Previously, ocb_internal.cc supported different key sizes, by way of
the deprecated aes_* function family. However, in practice, mosh
always uses AES-128. In Nettle, the explicit key-size APIs are not
deprecated, so switch to AES-128 directly.
Fixes: 1202
Explicitly define the primitive AES API used by the internal OCB
implementation, and move it into its own namespace (ocb_aes). This will
ease future implementation changes.
Also make some style fixes to affected lines: Replace C-style casts
with C++-style casts, add some missing spaces in argument lists, and
remove some `inline` that the compiler will ignore.
Bug: https://github.com/mobile-shell/mosh/issues/1174
After further discussion, the Mosh maintainers have decided to stick
with the internal OCB implementation for this release. Restore support
for using OpenSSL’s AES but internal OCB. To make this commit easy to
audit, restore the code exactly, including calls to AES functions that
are deprecated in OpenSSL 3; a future commit will update ocb_internal.cc
to use EVP instead of directly calling the AES primitives.
In anticipation of future changes, preserve support for OpenSSL’s
AES-OCB, but don’t compile it in. Add
--with-crypto-library=openssl-with-openssl-ocb and
--with-crypto-library=openssl-with-internal-ocb options to configure so
that developers can easily test Mosh using OpenSSL’s AES-OCB. These
options are intended only for testing, are undocumented, and are not
subject to any API stability guarantees.
Rework configure to look for all possible cryptography libraries first
and then dispatch on --with-crypto-library as appropriate.
Split src/crypto/ocb.cc into two files – one containing the AES-OCB
implementation backed by OpenSSL, and the other containing
implementations backed by Apple Common Crypto and Nettle. This paves the
way for a new OpenSSL implementation that uses OpenSSL 1.1’s OCB support
directly, rather than one that merely uses OpenSSL to provide the
underlying block cipher.
Remove support for rijndael-alg-fst.c and compiler-provided AES
intrinsics, since they’re not in use anymore. (Mosh can still use
hardware-accelerated AES if it’s available; it just now relies
exclusively on the underlying cryptography library to accelerate AES if
possible.)
Update the build system to conditionally compile in either
ocb_openssl.cc or ocb_internal.cc, depending on which cryptography
library you pass to ./configure.
To make this commit easy to audit, ocb_openssl.cc and ocb_internal.cc
are trivially diffable against ocb.cc (now deleted). Expected diffs
consist of a copyright notice update, a preprocessor check to ensure the
appropriate cryptography implementation has been selected, and deletions
to remove code that’s no longer in use. This does mean a substantial
amount of code is duplicated between ocb_openssl.cc and ocb_internal.cc;
however, ocb_openssl.cc should be completely replaced soon, so it won’t
be an issue in the long term.
Bug: https://github.com/mobile-shell/mosh/issues/1174
Alex Chernyakhovsky