Merge branch 'master' into openssh-posix-rename

README.adoc

@@ -1,7 +1,7 @@
 = sshj - SSHv2 library for Java
 Jeroen van Erp
 :sshj_groupid: com.hierynomus
-:sshj_version: 0.36.0
+:sshj_version: 0.37.0
 :source-highlighter: pygments
 
 image:https://github.com/hierynomus/sshj/actions/workflows/gradle.yml/badge.svg[link="https://github.com/hierynomus/sshj/actions/workflows/gradle.yml"]
@@ -108,6 +108,10 @@ Issue tracker: https://github.com/hierynomus/sshj/issues
 Fork away!
 
 == Release history
+SSHJ 0.37.0 (2023-10-11)::
+* Merged https://github.com/hierynomus/sshj/pull/899[#899]: Add support for AES-GCM OpenSSH private keys
+* Merged https://github.com/hierynomus/sshj/pull/901[#901]: Fix ZLib compression bug
+* Merged https://github.com/hierynomus/sshj/pull/898[#898]: Improved malformed file handling for OpenSSH private keys
 SSHJ 0.36.0 (2023-09-04)::
 * Rewrote Integration tests to JUnit5
 * Merged https://github.com/hierynomus/sshj/pull/851[#851]: Fix race condition in key exchange causing intermittent SSH_MSG_UNIMPLEMENTED

examples/pom.xml

@@ -24,7 +24,7 @@
     <groupId>com.hierynomus</groupId>
     <artifactId>sshj-examples</artifactId>
     <packaging>jar</packaging>
-    <version>0.33.0</version>
+    <version>0.37.0</version>
 
     <name>sshj-examples</name>
     <description>Examples for SSHv2 library for Java</description>

src/main/java/com/hierynomus/sshj/transport/cipher/ChachaPolyCipher.java

@@ -16,9 +16,8 @@
 package com.hierynomus.sshj.transport.cipher;
 
 import java.security.GeneralSecurityException;
-import java.security.InvalidAlgorithmParameterException;
-import java.security.InvalidKeyException;
 
+import java.security.MessageDigest;
 import java.security.spec.AlgorithmParameterSpec;
 import java.util.Arrays;
 import javax.crypto.spec.IvParameterSpec;
@@ -82,8 +81,7 @@ public void setSequenceNumber(long seq) {
     }
 
     @Override
-    protected void initCipher(javax.crypto.Cipher cipher, Mode mode, byte[] key, byte[] iv)
-            throws InvalidKeyException, InvalidAlgorithmParameterException {
+    protected void initCipher(javax.crypto.Cipher cipher, Mode mode, byte[] key, byte[] iv) {
         this.mode = mode;
 
         cipherKey = getKeySpec(Arrays.copyOfRange(key, 0, CHACHA_KEY_SIZE));
@@ -127,28 +125,34 @@ public void updateAAD(byte[] data) {
 
     @Override
     public void update(byte[] input, int inputOffset, int inputLen) {
-        if (inputOffset != AAD_LENGTH) {
+        if (inputOffset != 0 && inputOffset != AAD_LENGTH) {
             throw new IllegalArgumentException("updateAAD called with inputOffset " + inputOffset);
         }
 
-        final int macInputLength = AAD_LENGTH + inputLen;
-
+        final int macInputLength = inputOffset + inputLen;
         if (mode == Mode.Decrypt) {
-            byte[] macInput = new byte[macInputLength];
-            System.arraycopy(encryptedAad, 0, macInput, 0, AAD_LENGTH);
-            System.arraycopy(input, AAD_LENGTH, macInput, AAD_LENGTH, inputLen);
+            final byte[] macInput = new byte[macInputLength];
+
+            if (inputOffset == 0) {
+                // Handle decryption without AAD
+                System.arraycopy(input, 0, macInput, 0, inputLen);
+            } else {
+                // Handle decryption with previous AAD from updateAAD()
+                System.arraycopy(encryptedAad, 0, macInput, 0, AAD_LENGTH);
+                System.arraycopy(input, AAD_LENGTH, macInput, AAD_LENGTH, inputLen);
+            }
 
