2014-11-14 18:37:01 +01:00
|
|
|
/*
|
|
|
|
*
|
|
|
|
* Wireless daemon for Linux
|
|
|
|
*
|
2018-09-01 00:37:54 +02:00
|
|
|
* Copyright (C) 2013-2018 Intel Corporation. All rights reserved.
|
2014-11-14 18:37:01 +01:00
|
|
|
*
|
|
|
|
* This library is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
|
|
* License as published by the Free Software Foundation; either
|
|
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This library is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
|
* Lesser General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
|
|
* License along with this library; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
#include <config.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#include <stdbool.h>
|
|
|
|
#include <string.h>
|
|
|
|
#include <errno.h>
|
2014-12-26 18:46:27 +01:00
|
|
|
#include <linux/if_ether.h>
|
2014-11-14 18:37:01 +01:00
|
|
|
|
|
|
|
#include <ell/ell.h>
|
|
|
|
|
2019-04-03 18:34:22 +02:00
|
|
|
#include "src/missing.h"
|
2018-10-26 21:35:27 +02:00
|
|
|
#include "src/crypto.h"
|
2014-11-14 18:37:01 +01:00
|
|
|
|
2016-08-13 00:34:00 +02:00
|
|
|
/* RFC 3526, Section 2 */
|
|
|
|
const unsigned char crypto_dh5_prime[] = {
|
|
|
|
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xc9, 0x0f, 0xda, 0xa2,
|
|
|
|
0x21, 0x68, 0xc2, 0x34, 0xc4, 0xc6, 0x62, 0x8b, 0x80, 0xdc, 0x1c, 0xd1,
|
|
|
|
0x29, 0x02, 0x4e, 0x08, 0x8a, 0x67, 0xcc, 0x74, 0x02, 0x0b, 0xbe, 0xa6,
|
|
|
|
0x3b, 0x13, 0x9b, 0x22, 0x51, 0x4a, 0x08, 0x79, 0x8e, 0x34, 0x04, 0xdd,
|
|
|
|
0xef, 0x95, 0x19, 0xb3, 0xcd, 0x3a, 0x43, 0x1b, 0x30, 0x2b, 0x0a, 0x6d,
|
|
|
|
0xf2, 0x5f, 0x14, 0x37, 0x4f, 0xe1, 0x35, 0x6d, 0x6d, 0x51, 0xc2, 0x45,
|
|
|
|
0xe4, 0x85, 0xb5, 0x76, 0x62, 0x5e, 0x7e, 0xc6, 0xf4, 0x4c, 0x42, 0xe9,
|
|
|
|
0xa6, 0x37, 0xed, 0x6b, 0x0b, 0xff, 0x5c, 0xb6, 0xf4, 0x06, 0xb7, 0xed,
|
|
|
|
0xee, 0x38, 0x6b, 0xfb, 0x5a, 0x89, 0x9f, 0xa5, 0xae, 0x9f, 0x24, 0x11,
|
|
|
|
0x7c, 0x4b, 0x1f, 0xe6, 0x49, 0x28, 0x66, 0x51, 0xec, 0xe4, 0x5b, 0x3d,
|
|
|
|
0xc2, 0x00, 0x7c, 0xb8, 0xa1, 0x63, 0xbf, 0x05, 0x98, 0xda, 0x48, 0x36,
|
|
|
|
0x1c, 0x55, 0xd3, 0x9a, 0x69, 0x16, 0x3f, 0xa8, 0xfd, 0x24, 0xcf, 0x5f,
|
|
|
|
0x83, 0x65, 0x5d, 0x23, 0xdc, 0xa3, 0xad, 0x96, 0x1c, 0x62, 0xf3, 0x56,
|
|
|
|
0x20, 0x85, 0x52, 0xbb, 0x9e, 0xd5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6d,
|
|
|
|
0x67, 0x0c, 0x35, 0x4e, 0x4a, 0xbc, 0x98, 0x04, 0xf1, 0x74, 0x6c, 0x08,
|
|
|
|
0xca, 0x23, 0x73, 0x27, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
|
|
|
};
|
|
|
|
size_t crypto_dh5_prime_size = sizeof(crypto_dh5_prime);
|
|
|
|
|
|
|
|
const unsigned char crypto_dh5_generator[] = { 0x2 };
|
|
|
|
size_t crypto_dh5_generator_size = sizeof(crypto_dh5_generator);
|
|
|
|
|
2015-02-19 03:51:54 +01:00
|
|
|
static bool hmac_common(enum l_checksum_type type,
|
|
|
|
const void *key, size_t key_len,
|
2015-02-19 03:45:52 +01:00
|
|
|
const void *data, size_t data_len, void *output, size_t size)
|
|
|
|
{
|
|
|
|
struct l_checksum *hmac;
|
|
|
|
|
2015-02-19 03:51:54 +01:00
|
|
|
hmac = l_checksum_new_hmac(type, key, key_len);
|
2015-02-19 03:45:52 +01:00
|
|
|
if (!hmac)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
l_checksum_update(hmac, data, data_len);
|
|
|
|
l_checksum_get_digest(hmac, output, size);
|
|
|
|
l_checksum_free(hmac);
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2015-02-19 03:51:54 +01:00
|
|
|
bool hmac_md5(const void *key, size_t key_len,
|
|
|
|
const void *data, size_t data_len, void *output, size_t size)
|
|
|
|
{
|
|
|
|
return hmac_common(L_CHECKSUM_MD5, key, key_len, data, data_len,
|
|
|
|
output, size);
|
|
|
|
}
|
|
|
|
|
2016-02-10 21:12:46 +01:00
|
|
|
bool hmac_sha1(const void *key, size_t key_len,
|
|
|
|
const void *data, size_t data_len, void *output, size_t size)
|
|
|
|
{
|
|
|
|
return hmac_common(L_CHECKSUM_SHA1, key, key_len, data, data_len,
|
|
|
|
output, size);
|
|
|
|
}
|
|
|
|
|
2015-02-19 03:51:54 +01:00
|
|
|
bool hmac_sha256(const void *key, size_t key_len,
|
|
|
|
const void *data, size_t data_len, void *output, size_t size)
|
|
|
|
{
|
|
|
|
return hmac_common(L_CHECKSUM_SHA256, key, key_len, data, data_len,
|
|
|
|
output, size);
|
|
|
|
}
|
|
|
|
|
2019-01-14 21:54:26 +01:00
|
|
|
bool hmac_sha384(const void *key, size_t key_len,
|
|
|
|
const void *data, size_t data_len, void *output, size_t size)
|
|
|
|
{
|
|
|
|
return hmac_common(L_CHECKSUM_SHA384, key, key_len, data, data_len,
|
|
|
|
output, size);
|
|
|
|
}
|
|
|
|
|
2015-02-19 04:02:09 +01:00
|
|
|
bool cmac_aes(const void *key, size_t key_len,
|
|
|
|
const void *data, size_t data_len, void *output, size_t size)
|
|
|
|
{
|
|
|
|
struct l_checksum *cmac_aes;
|
|
|
|
|
|
|
|
cmac_aes = l_checksum_new_cmac_aes(key, key_len);
|
|
|
|
if (!cmac_aes)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
l_checksum_update(cmac_aes, data, data_len);
|
|
|
|
l_checksum_get_digest(cmac_aes, output, size);
|
|
|
|
l_checksum_free(cmac_aes);
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Implements AES Key-Unwrap from RFC 3394
|
|
|
|
*
|
|
|
|
* The key is specified using @kek. @in contains the encrypted data and @len
|
|
|
|
* contains its length. @out will contain the decrypted data. The result
|
|
|
|
* will be (len - 8) bytes.
