eap_gpsk_common.c revision 189251 
1/*
2 * EAP server/peer: EAP-GPSK shared routines
3 * Copyright (c) 2006-2007, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15#include "includes.h"
16
17#include "common.h"
18#include "eap_defs.h"
19#include "aes_wrap.h"
20#include "crypto.h"
21#ifdef EAP_GPSK_SHA256
22#include "sha256.h"
23#endif /* EAP_GPSK_SHA256 */
24#include "eap_gpsk_common.h"
25
26
27/**
28 * eap_gpsk_supported_ciphersuite - Check whether ciphersuite is supported
29 * @vendor: CSuite/Vendor
30 * @specifier: CSuite/Specifier
31 * Returns: 1 if ciphersuite is support, or 0 if not
32 */
33int eap_gpsk_supported_ciphersuite(int vendor, int specifier)
34{
35	if (vendor == EAP_GPSK_VENDOR_IETF &&
36	    specifier == EAP_GPSK_CIPHER_AES)
37		return 1;
38#ifdef EAP_GPSK_SHA256
39	if (vendor == EAP_GPSK_VENDOR_IETF &&
40	    specifier == EAP_GPSK_CIPHER_SHA256)
41		return 1;
42#endif /* EAP_GPSK_SHA256 */
43	return 0;
44}
45
46
47static int eap_gpsk_gkdf_cmac(const u8 *psk /* Y */,
48			      const u8 *data /* Z */, size_t data_len,
49			      u8 *buf, size_t len /* X */)
50{
51	u8 *opos;
52	size_t i, n, hashlen, left, clen;
53	u8 ibuf[2], hash[16];
54	const u8 *addr[2];
55	size_t vlen[2];
56
57	hashlen = sizeof(hash);
58	/* M_i = MAC_Y (i || Z); (MAC = AES-CMAC-128) */
59	addr[0] = ibuf;
60	vlen[0] = sizeof(ibuf);
61	addr[1] = data;
62	vlen[1] = data_len;
63
64	opos = buf;
65	left = len;
66	n = (len + hashlen - 1) / hashlen;
67	for (i = 1; i <= n; i++) {
68		WPA_PUT_BE16(ibuf, i);
69		if (omac1_aes_128_vector(psk, 2, addr, vlen, hash))
70			return -1;
71		clen = left > hashlen ? hashlen : left;
72		os_memcpy(opos, hash, clen);
73		opos += clen;
74		left -= clen;
75	}
76
77	return 0;
78}
79
80
81#ifdef EAP_GPSK_SHA256
82static int eap_gpsk_gkdf_sha256(const u8 *psk /* Y */,
83				const u8 *data /* Z */, size_t data_len,
84				u8 *buf, size_t len /* X */)
85{
86	u8 *opos;
87	size_t i, n, hashlen, left, clen;
88	u8 ibuf[2], hash[SHA256_MAC_LEN];
89	const u8 *addr[2];
90	size_t vlen[2];
91
92	hashlen = SHA256_MAC_LEN;
93	/* M_i = MAC_Y (i || Z); (MAC = HMAC-SHA256) */
94	addr[0] = ibuf;
95	vlen[0] = sizeof(ibuf);
96	addr[1] = data;
97	vlen[1] = data_len;
98
99	opos = buf;
100	left = len;
101	n = (len + hashlen - 1) / hashlen;
102	for (i = 1; i <= n; i++) {
103		WPA_PUT_BE16(ibuf, i);
104		hmac_sha256_vector(psk, 32, 2, addr, vlen, hash);
105		clen = left > hashlen ? hashlen : left;
106		os_memcpy(opos, hash, clen);
107		opos += clen;
108		left -= clen;
109	}
110
111	return 0;
112}
113#endif /* EAP_GPSK_SHA256 */
114
115
116static int eap_gpsk_derive_keys_helper(u32 csuite_specifier,
117				       u8 *kdf_out, size_t kdf_out_len,
118				       const u8 *psk, size_t psk_len,
119				       const u8 *seed, size_t seed_len,
120				       u8 *msk, u8 *emsk,
121				       u8 *sk, size_t sk_len,
122				       u8 *pk, size_t pk_len)
123{
124	u8 mk[32], *pos, *data;
125	size_t data_len, mk_len;
126	int (*gkdf)(const u8 *_psk, const u8 *_data, size_t _data_len,
127		    u8 *buf, size_t len);
