1/* 2 * Simultaneous authentication of equals 3 * Copyright (c) 2012-2016, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#include "includes.h" 10 11#include "common.h" 12#include "utils/const_time.h" 13#include "crypto/crypto.h" 14#include "crypto/sha256.h" 15#include "crypto/random.h" 16#include "crypto/dh_groups.h" 17#include "ieee802_11_defs.h" 18#include "dragonfly.h" 19#include "sae.h" 20 21 22int sae_set_group(struct sae_data *sae, int group) 23{ 24 struct sae_temporary_data *tmp; 25 26#ifdef CONFIG_TESTING_OPTIONS 27 /* Allow all groups for testing purposes in non-production builds. */ 28#else /* CONFIG_TESTING_OPTIONS */ 29 if (!dragonfly_suitable_group(group, 0)) { 30 wpa_printf(MSG_DEBUG, "SAE: Reject unsuitable group %d", group); 31 return -1; 32 } 33#endif /* CONFIG_TESTING_OPTIONS */ 34 35 sae_clear_data(sae); 36 tmp = sae->tmp = os_zalloc(sizeof(*tmp)); 37 if (tmp == NULL) 38 return -1; 39 40 /* First, check if this is an ECC group */ 41 tmp->ec = crypto_ec_init(group); 42 if (tmp->ec) { 43 wpa_printf(MSG_DEBUG, "SAE: Selecting supported ECC group %d", 44 group); 45 sae->group = group; 46 tmp->prime_len = crypto_ec_prime_len(tmp->ec); 47 tmp->prime = crypto_ec_get_prime(tmp->ec); 48 tmp->order_len = crypto_ec_order_len(tmp->ec); 49 tmp->order = crypto_ec_get_order(tmp->ec); 50 return 0; 51 } 52 53 /* Not an ECC group, check FFC */ 54 tmp->dh = dh_groups_get(group); 55 if (tmp->dh) { 56 wpa_printf(MSG_DEBUG, "SAE: Selecting supported FFC group %d", 57 group); 58 sae->group = group; 59 tmp->prime_len = tmp->dh->prime_len; 60 if (tmp->prime_len > SAE_MAX_PRIME_LEN) { 61 sae_clear_data(sae); 62 return -1; 63 } 64 65 tmp->prime_buf = crypto_bignum_init_set(tmp->dh->prime, 66 tmp->prime_len); 67 if (tmp->prime_buf == NULL) { 68 sae_clear_data(sae); 69 return -1; 70 } 71 tmp->prime = tmp->prime_buf; 72 73 tmp->order_len = tmp->dh->order_len; 74 tmp->order_buf = crypto_bignum_init_set(tmp->dh->order, 75 tmp->dh->order_len); 76 if (tmp->order_buf == NULL) { 77 sae_clear_data(sae); 78 return -1; 79 } 80 tmp->order = tmp->order_buf; 81 82 return 0; 83 } 84 85 /* Unsupported group */ 86 wpa_printf(MSG_DEBUG, 87 "SAE: Group %d not supported by the crypto library", group); 88 return -1; 89} 90 91 92void sae_clear_temp_data(struct sae_data *sae) 93{ 94 struct sae_temporary_data *tmp; 95 if (sae == NULL || sae->tmp == NULL) 96 return; 97 tmp = sae->tmp; 98 crypto_ec_deinit(tmp->ec); 99 crypto_bignum_deinit(tmp->prime_buf, 0); 100 crypto_bignum_deinit(tmp->order_buf, 0); 101 crypto_bignum_deinit(tmp->sae_rand, 1); 102 crypto_bignum_deinit(tmp->pwe_ffc, 1); 103 crypto_bignum_deinit(tmp->own_commit_scalar, 0); 104 crypto_bignum_deinit(tmp->own_commit_element_ffc, 0); 105 crypto_bignum_deinit(tmp->peer_commit_element_ffc, 0); 106 crypto_ec_point_deinit(tmp->pwe_ecc, 1); 107 crypto_ec_point_deinit(tmp->own_commit_element_ecc, 0); 108 crypto_ec_point_deinit(tmp->peer_commit_element_ecc, 0); 109 wpabuf_free(tmp->anti_clogging_token); 110 os_free(tmp->pw_id); 111 bin_clear_free(tmp, sizeof(*tmp)); 112 sae->tmp = NULL; 113} 114 115 116void sae_clear_data(struct sae_data *sae) 117{ 118 if (sae == NULL) 119 return; 120 sae_clear_temp_data(sae); 121 crypto_bignum_deinit(sae->peer_commit_scalar, 0); 122 os_memset(sae, 0, sizeof(*sae)); 123} 124 125 126static void sae_pwd_seed_key(const u8 *addr1, const u8 *addr2, u8 *key) 127{ 128 wpa_printf(MSG_DEBUG, "SAE: PWE derivation - addr1=" MACSTR 129 " addr2=" MACSTR, MAC2STR(addr1), MAC2STR(addr2)); 130 if (os_memcmp(addr1, addr2, ETH_ALEN) > 0) { 131 os_memcpy(key, addr1, ETH_ALEN); 132 os_memcpy(key + ETH_ALEN, addr2, ETH_ALEN); 133 } else { 134 os_memcpy(key, addr2, ETH_ALEN); 135 os_memcpy(key + ETH_ALEN, addr1, ETH_ALEN); 136 } 137} 138 139 140static int sae_test_pwd_seed_ecc(struct sae_data *sae, const u8 *pwd_seed, 141 const u8 *prime, const u8 *qr, const u8 *qnr, 142 u8 *pwd_value) 143{ 144 struct crypto_bignum *y_sqr, *x_cand; 145 int res; 146 size_t bits; 147 int cmp_prime; 148 unsigned int in_range; 149 150 wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-seed", pwd_seed, SHA256_MAC_LEN); 151 152 /* pwd-value = KDF-z(pwd-seed, "SAE Hunting and Pecking", p) */ 153 bits = crypto_ec_prime_len_bits(sae->tmp->ec); 154 if (sha256_prf_bits(pwd_seed, SHA256_MAC_LEN, "SAE Hunting and Pecking", 155 prime, sae->tmp->prime_len, pwd_value, bits) < 0) 156 return -1; 157 if (bits % 8) 158 buf_shift_right(pwd_value, sae->tmp->prime_len, 8 - bits % 8); 159 wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value", 160 pwd_value, sae->tmp->prime_len); 161 162 cmp_prime = const_time_memcmp(pwd_value, prime, sae->tmp->prime_len); 163 /* Create a const_time mask for selection based on prf result 164 * being smaller than prime. */ 165 in_range = const_time_fill_msb((unsigned int) cmp_prime); 166 /* The algorithm description would skip the next steps if 167 * cmp_prime >= 0 (reutnr 0 here), but go through them regardless to 168 * minimize externally observable differences in behavior. */ 169 170 x_cand = crypto_bignum_init_set(pwd_value, sae->tmp->prime_len); 171 if (!x_cand) 172 return -1; 173 y_sqr = crypto_ec_point_compute_y_sqr(sae->tmp->ec, x_cand); 174 crypto_bignum_deinit(x_cand, 1); 175 if (!y_sqr) 176 return -1; 177 178 res = dragonfly_is_quadratic_residue_blind(sae->tmp->ec, qr, qnr, 