|
|
|
|
*
|
|
|
|
* Returns: true on success, false if an IV mismatch has occurred.
|
|
|
|
*
|
|
|
|
* NOTE: Buffers @in and @out can overlap
|
|
|
|
*/
|
2019-01-17 21:25:30 +01:00
|
|
|
bool aes_unwrap(const uint8_t *kek, size_t kek_len, const uint8_t *in, size_t len,
|
2015-02-19 04:02:09 +01:00
|
|
|
uint8_t *out)
|
|
|
|
{
|
2017-08-31 19:18:07 +02:00
|
|
|
uint64_t b[2];
|
|
|
|
uint64_t *r;
|
2015-02-19 04:02:09 +01:00
|
|
|
size_t n = (len - 8) >> 3;
|
|
|
|
int i, j;
|
|
|
|
struct l_cipher *cipher;
|
2017-08-31 19:18:07 +02:00
|
|
|
uint64_t t = n * 6;
|
2015-02-19 04:02:09 +01:00
|
|
|
|
2019-01-17 21:25:30 +01:00
|
|
|
cipher = l_cipher_new(L_CIPHER_AES, kek, kek_len);
|
2015-02-19 04:02:09 +01:00
|
|
|
if (!cipher)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
/* Set up */
|
2017-08-31 04:04:46 +02:00
|
|
|
memcpy(b, in, 8);
|
2015-02-19 04:02:09 +01:00
|
|
|
memmove(out, in + 8, n * 8);
|
|
|
|
|
|
|
|
/* Unwrap */
|
|
|
|
for (j = 5; j >= 0; j--) {
|
2017-08-31 19:18:07 +02:00
|
|
|
r = (uint64_t *) out + n - 1;
|
2015-02-19 04:02:09 +01:00
|
|
|
|
2017-08-31 19:18:07 +02:00
|
|
|
for (i = n; i >= 1; i--, t--) {
|
|
|
|
b[0] ^= L_CPU_TO_BE64(t);
|
|
|
|
b[1] = L_GET_UNALIGNED(r);
|
2015-02-19 04:02:09 +01:00
|
|
|
l_cipher_decrypt(cipher, b, b, 16);
|
2017-08-31 19:18:07 +02:00
|
|
|
L_PUT_UNALIGNED(b[1], r);
|
|
|
|
r -= 1;
|
2015-02-19 04:02:09 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
l_cipher_free(cipher);
|
2019-03-21 03:54:13 +01:00
|
|
|
explicit_bzero(&b[1], 8);
|
2015-02-19 04:02:09 +01:00
|
|
|
|
|
|
|
/* Check IV */
|
2017-08-31 19:18:07 +02:00
|
|
|
if (b[0] != 0xa6a6a6a6a6a6a6a6)
|
|
|
|
return false;
|
2015-02-19 04:02:09 +01:00
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2017-08-31 04:04:47 +02:00
|
|
|
/*
|
|
|
|
* AES Key-wrap from RFC 3394 for 128-bit key
|
|
|
|
*
|
|
|
|
* The key is specified using @kek. @in contains the plaintext data and @len
|
|
|
|
* contains its length. @out will contain the encrypted data. The result
|
|
|
|
* will be (len + 8) bytes.
|
|
|
|
*
|
|
|
|
* Returns: true on success, false if an IV mismatch has occurred.
|
|
|
|
*
|
|
|
|
* NOTE: Buffers @in and @out can overlap
|
|
|
|
*/
|
|
|
|
bool aes_wrap(const uint8_t *kek, const uint8_t *in, size_t len, uint8_t *out)
|
|
|
|
{
|
|
|
|
uint64_t b[2] = { 0xa6a6a6a6a6a6a6a6, 0 };
|
|
|
|
uint64_t *r = (uint64_t *) out + 1;
|
|
|
|
size_t n = len >> 3;
|
|
|
|
unsigned int i, j;
|
|
|
|
uint32_t t = 1;
|
|
|
|
struct l_cipher *cipher;
|
|
|
|
|
|
|
|
cipher = l_cipher_new(L_CIPHER_AES, kek, 16);
|
|
|
|
if (!cipher)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
memmove(r, in, len);
|
|
|
|
|
|
|
|
for (j = 0; j < 6; j++) {
|
|
|
|
for (i = 0; i < n; i++, t++) {
|
|
|
|
b[1] = L_GET_UNALIGNED(r + i);
|
|
|
|
l_cipher_encrypt(cipher, b, b, 16);
|
|
|
|
L_PUT_UNALIGNED(b[1], r + i);
|
|
|
|
b[0] ^= L_CPU_TO_BE64(t);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
L_PUT_UNALIGNED(b[0], r - 1);
|
|
|
|
|
|
|
|
l_cipher_free(cipher);
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2019-04-17 20:21:29 +02:00
|
|
|
/*
|
|
|
|
* RFC 5297 Section 2.3 - Doubling
|
|
|
|
*/
|
|
|
|
static void dbl(uint8_t *val)
|
|
|
|
{
|
|
|
|
int i;
|
|
|
|
int c = val[0] & (1 << 7);
|
|
|
|
|
|
|
|
/* shift all but last byte (since i + 1 would overflow) */
|
|
|
|
for (i = 0; i < 15; i++)
|
|
|
|
val[i] = (val[i] << 1) | (val[i + 1] >> 7);
|
|
|
|
|
|
|
|
val[15] <<= 1;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* "The condition under which the xor operation is performed is when the
|
|
|
|
* bit being shifted off is one."
