Commit c7419e7c authored by Mark Haines's avatar Mark Haines
Browse files

Try to ensure the compiler cannot optimise away attempts to erase secrets from memory

parent b3496b0a
...@@ -28,6 +28,7 @@ struct Curve25519KeyPair : public Curve25519PublicKey { ...@@ -28,6 +28,7 @@ struct Curve25519KeyPair : public Curve25519PublicKey {
std::uint8_t private_key[32]; std::uint8_t private_key[32];
}; };
/** Generate a curve25519 key pair from 32 random bytes. */ /** Generate a curve25519 key pair from 32 random bytes. */
void generate_key( void generate_key(
std::uint8_t const * random_32_bytes, std::uint8_t const * random_32_bytes,
...@@ -37,6 +38,7 @@ void generate_key( ...@@ -37,6 +38,7 @@ void generate_key(
const std::size_t CURVE25519_SHARED_SECRET_LENGTH = 32; const std::size_t CURVE25519_SHARED_SECRET_LENGTH = 32;
/** Create a shared secret using our private key and their public key. /** Create a shared secret using our private key and their public key.
* The output buffer must be at least 32 bytes long. */ * The output buffer must be at least 32 bytes long. */
void curve25519_shared_secret( void curve25519_shared_secret(
......
#include <cstddef>
namespace axolotl {
/** Clear the memory held in the buffer */
void unset(
volatile void * buffer, std::size_t buffer_length
);
/** Clear the memory backing an object */
template<typename T>
void unset(T & value) {
unset(reinterpret_cast<volatile void *>(&value), sizeof(T));
}
} // namespace axolotl
...@@ -14,6 +14,7 @@ ...@@ -14,6 +14,7 @@
*/ */
#include "axolotl/axolotl.hh" #include "axolotl/axolotl.hh"
#include "axolotl/message.hh" #include "axolotl/message.hh"
#include "axolotl/memory.hh"
#include <cstring> #include <cstring>
...@@ -26,14 +27,6 @@ std::uint8_t MESSAGE_KEY_SEED[1] = {0x01}; ...@@ -26,14 +27,6 @@ std::uint8_t MESSAGE_KEY_SEED[1] = {0x01};
std::uint8_t CHAIN_KEY_SEED[1] = {0x02}; std::uint8_t CHAIN_KEY_SEED[1] = {0x02};
std::size_t MAX_MESSAGE_GAP = 2000; std::size_t MAX_MESSAGE_GAP = 2000;
template<typename T>
void unset(
T & value
) {
std::memset(&value, 0, sizeof(T));
}
void create_chain_key( void create_chain_key(
axolotl::SharedKey const & root_key, axolotl::SharedKey const & root_key,
axolotl::Curve25519KeyPair const & our_key, axolotl::Curve25519KeyPair const & our_key,
...@@ -54,8 +47,8 @@ void create_chain_key( ...@@ -54,8 +47,8 @@ void create_chain_key(
std::memcpy(new_root_key, derived_secrets, 32); std::memcpy(new_root_key, derived_secrets, 32);
std::memcpy(new_chain_key.key, derived_secrets + 32, 32); std::memcpy(new_chain_key.key, derived_secrets + 32, 32);
new_chain_key.index = 0; new_chain_key.index = 0;
unset(derived_secrets); axolotl::unset(derived_secrets);
unset(secret); axolotl::unset(secret);
} }
...@@ -94,8 +87,8 @@ void create_message_keys( ...@@ -94,8 +87,8 @@ void create_message_keys(
std::memcpy(message_key.mac_key, derived_secrets + 32, 32); std::memcpy(message_key.mac_key, derived_secrets + 32, 32);
std::memcpy(message_key.iv.iv, derived_secrets + 64, 16); std::memcpy(message_key.iv.iv, derived_secrets + 64, 16);
message_key.index = chain_key.index; message_key.index = chain_key.index;
unset(derived_secrets); axolotl::unset(derived_secrets);
unset(secret); axolotl::unset(secret);
} }
...@@ -112,7 +105,7 @@ bool verify_mac( ...@@ -112,7 +105,7 @@ bool verify_mac(
); );
bool result = std::memcmp(mac, reader.mac, MAC_LENGTH) == 0; bool result = std::memcmp(mac, reader.mac, MAC_LENGTH) == 0;
unset(mac); axolotl::unset(mac);
return result; return result;
} }
...@@ -142,7 +135,7 @@ bool verify_mac_for_existing_chain( ...@@ -142,7 +135,7 @@ bool verify_mac_for_existing_chain(