179 y_sqr); 180 crypto_bignum_deinit(y_sqr, 1); 181 if (res < 0) 182 return res; 183 return const_time_select_int(in_range, res, 0); 184} 185 186 187/* Returns -1 on fatal failure, 0 if PWE cannot be derived from the provided 188 * pwd-seed, or 1 if a valid PWE was derived from pwd-seed. */ 189static int sae_test_pwd_seed_ffc(struct sae_data *sae, const u8 *pwd_seed, 190 struct crypto_bignum *pwe) 191{ 192 u8 pwd_value[SAE_MAX_PRIME_LEN]; 193 size_t bits = sae->tmp->prime_len * 8; 194 u8 exp[1]; 195 struct crypto_bignum *a, *b = NULL; 196 int res, is_val; 197 u8 pwd_value_valid; 198 199 wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-seed", pwd_seed, SHA256_MAC_LEN); 200 201 /* pwd-value = KDF-z(pwd-seed, "SAE Hunting and Pecking", p) */ 202 if (sha256_prf_bits(pwd_seed, SHA256_MAC_LEN, "SAE Hunting and Pecking", 203 sae->tmp->dh->prime, sae->tmp->prime_len, pwd_value, 204 bits) < 0) 205 return -1; 206 wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value", pwd_value, 207 sae->tmp->prime_len); 208 209 /* Check whether pwd-value < p */ 210 res = const_time_memcmp(pwd_value, sae->tmp->dh->prime, 211 sae->tmp->prime_len); 212 /* pwd-value >= p is invalid, so res is < 0 for the valid cases and 213 * the negative sign can be used to fill the mask for constant time 214 * selection */ 215 pwd_value_valid = const_time_fill_msb(res); 216 217 /* If pwd-value >= p, force pwd-value to be < p and perform the 218 * calculations anyway to hide timing difference. The derived PWE will 219 * be ignored in that case. */ 220 pwd_value[0] = const_time_select_u8(pwd_value_valid, pwd_value[0], 0); 221 222 /* PWE = pwd-value^((p-1)/r) modulo p */ 223 224 res = -1; 225 a = crypto_bignum_init_set(pwd_value, sae->tmp->prime_len); 226 if (!a) 227 goto fail; 228 229 /* This is an optimization based on the used group that does not depend 230 * on the password in any way, so it is fine to use separate branches 231 * for this step without constant time operations. */ 232 if (sae->tmp->dh->safe_prime) { 233 /* 234 * r = (p-1)/2 for the group used here, so this becomes: 235 * PWE = pwd-value^2 modulo p 236 */ 237 exp[0] = 2; 238 b = crypto_bignum_init_set(exp, sizeof(exp)); 239 } else { 240 /* Calculate exponent: (p-1)/r */ 241 exp[0] = 1; 242 b = crypto_bignum_init_set(exp, sizeof(exp)); 243 if (b == NULL || 244 crypto_bignum_sub(sae->tmp->prime, b, b) < 0 || 245 crypto_bignum_div(b, sae->tmp->order, b) < 0) 246 goto fail; 247 } 248 249 if (!b) 250 goto fail; 251 252 res = crypto_bignum_exptmod(a, b, sae->tmp->prime, pwe); 253 if (res < 0) 254 goto fail; 255 256 /* There were no fatal errors in calculations, so determine the return 257 * value using constant time operations. We get here for number of 258 * invalid cases which are cleared here after having performed all the 259 * computation. PWE is valid if pwd-value was less than prime and 260 * PWE > 1. Start with pwd-value check first and then use constant time 261 * operations to clear res to 0 if PWE is 0 or 1. 262 */ 263 res = const_time_select_u8(pwd_value_valid, 1, 0); 264 is_val = crypto_bignum_is_zero(pwe); 265 res = const_time_select_u8(const_time_is_zero(is_val), res, 0); 266 is_val = crypto_bignum_is_one(pwe); 267 res = const_time_select_u8(const_time_is_zero(is_val), res, 0); 268 269fail: 270 crypto_bignum_deinit(a, 1); 271 crypto_bignum_deinit(b, 1); 272 return res; 273} 274 275 276static int sae_derive_pwe_ecc(struct sae_data *sae, const u8 *addr1, 277 const u8 *addr2, const u8 *password, 278 size_t password_len, const char *identifier) 279{ 280 u8 counter, k; 281 u8 addrs[2 * ETH_ALEN]; 282 const u8 *addr[3]; 283 size_t len[3]; 284 size_t num_elem; 285 u8 *dummy_password, *tmp_password; 286 int pwd_seed_odd = 0; 287 u8 prime[SAE_MAX_ECC_PRIME_LEN]; 288 size_t prime_len; 289 struct crypto_bignum *x = NULL, *qr = NULL, *qnr = NULL; 290 u8 x_bin[SAE_MAX_ECC_PRIME_LEN]; 291 u8 x_cand_bin[SAE_MAX_ECC_PRIME_LEN]; 292 u8 qr_bin[SAE_MAX_ECC_PRIME_LEN]; 293 u8 qnr_bin[SAE_MAX_ECC_PRIME_LEN]; 294 int res = -1; 295 u8 found = 0; /* 0 (false) or 0xff (true) to be used as const_time_* 296 * mask */ 297 298 os_memset(x_bin, 0, sizeof(x_bin)); 299 300 dummy_password = os_malloc(password_len); 301 tmp_password = os_malloc(password_len); 302 if (!dummy_password || !tmp_password || 303 random_get_bytes(dummy_password, password_len) < 0) 304 goto fail; 305 306 prime_len = sae->tmp->prime_len; 307 if (crypto_bignum_to_bin(sae->tmp->prime, prime, sizeof(prime), 308 prime_len) < 0) 309 goto fail; 310 311 /* 312 * Create a random quadratic residue (qr) and quadratic non-residue 313 * (qnr) modulo p for blinding purposes during the loop. 314 */ 315 if (dragonfly_get_random_qr_qnr(sae->tmp->prime, &qr, &qnr) < 0 || 316 crypto_bignum_to_bin(qr, qr_bin, sizeof(qr_bin), prime_len) < 0 || 317 crypto_bignum_to_bin(qnr, qnr_bin, sizeof(qnr_bin), prime_len) < 0) 318 goto fail; 319 320 wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password", 321 password, password_len); 322 if (identifier) 323 wpa_printf(MSG_DEBUG, "SAE: password identifier: %s", 324 identifier); 325 326 /* 327 * H(salt, ikm) = HMAC-SHA256(salt, ikm) 328 * base = password [|| identifier] 329 * pwd-seed = H(MAX(STA-A-MAC, STA-B-MAC) || MIN(STA-A-MAC, STA-B-MAC), 330 * base || counter) 331 */ 332 