing requests are encrypted with the key we just generated */
-
- if(c->outcipher)
- {
- EVP_EncryptInit(c->outctx, c->outcipher,
- c->outkey + len - c->outcipher->key_len,
- c->outkey + len - c->outcipher->key_len - c->outcipher->iv_len);
-
- c->status.encryptout = 1;
- }
-cp
- return x;
+static uint64_t byte_budget(const EVP_CIPHER *cipher) {
+ /* Hopefully some failsafe way to calculate the maximum amount of bytes to
+ send/receive with a given cipher before we might run into birthday paradox
+ attacks. Because we might use different modes, the block size of the mode
+ might be 1 byte. In that case, use the IV length. Ensure the whole thing
+ is limited to what can be represented with a 64 bits integer.
+ */
+
+ int ivlen = EVP_CIPHER_iv_length(cipher);
+ int blklen = EVP_CIPHER_block_size(cipher);
+ int len = blklen > 1 ? blklen : ivlen > 1 ? ivlen : 8;
+ int bits = len * 4 - 1;
+ return bits < 64 ? UINT64_C(1) << bits : UINT64_MAX;
+}
+
+bool send_metakey(connection_t *c) {
+ bool x;
+
+ int len = RSA_size(c->rsa_key);
+
+ /* Allocate buffers for the meta key */
+
+ char buffer[2 * len + 1];
+
+ c->outkey = xrealloc(c->outkey, len);
+
+ if(!c->outctx) {
+ c->outctx = EVP_CIPHER_CTX_new();
+
+ if(!c->outctx) {
+ abort();
+ }
+ }
+
+ /* Copy random data to the buffer */
+
+ if(1 != RAND_bytes((unsigned char *)c->outkey, len)) {
+ int err = ERR_get_error();
+ logger(LOG_ERR, "Failed to generate meta key (%s)", ERR_error_string(err, NULL));
+ return false;
+ }
+
+
+ /* The message we send must be smaller than the modulus of the RSA key.
+ By definition, for a key of k bits, the following formula holds:
+
+ 2^(k-1) <= modulus < 2^(k)
+
+ Where ^ means "to the power of", not "xor".
+ This means that to be sure, we must choose our message < 2^(k-1).
+ This can be done by setting the most significant bit to zero.
+ */
+
+ c->outkey[0] &= 0x7F;
+
+ ifdebug(SCARY_THINGS) {
+ bin2hex(c->outkey, buffer, len);
+ buffer[len * 2] = '\0';
+ logger(LOG_DEBUG, "Generated random meta key (unencrypted): %s",
+ buffer);
+ }
+
+ /* Encrypt the random data
+
+ We do not use one of the PKCS padding schemes here.
+ This is allowed, because we encrypt a totally random string
+ with a length equal to that of the modulus of the RSA key.
+ */
+
+ if(RSA_public_encrypt(len, (unsigned char *)c->outkey, (unsigned char *)buffer, c->rsa_key, RSA_NO_PADDING) != len) {
+ logger(LOG_ERR, "Error during encryption of meta key for %s (%s): %s",
+ c->name, c->hostname, ERR_error_string(ERR_get_error(), NULL));
+ return false;
+ }
+
+ /* Convert the encrypted random data to a hexadecimal formatted string */
+
+ bin2hex(buffer, buffer, len);
+ buffer[len * 2] = '\0';
+
+ /* Send the meta key */
+
+ x = send_request(c, "%d %d %d %d %d %s", METAKEY,
+ c->outcipher ? EVP_CIPHER_nid(c->outcipher) : 0,
+ c->outdigest ? EVP_MD_type(c->outdigest) : 0, c->outmaclength,
+ c->outcompression, buffer);
+
+ /* Further outgoing requests are encrypted with the key we just generated */
+
+ if(c->outcipher) {
+ if(!EVP_EncryptInit(c->outctx, c->outcipher,
+ (unsigned char *)c->outkey + len - EVP_CIPHER_key_length(c->outcipher),
+ (unsigned char *)c->outkey + len - EVP_CIPHER_key_length(c->outcipher) -
+ EVP_CIPHER_iv_length(c->outcipher))) {
+ logger(LOG_ERR, "Error during initialisation of cipher for %s (%s): %s",
+ c->name, c->hostname, ERR_error_string(ERR_get_error(), NULL));
+ return false;
+ }
+
+ c->outbudget = byte_budget(c->outcipher);
+ c->status.encryptout = true;
+ }
+
+ return x;