|
|
|
|
*/
|
|
|
|
if (c)
|
|
|
|
val[15] ^= 0x87;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void xor(uint8_t *a, uint8_t *b, size_t len)
|
|
|
|
{
|
|
|
|
size_t i;
|
|
|
|
|
|
|
|
for (i = 0; i < len; i++)
|
|
|
|
a[i] ^= b[i];
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* RFC 5297 Section 2.4 - S2V
|
|
|
|
*/
|
|
|
|
static bool s2v(struct l_checksum *cmac, struct iovec *iov, size_t iov_len,
|
|
|
|
uint8_t *v)
|
|
|
|
{
|
|
|
|
uint8_t zero[16] = { 0 };
|
|
|
|
uint8_t d[16];
|
|
|
|
uint8_t tmp[16];
|
|
|
|
size_t i;
|
|
|
|
|
|
|
|
/* AES-CMAC(K, <zero>) */
|
|
|
|
if (!l_checksum_update(cmac, zero, sizeof(zero)))
|
|
|
|
return false;
|
|
|
|
|
|
|
|
l_checksum_get_digest(cmac, d, sizeof(d));
|
|
|
|
|
|
|
|
/* Last element is treated special */
|
|
|
|
for (i = 0; i < iov_len - 1; i++) {
|
|
|
|
/* D = dbl(D) */
|
|
|
|
dbl(d);
|
|
|
|
|
|
|
|
/* AES-CMAC(K, Si) */
|
|
|
|
if (!l_checksum_update(cmac, iov[i].iov_base, iov[i].iov_len))
|
|
|
|
return false;
|
|
|
|
|
|
|
|
l_checksum_get_digest(cmac, tmp, sizeof(tmp));
|
|
|
|
/* D = D xor AES-CMAC(K, Si) */
|
|
|
|
xor(d, tmp, sizeof(tmp));
|
|
|
|
}
|
|
|
|
|
|
|
|
if (iov[i].iov_len >= 16) {
|
|
|
|
if (!l_checksum_update(cmac, iov[i].iov_base,
|
|
|
|
iov[i].iov_len - 16))
|
|
|
|
return false;
|
|
|
|
/* xorend(d) */
|
|
|
|
xor(d, iov[i].iov_base + iov[i].iov_len - 16, 16);
|
|
|
|
} else {
|
|
|
|
dbl(d);
|
|
|
|
xor(d, iov[i].iov_base, iov[i].iov_len);
|
|
|
|
/*
|
|
|
|
* pad(X) indicates padding of string X, len(X) < 128, out to
|
|
|
|
* 128 bits by the concatenation of a single bit of 1 followed
|
|
|
|
* by as many 0 bits as are necessary.
|
|
|
|
*/
|
|
|
|
d[iov[i].iov_len] ^= 0x80;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!l_checksum_update(cmac, d, 16))
|
|
|
|
return false;
|
|
|
|
|
|
|
|
l_checksum_get_digest(cmac, v, 16);
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* RFC 5297 Section 2.6 - SIV Encrypt
|
|
|
|
*/
|
|
|
|
bool aes_siv_encrypt(const uint8_t *key, size_t key_len, const uint8_t *in,
|
|
|
|
size_t in_len, struct iovec *ad, size_t num_ad,
|
|
|
|
uint8_t *out)
|
|
|
|
{
|
|
|
|
struct l_checksum *cmac;
|
|
|
|
struct l_cipher *ctr;
|
|
|
|
struct iovec iov[num_ad + 1];
|
|
|
|
uint8_t v[16];
|
|
|
|
|
|
|
|
memcpy(iov, ad, sizeof(iov) * num_ad);
|
|
|
|
iov[num_ad].iov_base = (void *)in;
|
|
|
|
iov[num_ad].iov_len = in_len;
|
|
|
|
num_ad++;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* key is split into two equal halves... K1 is used for S2V and K2 is
|
|
|
|
* used for CTR
|
|
|
|
*/
|
|
|
|
cmac = l_checksum_new_cmac_aes(key, key_len / 2);
|
|
|
|
if (!cmac)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
if (!s2v(cmac, iov, num_ad, v)) {
|
|
|
|
l_checksum_free(cmac);
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
l_checksum_free(cmac);
|
|
|
|
|
|
|
|
memcpy(out, v, 16);
|
|
|
|
|
|
|
|
v[8] &= 0x7f;
|
|
|
|
v[12] &= 0x7f;
|
|
|
|
|
|
|
|
ctr = l_cipher_new(L_CIPHER_AES_CTR, key + (key_len / 2), key_len / 2);
|
|
|
|
if (!ctr)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
if (!l_cipher_set_iv(ctr, v, 16))
|
|
|
|
goto free_ctr;
|
|
|
|
|
|
|
|
if (!l_cipher_encrypt(ctr, in, out + 16, in_len))
|
|
|
|
goto free_ctr;
|
|
|
|
|
|
|
|
l_cipher_free(ctr);
|
|
|
|
|
|
|
|
return true;
|
|
|
|
|
|
|
|
free_ctr:
|
|
|
|
l_cipher_free(ctr);
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
bool aes_siv_decrypt(const uint8_t *key, size_t key_len, const uint8_t *in,
|
|
|
|
size_t in_len, struct iovec *ad, size_t num_ad,
|
|
|
|
uint8_t *out)
|
|
|
|
{
|
|
|
|
struct l_checksum *cmac;
|
|
|
|
struct l_cipher *ctr;
|
|
|
|
struct iovec iov[num_ad + 1];
|
|
|
|
uint8_t iv[16];
|
|
|
|
uint8_t v[16];
|
|
|
|
|
2019-04-18 01:59:27 +02:00
|
|
|
if (in_len < 16)
|
|
|
|
return false;
|
|
|
|
|
2019-04-17 20:21:29 +02:00
|
|
|
memcpy(iov, ad, sizeof(iov) * num_ad);
|
|
|
|
iov[num_ad].iov_base = (void *)out;
|
|
|
|
iov[num_ad].iov_len = in_len - 16;
|
|
|
|
num_ad++;
|
|
|
|
|
2019-04-18 01:59:27 +02:00
|
|
|
if (in_len == 16)
|
|
|
|
goto check_cmac;
|
|
|
|
|
2019-04-17 20:21:29 +02:00
|
|
|
memcpy(iv, in, 16);
|
|
|
|
|
|
|
|
iv[8] &= 0x7f;
|
|
|
|
iv[12] &= 0x7f;
|
|
|
|
|
|
|
|
ctr = l_cipher_new(L_CIPHER_AES_CTR, key + (key_len / 2), key_len / 2);
|
|
|
|
if (!ctr)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
if (!l_cipher_set_iv(ctr, iv, 16))
|
|
|
|
goto free_ctr;
|
|
|
|
|
|
|
|
if (!l_cipher_decrypt(ctr, in + 16, out, in_len - 16))
|
|
|
|
goto free_ctr;
|
|
|
|
|
|
|
|
l_cipher_free(ctr);
|
|
|
|
|
2019-04-18 01:59:27 +02:00
|
|
|
check_cmac:
|
2019-04-17 20:21:29 +02:00
|
|
|
cmac = l_checksum_new_cmac_aes(key, key_len / 2);
|
|
|
|