sae_pwd_seed_key(addr1, addr2, addrs); 333 334 addr[0] = tmp_password; 335 len[0] = password_len; 336 num_elem = 1; 337 if (identifier) { 338 addr[num_elem] = (const u8 *) identifier; 339 len[num_elem] = os_strlen(identifier); 340 num_elem++; 341 } 342 addr[num_elem] = &counter; 343 len[num_elem] = sizeof(counter); 344 num_elem++; 345 346 /* 347 * Continue for at least k iterations to protect against side-channel 348 * attacks that attempt to determine the number of iterations required 349 * in the loop. 350 */ 351 k = dragonfly_min_pwe_loop_iter(sae->group); 352 353 for (counter = 1; counter <= k || !found; counter++) { 354 u8 pwd_seed[SHA256_MAC_LEN]; 355 356 if (counter > 200) { 357 /* This should not happen in practice */ 358 wpa_printf(MSG_DEBUG, "SAE: Failed to derive PWE"); 359 break; 360 } 361 362 wpa_printf(MSG_DEBUG, "SAE: counter = %03u", counter); 363 const_time_select_bin(found, dummy_password, password, 364 password_len, tmp_password); 365 if (hmac_sha256_vector(addrs, sizeof(addrs), num_elem, 366 addr, len, pwd_seed) < 0) 367 break; 368 369 res = sae_test_pwd_seed_ecc(sae, pwd_seed, 370 prime, qr_bin, qnr_bin, x_cand_bin); 371 const_time_select_bin(found, x_bin, x_cand_bin, prime_len, 372 x_bin); 373 pwd_seed_odd = const_time_select_u8( 374 found, pwd_seed_odd, 375 pwd_seed[SHA256_MAC_LEN - 1] & 0x01); 376 os_memset(pwd_seed, 0, sizeof(pwd_seed)); 377 if (res < 0) 378 goto fail; 379 /* Need to minimize differences in handling res == 0 and 1 here 380 * to avoid differences in timing and instruction cache access, 381 * so use const_time_select_*() to make local copies of the 382 * values based on whether this loop iteration was the one that 383 * found the pwd-seed/x. */ 384 385 /* found is 0 or 0xff here and res is 0 or 1. Bitwise OR of them 386 * (with res converted to 0/0xff) handles this in constant time. 387 */ 388 found |= res * 0xff; 389 wpa_printf(MSG_DEBUG, "SAE: pwd-seed result %d found=0x%02x", 390 res, found); 391 } 392 393 if (!found) { 394 wpa_printf(MSG_DEBUG, "SAE: Could not generate PWE"); 395 res = -1; 396 goto fail; 397 } 398 399 x = crypto_bignum_init_set(x_bin, prime_len); 400 if (!x) { 401 res = -1; 402 goto fail; 403 } 404 405 if (!sae->tmp->pwe_ecc) 406 sae->tmp->pwe_ecc = crypto_ec_point_init(sae->tmp->ec); 407 if (!sae->tmp->pwe_ecc) 408 res = -1; 409 else 410 res = crypto_ec_point_solve_y_coord(sae->tmp->ec, 411 sae->tmp->pwe_ecc, x, 412 pwd_seed_odd); 413 if (res < 0) { 414 /* 415 * This should not happen since we already checked that there 416 * is a result. 417 */ 418 wpa_printf(MSG_DEBUG, "SAE: Could not solve y"); 419 } 420 421fail: 422 crypto_bignum_deinit(qr, 0); 423 crypto_bignum_deinit(qnr, 0); 424 os_free(dummy_password); 425 bin_clear_free(tmp_password, password_len); 426 crypto_bignum_deinit(x, 1); 427 os_memset(x_bin, 0, sizeof(x_bin)); 428 os_memset(x_cand_bin, 0, sizeof(x_cand_bin)); 429 430 return res; 431} 432 433 434static int sae_modp_group_require_masking(int group) 435{ 436 /* Groups for which pwd-value is likely to be >= p frequently */ 437 return group == 22 || group == 23 || group == 24; 438} 439 440 441static int sae_derive_pwe_ffc(struct sae_data *sae, const u8 *addr1, 442 const u8 *addr2, const u8 *password, 443 size_t password_len, const char *identifier) 444{ 445 u8 counter, k, sel_counter = 0; 446 u8 addrs[2 * ETH_ALEN]; 447 const u8 *addr[3]; 448 size_t len[3]; 449 size_t num_elem; 450 u8 found = 0; /* 0 (false) or 0xff (true) to be used as const_time_* 451 * mask */ 452 u8 mask; 453 struct crypto_bignum *pwe; 454 size_t prime_len = sae->tmp->prime_len * 8; 455 u8 *pwe_buf; 456 457 crypto_bignum_deinit(sae->tmp->pwe_ffc, 1); 458 sae->tmp->pwe_ffc = NULL; 459 460 /* Allocate a buffer to maintain selected and candidate PWE for constant 461 * time selection. */ 462 pwe_buf = os_zalloc(prime_len * 2); 463 pwe = crypto_bignum_init(); 464 if (!pwe_buf || !pwe) 465 goto fail; 466 467 wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password", 468 password, password_len); 469 470 /* 471 * H(salt, ikm) = HMAC-SHA256(salt, ikm) 472 * pwd-seed = H(MAX(STA-A-MAC, STA-B-MAC) || MIN(STA-A-MAC, STA-B-MAC), 473 * password [|| identifier] || counter) 474 */ 475 sae_pwd_seed_key(addr1, addr2, addrs); 476 477 addr[0] = password; 478 len[0] = password_len; 479 num_elem = 1; 480 if (identifier) { 481 addr[num_elem] = (const u8 *) identifier; 482 len[num_elem] = os_strlen(identifier); 483 num_elem++; 484 } 485 addr[num_elem] = &counter; 486 len[num_elem] = sizeof(counter); 487 num_elem++; 488 489 k = dragonfly_min_pwe_loop_iter(sae->group); 490 491 for (counter = 1; counter <= k || !found; counter++) { 492 u8 pwd_seed[SHA256_MAC_LEN]; 493 int res; 494 495 if (counter > 200) { 496 /* This should not happen in practice */ 497 wpa_printf(MSG_DEBUG, "SAE: Failed to derive PWE"); 498 break; 499 } 500 501 wpa_printf(MSG_DEBUG, "SAE: counter = %02u", counter); 502 if (hmac_sha256_vector(addrs, sizeof(addrs), num_elem, 503 addr, len, pwd_seed) < 0) 504 break; 505 res = sae_test_pwd_seed_ffc(sae, pwd_seed, pwe); 506 /* res is -1 for fatal failure, 0 if a valid PWE was not found, 507 * or 1 if a valid PWE was found. */ 508 if (res < 0) 509 break; 510 /* Store the candidate PWE into the second half of pwe_buf and 511 * the selected PWE in the beginning of pwe_buf using constant 512 * time selection. */ 513 if (crypto_bignum_to_bin(pwe, pwe_buf + prime_len, prime_len, 514 prime_len) < 0) 515 break; 516 const_time_select_bin(found, pwe_buf, pwe_buf + prime_len, 517 prime_len, pwe_buf); 518 sel_counter = const_time_select_u8(found, sel_counter, counter); 519 mask = const_time_eq_u8(res, 1); 520 found = const_time_select_u8(found, found, mask); 521 } 522 523 if (!found) 524 goto fail; 525 526 wpa_printf(MSG_DEBUG, "SAE: Use PWE from counter = %02u", sel_counter); 527 sae->tmp->pwe_ffc = crypto_bignum_init_set(pwe_buf, prime_len); 528fail: 529 crypto_bignum_deinit(pwe, 1); 530 bin_clear_free(pwe_buf, prime_len * 2); 531 return sae->tmp->pwe_ffc ? 