"Annual" pgcrypto update from Marko Kreen:

Few cleanups and couple of new things:

 - add SHA2 algorithm to older OpenSSL
 - add BIGNUM math to have public-key cryptography work on non-OpenSSL
   build.
 - gen_random_bytes() function

The status of SHA2 algoritms and public-key encryption can now be
changed to 'always available.'

That makes pgcrypto functionally complete and unless there will be new
editions of AES, SHA2 or OpenPGP standards, there is no major changes
planned.

Author: Neil Conway

contrib/pgcrypto/Makefile

@@ -1,29 +1,26 @@
 #
-# $PostgreSQL: pgsql/contrib/pgcrypto/Makefile,v 1.23 2005/09/27 17:13:08 tgl Exp $
+# $PostgreSQL: pgsql/contrib/pgcrypto/Makefile,v 1.24 2006/07/13 04:15:24 neilc Exp $
 #
 
-INT_SRCS = md5.c sha1.c sha2.c internal.c blf.c rijndael.c \
-		fortuna.c random.c pgp-mpi-internal.c
+INT_SRCS = md5.c sha1.c sha2.c internal.c internal-sha2.c blf.c rijndael.c \
+		fortuna.c random.c pgp-mpi-internal.c imath.c
 INT_TESTS = sha2
 
 OSSL_SRCS = openssl.c pgp-mpi-openssl.c
-OSSL_TESTS = des 3des cast5
+OSSL_TESTS = sha2 des 3des cast5
 
 ZLIB_OFF_CFLAGS = -DDISABLE_ZLIB
 ZLIB_TST = pgp-compression
 ZLIB_OFF_TST = pgp-zlib-DISABLED
-PUBENC_ON = pgp-pubkey-decrypt pgp-pubkey-encrypt pgp-info
-PUBENC_OFF = pgp-pubkey-DISABLED
 
 CF_SRCS = $(if $(subst no,,$(with_openssl)), $(OSSL_SRCS), $(INT_SRCS))
 CF_TESTS = $(if $(subst no,,$(with_openssl)), $(OSSL_TESTS), $(INT_TESTS))
 CF_CFLAGS = $(if $(subst yes,,$(with_zlib)), $(ZLIB_OFF_CFLAGS))
-CF_PGP_TESTS = $(if $(subst no,,$(with_zlib)), $(ZLIB_TST), $(ZLIB_OFF_TST)) \
-	$(if $(subst no,,$(with_openssl)), $(PUBENC_ON), $(PUBENC_OFF))
+CF_PGP_TESTS = $(if $(subst no,,$(with_zlib)), $(ZLIB_TST), $(ZLIB_OFF_TST))
 
 PG_CPPFLAGS	= $(CF_CFLAGS)
 
-SRCS		= pgcrypto.c px.c px-hmac.c px-crypt.c misc.c \
+SRCS		= pgcrypto.c px.c px-hmac.c px-crypt.c \
 		crypt-gensalt.c crypt-blowfish.c crypt-des.c \
 		crypt-md5.c $(CF_SRCS) \
 		mbuf.c pgp.c pgp-armor.c pgp-cfb.c pgp-compress.c \
@@ -35,12 +32,14 @@ MODULE_big	= pgcrypto
 OBJS		= $(SRCS:.c=.o)
 DOCS		= README.pgcrypto
 DATA_built	= pgcrypto.sql
+DATA		= uninstall_pgcrypto.sql
 EXTRA_CLEAN	= gen-rtab
 
 REGRESS = init md5 sha1 hmac-md5 hmac-sha1 blowfish rijndael \
 	$(CF_TESTS) \
 	crypt-des crypt-md5 crypt-blowfish crypt-xdes \
-	pgp-armor pgp-decrypt pgp-encrypt $(CF_PGP_TESTS)
+	pgp-armor pgp-decrypt pgp-encrypt $(CF_PGP_TESTS) \
+	pgp-pubkey-decrypt pgp-pubkey-encrypt pgp-info
 
 
 ifdef USE_PGXS

contrib/pgcrypto/README.pgcrypto

@@ -49,14 +49,14 @@ There are some other differences with and without OpenSSL:
 ----------------------------------------------------
  MD5                          yes       yes
  SHA1                         yes       yes
- SHA256/384/512               yes       since 0.9.8
+ SHA224/256/384/512           yes       yes (3)
  Any other digest algo        no        yes (1)
  Blowfish                     yes       yes
  AES                          yes       yes (2)
  DES/3DES/CAST5               no        yes
  Raw encryption               yes       yes
  PGP Symmetric encryption     yes       yes
- PGP Public-Key encryption    no        yes
+ PGP Public-Key encryption    yes       yes
 ----------------------------------------------------
 
 1. Any digest algorithm OpenSSL supports is automatically picked up.
@@ -67,6 +67,9 @@ There are some other differences with and without OpenSSL:
    compiled against older version, it will use built-in AES code,
    so it has AES always available.
 
