pgcrypto: support changing S2K iteration count

pgcrypto already supports key-stretching during symmetric encryption,
including the salted-and-iterated method; but the number of iterations
was not configurable.  This commit implements a new s2k-count parameter
to pgp_sym_encrypt() which permits selecting a larger number of
iterations.

Author: Jeff Janes

diff --git a/contrib/pgcrypto/expected/pgp-encrypt.out b/contrib/pgcrypto/expected/pgp-encrypt.out
index b35de79afa741173cb63e3f868884f1aebcf295b..8fc558c402bde4400746c05fed376e2b1f3849c9 100644 (file)
--- a/contrib/pgcrypto/expected/pgp-encrypt.out
+++ b/contrib/pgcrypto/expected/pgp-encrypt.out
@@ -103,6 +103,25 @@ select pgp_sym_decrypt(
  Secret.
 (1 row)
 
+-- s2k count change
+select pgp_sym_decrypt(
+   pgp_sym_encrypt('Secret.', 'key', 's2k-count=1024'),
+   'key', 'expect-s2k-count=1024');
+ pgp_sym_decrypt 
+-----------------
+ Secret.
+(1 row)
+
+-- s2k_count rounds up
+select pgp_sym_decrypt(
+   pgp_sym_encrypt('Secret.', 'key', 's2k-count=65000000'),
+   'key', 'expect-s2k-count=65000000');
+NOTICE:  pgp_decrypt: unexpected s2k_count: expected 65000000 got 65011712
+ pgp_sym_decrypt 
+-----------------
+ Secret.
+(1 row)
+
 -- s2k digest change
 select pgp_sym_decrypt(
    pgp_sym_encrypt('Secret.', 'key', 's2k-digest-algo=md5'),

diff --git a/contrib/pgcrypto/pgp-decrypt.c b/contrib/pgcrypto/pgp-decrypt.c
index 5c69745156ccba0884bd82d3f6863e9f56d85ccc..9ea60c4c47daf2201438f4dfb102ef342b27bb55 100644 (file)
--- a/contrib/pgcrypto/pgp-decrypt.c
+++ b/contrib/pgcrypto/pgp-decrypt.c
@@ -643,6 +643,7 @@ parse_symenc_sesskey(PGP_Context *ctx, PullFilter *src)
    if (res < 0)
        return res;
    ctx->s2k_mode = ctx->s2k.mode;
+   ctx->s2k_count = s2k_decode_count(ctx->s2k.iter);
    ctx->s2k_digest_algo = ctx->s2k.digest_algo;
 
    /*

diff --git a/contrib/pgcrypto/pgp-encrypt.c b/contrib/pgcrypto/pgp-encrypt.c
index 2320c7574b5cb585138fa09cb12e96b968da49da..c9148fd2fc6d0f630ba1116a5d753157791d9d85 100644 (file)
--- a/contrib/pgcrypto/pgp-encrypt.c
+++ b/contrib/pgcrypto/pgp-encrypt.c
@@ -567,7 +567,7 @@ init_s2k_key(PGP_Context *ctx)
    if (ctx->s2k_cipher_algo < 0)
        ctx->s2k_cipher_algo = ctx->cipher_algo;
 
-   res = pgp_s2k_fill(&ctx->s2k, ctx->s2k_mode, ctx->s2k_digest_algo);
+   res = pgp_s2k_fill(&ctx->s2k, ctx->s2k_mode, ctx->s2k_digest_algo, ctx->s2k_count);
    if (res < 0)
        return res;
 