create_message_keys(new_chain, session.kdf_info, message_key); create_message_keys(new_chain, session.kdf_info, message_key);
bool result = verify_mac(message_key, input, reader); bool result = verify_mac(message_key, input, reader);
unset(new_chain); axolotl::unset(new_chain);
return result; return result;
} }
...@@ -178,8 +171,8 @@ bool verify_mac_for_new_chain( ...@@ -178,8 +171,8 @@ bool verify_mac_for_new_chain(
bool result = verify_mac_for_existing_chain( bool result = verify_mac_for_existing_chain(
session, new_chain.chain_key, input, reader session, new_chain.chain_key, input, reader
); );
unset(new_root_key); axolotl::unset(new_root_key);
unset(new_chain); axolotl::unset(new_chain);
return result; return result;
} }
...@@ -207,7 +200,7 @@ void axolotl::Session::initialise_as_bob( ...@@ -207,7 +200,7 @@ void axolotl::Session::initialise_as_bob(
std::memcpy(root_key, derived_secrets, 32); std::memcpy(root_key, derived_secrets, 32);
std::memcpy(receiver_chains[0].chain_key.key, derived_secrets + 32, 32); std::memcpy(receiver_chains[0].chain_key.key, derived_secrets + 32, 32);
receiver_chains[0].ratchet_key = their_ratchet_key; receiver_chains[0].ratchet_key = their_ratchet_key;
unset(derived_secrets); axolotl::unset(derived_secrets);
} }
...@@ -226,7 +219,7 @@ void axolotl::Session::initialise_as_alice( ...@@ -226,7 +219,7 @@ void axolotl::Session::initialise_as_alice(
std::memcpy(root_key, derived_secrets, 32); std::memcpy(root_key, derived_secrets, 32);
std::memcpy(sender_chain[0].chain_key.key, derived_secrets + 32, 32); std::memcpy(sender_chain[0].chain_key.key, derived_secrets + 32, 32);
sender_chain[0].ratchet_key = our_ratchet_key; sender_chain[0].ratchet_key = our_ratchet_key;
unset(derived_secrets); axolotl::unset(derived_secrets);
} }
...@@ -303,7 +296,7 @@ std::size_t axolotl::Session::encrypt( ...@@ -303,7 +296,7 @@ std::size_t axolotl::Session::encrypt(
); );
std::memcpy(writer.mac, mac, MAC_LENGTH); std::memcpy(writer.mac, mac, MAC_LENGTH);
unset(keys); axolotl::unset(keys);
return writer.body_length + MAC_LENGTH; return writer.body_length + MAC_LENGTH;
} }
...@@ -385,7 +378,7 @@ std::size_t axolotl::Session::decrypt( ...@@ -385,7 +378,7 @@ std::size_t axolotl::Session::decrypt(
/* Remove the key from the skipped keys now that we've /* Remove the key from the skipped keys now that we've
* decoded the message it corresponds to. */ * decoded the message it corresponds to. */
unset(skipped); axolotl::unset(skipped);
skipped_message_keys.erase(&skipped); skipped_message_keys.erase(&skipped);
return result; return result;
} }
...@@ -414,7 +407,7 @@ std::size_t axolotl::Session::decrypt( ...@@ -414,7 +407,7 @@ std::size_t axolotl::Session::decrypt(
root_key, sender_chain[0].ratchet_key, chain->ratchet_key, root_key, sender_chain[0].ratchet_key, chain->ratchet_key,
kdf_info, root_key, chain->chain_key kdf_info, root_key, chain->chain_key
); );
unset(sender_chain[0]); axolotl::unset(sender_chain[0]);
sender_chain.erase(sender_chain.begin()); sender_chain.erase(sender_chain.begin());
} }
...@@ -433,7 +426,7 @@ std::size_t axolotl::Session::decrypt( ...@@ -433,7 +426,7 @@ std::size_t axolotl::Session::decrypt(
reader.ciphertext, reader.ciphertext_length, reader.ciphertext, reader.ciphertext_length,
plaintext plaintext
); );
unset(message_key); axolotl::unset(message_key);
advance_chain_key(chain->chain_key, chain->chain_key); advance_chain_key(chain->chain_key, chain->chain_key);
......
...@@ -13,6 +13,8 @@ ...@@ -13,6 +13,8 @@
* limitations under the License. * limitations under the License.