0 : -1; 532} 533 534 535static int sae_derive_commit_element_ecc(struct sae_data *sae, 536 struct crypto_bignum *mask) 537{ 538 /* COMMIT-ELEMENT = inverse(scalar-op(mask, PWE)) */ 539 if (!sae->tmp->own_commit_element_ecc) { 540 sae->tmp->own_commit_element_ecc = 541 crypto_ec_point_init(sae->tmp->ec); 542 if (!sae->tmp->own_commit_element_ecc) 543 return -1; 544 } 545 546 if (crypto_ec_point_mul(sae->tmp->ec, sae->tmp->pwe_ecc, mask, 547 sae->tmp->own_commit_element_ecc) < 0 || 548 crypto_ec_point_invert(sae->tmp->ec, 549 sae->tmp->own_commit_element_ecc) < 0) { 550 wpa_printf(MSG_DEBUG, "SAE: Could not compute commit-element"); 551 return -1; 552 } 553 554 return 0; 555} 556 557 558static int sae_derive_commit_element_ffc(struct sae_data *sae, 559 struct crypto_bignum *mask) 560{ 561 /* COMMIT-ELEMENT = inverse(scalar-op(mask, PWE)) */ 562 if (!sae->tmp->own_commit_element_ffc) { 563 sae->tmp->own_commit_element_ffc = crypto_bignum_init(); 564 if (!sae->tmp->own_commit_element_ffc) 565 return -1; 566 } 567 568 if (crypto_bignum_exptmod(sae->tmp->pwe_ffc, mask, sae->tmp->prime, 569 sae->tmp->own_commit_element_ffc) < 0 || 570 crypto_bignum_inverse(sae->tmp->own_commit_element_ffc, 571 sae->tmp->prime, 572 sae->tmp->own_commit_element_ffc) < 0) { 573 wpa_printf(MSG_DEBUG, "SAE: Could not compute commit-element"); 574 return -1; 575 } 576 577 return 0; 578} 579 580 581static int sae_derive_commit(struct sae_data *sae) 582{ 583 struct crypto_bignum *mask; 584 int ret; 585 586 mask = crypto_bignum_init(); 587 if (!sae->tmp->sae_rand) 588 sae->tmp->sae_rand = crypto_bignum_init(); 589 if (!sae->tmp->own_commit_scalar) 590 sae->tmp->own_commit_scalar = crypto_bignum_init(); 591 ret = !mask || !sae->tmp->sae_rand || !sae->tmp->own_commit_scalar || 592 dragonfly_generate_scalar(sae->tmp->order, sae->tmp->sae_rand, 593 mask, 594 sae->tmp->own_commit_scalar) < 0 || 595 (sae->tmp->ec && 596 sae_derive_commit_element_ecc(sae, mask) < 0) || 597 (sae->tmp->dh && 598 sae_derive_commit_element_ffc(sae, mask) < 0); 599 crypto_bignum_deinit(mask, 1); 600 return ret ? -1 : 0; 601} 602 603 604int sae_prepare_commit(const u8 *addr1, const u8 *addr2, 605 const u8 *password, size_t password_len, 606 const char *identifier, struct sae_data *sae) 607{ 608 if (sae->tmp == NULL || 609 (sae->tmp->ec && sae_derive_pwe_ecc(sae, addr1, addr2, password, 610 password_len, 611 identifier) < 0) || 612 (sae->tmp->dh && sae_derive_pwe_ffc(sae, addr1, addr2, password, 613 password_len, 614 identifier) < 0) || 615 sae_derive_commit(sae) < 0) 616 return -1; 617 return 0; 618} 619 620 621static int sae_derive_k_ecc(struct sae_data *sae, u8 *k) 622{ 623 struct crypto_ec_point *K; 624 int ret = -1; 625 626 K = crypto_ec_point_init(sae->tmp->ec); 627 if (K == NULL) 628 goto fail; 629 630 /* 631 * K = scalar-op(rand, (elem-op(scalar-op(peer-commit-scalar, PWE), 632 * PEER-COMMIT-ELEMENT))) 633 * If K is identity element (point-at-infinity), reject 634 * k = F(K) (= x coordinate) 635 */ 636 637 if (crypto_ec_point_mul(sae->tmp->ec, sae->tmp->pwe_ecc, 638 sae->peer_commit_scalar, K) < 0 || 639 crypto_ec_point_add(sae->tmp->ec, K, 640 sae->tmp->peer_commit_element_ecc, K) < 0 || 641 crypto_ec_point_mul(sae->tmp->ec, K, sae->tmp->sae_rand, K) < 0 || 642 crypto_ec_point_is_at_infinity(sae->tmp->ec, K) || 643 crypto_ec_point_to_bin(sae->tmp->ec, K, k, NULL) < 0) { 644 wpa_printf(MSG_DEBUG, "SAE: Failed to calculate K and k"); 645 goto fail; 646 } 647 648 wpa_hexdump_key(MSG_DEBUG, "SAE: k", k, sae->tmp->prime_len); 649 650 ret = 0; 651fail: 652 crypto_ec_point_deinit(K, 1); 653 return ret; 654} 655 656 657static int sae_derive_k_ffc(struct sae_data *sae, u8 *k) 658{ 659 struct crypto_bignum *K; 660 int ret = -1; 661 662 K = crypto_bignum_init(); 663 if (K == NULL) 664 goto fail; 665 666 /* 667 * K = scalar-op(rand, (elem-op(scalar-op(peer-commit-scalar, PWE), 668 * PEER-COMMIT-ELEMENT))) 669 * If K is identity element (one), reject. 