1 /* 2 * EAP server/peer: EAP-GPSK shared routines 3 * Copyright (c) 2006-2007, Jouni Malinen <j@w1.fi> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Alternatively, this software may be distributed under the terms of BSD 10 * license. 11 * 12 * See README and COPYING for more details. 13 */ 14 15 #include "includes.h" 16 17 #include "common.h" 18 #include "eap_defs.h" 19 #include "aes_wrap.h" 20 #include "crypto.h" 21 #ifdef EAP_GPSK_SHA256 22 #include "sha256.h" 23 #endif /* EAP_GPSK_SHA256 */ 24 #include "eap_gpsk_common.h" 25 26 27 /** 28 * eap_gpsk_supported_ciphersuite - Check whether ciphersuite is supported 29 * @vendor: CSuite/Vendor 30 * @specifier: CSuite/Specifier 31 * Returns: 1 if ciphersuite is support, or 0 if not 32 */ 33 int eap_gpsk_supported_ciphersuite(int vendor, int specifier) 34 { 35 if (vendor == EAP_GPSK_VENDOR_IETF && 36 specifier == EAP_GPSK_CIPHER_AES) 37 return 1; 38 #ifdef EAP_GPSK_SHA256 39 if (vendor == EAP_GPSK_VENDOR_IETF && 40 specifier == EAP_GPSK_CIPHER_SHA256) 41 return 1; 42 #endif /* EAP_GPSK_SHA256 */ 43 return 0; 44 } 45 46 47 static int eap_gpsk_gkdf_cmac(const u8 *psk /* Y */, 48 const u8 *data /* Z */, size_t data_len, 49 u8 *buf, size_t len /* X */) 50 { 51 u8 *opos; 52 size_t i, n, hashlen, left, clen; 53 u8 ibuf[2], hash[16]; 54 const u8 *addr[2]; 55 size_t vlen[2]; 56 57 hashlen = sizeof(hash); 58 /* M_i = MAC_Y (i || Z); (MAC = AES-CMAC-128) */ 59 addr[0] = ibuf; 60 vlen[0] = sizeof(ibuf); 61 addr[1] = data; 62 vlen[1] = data_len; 63 64 opos = buf; 65 left = len; 66 n = (len + hashlen - 1) / hashlen; 67 for (i = 1; i <= n; i++) { 68 WPA_PUT_BE16(ibuf, i); 69 if (omac1_aes_128_vector(psk, 2, addr, vlen, hash)) 70 return -1; 71 clen = left > hashlen ? hashlen : left; 72 os_memcpy(opos, hash, clen); 73 opos += clen; 74 left -= clen; 75 } 76 77 return 0; 78 } 79 80 81 #ifdef EAP_GPSK_SHA256 82 static int eap_gpsk_gkdf_sha256(const u8 *psk /* Y */, 83 const u8 *data /* Z */, size_t data_len, 84 u8 *buf, size_t len /* X */) 85 { 86 u8 *opos; 87 size_t i, n, hashlen, left, clen; 88 u8 ibuf[2], hash[SHA256_MAC_LEN]; 89 const u8 *addr[2]; 90 size_t vlen[2]; 91 92 hashlen = SHA256_MAC_LEN; 93 /* M_i = MAC_Y (i || Z); (MAC = HMAC-SHA256) */ 94 addr[0] = ibuf; 95 vlen[0] = sizeof(ibuf); 96 addr[1] = data; 97 vlen[1] = data_len; 98 99 opos = buf; 100 left = len; 101 n = (len + hashlen - 1) / hashlen; 102 for (i = 1; i <= n; i++) { 103 WPA_PUT_BE16(ibuf, i); 104 hmac_sha256_vector(psk, 32, 2, addr, vlen, hash); 105 clen = left > hashlen ? hashlen : left; 106 os_memcpy(opos, hash, clen); 107 opos += clen; 108 left -= clen; 109 } 110 111 return 0; 112 } 113 #endif /* EAP_GPSK_SHA256 */ 114 115 116 static int eap_gpsk_derive_keys_helper(u32 csuite_specifier, 117 u8 *kdf_out, size_t kdf_out_len, 118 const u8 *psk, size_t psk_len, 119 const u8 *seed, size_t seed_len, 120 u8 *msk, u8 *emsk, 121 u8 *sk, size_t sk_len, 122 u8 *pk, size_t pk_len) 123 { 124 u8 mk[32], *pos, *data; 125 