+3. SHA2 algorithms were added to OpenSSL in version 0.9.8.  For
+   older versions, pgcrypto will use built-in code.
+
 
 2.2.  NULL handling
 ~~~~~~~~~~~~~~~~~~~~
@@ -621,36 +624,47 @@ is equal to
 	encrypt(data, 'fooz', 'bf-cbc/pad:pkcs')
 
 
-7.  Credits
+7.  Random bytes
+-----------------
+
+    gen_random_bytes(count integer)
+
+Returns `count` cryptographically strong random bytes as bytea value.
+There can be maximally 1024 bytes extracted at a time.  This is to avoid
+draining the randomness generator pool.
+
+
+8.  Credits
 ------------
 
 I have used code from following sources:
 
-`--------------------`-------------------------`----------------------
+`--------------------`-------------------------`-------------------------------
   Algorithm            Author                    Source origin
-----------------------------------------------------------------------
+-------------------------------------------------------------------------------
   DES crypt()          David Burren and others   FreeBSD libcrypt
   MD5 crypt()          Poul-Henning Kamp         FreeBSD libcrypt
   Blowfish crypt()     Solar Designer            www.openwall.com
   Blowfish cipher      Niels Provos              OpenBSD sys/crypto
   Rijndael cipher      Brian Gladman             OpenBSD sys/crypto
   MD5 and SHA1         WIDE Project              KAME kame/sys/crypto
   SHA256/384/512       Aaron D. Gifford          OpenBSD sys/crypto
-----------------------------------------------------------------------
+  BIGNUM math          Michael J. Fromberger     dartmouth.edu/~sting/sw/imath
+-------------------------------------------------------------------------------
 
 
-8.  Legalese
+9.  Legalese
 -------------
 
 * I owe a beer to Poul-Henning.
 * This product includes software developed by Niels Provos.
 
 
-9.  References/Links
----------------------
+10.  References/Links
+----------------------
 
-9.1.  Useful reading
-~~~~~~~~~~~~~~~~~~~~~
+10.1.  Useful reading
+~~~~~~~~~~~~~~~~~~~~~~
 
 http://www.gnupg.org/gph/en/manual.html[]::
 	The GNU Privacy Handbook
@@ -668,8 +682,8 @@ http://www.interhack.net/people/cmcurtin/snake-oil-faq.html[]::
 	Describes good and bad cryptography.
 
 
-9.2.  Technical references
-~~~~~~~~~~~~~~~~~~~~~~~~~~~
+10.2.  Technical references
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 http://www.ietf.org/rfc/rfc2440.txt[]::
 	OpenPGP message format
@@ -699,4 +713,4 @@ http://www.cs.ut.ee/~helger/crypto/[]::
 	Collection of cryptology pointers.
 
 
-// $PostgreSQL: pgsql/contrib/pgcrypto/README.pgcrypto,v 1.14 2005/11/03 02:54:07 tgl Exp $
+// $PostgreSQL: pgsql/contrib/pgcrypto/README.pgcrypto,v 1.15 2006/07/13 04:15:24 neilc Exp $

contrib/pgcrypto/crypt-des.c

@@ -1,7 +1,7 @@
 /*
  * FreeSec: libcrypt for NetBSD
  *
- * $PostgreSQL: pgsql/contrib/pgcrypto/crypt-des.c,v 1.14 2006/03/11 04:38:30 momjian Exp $
+ * $PostgreSQL: pgsql/contrib/pgcrypto/crypt-des.c,v 1.15 2006/07/13 04:15:24 neilc Exp $
  *
  * Copyright (c) 1994 David Burren
  * All rights reserved.
@@ -71,6 +71,9 @@
 
 #define _PASSWORD_EFMT1 '_'
 
+static const char _crypt_a64[] =
+"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+
 static uint8 IP[64] = {
 	58, 50, 42, 34, 26, 18, 10, 2, 60, 52, 44, 36, 28, 20, 12, 4,
 	62, 54, 46, 38, 30, 22, 14, 6, 64, 56, 48, 40, 32, 24, 16, 8,

contrib/pgcrypto/crypt-gensalt.c

@@ -2,7 +2,7 @@
  * Written by Solar Designer and placed in the public domain.
  * See crypt_blowfish.c for more information.
  *
- * $PostgreSQL: pgsql/contrib/pgcrypto/crypt-gensalt.c,v 1.8 2006/03/11 04:38:30 momjian Exp $
+ * $PostgreSQL: pgsql/contrib/pgcrypto/crypt-gensalt.c,v 1.9 2006/07/13 04:15:24 neilc Exp $
  *
  * This file contains salt generation functions for the traditional and
  * other common crypt(3) algorithms, except for bcrypt which is defined
@@ -19,7 +19,7 @@
 
 typedef unsigned int BF_word;
 
-unsigned char _crypt_itoa64[64 + 1] =
+static unsigned char _crypt_itoa64[64 + 1] =
 "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 
 char *

contrib/pgcrypto/crypt-md5.c

@@ -8,7 +8,7 @@
  *
  * $FreeBSD: src/lib/libcrypt/crypt-md5.c,v 1.5 1999/12/17 20:21:45 peter Exp $
  *
- * $PostgreSQL: pgsql/contrib/pgcrypto/crypt-md5.c,v 1.6 2005/10/15 02:49:06 momjian Exp $