if (!cmac)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
if (!s2v(cmac, iov, num_ad, v)) {
|
|
|
|
l_checksum_free(cmac);
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
l_checksum_free(cmac);
|
|
|
|
|
|
|
|
if (memcmp(v, in, 16))
|
|
|
|
return false;
|
|
|
|
|
|
|
|
return true;
|
|
|
|
|
|
|
|
free_ctr:
|
|
|
|
l_cipher_free(ctr);
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2015-02-19 04:11:37 +01:00
|
|
|
bool arc4_skip(const uint8_t *key, size_t key_len, size_t skip,
|
|
|
|
const uint8_t *in, size_t len, uint8_t *out)
|
|
|
|
{
|
|
|
|
char skip_buf[1024];
|
|
|
|
struct l_cipher *cipher;
|
2017-06-06 20:32:14 +02:00
|
|
|
struct iovec in_vec[2];
|
|
|
|
struct iovec out_vec[2];
|
|
|
|
bool r;
|
2015-02-19 04:11:37 +01:00
|
|
|
|
|
|
|
cipher = l_cipher_new(L_CIPHER_ARC4, key, key_len);
|
|
|
|
if (!cipher)
|
|
|
|
return false;
|
|
|
|
|
2017-06-06 20:33:08 +02:00
|
|
|
/* This is not strictly necessary, but keeps valgrind happy */
|
|
|
|
memset(skip_buf, 0, sizeof(skip_buf));
|
|
|
|
|
2017-06-06 20:32:14 +02:00
|
|
|
while (skip > sizeof(skip_buf)) {
|
2015-02-19 04:11:37 +01:00
|
|
|
size_t to_skip =
|
|
|
|
skip > sizeof(skip_buf) ? sizeof(skip_buf) : skip;
|
|
|
|
|
|
|
|
l_cipher_decrypt(cipher, skip_buf, skip_buf, to_skip);
|
|
|
|
skip -= to_skip;
|
|
|
|
}
|
|
|
|
|
2017-06-06 20:32:14 +02:00
|
|
|
in_vec[0].iov_base = skip_buf;
|
|
|
|
in_vec[0].iov_len = skip;
|
|
|
|
in_vec[1].iov_base = (void *) in;
|
|
|
|
in_vec[1].iov_len = len;
|
|
|
|
|
|
|
|
out_vec[0].iov_base = skip_buf;
|
|
|
|
out_vec[0].iov_len = skip;
|
|
|
|
out_vec[1].iov_base = out;
|
|
|
|
out_vec[1].iov_len = len;
|
|
|
|
|
|
|
|
r = l_cipher_decryptv(cipher, in_vec, 2, out_vec, 2);
|
2015-02-19 04:11:37 +01:00
|
|
|
l_cipher_free(cipher);
|
|
|
|
|
2017-06-06 20:32:14 +02:00
|
|
|
return r;
|
2015-02-19 04:11:37 +01:00
|
|
|
}
|
2016-08-22 22:54:24 +02:00
|
|
|
|
2014-12-26 19:15:32 +01:00
|
|
|
/* 802.11, Section 11.6.2, Table 11-4 */
|
|
|
|
int crypto_cipher_key_len(enum crypto_cipher cipher)
|
|
|
|
{
|
|
|
|
switch (cipher) {
|
|
|
|
case CRYPTO_CIPHER_WEP40:
|
|
|
|
return 5;
|
|
|
|
case CRYPTO_CIPHER_WEP104:
|
|
|
|
return 13;
|
|
|
|
case CRYPTO_CIPHER_TKIP:
|
|
|
|
return 32;
|
|
|
|
case CRYPTO_CIPHER_CCMP:
|
|
|
|
return 16;
|
|
|
|
case CRYPTO_CIPHER_BIP:
|
|
|
|
return 16;
|
|
|
|
};
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2014-12-26 19:15:46 +01:00
|
|
|
int crypto_cipher_tk_bits(enum crypto_cipher cipher)
|
|
|
|
{
|
|
|
|
return crypto_cipher_key_len(cipher) * 8;
|
|
|
|
}
|
|
|
|
|
2019-09-18 18:02:57 +02:00
|
|
|
bool crypto_passphrase_is_valid(const char *passphrase)
|
2014-11-14 18:37:01 +01:00
|
|
|
{
|
|
|
|
size_t passphrase_len;
|
|
|
|
size_t i;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* IEEE 802.11, Annex M, Section M.4.1:
|
|
|
|
* "A pass-phrase is a sequence of between 8 and 63 ASCII-encoded
|
|
|
|
* characters. The limit of 63 comes from the desire to distinguish
|
|
|
|
* between a pass-phrase and a PSK displayed as 64 hexadecimal
|
|
|
|
* characters."
|
|
|
|
*/
|
|
|
|
passphrase_len = strlen(passphrase);
|
|
|
|
if (passphrase_len < 8 || passphrase_len > 63)
|
2019-09-18 18:02:57 +02:00
|
|
|
return false;
|
2014-11-14 18:37:01 +01:00
|
|
|
|
|
|
|
/* IEEE 802.11, Annex M, Section M.4.1:
|
|
|
|
* "Each character in the pass-phrase must have an encoding in the
|
|
|
|
* range of 32 to 126 (decimal), inclusive."
|
|
|
|
*
|
|
|
|
* This corresponds to printable characters only
|
|
|
|
*/
|
|
|
|
for (i = 0; i < passphrase_len; i++) {
|
|
|
|
if (l_ascii_isprint(passphrase[i]))
|
|
|
|
continue;
|
|
|
|
|
2019-09-18 18:02:57 +02:00
|
|
|
return false;
|
2014-11-14 18:37:01 +01:00
|
|
|
}
|
|
|
|
|
2019-09-18 18:02:57 +02:00
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
int crypto_psk_from_passphrase(const char *passphrase,
|
|
|
|
const unsigned char *ssid, size_t ssid_len,
|
|
|
|
unsigned char *out_psk)
|
|
|
|
{
|
|
|
|
bool result;
|
|
|
|
unsigned char psk[32];
|
|
|
|
|
|
|
|
if (!passphrase)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
if (!ssid)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
if (!crypto_passphrase_is_valid(passphrase))
|
|
|
|
return -ERANGE;
|
|
|
|
|
|
|
|
if (ssid_len == 0 || ssid_len > 32)
|
|
|
|
return -ERANGE;
|
|
|
|
|
2017-10-09 11:48:13 +02:00
|
|
|
result = l_pkcs5_pbkdf2(L_CHECKSUM_SHA1, passphrase, ssid, ssid_len,
|
2014-11-14 18:37:01 +01:00
|
|
|
4096, psk, sizeof(psk));
|
|
|
|
if (!result)
|
|
|
|
return -ENOKEY;
|
|
|
|
|
|
|
|
if (out_psk)
|
|
|
|
memcpy(out_psk, psk, sizeof(psk));
|
|
|
|
|
2019-03-21 03:54:13 +01:00
|
|
|
explicit_bzero(psk, sizeof(psk));
|
2014-11-14 18:37:01 +01:00
|
|
|
return 0;
|
|
|
|
}
|