*/ */
#include "axolotl/crypto.hh" #include "axolotl/crypto.hh"
#include "axolotl/memory.hh"
#include <cstring> #include <cstring>
extern "C" { extern "C" {
...@@ -76,7 +78,7 @@ inline void hmac_sha256_init( ...@@ -76,7 +78,7 @@ inline void hmac_sha256_init(
} }
::sha256_init(context); ::sha256_init(context);
::sha256_update(context, i_pad, SHA256_BLOCK_LENGTH); ::sha256_update(context, i_pad, SHA256_BLOCK_LENGTH);
std::memset(i_pad, 0, sizeof(i_pad)); axolotl::unset(i_pad);
} }
...@@ -95,7 +97,8 @@ inline void hmac_sha256_final( ...@@ -95,7 +97,8 @@ inline void hmac_sha256_final(
::sha256_init(&final_context); ::sha256_init(&final_context);
::sha256_update(&final_context, o_pad, sizeof(o_pad)); ::sha256_update(&final_context, o_pad, sizeof(o_pad));
::sha256_final(&final_context, output); ::sha256_final(&final_context, output);
std::memset(o_pad, 0, sizeof(o_pad)); axolotl::unset(final_context);
axolotl::unset(o_pad);
} }
} // namespace } // namespace
...@@ -154,8 +157,8 @@ void axolotl::aes_encrypt_cbc( ...@@ -154,8 +157,8 @@ void axolotl::aes_encrypt_cbc(
input_block[i] ^= AES_BLOCK_LENGTH - input_length; input_block[i] ^= AES_BLOCK_LENGTH - input_length;
} }
::aes_encrypt(input_block, output, key_schedule, 256); ::aes_encrypt(input_block, output, key_schedule, 256);
std::memset(key_schedule, 0, sizeof(key_schedule)); axolotl::unset(key_schedule);
std::memset(input_block, 0, sizeof(AES_BLOCK_LENGTH)); axolotl::unset(input_block);
} }
...@@ -175,7 +178,7 @@ std::size_t axolotl::aes_decrypt_cbc( ...@@ -175,7 +178,7 @@ std::size_t axolotl::aes_decrypt_cbc(
xor_block<AES_BLOCK_LENGTH>(&output[i], &input[i - AES_BLOCK_LENGTH]); xor_block<AES_BLOCK_LENGTH>(&output[i], &input[i - AES_BLOCK_LENGTH]);
} }
} }
std::memset(key_schedule, 0, sizeof(key_schedule)); axolotl::unset(key_schedule);
std::size_t padding = output[input_length - 1]; std::size_t padding = output[input_length - 1];
return (padding > input_length) ? std::size_t(-1) : (input_length - padding); return (padding > input_length) ? std::size_t(-1) : (input_length - padding);
} }
...@@ -189,6 +192,7 @@ void axolotl::sha256( ...@@ -189,6 +192,7 @@ void axolotl::sha256(
::sha256_init(&context); ::sha256_init(&context);
::sha256_update(&context, input, input_length); ::sha256_update(&context, input, input_length);
::sha256_final(&context, output); ::sha256_final(&context, output);
axolotl::unset(context);
} }
void axolotl::hmac_sha256( void axolotl::hmac_sha256(
...@@ -202,7 +206,8 @@ void axolotl::hmac_sha256( ...@@ -202,7 +206,8 @@ void axolotl::hmac_sha256(
hmac_sha256_init(&context, hmac_key); hmac_sha256_init(&context, hmac_key);
::sha256_update(&context, input, input_length); ::sha256_update(&context, input, input_length);
hmac_sha256_final(&context, hmac_key, output); hmac_sha256_final(&context, hmac_key, output);
std::memset(hmac_key, 0, sizeof(hmac_key)); axolotl::unset(hmac_key);
axolotl::unset(context);
} }
...@@ -245,4 +250,7 @@ void axolotl::hkdf_sha256( ...@@ -245,4 +250,7 @@ void axolotl::hkdf_sha256(
hmac_sha256_final(&context, hmac_key, step_result); hmac_sha256_final(&context, hmac_key, step_result);
} }
std::memcpy(output, step_result, bytes_remaining); std::memcpy(output, step_result, bytes_remaining);
axolotl::unset(context);
axolotl::unset(hmac_key);
axolotl::unset(step_result);
} }
#include "axolotl/memory.hh"
void axolotl::unset(
volatile void * buffer, std::size_t buffer_length
) {
volatile char * pos = reinterpret_cast<volatile char *>(buffer);
volatile char * end = pos + buffer_length;
while (pos != end) {
*(pos++) = 0;
}
}
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment