|
 |
6e16f6 |
diff -up ntp-4.2.6p5/html/keygen.html.pwcipher ntp-4.2.6p5/html/keygen.html
|
|
|
6e16f6 |
--- ntp-4.2.6p5/html/keygen.html.pwcipher 2012-11-23 13:57:26.178868018 +0100
|
|
|
6e16f6 |
+++ ntp-4.2.6p5/html/keygen.html 2012-11-23 14:44:50.952850361 +0100
|
|
|
6e16f6 |
@@ -44,8 +44,8 @@
|
|
|
6e16f6 |
Synopsis
|
|
|
6e16f6 |
|
|
|
6e16f6 |
<tt>ntp-keygen [ -deGHIMPT ] [ -b modulus ] [ -c [RSA-MD2 | RSA-MD5 | RSA-SHA
|
|
|
6e16f6 |
- | RSA-SHA1 | RSA-MDC2 | RSA-RIPEMD160 | DSA-SHA | DSA-SHA1 ] ] [
|
|
|
6e16f6 |
- -i group ]
|
|
|
6e16f6 |
+ | RSA-SHA1 | RSA-MDC2 | RSA-RIPEMD160 | DSA-SHA | DSA-SHA1 ] ]
|
|
|
6e16f6 |
+ [ -C cipher ] [ -i group ]
|
|
|
6e16f6 |
[ -m modulus ] [ -p passwd2 ] [ -q passwd1 ] [ -S
|
|
|
6e16f6 |
[ RSA | DSA ] ] [ -s host ] [ -V nkeys ]</tt>
|
|
|
6e16f6 |
|
|
|
6e16f6 |
@@ -148,6 +148,9 @@
|
|
|
6e16f6 |
compatibility with FIPS 140-2 is required, either the <tt>DSA-SHA</tt> or <tt>DSA-SHA1</tt> scheme
|
|
|
6e16f6 |
must be used.
|
|
|
6e16f6 |
|
|
|
6e16f6 |
+<tt>-C cipher</tt>
|
|
|
6e16f6 |
+Select the cipher which is used to encrypt the files containing private keys. The default is three-key triple DES in CBC mode, equivalent to "-C des-ede3-cbc". The openssl tool lists ciphers available in "openssl -h" output.
|
|
|
6e16f6 |
+
|
|
|
6e16f6 |
<tt>-d</tt>
|
|
|
6e16f6 |
Enable debugging. This option displays the cryptographic data produced for eye-friendly billboards.
|
|
|
6e16f6 |
|
|
|
6e16f6 |
@@ -215,7 +218,7 @@
|
|
|
6e16f6 |
|
|
|
6e16f6 |
All files begin with two nonencrypted lines. The first line contains the file name in the format <tt>ntpkey_key_host.fstamp</tt>. The second line contains the datestamp in conventional Unix <tt>date</tt> format. Lines beginning with <tt>#</tt> are ignored.
|
|
|
6e16f6 |
|
|
|
6e16f6 |
-The remainder of the file contains cryptographic data encoded first using ASN.1 rules, then encrypted using the DES-CBC algorithm and given password and finally written in PEM-encoded printable ASCII text preceded and followed by MIME content identifier lines.
|
|
|
6e16f6 |
+The remainder of the file contains cryptographic data encoded first using ASN.1 rules, then encrypted using the cipher selected with <tt>-C</tt> and given password and finally written in PEM-encoded printable ASCII text preceded and followed by MIME content identifier lines.
|
|
|
6e16f6 |
|
|
|
6e16f6 |
The format of the symmetric keys file is somewhat different than the other files in the interest of backward compatibility. Since DES-CBC is deprecated in NTPv4, the only key format of interest is MD5 alphanumeric strings. Following the header the keys are entered one per line in the format
|
|
|
6e16f6 |
|
|
|
6e16f6 |
@@ -237,4 +240,4 @@
|
|
|
6e16f6 |
|
|
|
6e16f6 |
</body>
|
|
|
6e16f6 |
|
|
|
6e16f6 |
-</html>
|
|
|
6e16f6 |
\ No newline at end of file
|
|
|
6e16f6 |
+</html>
|
|
|
6e16f6 |
diff -up ntp-4.2.6p5/util/ntp-keygen-opts.def.pwcipher ntp-4.2.6p5/util/ntp-keygen-opts.def
|
|
|
6e16f6 |
--- ntp-4.2.6p5/util/ntp-keygen-opts.def.pwcipher 2009-12-09 08:36:35.000000000 +0100
|
|
|
6e16f6 |
+++ ntp-4.2.6p5/util/ntp-keygen-opts.def 2012-11-23 13:57:26.211868051 +0100
|
|
|
6e16f6 |
@@ -34,6 +34,21 @@ flag = {
|
|
|
6e16f6 |
_EndOfDoc_;
|
|
|
6e16f6 |
};
|
|
|
6e16f6 |
|
|
|
6e16f6 |
+flag = {
|
|
|
6e16f6 |
+ value = C;
|
|
|
6e16f6 |
+ name = cipher;
|
|
|
6e16f6 |
+ arg-type = string;
|
|
|
6e16f6 |
+ arg-name = cipher;
|
|
|
6e16f6 |
+ ifdef = OPENSSL;
|
|
|
6e16f6 |
+ descrip = "privatekey cipher";
|
|
|
6e16f6 |
+ doc = <<- _EndOfDoc_
|
|
|
6e16f6 |
+ Select the cipher which is used to encrypt the files containing
|
|
|
6e16f6 |
+ private keys. The default is three-key triple DES in CBC mode,
|
|
|
6e16f6 |
+ equivalent to "-C des-ede3-cbc". The openssl tool lists ciphers
|
|
|
6e16f6 |
+ available in "openssl -h" output.
|
|
|
6e16f6 |
+ _EndOfDoc_;
|
|
|
6e16f6 |
+};
|
|
|
6e16f6 |
+
|
|
|
6e16f6 |
#include debug-opt.def
|
|
|
6e16f6 |
|
|
|
6e16f6 |
flag = {
|
|
|
6e16f6 |
@@ -134,7 +149,7 @@ flag = {
|
|
|
6e16f6 |
descrip = "output private password";
|
|
|
6e16f6 |
doc = <<- _EndOfDoc_
|
|
|
6e16f6 |
Encrypt generated files containing private data with the specified
|
|
|
6e16f6 |
- password and the DES-CBC algorithm.
|
|
|
6e16f6 |
+ password and the cipher selected with -C/--cipher.
|
|
|
6e16f6 |
_EndOfDoc_;
|
|
|
6e16f6 |
};
|
|
|
6e16f6 |
|
|
|
6e16f6 |
diff -up ntp-4.2.6p5/util/ntp-keygen.c.pwcipher ntp-4.2.6p5/util/ntp-keygen.c
|
|
|
6e16f6 |
--- ntp-4.2.6p5/util/ntp-keygen.c.pwcipher 2012-11-23 13:57:26.202868041 +0100
|
|
|
6e16f6 |
+++ ntp-4.2.6p5/util/ntp-keygen.c 2012-11-23 13:57:26.212868052 +0100
|
|
|
6e16f6 |
@@ -169,6 +169,7 @@ char *passwd1 = NULL; /* input private k
|
|
|
6e16f6 |
char *passwd2 = NULL; /* output private key password */
|
|
|
6e16f6 |
#ifdef OPENSSL
|
|
|
6e16f6 |
long d0, d1, d2, d3; /* callback counters */
|
|
|
6e16f6 |
+const EVP_CIPHER * cipher = NULL;
|
|
|
6e16f6 |
#endif /* OPENSSL */
|
|
|
6e16f6 |
|
|
|
6e16f6 |
#ifdef SYS_WINNT
|
|
|
6e16f6 |
@@ -236,6 +237,7 @@ main(
|
|
|
6e16f6 |
const EVP_MD *ectx; /* EVP digest */
|
|
|
6e16f6 |
char pathbuf[MAXFILENAME + 1];
|
|
|
6e16f6 |
const char *scheme = NULL; /* digest/signature scheme */
|
|
|
6e16f6 |
+ const char *ciphername = NULL; /* to encrypt priv. key */
|
|
|
6e16f6 |
char *exten = NULL; /* private extension */
|
|
|
6e16f6 |
char *grpkey = NULL; /* identity extension */
|
|
|
6e16f6 |
int nid; /* X509 digest/signature scheme */
|
|
|
6e16f6 |
@@ -322,6 +324,9 @@ main(
|
|
|
6e16f6 |
if (HAVE_OPT( CERTIFICATE ))
|
|
|
6e16f6 |
scheme = OPT_ARG( CERTIFICATE );
|
|
|
6e16f6 |
|
|
|
6e16f6 |
+ if (HAVE_OPT( CIPHER ))
|
|
|
6e16f6 |
+ ciphername = OPT_ARG( CIPHER );
|
|
|
6e16f6 |
+
|
|
|
6e16f6 |
if (HAVE_OPT( SUBJECT_NAME ))
|
|
|
6e16f6 |
hostname = strdup(OPT_ARG( SUBJECT_NAME ));
|
|
|
6e16f6 |
|
|
|
6e16f6 |
@@ -418,6 +423,13 @@ main(
|
|
|
6e16f6 |
}
|
|
|
6e16f6 |
if (scheme == NULL)
|
|
|
6e16f6 |
scheme = "RSA-MD5";
|
|
|
6e16f6 |
+ if (ciphername == NULL)
|
|
|
6e16f6 |
+ ciphername = "des-ede3-cbc";
|
|
|
6e16f6 |
+ cipher = EVP_get_cipherbyname(ciphername);
|
|
|
6e16f6 |
+ if (cipher == NULL) {
|
|
|
6e16f6 |
+ fprintf(stderr, "Unknown cipher %s\n", ciphername);
|
|
|
6e16f6 |
+ exit(-1);
|
|
|
6e16f6 |
+ }
|
|
|
6e16f6 |
if (groupname == NULL)
|
|
|
6e16f6 |
groupname = hostname;
|
|
|
6e16f6 |
fprintf(stderr, "Using host %s group %s\n", hostname,
|
|
|
6e16f6 |
@@ -520,9 +532,9 @@ main(
|
|
|
6e16f6 |
BN_copy(rsa->q, BN_value_one());
|
|
|
6e16f6 |
pkey = EVP_PKEY_new();
|
|
|
6e16f6 |
EVP_PKEY_assign_RSA(pkey, rsa);
|
|
|
6e16f6 |
- PEM_write_PrivateKey(stdout, pkey, NULL, NULL, 0, NULL,
|
|
|
6e16f6 |
- NULL);
|
|
|
6e16f6 |
- fclose(stdout);
|
|
|
6e16f6 |
+ PEM_write_PKCS8PrivateKey(stdout, pkey, NULL, NULL, 0,
|
|
|
6e16f6 |
+ NULL, NULL);
|
|
|
6e16f6 |
+ fflush(stdout);
|
|
|
6e16f6 |
if (debug)
|
|
|
6e16f6 |
RSA_print_fp(stderr, rsa, 0);
|
|
|
6e16f6 |
}
|
|
|
6e16f6 |
@@ -542,9 +554,9 @@ main(
|
|
|
6e16f6 |
rsa = pkey_gqkey->pkey.rsa;
|
|
|
6e16f6 |
pkey = EVP_PKEY_new();
|
|
|
6e16f6 |
EVP_PKEY_assign_RSA(pkey, rsa);
|
|
|
6e16f6 |
- PEM_write_PrivateKey(stdout, pkey,
|
|
|
6e16f6 |
- EVP_des_cbc(), NULL, 0, NULL, passwd2);
|
|
|
6e16f6 |
- fclose(stdout);
|
|
|
6e16f6 |
+ PEM_write_PKCS8PrivateKey(stdout, pkey, cipher, NULL, 0,
|
|
|
6e16f6 |
+ NULL, passwd2);
|
|
|
6e16f6 |
+ fflush(stdout);
|
|
|
6e16f6 |
if (debug)
|
|
|
6e16f6 |
RSA_print_fp(stderr, rsa, 0);