diff --git a/contrib/pgcrypto/pgp-pgsql.c b/contrib/pgcrypto/pgp-pgsql.c
index 1842985e53db053a05701597d3a935ac6d959652..1f65b667cab3747cf2af2216b577284f31e3051c 100644 (file)
--- a/contrib/pgcrypto/pgp-pgsql.c
+++ b/contrib/pgcrypto/pgp-pgsql.c
@@ -181,6 +181,7 @@ struct debug_expect
    int         expect;
    int         cipher_algo;
    int         s2k_mode;
+   int         s2k_count;
    int         s2k_cipher_algo;
    int         s2k_digest_algo;
    int         compress_algo;
@@ -196,6 +197,7 @@ fill_expect(struct debug_expect * ex, int text_mode)
    ex->expect = 0;
    ex->cipher_algo = -1;
    ex->s2k_mode = -1;
+   ex->s2k_count = -1;
    ex->s2k_cipher_algo = -1;
    ex->s2k_digest_algo = -1;
    ex->compress_algo = -1;
@@ -218,6 +220,7 @@ check_expect(PGP_Context *ctx, struct debug_expect * ex)
 {
    EX_CHECK(cipher_algo);
    EX_CHECK(s2k_mode);
+   EX_CHECK(s2k_count);
    EX_CHECK(s2k_digest_algo);
    EX_CHECK(use_sess_key);
    if (ctx->use_sess_key)
@@ -247,6 +250,8 @@ set_arg(PGP_Context *ctx, char *key, char *val,
        res = pgp_set_sess_key(ctx, atoi(val));
    else if (strcmp(key, "s2k-mode") == 0)
        res = pgp_set_s2k_mode(ctx, atoi(val));
+   else if (strcmp(key, "s2k-count") == 0)
+       res = pgp_set_s2k_count(ctx, atoi(val));
    else if (strcmp(key, "s2k-digest-algo") == 0)
        res = pgp_set_s2k_digest_algo(ctx, val);
    else if (strcmp(key, "s2k-cipher-algo") == 0)
@@ -286,6 +291,11 @@ set_arg(PGP_Context *ctx, char *key, char *val,
        ex->expect = 1;
        ex->s2k_mode = atoi(val);
    }
+   else if (ex != NULL && strcmp(key, "expect-s2k-count") == 0)
+   {
+       ex->expect = 1;
+       ex->s2k_count = atoi(val);
+   }
    else if (ex != NULL && strcmp(key, "expect-s2k-digest-algo") == 0)
    {
        ex->expect = 1;

diff --git a/contrib/pgcrypto/pgp-s2k.c b/contrib/pgcrypto/pgp-s2k.c
index 193dd95173ffed5b716961ec8faa4f24d02897b6..9937d154f275853b2e013f287d04a9b8dc79d993 100644 (file)
--- a/contrib/pgcrypto/pgp-s2k.c
+++ b/contrib/pgcrypto/pgp-s2k.c
@@ -132,12 +132,10 @@ calc_s2k_iter_salted(PGP_S2K *s2k, PX_MD *md, const uint8 *key,
    unsigned    preload = 0;
    unsigned    remain,
                c,
-               cval,
                curcnt,
                count;
 
-   cval = s2k->iter;
-   count = ((unsigned) 16 + (cval & 15)) << ((cval >> 4) + 6);
+   count = s2k_decode_count(s2k->iter);
 
    md_rlen = px_md_result_size(md);
 
@@ -195,21 +193,34 @@ calc_s2k_iter_salted(PGP_S2K *s2k, PX_MD *md, const uint8 *key,
 }
 
 /*
- * Decide S2K_ISALTED iteration count
+ * Decide PGP_S2K_ISALTED iteration count (in OpenPGP one-byte representation)
  *
  * Too small: weak
  * Too big: slow
  * gpg defaults to 96 => 65536 iters
- * let it float a bit: 96 + 32 => 262144 iters
+ *
+ * For our default (count=-1) we let it float a bit: 96 + 32 => between 65536
+ * and 262144 iterations.
+ *
+ * Otherwise, find the smallest number which provides at least the specified
+ * iteration count.
  */
-static int
-decide_count(unsigned rand_byte)
+static uint8
+decide_s2k_iter(unsigned rand_byte, int count)
 {
-   return 96 + (rand_byte & 0x1F);
+   int         iter;
+
+   if (count == -1)
+       return 96 + (rand_byte & 0x1F);
+   /* this is a bit brute-force, but should be quick enough */
+   for (iter = 0; iter <= 255; iter++)
+       if (s2k_decode_count(iter) >= count)
+           return iter;
+   return 255;
 }
 