128
129	gkdf = NULL;
130	switch (csuite_specifier) {
131	case EAP_GPSK_CIPHER_AES:
132		gkdf = eap_gpsk_gkdf_cmac;
133		mk_len = 16;
134		break;
135#ifdef EAP_GPSK_SHA256
136	case EAP_GPSK_CIPHER_SHA256:
137		gkdf = eap_gpsk_gkdf_sha256;
138		mk_len = SHA256_MAC_LEN;
139		break;
140#endif /* EAP_GPSK_SHA256 */
141	default:
142		return -1;
143	}
144
145	if (psk_len < mk_len)
146		return -1;
147
148	data_len = 2 + psk_len + 6 + seed_len;
149	data = os_malloc(data_len);
150	if (data == NULL)
151		return -1;
152	pos = data;
153	WPA_PUT_BE16(pos, psk_len);
154	pos += 2;
155	os_memcpy(pos, psk, psk_len);
156	pos += psk_len;
157	WPA_PUT_BE32(pos, EAP_GPSK_VENDOR_IETF); /* CSuite/Vendor = IETF */
158	pos += 4;
159	WPA_PUT_BE16(pos, csuite_specifier); /* CSuite/Specifier */
160	pos += 2;
161	os_memcpy(pos, seed, seed_len); /* inputString */
162	wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: Data to MK derivation",
163			data, data_len);
164
165	if (gkdf(psk, data, data_len, mk, mk_len) < 0) {
166		os_free(data);
167		return -1;
168	}
169	os_free(data);
170	wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: MK", mk, mk_len);
171
172	if (gkdf(mk, seed, seed_len, kdf_out, kdf_out_len) < 0)
173		return -1;
174
175	pos = kdf_out;
176	wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: MSK", pos, EAP_MSK_LEN);
177	os_memcpy(msk, pos, EAP_MSK_LEN);
178	pos += EAP_MSK_LEN;
179
180	wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: EMSK", pos, EAP_EMSK_LEN);
181	os_memcpy(emsk, pos, EAP_EMSK_LEN);
182	pos += EAP_EMSK_LEN;
183
184	wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: SK", pos, sk_len);
185	os_memcpy(sk, pos, sk_len);
186	pos += sk_len;
187
188	if (pk) {
189		wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: PK", pos, pk_len);
190		os_memcpy(pk, pos, pk_len);
191	}
192
193	return 0;
194}
195
196
197static int eap_gpsk_derive_keys_aes(const u8 *psk, size_t psk_len,
198				    const u8 *seed, size_t seed_len,
199				    u8 *msk, u8 *emsk, u8 *sk, size_t *sk_len,
200				    u8 *pk, size_t *pk_len)
201{
202#define EAP_GPSK_SK_LEN_AES 16
203#define EAP_GPSK_PK_LEN_AES 16
204	u8 kdf_out[EAP_MSK_LEN + EAP_EMSK_LEN + EAP_GPSK_SK_LEN_AES +
205		   EAP_GPSK_PK_LEN_AES];
206
207	/*
208	 * inputString = RAND_Peer || ID_Peer || RAND_Server || ID_Server
209	 *            (= seed)
210	 * KS = 16, PL = psk_len, CSuite_Sel = 0x00000000 0x0001
211	 * MK = GKDF-16 (PSK[0..15], PL || PSK || CSuite_Sel || inputString)
212	 * MSK = GKDF-160 (MK, inputString)[0..63]
213	 * EMSK = GKDF-160 (MK, inputString)[64..127]
214	 * SK = GKDF-160 (MK, inputString)[128..143]
215	 * PK = GKDF-160 (MK, inputString)[144..159]
216	 * zero = 0x00 || 0x00 || ... || 0x00 (16 times)
217	 * Method-ID = GKDF-16 (zero, "Method ID" || EAP_Method_Type ||
218	 *                      CSuite_Sel || inputString)
219	 */
220
221	*sk_len = EAP_GPSK_SK_LEN_AES;
222	*pk_len = EAP_GPSK_PK_LEN_AES;
223
224	return eap_gpsk_derive_keys_helper(EAP_GPSK_CIPHER_AES,
225					   kdf_out, sizeof(kdf_out),
