blob: fb2858148da773feacbf827079834f6d849cdca7 [file] [log] [blame]
// Copyright 2017 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "net/ntlm/ntlm.h"
#include <string.h>
#include "base/check_op.h"
#include "base/containers/span.h"
#include "base/metrics/histogram_macros.h"
#include "base/notreached.h"
#include "base/strings/string_util.h"
#include "base/strings/utf_string_conversions.h"
#include "net/base/net_string_util.h"
#include "net/ntlm/ntlm_buffer_writer.h"
#include "net/ntlm/ntlm_constants.h"
#include "third_party/boringssl/src/include/openssl/des.h"
#include "third_party/boringssl/src/include/openssl/hmac.h"
#include "third_party/boringssl/src/include/openssl/md4.h"
#include "third_party/boringssl/src/include/openssl/md5.h"
namespace net {
namespace ntlm {
namespace {
// Takes the parsed target info in |av_pairs| and performs the following
// actions.
// 1) If a |TargetInfoAvId::kTimestamp| AvPair exists, |server_timestamp|
// is set to the payload.
// 2) If |is_mic_enabled| is true, the existing |TargetInfoAvId::kFlags| AvPair
// will have the |TargetInfoAvFlags::kMicPresent| bit set. If an existing
// flags AvPair does not already exist, a new one is added with the value of
// |TargetInfoAvFlags::kMicPresent|.
// 3) If |is_epa_enabled| is true, two new AvPair entries will be added to
// |av_pairs|. The first will be of type |TargetInfoAvId::kChannelBindings|
// and contains MD5(|channel_bindings|) as the payload. The second will be
// of type |TargetInfoAvId::kTargetName| and contains |spn| as a little
// endian UTF16 string.
// 4) Sets |target_info_len| to the size of |av_pairs| when serialized into
// a payload.
void UpdateTargetInfoAvPairs(bool is_mic_enabled,
bool is_epa_enabled,
const std::string& channel_bindings,
const std::string& spn,
std::vector<AvPair>* av_pairs,
uint64_t* server_timestamp,
size_t* target_info_len) {
// Do a pass to update flags and calculate current length and
// pull out the server timestamp if it is there.
*server_timestamp = UINT64_MAX;
*target_info_len = 0;
bool need_flags_added = is_mic_enabled;
for (AvPair& pair : *av_pairs) {
*target_info_len += pair.avlen + kAvPairHeaderLen;
switch (pair.avid) {
case TargetInfoAvId::kFlags:
// The parsing phase already set the payload to the |flags| field.
if (is_mic_enabled) {
pair.flags = pair.flags | TargetInfoAvFlags::kMicPresent;
need_flags_added = false;
case TargetInfoAvId::kTimestamp:
// The parsing phase already set the payload to the |timestamp| field.
*server_timestamp = pair.timestamp;
case TargetInfoAvId::kEol:
case TargetInfoAvId::kChannelBindings:
case TargetInfoAvId::kTargetName:
// The terminator, |kEol|, should already have been removed from the
// end of the list and would have been rejected if it has been inside
// the list. Additionally |kChannelBindings| and |kTargetName| pairs
// would have been rejected during the initial parsing. See
// |NtlmBufferReader::ReadTargetInfo|.
// Ignore entries we don't care about.
if (need_flags_added) {
AvPair flags_pair(TargetInfoAvId::kFlags, sizeof(uint32_t));
flags_pair.flags = TargetInfoAvFlags::kMicPresent;
*target_info_len += kAvPairHeaderLen + flags_pair.avlen;
if (is_epa_enabled) {
std::vector<uint8_t> channel_bindings_hash(kChannelBindingsHashLen, 0);
// Hash the channel bindings if they exist otherwise they remain zeros.
if (!channel_bindings.empty()) {
// Convert the SPN to little endian unicode.
base::string16 spn16 = base::UTF8ToUTF16(spn);
NtlmBufferWriter spn_writer(spn16.length() * 2);
bool spn_writer_result =
spn_writer.WriteUtf16String(spn16) && spn_writer.IsEndOfBuffer();
av_pairs->emplace_back(TargetInfoAvId::kTargetName, spn_writer.Pass());
// Add the length of the two new AV Pairs to the total length.