2014-12-26 18:46:27 +01:00
|
|
|
|
2016-02-10 21:16:32 +01:00
|
|
|
bool prf_sha1(const void *key, size_t key_len,
|
|
|
|
const void *prefix, size_t prefix_len,
|
|
|
|
const void *data, size_t data_len, void *output, size_t size)
|
|
|
|
{
|
|
|
|
struct l_checksum *hmac;
|
|
|
|
unsigned int i, offset = 0;
|
|
|
|
unsigned char empty = '\0';
|
|
|
|
unsigned char counter;
|
|
|
|
struct iovec iov[4] = {
|
|
|
|
[0] = { .iov_base = (void *) prefix, .iov_len = prefix_len },
|
|
|
|
[1] = { .iov_base = &empty, .iov_len = 1 },
|
|
|
|
[2] = { .iov_base = (void *) data, .iov_len = data_len },
|
|
|
|
[3] = { .iov_base = &counter, .iov_len = 1 },
|
|
|
|
};
|
|
|
|
|
|
|
|
hmac = l_checksum_new_hmac(L_CHECKSUM_SHA1, key, key_len);
|
|
|
|
if (!hmac)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
/* PRF processes in 160-bit chunks (20 bytes) */
|
|
|
|
for (i = 0, counter = 0; i < (size + 19) / 20; i++, counter++) {
|
|
|
|
size_t len;
|
|
|
|
|
|
|
|
if (size - offset > 20)
|
|
|
|
len = 20;
|
|
|
|
else
|
|
|
|
len = size - offset;
|
|
|
|
|
|
|
|
l_checksum_updatev(hmac, iov, 4);
|
|
|
|
l_checksum_get_digest(hmac, output + offset, len);
|
|
|
|
|
|
|
|
offset += len;
|
|
|
|
}
|
|
|
|
|
|
|
|
l_checksum_free(hmac);
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2016-02-10 23:30:22 +01:00
|
|
|
/* Defined in 802.11-2012, Section 11.6.1.7.2 Key derivation function (KDF) */
|
|
|
|
bool kdf_sha256(const void *key, size_t key_len,
|
|
|
|
const void *prefix, size_t prefix_len,
|
|
|
|
const void *data, size_t data_len, void *output, size_t size)
|
|
|
|
{
|
|
|
|
struct l_checksum *hmac;
|
|
|
|
unsigned int i, offset = 0;
|
|
|
|
unsigned int counter;
|
|
|
|
uint8_t counter_le[2];
|
|
|
|
uint8_t length_le[2];
|
|
|
|
struct iovec iov[4] = {
|
|
|
|
[0] = { .iov_base = counter_le, .iov_len = 2 },
|
|
|
|
[1] = { .iov_base = (void *) prefix, .iov_len = prefix_len },
|
|
|
|
[2] = { .iov_base = (void *) data, .iov_len = data_len },
|
|
|
|
[3] = { .iov_base = length_le, .iov_len = 2 },
|
|
|
|
};
|
|
|
|
|
|
|
|
hmac = l_checksum_new_hmac(L_CHECKSUM_SHA256, key, key_len);
|
|
|
|
if (!hmac)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
/* Length is denominated in bits, not bytes */
|
|
|
|
l_put_le16(size * 8, length_le);
|
|
|
|
|
|
|
|
/* KDF processes in 256-bit chunks (32 bytes) */
|
|
|
|
for (i = 0, counter = 1; i < (size + 31) / 32; i++, counter++) {
|
|
|
|
size_t len;
|
|
|
|
|
|
|
|
if (size - offset > 32)
|
|
|
|
len = 32;
|
|
|
|
else
|
|
|
|
len = size - offset;
|
|
|
|
|
|
|
|
l_put_le16(counter, counter_le);
|
|
|
|
|
|
|
|
l_checksum_updatev(hmac, iov, 4);
|
|
|
|
l_checksum_get_digest(hmac, output + offset, len);
|
2019-04-06 00:47:30 +02:00
|
|
|
|
|
|
|
offset += len;
|
|
|
|
}
|
|
|
|
|
|
|
|
l_checksum_free(hmac);
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
bool kdf_sha384(const void *key, size_t key_len,
|
|
|
|
const void *prefix, size_t prefix_len,
|
|
|
|
const void *data, size_t data_len, void *output, size_t size)
|
|
|
|
{
|
|
|
|
struct l_checksum *hmac;
|
|
|
|
unsigned int i, offset = 0;
|
|
|
|
unsigned int counter;
|
|
|
|
uint8_t counter_le[2];
|
|
|
|
uint8_t length_le[2];
|
|
|
|
struct iovec iov[4] = {
|
|
|
|
[0] = { .iov_base = counter_le, .iov_len = 2 },
|
|
|
|
[1] = { .iov_base = (void *) prefix, .iov_len = prefix_len },
|
|
|
|
[2] = { .iov_base = (void *) data, .iov_len = data_len },
|
|
|
|
[3] = { .iov_base = length_le, .iov_len = 2 },
|
|
|
|
};
|
|
|
|
|
|
|
|
hmac = l_checksum_new_hmac(L_CHECKSUM_SHA384, key, key_len);
|
|
|
|
if (!hmac)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
/* Length is denominated in bits, not bytes */
|
|
|
|
l_put_le16(size * 8, length_le);
|
|
|
|
|
|
|
|
/* KDF processes in 384-bit chunks (48 bytes) */
|
|
|
|
for (i = 0, counter = 1; i < (size + 47) / 48; i++, counter++) {
|
|
|
|
size_t len;
|
|
|
|
|
|
|
|
if (size - offset > 48)
|
|
|
|
len = 48;
|
|
|
|
else
|
|
|
|
len = size - offset;
|
|
|
|
|
|
|
|
l_put_le16(counter, counter_le);
|
|
|
|
|
|
|
|
l_checksum_updatev(hmac, iov, 4);
|
|
|
|
l_checksum_get_digest(hmac, output + offset, len);
|
2016-02-10 23:30:22 +01:00
|
|
|
|
|
|
|
offset += len;
|
|
|
|
}
|
|
|
|
|
|
|
|
l_checksum_free(hmac);
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
2016-08-22 22:54:24 +02:00
|
|
|
|
2018-09-01 00:37:54 +02:00
|
|
|
/*
|
|
|
|
* Defined in RFC 5869 - HMAC-based Extract-and-Expand Key Derivation Function
|
|
|
|
*
|
|
|
|
* Null key equates to a zero key (makes calls in EAP-PWD more convenient)
|
|
|
|
*/
|
2019-01-17 21:25:36 +01:00
|
|
|
bool hkdf_extract(enum l_checksum_type type, const uint8_t *key,
|
|
|
|
size_t key_len, uint8_t num_args,
|
|
|
|
uint8_t *out, ...)