670 * k = F(K) (= x coordinate) 671 */ 672 673 if (crypto_bignum_exptmod(sae->tmp->pwe_ffc, sae->peer_commit_scalar, 674 sae->tmp->prime, K) < 0 || 675 crypto_bignum_mulmod(K, sae->tmp->peer_commit_element_ffc, 676 sae->tmp->prime, K) < 0 || 677 crypto_bignum_exptmod(K, sae->tmp->sae_rand, sae->tmp->prime, K) < 0 678 || 679 crypto_bignum_is_one(K) || 680 crypto_bignum_to_bin(K, k, SAE_MAX_PRIME_LEN, sae->tmp->prime_len) < 681 0) { 682 wpa_printf(MSG_DEBUG, "SAE: Failed to calculate K and k"); 683 goto fail; 684 } 685 686 wpa_hexdump_key(MSG_DEBUG, "SAE: k", k, sae->tmp->prime_len); 687 688 ret = 0; 689fail: 690 crypto_bignum_deinit(K, 1); 691 return ret; 692} 693 694 695static int sae_derive_keys(struct sae_data *sae, const u8 *k) 696{ 697 u8 null_key[SAE_KEYSEED_KEY_LEN], val[SAE_MAX_PRIME_LEN]; 698 u8 keyseed[SHA256_MAC_LEN]; 699 u8 keys[SAE_KCK_LEN + SAE_PMK_LEN]; 700 struct crypto_bignum *tmp; 701 int ret = -1; 702 703 tmp = crypto_bignum_init(); 704 if (tmp == NULL) 705 goto fail; 706 707 /* keyseed = H(<0>32, k) 708 * KCK || PMK = KDF-512(keyseed, "SAE KCK and PMK", 709 * (commit-scalar + peer-commit-scalar) modulo r) 710 * PMKID = L((commit-scalar + peer-commit-scalar) modulo r, 0, 128) 711 */ 712 713 os_memset(null_key, 0, sizeof(null_key)); 714 hmac_sha256(null_key, sizeof(null_key), k, sae->tmp->prime_len, 715 keyseed); 716 wpa_hexdump_key(MSG_DEBUG, "SAE: keyseed", keyseed, sizeof(keyseed)); 717 718 crypto_bignum_add(sae->tmp->own_commit_scalar, sae->peer_commit_scalar, 719 tmp); 720 crypto_bignum_mod(tmp, sae->tmp->order, tmp); 721 /* IEEE Std 802.11-2016 is not exactly clear on the encoding of the bit 722 * string that is needed for KCK, PMK, and PMKID derivation, but it 723 * seems to make most sense to encode the 724 * (commit-scalar + peer-commit-scalar) mod r part as a bit string by 725 * zero padding it from left to the length of the order (in full 726 * octets). */ 727 crypto_bignum_to_bin(tmp, val, sizeof(val), sae->tmp->order_len); 728 wpa_hexdump(MSG_DEBUG, "SAE: PMKID", val, SAE_PMKID_LEN); 729 if (sha256_prf(keyseed, sizeof(keyseed), "SAE KCK and PMK", 730 val, sae->tmp->order_len, keys, sizeof(keys)) < 0) 731 goto fail; 732 os_memset(keyseed, 0, sizeof(keyseed)); 733 os_memcpy(sae->tmp->kck, keys, SAE_KCK_LEN); 734 os_memcpy(sae->pmk, keys + SAE_KCK_LEN, SAE_PMK_LEN); 735 os_memcpy(sae->pmkid, val, SAE_PMKID_LEN); 736 os_memset(keys, 0, sizeof(keys)); 737 wpa_hexdump_key(MSG_DEBUG, "SAE: KCK", sae->tmp->kck, SAE_KCK_LEN); 738 wpa_hexdump_key(MSG_DEBUG, "SAE: PMK", sae->pmk, SAE_PMK_LEN); 739 740 ret = 0; 741fail: 742 crypto_bignum_deinit(tmp, 0); 743 return ret; 744} 745 746 747int sae_process_commit(struct sae_data *sae) 748{ 749 u8 k[SAE_MAX_PRIME_LEN]; 750 if (sae->tmp == NULL || 751 (sae->tmp->ec && sae_derive_k_ecc(sae, k) < 0) || 752 (sae->tmp->dh && sae_derive_k_ffc(sae, k) < 0) || 753 sae_derive_keys(sae, k) < 0) 754 return -1; 755 return 0; 756} 757 758 759void sae_write_commit(struct sae_data *sae, struct wpabuf *buf, 760 const struct wpabuf *token, const char *identifier) 761{ 762 u8 *pos; 763 764 if (sae->tmp == NULL) 765 return; 766 767 wpabuf_put_le16(buf, sae->group); /* Finite Cyclic Group */ 768 if (token) { 769 wpabuf_put_buf(buf, token); 770 wpa_hexdump(MSG_DEBUG, "SAE: Anti-clogging token", 771 wpabuf_head(token), wpabuf_len(token)); 772 } 773 pos = wpabuf_put(buf, sae->tmp->prime_len); 774 crypto_bignum_to_bin(sae->tmp->own_commit_scalar, pos, 775 sae->tmp->prime_len, sae->tmp->prime_len); 776 wpa_hexdump(MSG_DEBUG, "SAE: own commit-scalar", 777 pos, sae->tmp->prime_len); 778 if (sae->tmp->ec) { 779 pos = wpabuf_put(buf, 2 * sae->tmp->prime_len); 780 crypto_ec_point_to_bin(sae->tmp->ec, 781 sae->tmp->own_commit_element_ecc, 782 pos, pos + sae->tmp->prime_len); 783 wpa_hexdump(MSG_DEBUG, "SAE: own commit-element(x)", 784 pos, sae->tmp->prime_len); 785 wpa_hexdump(MSG_DEBUG, "SAE: own commit-element(y)", 786 pos + sae->tmp->prime_len, sae->tmp->prime_len); 787 } else { 788 pos = wpabuf_put(buf, sae->tmp->prime_len); 789 crypto_bignum_to_bin(sae->tmp->own_commit_element_ffc, pos, 790 sae->tmp->prime_len, sae->tmp->prime_len); 791 wpa_hexdump(MSG_DEBUG, "SAE: own commit-element", 792 pos, sae->tmp->prime_len); 793 } 794 795 if (identifier) { 796 /* Password Identifier element */ 797 wpabuf_put_u8(buf, WLAN_EID_EXTENSION); 798 wpabuf_put_u8(buf, 1 + os_strlen(identifier)); 799 wpabuf_put_u8(buf, WLAN_EID_EXT_PASSWORD_IDENTIFIER); 800 wpabuf_put_str(buf, identifier); 801 wpa_printf(MSG_DEBUG, "SAE: own Password Identifier: %s", 802 identifier); 803 } 804} 805 806 807u16 sae_group_allowed(struct sae_data *sae, int *allowed_groups, u16 group) 808{ 809 if (allowed_groups) { 810 int i; 811 for (i = 0; allowed_groups[i] > 0; i++) { 812 if (allowed_groups[i] == group) 813 break; 814 } 815 if (allowed_groups[i] != group) { 816 wpa_printf(MSG_DEBUG, "SAE: Proposed group %u not " 817 "enabled in the current configuration", 818 group); 819 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED; 820 } 821 } 822 823 if (sae->state == SAE_COMMITTED && group != sae->group) { 824 wpa_printf(MSG_DEBUG, "SAE: Do not allow group to be changed"); 825 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED; 826 } 827 828 if (group != sae->group && sae_set_group(sae, group) < 0) { 829 wpa_printf(MSG_DEBUG, "SAE: Unsupported Finite Cyclic Group %u", 830 group); 831 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED; 832 } 833 834 if (sae->tmp == NULL) { 835 wpa_printf(MSG_DEBUG, "SAE: Group information not yet initialized"); 836 return WLAN_STATUS_UNSPECIFIED_FAILURE; 837 } 838 839 if (sae->tmp->dh && !allowed_groups) { 840 wpa_printf(MSG_DEBUG, "SAE: Do not allow FFC group %u without " 841 "explicit configuration enabling it", group); 842 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED; 843 } 844 845 return WLAN_STATUS_SUCCESS; 846} 847 848 849static int sae_is_password_id_elem(const u8 *pos, const u8 *end) 850{ 851 return end - pos >= 3 && 852 pos[0] == WLAN_EID_EXTENSION && 853 pos[1] >= 1 && 854 end - pos - 2 >= pos[1] && 855 pos[2] == WLAN_EID_EXT_PASSWORD_IDENTIFIER; 856} 857 858 859static void sae_parse_commit_token(struct sae_data *sae, const u8 **pos, 860 const u8 *end, const u8 **token, 861 size_t *token_len) 862{ 863 size_t scalar_elem_len, tlen; 864 const u8 *elem; 865 866 if (token) 867 *token = NULL; 868 if (token_len) 869 *token_len = 0; 870 871 scalar_elem_len = (sae->tmp->ec ? 