|
|
|
6e16f6 |
}
|
|
|
6e16f6 |
@@ -584,9 +596,9 @@ main(
|
|
|
6e16f6 |
BN_copy(dsa->priv_key, BN_value_one());
|
|
|
6e16f6 |
pkey = EVP_PKEY_new();
|
|
|
6e16f6 |
EVP_PKEY_assign_DSA(pkey, dsa);
|
|
|
6e16f6 |
- PEM_write_PrivateKey(stdout, pkey, NULL, NULL, 0, NULL,
|
|
|
6e16f6 |
- NULL);
|
|
|
6e16f6 |
- fclose(stdout);
|
|
|
6e16f6 |
+ PEM_write_PKCS8PrivateKey(stdout, pkey, NULL, NULL, 0,
|
|
|
6e16f6 |
+ NULL, NULL);
|
|
|
6e16f6 |
+ fflush(stdout);
|
|
|
6e16f6 |
if (debug)
|
|
|
6e16f6 |
DSA_print_fp(stderr, dsa, 0);
|
|
|
6e16f6 |
}
|
|
|
6e16f6 |
@@ -607,9 +619,9 @@ main(
|
|
|
6e16f6 |
dsa = pkey_iffkey->pkey.dsa;
|
|
|
6e16f6 |
pkey = EVP_PKEY_new();
|
|
|
6e16f6 |
EVP_PKEY_assign_DSA(pkey, dsa);
|
|
|
6e16f6 |
- PEM_write_PrivateKey(stdout, pkey, EVP_des_cbc(), NULL,
|
|
|
6e16f6 |
- 0, NULL, passwd2);
|
|
|
6e16f6 |
- fclose(stdout);
|
|
|
6e16f6 |
+ PEM_write_PKCS8PrivateKey(stdout, pkey, cipher, NULL, 0,
|
|
|
6e16f6 |
+ NULL, passwd2);
|
|
|
6e16f6 |
+ fflush(stdout);
|
|
|
6e16f6 |
if (debug)
|
|
|
6e16f6 |
DSA_print_fp(stderr, dsa, 0);
|
|
|
6e16f6 |
}
|
|
|
6e16f6 |
@@ -645,9 +657,9 @@ main(
|
|
|
6e16f6 |
fprintf(stdout, "# %s\n# %s\n", filename,
|
|
|
6e16f6 |
ctime(&epoch));
|
|
|
6e16f6 |
pkey = pkey_mvpar[2];
|
|
|
6e16f6 |
- PEM_write_PrivateKey(stdout, pkey, NULL, NULL, 0, NULL,
|
|
|
6e16f6 |
- NULL);
|
|
|
6e16f6 |
- fclose(stdout);
|
|
|
6e16f6 |
+ PEM_write_PKCS8PrivateKey(stdout, pkey, NULL, NULL, 0,
|
|
|
6e16f6 |
+ NULL, NULL);
|
|
|
6e16f6 |
+ fflush(stdout);
|
|
|
6e16f6 |
if (debug)
|
|
|
6e16f6 |
DSA_print_fp(stderr, pkey->pkey.dsa, 0);
|
|
|
6e16f6 |
}
|
|
|
6e16f6 |
@@ -664,9 +676,9 @@ main(
|
|
|
6e16f6 |
fprintf(stdout, "# %s\n# %s\n", filename,
|
|
|
6e16f6 |
ctime(&epoch));
|
|
|
6e16f6 |
pkey = pkey_mvpar[1];
|
|
|
6e16f6 |
- PEM_write_PrivateKey(stdout, pkey, EVP_des_cbc(), NULL,
|
|
|
6e16f6 |
- 0, NULL, passwd2);
|
|
|
6e16f6 |
- fclose(stdout);
|
|
|
6e16f6 |
+ PEM_write_PKCS8PrivateKey(stdout, pkey, cipher, NULL, 0,
|
|
|
6e16f6 |
+ NULL, passwd2);
|
|
|
6e16f6 |
+ fflush(stdout);
|
|
|
6e16f6 |
if (debug)
|
|
|
6e16f6 |
DSA_print_fp(stderr, pkey->pkey.dsa, 0);
|
|
|
6e16f6 |
}
|
|
|
6e16f6 |
@@ -886,7 +898,7 @@ gen_rsa(
|
|
|
6e16f6 |
str = fheader("RSAhost", id, hostname);
|
|
|
6e16f6 |
pkey = EVP_PKEY_new();
|
|
|
6e16f6 |
EVP_PKEY_assign_RSA(pkey, rsa);
|
|
|
6e16f6 |
- PEM_write_PrivateKey(str, pkey, EVP_des_cbc(), NULL, 0, NULL,
|
|
|
6e16f6 |
+ PEM_write_PKCS8PrivateKey(str, pkey, cipher, NULL, 0, NULL,
|
|
|
6e16f6 |
passwd1);
|
|
|
6e16f6 |
