src/wallet/crypter.cpp

   1 // Copyright (c) 2009-2016 The Bitcoin Core developers
   2 // Distributed under the MIT software license, see the accompanying
   3 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
   4
   5 #include "crypter.h"
   6
   7 #include "crypto/aes.h"
   8 #include "crypto/sha512.h"
   9 #include "script/script.h"
  10 #include "script/standard.h"
  11 #include "util.h"
  12
  13 #include <string>
  14 #include <vector>
  15
  16 int CCrypter::BytesToKeySHA512AES(const std::vector<unsigned char>& chSalt, const SecureString& strKeyData, int count, unsigned char *key,unsigned char *iv) const
  17 {
  18     // This mimics the behavior of openssl's EVP_BytesToKey with an aes256cbc
  19     // cipher and sha512 message digest. Because sha512's output size (64b) is
  20     // greater than the aes256 block size (16b) + aes256 key size (32b),
  21     // there's no need to process more than once (D_0).
  22
  23     if(!count || !key || !iv)
  24         return 0;
  25
  26     unsigned char buf[CSHA512::OUTPUT_SIZE];
  27     CSHA512 di;
  28
  29     di.Write((const unsigned char*)strKeyData.c_str(), strKeyData.size());
  30     di.Write(chSalt.data(), chSalt.size());
  31     di.Finalize(buf);
  32
  33     for(int i = 0; i != count - 1; i++)
  34         di.Reset().Write(buf, sizeof(buf)).Finalize(buf);
  35
  36     memcpy(key, buf, WALLET_CRYPTO_KEY_SIZE);
  37     memcpy(iv, buf + WALLET_CRYPTO_KEY_SIZE, WALLET_CRYPTO_IV_SIZE);
  38     memory_cleanse(buf, sizeof(buf));
  39     return WALLET_CRYPTO_KEY_SIZE;
  40 }
  41
  42 bool CCrypter::SetKeyFromPassphrase(const SecureString& strKeyData, const std::vector<unsigned char>& chSalt, const unsigned int nRounds, const unsigned int nDerivationMethod)
  43 {
  44     if (nRounds < 1 || chSalt.size() != WALLET_CRYPTO_SALT_SIZE)
  45         return false;
  46
  47     int i = 0;
  48     if (nDerivationMethod == 0)
  49         i = BytesToKeySHA512AES(chSalt, strKeyData, nRounds, vchKey.data(), vchIV.data());
  50
  51     if (i != (int)WALLET_CRYPTO_KEY_SIZE)
  52     {
  53         memory_cleanse(vchKey.data(), vchKey.size());
  54         memory_cleanse(vchIV.data(), vchIV.size());
  55         return false;
  56     }
  57
  58     fKeySet = true;
  59     return true;
  60 }
  61
  62 bool CCrypter::SetKey(const CKeyingMaterial& chNewKey, const std::vector<unsigned char>& chNewIV)
  63 {
  64     if (chNewKey.size() != WALLET_CRYPTO_KEY_SIZE || chNewIV.size() != WALLET_CRYPTO_IV_SIZE)
  65         return false;
  66
  67     memcpy(vchKey.data(), chNewKey.data(), chNewKey.size());
  68     memcpy(vchIV.data(), chNewIV.data(), chNewIV.size());
  69
  70     fKeySet = true;
  71     return true;
  72 }
  73
  74 bool CCrypter::Encrypt(const CKeyingMaterial& vchPlaintext, std::vector<unsigned char> &vchCiphertext) const
  75 {
  76     if (!fKeySet)
  77         return false;
  78
  79     // max ciphertext len for a n bytes of plaintext is
  80     // n + AES_BLOCKSIZE bytes
  81     vchCiphertext.resize(vchPlaintext.size() + AES_BLOCKSIZE);
  82
  83     AES256CBCEncrypt enc(vchKey.data(), vchIV.data(), true);
  84     size_t nLen = enc.Encrypt(&vchPlaintext[0], vchPlaintext.size(), vchCiphertext.data());
  85     if(nLen < vchPlaintext.size())
  86         return false;
  87     vchCiphertext.resize(nLen);
  88
  89     return true;
  90 }
  91
  92 bool CCrypter::Decrypt(const std::vector<unsigned char>& vchCiphertext, CKeyingMaterial& vchPlaintext) const
  93 {
  94     if (!fKeySet)