-            byte[] expectedPolyTag = mac.doFinal(macInput);
-            byte[] actualPolyTag = Arrays.copyOfRange(input, macInputLength, macInputLength + POLY_TAG_LENGTH);
-            if (!Arrays.equals(actualPolyTag, expectedPolyTag)) {
+            final byte[] expectedPolyTag = mac.doFinal(macInput);
+            final byte[] actualPolyTag = Arrays.copyOfRange(input, macInputLength, macInputLength + POLY_TAG_LENGTH);
+            if (!MessageDigest.isEqual(actualPolyTag, expectedPolyTag)) {
                 throw new SSHRuntimeException("MAC Error");
             }
         }
 
         try {
-            cipher.update(input, AAD_LENGTH, inputLen, input, AAD_LENGTH);
+            cipher.update(input, inputOffset, inputLen, input, inputOffset);
         } catch (GeneralSecurityException e) {
-            throw new SSHRuntimeException("Error updating data through cipher", e);
+            throw new SSHRuntimeException("ChaCha20 cipher processing failed", e);
         }
 
         if (mode == Mode.Encrypt) {

src/main/java/com/hierynomus/sshj/userauth/keyprovider/OpenSSHKeyV1KeyFile.java

@@ -18,6 +18,8 @@
 import com.hierynomus.sshj.common.KeyAlgorithm;
 import com.hierynomus.sshj.common.KeyDecryptionFailedException;
 import com.hierynomus.sshj.transport.cipher.BlockCiphers;
+import com.hierynomus.sshj.transport.cipher.ChachaPolyCiphers;
+import com.hierynomus.sshj.transport.cipher.GcmCiphers;
 import net.i2p.crypto.eddsa.EdDSAPrivateKey;
 import net.i2p.crypto.eddsa.spec.EdDSANamedCurveTable;
 import net.i2p.crypto.eddsa.spec.EdDSAPrivateKeySpec;
@@ -36,6 +38,7 @@
 import org.bouncycastle.asn1.x9.X9ECParameters;
 import org.bouncycastle.jce.spec.ECNamedCurveSpec;
 import com.hierynomus.sshj.userauth.keyprovider.bcrypt.BCrypt;
+import org.bouncycastle.openssl.EncryptionException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -47,24 +50,43 @@
 import java.math.BigInteger;
 import java.nio.ByteBuffer;
 import java.nio.CharBuffer;
-import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
 import java.security.*;
 import java.security.spec.ECPrivateKeySpec;
 import java.security.spec.RSAPrivateCrtKeySpec;
 import java.util.Arrays;
 import java.util.Base64;
+import java.util.HashMap;
+import java.util.Map;
 
