1 /* 2 * EAP server/peer: EAP-EKE shared routines 3 * Copyright (c) 2011-2013, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #include "common.h" 12 #include "crypto/aes.h" 13 #include "crypto/aes_wrap.h" 14 #include "crypto/crypto.h" 15 #include "crypto/dh_groups.h" 16 #include "crypto/random.h" 17 #include "crypto/sha1.h" 18 #include "crypto/sha256.h" 19 #include "eap_common/eap_defs.h" 20 #include "eap_eke_common.h" 21 22 23 static int eap_eke_dh_len(u8 group) 24 { 25 switch (group) { 26 case EAP_EKE_DHGROUP_EKE_2: 27 return 128; 28 case EAP_EKE_DHGROUP_EKE_5: 29 return 192; 30 case EAP_EKE_DHGROUP_EKE_14: 31 return 256; 32 case EAP_EKE_DHGROUP_EKE_15: 33 return 384; 34 case EAP_EKE_DHGROUP_EKE_16: 35 return 512; 36 } 37 38 return -1; 39 } 40 41 42 static int eap_eke_dhcomp_len(u8 dhgroup, u8 encr) 43 { 44 int dhlen; 45 46 dhlen = eap_eke_dh_len(dhgroup); 47 if (dhlen < 0) 48 return -1; 49 if (encr != EAP_EKE_ENCR_AES128_CBC) 50 return -1; 51 return AES_BLOCK_SIZE + dhlen; 52 } 53 54 55 static const struct dh_group * eap_eke_dh_group(u8 group) 56 { 57 switch (group) { 58 case EAP_EKE_DHGROUP_EKE_2: 59 return dh_groups_get(2); 60 case EAP_EKE_DHGROUP_EKE_5: 61 return dh_groups_get(5); 62 case EAP_EKE_DHGROUP_EKE_14: 63 return dh_groups_get(14); 64 case EAP_EKE_DHGROUP_EKE_15: 65 return dh_groups_get(15); 66 case EAP_EKE_DHGROUP_EKE_16: 67 return dh_groups_get(16); 68 } 69 70 return NULL; 71 } 72 73 74 static int eap_eke_dh_generator(u8 group) 75 { 76 switch (group) { 77 case EAP_EKE_DHGROUP_EKE_2: 78 return 5; 79 case EAP_EKE_DHGROUP_EKE_5: 80 return 31; 81 case EAP_EKE_DHGROUP_EKE_14: 82 return 11; 83 case EAP_EKE_DHGROUP_EKE_15: 84 return 5; 85 case EAP_EKE_DHGROUP_EKE_16: 86 return 5; 87 } 88 89 return -1; 90 } 91 92 93 static int eap_eke_pnonce_len(u8 mac) 94 { 95 int mac_len; 96 97 if (mac == EAP_EKE_MAC_HMAC_SHA1) 98 mac_len = SHA1_MAC_LEN; 99 else if (mac == EAP_EKE_MAC_HMAC_SHA2_256) 100 mac_len = SHA256_MAC_LEN; 101 else 102 return -1; 103 104 return AES_BLOCK_SIZE + 16 + mac_len; 105 } 106 107 108 static int eap_eke_pnonce_ps_len(u8 mac) 109 { 110 int mac_len; 111 112 if (mac == EAP_EKE_MAC_HMAC_SHA1) 113 mac_len = SHA1_MAC_LEN; 114 else if (mac == EAP_EKE_MAC_HMAC_SHA2_256) 115 mac_len = SHA256_MAC_LEN; 116 else 117 return -1; 118 119 return AES_BLOCK_SIZE + 2 * 16 + mac_len; 120 } 121 122 123 static int eap_eke_prf_len(u8 prf) 124 { 125 if (prf == EAP_EKE_PRF_HMAC_SHA1) 126 return 20; 127 if (prf == EAP_EKE_PRF_HMAC_SHA2_256) 128 return 32; 129 return -1; 130 } 131 132 133 static int eap_eke_nonce_len(u8 prf) 134 { 135 int prf_len; 136 137 prf_len = eap_eke_prf_len(prf); 138 if (prf_len < 0) 139 return -1; 140 141 if (prf_len > 2 * 16) 142 return (prf_len + 1) / 2; 143 144 return 16; 145 } 146 147 148 static int eap_eke_auth_len(u8 