size_t data_len, mk_len; 126 int (*gkdf)(const u8 *_psk, const u8 *_data, size_t _data_len, 127 u8 *buf, size_t len); 128 129 gkdf = NULL; 130 switch (csuite_specifier) { 131 case EAP_GPSK_CIPHER_AES: 132 gkdf = eap_gpsk_gkdf_cmac; 133 mk_len = 16; 134 break; 135 #ifdef EAP_GPSK_SHA256 136 case EAP_GPSK_CIPHER_SHA256: 137 gkdf = eap_gpsk_gkdf_sha256; 138 mk_len = SHA256_MAC_LEN; 139 break; 140 #endif /* EAP_GPSK_SHA256 */ 141 default: 142 return -1; 143 } 144 145 if (psk_len < mk_len) 146 return -1; 147 148 data_len = 2 + psk_len + 6 + seed_len; 149 data = os_malloc(data_len); 150 if (data == NULL) 151 return -1; 152 pos = data; 153 WPA_PUT_BE16(pos, psk_len); 154 pos += 2; 155 os_memcpy(pos, psk, psk_len); 156 pos += psk_len; 157 WPA_PUT_BE32(pos, EAP_GPSK_VENDOR_IETF); /* CSuite/Vendor = IETF */ 158 pos += 4; 159 WPA_PUT_BE16(pos, csuite_specifier); /* CSuite/Specifier */ 160 pos += 2; 161 os_memcpy(pos, seed, seed_len); /* inputString */ 162 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: Data to MK derivation", 163 data, data_len); 164 165 if (gkdf(psk, data, data_len, mk, mk_len) < 0) { 166 os_free(data); 167 return -1; 168 } 169 os_free(data); 170 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: MK", mk, mk_len); 171 172 if (gkdf(mk, seed, seed_len, kdf_out, kdf_out_len) < 0) 173 return -1; 174 175 pos = kdf_out; 176 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: MSK", pos, EAP_MSK_LEN); 177 os_memcpy(msk, pos, EAP_MSK_LEN); 178 pos += EAP_MSK_LEN; 179 180 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: EMSK", pos, EAP_EMSK_LEN); 181 os_memcpy(emsk, pos, EAP_EMSK_LEN); 182 pos += EAP_EMSK_LEN; 183 184 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: SK", pos, sk_len); 185 os_memcpy(sk, pos, sk_len); 186 pos += sk_len; 187 188 if (pk) { 189 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: PK", pos, pk_len); 190 os_memcpy(pk, pos, pk_len); 191 } 192 193 return 0; 194 } 195 196 197 static int eap_gpsk_derive_keys_aes(const u8 *psk, size_t psk_len, 198 const u8 *seed, size_t seed_len, 199 u8 *msk, u8 *emsk, u8 *sk, size_t *sk_len, 200 u8 *pk, size_t *pk_len) 201 { 202 #define EAP_GPSK_SK_LEN_AES 16 203 #define EAP_GPSK_PK_LEN_AES 16 204 u8 kdf_out[EAP_MSK_LEN + EAP_EMSK_LEN + EAP_GPSK_SK_LEN_AES + 205 EAP_GPSK_PK_LEN_AES]; 206 207 /* 208 * inputString = RAND_Peer || ID_Peer || RAND_Server || ID_Server 209 * (= seed) 210 * KS = 16, PL = psk_len, CSuite_Sel = 0x00000000 0x0001 211 * MK = GKDF-16 (PSK[0..15], PL || PSK || CSuite_Sel || inputString) 212 * MSK = GKDF-160 (MK, inputString)[0..63] 213 * EMSK = GKDF-160 (MK, inputString)[64..127] 214 * SK = GKDF-160 (MK, inputString)[128..143] 215 * PK = GKDF-160 (MK, inputString)[144..159] 216 * zero = 0x00 || 0x00 || ... || 0x00 (16 times) 217 * Method-ID = GKDF-16 (zero, "Method ID" || EAP_Method_Type || 218 * CSuite_Sel || inputString) 219 */ 220 221 *sk_len = EAP_GPSK_SK_LEN_AES; 222 *pk_len = EAP_GPSK_PK_LEN_AES; 223 224 return