*target_info_len +=
(2 * kAvPairHeaderLen) + kChannelBindingsHashLen + (spn16.length() * 2);
// Add extra space for the terminator at the end.
*target_info_len += kAvPairHeaderLen;
std::vector<uint8_t> WriteUpdatedTargetInfo(const std::vector<AvPair>& av_pairs,
size_t updated_target_info_len) {
bool result = true;
NtlmBufferWriter writer(updated_target_info_len);
for (const AvPair& pair : av_pairs) {
result = writer.WriteAvPair(pair);
result = writer.WriteAvPairTerminator() && writer.IsEndOfBuffer();
return writer.Pass();
// Reads 7 bytes (56 bits) from |key_56| and writes them into 8 bytes of
// |key_64| with 7 bits in every byte. The least significant bits are
// undefined and a subsequent operation will set those bits with a parity bit.
// |key_56| must contain 7 bytes.
// |key_64| must contain 8 bytes.
void Splay56To64(const uint8_t* key_56, uint8_t* key_64) {
key_64[0] = key_56[0];
key_64[1] = key_56[0] << 7 | key_56[1] >> 1;
key_64[2] = key_56[1] << 6 | key_56[2] >> 2;
key_64[3] = key_56[2] << 5 | key_56[3] >> 3;
key_64[4] = key_56[3] << 4 | key_56[4] >> 4;
key_64[5] = key_56[4] << 3 | key_56[5] >> 5;
key_64[6] = key_56[5] << 2 | key_56[6] >> 6;
key_64[7] = key_56[6] << 1;
} // namespace
void Create3DesKeysFromNtlmHash(
base::span<const uint8_t, kNtlmHashLen> ntlm_hash,
base::span<uint8_t, 24> keys) {
// Put the first 112 bits from |ntlm_hash| into the first 16 bytes of
// |keys|.
Splay56To64( + 7, + 8);
// Put the next 2x 7 bits in bytes 16 and 17 of |keys|, then
// the last 2 bits in byte 18, then zero pad the rest of the final key.
keys[16] = ntlm_hash[14];
keys[17] = ntlm_hash[14] << 7 | ntlm_hash[15] >> 1;
keys[18] = ntlm_hash[15] << 6;
memset( + 19, 0, 5);
void GenerateNtlmHashV1(const base::string16& password,
base::span<uint8_t, kNtlmHashLen> hash) {
size_t length = password.length() * 2;
NtlmBufferWriter writer(length);
// The writer will handle the big endian case if necessary.
bool result = writer.WriteUtf16String(password) && writer.IsEndOfBuffer();
MD4(writer.GetBuffer().data(), writer.GetLength(),;
void GenerateResponseDesl(base::span<const uint8_t, kNtlmHashLen> hash,
base::span<const uint8_t, kChallengeLen> challenge,
base::span<uint8_t, kResponseLenV1> response) {
constexpr size_t block_count = 3;
constexpr size_t block_size = sizeof(DES_cblock);
static_assert(kChallengeLen == block_size,
"kChallengeLen must equal block_size");
static_assert(kResponseLenV1 == block_count * block_size,
"kResponseLenV1 must equal block_count * block_size");
const DES_cblock* challenge_block =
reinterpret_cast<const DES_cblock*>(;
uint8_t keys[block_count * block_size];
// Map the NTLM hash to three 8 byte DES keys, with 7 bits of the key in each
// byte and the least significant bit set with odd parity. Then encrypt the
// 8 byte challenge with each of the three keys. This produces three 8 byte
// encrypted blocks into |response|.
