From owner-freebsd-bugs Wed Oct 20 18:50:10 1999 Delivered-To: freebsd-bugs@freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.ORG [204.216.27.21]) by hub.freebsd.org (Postfix) with ESMTP id EF94D14D7F for ; Wed, 20 Oct 1999 18:50:01 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.9.3/8.9.2) id SAA85563; Wed, 20 Oct 1999 18:50:01 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: from vm.arl.mil (vm.arl.mil [128.63.247.191]) by hub.freebsd.org (Postfix) with ESMTP id C9FAF14E4F for ; Wed, 20 Oct 1999 18:41:53 -0700 (PDT) (envelope-from mike@vm.arl.mil) Received: (from mike@localhost) by vm.arl.mil (8.9.3/8.9.3) id VAA90833; Wed, 20 Oct 1999 21:39:57 -0400 (EDT) (envelope-from mike) Message-Id: <199910210139.VAA90833@vm.arl.mil> Date: Wed, 20 Oct 1999 21:39:57 -0400 (EDT) From: mike@arl.mil Reply-To: mike@arl.mil To: FreeBSD-gnats-submit@freebsd.org, mike@arl.mil X-Send-Pr-Version: 3.2 Subject: bin/14444: enigma command can't decrypt files encrypted on other UNIX systems Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org >Number: 14444 >Category: bin >Synopsis: enigma command can't decrypt files encrypted on other UNIX systems >Confidential: no >Severity: serious >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Oct 20 18:50:00 PDT 1999 >Closed-Date: >Last-Modified: >Originator: Mike Muuss >Release: FreeBSD 3.2-RELEASE i386 >Organization: ARL >Environment: This problem can apply to enigma on all FreeBSD platforms. >Description: 1) The 'enigma' program uses the /usr/libexec/makekey program to generate the key with which the Enigma machine is started. It has been modified to call the crypt(3) library routine directly, to simplify porting. (This is more of an issue for other OSs that we use this program on). 2) If the MD5 version of crypt(3) has been installed (the default for FreeBSD 3.x systems), the enigma program will not be able to decode files encrypted on other UNIX systems, nor will files encrypted on FreeBSD be able to be decrypted on other UNIX systems. As the only real point of having the enigma command around at all is to permit reading of old encrypted files, this defeats its purpose. I have added self-checking into the enigma source, so that if the crypt(3) routine is not functioning in a backwards-compatible manner, it will complain and abort. >How-To-Repeat: On FreeBSD, this (incorrect) output is produced: echo testing | enigma glorp | hd 00000000 20 e9 04 27 8e 38 8c 15 | ..'.8..| On correctly operating UNIX systems, this is the output produced: echo testing | crypt glorp | hd 00000000 bf f7 35 2b fc 49 fa 22 |..5+.I."| I verified these correct results on three systems: my reference VAX-11/780 running 4.3 BSD, an SGI Origin-200 running IRIX64 release 6.4, and a RedHat Linux 6.0 running on a Dell Dimension XPS-R400 Pentium. >Fix: *** /p/ftp/pub/FreeBSD/FreeBSD-current/src/usr.bin/enigma/enigma.c Fri Oct 30 10:24:00 1998 --- enigma.c Wed Oct 20 19:49:28 1999 *************** *** 8,18 **** * A public-domain replacement for the UNIX "crypt" command. * * Upgraded to function properly on 64-bit machines. */ - #include - #include - #include #include #include --- 8,19 ---- * A public-domain replacement for the UNIX "crypt" command. * * Upgraded to function properly on 64-bit machines. + * + * Upgraded to have inline "makekey", and to test for + * backwards-compatible operation of crypt(), rather than MD5 version. + * crypt() is often found in -lcrypt */ #include #include #include *************** *** 35,76 **** setup(pw) char *pw; { ! int ic, i, k, temp, pf[2], pid; unsigned random; long seed; strncpy(buf, pw, 8); while (*pw) *pw++ = '\0'; ! buf[8] = buf[0]; ! buf[9] = buf[1]; ! pipe(pf); ! if ((pid=fork())==0) { ! close(0); ! close(1); ! dup(pf[0]); ! dup(pf[1]); ! execlp("makekey", "-", 0); ! execl("/usr/libexec/makekey", "-", 0); /* BSDI */ ! execl("/usr/lib/makekey", "-", 0); ! execl("/usr/bin/makekey", "-", 0); /* IBM */ ! execl("/lib/makekey", "-", 0); ! perror("makekey"); ! fprintf(stderr, "enigma: cannot execute 'makekey', aborting\n"); ! exit(1); ! } ! write(pf[1], buf, 10); ! close(pf[1]); ! i=wait((int *)NULL); ! if (i<0) perror("enigma: wait"); ! if (i!=pid) { ! fprintf(stderr, "enigma: expected pid %d, got pid %d\n", pid, i); ! exit(1); ! } ! if ((i=read(pf[0], buf, 13)) != 13) { ! fprintf(stderr, "enigma: cannot generate key, read %d\n",i); ! exit(1); ! } seed = 123; for (i=0; i<13; i++) seed = seed*buf[i] + i; --- 36,70 ---- setup(pw) char *pw; { ! int ic, i, k, temp; unsigned random; long seed; + char *r; + char salt[3]; + + /* Verify backwards-compatible operation of library routine crypt() */ + r = crypt("glorp", "gl"); + if( strncmp( r, "$1$gl$85n.KNI", 13 ) == 0 ) { + fprintf(stderr, "enigma: crypt() library routine is using MD5 rather than DES.\n%s\n", + "Incompatible encryption would occur, aborting."); + exit(1); + } + if( strcmp( r, "gl4EsjmGvYQE." ) != 0 ) { + fprintf(stderr, "enigma: malfunction in crypt() library routine, aborting.\n"); + exit(1); + } + /* Don't exec makekey, just invoke library routine directly */ strncpy(buf, pw, 8); while (*pw) *pw++ = '\0'; ! buf[8] = '\0'; ! salt[0] = buf[0]; ! salt[1] = buf[1]; ! salt[2] = '\0'; ! r = crypt( buf, salt ); ! strncpy( buf, r, sizeof(buf) ); ! seed = 123; for (i=0; i<13; i++) seed = seed*buf[i] + i; END >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message