233 lines
7.1 KiB
Go
233 lines
7.1 KiB
Go
package main
|
|
|
|
import (
|
|
"errors"
|
|
"strings"
|
|
)
|
|
|
|
// Traditional DES-based crypt(3) — the 13-character, no-"$"-prefix hash used by
|
|
// old Linux/UNIX systems (e.g. accounts created with perl's crypt() or legacy
|
|
// SSH-account scripts). Pure Go; no dependency on libcrypt.
|
|
//
|
|
// Verified against the canonical vector crypt("rasmuslerdorf","rl") ==
|
|
// "rl.3StKT.4T8M" (see descrypt_test.go).
|
|
|
|
const cryptAlphabet = "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
|
|
|
|
func crypt64Decode(c byte) int {
|
|
return strings.IndexByte(cryptAlphabet, c)
|
|
}
|
|
|
|
// ---- Standard DES permutation tables (1-indexed, MSB-first) ----
|
|
|
|
var ipTable = []int{
|
|
58, 50, 42, 34, 26, 18, 10, 2, 60, 52, 44, 36, 28, 20, 12, 4,
|
|
62, 54, 46, 38, 30, 22, 14, 6, 64, 56, 48, 40, 32, 24, 16, 8,
|
|
57, 49, 41, 33, 25, 17, 9, 1, 59, 51, 43, 35, 27, 19, 11, 3,
|
|
61, 53, 45, 37, 29, 21, 13, 5, 63, 55, 47, 39, 31, 23, 15, 7,
|
|
}
|
|
|
|
var fpTable = []int{
|
|
40, 8, 48, 16, 56, 24, 64, 32, 39, 7, 47, 15, 55, 23, 63, 31,
|
|
38, 6, 46, 14, 54, 22, 62, 30, 37, 5, 45, 13, 53, 21, 61, 29,
|
|
36, 4, 44, 12, 52, 20, 60, 28, 35, 3, 43, 11, 51, 19, 59, 27,
|
|
34, 2, 42, 10, 50, 18, 58, 26, 33, 1, 41, 9, 49, 17, 57, 25,
|
|
}
|
|
|
|
var eTable = []int{
|
|
32, 1, 2, 3, 4, 5, 4, 5, 6, 7, 8, 9, 8, 9, 10, 11, 12, 13,
|
|
12, 13, 14, 15, 16, 17, 16, 17, 18, 19, 20, 21, 20, 21, 22, 23, 24, 25,
|
|
24, 25, 26, 27, 28, 29, 28, 29, 30, 31, 32, 1,
|
|
}
|
|
|
|
var pTable = []int{
|
|
16, 7, 20, 21, 29, 12, 28, 17, 1, 15, 23, 26, 5, 18, 31, 10,
|
|
2, 8, 24, 14, 32, 27, 3, 9, 19, 13, 30, 6, 22, 11, 4, 25,
|
|
}
|
|
|
|
var pc1Table = []int{
|
|
57, 49, 41, 33, 25, 17, 9, 1, 58, 50, 42, 34, 26, 18,
|
|
10, 2, 59, 51, 43, 35, 27, 19, 11, 3, 60, 52, 44, 36,
|
|
63, 55, 47, 39, 31, 23, 15, 7, 62, 54, 46, 38, 30, 22,
|
|
14, 6, 61, 53, 45, 37, 29, 21, 13, 5, 28, 20, 12, 4,
|
|
}
|
|
|
|
var pc2Table = []int{
|
|
14, 17, 11, 24, 1, 5, 3, 28, 15, 6, 21, 10,
|
|
23, 19, 12, 4, 26, 8, 16, 7, 27, 20, 13, 2,
|
|
41, 52, 31, 37, 47, 55, 30, 40, 51, 45, 33, 48,
|
|
44, 49, 39, 56, 34, 53, 46, 42, 50, 36, 29, 32,
|
|
}
|
|
|
|
var shiftTable = []int{1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1}
|
|
|
|
var sBoxes = [8][64]int{
|
|
{14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7,