  95         return false;
  96
  97     // plaintext will always be equal to or lesser than length of ciphertext
  98     int nLen = vchCiphertext.size();
  99
 100     vchPlaintext.resize(nLen);
 101
 102     AES256CBCDecrypt dec(vchKey.data(), vchIV.data(), true);
 103     nLen = dec.Decrypt(vchCiphertext.data(), vchCiphertext.size(), &vchPlaintext[0]);
 104     if(nLen == 0)
 105         return false;
 106     vchPlaintext.resize(nLen);
 107     return true;
 108 }
 109
 110
 111 static bool EncryptSecret(const CKeyingMaterial& vMasterKey, const CKeyingMaterial &vchPlaintext, const uint256& nIV, std::vector<unsigned char> &vchCiphertext)
 112 {
 113     CCrypter cKeyCrypter;
 114     std::vector<unsigned char> chIV(WALLET_CRYPTO_IV_SIZE);
 115     memcpy(chIV.data(), &nIV, WALLET_CRYPTO_IV_SIZE);
 116     if(!cKeyCrypter.SetKey(vMasterKey, chIV))
 117         return false;
 118     return cKeyCrypter.Encrypt(*((const CKeyingMaterial*)&vchPlaintext), vchCiphertext);
 119 }
 120
 121 static bool DecryptSecret(const CKeyingMaterial& vMasterKey, const std::vector<unsigned char>& vchCiphertext, const uint256& nIV, CKeyingMaterial& vchPlaintext)
 122 {
 123     CCrypter cKeyCrypter;
 124     std::vector<unsigned char> chIV(WALLET_CRYPTO_IV_SIZE);
 125     memcpy(chIV.data(), &nIV, WALLET_CRYPTO_IV_SIZE);
 126     if(!cKeyCrypter.SetKey(vMasterKey, chIV))
 127         return false;
 128     return cKeyCrypter.Decrypt(vchCiphertext, *((CKeyingMaterial*)&vchPlaintext));
 129 }
 130
 131 static bool DecryptKey(const CKeyingMaterial& vMasterKey, const std::vector<unsigned char>& vchCryptedSecret, const CPubKey& vchPubKey, CKey& key)
 132 {
 133     CKeyingMaterial vchSecret;
 134     if(!DecryptSecret(vMasterKey, vchCryptedSecret, vchPubKey.GetHash(), vchSecret))
 135         return false;
 136
 137     if (vchSecret.size() != 32)
 138         return false;
 139
 140     key.Set(vchSecret.begin(), vchSecret.end(), vchPubKey.IsCompressed());
 141     return key.VerifyPubKey(vchPubKey);
 142 }
 143
 144 bool CCryptoKeyStore::SetCrypted()
 145 {
 146     LOCK(cs_KeyStore);
 147     if (fUseCrypto)
 148         return true;
 149     if (!mapKeys.empty())
 150         return false;
 151     fUseCrypto = true;
 152     return true;
 153 }
 154
 155 bool CCryptoKeyStore::Lock()
 156 {
 157     if (!SetCrypted())
 158         return false;
 159
 160     {
 161         LOCK(cs_KeyStore);
 162         vMasterKey.clear();
 163     }
 164
 165     NotifyStatusChanged(this);
 166     return true;
 167 }
 168
 169 bool CCryptoKeyStore::Unlock(const CKeyingMaterial& vMasterKeyIn)
 170 {
 171     {
 172         LOCK(cs_KeyStore);
 173         if (!SetCrypted())
 174             return false;
 175
 176         bool keyPass = false;
 177         bool keyFail = false;
 178         CryptedKeyMap::const_iterator mi = mapCryptedKeys.begin();
 179         for (; mi != mapCryptedKeys.end(); ++mi)
 180         {
 181             const CPubKey &vchPubKey = (*mi).second.first;
 182             const std::vector<unsigned char> &vchCryptedSecret = (*mi).second.second;
 183             CKey key;
 184             if (!DecryptKey(vMasterKeyIn, vchCryptedSecret, vchPubKey, key))
 185             {
 186                 keyFail = true;
 187                 break;
 188             }
 189             keyPass = true;
 190             if (fDecryptionThoroughlyChecked)
 191                 break;
 192         }
 193         if (keyPass && keyFail)
 194         {
 195             LogPrintf("The wallet is probably corrupted: Some keys decrypt but not all.\n");
 196             assert(false);
 197         }
 198         if (keyFail || !keyPass)
 199             return false;
 200         vMasterKey = vMasterKeyIn;
 201         fDecryptionThoroughlyChecked = true;
 202     }
 203     NotifyStatusChanged(this);
 204     return true;
 205 }
 206
 207 bool CCryptoKeyStore::AddKeyPubKey(const CKey& key, const CPubKey &pubkey)
 208 {
 209     {
 210         LOCK(cs_KeyStore);
 211         if (!IsCrypted())
 212             return CBasicKeyStore::AddKeyPubKey(key, pubkey);
 213
 214         if (IsLocked())
 215             return false;
 216
 217         std::vector<unsigned char> vchCryptedSecret;
 218         CKeyingMaterial vchSecret(key.begin(), key.end());
 219         if (!EncryptSecret(vMasterKey, vchSecret, pubkey.GetHash(), vchCryptedSecret))
 220             return false;
 221
 222         if (!AddCryptedKey(pubkey, vchCryptedSecret))
 223             return false;
 224     }
 225     return true;
 226 }
 227
 228
 229 bool CCryptoKeyStore::AddCryptedKey(const CPubKey &vchPubKey, const std::vector<unsigned char> &vchCryptedSecret)
 230 {
 231     {
 232         LOCK(cs_KeyStore);
 233         if (!SetCrypted())
 234             return false;
 235
 236         mapCryptedKeys[vchPubKey.GetID()] = make_pair(vchPubKey, vchCryptedSecret);
 237     }
 238     return true;
 239 }
 240
 241 bool CCryptoKeyStore::GetKey(const CKeyID &address, CKey& keyOut) const
 242 {
 243     {
 244         LOCK(cs_KeyStore);
 245         if (!IsCrypted())
 246             return CBasicKeyStore::GetKey(address, keyOut);
 247
 248         CryptedKeyMap::const_iterator mi = mapCryptedKeys.find(address);
 249         if (mi != mapCryptedKeys.end())
 250         {
 251             const CPubKey &vchPubKey = (*mi).second.first;
 252             const std::vector<unsigned char> &vchCryptedSecret = (*mi).second.second;
 253             return DecryptKey(vMasterKey, vchCryptedSecret, vchPubKey, keyOut);
 254         }
 255     }
 256     return false;
 257 }
 258
 259 bool CCryptoKeyStore::GetPubKey(const CKeyID &address, CPubKey& vchPubKeyOut) const
 260 {
 261     {
 262         LOCK(cs_KeyStore);
 263         if (!IsCrypted())
 264             return CBasicKeyStore::GetPubKey(address, vchPubKeyOut);
 265
 266         CryptedKeyMap::const_iterator mi = mapCryptedKeys.find(address);
 267         if (mi != mapCryptedKeys.end())
 268         {
 269             vchPubKeyOut = (*mi).second.first;
 270             return true;
 271         }
 272         // Check for watch-only pubkeys
 273         return CBasicKeyStore::GetPubKey(address, vchPubKeyOut);
 274     }
 275 }
 276
 277 bool CCryptoKeyStore::EncryptKeys(CKeyingMaterial& vMasterKeyIn)
 278 {
 279     {
 280         LOCK(cs_KeyStore);
 281         if (!mapCryptedKeys.empty() || IsCrypted())
 282             return false;
 283
 284         fUseCrypto = true;
 285         for (KeyMap::value_type& mKey : mapKeys)
 286         {
 287             const CKey &key = mKey.second;
 288             CPubKey vchPubKey = key.GetPubKey();
 289             CKeyingMaterial vchSecret(key.begin(), key.end());
 290             std::vector<unsigned char> vchCryptedSecret;
 291             if (!EncryptSecret(vMasterKeyIn, vchSecret, vchPubKey.GetHash(), vchCryptedSecret))
 292                 return false;
 293             if (!AddCryptedKey(vchPubKey, vchCryptedSecret))
 294                 return false;
 295         }
 296         mapKeys.clear();
 297     }
 298     return true;
 299 }