3 : 2) * sae->tmp->prime_len; 872 if (scalar_elem_len >= (size_t) (end - *pos)) 873 return; /* No extra data beyond peer scalar and element */ 874 875 /* It is a bit difficult to parse this now that there is an 876 * optional variable length Anti-Clogging Token field and 877 * optional variable length Password Identifier element in the 878 * frame. We are sending out fixed length Anti-Clogging Token 879 * fields, so use that length as a requirement for the received 880 * token and check for the presence of possible Password 881 * Identifier element based on the element header information. 882 */ 883 tlen = end - (*pos + scalar_elem_len); 884 885 if (tlen < SHA256_MAC_LEN) { 886 wpa_printf(MSG_DEBUG, 887 "SAE: Too short optional data (%u octets) to include our Anti-Clogging Token", 888 (unsigned int) tlen); 889 return; 890 } 891 892 elem = *pos + scalar_elem_len; 893 if (sae_is_password_id_elem(elem, end)) { 894 /* Password Identifier element takes out all available 895 * extra octets, so there can be no Anti-Clogging token in 896 * this frame. */ 897 return; 898 } 899 900 elem += SHA256_MAC_LEN; 901 if (sae_is_password_id_elem(elem, end)) { 902 /* Password Identifier element is included in the end, so 903 * remove its length from the Anti-Clogging token field. */ 904 tlen -= 2 + elem[1]; 905 } 906 907 wpa_hexdump(MSG_DEBUG, "SAE: Anti-Clogging Token", *pos, tlen); 908 if (token) 909 *token = *pos; 910 if (token_len) 911 *token_len = tlen; 912 *pos += tlen; 913} 914 915 916static u16 sae_parse_commit_scalar(struct sae_data *sae, const u8 **pos, 917 const u8 *end) 918{ 919 struct crypto_bignum *peer_scalar; 920 921 if (sae->tmp->prime_len > end - *pos) { 922 wpa_printf(MSG_DEBUG, "SAE: Not enough data for scalar"); 923 return WLAN_STATUS_UNSPECIFIED_FAILURE; 924 } 925 926 peer_scalar = crypto_bignum_init_set(*pos, sae->tmp->prime_len); 927 if (peer_scalar == NULL) 928 return WLAN_STATUS_UNSPECIFIED_FAILURE; 929 930 /* 931 * IEEE Std 802.11-2012, 11.3.8.6.1: If there is a protocol instance for 932 * the peer and it is in Authenticated state, the new Commit Message 933 * shall be dropped if the peer-scalar is identical to the one used in 934 * the existing protocol instance. 935 */ 936 if (sae->state == SAE_ACCEPTED && sae->peer_commit_scalar && 937 crypto_bignum_cmp(sae->peer_commit_scalar, peer_scalar) == 0) { 938 wpa_printf(MSG_DEBUG, "SAE: Do not accept re-use of previous " 939 "peer-commit-scalar"); 940 crypto_bignum_deinit(peer_scalar, 0); 941 return WLAN_STATUS_UNSPECIFIED_FAILURE; 942 } 943 944 /* 1 < scalar < r */ 945 if (crypto_bignum_is_zero(peer_scalar) || 946 crypto_bignum_is_one(peer_scalar) || 947 crypto_bignum_cmp(peer_scalar, sae->tmp->order) >= 0) { 948 wpa_printf(MSG_DEBUG, "SAE: Invalid peer scalar"); 949 crypto_bignum_deinit(peer_scalar, 0); 950 return WLAN_STATUS_UNSPECIFIED_FAILURE; 951 } 952 953 954 crypto_bignum_deinit(sae->peer_commit_scalar, 0); 955 sae->peer_commit_scalar = peer_scalar; 956 wpa_hexdump(MSG_DEBUG, "SAE: Peer commit-scalar", 957 *pos, sae->tmp->prime_len); 958 *pos += sae->tmp->prime_len; 959 960 return WLAN_STATUS_SUCCESS; 961} 962 963 964static u16 sae_parse_commit_element_ecc(struct sae_data *sae, const u8 **pos, 965 const u8 *end) 966{ 967 u8 prime[SAE_MAX_ECC_PRIME_LEN]; 968 969 if (2 * sae->tmp->prime_len > end - *pos) { 970 wpa_printf(MSG_DEBUG, "SAE: Not enough data for " 971 "commit-element"); 972 return WLAN_STATUS_UNSPECIFIED_FAILURE; 973 } 974 975 if (crypto_bignum_to_bin(sae->tmp->prime, prime, sizeof(prime), 976 sae->tmp->prime_len) < 0) 977 return WLAN_STATUS_UNSPECIFIED_FAILURE; 978 979 /* element x and y coordinates < p */ 980 if (os_memcmp(*pos, prime, sae->tmp->prime_len) >= 0 || 981 os_memcmp(*pos + sae->tmp->prime_len, prime, 982 sae->tmp->prime_len) >= 0) { 983 wpa_printf(MSG_DEBUG, "SAE: Invalid coordinates in peer " 984 "element"); 985 return WLAN_STATUS_UNSPECIFIED_FAILURE; 986 } 987 988 wpa_hexdump(MSG_DEBUG, "SAE: Peer commit-element(x)", 989 *pos, sae->tmp->prime_len); 990 wpa_hexdump(MSG_DEBUG, "SAE: Peer commit-element(y)", 991 *pos + sae->tmp->prime_len, sae->tmp->prime_len); 992 993 crypto_ec_point_deinit(sae->tmp->peer_commit_element_ecc, 0); 994 sae->tmp->peer_commit_element_ecc = 995 crypto_ec_point_from_bin(sae->tmp->ec, *pos); 996 if (sae->tmp->peer_commit_element_ecc == NULL) 997 return WLAN_STATUS_UNSPECIFIED_FAILURE; 998 999 if (!crypto_ec_point_is_on_curve(sae->tmp->ec, 1000 sae->tmp->peer_commit_element_ecc)) { 1001 wpa_printf(MSG_DEBUG, "SAE: Peer element is not on curve"); 1002 return WLAN_STATUS_UNSPECIFIED_FAILURE; 1003 } 1004 1005 *pos += 2 * sae->tmp->prime_len; 1006 1007 return WLAN_STATUS_SUCCESS; 1008} 1009 1010 1011static u16 sae_parse_commit_element_ffc(struct sae_data *sae, const u8 **pos, 1012 const u8 *end) 1013{ 1014 struct