fclose(str);
|
|
|
6e16f6 |
if (debug)
|
|
|
6e16f6 |
@@ -941,7 +953,7 @@ gen_dsa(
|
|
|
6e16f6 |
str = fheader("DSAsign", id, hostname);
|
|
|
6e16f6 |
pkey = EVP_PKEY_new();
|
|
|
6e16f6 |
EVP_PKEY_assign_DSA(pkey, dsa);
|
|
|
6e16f6 |
- PEM_write_PrivateKey(str, pkey, EVP_des_cbc(), NULL, 0, NULL,
|
|
|
6e16f6 |
+ PEM_write_PKCS8PrivateKey(str, pkey, cipher, NULL, 0, NULL,
|
|
|
6e16f6 |
passwd1);
|
|
|
6e16f6 |
fclose(str);
|
|
|
6e16f6 |
if (debug)
|
|
|
6e16f6 |
@@ -1108,7 +1120,7 @@ gen_iffkey(
|
|
|
6e16f6 |
str = fheader("IFFkey", id, groupname);
|
|
|
6e16f6 |
pkey = EVP_PKEY_new();
|
|
|
6e16f6 |
EVP_PKEY_assign_DSA(pkey, dsa);
|
|
|
6e16f6 |
- PEM_write_PrivateKey(str, pkey, EVP_des_cbc(), NULL, 0, NULL,
|
|
|
6e16f6 |
+ PEM_write_PKCS8PrivateKey(str, pkey, cipher, NULL, 0, NULL,
|
|
|
6e16f6 |
passwd1);
|
|
|
6e16f6 |
fclose(str);
|
|
|
6e16f6 |
if (debug)
|
|
|
6e16f6 |
@@ -1305,7 +1317,7 @@ gen_gqkey(
|
|
|
6e16f6 |
str = fheader("GQkey", id, groupname);
|
|
|
6e16f6 |
pkey = EVP_PKEY_new();
|
|
|
6e16f6 |
EVP_PKEY_assign_RSA(pkey, rsa);
|
|
|
6e16f6 |
- PEM_write_PrivateKey(str, pkey, EVP_des_cbc(), NULL, 0, NULL,
|
|
|
6e16f6 |
+ PEM_write_PKCS8PrivateKey(str, pkey, cipher, NULL, 0, NULL,
|
|
|
6e16f6 |
passwd1);
|
|
|
6e16f6 |
fclose(str);
|
|
|
6e16f6 |
if (debug)
|
|
|
6e16f6 |
@@ -1710,7 +1722,7 @@ gen_mvkey(
|
|
|
6e16f6 |
BN_copy(dsa->pub_key, b);
|
|
|
6e16f6 |
pkey = EVP_PKEY_new();
|
|
|
6e16f6 |
EVP_PKEY_assign_DSA(pkey, dsa);
|
|
|
6e16f6 |
- PEM_write_PrivateKey(str, pkey, EVP_des_cbc(), NULL, 0, NULL,
|
|
|
6e16f6 |
+ PEM_write_PKCS8PrivateKey(str, pkey, cipher, NULL, 0, NULL,
|
|
|
6e16f6 |
passwd1);
|
|
|
6e16f6 |
evpars[i++] = pkey;
|
|
|
6e16f6 |
if (debug)
|
|
|
6e16f6 |
@@ -1736,7 +1748,7 @@ gen_mvkey(
|
|
|
6e16f6 |
dsa2->pub_key = BN_dup(ghat);
|
|
|
6e16f6 |
pkey1 = EVP_PKEY_new();
|
|
|
6e16f6 |
EVP_PKEY_assign_DSA(pkey1, dsa2);
|
|
|
6e16f6 |
- PEM_write_PrivateKey(str, pkey1, EVP_des_cbc(), NULL, 0, NULL,
|
|
|
6e16f6 |
+ PEM_write_PKCS8PrivateKey(str, pkey1, cipher, NULL, 0, NULL,
|
|
|
6e16f6 |
passwd1);
|
|
|
6e16f6 |
evpars[i++] = pkey1;
|
|
|
6e16f6 |
if (debug)
|
|
|
6e16f6 |
@@ -1762,7 +1774,7 @@ gen_mvkey(
|
|
|
6e16f6 |
sdsa->pub_key = BN_dup(xhat[j]);
|
|
|
6e16f6 |
pkey1 = EVP_PKEY_new();
|
|
|
6e16f6 |
EVP_PKEY_set1_DSA(pkey1, sdsa);
|
|
|
6e16f6 |
- PEM_write_PrivateKey(str, pkey1, EVP_des_cbc(), NULL, 0,
|
|
|
6e16f6 |
+ PEM_write_PKCS8PrivateKey(str, pkey1, cipher, NULL, 0,
|
|
|
6e16f6 |
NULL, passwd1);
|
|
|
6e16f6 |
evpars[i++] = pkey1;
|
|
|
6e16f6 |
if (debug)
|