Create3DesKeysFromNtlmHash(hash, keys);
for (size_t ix = 0; ix < block_count * block_size; ix += block_size) {
DES_cblock* key_block = reinterpret_cast<DES_cblock*>(keys + ix);
DES_cblock* response_block =
reinterpret_cast<DES_cblock*>( + ix);
DES_key_schedule key_schedule;
DES_set_key(key_block, &key_schedule);
DES_ecb_encrypt(challenge_block, response_block, &key_schedule,
void GenerateNtlmResponseV1(
const base::string16& password,
base::span<const uint8_t, kChallengeLen> server_challenge,
base::span<uint8_t, kResponseLenV1> ntlm_response) {
uint8_t ntlm_hash[kNtlmHashLen];
GenerateNtlmHashV1(password, ntlm_hash);
GenerateResponseDesl(ntlm_hash, server_challenge, ntlm_response);
void GenerateResponsesV1(
const base::string16& password,
base::span<const uint8_t, kChallengeLen> server_challenge,
base::span<uint8_t, kResponseLenV1> lm_response,
base::span<uint8_t, kResponseLenV1> ntlm_response) {
GenerateNtlmResponseV1(password, server_challenge, ntlm_response);
// In NTLM v1 (with LMv1 disabled), the lm_response and ntlm_response are the
// same. So just copy the ntlm_response into the lm_response.
memcpy(,, kResponseLenV1);
void GenerateLMResponseV1WithSessionSecurity(
base::span<const uint8_t, kChallengeLen> client_challenge,
base::span<uint8_t, kResponseLenV1> lm_response) {
// In NTLM v1 with Session Security (aka NTLM2) the lm_response is 8 bytes of
// client challenge and 16 bytes of zeros. (See 3.3.1)
memcpy(,, kChallengeLen);
memset( + kChallengeLen, 0, kResponseLenV1 - kChallengeLen);
void GenerateSessionHashV1WithSessionSecurity(
base::span<const uint8_t, kChallengeLen> server_challenge,
base::span<const uint8_t, kChallengeLen> client_challenge,
base::span<uint8_t, kNtlmHashLen> session_hash) {
MD5_CTX ctx;
MD5_Update(&ctx,, kChallengeLen);
MD5_Update(&ctx,, kChallengeLen);
MD5_Final(, &ctx);
void GenerateNtlmResponseV1WithSessionSecurity(
const base::string16& password,
base::span<const uint8_t, kChallengeLen> server_challenge,
base::span<const uint8_t, kChallengeLen> client_challenge,
base::span<uint8_t, kResponseLenV1> ntlm_response) {
// Generate the NTLMv1 Hash.
uint8_t ntlm_hash[kNtlmHashLen];
GenerateNtlmHashV1(password, ntlm_hash);
// Generate the NTLMv1 Session Hash.
uint8_t session_hash[kNtlmHashLen];
GenerateSessionHashV1WithSessionSecurity(server_challenge, client_challenge,
ntlm_hash, base::make_span(session_hash).subspan<0, kChallengeLen>(),
void GenerateResponsesV1WithSessionSecurity(
const base::string16& password,
base::span<const uint8_t, kChallengeLen> server_challenge,
base::span<const uint8_t, kChallengeLen> client_challenge,
base::span<uint8_t, kResponseLenV1> lm_response,
base::span<uint8_t, kResponseLenV1> ntlm_response) {
GenerateLMResponseV1WithSessionSecurity(client_challenge, lm_response);
GenerateNtlmResponseV1WithSessionSecurity(password, server_challenge,
client_challenge, ntlm_response);
void GenerateNtlmHashV2(const base::string16& domain,
const base::string16& username,
const base::string16& password,
base::span<uint8_t, kNtlmHashLen> v2_hash) {
// NOTE: According to [MS-NLMP] Section 3.3.2 only the username and not the
// domain is uppercased.
base::string16 upper_username;
bool result = ToUpper(username, &upper_username);
// TODO( Using a locale-sensitive upper casing
// algorithm is problematic. A more predictable approach is to only uppercase
// ASCII characters, so the hash does not change depending on the user's
// locale. Histogram how often the locale-sensitive ToUpper() gives a result
// that differs from ASCII uppercasing, to see how often this ambiguity arises
// in practice.
