2 Unix SMB/Netbios implementation.
4 SMB parameters and setup
5 Copyright (C) Andrew Tridgell 1992-1998
6 Modified by Jeremy Allison 1995.
7 Copyright (C) Jeremy Allison 1995-2000.
8 Copyright (C) Luke Kennethc Casson Leighton 1996-2000.
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 #include "byteorder.h"
29 This implements the X/Open SMB password encryption
30 It takes a password, a 8 byte "crypt key" and puts 24 bytes of
31 encrypted password into p24 */
32 void SMBencrypt(uchar *passwd, uchar *c8, uchar *p24)
34 uchar p14[15], p21[21];
38 StrnCpy((char *)p14,(char *)passwd,14);
40 strupper((char *)p14);
43 SMBOWFencrypt(p21, c8, p24);
46 DEBUG(100,("SMBencrypt: lm#, challenge, response\n"));
47 dump_data(100, (char *)p21, 16);
48 dump_data(100, (char *)c8, 8);
49 dump_data(100, (char *)p24, 24);
54 * Creates the MD4 Hash of the users password in NT UNICODE.
57 void E_md4hash(uchar *passwd, uchar *p16)
62 /* Password cannot be longer than 128 characters */
63 len = strlen((char *)passwd);
66 /* Password must be converted to NT unicode - null terminated. */
67 push_ucs2(NULL, wpwd, (const char *)passwd, 256, STR_UNICODE|STR_NOALIGN|STR_TERMINATE);
68 /* Calculate length in bytes */
69 len = strlen_w(wpwd) * sizeof(int16);
71 mdfour(p16, (unsigned char *)wpwd, len);
74 /* Does both the NT and LM owfs of a user's password */
75 void nt_lm_owf_gen(char *pwd, uchar nt_p16[16], uchar p16[16])
79 memset(passwd,'\0',514);
80 safe_strcpy( passwd, pwd, sizeof(passwd)-1);
82 /* Calculate the MD4 hash (NT compatible) of the password */
83 memset(nt_p16, '\0', 16);
84 E_md4hash((uchar *)passwd, nt_p16);
87 DEBUG(100,("nt_lm_owf_gen: pwd, nt#\n"));
88 dump_data(120, passwd, strlen(passwd));
89 dump_data(100, (char *)nt_p16, 16);
92 /* Mangle the passwords into Lanman format */
96 /* Calculate the SMB (lanman) hash functions of the password */
98 memset(p16, '\0', 16);
99 E_P16((uchar *) passwd, (uchar *)p16);
101 #ifdef DEBUG_PASSWORD
102 DEBUG(100,("nt_lm_owf_gen: pwd, lm#\n"));
103 dump_data(120, passwd, strlen(passwd));
104 dump_data(100, (char *)p16, 16);
106 /* clear out local copy of user's password (just being paranoid). */
107 memset(passwd, '\0', sizeof(passwd));
110 /* Does both the NTLMv2 owfs of a user's password */
111 void ntv2_owf_gen(const uchar owf[16],
112 const char *user_n, const char *domain_n, uchar kr_buf[16])
118 int user_l = strlen(user_n);
119 int domain_l = strlen(domain_n);
121 push_ucs2(NULL, user_u, user_n, (user_l+1)*2, STR_UNICODE|STR_NOALIGN|STR_TERMINATE|STR_UPPER);
122 push_ucs2(NULL, dom_u, domain_n, (domain_l+1)*2, STR_UNICODE|STR_NOALIGN|STR_TERMINATE|STR_UPPER);
124 hmac_md5_init_limK_to_64(owf, 16, &ctx);
125 hmac_md5_update((const unsigned char *)user_u, user_l * 2, &ctx);
126 hmac_md5_update((const unsigned char *)dom_u, domain_l * 2, &ctx);
127 hmac_md5_final(kr_buf, &ctx);
129 #ifdef DEBUG_PASSWORD
130 DEBUG(100, ("ntv2_owf_gen: user, domain, owfkey, kr\n"));
131 dump_data(100, user_u, user_l * 2);
132 dump_data(100, dom_u, domain_l * 2);
133 dump_data(100, owf, 16);
134 dump_data(100, kr_buf, 16);
138 /* Does the des encryption from the NT or LM MD4 hash. */
139 void SMBOWFencrypt(const uchar passwd[16], const uchar *c8, uchar p24[24])
145 memcpy(p21, passwd, 16);
149 /* Does the des encryption from the FIRST 8 BYTES of the NT or LM MD4 hash. */
150 void NTLMSSPOWFencrypt(uchar passwd[8], uchar *ntlmchalresp, uchar p24[24])
155 memcpy(p21, passwd, 8);
156 memset(p21 + 8, 0xbd, 8);
158 E_P24(p21, ntlmchalresp, p24);
159 #ifdef DEBUG_PASSWORD
160 DEBUG(100,("NTLMSSPOWFencrypt: p21, c8, p24\n"));
161 dump_data(100, (char *)p21, 21);
162 dump_data(100, (char *)ntlmchalresp, 8);
163 dump_data(100, (char *)p24, 24);
168 /* Does the NT MD4 hash then des encryption. */
170 void SMBNTencrypt(uchar *passwd, uchar *c8, uchar *p24)
176 E_md4hash(passwd, p21);
177 SMBOWFencrypt(p21, c8, p24);
179 #ifdef DEBUG_PASSWORD
180 DEBUG(100,("SMBNTencrypt: nt#, challenge, response\n"));
181 dump_data(100, (char *)p21, 16);
182 dump_data(100, (char *)c8, 8);
183 dump_data(100, (char *)p24, 24);
187 BOOL make_oem_passwd_hash(char data[516], const char *passwd, uchar old_pw_hash[16], BOOL unicode)
189 int new_pw_len = strlen(passwd) * (unicode ? 2 : 1);
191 if (new_pw_len > 512)
193 DEBUG(0,("make_oem_passwd_hash: new password is too long.\n"));
198 * Now setup the data area.