226					   psk, psk_len, seed, seed_len,
227					   msk, emsk, sk, *sk_len,
228					   pk, *pk_len);
229}
230
231
232#ifdef EAP_GPSK_SHA256
233static int eap_gpsk_derive_keys_sha256(const u8 *psk, size_t psk_len,
234				       const u8 *seed, size_t seed_len,
235				       u8 *msk, u8 *emsk,
236				       u8 *sk, size_t *sk_len)
237{
238#define EAP_GPSK_SK_LEN_SHA256 SHA256_MAC_LEN
239#define EAP_GPSK_PK_LEN_SHA256 SHA256_MAC_LEN
240	u8 kdf_out[EAP_MSK_LEN + EAP_EMSK_LEN + EAP_GPSK_SK_LEN_SHA256 +
241		   EAP_GPSK_PK_LEN_SHA256];
242
243	/*
244	 * inputString = RAND_Peer || ID_Peer || RAND_Server || ID_Server
245	 *            (= seed)
246	 * KS = 32, PL = psk_len, CSuite_Sel = 0x00000000 0x0002
247	 * MK = GKDF-32 (PSK[0..31], PL || PSK || CSuite_Sel || inputString)
248	 * MSK = GKDF-160 (MK, inputString)[0..63]
249	 * EMSK = GKDF-160 (MK, inputString)[64..127]
250	 * SK = GKDF-160 (MK, inputString)[128..159]
251	 * zero = 0x00 || 0x00 || ... || 0x00 (32 times)
252	 * Method-ID = GKDF-16 (zero, "Method ID" || EAP_Method_Type ||
253	 *                      CSuite_Sel || inputString)
254	 */
255
256	*sk_len = EAP_GPSK_SK_LEN_SHA256;
257
258	return eap_gpsk_derive_keys_helper(EAP_GPSK_CIPHER_SHA256,
259					   kdf_out, sizeof(kdf_out),
260					   psk, psk_len, seed, seed_len,
261					   msk, emsk, sk, *sk_len,
262					   NULL, 0);
263}
264#endif /* EAP_GPSK_SHA256 */
265
266
267/**
268 * eap_gpsk_derive_keys - Derive EAP-GPSK keys
269 * @psk: Pre-shared key
270 * @psk_len: Length of psk in bytes
271 * @vendor: CSuite/Vendor
272 * @specifier: CSuite/Specifier
273 * @rand_peer: 32-byte RAND_Peer
274 * @rand_server: 32-byte RAND_Server
275 * @id_peer: ID_Peer
276 * @id_peer_len: Length of ID_Peer
277 * @id_server: ID_Server
278 * @id_server_len: Length of ID_Server
279 * @msk: Buffer for 64-byte MSK
280 * @emsk: Buffer for 64-byte EMSK
281 * @sk: Buffer for SK (at least EAP_GPSK_MAX_SK_LEN bytes)
282 * @sk_len: Buffer for returning length of SK
283 * @pk: Buffer for PK (at least EAP_GPSK_MAX_PK_LEN bytes)
284 * @pk_len: Buffer for returning length of PK
285 * Returns: 0 on success, -1 on failure
286 */
287int eap_gpsk_derive_keys(const u8 *psk, size_t psk_len, int vendor,
288			 int specifier,
289			 const u8 *rand_peer, const u8 *rand_server,
290			 const u8 *id_peer, size_t id_peer_len,
291			 const u8 *id_server, size_t id_server_len,
292			 u8 *msk, u8 *emsk, u8 *sk, size_t *sk_len,
293			 u8 *pk, size_t *pk_len)
294{
295	u8 *seed, *pos;
296	size_t seed_len;
297	int ret;
298
299	wpa_printf(MSG_DEBUG, "EAP-GPSK: Deriving keys (%d:%d)",
300		   vendor, specifier);
301
302	if (vendor != EAP_GPSK_VENDOR_IETF)
303		return -1;
304
305	wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: PSK", psk, psk_len);
306
307	/* Seed = RAND_Peer || ID_Peer || RAND_Server || ID_Server */
308	seed_len = 2 * EAP_GPSK_RAND_LEN + id_server_len + id_peer_len;
309	seed = os_malloc(seed_len);
310	if (seed == NULL) {
311		wpa_printf(MSG_DEBUG, "EAP-GPSK: Failed to allocate memory "
312			   "for key derivation");