prf) 149 { 150 switch (prf) { 151 case EAP_EKE_PRF_HMAC_SHA1: 152 return SHA1_MAC_LEN; 153 case EAP_EKE_PRF_HMAC_SHA2_256: 154 return SHA256_MAC_LEN; 155 } 156 157 return -1; 158 } 159 160 161 int eap_eke_dh_init(u8 group, u8 *ret_priv, u8 *ret_pub) 162 { 163 int generator; 164 u8 gen; 165 const struct dh_group *dh; 166 size_t pub_len, i; 167 168 generator = eap_eke_dh_generator(group); 169 if (generator < 0 || generator > 255) 170 return -1; 171 gen = generator; 172 173 dh = eap_eke_dh_group(group); 174 if (dh == NULL) 175 return -1; 176 177 /* x = random number 2 .. p-1 */ 178 if (random_get_bytes(ret_priv, dh->prime_len)) 179 return -1; 180 if (os_memcmp(ret_priv, dh->prime, dh->prime_len) > 0) { 181 /* Make sure private value is smaller than prime */ 182 ret_priv[0] = 0; 183 } 184 for (i = 0; i < dh->prime_len - 1; i++) { 185 if (ret_priv[i]) 186 break; 187 } 188 if (i == dh->prime_len - 1 && (ret_priv[i] == 0 || ret_priv[i] == 1)) 189 return -1; 190 wpa_hexdump_key(MSG_DEBUG, "EAP-EKE: DH private value", 191 ret_priv, dh->prime_len); 192 193 /* y = g ^ x (mod p) */ 194 pub_len = dh->prime_len; 195 if (crypto_mod_exp(&gen, 1, ret_priv, dh->prime_len, 196 dh->prime, dh->prime_len, ret_pub, &pub_len) < 0) 197 return -1; 198 if (pub_len < dh->prime_len) { 199 size_t pad = dh->prime_len - pub_len; 200 os_memmove(ret_pub + pad, ret_pub, pub_len); 201 os_memset(ret_pub, 0, pad); 202 } 203 204 wpa_hexdump(MSG_DEBUG, "EAP-EKE: DH public value", 205 ret_pub, dh->prime_len); 206 207 return 0; 208 } 209 210 211 static int eap_eke_prf(u8 prf, const u8 *key, size_t key_len, const u8 *data, 212 size_t data_len, const u8 *data2, size_t data2_len, 213 u8 *res) 214 { 215 const u8 *addr[2]; 216 size_t len[2]; 217 size_t num_elem = 1; 218 219 addr[0] = data; 220 len[0] = data_len; 221 if (data2) { 222 num_elem++; 223 addr[1] = data2; 224 len[1] = data2_len; 225 } 226 227 if (prf == EAP_EKE_PRF_HMAC_SHA1) 228 return hmac_sha1_vector(key, key_len, num_elem, addr, len, res); 229 if (prf == EAP_EKE_PRF_HMAC_SHA2_256) 230 return hmac_sha256_vector(key, key_len, num_elem, addr, len, 231 res); 232 return -1; 233 } 234 235 236 static int eap_eke_prf_hmac_sha1(const u8 *key, size_t key_len, const u8 *data, 237 size_t data_len, u8 *res, size_t len) 238 { 239 u8 hash[SHA1_MAC_LEN]; 240 u8 idx; 241 const u8 *addr[3]; 242 size_t vlen[3]; 243 int ret; 244 245 idx = 0; 246 addr[0] = hash; 247 vlen[0] = SHA1_MAC_LEN; 248 addr[1] = data; 249 vlen[1] = data_len; 250 addr[2] = &idx; 251 vlen[2] = 1; 252 253 while (len > 0) { 254 idx++; 255 if (idx == 1) 256 ret = hmac_sha1_vector(key, key_len, 2, &addr[1], 257 &vlen[1], hash); 258 else 259 ret = hmac_sha1_vector(key, key_len, 3, addr, vlen, 260 hash); 261 if (ret < 0) 262 return -1; 263 if (len > SHA1_MAC_LEN) { 264 