Exemple #1
0
        /// <summary>
        /// Attempts to load the session resume ticket.
        /// </summary>
        /// <param name="ticket">The serialized data for the key</param>
        /// <param name="user">The user's credentials so the proper encryption key can be used</param>
        /// <param name="sessionSecret">the session secret decoded if successful. null otherwise</param>
        /// <returns>
        /// True if the ticket is authentic
        /// </returns>
        unsafe static bool TryLoadTicket(byte[] ticket, SrpUserCredential user, out byte[] sessionSecret)
        {
            sessionSecret = null;

            //Ticket Structure:
            //  byte      TicketVersion = 1
            //  int16     Username Length
            //  int16     Session Key Length
            //  Guid      ServerKeyName
            //  DateTime  AuthenticationTime
            //  byte[16]  IV
            //  byte[]    Username
            //  byte[]    Encrypted Session Data (Round [Session Key Length] up to a 128 bit number to get the length of the encrypted data)
            //  byte[32]  HMAC (Sha2-256)

            if (ticket == null || ticket.Length < 1 + 16 + 8 + 16 + 2 + 32)
                return(false);

            fixed(byte *lp = ticket)
            {
                var stream = new BinaryStreamPointerWrapper(lp, ticket.Length);

                if (stream.ReadUInt8() != 1)
                {
                    return(false);
                }

                int sessionKeyLength = stream.ReadUInt16();

                if (sessionKeyLength < 0 || sessionKeyLength > 1024) //Max session key is 8192 SRP.
                {
                    return(false);
                }

                int encryptedDataLength = (sessionKeyLength + 15) & ~15; //Add 15, then round down. (Effecitvely rounds up to the nearest 128 bit boundary).

                if (ticket.Length != 1 + 2 + 16 + 8 + 16 + encryptedDataLength + 32)
                {
                    return(false);
                }

                if (!user.ServerKeyName.SecureEquals(stream.ReadGuid()))
                {
                    return(false);
                }

                long maxTicketAge = DateTime.UtcNow.Ticks + TimeSpan.TicksPerMinute * 10; //Allows for time syncing issues that might move the server's time back by a few minutes.
                long minTicketAge = maxTicketAge - TimeSpan.TicksPerDay;

                long issueTime = stream.ReadInt64();

                if (issueTime < minTicketAge || issueTime > maxTicketAge)
                {
                    return(false);
                }

                byte[] initializationVector = stream.ReadBytes(16);

                //Verify the signature if everything else looks good.
                //This is last because it is the most computationally complex.
                //This limits denial of service attackes.
                byte[] hmac = HMAC <Sha256Digest> .Compute(user.ServerHMACKey, ticket, 0, ticket.Length - 32);

                if (!hmac.SecureEquals(ticket, ticket.Length - 32, 32))
                {
                    return(false);
                }

                byte[] encryptedData = stream.ReadBytes(encryptedDataLength);
                var    aes           = new RijndaelManaged();

                aes.Key     = user.ServerEncryptionkey;
                aes.IV      = initializationVector;
                aes.Mode    = CipherMode.CBC;
                aes.Padding = PaddingMode.None;
                var decrypt = aes.CreateDecryptor();

                sessionSecret = decrypt.TransformFinalBlock(encryptedData, 0, encryptedData.Length);

                return(true);
            }
        }
Exemple #2
0
        private unsafe bool TryLoadTicket(byte[] ticket, out byte[] sessionSecret, out Guid userToken)
        {
#if SQLCLR
            sessionSecret = null;
            userToken     = Guid.Empty;
            return(false);
#else
            State     state           = m_state;
            const int encryptedLength = 32 + 16;
            const int ticketSize      = 1 + 16 + 8 + 16 + encryptedLength + 32;

            userToken     = default(Guid);
            sessionSecret = null;

            //Ticket Structure:
            //  byte      TicketVersion = 1
            //  Guid      ServerKeyName
            //  DateTime  AuthenticationTime
            //  byte[16]  IV
            //  byte[]    Encrypted Session Data 32+16
            //  byte[32]  HMAC (Sha2-256)

            if (ticket == null || ticket.Length != ticketSize)
                return(false);

            fixed(byte *lp = ticket)
            {
                var stream = new BinaryStreamPointerWrapper(lp, ticket.Length);

                if (stream.ReadUInt8() != 1)
                {
                    return(false);
                }

                if (!state.ServerKeyName.SecureEquals(stream.ReadGuid()))
                {
                    return(false);
                }


                long currentTime = DateTime.UtcNow.Ticks;
                long issueTime   = stream.ReadInt64();


                if (issueTime <= currentTime)
                {
                    //Issue time is before current time.
                    if (currentTime - issueTime > TimeSpan.TicksPerMinute * TicketExpireTimeMinutes)
                    {
                        return(false);
                    }
                }
                else
                {
                    //For some reason, the issue time is after the current time.
                    //This could be due to a clock sync on the server after the ticket was issued.
                    //Allow up to 1 minute of clock skew
                    if (issueTime - currentTime > TimeSpan.TicksPerMinute)
                    {
                        return(false);
                    }
                }

                byte[] initializationVector = stream.ReadBytes(16);

                //Verify the signature if everything else looks good.
                //This is last because it is the most computationally complex.
                //This limits denial of service attackes.
                byte[] hmac = HMAC <Sha256Digest> .Compute(state.ServerHMACKey, ticket, 0, ticket.Length - 32);

                if (!hmac.SecureEquals(ticket, ticket.Length - 32, 32))
                {
                    return(false);
                }

                byte[] encryptedData = stream.ReadBytes(encryptedLength);
                var    aes           = new RijndaelManaged();

                aes.Key     = state.ServerEncryptionkey;
                aes.IV      = initializationVector;
                aes.Mode    = CipherMode.CBC;
                aes.Padding = PaddingMode.None;
                var decrypt = aes.CreateDecryptor();

                encryptedData = decrypt.TransformFinalBlock(encryptedData, 0, encryptedData.Length);

                sessionSecret = new byte[32];
                Array.Copy(encryptedData, 0, sessionSecret, 0, 32);
                userToken = encryptedData.ToRfcGuid(32);

                return(true);
            }
#endif
        }