 /**
  * Reads a key file in the new OpenSSH format.
  * The format is described in the following document: https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.key
  */
 public class OpenSSHKeyV1KeyFile extends BaseFileKeyProvider {
-    private static final Logger logger = LoggerFactory.getLogger(OpenSSHKeyV1KeyFile.class);
     private static final String BEGIN = "-----BEGIN ";
     private static final String END = "-----END ";
     private static final byte[] AUTH_MAGIC = "openssh-key-v1\0".getBytes();
     public static final String OPENSSH_PRIVATE_KEY = "OPENSSH PRIVATE KEY-----";
     public static final String BCRYPT = "bcrypt";
+
+    private static final String NONE_CIPHER = "none";
+
+    private static final Map<String, Factory.Named<Cipher>> SUPPORTED_CIPHERS = new HashMap<>();
+
+    static {
+        SUPPORTED_CIPHERS.put(BlockCiphers.TripleDESCBC().getName(), BlockCiphers.TripleDESCBC());
+        SUPPORTED_CIPHERS.put(BlockCiphers.AES128CBC().getName(), BlockCiphers.AES128CBC());
+        SUPPORTED_CIPHERS.put(BlockCiphers.AES192CBC().getName(), BlockCiphers.AES192CBC());
+        SUPPORTED_CIPHERS.put(BlockCiphers.AES256CBC().getName(), BlockCiphers.AES256CBC());
+        SUPPORTED_CIPHERS.put(BlockCiphers.AES128CTR().getName(), BlockCiphers.AES128CTR());
+        SUPPORTED_CIPHERS.put(BlockCiphers.AES192CTR().getName(), BlockCiphers.AES192CTR());
+        SUPPORTED_CIPHERS.put(BlockCiphers.AES256CTR().getName(), BlockCiphers.AES256CTR());
+        SUPPORTED_CIPHERS.put(GcmCiphers.AES256GCM().getName(), GcmCiphers.AES256GCM());
+        SUPPORTED_CIPHERS.put(GcmCiphers.AES128GCM().getName(), GcmCiphers.AES128GCM());
+        SUPPORTED_CIPHERS.put(ChachaPolyCiphers.CHACHA_POLY_OPENSSH().getName(), ChachaPolyCiphers.CHACHA_POLY_OPENSSH());
+    }
+
     private PublicKey pubKey;
 
     public static class Factory
@@ -135,74 +157,117 @@ private KeyPair readDecodedKeyPair(final PlainBuffer keyBuffer) throws IOExcepti
 
         int nrKeys = keyBuffer.readUInt32AsInt(); // int number of keys N; Should be 1
         if (nrKeys != 1) {
-            throw new IOException("We don't support having more than 1 key in the file (yet).");
+            final String message = String.format("OpenSSH Private Key number of keys not supported [%d]", nrKeys);
+            throw new IOException(message);
         }
         PublicKey publicKey = pubKey;
         if (publicKey == null) {
             publicKey = readPublicKey(new PlainBuffer(keyBuffer.readBytes()));
-        }
-        else {
+        } else {
             keyBuffer.readBytes();
         }
-        PlainBuffer privateKeyBuffer = new PlainBuffer(keyBuffer.readBytes()); // string (possibly) encrypted, padded list of private keys
-        if ("none".equals(cipherName)) {
-            logger.debug("Reading unencrypted keypair");
+
+        final byte[] privateKeyEncoded = keyBuffer.readBytes();
+        final PlainBuffer privateKeyBuffer = new PlainBuffer(privateKeyEncoded);
+
+        if (NONE_CIPHER.equals(cipherName)) {
             return readUnencrypted(privateKeyBuffer, publicKey);
         } else {
-            logger.info("Keypair is encrypted with: {}, {}, {}", cipherName, kdfName, Arrays.toString(kdfOptions));
+            final byte[] encryptedPrivateKey = readEncryptedPrivateKey(privateKeyEncoded, keyBuffer);
             while (true) {
-                PlainBuffer decryptionBuffer = new PlainBuffer(privateKeyBuffer);
-                PlainBuffer decrypted = decryptBuffer(decryptionBuffer, cipherName, kdfName, kdfOptions);
+                final byte[] encrypted = encryptedPrivateKey.clone();
                 try {
+                    final PlainBuffer decrypted = decryptPrivateKey(encrypted, privateKeyEncoded.length, cipherName, kdfName, kdfOptions);
                     return readUnencrypted(decrypted, publicKey);
                 } catch (KeyDecryptionFailedException e) {
                     if (pwdf == null || !pwdf.shouldRetry(resource))
                         throw e;
                 }
             }
-//            throw new IOException("Cannot read encrypted keypair with " + cipherName + " yet.");
         }
     }
 
