18d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/* 28d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * EAP server/peer: EAP-SAKE shared routines 38d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Copyright (c) 2006-2007, Jouni Malinen <j@w1.fi> 48d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 5c5ec7f57ead87efa365800228aa0b09a12d9e6c4Dmitry Shmidt * This software may be distributed under the terms of the BSD license. 6c5ec7f57ead87efa365800228aa0b09a12d9e6c4Dmitry Shmidt * See README for more details. 78d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 88d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 98d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "includes.h" 108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "common.h" 128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "wpabuf.h" 138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "crypto/sha1.h" 148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "eap_defs.h" 158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "eap_sake_common.h" 168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int eap_sake_parse_add_attr(struct eap_sake_parse_attr *attr, 198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *pos) 208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t i; 228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt switch (pos[0]) { 248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case EAP_SAKE_AT_RAND_S: 258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Parse: AT_RAND_S"); 268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos[1] != 2 + EAP_SAKE_RAND_LEN) { 278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: AT_RAND_S with " 288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "invalid length %d", pos[1]); 298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->rand_s = pos + 2; 328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case EAP_SAKE_AT_RAND_P: 348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Parse: AT_RAND_P"); 358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos[1] != 2 + EAP_SAKE_RAND_LEN) { 368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: AT_RAND_P with " 378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "invalid length %d", pos[1]); 388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->rand_p = pos + 2; 418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case EAP_SAKE_AT_MIC_S: 438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Parse: AT_MIC_S"); 448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos[1] != 2 + EAP_SAKE_MIC_LEN) { 458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: AT_MIC_S with " 468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "invalid length %d", pos[1]); 478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->mic_s = pos + 2; 508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case EAP_SAKE_AT_MIC_P: 528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Parse: AT_MIC_P"); 538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos[1] != 2 + EAP_SAKE_MIC_LEN) { 548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: AT_MIC_P with " 558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "invalid length %d", pos[1]); 568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->mic_p = pos + 2; 598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case EAP_SAKE_AT_SERVERID: 618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Parse: AT_SERVERID"); 628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->serverid = pos + 2; 638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->serverid_len = pos[1] - 2; 648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case EAP_SAKE_AT_PEERID: 668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Parse: AT_PEERID"); 678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->peerid = pos + 2; 688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->peerid_len = pos[1] - 2; 698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case EAP_SAKE_AT_SPI_S: 718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Parse: AT_SPI_S"); 728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->spi_s = pos + 2; 738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->spi_s_len = pos[1] - 2; 748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case EAP_SAKE_AT_SPI_P: 768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Parse: AT_SPI_P"); 778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->spi_p = pos + 2; 788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->spi_p_len = pos[1] - 2; 798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case EAP_SAKE_AT_ANY_ID_REQ: 818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Parse: AT_ANY_ID_REQ"); 828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos[1] != 4) { 838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Invalid AT_ANY_ID_REQ" 848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt " length %d", pos[1]); 858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->any_id_req = pos + 2; 888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case EAP_SAKE_AT_PERM_ID_REQ: 908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Parse: AT_PERM_ID_REQ"); 918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos[1] != 4) { 928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Invalid " 938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "AT_PERM_ID_REQ length %d", pos[1]); 948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->perm_id_req = pos + 2; 978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case EAP_SAKE_AT_ENCR_DATA: 998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Parse: AT_ENCR_DATA"); 1008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->encr_data = pos + 2; 1018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->encr_data_len = pos[1] - 2; 1028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 1038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case EAP_SAKE_AT_IV: 1048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Parse: AT_IV"); 1058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->iv = pos + 2; 1068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->iv_len = pos[1] - 2; 1078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 1088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case EAP_SAKE_AT_PADDING: 1098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Parse: AT_PADDING"); 1108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt for (i = 2; i < pos[1]; i++) { 1118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos[i]) { 1128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: AT_PADDING " 1138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "with non-zero pad byte"); 1148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 1158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 1188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case EAP_SAKE_AT_NEXT_TMPID: 1198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Parse: AT_NEXT_TMPID"); 1208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->next_tmpid = pos + 2; 1218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->next_tmpid_len = pos[1] - 2; 1228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 1238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case EAP_SAKE_AT_MSK_LIFE: 1248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Parse: AT_IV"); 1258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos[1] != 6) { 1268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Invalid " 1278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "AT_MSK_LIFE length %d", pos[1]); 1288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 1298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt attr->msk_life = pos + 2; 1318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 1328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt default: 1338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos[0] < 128) { 1348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Unknown non-skippable" 1358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt " attribute %d", pos[0]); 1368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 1378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Ignoring unknown skippable " 1398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "attribute %d", pos[0]); 1408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 