|
|
0, 15, 7, 4, 14, 2, 13, 1, 10, 6, 12, 11, 9, 5, 3, 8,
|
|
4, 1, 14, 8, 13, 6, 2, 11, 15, 12, 9, 7, 3, 10, 5, 0,
|
|
15, 12, 8, 2, 4, 9, 1, 7, 5, 11, 3, 14, 10, 0, 6, 13},
|
|
{15, 1, 8, 14, 6, 11, 3, 4, 9, 7, 2, 13, 12, 0, 5, 10,
|
|
3, 13, 4, 7, 15, 2, 8, 14, 12, 0, 1, 10, 6, 9, 11, 5,
|
|
0, 14, 7, 11, 10, 4, 13, 1, 5, 8, 12, 6, 9, 3, 2, 15,
|
|
13, 8, 10, 1, 3, 15, 4, 2, 11, 6, 7, 12, 0, 5, 14, 9},
|
|
{10, 0, 9, 14, 6, 3, 15, 5, 1, 13, 12, 7, 11, 4, 2, 8,
|
|
13, 7, 0, 9, 3, 4, 6, 10, 2, 8, 5, 14, 12, 11, 15, 1,
|
|
13, 6, 4, 9, 8, 15, 3, 0, 11, 1, 2, 12, 5, 10, 14, 7,
|
|
1, 10, 13, 0, 6, 9, 8, 7, 4, 15, 14, 3, 11, 5, 2, 12},
|
|
{7, 13, 14, 3, 0, 6, 9, 10, 1, 2, 8, 5, 11, 12, 4, 15,
|
|
13, 8, 11, 5, 6, 15, 0, 3, 4, 7, 2, 12, 1, 10, 14, 9,
|
|
10, 6, 9, 0, 12, 11, 7, 13, 15, 1, 3, 14, 5, 2, 8, 4,
|
|
3, 15, 0, 6, 10, 1, 13, 8, 9, 4, 5, 11, 12, 7, 2, 14},
|
|
{2, 12, 4, 1, 7, 10, 11, 6, 8, 5, 3, 15, 13, 0, 14, 9,
|
|
14, 11, 2, 12, 4, 7, 13, 1, 5, 0, 15, 10, 3, 9, 8, 6,
|
|
4, 2, 1, 11, 10, 13, 7, 8, 15, 9, 12, 5, 6, 3, 0, 14,
|
|
11, 8, 12, 7, 1, 14, 2, 13, 6, 15, 0, 9, 10, 4, 5, 3},
|
|
{12, 1, 10, 15, 9, 2, 6, 8, 0, 13, 3, 4, 14, 7, 5, 11,
|
|
10, 15, 4, 2, 7, 12, 9, 5, 6, 1, 13, 14, 0, 11, 3, 8,
|
|
9, 14, 15, 5, 2, 8, 12, 3, 7, 0, 4, 10, 1, 13, 11, 6,
|
|
4, 3, 2, 12, 9, 5, 15, 10, 11, 14, 1, 7, 6, 0, 8, 13},
|
|
{4, 11, 2, 14, 15, 0, 8, 13, 3, 12, 9, 7, 5, 10, 6, 1,
|
|
13, 0, 11, 7, 4, 9, 1, 10, 14, 3, 5, 12, 2, 15, 8, 6,
|
|
1, 4, 11, 13, 12, 3, 7, 14, 10, 15, 6, 8, 0, 5, 9, 2,
|
|
6, 11, 13, 8, 1, 4, 10, 7, 9, 5, 0, 15, 14, 2, 3, 12},
|
|
{13, 2, 8, 4, 6, 15, 11, 1, 10, 9, 3, 14, 5, 0, 12, 7,
|
|
1, 15, 13, 8, 10, 3, 7, 4, 12, 5, 6, 11, 0, 14, 9, 2,
|
|
7, 11, 4, 1, 9, 12, 14, 2, 0, 6, 10, 13, 15, 3, 5, 8,
|
|
2, 1, 14, 7, 4, 10, 8, 13, 15, 12, 9, 0, 3, 5, 6, 11},
|
|
}
|
|
|
|
// permute selects bits from in (each element 0/1, MSB-first) per a 1-indexed table.
|
|
func permute(in []byte, table []int) []byte {
|
|
out := make([]byte, len(table))
|
|
for i, pos := range table {
|
|
out[i] = in[pos-1]
|
|
}
|
|
return out
|
|
}
|
|
|
|
func keySchedule(key64 []byte) [][]byte {
|
|
cd := permute(key64, pc1Table) // 56 bits
|
|
c := cd[:28]
|
|
d := cd[28:]
|
|
subkeys := make([][]byte, 16)
|
|
for i := 0; i < 16; i++ {
|
|
c = rotl(c, shiftTable[i])
|
|
d = rotl(d, shiftTable[i])
|
|
combined := append(append([]byte{}, c...), d...)