|
2018-09-01 00:37:54 +02:00
|
|
|
{
|
|
|
|
struct l_checksum *hmac;
|
|
|
|
struct iovec iov[num_args];
|
2019-01-17 21:25:36 +01:00
|
|
|
const uint8_t zero_key[64] = { 0 };
|
|
|
|
size_t dlen = l_checksum_digest_length(type);
|
2018-09-01 00:37:54 +02:00
|
|
|
const uint8_t *k = key ? key : zero_key;
|
2019-01-17 21:25:36 +01:00
|
|
|
size_t k_len = key ? key_len : dlen;
|
2018-09-01 00:37:54 +02:00
|
|
|
va_list va;
|
|
|
|
int i;
|
|
|
|
int ret;
|
|
|
|
|
2019-01-17 21:25:36 +01:00
|
|
|
if (dlen <= 0)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
hmac = l_checksum_new_hmac(type, k, k_len);
|
2018-09-01 00:37:54 +02:00
|
|
|
if (!hmac)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
va_start(va, out);
|
|
|
|
|
|
|
|
for (i = 0; i < num_args; i++) {
|
|
|
|
iov[i].iov_base = va_arg(va, void *);
|
|
|
|
iov[i].iov_len = va_arg(va, size_t);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!l_checksum_updatev(hmac, iov, num_args)) {
|
|
|
|
va_end(va);
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2019-01-17 21:25:36 +01:00
|
|
|
ret = l_checksum_get_digest(hmac, out, dlen);
|
2018-09-01 00:37:54 +02:00
|
|
|
l_checksum_free(hmac);
|
|
|
|
|
|
|
|
va_end(va);
|
2019-01-17 21:25:36 +01:00
|
|
|
return (ret == (int) dlen);
|
2018-09-01 00:37:54 +02:00
|
|
|
}
|
|
|
|
|
2019-01-17 21:25:36 +01:00
|
|
|
bool hkdf_expand(enum l_checksum_type type, const uint8_t *key, size_t key_len,
|
|
|
|
const char *info, size_t info_len, void *out,
|
|
|
|
size_t out_len)
|
2018-11-16 23:22:51 +01:00
|
|
|
{
|
2019-01-22 07:16:43 +01:00
|
|
|
uint8_t *t = out;
|
2018-11-16 23:22:51 +01:00
|
|
|
size_t t_len = 0;
|
|
|
|
struct l_checksum *hmac;
|
|
|
|
uint8_t count = 1;
|
|
|
|
uint8_t *out_ptr = out;
|
2019-01-17 21:25:36 +01:00
|
|
|
|
2019-01-22 07:16:43 +01:00
|
|
|
hmac = l_checksum_new_hmac(type, key, key_len);
|
|
|
|
if (!hmac)
|
2019-01-17 21:25:36 +01:00
|
|
|
return false;
|
2018-11-16 23:22:51 +01:00
|
|
|
|
|
|
|
while (out_len > 0) {
|
|
|
|
ssize_t ret;
|
2019-01-22 07:16:43 +01:00
|
|
|
struct iovec iov[3];
|
2018-11-16 23:22:51 +01:00
|
|
|
|
|
|
|
iov[0].iov_base = t;
|
|
|
|
iov[0].iov_len = t_len;
|
|
|
|
iov[1].iov_base = (void *) info;
|
|
|
|
iov[1].iov_len = info_len;
|
|
|
|
iov[2].iov_base = &count;
|
|
|
|
iov[2].iov_len = 1;
|
|
|
|
|
|
|
|
if (!l_checksum_updatev(hmac, iov, 3)) {
|
|
|
|
l_checksum_free(hmac);
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2019-01-22 07:16:43 +01:00
|
|
|
ret = l_checksum_get_digest(hmac, out_ptr, out_len);
|
2018-11-16 23:22:51 +01:00
|
|
|
if (ret < 0) {
|
|
|
|
l_checksum_free(hmac);
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* RFC specifies that T(0) = empty string, so after the first
|
|
|
|
* iteration we update the length for T(1)...T(N)
|
|
|
|
*/
|
2019-01-22 07:16:43 +01:00
|
|
|
t_len = ret;
|
|
|
|
t = out_ptr;
|
2018-11-16 23:22:51 +01:00
|
|
|
count++;
|
|
|
|
|
2019-01-22 07:16:43 +01:00
|
|
|
out_len -= ret;
|
|
|
|
out_ptr += ret;
|
|
|
|
|
|
|
|
if (out_len)
|
|
|
|
l_checksum_reset(hmac);
|
2018-11-16 23:22:51 +01:00
|
|
|
}
|
|
|
|
|
2019-01-22 07:16:43 +01:00
|
|
|
l_checksum_free(hmac);
|
|
|
|
|
2018-11-16 23:22:51 +01:00
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2014-12-26 18:46:27 +01:00
|
|
|
/*
|
|
|
|
* 802.11, Section 11.6.6.7:
|
|
|
|
* PTK = PRF-X(PMK, "Pairwise key expansion", Min(AA, SA) || Max(AA, SA) ||
|
|
|
|
* Min(ANonce, SNonce) || Max(ANonce, SNonce))
|
2014-12-26 19:24:23 +01:00
|
|
|
*
|
|
|
|
* 802.11, Section 11.6.1.3:
|
|
|
|
* The PTK shall be derived from the PMK by
|
|
|
|
* PTK ← PRF-X(PMK, “Pairwise key expansion”, Min(AA,SPA) || Max(AA,SPA) ||
|
|
|
|
* Min(ANonce,SNonce) || Max(ANonce,SNonce))
|
|
|
|
* where X = 256 + TK_bits. The value of TK_bits is cipher-suite dependent and
|
|
|
|
* is defined in Table 11-4. The Min and Max operations for IEEE 802 addresses
|
|
|
|
* are with the address converted to a positive integer treating the first
|
|
|
|
* transmitted octet as the most significant octet of the integer. The Min and
|
|
|
|
* Max operations for nonces are with the nonces treated as positive integers
|
|
|
|
* converted as specified in 8.2.2.
