Cryptography for secure shell in emulated environments
Calls from an application in an emulated environment to a module in the operating system hosting the emulated environment may be combined to reduce the overhead of accessing the module. An application handling secure shell (SSH) communications may execute multiple calls to a cryptographic module in the host operating system. Because many calls to the cryptographic module during SSH communications follow patterns, two or more related calls may be combined into a single combined call to the cryptographic module. For example, a call to generate a server-to-client key and a call to generate a client-to-server key may be combined into a single call.
1. A method for providing secure communications to an application in an emulated environment, comprising:
providing an interface for the application executing in the emulated environment of a host operating system, in which the application accesses a security module in the host operating system through calls to the interface;
identifying two or more related calls, from the application to the module, for processing data during secure shell communications, in which the two or more related calls comprise at least one of:
a call to a CreateHash function;
a call to a HashData function; and
a call to a GetHashValue function;
combining the two or more related calls into a single call; and
executing a single combined call to the module of the host operating system to perform the two or more related calls.
2. The method of claim 1 , in which the module is a cryptographic module.
3. The method of claim 2 , in which the two or more calls are calls for generating an encryption key.
4. The method of claim 3 , in which the two or more related calls further comprise:
calls to the CreateHash function, the HashData function, and the GetHashValue function for producing a client-to-server initialization vector;
calls to the CreateHash function, the HashData function, and the GetHashValue function for producing a server-to-client initialization vector;
calls to the CreateHash function, the HashData function, and the GetHashValue function for producing a client-to-server encryption key;
calls to the CreateHash function, the HashData function, and the GetHashValue function for producing a server-to-client encryption key;
calls to the CreateHash function, the HashData function, and the GetHashValue function for producing a client-to-server message authentication code; and
calls to the CreateHash function, the HashData function, and the GetHashValue function for producing a server-to-client message authentication code.
5. The method of claim 2 , in which the two or more related calls comprise:
a call to a CreateCipher function for using a client-to-server encryption key; and
a call to the CreateCipher function for using the server-to-client encryption key.
6. The method of claim 2 , in which the two or more related calls comprise at least one of:
a call to a CreateHash function for using the client-to-server message authentication code; and
a call to the CreateHash function for using a server-to-client message authentication code.
7. The method of claim 2 , in which the two or more related calls comprise:
a call to an EncryptData function;
a call to a HashData function; and
a call to a GetHashValue function.
8. The method of claim 2 , in which the two or more related calls comprise:
a call to an ImportPublicKey function;
a call to an OpenCertificateStore function; and
a call to a StoreCertificate function.
9. The method of claim 2 , in which the two or more related calls comprise:
a call to a McpCryptGenDHPublicValue function for generating a Diffie-Hellman key;
a call to a McpCryptGenDHSharedSecret function for generating shared secrets; and
a call to a McpSSHHashAndVerifySignature function for generating an exchange hash and verifying the server's signature of the hash.
10. A computer program product for providing secure communications to an application in an emulated environment, comprising:
a non-transitory computer-readable medium comprising:
code to provide an interface for an application executing in an emulated environment of a host operating system, in which the application accesses a security module in the host operating system through calls to the interface;
code to identify two or more related calls, from the application to the module, for processing data during secure shell communications, in which the two or more related calls comprise at least one of:
a call to a CreateHash function;
a call to a HashData function; and
a call to a GetHashValue function;
code to combine the two or more related calls into a single call; and
code to execute a single combined call to the module of the host operating system to perform the two or more related calls.
11. The computer program product of claim 10 , in which the module is a cryptographic module.
12. The computer program product of claim 11 , in which the two or more calls are calls for generating an encryption key.
13. The computer program product of claim 12 , in which the two or more related calls comprise:
a call to a CreateCipher function for using a client-to-server encryption key; and
a call to the CreateCipher function for using the server-to-client encryption key.
14. The computer program product of claim 12 , in which the two or more related calls comprise:
a call to a CreateHash function for using the client-to-server message authentication code; and
a call to the CreateHash function for using a server-to-client message authentication code.
15. The computer program product of claim 12 , in which the two or more related calls comprise:
a call to a McpCryptGenDHPublicValue function for generating a Diffie-Hellman key;
a call to a McpCryptGenDHSharedSecret function for generating shared secrets;
a call to a McpSSHHashAndVerifySignature function for generating an exchange hash and verifying the server's signature of the hash.
16. An apparatus for providing secure communications to an application in an emulated environment, comprising:
a processor; and
a memory coupled to the processor, in which the processor is configured:
to provide an interface for an application executing in an emulated environment of a host operating system, in which the application accesses a module in the host operating system through calls to the interface;
to identify two or more related calls, from the application to the module, for processing data in secure shell communications, in which the two or more related calls comprise at least one of:
a call to a CreateHash function;
a call to a HashData function; and
a call to a GetHashValue function;
to combine the two or more related calls into a single call; and
to execute a single combined call to the module of the host operating system to perform the two or more related calls.
17. The apparatus of claim 16 , in which the processor is configured to perform cryptographic functions through the module in the host operating system.
18. The apparatus of claim 17 , in which the two or more calls are calls for generating an encryption key.
19. The apparatus of claim 18 , in which the processor is configured to process a call to a CreateHash function, to process a call to a HashData function, to process a call to a GetHashValue function as a single combined call.
20. The apparatus of claim 18 , in which the processor is configured to process a call to a CreateCipher function for using a client-to-server encryption key and to process a call to the CreateCipher function for using the server-to-client encryption key as a single combined call.