|
|
subkeys[i] = permute(combined, pc2Table) // 48 bits
|
|
}
|
|
return subkeys
|
|
}
|
|
|
|
func rotl(b []byte, n int) []byte {
|
|
out := make([]byte, len(b))
|
|
for i := range b {
|
|
out[i] = b[(i+n)%len(b)]
|
|
}
|
|
return out
|
|
}
|
|
|
|
// feistel computes f(R, K) with the salt-perturbed E expansion.
|
|
func feistel(r []byte, k []byte, saltMask [24]bool) []byte {
|
|
e := permute(r, eTable) // 48 bits
|
|
// Salt: for i in 0..23, if saltMask[i] swap E-output bits i and i+24.
|
|
for i := 0; i < 24; i++ {
|
|
if saltMask[i] {
|
|
e[i], e[i+24] = e[i+24], e[i]
|
|
}
|
|
}
|
|
x := make([]byte, 48)
|
|
for i := range x {
|
|
x[i] = e[i] ^ k[i]
|
|
}
|
|
out := make([]byte, 32)
|
|
for box := 0; box < 8; box++ {
|
|
off := box * 6
|
|
row := int(x[off])<<1 | int(x[off+5])
|
|
col := int(x[off+1])<<3 | int(x[off+2])<<2 | int(x[off+3])<<1 | int(x[off+4])
|
|
val := sBoxes[box][row*16+col]
|
|
for bit := 0; bit < 4; bit++ {
|
|
out[box*4+bit] = byte((val >> (3 - bit)) & 1)
|
|
}
|
|
}
|
|
return permute(out, pTable)
|
|
}
|
|
|
|
func desEncryptBlock(block []byte, subkeys [][]byte, saltMask [24]bool) []byte {
|
|
ip := permute(block, ipTable)
|
|
l := ip[:32]
|
|
r := ip[32:]
|
|
for i := 0; i < 16; i++ {
|
|
f := feistel(r, subkeys[i], saltMask)
|
|
newR := make([]byte, 32)
|
|
for j := 0; j < 32; j++ {
|
|
newR[j] = l[j] ^ f[j]
|
|
}
|
|
l = r
|
|
r = newR
|
|
}
|
|
pre := append(append([]byte{}, r...), l...) // R16 L16
|
|
return permute(pre, fpTable)
|
|
}
|
|
|
|
// desCrypt implements the traditional 13-char DES crypt. setting supplies the
|
|
// 2-char salt (its first two characters).
|
|
func desCrypt(password, setting string) (string, error) {
|
|
if len(setting) < 2 {
|
|
return "", errors.New("descrypt: salt too short")
|
|
}
|
|
s0 := crypt64Decode(setting[0])
|
|
s1 := crypt64Decode(setting[1])
|
|
if s0 < 0 || s1 < 0 {
|
|
return "", errors.New("descrypt: bad salt characters")
|
|
}
|
|
salt := s0 | (s1 << 6)
|
|
var saltMask [24]bool
|
|
for i := 0; i < 24; i++ {
|
|
if (salt>>i)&1 == 1 {
|
|
saltMask[i] = true
|
|
}
|
|
}
|
|
|
|
// Key: first 8 bytes of the password, each char<<1 forms a key byte.
|
|
key64 := make([]byte, 64)
|
|
for i := 0; i < 8; i++ {
|
|
var c byte
|
|
if i < len(password) {
|
|
c = password[i]
|
|
}
|
|
kb := c << 1
|
|
for bit := 0; bit < 8; bit++ {
|
|
key64[i*8+bit] = (kb >> (7 - bit)) & 1
|
|
}
|
|
}
|
|
subkeys := keySchedule(key64)
|
|
|
|
block := make([]byte, 64) // all zeros
|
|
for iter := 0; iter < 25; iter++ {
|
|
block = desEncryptBlock(block, subkeys, saltMask)
|
|
}
|
|
|
|
return string(setting[0]) + string(setting[1]) + encodeDESOutput(block), nil
|
|
}
|
|
|
|
// encodeDESOutput packs the 64-bit result (MSB-first bit array) into 11
|
|
// crypt-base64 characters: eleven 6-bit groups read most-significant-bit first,
|
|
// the last group zero-padded to 6 bits.
|
|
func encodeDESOutput(block []byte) string {
|
|
out := make([]byte, 0, 11)
|
|
for j := 0; j < 11; j++ {
|
|
v := 0
|
|
for k := 0; k < 6; k++ {
|
|
idx := j*6 + k
|
|
bit := 0
|
|
if idx < len(block) {
|
|
bit = int(block[idx])
|
|
}
|
|
v = (v << 1) | bit
|
|
}
|
|
out = append(out, cryptAlphabet[v])
|
|
}
|
|
return string(out)
|
|
}
|