eap_gpsk_derive_keys_helper(EAP_GPSK_CIPHER_AES, 225 kdf_out, sizeof(kdf_out), 226 psk, psk_len, seed, seed_len, 227 msk, emsk, sk, *sk_len, 228 pk, *pk_len); 229 } 230 231 232 #ifdef EAP_GPSK_SHA256 233 static int eap_gpsk_derive_keys_sha256(const u8 *psk, size_t psk_len, 234 const u8 *seed, size_t seed_len, 235 u8 *msk, u8 *emsk, 236 u8 *sk, size_t *sk_len) 237 { 238 #define EAP_GPSK_SK_LEN_SHA256 SHA256_MAC_LEN 239 #define EAP_GPSK_PK_LEN_SHA256 SHA256_MAC_LEN 240 u8 kdf_out[EAP_MSK_LEN + EAP_EMSK_LEN + EAP_GPSK_SK_LEN_SHA256 + 241 EAP_GPSK_PK_LEN_SHA256]; 242 243 /* 244 * inputString = RAND_Peer || ID_Peer || RAND_Server || ID_Server 245 * (= seed) 246 * KS = 32, PL = psk_len, CSuite_Sel = 0x00000000 0x0002 247 * MK = GKDF-32 (PSK[0..31], PL || PSK || CSuite_Sel || inputString) 248 * MSK = GKDF-160 (MK, inputString)[0..63] 249 * EMSK = GKDF-160 (MK, inputString)[64..127] 250 * SK = GKDF-160 (MK, inputString)[128..159] 251 * zero = 0x00 || 0x00 || ... || 0x00 (32 times) 252 * Method-ID = GKDF-16 (zero, "Method ID" || EAP_Method_Type || 253 * CSuite_Sel || inputString) 254 */ 255 256 *sk_len = EAP_GPSK_SK_LEN_SHA256; 257 258 return eap_gpsk_derive_keys_helper(EAP_GPSK_CIPHER_SHA256, 259 kdf_out, sizeof(kdf_out), 260 psk, psk_len, seed, seed_len, 261 msk, emsk, sk, *sk_len, 262 NULL, 0); 263 } 264 #endif /* EAP_GPSK_SHA256 */ 265 266 267 /** 268 * eap_gpsk_derive_keys - Derive EAP-GPSK keys 269 * @psk: Pre-shared key 270 * @psk_len: Length of psk in bytes 271 * @vendor: CSuite/Vendor 272 * @specifier: CSuite/Specifier 273 * @rand_peer: 32-byte RAND_Peer 274 * @rand_server: 32-byte RAND_Server 275 * @id_peer: ID_Peer 276 * @id_peer_len: Length of ID_Peer 277 * @id_server: ID_Server 278 * @id_server_len: Length of ID_Server 279 * @msk: Buffer for 64-byte MSK 280 * @emsk: Buffer for 64-byte EMSK 281 * @sk: Buffer for SK (at least EAP_GPSK_MAX_SK_LEN bytes) 282 * @sk_len: Buffer for returning length of SK 283 * @pk: Buffer for PK (at least EAP_GPSK_MAX_PK_LEN bytes) 284 * @pk_len: Buffer for returning length of PK 285 * Returns: 0 on success, -1 on failure 286 */ 287 int eap_gpsk_derive_keys(const u8 *psk, size_t psk_len, int vendor, 288 int specifier, 289 const u8 *rand_peer, const u8 *rand_server, 290 const u8 *id_peer, size_t id_peer_len, 291 const u8 *id_server, size_t id_server_len, 292 u8 *msk, u8 *emsk, u8 *sk, size_t *sk_len, 293 u8 *pk, size_t *pk_len) 294 { 295 u8 *seed, *pos; 296 size_t seed_len; 297 int ret; 298 299 wpa_printf(MSG_DEBUG, "EAP-GPSK: Deriving keys (%d:%d)", 300 vendor, specifier); 301 302 if (vendor != EAP_GPSK_VENDOR_IETF) 303 return -1; 304 305 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: PSK", psk, psk_len); 306 307 /* Seed = RAND_Peer || ID_Peer || RAND_Server || ID_Server */ 308 seed_len = 2 * EAP_GPSK_RAND_LEN + id_server_len + id_peer_len; 309 seed = os_malloc(seed_len); 310 if (seed == NULL) { 311 wpa_printf(MSG_DEBUG, "EAP-GPSK: Failed to allocate memory " 312 "for key derivation"); 