upper_username != base::ToUpperASCII(username));
uint8_t v1_hash[kNtlmHashLen];
GenerateNtlmHashV1(password, v1_hash);
NtlmBufferWriter input_writer((upper_username.length() + domain.length()) *
bool writer_result = input_writer.WriteUtf16String(upper_username) &&
input_writer.WriteUtf16String(domain) &&
unsigned int outlen = kNtlmHashLen;
uint8_t* out_hash =
HMAC(EVP_md5(), v1_hash, sizeof(v1_hash), input_writer.GetBuffer().data(),
input_writer.GetLength(),, &outlen);
DCHECK_EQ(, out_hash);
DCHECK_EQ(sizeof(v1_hash), outlen);
std::vector<uint8_t> GenerateProofInputV2(
uint64_t timestamp,
base::span<const uint8_t, kChallengeLen> client_challenge) {
NtlmBufferWriter writer(kProofInputLenV2);
bool result = writer.WriteUInt16(kProofInputVersionV2) &&
writer.WriteZeros(6) && writer.WriteUInt64(timestamp) &&
writer.WriteBytes(client_challenge) && writer.WriteZeros(4) &&
return writer.Pass();
void GenerateNtlmProofV2(
base::span<const uint8_t, kNtlmHashLen> v2_hash,
base::span<const uint8_t, kChallengeLen> server_challenge,
base::span<const uint8_t, kProofInputLenV2> v2_input,
base::span<const uint8_t> target_info,
base::span<uint8_t, kNtlmProofLenV2> v2_proof) {
bssl::ScopedHMAC_CTX ctx;
HMAC_Init_ex(ctx.get(),, kNtlmHashLen, EVP_md5(), NULL);
DCHECK_EQ(kNtlmProofLenV2, HMAC_size(ctx.get()));
HMAC_Update(ctx.get(),, kChallengeLen);
HMAC_Update(ctx.get(),, kProofInputLenV2);
HMAC_Update(ctx.get(),, target_info.size());
const uint32_t zero = 0;
HMAC_Update(ctx.get(), reinterpret_cast<const uint8_t*>(&zero),
HMAC_Final(ctx.get(),, nullptr);
void GenerateSessionBaseKeyV2(
base::span<const uint8_t, kNtlmHashLen> v2_hash,
base::span<const uint8_t, kNtlmProofLenV2> v2_proof,
base::span<uint8_t, kSessionKeyLenV2> session_key) {
unsigned int outlen = kSessionKeyLenV2;
uint8_t* result =
HMAC(EVP_md5(),, kNtlmHashLen,,
kNtlmProofLenV2,, &outlen);
DCHECK_EQ(, result);
DCHECK_EQ(kSessionKeyLenV2, outlen);
void GenerateChannelBindingHashV2(
const std::string& channel_bindings,
base::span<uint8_t, kNtlmHashLen> channel_bindings_hash) {
NtlmBufferWriter writer(kEpaUnhashedStructHeaderLen);
bool result = writer.WriteZeros(16) &&
writer.WriteUInt32(channel_bindings.length()) &&
MD5_CTX ctx;
MD5_Update(&ctx, writer.GetBuffer().data(), writer.GetBuffer().size());
MD5_Update(&ctx,, channel_bindings.size());
MD5_Final(, &ctx);
void GenerateMicV2(base::span<const uint8_t, kSessionKeyLenV2> session_key,
base::span<const uint8_t> negotiate_msg,
base::span<const uint8_t> challenge_msg,
base::span<const uint8_t> authenticate_msg,
base::span<uint8_t, kMicLenV2> mic) {
bssl::ScopedHMAC_CTX ctx;
HMAC_Init_ex(ctx.get(),, kSessionKeyLenV2, EVP_md5(),
DCHECK_EQ(kMicLenV2, HMAC_size(ctx.get()));
HMAC_Update(ctx.get(),, negotiate_msg.size());
HMAC_Update(ctx.get(),, challenge_msg.size());
HMAC_Update(ctx.get(),, authenticate_msg.size());
HMAC_Final(ctx.get(),, nullptr);
NET_EXPORT_PRIVATE std::vector<uint8_t> GenerateUpdatedTargetInfo(
bool is_mic_enabled,
bool is_epa_enabled,
const std::string& channel_bindings,
const std::string& spn,
const std::vector<AvPair>& av_pairs,
uint64_t* server_timestamp) {
size_t updated_target_info_len = 0;
std::vector<AvPair> updated_av_pairs(av_pairs);
UpdateTargetInfoAvPairs(is_mic_enabled, is_epa_enabled, channel_bindings, spn,
&updated_av_pairs, server_timestamp,
return WriteUpdatedTargetInfo(updated_av_pairs, updated_target_info_len);
} // namespace ntlm
} // namespace net