Bug#394759: [Pkg-openssl-devel] Bug#394759: please ship the des binary

[Kurt Roeckx]

On Sun, Oct 22, 2006 at 10:17:59PM +0100, Martin Michlmayr wrote:
> Package: openssl
> Version: 0.9.8c-3
> Severity: wishlist
> 
> The openssl source code includes the file crypto/des/des.c.  Do you
> think you could include the binary from this file in the openssl
> package?  I'd need this binary to encrypt something for
> debian-installer so the firmware of a specific device will accept it
> and apparently I cannot do this with the openssl binary itself.

So, there are a few changed between the way that old des binary works,
and the new:
- padding is different.
- Converting the key to the real key and IV happens with a different
  algorithm.  You need to use DES_string_to_key() to convert the key
  and set iv to 0.
- It doesn't use a salt, so you need the -nosalt option.

I've attached a patch that works for me for the padding problem, but I'm
not really sure if upstream is going to accept the patch as is.

For both encryption and decryption you need to use the -padolddes
option, you shouldn't use the -nopad option.

For the second problem it would be nice if there was an option in
openssl to convert the string using DES_string_to_key(), but I guess
this is easier to work around.


Kurt

-------------- next part --------------
--- openssl-0.9.8c/apps/enc.c	2005-04-30 15:17:05.000000000 +0000
+++ openssl-0.9.8c/apps/enc.c	2006-10-29 16:27:54.000000000 +0000
@@ -110,6 +110,7 @@
 	int bsize=BSIZE,verbose=0;
 	int ret=1,inl;
 	int nopad = 0;
+	int padolddes = 0;
 	unsigned char key[EVP_MAX_KEY_LENGTH],iv[EVP_MAX_IV_LENGTH];
 	unsigned char salt[PKCS5_SALT_LEN];
 	char *str=NULL, *passarg = NULL, *pass = NULL;
@@ -185,6 +186,11 @@
 			verbose=1;
 		else if	(strcmp(*argv,"-nopad") == 0)
 			nopad=1;
+		else if (strcmp(*argv,"-padolddes") == 0)
+		{
+			padolddes=1;
+			nopad=0;
+		}
 		else if	(strcmp(*argv,"-salt") == 0)
 			nosalt=0;
 		else if	(strcmp(*argv,"-nosalt") == 0)
@@ -550,6 +556,8 @@
 			ERR_print_errors(bio_err);
 			goto end;
 			}
+		if (padolddes)
+			EVP_CIPHER_CTX_set_padding(ctx, 2);
 
 		if (nopad)
 			EVP_CIPHER_CTX_set_padding(ctx, 0);
--- openssl-0.9.8c/crypto/evp/evp.h	2006-06-09 15:42:13.000000000 +0000
+++ openssl-0.9.8c/crypto/evp/evp.h	2006-10-29 16:12:43.000000000 +0000
@@ -347,6 +347,8 @@
 #define 	EVP_CIPH_NO_PADDING		0x100
 /* cipher handles random key generation */
 #define 	EVP_CIPH_RAND_KEY		0x200
+/* Make padding compatible with the old des utility */
+#define		EVP_CIPH_PADDING_OLD_DES	0x400
 
 /* ctrl() values */
 
--- openssl-0.9.8c/crypto/evp/evp_enc.c	2005-12-02 13:47:02.000000000 +0000
+++ openssl-0.9.8c/crypto/evp/evp_enc.c	2006-10-29 16:24:31.000000000 +0000
@@ -363,7 +363,14 @@
 		return 1;
 		}
 
-	n=b-bl;
+	if (ctx->flags & EVP_CIPH_PADDING_OLD_DES)
+	{
+		n=bl;
+	}
+	else
+	{
+		n=b-bl;
+	}
 	for (i=bl; i<b; i++)
 		ctx->buf[i]=n;
 	ret=ctx->cipher->do_cipher(ctx,out,ctx->buf,b);
@@ -461,15 +468,18 @@
 			EVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_BAD_DECRYPT);
 			return(0);
 			}
-		for (i=0; i<n; i++)
-			{
-			if (ctx->final[--b] != n)
+		if (!(ctx->flags & EVP_CIPH_PADDING_OLD_DES))
+		{
+			for (i=0; i<n; i++)
 				{
-				EVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_BAD_DECRYPT);
-				return(0);
+				if (ctx->final[--b] != n)
+					{
+					EVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_BAD_DECRYPT);
+					return(0);
+					}
 				}
-			}
-		n=ctx->cipher->block_size-n;
+			n=ctx->cipher->block_size-n;
+		}
 		for (i=0; i<n; i++)
 			out[i]=ctx->final[i];
 		*outl=n;
@@ -526,6 +536,7 @@
 
 int EVP_CIPHER_CTX_set_padding(EVP_CIPHER_CTX *ctx, int pad)
 	{
+	if (pad == 2) ctx->flags |= EVP_CIPH_PADDING_OLD_DES;
 	if (pad) ctx->flags &= ~EVP_CIPH_NO_PADDING;
 	else ctx->flags |= EVP_CIPH_NO_PADDING;
 	return 1;
--- openssl-0.9.8c/include/openssl/evp.h	2006-06-09 15:42:13.000000000 +0000
+++ openssl-0.9.8c/include/openssl/evp.h	2006-10-29 16:12:43.000000000 +0000
@@ -347,6 +347,8 @@
 #define 	EVP_CIPH_NO_PADDING		0x100
 /* cipher handles random key generation */
 #define 	EVP_CIPH_RAND_KEY		0x200
+/* Make padding compatible with the old des utility */
+#define		EVP_CIPH_PADDING_OLD_DES	0x400
 
 /* ctrl() values */