os_memcpy(res, hash, SHA1_MAC_LEN); 265 res += SHA1_MAC_LEN; 266 len -= SHA1_MAC_LEN; 267 } else { 268 os_memcpy(res, hash, len); 269 len = 0; 270 } 271 } 272 273 return 0; 274 } 275 276 277 static int eap_eke_prf_hmac_sha256(const u8 *key, size_t key_len, const u8 *data, 278 size_t data_len, u8 *res, size_t len) 279 { 280 u8 hash[SHA256_MAC_LEN]; 281 u8 idx; 282 const u8 *addr[3]; 283 size_t vlen[3]; 284 int ret; 285 286 idx = 0; 287 addr[0] = hash; 288 vlen[0] = SHA256_MAC_LEN; 289 addr[1] = data; 290 vlen[1] = data_len; 291 addr[2] = &idx; 292 vlen[2] = 1; 293 294 while (len > 0) { 295 idx++; 296 if (idx == 1) 297 ret = hmac_sha256_vector(key, key_len, 2, &addr[1], 298 &vlen[1], hash); 299 else 300 ret = hmac_sha256_vector(key, key_len, 3, addr, vlen, 301 hash); 302 if (ret < 0) 303 return -1; 304 if (len > SHA256_MAC_LEN) { 305 os_memcpy(res, hash, SHA256_MAC_LEN); 306 res += SHA256_MAC_LEN; 307 len -= SHA256_MAC_LEN; 308 } else { 309 os_memcpy(res, hash, len); 310 len = 0; 311 } 312 } 313 314 return 0; 315 } 316 317 318 static int eap_eke_prfplus(u8 prf, const u8 *key, size_t key_len, 319 const u8 *data, size_t data_len, u8 *res, size_t len) 320 { 321 if (prf == EAP_EKE_PRF_HMAC_SHA1) 322 return eap_eke_prf_hmac_sha1(key, key_len, data, data_len, res, 323 len); 324 if (prf == EAP_EKE_PRF_HMAC_SHA2_256) 325 return eap_eke_prf_hmac_sha256(key, key_len, data, data_len, 326 res, len); 327 return -1; 328 } 329 330 331 int eap_eke_derive_key(struct eap_eke_session *sess, 332 const u8 *password, size_t password_len, 333 const u8 *id_s, size_t id_s_len, const u8 *id_p, 334 size_t id_p_len, u8 *key) 335 { 336 u8 zeros[EAP_EKE_MAX_HASH_LEN]; 337 u8 temp[EAP_EKE_MAX_HASH_LEN]; 338 size_t key_len = 16; /* Only AES-128-CBC is used here */ 339 u8 *id; 340 341 /* temp = prf(0+, password) */ 342 os_memset(zeros, 0, sess->prf_len); 343 if (eap_eke_prf(sess->prf, zeros, sess->prf_len, 344 password, password_len, NULL, 0, temp) < 0) 345 return -1; 346 wpa_hexdump_key(MSG_DEBUG, "EAP-EKE: temp = prf(0+, password)", 347 temp, sess->prf_len); 348 349 /* key = prf+(temp, ID_S | ID_P) */ 350 id = os_malloc(id_s_len + id_p_len); 351 if (id == NULL) 352 return -1; 353 os_memcpy(id, id_s, id_s_len); 354 os_memcpy(id + id_s_len, id_p, id_p_len); 355 wpa_hexdump_ascii(MSG_DEBUG, "EAP-EKE: ID_S | ID_P", 356 id, id_s_len + id_p_len); 357 if (eap_eke_prfplus(sess->prf, temp, sess->prf_len, 358 id, id_s_len + id_p_len, key, key_len) < 0) { 359 os_free(id); 360 return -1; 361 } 362 os_free(id); 363 wpa_hexdump_key(MSG_DEBUG, "EAP-EKE: key = prf+(temp, ID_S | ID_P)", 364 key, key_len); 365 366 return 0; 367 } 368 369 370 int eap_eke_dhcomp(struct eap_eke_session *sess, const u8 *key, const u8 *dhpub, 371 u8 *ret_dhcomp) 372 { 373 u8 pub[EAP_EKE_MAX_DH_LEN]; 374 int dh_len; 375 u8 iv[AES_BLOCK_SIZE]; 376 377 dh_len = eap_eke_dh_len(sess->dhgroup); 378 if (dh_len < 0) 379 return -1; 380 381 /* 382 * DHComponent = Encr(key, y) 383 * 384 * All defined DH groups use primes that have length devisible by 16, so 385 * no need to do extra padding for y (= pub). 