 int
-pgp_s2k_fill(PGP_S2K *s2k, int mode, int digest_algo)
+pgp_s2k_fill(PGP_S2K *s2k, int mode, int digest_algo, int count)
 {
    int         res = 0;
    uint8       tmp;
@@ -219,19 +230,19 @@ pgp_s2k_fill(PGP_S2K *s2k, int mode, int digest_algo)
 
    switch (s2k->mode)
    {
-       case 0:
+       case PGP_S2K_SIMPLE:
            break;
-       case 1:
+       case PGP_S2K_SALTED:
            res = px_get_pseudo_random_bytes(s2k->salt, PGP_S2K_SALT);
            break;
-       case 3:
+       case PGP_S2K_ISALTED:
            res = px_get_pseudo_random_bytes(s2k->salt, PGP_S2K_SALT);
            if (res < 0)
                break;
            res = px_get_pseudo_random_bytes(&tmp, 1);
            if (res < 0)
                break;
-           s2k->iter = decide_count(tmp);
+           s2k->iter = decide_s2k_iter(tmp, count);
            break;
        default:
            res = PXE_PGP_BAD_S2K_MODE;

diff --git a/contrib/pgcrypto/pgp.c b/contrib/pgcrypto/pgp.c
index 03fe48fb64ce0025506aa2ecf7f62f6751b009a8..0800fc325d10b1ceefe90461adc3f82a927eca5b 100644 (file)
--- a/contrib/pgcrypto/pgp.c
+++ b/contrib/pgcrypto/pgp.c
@@ -40,6 +40,7 @@
 static int def_cipher_algo = PGP_SYM_AES_128;
 static int def_s2k_cipher_algo = -1;
 static int def_s2k_mode = PGP_S2K_ISALTED;
+static int def_s2k_count = -1;
 static int def_s2k_digest_algo = PGP_DIGEST_SHA1;
 static int def_compress_algo = PGP_COMPR_NONE;
 static int def_compress_level = 6;
@@ -206,6 +207,7 @@ pgp_init(PGP_Context **ctx_p)
    ctx->cipher_algo = def_cipher_algo;
    ctx->s2k_cipher_algo = def_s2k_cipher_algo;
    ctx->s2k_mode = def_s2k_mode;
+   ctx->s2k_count = def_s2k_count;
    ctx->s2k_digest_algo = def_s2k_digest_algo;
    ctx->compress_algo = def_compress_algo;
    ctx->compress_level = def_compress_level;
@@ -269,6 +271,17 @@ pgp_set_s2k_mode(PGP_Context *ctx, int mode)
    return err;
 }
 
+int
+pgp_set_s2k_count(PGP_Context *ctx, int count)
+{
+   if (ctx->s2k_mode == PGP_S2K_ISALTED && count >= 1024 && count <= 65011712)
+   {
+       ctx->s2k_count = count;
+       return PXE_OK;
+   }
+   return PXE_ARGUMENT_ERROR;
+}
+
 int
 pgp_set_compress_algo(PGP_Context *ctx, int algo)
 {

diff --git a/contrib/pgcrypto/pgp.h b/contrib/pgcrypto/pgp.h
index 62b8517c27c682e50c0993d9b9d74c3d97934bbc..88f7f8dc48409796ffb386748ed40a46fc1e9fe4 100644 (file)
--- a/contrib/pgcrypto/pgp.h
+++ b/contrib/pgcrypto/pgp.h
@@ -124,7 +124,7 @@ struct PGP_S2K
    uint8       mode;
    uint8       digest_algo;
    uint8       salt[8];
-   uint8       iter;
+   uint8       iter;       /* encoded (one-octet) count */
    /* calculated: */
    uint8       key[PGP_MAX_KEY];
    uint8       key_len;
@@ -138,6 +138,7 @@ struct PGP_Context
     */
    PGP_S2K     s2k;
    int         s2k_mode;
+   int         s2k_count;      /* 4-byte decoded count */
    int         s2k_digest_algo;
    int         s2k_cipher_algo;
    int         cipher_algo;
@@ -171,6 +172,10 @@ struct PGP_Context
    unsigned    sess_key_len;
 };
 