1418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (attr->iv && !attr->encr_data) { 1448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: AT_IV included without " 1458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "AT_ENCR_DATA"); 1468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 1478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 1508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 1518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/** 1548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * eap_sake_parse_attributes - Parse EAP-SAKE attributes 1558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @buf: Packet payload (starting with the first attribute) 1568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @len: Payload length 1578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @attr: Structure to be filled with found attributes 1588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Returns: 0 on success or -1 on failure 1598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 1608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtint eap_sake_parse_attributes(const u8 *buf, size_t len, 1618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_sake_parse_attr *attr) 1628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 1638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *pos = buf, *end = buf + len; 1648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memset(attr, 0, sizeof(*attr)); 1668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt while (pos < end) { 1678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (end - pos < 2) { 1688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Too short attribute"); 1698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 1708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos[1] < 2) { 1738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Invalid attribute " 1748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "length (%d)", pos[1]); 1758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 1768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos + pos[1] > end) { 1798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Attribute underflow"); 1808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 1818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (eap_sake_parse_add_attr(attr, pos)) 1848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 1858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += pos[1]; 1878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 1908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 1918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/** 1948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * eap_sake_kdf - EAP-SAKE Key Derivation Function (KDF) 1958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @key: Key for KDF 1968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @key_len: Length of the key in bytes 1978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @label: A unique label for each purpose of the KDF 1988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @data: Extra data (start) to bind into the key 1998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @data_len: Length of the data 2008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @data2: Extra data (end) to bind into the key 2018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @data2_len: Length of the data2 2028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @buf: Buffer for the generated pseudo-random key 2038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @buf_len: Number of bytes of key to generate 2048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 2058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * This function is used to derive new, cryptographically separate keys from a 2068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * given key (e.g., SMS). This is identical to the PRF used in IEEE 802.11i. 2078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 2088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void eap_sake_kdf(const u8 *key, size_t key_len, const char *label, 2098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *data, size_t data_len, 2108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *data2, size_t data2_len, 2118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *buf, size_t buf_len) 2128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 counter = 0; 2148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t pos, plen; 2158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 hash[SHA1_MAC_LEN]; 2168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t label_len = os_strlen(label) + 1; 2178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const unsigned char *addr[4]; 2188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t len[4]; 2198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt addr[0] = (u8 *) label; /* Label | Y */ 2218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt len[0] = label_len; 2228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt addr[1] = data; /* Msg[start] */ 2238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt len[1] = data_len; 2248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt addr[2] = data2; /* Msg[end] */ 2258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt len[2] = data2_len; 2268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt addr[3] = &counter; /* Length */ 2278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt len[3] = 1; 2288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = 0; 2308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt while (pos < buf_len) { 2318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt plen = buf_len - pos; 2328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (plen >= SHA1_MAC_LEN) { 2338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hmac_sha1_vector(key, key_len, 4, addr, len, 2348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt &buf[pos]); 2358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += SHA1_MAC_LEN; 2368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else { 2378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hmac_sha1_vector(key, key_len, 4, addr, len, 2388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hash); 2398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(&buf[pos], hash, plen); 2408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 2418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt counter++; 2438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/** 2488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * eap_sake_derive_keys - Derive EAP-SAKE keys 2498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @root_secret_a: 16-byte Root-Secret-A 2508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @root_secret_b: 16-byte Root-Secret-B 2518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @rand_s: 16-byte RAND_S 2528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @rand_p: 16-byte RAND_P 2538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @tek: Buffer for Temporary EAK Keys (TEK-Auth[16] | TEK-Cipher[16]) 2548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @msk: Buffer for 64-byte MSK 2558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @emsk: Buffer for 64-byte EMSK 2568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 2578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * This function derives EAP-SAKE keys as defined in RFC 4763, section 3.2.6. 