313 return -1; 314 } 315 316 pos = seed; 317 os_memcpy(pos, rand_peer, EAP_GPSK_RAND_LEN); 318 pos += EAP_GPSK_RAND_LEN; 319 os_memcpy(pos, id_peer, id_peer_len); 320 pos += id_peer_len; 321 os_memcpy(pos, rand_server, EAP_GPSK_RAND_LEN); 322 pos += EAP_GPSK_RAND_LEN; 323 os_memcpy(pos, id_server, id_server_len); 324 pos += id_server_len; 325 wpa_hexdump(MSG_DEBUG, "EAP-GPSK: Seed", seed, seed_len); 326 327 switch (specifier) { 328 case EAP_GPSK_CIPHER_AES: 329 ret = eap_gpsk_derive_keys_aes(psk, psk_len, seed, seed_len, 330 msk, emsk, sk, sk_len, 331 pk, pk_len); 332 break; 333 #ifdef EAP_GPSK_SHA256 334 case EAP_GPSK_CIPHER_SHA256: 335 ret = eap_gpsk_derive_keys_sha256(psk, psk_len, seed, seed_len, 336 msk, emsk, sk, sk_len); 337 break; 338 #endif /* EAP_GPSK_SHA256 */ 339 default: 340 wpa_printf(MSG_DEBUG, "EAP-GPSK: Unknown cipher %d:%d used in " 341 "key derivation", vendor, specifier); 342 ret = -1; 343 break; 344 } 345 346 os_free(seed); 347 348 return ret; 349 } 350 351 352 /** 353 * eap_gpsk_mic_len - Get the length of the MIC 354 * @vendor: CSuite/Vendor 355 * @specifier: CSuite/Specifier 356 * Returns: MIC length in bytes 357 */ 358 size_t eap_gpsk_mic_len(int vendor, int specifier) 359 { 360 if (vendor != EAP_GPSK_VENDOR_IETF) 361 return 0; 362 363 switch (specifier) { 364 case EAP_GPSK_CIPHER_AES: 365 return 16; 366 #ifdef EAP_GPSK_SHA256 367 case EAP_GPSK_CIPHER_SHA256: 368 return 32; 369 #endif /* EAP_GPSK_SHA256 */ 370 default: 371 return 0; 372 } 373 } 374 375 376 static int eap_gpsk_compute_mic_aes(const u8 *sk, size_t sk_len, 377 const u8 *data, size_t len, u8 *mic) 378 { 379 if (sk_len != 16) { 380 wpa_printf(MSG_DEBUG, "EAP-GPSK: Invalid SK length %lu for " 381 "AES-CMAC MIC", (unsigned long) sk_len); 382 return -1; 383 } 384 385 return omac1_aes_128(sk, data, len, mic); 386 } 387 388 389 /** 390 * eap_gpsk_compute_mic - Compute EAP-GPSK MIC for an EAP packet 391 * @sk: Session key SK from eap_gpsk_derive_keys() 392 * @sk_len: SK length in bytes from eap_gpsk_derive_keys() 393 * @vendor: CSuite/Vendor 394 * @specifier: CSuite/Specifier 395 * @data: Input data to MIC 396 * @len: Input data length in bytes 397 * @mic: Buffer for the computed MIC, eap_gpsk_mic_len(cipher) bytes 398 * Returns: 0 on success, -1 on failure 399 */ 400 int eap_gpsk_compute_mic(const u8 *sk, size_t sk_len, int vendor, 401 int specifier, const u8 *data, size_t len, u8 *mic) 402 { 403 int ret; 404 405 if (vendor != EAP_GPSK_VENDOR_IETF) 406 return -1; 407 408 switch (specifier) { 409 case EAP_GPSK_CIPHER_AES: 410 ret = eap_gpsk_compute_mic_aes(sk, sk_len, data, len, mic); 411 break; 412 #ifdef EAP_GPSK_SHA256 413 case EAP_GPSK_CIPHER_SHA256: 414 hmac_sha256(sk, sk_len, data, len, mic); 415 ret = 0; 416 break; 417 #endif /* EAP_GPSK_SHA256 */ 418 default: 419 wpa_printf(MSG_DEBUG, "EAP-GPSK: Unknown cipher %d:%d used in " 420 "MIC computation", vendor, specifier); 421 ret = -1; 422 break; 423 } 424 425 return ret; 426 } 427