crypter.cpp

Go to the documentation of this file.

// Copyright (c) 2009-2016 The Bitcoin Core developers
// Distributed under the MIT software license, see the accompanying
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
#include <wallet/crypter.h>
 
#include <common/system.h>
#include <crypto/aes.h>
#include <crypto/sha512.h>
 
#include <vector>
 
int CCrypter::BytesToKeySHA512AES(const std::vector<uint8_t> &chSalt,
                                  const SecureString &strKeyData, int count,
                                  uint8_t *key, uint8_t *iv) const {
    // This mimics the behavior of openssl's EVP_BytesToKey with an aes256cbc
    // cipher and sha512 message digest. Because sha512's output size (64b) is
    // greater than the aes256 block size (16b) + aes256 key size (32b), there's
    // no need to process more than once (D_0).
    if (!count || !key || !iv) {
        return 0;
    }
 
    uint8_t buf[CSHA512::OUTPUT_SIZE];
    CSHA512 di;
 
    di.Write((const uint8_t *)strKeyData.data(), strKeyData.size());
    di.Write(chSalt.data(), chSalt.size());
    di.Finalize(buf);
 
    for (int i = 0; i != count - 1; i++) {
        di.Reset().Write(buf, sizeof(buf)).Finalize(buf);
    }
 
    memcpy(key, buf, WALLET_CRYPTO_KEY_SIZE);
    memcpy(iv, buf + WALLET_CRYPTO_KEY_SIZE, WALLET_CRYPTO_IV_SIZE);
    memory_cleanse(buf, sizeof(buf));
    return WALLET_CRYPTO_KEY_SIZE;
}
 
bool CCrypter::SetKeyFromPassphrase(const SecureString &strKeyData,
                                    const std::vector<uint8_t> &chSalt,
                                    const unsigned int nRounds,
                                    const unsigned int nDerivationMethod) {
    if (nRounds < 1 || chSalt.size() != WALLET_CRYPTO_SALT_SIZE) {
        return false;
    }
 
    int i = 0;
    if (nDerivationMethod == 0) {
        i = BytesToKeySHA512AES(chSalt, strKeyData, nRounds, vchKey.data(),
                                vchIV.data());
    }
 
    if (i != (int)WALLET_CRYPTO_KEY_SIZE) {
        memory_cleanse(vchKey.data(), vchKey.size());
        memory_cleanse(vchIV.data(), vchIV.size());
        return false;
    }
 
    fKeySet = true;
    return true;
}
 
bool CCrypter::SetKey(const CKeyingMaterial &chNewKey,
                      const std::vector<uint8_t> &chNewIV) {
    if (chNewKey.size() != WALLET_CRYPTO_KEY_SIZE ||
        chNewIV.size() != WALLET_CRYPTO_IV_SIZE) {
        return false;
    }
 
    memcpy(vchKey.data(), chNewKey.data(), chNewKey.size());
    memcpy(vchIV.data(), chNewIV.data(), chNewIV.size());
 
    fKeySet = true;
    return true;
}
 
bool CCrypter::Encrypt(const CKeyingMaterial &vchPlaintext,
                       std::vector<uint8_t> &vchCiphertext) const {
    if (!fKeySet) {
        return false;
    }
 
    // max ciphertext len for a n bytes of plaintext is
    // n + AES_BLOCKSIZE bytes
    vchCiphertext.resize(vchPlaintext.size() + AES_BLOCKSIZE);
 
    AES256CBCEncrypt enc(vchKey.data(), vchIV.data(), true);
    size_t nLen = enc.Encrypt(vchPlaintext.data(), vchPlaintext.size(),
                              vchCiphertext.data());
    if (nLen < vchPlaintext.size()) {
        return false;
    }
    vchCiphertext.resize(nLen);
 
    return true;
}
 
bool CCrypter::Decrypt(const std::vector<uint8_t> &vchCiphertext,
                       CKeyingMaterial &vchPlaintext) const {
    if (!fKeySet) {
        return false;
    }
 
    // plaintext will always be equal to or lesser than length of ciphertext
    int nLen = vchCiphertext.size();
 
    vchPlaintext.resize(nLen);
 
    AES256CBCDecrypt dec(vchKey.data(), vchIV.data(), true);
    nLen = dec.Decrypt(vchCiphertext.data(), vchCiphertext.size(),
                       vchPlaintext.data());
    if (nLen == 0) {
        return false;
    }
    vchPlaintext.resize(nLen);
    return true;
}
 
bool EncryptSecret(const CKeyingMaterial &vMasterKey,
                   const CKeyingMaterial &vchPlaintext, const uint256 &nIV,
                   std::vector<uint8_t> &vchCiphertext) {
    CCrypter cKeyCrypter;
    std::vector<uint8_t> chIV(WALLET_CRYPTO_IV_SIZE);
    memcpy(chIV.data(), &nIV, WALLET_CRYPTO_IV_SIZE);
    if (!cKeyCrypter.SetKey(vMasterKey, chIV)) {
        return false;
    }
    return cKeyCrypter.Encrypt(*((const CKeyingMaterial *)&vchPlaintext),
                               vchCiphertext);
}
 
bool DecryptSecret(const CKeyingMaterial &vMasterKey,
                   const std::vector<uint8_t> &vchCiphertext,
                   const uint256 &nIV, CKeyingMaterial &vchPlaintext) {
    CCrypter cKeyCrypter;
    std::vector<uint8_t> chIV(WALLET_CRYPTO_IV_SIZE);
    memcpy(chIV.data(), &nIV, WALLET_CRYPTO_IV_SIZE);
    if (!cKeyCrypter.SetKey(vMasterKey, chIV)) {
        return false;
    }
    return cKeyCrypter.Decrypt(vchCiphertext, vchPlaintext);
}
 
bool DecryptKey(const CKeyingMaterial &vMasterKey,
                const std::vector<uint8_t> &vchCryptedSecret,
                const CPubKey &vchPubKey, CKey &key) {
    CKeyingMaterial vchSecret;
    if (!DecryptSecret(vMasterKey, vchCryptedSecret, vchPubKey.GetHash(),
                       vchSecret)) {
        return false;
    }
 
    if (vchSecret.size() != 32) {
        return false;
    }
 
    key.Set(vchSecret.begin(), vchSecret.end(), vchPubKey.IsCompressed());
    return key.VerifyPubKey(vchPubKey);
}