2588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 2598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtvoid eap_sake_derive_keys(const u8 *root_secret_a, const u8 *root_secret_b, 2608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *rand_s, const u8 *rand_p, u8 *tek, u8 *msk, 2618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *emsk) 2628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 sms_a[EAP_SAKE_SMS_LEN]; 2648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 sms_b[EAP_SAKE_SMS_LEN]; 2658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 key_buf[EAP_MSK_LEN + EAP_EMSK_LEN]; 2668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-SAKE: Deriving keys"); 2688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_key(MSG_DEBUG, "EAP-SAKE: Root-Secret-A", 2708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt root_secret_a, EAP_SAKE_ROOT_SECRET_LEN); 2718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_sake_kdf(root_secret_a, EAP_SAKE_ROOT_SECRET_LEN, 2728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "SAKE Master Secret A", 2738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt rand_p, EAP_SAKE_RAND_LEN, rand_s, EAP_SAKE_RAND_LEN, 2748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt sms_a, EAP_SAKE_SMS_LEN); 2758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_key(MSG_DEBUG, "EAP-SAKE: SMS-A", sms_a, EAP_SAKE_SMS_LEN); 2768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_sake_kdf(sms_a, EAP_SAKE_SMS_LEN, "Transient EAP Key", 2778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt rand_s, EAP_SAKE_RAND_LEN, rand_p, EAP_SAKE_RAND_LEN, 2788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tek, EAP_SAKE_TEK_LEN); 2798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_key(MSG_DEBUG, "EAP-SAKE: TEK-Auth", 2808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tek, EAP_SAKE_TEK_AUTH_LEN); 2818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_key(MSG_DEBUG, "EAP-SAKE: TEK-Cipher", 2828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tek + EAP_SAKE_TEK_AUTH_LEN, EAP_SAKE_TEK_CIPHER_LEN); 2838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_key(MSG_DEBUG, "EAP-SAKE: Root-Secret-B", 2858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt root_secret_b, EAP_SAKE_ROOT_SECRET_LEN); 2868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_sake_kdf(root_secret_b, EAP_SAKE_ROOT_SECRET_LEN, 2878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "SAKE Master Secret B", 2888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt rand_p, EAP_SAKE_RAND_LEN, rand_s, EAP_SAKE_RAND_LEN, 2898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt sms_b, EAP_SAKE_SMS_LEN); 2908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_key(MSG_DEBUG, "EAP-SAKE: SMS-B", sms_b, EAP_SAKE_SMS_LEN); 2918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_sake_kdf(sms_b, EAP_SAKE_SMS_LEN, "Master Session Key", 2928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt rand_s, EAP_SAKE_RAND_LEN, rand_p, EAP_SAKE_RAND_LEN, 2938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key_buf, sizeof(key_buf)); 2948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(msk, key_buf, EAP_MSK_LEN); 2958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(emsk, key_buf + EAP_MSK_LEN, EAP_EMSK_LEN); 2968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_key(MSG_DEBUG, "EAP-SAKE: MSK", msk, EAP_MSK_LEN); 2978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_key(MSG_DEBUG, "EAP-SAKE: EMSK", emsk, EAP_EMSK_LEN); 2988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/** 3028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * eap_sake_compute_mic - Compute EAP-SAKE MIC for an EAP packet 3038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @tek_auth: 16-byte TEK-Auth 3048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @rand_s: 16-byte RAND_S 3058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @rand_p: 16-byte RAND_P 3068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @serverid: SERVERID 3078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @serverid_len: SERVERID length 3088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @peerid: PEERID 3098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @peerid_len: PEERID length 3108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @peer: MIC calculation for 0 = Server, 1 = Peer message 3118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @eap: EAP packet 3128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @eap_len: EAP packet length 3138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @mic_pos: MIC position in the EAP packet (must be [eap .. eap + eap_len]) 3148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @mic: Buffer for the computed 16-byte MIC 3158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 3168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtint eap_sake_compute_mic(const u8 *tek_auth, 3178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *rand_s, const u8 *rand_p, 3188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *serverid, size_t serverid_len, 3198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *peerid, size_t peerid_len, 3208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int peer, const u8 *eap, size_t eap_len, 3218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *mic_pos, u8 *mic) 3228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 3238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 _rand[2 * EAP_SAKE_RAND_LEN]; 3248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *tmp, *pos; 3258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t tmplen; 3268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tmplen = serverid_len + 1 + peerid_len + 1 + eap_len; 3288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tmp = os_malloc(tmplen); 3298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tmp == NULL) 3308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 3318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = tmp; 3328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (peer) { 3338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (peerid) { 3348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(pos, peerid, peerid_len); 3358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += peerid_len; 3368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = 0x00; 3388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (serverid) { 3398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(pos, serverid, serverid_len); 3408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += serverid_len; 3418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = 0x00; 3438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(_rand, rand_s, EAP_SAKE_RAND_LEN); 3458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(_rand + EAP_SAKE_RAND_LEN, rand_p, 3468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt EAP_SAKE_RAND_LEN); 3478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else { 3488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (serverid) { 3498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(pos, serverid, serverid_len); 3508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += serverid_len; 3518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = 0x00; 3538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (peerid) { 3548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(pos, peerid, peerid_len); 3558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += peerid_len; 3568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = 0x00; 3588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(_rand, rand_p, EAP_SAKE_RAND_LEN); 3608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(_rand + EAP_SAKE_RAND_LEN, rand_s, 3618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt EAP_SAKE_RAND_LEN); 3628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(pos, eap, eap_len); 3658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memset(pos + (mic_pos - eap), 0, EAP_SAKE_MIC_LEN); 3668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_sake_kdf(tek_auth, EAP_SAKE_TEK_AUTH_LEN, 3688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt peer ? "Peer MIC" : "Server MIC", 3698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt _rand, 2 * EAP_SAKE_RAND_LEN, tmp, tmplen, 3708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt mic, EAP_SAKE_MIC_LEN); 3718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(tmp); 3738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 3758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 3768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtvoid eap_sake_add_attr(struct wpabuf *buf, u8 type, const u8 *data, 3798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t len) 3808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 3818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_u8(buf, type); 3828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_u8(buf, 2 + len); /* Length; including attr header */ 3838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data) 3848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_data(buf, data, len); 3858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt else 3868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memset(wpabuf_put(buf, len), 0, len); 3878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 388