386 */ 387 if (sess->encr != EAP_EKE_ENCR_AES128_CBC) 388 return -1; 389 if (random_get_bytes(iv, AES_BLOCK_SIZE)) 390 return -1; 391 wpa_hexdump(MSG_DEBUG, "EAP-EKE: IV for Encr(key, y)", 392 iv, AES_BLOCK_SIZE); 393 os_memcpy(pub, dhpub, dh_len); 394 if (aes_128_cbc_encrypt(key, iv, pub, dh_len) < 0) 395 return -1; 396 os_memcpy(ret_dhcomp, iv, AES_BLOCK_SIZE); 397 os_memcpy(ret_dhcomp + AES_BLOCK_SIZE, pub, dh_len); 398 wpa_hexdump(MSG_DEBUG, "EAP-EKE: DHComponent = Encr(key, y)", 399 ret_dhcomp, AES_BLOCK_SIZE + dh_len); 400 401 return 0; 402 } 403 404 405 int eap_eke_shared_secret(struct eap_eke_session *sess, const u8 *key, 406 const u8 *dhpriv, const u8 *peer_dhcomp) 407 { 408 u8 zeros[EAP_EKE_MAX_HASH_LEN]; 409 u8 peer_pub[EAP_EKE_MAX_DH_LEN]; 410 u8 modexp[EAP_EKE_MAX_DH_LEN]; 411 size_t len; 412 const struct dh_group *dh; 413 414 if (sess->encr != EAP_EKE_ENCR_AES128_CBC) 415 return -1; 416 417 dh = eap_eke_dh_group(sess->dhgroup); 418 if (dh == NULL) 419 return -1; 420 421 /* Decrypt peer DHComponent */ 422 os_memcpy(peer_pub, peer_dhcomp + AES_BLOCK_SIZE, dh->prime_len); 423 if (aes_128_cbc_decrypt(key, peer_dhcomp, peer_pub, dh->prime_len) < 0) { 424 wpa_printf(MSG_INFO, "EAP-EKE: Failed to decrypt DHComponent"); 425 return -1; 426 } 427 wpa_hexdump_key(MSG_DEBUG, "EAP-EKE: Decrypted peer DH pubkey", 428 peer_pub, dh->prime_len); 429 430 /* SharedSecret = prf(0+, g ^ (x_s * x_p) (mod p)) */ 431 len = dh->prime_len; 432 if (crypto_mod_exp(peer_pub, dh->prime_len, dhpriv, dh->prime_len, 433 dh->prime, dh->prime_len, modexp, &len) < 0) 434 return -1; 435 if (len < dh->prime_len) { 436 size_t pad = dh->prime_len - len; 437 os_memmove(modexp + pad, modexp, len); 438 os_memset(modexp, 0, pad); 439 } 440 441 os_memset(zeros, 0, sess->auth_len); 442 if (eap_eke_prf(sess->prf, zeros, sess->auth_len, modexp, dh->prime_len, 443 NULL, 0, sess->shared_secret) < 0) 444 return -1; 445 wpa_hexdump_key(MSG_DEBUG, "EAP-EKE: SharedSecret", 446 sess->shared_secret, sess->auth_len); 447 448 return 0; 449 } 450 451 452 int eap_eke_derive_ke_ki(struct eap_eke_session *sess, 453 const u8 *id_s, size_t id_s_len, 454 const u8 *id_p, size_t id_p_len) 455 { 456 u8 buf[EAP_EKE_MAX_KE_LEN + EAP_EKE_MAX_KI_LEN]; 457 size_t ke_len, ki_len; 458 u8 *data; 459 size_t data_len; 460 const char *label = "EAP-EKE Keys"; 461 size_t label_len; 462 463 /* 464 * Ke | Ki = prf+(SharedSecret, "EAP-EKE Keys" | ID_S | ID_P) 465 * Ke = encryption key 466 * Ki = integrity protection key 467 * Length of each key depends on the selected algorithms. 