|
2014-12-26 18:46:27 +01:00
|
|
|
*/
|
2016-02-10 23:54:55 +01:00
|
|
|
static bool crypto_derive_ptk(const uint8_t *pmk, size_t pmk_len,
|
|
|
|
const char *label,
|
|
|
|
const uint8_t *addr1, const uint8_t *addr2,
|
|
|
|
const uint8_t *nonce1, const uint8_t *nonce2,
|
|
|
|
uint8_t *out_ptk, size_t ptk_len,
|
2019-04-25 21:52:48 +02:00
|
|
|
enum l_checksum_type type)
|
2014-12-26 18:46:27 +01:00
|
|
|
{
|
|
|
|
/* Nonce length is 32 */
|
|
|
|
uint8_t data[ETH_ALEN * 2 + 64];
|
|
|
|
size_t pos = 0;
|
|
|
|
|
|
|
|
/* Address 1 is less than Address 2 */
|
|
|
|
if (memcmp(addr1, addr2, ETH_ALEN) < 0) {
|
|
|
|
memcpy(data, addr1, ETH_ALEN);
|
|
|
|
memcpy(data + ETH_ALEN, addr2, ETH_ALEN);
|
|
|
|
} else {
|
|
|
|
memcpy(data, addr2, ETH_ALEN);
|
|
|
|
memcpy(data + ETH_ALEN, addr1, ETH_ALEN);
|
|
|
|
}
|
|
|
|
|
|
|
|
pos += ETH_ALEN * 2;
|
|
|
|
|
|
|
|
/* Nonce1 is less than Nonce2 */
|
|
|
|
if (memcmp(nonce1, nonce2, 32) < 0) {
|
|
|
|
memcpy(data + pos, nonce1, 32);
|
|
|
|
memcpy(data + pos + 32, nonce2, 32);
|
|
|
|
} else {
|
|
|
|
memcpy(data + pos, nonce2, 32);
|
|
|
|
memcpy(data + pos + 32, nonce1, 32);
|
|
|
|
}
|
|
|
|
|
|
|
|
pos += 64;
|
2019-04-25 21:52:48 +02:00
|
|
|
if (type == L_CHECKSUM_SHA384)
|
|
|
|
return kdf_sha384(pmk, pmk_len, label, strlen(label),
|
|
|
|
data, sizeof(data), out_ptk, ptk_len);
|
|
|
|
else if (type == L_CHECKSUM_SHA256)
|
2016-02-10 23:54:55 +01:00
|
|
|
return kdf_sha256(pmk, pmk_len, label, strlen(label),
|
|
|
|
data, sizeof(data), out_ptk, ptk_len);
|
|
|
|
else
|
|
|
|
return prf_sha1(pmk, pmk_len, label, strlen(label),
|
|
|
|
data, sizeof(data), out_ptk, ptk_len);
|
2014-12-26 18:46:27 +01:00
|
|
|
}
|
2014-12-26 21:14:02 +01:00
|
|
|
|
2019-01-17 21:25:31 +01:00
|
|
|
bool crypto_derive_pairwise_ptk(const uint8_t *pmk, size_t pmk_len,
|
2014-12-26 21:14:02 +01:00
|
|
|
const uint8_t *addr1, const uint8_t *addr2,
|
|
|
|
const uint8_t *nonce1, const uint8_t *nonce2,
|
2019-01-17 21:25:30 +01:00
|
|
|
uint8_t *out_ptk, size_t ptk_len,
|
2019-04-25 21:52:48 +02:00
|
|
|
enum l_checksum_type type)
|
2014-12-26 21:14:02 +01:00
|
|
|
{
|
2019-01-17 21:25:31 +01:00
|
|
|
return crypto_derive_ptk(pmk, pmk_len, "Pairwise key expansion",
|
2014-12-26 21:14:02 +01:00
|
|
|
addr1, addr2, nonce1, nonce2,
|
2019-01-17 21:25:30 +01:00
|
|
|
out_ptk, ptk_len,
|
2019-04-25 21:52:48 +02:00
|
|
|
type);
|
2014-12-26 21:14:02 +01:00
|
|
|
}
|
2016-09-06 23:43:39 +02:00
|
|
|
|
|
|
|
/* Defined in 802.11-2012, Section 11.6.1.7.3 PMK-R0 */
|
2019-05-10 22:19:25 +02:00
|
|
|
bool crypto_derive_pmk_r0(const uint8_t *xxkey, size_t xxkey_len,
|
2016-09-06 23:43:39 +02:00
|
|
|
const uint8_t *ssid, size_t ssid_len,
|
|
|
|
uint16_t mdid,
|
|
|
|
const uint8_t *r0khid, size_t r0kh_len,
|
2019-05-10 22:19:28 +02:00
|
|
|
const uint8_t *s0khid, bool sha384,
|
|
|
|
uint8_t *out_pmk_r0, uint8_t *out_pmk_r0_name)
|
2016-09-06 23:43:39 +02:00
|
|
|
{
|
|
|
|
uint8_t context[512];
|
|
|
|
size_t pos = 0;
|
2019-05-10 22:19:28 +02:00
|
|
|
uint8_t output[64];
|
|
|
|
size_t offset = sha384 ? 48 : 32;
|
|
|
|
struct l_checksum *sha;
|
2016-09-06 23:43:39 +02:00
|
|
|
bool r = false;
|
|
|
|
struct iovec iov[2] = {
|
|
|
|
[0] = { .iov_base = "FT-R0N", .iov_len = 6 },
|
2019-05-10 22:19:28 +02:00
|
|
|
[1] = { .iov_base = output + offset, .iov_len = 16 },
|
2016-09-06 23:43:39 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
context[pos++] = ssid_len;
|
|
|
|
|
|
|
|
memcpy(context + pos, ssid, ssid_len);
|
|
|
|
pos += ssid_len;
|
|
|
|
|
|
|
|
l_put_le16(mdid, context + pos);
|
|
|
|
pos += 2;
|
|
|
|
|
|
|
|
context[pos++] = r0kh_len;
|
|
|
|
|
|
|
|
memcpy(context + pos, r0khid, r0kh_len);
|
|
|
|
pos += r0kh_len;
|
|
|
|
|
|
|
|
memcpy(context + pos, s0khid, ETH_ALEN);
|
|
|
|
pos += ETH_ALEN;
|
|
|
|
|
2019-05-10 22:19:28 +02:00
|
|
|
if (sha384) {
|
|
|
|
if (!kdf_sha384(xxkey, xxkey_len, "FT-R0", 5, context, pos,
|
|
|
|
output, 64))
|
|
|
|
goto exit;
|
|
|
|
} else {
|
|
|
|
if (!kdf_sha256(xxkey, xxkey_len, "FT-R0", 5, context, pos,
|
|
|
|
output, 48))
|
|
|
|
goto exit;
|
|
|
|
}
|
2016-09-06 23:43:39 +02:00
|
|
|
|
2019-05-10 22:19:28 +02:00
|
|
|
sha = l_checksum_new((sha384) ? L_CHECKSUM_SHA384 : L_CHECKSUM_SHA256);
|
|
|
|
if (!sha)
|
2016-09-06 23:43:39 +02:00
|
|
|
goto exit;
|
|
|
|
|
2019-05-10 22:19:28 +02:00
|
|
|
l_checksum_updatev(sha, iov, 2);
|
|
|
|
l_checksum_get_digest(sha, out_pmk_r0_name, 16);
|
2016-09-06 23:43:39 +02:00
|
|
|
|
2019-05-10 22:19:28 +02:00
|
|
|
l_checksum_free(sha);
|
2016-09-06 23:43:39 +02:00
|
|
|
|
2019-05-10 22:19:28 +02:00
|
|
|
memcpy(out_pmk_r0, output, offset);
|
2016-09-06 23:43:39 +02:00
|
|
|
|
|
|
|
r = true;
|
|
|
|
|
|
|
|
exit:
|
2019-03-22 00:56:53 +01:00
|
|
|