+/* from RFC 4880 3.7.1.3 */
+#define s2k_decode_count(cval) \
+   (((unsigned) 16 + (cval & 15)) << ((cval >> 4) + 6))
+
 struct PGP_MPI
 {
    uint8      *data;
@@ -243,6 +248,7 @@ const char *pgp_get_cipher_name(int code);
 
 int            pgp_set_cipher_algo(PGP_Context *ctx, const char *name);
 int            pgp_set_s2k_mode(PGP_Context *ctx, int type);
+int            pgp_set_s2k_count(PGP_Context *ctx, int count);
 int            pgp_set_s2k_cipher_algo(PGP_Context *ctx, const char *name);
 int            pgp_set_s2k_digest_algo(PGP_Context *ctx, const char *name);
 int            pgp_set_convert_crlf(PGP_Context *ctx, int doit);
@@ -267,7 +273,7 @@ int         pgp_load_cipher(int c, PX_Cipher **res);
 int            pgp_get_cipher_key_size(int c);
 int            pgp_get_cipher_block_size(int c);
 
-int            pgp_s2k_fill(PGP_S2K *s2k, int mode, int digest_algo);
+int            pgp_s2k_fill(PGP_S2K *s2k, int mode, int digest_algo, int count);
 int            pgp_s2k_read(PullFilter *src, PGP_S2K *s2k);
 int            pgp_s2k_process(PGP_S2K *s2k, int cipher, const uint8 *key, int klen);
 

diff --git a/contrib/pgcrypto/sql/pgp-encrypt.sql b/contrib/pgcrypto/sql/pgp-encrypt.sql
index a9ac0b924b7828c090f730013f859394f30c5f40..ed9d2c8127f8ae8682835c2700166c2398a9c8e6 100644 (file)
--- a/contrib/pgcrypto/sql/pgp-encrypt.sql
+++ b/contrib/pgcrypto/sql/pgp-encrypt.sql
@@ -55,6 +55,15 @@ select pgp_sym_decrypt(
    pgp_sym_encrypt('Secret.', 'key', 's2k-mode=3'),
    'key', 'expect-s2k-mode=3');
 
+-- s2k count change
+select pgp_sym_decrypt(
+   pgp_sym_encrypt('Secret.', 'key', 's2k-count=1024'),
+   'key', 'expect-s2k-count=1024');
+-- s2k_count rounds up
+select pgp_sym_decrypt(
+   pgp_sym_encrypt('Secret.', 'key', 's2k-count=65000000'),
+   'key', 'expect-s2k-count=65000000');
+
 -- s2k digest change
 select pgp_sym_decrypt(
    pgp_sym_encrypt('Secret.', 'key', 's2k-digest-algo=md5'),

diff --git a/doc/src/sgml/pgcrypto.sgml b/doc/src/sgml/pgcrypto.sgml
index bfcbe02f8512c1a72f55d8369246a9875715f41b..21a884bf20cd8bdacda6ef16f5a16974ce1795aa 100644 (file)
--- a/doc/src/sgml/pgcrypto.sgml
+++ b/doc/src/sgml/pgcrypto.sgml
@@ -858,6 +858,19 @@ Applies to: pgp_sym_encrypt
 </literallayout>
   </sect4>
 
+  <sect4>
+   <title>s2k-count</title>
+
+   <para>
+    The number of iterations of the S2K algorithm to use.  It must
+    be a value between 1024 and 65011712, inclusive.
+   </para>
+<literallayout>
+Default: A random value bewteen 65536 and 253952
+Applies to: pgp_sym_encrypt, only with s2k-mode=3
+</literallayout>
+  </sect4>
+
   <sect4>
    <title>s2k-digest-algo</title>