crypto_bignum *res, *one; 1015 const u8 one_bin[1] = { 0x01 }; 1016 1017 if (sae->tmp->prime_len > end - *pos) { 1018 wpa_printf(MSG_DEBUG, "SAE: Not enough data for " 1019 "commit-element"); 1020 return WLAN_STATUS_UNSPECIFIED_FAILURE; 1021 } 1022 wpa_hexdump(MSG_DEBUG, "SAE: Peer commit-element", *pos, 1023 sae->tmp->prime_len); 1024 1025 crypto_bignum_deinit(sae->tmp->peer_commit_element_ffc, 0); 1026 sae->tmp->peer_commit_element_ffc = 1027 crypto_bignum_init_set(*pos, sae->tmp->prime_len); 1028 if (sae->tmp->peer_commit_element_ffc == NULL) 1029 return WLAN_STATUS_UNSPECIFIED_FAILURE; 1030 /* 1 < element < p - 1 */ 1031 res = crypto_bignum_init(); 1032 one = crypto_bignum_init_set(one_bin, sizeof(one_bin)); 1033 if (!res || !one || 1034 crypto_bignum_sub(sae->tmp->prime, one, res) || 1035 crypto_bignum_is_zero(sae->tmp->peer_commit_element_ffc) || 1036 crypto_bignum_is_one(sae->tmp->peer_commit_element_ffc) || 1037 crypto_bignum_cmp(sae->tmp->peer_commit_element_ffc, res) >= 0) { 1038 crypto_bignum_deinit(res, 0); 1039 crypto_bignum_deinit(one, 0); 1040 wpa_printf(MSG_DEBUG, "SAE: Invalid peer element"); 1041 return WLAN_STATUS_UNSPECIFIED_FAILURE; 1042 } 1043 crypto_bignum_deinit(one, 0); 1044 1045 /* scalar-op(r, ELEMENT) = 1 modulo p */ 1046 if (crypto_bignum_exptmod(sae->tmp->peer_commit_element_ffc, 1047 sae->tmp->order, sae->tmp->prime, res) < 0 || 1048 !crypto_bignum_is_one(res)) { 1049 wpa_printf(MSG_DEBUG, "SAE: Invalid peer element (scalar-op)"); 1050 crypto_bignum_deinit(res, 0); 1051 return WLAN_STATUS_UNSPECIFIED_FAILURE; 1052 } 1053 crypto_bignum_deinit(res, 0); 1054 1055 *pos += sae->tmp->prime_len; 1056 1057 return WLAN_STATUS_SUCCESS; 1058} 1059 1060 1061static u16 sae_parse_commit_element(struct sae_data *sae, const u8 **pos, 1062 const u8 *end) 1063{ 1064 if (sae->tmp->dh) 1065 return sae_parse_commit_element_ffc(sae, pos, end); 1066 return sae_parse_commit_element_ecc(sae, pos, end); 1067} 1068 1069 1070static int sae_parse_password_identifier(struct sae_data *sae, 1071 const u8 *pos, const u8 *end) 1072{ 1073 wpa_hexdump(MSG_DEBUG, "SAE: Possible elements at the end of the frame", 1074 pos, end - pos); 1075 if (!sae_is_password_id_elem(pos, end)) { 1076 if (sae->tmp->pw_id) { 1077 wpa_printf(MSG_DEBUG, 1078 "SAE: No Password Identifier included, but expected one (%s)", 1079 sae->tmp->pw_id); 1080 return WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER; 1081 } 1082 os_free(sae->tmp->pw_id); 1083 sae->tmp->pw_id = NULL; 1084 return WLAN_STATUS_SUCCESS; /* No Password Identifier */ 1085 } 1086 1087 if (sae->tmp->pw_id && 1088 (pos[1] - 1 != (int) os_strlen(sae->tmp->pw_id) || 1089 os_memcmp(sae->tmp->pw_id, pos + 3, pos[1] - 1) != 0)) { 1090 wpa_printf(MSG_DEBUG, 1091 "SAE: The included Password Identifier does not match the expected one (%s)", 1092 sae->tmp->pw_id); 1093 return WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER; 1094 } 1095 1096 os_free(sae->tmp->pw_id); 1097 sae->tmp->pw_id = os_malloc(pos[1]); 1098 if (!sae->tmp->pw_id) 1099 return WLAN_STATUS_UNSPECIFIED_FAILURE; 1100 os_memcpy(sae->tmp->pw_id, pos + 3, pos[1] - 1); 1101 sae->tmp->pw_id[pos[1] - 1] = '\0'; 1102 wpa_hexdump_ascii(MSG_DEBUG, "SAE: Received Password Identifier", 1103 sae->tmp->pw_id, pos[1] - 1); 1104 return WLAN_STATUS_SUCCESS; 1105} 1106 1107 1108u16 sae_parse_commit(struct sae_data *sae, const u8 *data, size_t len, 1109 const u8 **token, size_t *token_len, int *allowed_groups) 1110{ 1111 const u8 *pos = data, *end = data + len; 1112 u16 res; 1113 1114 /* Check Finite Cyclic Group */ 1115 if (end - pos < 2) 1116 return WLAN_STATUS_UNSPECIFIED_FAILURE; 1117 res = sae_group_allowed(sae, allowed_groups, WPA_GET_LE16(pos)); 1118 if (res != WLAN_STATUS_SUCCESS) 1119 return res; 1120 pos += 2; 1121 1122 /* Optional Anti-Clogging Token */ 1123 sae_parse_commit_token(sae, &pos, end, token, token_len); 1124 1125 /* commit-scalar */ 1126 res = sae_parse_commit_scalar(sae, &pos, end); 1127 if (res != WLAN_STATUS_SUCCESS) 1128 return res; 1129 1130 /* commit-element */ 1131 res = sae_parse_commit_element(sae, &pos, end); 1132 if (res != WLAN_STATUS_SUCCESS) 1133 return res; 1134 1135 /* Optional Password Identifier element */ 1136 res = sae_parse_password_identifier(sae, pos, end); 1137 if (res != WLAN_STATUS_SUCCESS) 1138 return res; 1139 1140 /* 1141 * Check whether peer-commit-scalar and PEER-COMMIT-ELEMENT are same as 1142 * the values we sent which would be evidence of a reflection attack. 1143 */ 1144 if (!sae->tmp->own_commit_scalar || 1145 crypto_bignum_cmp(sae->tmp->own_commit_scalar, 1146 sae->peer_commit_scalar) != 0 || 1147 (sae->tmp->dh && 1148 (!sae->tmp->own_commit_element_ffc || 1149 crypto_bignum_cmp(sae->tmp->own_commit_element_ffc, 1150 sae->tmp->peer_commit_element_ffc) != 0)) || 1151 (sae->tmp->ec && 1152 (!sae->tmp->own_commit_element_ecc || 1153 crypto_ec_point_cmp(sae->tmp->ec, 1154 sae->tmp->own_commit_element_ecc, 1155 sae->tmp->peer_commit_element_ecc) != 0))) 1156 return WLAN_STATUS_SUCCESS; /* scalars/elements are different */ 1157 1158 /* 1159 * This is a reflection attack - return special value to trigger caller 1160 * to silently discard the frame instead of replying with a specific 1161 * status code. 1162 */ 1163 return SAE_SILENTLY_DISCARD; 1164} 1165 1166 1167static void sae_cn_confirm(struct sae_data *sae, const u8 *sc, 1168 const struct crypto_bignum *scalar1, 1169 const u8 *element1, size_t element1_len, 1170 const struct crypto_bignum *scalar2, 1171 const u8 *element2, size_t element2_len, 1172 u8 *confirm) 1173{ 1174 const u8 *addr[5]; 1175 size_t len[5]; 1176 u8 scalar_b1[SAE_MAX_PRIME_LEN], scalar_b2[SAE_MAX_PRIME_LEN]; 1177 1178 /* Confirm 1179 * CN(key, X, Y, Z, ...) = 1180 * HMAC-SHA256(key, D2OS(X) || D2OS(Y) || D2OS(Z) | ...) 