explicit_bzero(context, pos);
|
2019-05-10 22:19:28 +02:00
|
|
|
explicit_bzero(output, 64);
|
2016-09-06 23:43:39 +02:00
|
|
|
|
|
|
|
return r;
|
|
|
|
}
|
2016-09-06 23:43:40 +02:00
|
|
|
|
|
|
|
/* Defined in 802.11-2012, Section 11.6.1.7.4 PMK-R1 */
|
|
|
|
bool crypto_derive_pmk_r1(const uint8_t *pmk_r0,
|
|
|
|
const uint8_t *r1khid, const uint8_t *s1khid,
|
2019-05-10 22:19:28 +02:00
|
|
|
const uint8_t *pmk_r0_name, bool sha384,
|
2016-09-06 23:43:40 +02:00
|
|
|
uint8_t *out_pmk_r1,
|
|
|
|
uint8_t *out_pmk_r1_name)
|
|
|
|
{
|
|
|
|
uint8_t context[2 * ETH_ALEN];
|
2019-05-10 22:19:28 +02:00
|
|
|
struct l_checksum *sha;
|
2016-09-06 23:43:40 +02:00
|
|
|
bool r = false;
|
|
|
|
struct iovec iov[3] = {
|
|
|
|
[0] = { .iov_base = "FT-R1N", .iov_len = 6 },
|
|
|
|
[1] = { .iov_base = (uint8_t *) pmk_r0_name, .iov_len = 16 },
|
|
|
|
[2] = { .iov_base = context, .iov_len = sizeof(context) },
|
|
|
|
};
|
|
|
|
|
|
|
|
memcpy(context, r1khid, ETH_ALEN);
|
|
|
|
|
|
|
|
memcpy(context + ETH_ALEN, s1khid, ETH_ALEN);
|
|
|
|
|
2019-05-10 22:19:28 +02:00
|
|
|
if (sha384) {
|
|
|
|
if (!kdf_sha384(pmk_r0, 48, "FT-R1", 5, context,
|
|
|
|
sizeof(context), out_pmk_r1, 48))
|
|
|
|
goto exit;
|
|
|
|
} else {
|
|
|
|
if (!kdf_sha256(pmk_r0, 32, "FT-R1", 5, context,
|
|
|
|
sizeof(context), out_pmk_r1, 32))
|
|
|
|
goto exit;
|
|
|
|
}
|
2016-09-06 23:43:40 +02:00
|
|
|
|
2019-05-10 22:19:28 +02:00
|
|
|
sha = l_checksum_new((sha384) ? L_CHECKSUM_SHA384 : L_CHECKSUM_SHA256);
|
|
|
|
if (!sha) {
|
|
|
|
explicit_bzero(out_pmk_r1, 48);
|
2016-09-06 23:43:40 +02:00
|
|
|
goto exit;
|
|
|
|
}
|
|
|
|
|
2019-05-10 22:19:28 +02:00
|
|
|
l_checksum_updatev(sha, iov, 3);
|
|
|
|
l_checksum_get_digest(sha, out_pmk_r1_name, 16);
|
2016-09-06 23:43:40 +02:00
|
|
|
|
2019-05-10 22:19:28 +02:00
|
|
|
l_checksum_free(sha);
|
2016-09-06 23:43:40 +02:00
|
|
|
|
|
|
|
r = true;
|
|
|
|
|
|
|
|
exit:
|
2019-03-22 00:56:53 +01:00
|
|
|
explicit_bzero(context, sizeof(context));
|
2016-09-06 23:43:40 +02:00
|
|
|
|
|
|
|
return r;
|
|
|
|
}
|
2016-09-06 23:43:41 +02:00
|
|
|
|
|
|
|
/* Defined in 802.11-2012, Section 11.6.1.7.5 PTK */
|
|
|
|
bool crypto_derive_ft_ptk(const uint8_t *pmk_r1, const uint8_t *pmk_r1_name,
|
|
|
|
const uint8_t *addr1, const uint8_t *addr2,
|
|
|
|
const uint8_t *nonce1, const uint8_t *nonce2,
|
2019-05-10 22:19:28 +02:00
|
|
|
bool sha384, uint8_t *out_ptk, size_t ptk_len,
|
2016-09-06 23:43:41 +02:00
|
|
|
uint8_t *out_ptk_name)
|
|
|
|
{
|
|
|
|
uint8_t context[ETH_ALEN * 2 + 64];
|
2019-05-10 22:19:28 +02:00
|
|
|
struct l_checksum *sha;
|
2016-09-06 23:43:41 +02:00
|
|
|
bool r = false;
|
|
|
|
struct iovec iov[3] = {
|
|
|
|
[0] = { .iov_base = (uint8_t *) pmk_r1_name, .iov_len = 16 },
|
|
|
|
[1] = { .iov_base = "FT-PTKN", .iov_len = 7 },
|
|
|
|
[2] = { .iov_base = context, .iov_len = sizeof(context) },
|
|
|
|
};
|
|
|
|
|
|
|
|
memcpy(context, nonce1, 32);
|
|
|
|
|
|
|
|
memcpy(context + 32, nonce2, 32);
|
|
|
|
|
|
|
|
memcpy(context + 64, addr1, ETH_ALEN);
|
|
|
|
|
|
|
|
memcpy(context + 64 + ETH_ALEN, addr2, ETH_ALEN);
|
|
|
|
|
2019-05-10 22:19:28 +02:00
|
|
|
if (sha384) {
|
|
|
|
if (!kdf_sha384(pmk_r1, 48, "FT-PTK", 6, context,
|
|
|
|
sizeof(context), out_ptk, ptk_len))
|
|
|
|
goto exit;
|
|
|
|
} else {
|
|
|
|
if (!kdf_sha256(pmk_r1, 32, "FT-PTK", 6, context,
|
|
|
|
sizeof(context), out_ptk, ptk_len))
|
|
|
|
goto exit;
|
|
|
|
}
|
2016-09-06 23:43:41 +02:00
|
|
|
|
2019-05-10 22:19:28 +02:00
|
|
|
sha = l_checksum_new((sha384) ? L_CHECKSUM_SHA384 : L_CHECKSUM_SHA256);
|
|
|
|
if (!sha) {
|
2019-03-22 00:56:53 +01:00
|
|
|
explicit_bzero(out_ptk, ptk_len);
|
2016-09-06 23:43:41 +02:00
|
|
|
goto exit;
|
|
|
|
}
|
|
|
|
|
2019-05-10 22:19:28 +02:00
|
|
|
l_checksum_updatev(sha, iov, 3);
|
|
|
|
l_checksum_get_digest(sha, out_ptk_name, 16);
|
2016-09-06 23:43:41 +02:00
|
|
|
|
2019-05-10 22:19:28 +02:00
|
|
|
l_checksum_free(sha);
|
2016-09-06 23:43:41 +02:00
|
|
|
|
|
|
|
r = true;
|
|
|
|
|
|
|
|
exit:
|
2019-03-22 00:56:53 +01:00
|
|
|
explicit_bzero(context, sizeof(context));
|
2016-09-06 23:43:41 +02:00
|
|
|
|
|
|
|
return r;
|
|
|
|
}
|
2017-04-15 13:58:44 +02:00
|
|
|
|
|
|
|
/* Defined in 802.11-2012, Section 11.6.1.3 Pairwise Key Hierarchy */
|
|
|
|
bool crypto_derive_pmkid(const uint8_t *pmk,
|
|
|
|
const uint8_t *addr1, const uint8_t *addr2,
|
|
|
|
uint8_t *out_pmkid, bool use_sha256)
|
|
|
|
{
|
|
|
|
uint8_t data[20];
|
|
|
|
|
|
|
|
memcpy(data + 0, "PMK Name", 8);
|
|
|
|
memcpy(data + 8, addr2, 6);
|
|
|
|
memcpy(data + 14, addr1, 6);
|
|
|
|
|
|
|
|
if (use_sha256)
|
|
|
|
return hmac_sha256(pmk, 32, data, 20, out_pmkid, 16);
|
|
|
|
else
|
|
|
|
return hmac_sha1(pmk, 32, data, 20, out_pmkid, 16);
|
|
|
|
}
|