199 * We need to generate a random fill
200 * for this area to make it harder to
203 generate_random_buffer((unsigned char *)data, 516, False);
204 push_string(NULL, &data[512 - new_pw_len], passwd, new_pw_len,
205 STR_NOALIGN | (unicode?STR_UNICODE:STR_ASCII));
206 SIVAL(data, 512, new_pw_len);
208 #ifdef DEBUG_PASSWORD
209 DEBUG(100,("make_oem_passwd_hash\n"));
210 dump_data(100, data, 516);
212 SamOEMhash( (unsigned char *)data, (unsigned char *)old_pw_hash, 516);
217 /* Does the md5 encryption from the NT hash for NTLMv2. */
218 void SMBOWFencrypt_ntv2(const uchar kr[16],
219 const uchar * srv_chal, int srv_chal_len,
220 const uchar * cli_chal, int cli_chal_len,
225 hmac_md5_init_limK_to_64(kr, 16, &ctx);
226 hmac_md5_update(srv_chal, srv_chal_len, &ctx);
227 hmac_md5_update(cli_chal, cli_chal_len, &ctx);
228 hmac_md5_final((unsigned char *)resp_buf, &ctx);
230 #ifdef DEBUG_PASSWORD
231 DEBUG(100, ("SMBOWFencrypt_ntv2: srv_chal, cli_chal, resp_buf\n"));
232 dump_data(100, srv_chal, srv_chal_len);
233 dump_data(100, cli_chal, cli_chal_len);
234 dump_data(100, resp_buf, 16);
238 void SMBsesskeygen_ntv2(const uchar kr[16],
239 const uchar * nt_resp, char sess_key[16])
243 hmac_md5_init_limK_to_64(kr, 16, &ctx);
244 hmac_md5_update(nt_resp, 16, &ctx);
245 hmac_md5_final((unsigned char *)sess_key, &ctx);
247 #ifdef DEBUG_PASSWORD
248 DEBUG(100, ("SMBsesskeygen_ntv2:\n"));
249 dump_data(100, sess_key, 16);
253 void SMBsesskeygen_ntv1(const uchar kr[16],
254 const uchar * nt_resp, char sess_key[16])
256 mdfour((unsigned char *)sess_key, kr, 16);
258 #ifdef DEBUG_PASSWORD
259 DEBUG(100, ("SMBsesskeygen_ntv1:\n"));
260 dump_data(100, sess_key, 16);
264 /***********************************************************
265 encode a password buffer
266 ************************************************************/
267 BOOL encode_pw_buffer(char buffer[516], const char *new_pass,
268 int new_pw_len, BOOL nt_pass_set)
270 generate_random_buffer((unsigned char *)buffer, 516, True);
274 push_ucs2(NULL, &buffer[512 - new_pw_len], new_pass,
277 push_ascii(&buffer[512 - new_pw_len], new_pass,
282 * The length of the new password is in the last 4 bytes of
285 SIVAL(buffer, 512, new_pw_len);
290 /***********************************************************
291 decode a password buffer
292 *new_pw_len is the length in bytes of the possibly mulitbyte
293 returned password including termination.
294 ************************************************************/
295 BOOL decode_pw_buffer(char in_buffer[516], char *new_pwrd,
296 int new_pwrd_size, uint32 *new_pw_len)
301 Warning !!! : This function is called from some rpc call.
302 The password IN the buffer is a UNICODE string.
303 The password IN new_pwrd is an ASCII string
304 If you reuse that code somewhere else check first.
307 /* The length of the new password is in the last 4 bytes of the data buffer. */
309 byte_len = IVAL(in_buffer, 512);
311 #ifdef DEBUG_PASSWORD
312 dump_data(100, in_buffer, 516);
315 /* Password cannot be longer than 128 characters */
316 if ( (byte_len < 0) || (byte_len > new_pwrd_size - 1)) {
317 DEBUG(0, ("decode_pw_buffer: incorrect password length (%d).\n", byte_len));
318 DEBUG(0, ("decode_pw_buffer: check that 'encrypt passwords = yes'\n"));
322 /* decode into the return buffer. Buffer must be a pstring */
323 *new_pw_len = pull_string(NULL, new_pwrd, &in_buffer[512 - byte_len], new_pwrd_size, byte_len, STR_UNICODE);
325 #ifdef DEBUG_PASSWORD
326 DEBUG(100,("decode_pw_buffer: new_pwrd: "));
327 dump_data(100, (char *)new_pwrd, *new_pw_len);
328 DEBUG(100,("multibyte len:%d\n", *new_pw_len));
329 DEBUG(100,("original char len:%d\n", byte_len/2));
336 /* Calculate the NT owfs of a user's password */
337 void nt_owf_genW(const UNISTR2 *pwd, uchar nt_p16[16])
342 for (i = 0; i < MIN(pwd->uni_str_len, sizeof(buf) / 2); i++)
344 SIVAL(buf, i * 2, pwd->buffer[i]);
346 /* Calculate the MD4 hash (NT compatible) of the password */
347 mdfour(nt_p16, (const unsigned char *)buf, pwd->uni_str_len * 2);
349 /* clear out local copy of user's password (just being paranoid). */