-    private PlainBuffer decryptBuffer(PlainBuffer privateKeyBuffer, String cipherName, String kdfName, byte[] kdfOptions) throws IOException {
-        Cipher cipher = createCipher(cipherName);
-        initializeCipher(kdfName, kdfOptions, cipher);
-        byte[] array = privateKeyBuffer.array();
-        cipher.update(array, 0, privateKeyBuffer.available());
-        return new PlainBuffer(array);
+    private byte[] readEncryptedPrivateKey(final byte[] privateKeyEncoded, final PlainBuffer inputBuffer) throws Buffer.BufferException {
+        final byte[] encryptedPrivateKey;
+
+        final int bufferRemaining = inputBuffer.available();
+        if (bufferRemaining == 0) {
+            encryptedPrivateKey = privateKeyEncoded;
+        } else {
+            // Read Authentication Tag for AES-GCM or ChaCha20-Poly1305
+            final byte[] authenticationTag = new byte[bufferRemaining];
+            inputBuffer.readRawBytes(authenticationTag);
+
+            final int encryptedBufferLength = privateKeyEncoded.length + authenticationTag.length;
+            final PlainBuffer encryptedBuffer = new PlainBuffer(encryptedBufferLength);
+            encryptedBuffer.putRawBytes(privateKeyEncoded);
+            encryptedBuffer.putRawBytes(authenticationTag);
+
+            encryptedPrivateKey = new byte[encryptedBufferLength];
+            encryptedBuffer.readRawBytes(encryptedPrivateKey);
+        }
+
+        return encryptedPrivateKey;
     }
 
-    private void initializeCipher(String kdfName, byte[] kdfOptions, Cipher cipher) throws Buffer.BufferException {
+    private PlainBuffer decryptPrivateKey(final byte[] privateKey, final int privateKeyLength, final String cipherName, final String kdfName, final byte[] kdfOptions) throws IOException {
+        try {
+            final Cipher cipher = createCipher(cipherName);
+            initializeCipher(kdfName, kdfOptions, cipher);
+            cipher.update(privateKey, 0, privateKeyLength);
+        } catch (final SSHRuntimeException e) {
+            final String message = String.format("OpenSSH Private Key decryption failed with cipher [%s]", cipherName);
+            throw new KeyDecryptionFailedException(new EncryptionException(message, e));
+        }
+        final PlainBuffer decryptedPrivateKey = new PlainBuffer(privateKeyLength);
+        decryptedPrivateKey.putRawBytes(privateKey, 0, privateKeyLength);
+        return decryptedPrivateKey;
+    }
+
+    private void initializeCipher(final String kdfName, final byte[] kdfOptions, final Cipher cipher) throws Buffer.BufferException {
         if (kdfName.equals(BCRYPT)) {
-            PlainBuffer opts = new PlainBuffer(kdfOptions);
+            final PlainBuffer bufferedOptions = new PlainBuffer(kdfOptions);
             byte[] passphrase = new byte[0];
             if (pwdf != null) {
-                CharBuffer charBuffer = CharBuffer.wrap(pwdf.reqPassword(null));
-                ByteBuffer byteBuffer = Charset.forName("UTF-8").encode(charBuffer);
+                final CharBuffer charBuffer = CharBuffer.wrap(pwdf.reqPassword(null));
+                final ByteBuffer byteBuffer = StandardCharsets.UTF_8.encode(charBuffer);
                 passphrase = Arrays.copyOfRange(byteBuffer.array(), byteBuffer.position(), byteBuffer.limit());
                 Arrays.fill(charBuffer.array(), '\u0000');
                 Arrays.fill(byteBuffer.array(), (byte) 0);
             }
-            byte[] keyiv = new byte[cipher.getIVSize()+ cipher.getBlockSize()];
-            new BCrypt().pbkdf(passphrase, opts.readBytes(), opts.readUInt32AsInt(), keyiv);
+
+            final int ivSize = cipher.getIVSize();
+            final int blockSize = cipher.getBlockSize();
+            final int parameterSize = ivSize + blockSize;
+            final byte[] keyIvParameters = new byte[parameterSize];
+
+            final byte[] salt = bufferedOptions.readBytes();
+            final int iterations = bufferedOptions.readUInt32AsInt();
+            new BCrypt().pbkdf(passphrase, salt, iterations, keyIvParameters);
             Arrays.fill(passphrase, (byte) 0);
-            byte[] key = Arrays.copyOfRange(keyiv, 0, cipher.getBlockSize());
-            byte[] iv = Arrays.copyOfRange(keyiv, cipher.getBlockSize(), cipher.getIVSize() + cipher.getBlockSize());
+
+            final byte[] key = Arrays.copyOfRange(keyIvParameters, 0, blockSize);
+            final byte[] iv = Arrays.copyOfRange(keyIvParameters, blockSize, parameterSize);
+
             cipher.init(Cipher.Mode.Decrypt, key, iv);
         } else {
-            throw new IllegalStateException("No support for KDF '" + kdfName + "'.");
+            final String message = String.format("OpenSSH Private Key encryption KDF not supported [%s]", kdfName);
+            throw new IllegalStateException(message);
         }
     }
 