1181 * confirm = CN(KCK, send-confirm, commit-scalar, COMMIT-ELEMENT, 1182 * peer-commit-scalar, PEER-COMMIT-ELEMENT) 1183 * verifier = CN(KCK, peer-send-confirm, peer-commit-scalar, 1184 * PEER-COMMIT-ELEMENT, commit-scalar, COMMIT-ELEMENT) 1185 */ 1186 addr[0] = sc; 1187 len[0] = 2; 1188 crypto_bignum_to_bin(scalar1, scalar_b1, sizeof(scalar_b1), 1189 sae->tmp->prime_len); 1190 addr[1] = scalar_b1; 1191 len[1] = sae->tmp->prime_len; 1192 addr[2] = element1; 1193 len[2] = element1_len; 1194 crypto_bignum_to_bin(scalar2, scalar_b2, sizeof(scalar_b2), 1195 sae->tmp->prime_len); 1196 addr[3] = scalar_b2; 1197 len[3] = sae->tmp->prime_len; 1198 addr[4] = element2; 1199 len[4] = element2_len; 1200 hmac_sha256_vector(sae->tmp->kck, sizeof(sae->tmp->kck), 5, addr, len, 1201 confirm); 1202} 1203 1204 1205static void sae_cn_confirm_ecc(struct sae_data *sae, const u8 *sc, 1206 const struct crypto_bignum *scalar1, 1207 const struct crypto_ec_point *element1, 1208 const struct crypto_bignum *scalar2, 1209 const struct crypto_ec_point *element2, 1210 u8 *confirm) 1211{ 1212 u8 element_b1[2 * SAE_MAX_ECC_PRIME_LEN]; 1213 u8 element_b2[2 * SAE_MAX_ECC_PRIME_LEN]; 1214 1215 crypto_ec_point_to_bin(sae->tmp->ec, element1, element_b1, 1216 element_b1 + sae->tmp->prime_len); 1217 crypto_ec_point_to_bin(sae->tmp->ec, element2, element_b2, 1218 element_b2 + sae->tmp->prime_len); 1219 1220 sae_cn_confirm(sae, sc, scalar1, element_b1, 2 * sae->tmp->prime_len, 1221 scalar2, element_b2, 2 * sae->tmp->prime_len, confirm); 1222} 1223 1224 1225static void sae_cn_confirm_ffc(struct sae_data *sae, const u8 *sc, 1226 const struct crypto_bignum *scalar1, 1227 const struct crypto_bignum *element1, 1228 const struct crypto_bignum *scalar2, 1229 const struct crypto_bignum *element2, 1230 u8 *confirm) 1231{ 1232 u8 element_b1[SAE_MAX_PRIME_LEN]; 1233 u8 element_b2[SAE_MAX_PRIME_LEN]; 1234 1235 crypto_bignum_to_bin(element1, element_b1, sizeof(element_b1), 1236 sae->tmp->prime_len); 1237 crypto_bignum_to_bin(element2, element_b2, sizeof(element_b2), 1238 sae->tmp->prime_len); 1239 1240 sae_cn_confirm(sae, sc, scalar1, element_b1, sae->tmp->prime_len, 1241 scalar2, element_b2, sae->tmp->prime_len, confirm); 1242} 1243 1244 1245void sae_write_confirm(struct sae_data *sae, struct wpabuf *buf) 1246{ 1247 const u8 *sc; 1248 1249 if (sae->tmp == NULL) 1250 return; 1251 1252 /* Send-Confirm */ 1253 sc = wpabuf_put(buf, 0); 1254 wpabuf_put_le16(buf, sae->send_confirm); 1255 if (sae->send_confirm < 0xffff) 1256 sae->send_confirm++; 1257 1258 if (sae->tmp->ec) 1259 sae_cn_confirm_ecc(sae, sc, sae->tmp->own_commit_scalar, 1260 sae->tmp->own_commit_element_ecc, 1261 sae->peer_commit_scalar, 1262 sae->tmp->peer_commit_element_ecc, 1263 wpabuf_put(buf, SHA256_MAC_LEN)); 1264 else 1265 sae_cn_confirm_ffc(sae, sc, sae->tmp->own_commit_scalar, 1266 sae->tmp->own_commit_element_ffc, 1267 sae->peer_commit_scalar, 1268 sae->tmp->peer_commit_element_ffc, 1269 wpabuf_put(buf, SHA256_MAC_LEN)); 1270} 1271 1272 1273int sae_check_confirm(struct sae_data *sae, const u8 *data, size_t len) 1274{ 1275 u8 verifier[SHA256_MAC_LEN]; 1276 1277 if (len < 2 + SHA256_MAC_LEN) { 1278 wpa_printf(MSG_DEBUG, "SAE: Too short confirm message"); 1279 return -1; 1280 } 1281 1282 wpa_printf(MSG_DEBUG, "SAE: peer-send-confirm %u", WPA_GET_LE16(data)); 1283 1284 if (!sae->tmp || !sae->peer_commit_scalar || 1285 !sae->tmp->own_commit_scalar) { 1286 wpa_printf(MSG_DEBUG, "SAE: Temporary data not yet available"); 1287 return -1; 1288 } 1289 1290 if (sae->tmp->ec) { 1291 if (!sae->tmp->peer_commit_element_ecc || 1292 !sae->tmp->own_commit_element_ecc) 1293 return -1; 1294 sae_cn_confirm_ecc(sae, data, sae->peer_commit_scalar, 1295 sae->tmp->peer_commit_element_ecc, 1296 sae->tmp->own_commit_scalar, 1297 sae->tmp->own_commit_element_ecc, 1298 verifier); 1299 } else { 1300 if (!sae->tmp->peer_commit_element_ffc || 1301 !sae->tmp->own_commit_element_ffc) 1302 return -1; 1303 sae_cn_confirm_ffc(sae, data, sae->peer_commit_scalar, 1304 sae->tmp->peer_commit_element_ffc, 1305 sae->tmp->own_commit_scalar, 1306 sae->tmp->own_commit_element_ffc, 1307 verifier); 1308 } 1309 1310 if (os_memcmp_const(verifier, data + 2, SHA256_MAC_LEN) != 0) { 1311 wpa_printf(MSG_DEBUG, "SAE: Confirm mismatch"); 1312 wpa_hexdump(MSG_DEBUG, "SAE: Received confirm", 1313 data + 2, SHA256_MAC_LEN); 1314 wpa_hexdump(MSG_DEBUG, "SAE: Calculated verifier", 1315 verifier, SHA256_MAC_LEN); 1316 return -1; 1317 } 1318 1319 return 0; 1320} 1321 1322 1323const char * sae_state_txt(enum sae_state state) 1324{ 1325 switch (state) { 1326 case SAE_NOTHING: 1327 return "Nothing"; 1328 case SAE_COMMITTED: 1329 return "Committed"; 1330 case SAE_CONFIRMED: 1331 return "Confirmed"; 1332 case SAE_ACCEPTED: 1333 return "Accepted"; 1334 } 1335 return "?"; 1336} 1337