+ * $PostgreSQL: pgsql/contrib/pgcrypto/crypt-md5.c,v 1.7 2006/07/13 04:15:24 neilc Exp $
  */
 
 #include "postgres.h"
@@ -17,6 +17,20 @@
 #include "px-crypt.h"
 
 #define MD5_SIZE 16
+
+static const char _crypt_a64[] =
+"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+
+static void
+_crypt_to64(char *s, unsigned long v, int n)
+{
+   	while (--n >= 0)
+	{
+		*s++ = _crypt_a64[v & 0x3f];
+		v >>= 6;
+	}
+}
+
 /*
  * UNIX password
  */

contrib/pgcrypto/expected/sha2.out

@@ -1,6 +1,37 @@
 --
 -- SHA2 family
 --
+-- SHA224
+SELECT encode(digest('', 'sha224'), 'hex');
+                          encode                          
+----------------------------------------------------------
+ d14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f
+(1 row)
+
+SELECT encode(digest('a', 'sha224'), 'hex');
+                          encode                          
+----------------------------------------------------------
+ abd37534c7d9a2efb9465de931cd7055ffdb8879563ae98078d6d6d5
+(1 row)
+
+SELECT encode(digest('abc', 'sha224'), 'hex');
+                          encode                          
+----------------------------------------------------------
+ 23097d223405d8228642a477bda255b32aadbce4bda0b3f7e36c9da7
+(1 row)
+
+SELECT encode(digest('abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq', 'sha224'), 'hex');
+                          encode                          
+----------------------------------------------------------
+ 75388b16512776cc5dba5da1fd890150b0c6455cb4f58b1952522525
+(1 row)
+
+SELECT encode(digest('12345678901234567890123456789012345678901234567890123456789012345678901234567890', 'sha224'), 'hex');
+                          encode                          
+----------------------------------------------------------
+ b50aecbe4e9bb0b57bc5f3ae760a8e01db24f203fb3cdcd13148046e
+(1 row)
+
 -- SHA256
 SELECT encode(digest('', 'sha256'), 'hex');
                               encode                              

contrib/pgcrypto/fortuna.c

@@ -26,7 +26,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $PostgreSQL: pgsql/contrib/pgcrypto/fortuna.c,v 1.6 2006/05/21 20:22:16 tgl Exp $
+ * $PostgreSQL: pgsql/contrib/pgcrypto/fortuna.c,v 1.7 2006/07/13 04:15:24 neilc Exp $
  */
 
 #include "postgres.h"
@@ -125,7 +125,7 @@ struct fortuna_state
 	struct timeval last_reseed_time;
 	unsigned	pool0_bytes;
 	unsigned	rnd_pos;
-	int			counter_init;
+	int			tricks_done;
 };
 typedef struct fortuna_state FState;
 
@@ -332,7 +332,7 @@ add_entropy(FState * st, const uint8 *data, unsigned len)
 	/*
 	 * Make sure the pool 0 is initialized, then update randomly.
 	 */
-	if (st->reseed_count == 0 && st->pool0_bytes < POOL0_FILL)
+	if (st->reseed_count == 0)
 		pos = 0;
 	else
 		pos = get_rand_pool(st);
@@ -357,21 +357,34 @@ rekey(FState * st)
 }
 
 /*
- * Fortuna relies on AES standing known-plaintext attack.
- * In case it does not, slow down the attacker by initialising
- * the couter to random value.
+ * Hide public constants. (counter, pools > 0)
+ *
+ * This can also be viewed as spreading the startup
+ * entropy over all of the components.
  */
 static void
-init_counter(FState * st)
+startup_tricks(FState * st)
 {
+	int i;
+	uint8 buf[BLOCK];
+
 	/* Use next block as counter. */
 	encrypt_counter(st, st->counter);
 
+	/* Now shuffle pools, excluding #0 */
+	for (i = 1; i < NUM_POOLS; i++)
+	{
+		encrypt_counter(st, buf);
+		encrypt_counter(st, buf + CIPH_BLOCK);
+		md_update(&st->pool[i], buf, BLOCK);
+	}
+	memset(buf, 0, BLOCK);
+
 	/* Hide the key. */
 	rekey(st);
 
-	/* The counter can be shuffled only once. */
-	st->counter_init = 1;
+	/* This can be done only once. */
+	st->tricks_done = 1;
 }
 
 static void
@@ -380,13 +393,14 @@ extract_data(FState * st, unsigned count, uint8 *dst)
 	unsigned	n;
 	unsigned	block_nr = 0;
 
-	/* Can we reseed? */
-	if (st->pool0_bytes >= POOL0_FILL && enough_time_passed(st))
-		reseed(st);
+	/* Should we reseed? */
+	if (st->pool0_bytes >= POOL0_FILL || st->reseed_count == 0)
+		if (enough_time_passed(st))
+			reseed(st);
 
-	/* Is counter initialized? */
-	if (!st->counter_init)
-		init_counter(st);
+	/* Do some randomization on first call */
+	if (!st->tricks_done)
+		startup_tricks(st);
 
 	while (count > 0)
 	{