-    private Cipher createCipher(String cipherName) {
-        if (cipherName.equals(BlockCiphers.AES256CTR().getName())) {
-            return BlockCiphers.AES256CTR().create();
-        } else if (cipherName.equals(BlockCiphers.AES256CBC().getName())) {
-            return BlockCiphers.AES256CBC().create();
-        } else if (cipherName.equals(BlockCiphers.AES128CBC().getName())) {
-            return BlockCiphers.AES128CBC().create();
+    private Cipher createCipher(final String cipherName) {
+        final Cipher cipher;
+
+        if (SUPPORTED_CIPHERS.containsKey(cipherName)) {
+            final Factory.Named<Cipher> cipherFactory = SUPPORTED_CIPHERS.get(cipherName);
+            cipher = cipherFactory.create();
+        } else {
+            final String message = String.format("OpenSSH Key encryption cipher not supported [%s]", cipherName);
+            throw new IllegalStateException(message);
         }
-        throw new IllegalStateException("Cipher '" + cipherName + "' not currently implemented for openssh-key-v1 format");
+
+        return cipher;
     }
 
     private PublicKey readPublicKey(final PlainBuffer plainBuffer) throws Buffer.BufferException, GeneralSecurityException {
@@ -251,7 +316,7 @@ private KeyPair readUnencrypted(final PlainBuffer keyBuffer, final PublicKey pub
         int checkInt1 = keyBuffer.readUInt32AsInt(); // uint32 checkint1
         int checkInt2 = keyBuffer.readUInt32AsInt(); // uint32 checkint2
         if (checkInt1 != checkInt2) {
-            throw new KeyDecryptionFailedException();
+            throw new KeyDecryptionFailedException(new EncryptionException("OpenSSH Private Key integer comparison failed"));
         }
         // The private key section contains both the public key and the private key
         String keyType = keyBuffer.readString(); // string keytype

src/test/java/com/hierynomus/sshj/transport/ChachaPolyCipherTest.java

@@ -70,6 +70,28 @@ public void testEncryptDecrypt() {
         }
     }
 
+    @Test
+    public void testEncryptDecryptWithoutAAD() {
+        final Cipher encryptionCipher = FACTORY.create();
+        final byte[] key = new byte[encryptionCipher.getBlockSize()];
+        Arrays.fill(key, (byte) 1);
+        encryptionCipher.init(Cipher.Mode.Encrypt, key, new byte[0]);
+
+        final byte[] plaintextBytes = PLAINTEXT.getBytes(StandardCharsets.UTF_8);
+        final byte[] message = new byte[plaintextBytes.length + POLY_TAG_LENGTH];
+        System.arraycopy(plaintextBytes, 0, message, 0, plaintextBytes.length);
+
+        encryptionCipher.update(message, 0, plaintextBytes.length);
+
+        final Cipher decryptionCipher = FACTORY.create();
+        decryptionCipher.init(Cipher.Mode.Decrypt, key, new byte[0]);
+        decryptionCipher.update(message, 0, plaintextBytes.length);
+
+        final byte[] decrypted = Arrays.copyOfRange(message, 0, plaintextBytes.length);
+        final String decoded = new String(decrypted, StandardCharsets.UTF_8);
+        assertEquals(PLAINTEXT, decoded);
+    }
+
     @Test
     public void testCheckOnUpdateParameters() {
         Cipher cipher = FACTORY.create();