313		return -1;
314	}
315
316	pos = seed;
317	os_memcpy(pos, rand_peer, EAP_GPSK_RAND_LEN);
318	pos += EAP_GPSK_RAND_LEN;
319	os_memcpy(pos, id_peer, id_peer_len);
320	pos += id_peer_len;
321	os_memcpy(pos, rand_server, EAP_GPSK_RAND_LEN);
322	pos += EAP_GPSK_RAND_LEN;
323	os_memcpy(pos, id_server, id_server_len);
324	pos += id_server_len;
325	wpa_hexdump(MSG_DEBUG, "EAP-GPSK: Seed", seed, seed_len);
326
327	switch (specifier) {
328	case EAP_GPSK_CIPHER_AES:
329		ret = eap_gpsk_derive_keys_aes(psk, psk_len, seed, seed_len,
330					       msk, emsk, sk, sk_len,
331					       pk, pk_len);
332		break;
333#ifdef EAP_GPSK_SHA256
334	case EAP_GPSK_CIPHER_SHA256:
335		ret = eap_gpsk_derive_keys_sha256(psk, psk_len, seed, seed_len,
336						  msk, emsk, sk, sk_len);
337		break;
338#endif /* EAP_GPSK_SHA256 */
339	default:
340		wpa_printf(MSG_DEBUG, "EAP-GPSK: Unknown cipher %d:%d used in "
341			   "key derivation", vendor, specifier);
342		ret = -1;
343		break;
344	}
345
346	os_free(seed);
347
348	return ret;
349}
350
351
352/**
353 * eap_gpsk_mic_len - Get the length of the MIC
354 * @vendor: CSuite/Vendor
355 * @specifier: CSuite/Specifier
356 * Returns: MIC length in bytes
357 */
358size_t eap_gpsk_mic_len(int vendor, int specifier)
359{
360	if (vendor != EAP_GPSK_VENDOR_IETF)
361		return 0;
362
363	switch (specifier) {
364	case EAP_GPSK_CIPHER_AES:
365		return 16;
366#ifdef EAP_GPSK_SHA256
367	case EAP_GPSK_CIPHER_SHA256:
368		return 32;
369#endif /* EAP_GPSK_SHA256 */
370	default:
371		return 0;
372	}
373}
374
375
376static int eap_gpsk_compute_mic_aes(const u8 *sk, size_t sk_len,
377				    const u8 *data, size_t len, u8 *mic)
378{
379	if (sk_len != 16) {
380		wpa_printf(MSG_DEBUG, "EAP-GPSK: Invalid SK length %lu for "
381			   "AES-CMAC MIC", (unsigned long) sk_len);
382		return -1;
383	}
384
385	return omac1_aes_128(sk, data, len, mic);
386}
387
388
389/**
390 * eap_gpsk_compute_mic - Compute EAP-GPSK MIC for an EAP packet
391 * @sk: Session key SK from eap_gpsk_derive_keys()
392 * @sk_len: SK length in bytes from eap_gpsk_derive_keys()
393 * @vendor: CSuite/Vendor
394 * @specifier: CSuite/Specifier
395 * @data: Input data to MIC
396 * @len: Input data length in bytes
397 * @mic: Buffer for the computed MIC, eap_gpsk_mic_len(cipher) bytes
398 * Returns: 0 on success, -1 on failure
399 */
400int eap_gpsk_compute_mic(const u8 *sk, size_t sk_len, int vendor,
401			 int specifier, const u8 *data, size_t len, u8 *mic)
402{
403	int ret;
404
405	if (vendor != EAP_GPSK_VENDOR_IETF)
406		return -1;
407
408	switch (specifier) {
409	case EAP_GPSK_CIPHER_AES:
410		ret = eap_gpsk_compute_mic_aes(sk, sk_len, data, len, mic);
411		break;
412#ifdef EAP_GPSK_SHA256
413	case EAP_GPSK_CIPHER_SHA256:
414		hmac_sha256(sk, sk_len, data, len, mic);
415		ret = 0;
416		break;
417#endif /* EAP_GPSK_SHA256 */
418	default:
419		wpa_printf(MSG_DEBUG, "EAP-GPSK: Unknown cipher %d:%d used in "
420			   "MIC computation", vendor, specifier);
421		ret = -1;
422		break;
423	}
424
425	return ret;
426}
427