468 */ 469 470 if (sess->encr == EAP_EKE_ENCR_AES128_CBC) 471 ke_len = 16; 472 else 473 return -1; 474 475 if (sess->mac == EAP_EKE_PRF_HMAC_SHA1) 476 ki_len = 20; 477 else if (sess->mac == EAP_EKE_PRF_HMAC_SHA2_256) 478 ki_len = 32; 479 else 480 return -1; 481 482 label_len = os_strlen(label); 483 data_len = label_len + id_s_len + id_p_len; 484 data = os_malloc(data_len); 485 if (data == NULL) 486 return -1; 487 os_memcpy(data, label, label_len); 488 os_memcpy(data + label_len, id_s, id_s_len); 489 os_memcpy(data + label_len + id_s_len, id_p, id_p_len); 490 if (eap_eke_prfplus(sess->prf, sess->shared_secret, sess->prf_len, 491 data, data_len, buf, ke_len + ki_len) < 0) { 492 os_free(data); 493 return -1; 494 } 495 496 os_memcpy(sess->ke, buf, ke_len); 497 wpa_hexdump_key(MSG_DEBUG, "EAP-EKE: Ke", sess->ke, ke_len); 498 os_memcpy(sess->ki, buf + ke_len, ki_len); 499 wpa_hexdump_key(MSG_DEBUG, "EAP-EKE: Ki", sess->ki, ki_len); 500 501 os_free(data); 502 return 0; 503 } 504 505 506 int eap_eke_derive_ka(struct eap_eke_session *sess, 507 const u8 *id_s, size_t id_s_len, 508 const u8 *id_p, size_t id_p_len, 509 const u8 *nonce_p, const u8 *nonce_s) 510 { 511 u8 *data, *pos; 512 size_t data_len; 513 const char *label = "EAP-EKE Ka"; 514 size_t label_len; 515 516 /* 517 * Ka = prf+(SharedSecret, "EAP-EKE Ka" | ID_S | ID_P | Nonce_P | 518 * Nonce_S) 519 * Ka = authentication key 520 * Length of the key depends on the selected algorithms. 521 */ 522 523 label_len = os_strlen(label); 524 data_len = label_len + id_s_len + id_p_len + 2 * sess->nonce_len; 525 data = os_malloc(data_len); 526 if (data == NULL) 527 return -1; 528 pos = data; 529 os_memcpy(pos, label, label_len); 530 pos += label_len; 531 os_memcpy(pos, id_s, id_s_len); 532 pos += id_s_len; 533 os_memcpy(pos, id_p, id_p_len); 534 pos += id_p_len; 535 os_memcpy(pos, nonce_p, sess->nonce_len); 536 pos += sess->nonce_len; 537 os_memcpy(pos, nonce_s, sess->nonce_len); 538 if (eap_eke_prfplus(sess->prf, sess->shared_secret, sess->prf_len, 539 data, data_len, sess->ka, sess->prf_len) < 0) { 540 os_free(data); 541 return -1; 542 } 543 os_free(data); 544 545 wpa_hexdump_key(MSG_DEBUG, "EAP-EKE: Ka", sess->ka, sess->prf_len); 546 547 return 0; 548 } 549 550 551 int eap_eke_derive_msk(struct eap_eke_session *sess, 552 const u8 *id_s, size_t id_s_len, 553 const u8 *id_p, size_t id_p_len, 554 const u8 *nonce_p, const u8 *nonce_s, 555 u8 *msk, u8 *emsk) 556 { 557 u8 *data, *pos; 558 size_t data_len; 559 const char *label = "EAP-EKE Exported Keys"; 560 size_t label_len; 561 u8 buf[EAP_MSK_LEN + EAP_EMSK_LEN]; 562 563 /* 564 * MSK | EMSK = prf+(SharedSecret, "EAP-EKE Exported Keys" | ID_S | 565 * ID_P | Nonce_P | Nonce_S) 566 */ 567 568 label_len = os_strlen(label); 569 data_len = label_len + id_s_len + id_p_len + 2 * sess->nonce_len; 570 data = os_malloc(data_len); 571 if (data == NULL) 572 return -1; 573 pos = data; 574 os_memcpy(pos, label, label_len); 575 pos += label_len; 576 os_memcpy(pos, id_s, id_s_len); 577 pos += id_s_len; 578 os_memcpy(pos, id_p, id_p_len); 579 pos += id_p_len; 580 os_memcpy(pos, nonce_p, sess->nonce_len); 581 pos += sess->nonce_len; 582 os_memcpy(pos, nonce_s, sess->nonce_len); 583 if (eap_eke_prfplus(sess->prf, sess->shared_secret, sess->prf_len, 584 data, data_len, buf, EAP_MSK_LEN + EAP_EMSK_LEN) < 585 0) { 586 os_free(data); 587 return -1; 588 } 589 os_free(data); 590 591 os_memcpy(msk, buf, EAP_MSK_LEN); 592 os_memcpy(emsk, buf + EAP_MSK_LEN, EAP_EMSK_LEN); 593 os_memset(buf, 0, sizeof(buf)); 594 595 wpa_hexdump_key(MSG_DEBUG, "EAP-EKE: MSK", msk, EAP_MSK_LEN); 596 wpa_hexdump_key(MSG_DEBUG, "EAP-EKE: EMSK", msk, EAP_EMSK_LEN); 597 598 return 0; 599 } 600 601 602 static int eap_eke_mac(u8 mac, const u8 *key, const u8 *data, size_t data_len, 603 u8 *res) 604 { 605 if (mac == EAP_EKE_MAC_HMAC_SHA1) 606 return hmac_sha1(key, SHA1_MAC_LEN, data, data_len, res); 607 if (mac == EAP_EKE_MAC_HMAC_SHA2_256) 608 return hmac_sha256(key, SHA256_MAC_LEN, data, data_len, res); 609 return -1; 610 } 611 612 613 int eap_eke_prot(struct eap_eke_session *sess, 614 const u8 *data, size_t data_len, 615 u8 *prot, size_t *prot_len) 616 { 617 size_t block_size, icv_len, pad; 618 u8 *pos, *iv, *e; 619 620 if (sess->encr == EAP_EKE_ENCR_AES128_CBC) 621 block_size = AES_BLOCK_SIZE; 622 else 623 return -1; 624 625 if (sess->mac == EAP_EKE_PRF_HMAC_SHA1) 626 icv_len = SHA1_MAC_LEN; 627 else if (sess->mac == EAP_EKE_PRF_HMAC_SHA2_256) 628 icv_len = SHA256_MAC_LEN; 629 else 630 return -1; 631 632 pad = data_len % block_size; 633 if (pad) 634 pad = block_size - pad; 635 636 if (*prot_len < block_size + data_len + pad + icv_len) { 637 wpa_printf(MSG_INFO, "EAP-EKE: Not enough room for Prot() data"); 638 } 639 pos = prot; 640 641 if (random_get_bytes(pos, block_size)) 642 return -1; 643 iv = pos; 644 wpa_hexdump(MSG_DEBUG, "EAP-EKE: IV for Prot()", iv, block_size); 645 pos += block_size; 646 647 e = pos; 648 os_memcpy(pos, data, data_len); 649 pos += data_len; 650 if (pad) { 651 if (random_get_bytes(pos, pad)) 652 return -1; 653 pos += pad; 654 } 655 656 if (aes_128_cbc_encrypt(sess->ke, iv, e, data_len + pad) < 0) 657 return -1; 658 659 if (eap_eke_mac(sess->mac, sess->ki, e, data_len + pad, pos) < 0) 660 return -1; 661 pos += icv_len; 662 663 *prot_len = pos - prot; 664 return 0; 665 } 666 667 668 int eap_eke_decrypt_prot(struct eap_eke_session *sess, 669 const u8 *prot, size_t prot_len, 670 u8 *data, size_t *data_len) 671 { 672 size_t block_size, icv_len; 673 u8 icv[EAP_EKE_MAX_HASH_LEN]; 674 675 if (sess->encr == EAP_EKE_ENCR_AES128_CBC) 676 block_size = AES_BLOCK_SIZE; 677 else 678 return -1; 679 680 if (sess->mac == EAP_EKE_PRF_HMAC_SHA1) 681 icv_len = SHA1_MAC_LEN; 682 else if (sess->mac == EAP_EKE_PRF_HMAC_SHA2_256) 683 icv_len = SHA256_MAC_LEN; 684 else 685 return -1; 686 687 if (prot_len < 2 * block_size + icv_len) 688 return -1; 689 if ((prot_len - icv_len) % block_size) 690 return -1; 691 692 if (eap_eke_mac(sess->mac, sess->ki, prot + block_size, 693 prot_len - block_size - icv_len, icv) < 0) 694 return -1; 695 if (os_memcmp_const(icv, prot + prot_len - icv_len, icv_len) != 0) { 696 wpa_printf(MSG_INFO, "EAP-EKE: ICV mismatch in Prot() data"); 697 return -1; 698 } 699 700 if (*data_len < prot_len - block_size - icv_len) { 701 wpa_printf(MSG_INFO, "EAP-EKE: Not enough room for decrypted Prot() data"); 702 return -1; 703 } 704 705 *data_len = prot_len - block_size - icv_len; 706 os_memcpy(data, prot + block_size, *data_len); 707 if (aes_128_cbc_decrypt(sess->ke, prot, data, *data_len) < 0) { 708 wpa_printf(MSG_INFO, "EAP-EKE: Failed to decrypt Prot() data"); 709 return -1; 710 } 711 wpa_hexdump_key(MSG_DEBUG, "EAP-EKE: Decrypted Prot() data", 712 data, *data_len); 713 714 return 0; 715 } 716 717 718 int eap_eke_auth(struct eap_eke_session *sess, const char *label, 719 const struct wpabuf *msgs, u8 *auth) 720 { 721 wpa_printf(MSG_DEBUG, "EAP-EKE: Auth(%s)", label); 722 wpa_hexdump_key(MSG_DEBUG, "EAP-EKE: Ka for Auth", 723 sess->ka, sess->auth_len); 724 wpa_hexdump_buf(MSG_MSGDUMP, "EAP-EKE: Messages for Auth", msgs); 725 return eap_eke_prf(sess->prf, sess->ka, sess->auth_len, 726 (const u8 *) label, os_strlen(label), 727 wpabuf_head(msgs), wpabuf_len(msgs), auth); 728 } 729 730 731 int eap_eke_session_init(struct eap_eke_session *sess, u8 dhgroup, u8 encr, 732 u8 prf, u8 mac) 733 { 734 sess->dhgroup = dhgroup; 735 sess->encr = encr; 736 sess->prf = prf; 737 sess->mac = mac; 738 739 sess->prf_len = eap_eke_prf_len(prf); 740 if (sess->prf_len < 0) 741 return -1; 742 sess->nonce_len = eap_eke_nonce_len(prf); 743 if (sess->nonce_len < 0) 744 return -1; 745 sess->auth_len = eap_eke_auth_len(prf); 746 if (sess->auth_len < 0) 747 return -1; 748 sess->dhcomp_len = eap_eke_dhcomp_len(sess->dhgroup, sess->encr); 749 if (sess->dhcomp_len < 0) 750 return -1; 751 sess->pnonce_len = eap_eke_pnonce_len(sess->mac); 752 if (sess->pnonce_len < 0) 753 return -1; 754 sess->pnonce_ps_len = eap_eke_pnonce_ps_len(sess->mac); 755 if (sess->pnonce_ps_len < 0) 756 return -1; 757 758 return 0; 759 } 760 761 762 void eap_eke_session_clean(struct eap_eke_session *sess) 763 { 764 os_memset(sess->shared_secret, 0, EAP_EKE_MAX_HASH_LEN); 765 os_memset(sess->ke, 0, EAP_EKE_MAX_KE_LEN); 766 os_memset(sess->ki, 0, EAP_EKE_MAX_KI_LEN); 767 os_memset(sess->ka, 0, EAP_EKE_MAX_KA_LEN); 768 } 769