src/test/java/net/schmizz/sshj/keyprovider/OpenSSHKeyFileTest.java

@@ -259,6 +259,17 @@ public void shouldLoadProtectedED25519PrivateKeyAes128CBC() throws IOException {
         checkOpenSSHKeyV1("src/test/resources/keytypes/ed25519_aes128cbc.pem", "sshjtest", true);
     }
 
+    @Test
+    public void shouldLoadProtectedEd25519PrivateKeyAES256GCM() throws IOException {
+        checkOpenSSHKeyV1("src/test/resources/keytypes/ed25519_aes256-gcm", "sshjtest", false);
+        checkOpenSSHKeyV1("src/test/resources/keytypes/ed25519_aes256-gcm", "sshjtest", true);
+    }
+
+    @Test
+    public void shouldLoadProtectedEd25519PrivateKeyChaCha20Poly1305() throws IOException {
+        checkOpenSSHKeyV1("src/test/resources/keytypes/ed25519_chacha20-poly1305", "sshjtest", false);
+    }
+
     @Test
     public void shouldFailOnIncorrectPassphraseAfterRetries() {
         assertThrows(KeyDecryptionFailedException.class, () -> {

src/test/resources/keytypes/ed25519_aes256-gcm

@@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAAFmFlczI1Ni1nY21Ab3BlbnNzaC5jb20AAAAGYmNyeXB0AA
+AAGAAAABDpxH70vULcphyZoyd8Roc8AAAAEAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAA
+ID3cbY1HvyY8fXNrcESSpXm/3nGKpjxNjrlD+U5oMVmxAAAAoGXyMyKfXmGAVGLI3jbwk5
+gqrHAEFI5HHuYfW1DAAjSlj41paovl9tk7jZLIGslLUrUkN8Ac6ACNYuCWQZPgPr5mXHDx
+x+8GpdYPrgamB74lVwEPwk1BVjJRYUDRJ0SWyHagybITJhutq7yH+hZS+S05q2EeVee4Cn
+ZqESfmPZwdHg41IkdVTrZcLzadjPrcqrGzg1P7T9zl9hLD2QfBmO+XN2FPM+ufOGxpHHyJ
+SY/c
+-----END OPENSSH PRIVATE KEY-----

src/test/resources/keytypes/ed25519_aes256-gcm.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID3cbY1HvyY8fXNrcESSpXm/3nGKpjxNjrlD+U5oMVmx

src/test/resources/keytypes/ed25519_chacha20-poly1305

@@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAAHWNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tAAAABm
+JjcnlwdAAAABgAAAAQilqbRL4q3X9kEqWdTsD5/gAAABAAAAABAAAAMwAAAAtzc2gtZWQy
+NTUxOQAAACCpvtXUZPONb1XDjLkHmP5mQrGryGaQsA68Nb+OAjaaEgAAAJh+Repmt76g31
+jlD1ITaJU298ZU3rFWgA/Hs3xnOTNPjhMMu9nzfoZAu0fraE1MBVaEgNKRpw7SG+2eDBOo
+3fvN3lF15i7Q8YHZd9alfcUg3FrvBzjd0Edx4AQxbSueibPFaqnwmVk/YzDiQHwlyWfA1x
+HbqxrbJf1S0i8Bt5OjLK6woGk0/lfWJmy82xIa1sa3ONkPVjaJncm/f2SKV7t2k1UP9/jx
+dLA=
+-----END OPENSSH PRIVATE KEY-----

src/test/resources/keytypes/ed25519_chacha20-poly1305.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKm+1dRk841vVcOMuQeY/mZCsavIZpCwDrw1v44CNpoS