2 * EAP server/peer: EAP-GPSK shared routines
3 * Copyright (c) 2006-2007, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
18 #include "crypto/aes_wrap.h"
19 #include "crypto/sha256.h"
21 #include "eap_gpsk_common.h"
25 * eap_gpsk_supported_ciphersuite - Check whether ciphersuite is supported
26 * @vendor: CSuite/Vendor
27 * @specifier: CSuite/Specifier
28 * Returns: 1 if ciphersuite is support, or 0 if not
30 int eap_gpsk_supported_ciphersuite(int vendor, int specifier)
32 if (vendor == EAP_GPSK_VENDOR_IETF &&
33 specifier == EAP_GPSK_CIPHER_AES)
35 #ifdef EAP_GPSK_SHA256
36 if (vendor == EAP_GPSK_VENDOR_IETF &&
37 specifier == EAP_GPSK_CIPHER_SHA256)
39 #endif /* EAP_GPSK_SHA256 */
44 static int eap_gpsk_gkdf_cmac(const u8 *psk /* Y */,
45 const u8 *data /* Z */, size_t data_len,
46 u8 *buf, size_t len /* X */)
49 size_t i, n, hashlen, left, clen;
54 hashlen = sizeof(hash);
55 /* M_i = MAC_Y (i || Z); (MAC = AES-CMAC-128) */
57 vlen[0] = sizeof(ibuf);
63 n = (len + hashlen - 1) / hashlen;
64 for (i = 1; i <= n; i++) {
65 WPA_PUT_BE16(ibuf, i);
66 if (omac1_aes_128_vector(psk, 2, addr, vlen, hash))
68 clen = left > hashlen ? hashlen : left;
69 os_memcpy(opos, hash, clen);
78 #ifdef EAP_GPSK_SHA256
79 static int eap_gpsk_gkdf_sha256(const u8 *psk /* Y */,
80 const u8 *data /* Z */, size_t data_len,
81 u8 *buf, size_t len /* X */)
84 size_t i, n, hashlen, left, clen;
85 u8 ibuf[2], hash[SHA256_MAC_LEN];
89 hashlen = SHA256_MAC_LEN;
90 /* M_i = MAC_Y (i || Z); (MAC = HMAC-SHA256) */
92 vlen[0] = sizeof(ibuf);
98 n = (len + hashlen - 1) / hashlen;
99 for (i = 1; i <= n; i++) {
100 WPA_PUT_BE16(ibuf, i);
101 hmac_sha256_vector(psk, 32, 2, addr, vlen, hash);
102 clen = left > hashlen ? hashlen : left;
103 os_memcpy(opos, hash, clen);
110 #endif /* EAP_GPSK_SHA256 */
113 static int eap_gpsk_derive_keys_helper(u32 csuite_specifier,
114 u8 *kdf_out, size_t kdf_out_len,
115 const u8 *psk, size_t psk_len,
116 const u8 *seed, size_t seed_len,
118 u8 *sk, size_t sk_len,
119 u8 *pk, size_t pk_len)
121 u8 mk[32], *pos, *data;
122 size_t data_len, mk_len;
123 int (*gkdf)(const u8 *_psk, const u8 *_data, size_t _data_len,
124 u8 *buf, size_t len);
127 switch (csuite_specifier) {
128 case EAP_GPSK_CIPHER_AES:
129 gkdf = eap_gpsk_gkdf_cmac;
132 #ifdef EAP_GPSK_SHA256
133 case EAP_GPSK_CIPHER_SHA256:
134 gkdf = eap_gpsk_gkdf_sha256;
135 mk_len = SHA256_MAC_LEN;
137 #endif /* EAP_GPSK_SHA256 */
142 if (psk_len < mk_len)
145 data_len = 2 + psk_len + 6 + seed_len;
146 data = os_malloc(data_len);
150 WPA_PUT_BE16(pos, psk_len);
152 os_memcpy(pos, psk, psk_len);
154 WPA_PUT_BE32(pos, EAP_GPSK_VENDOR_IETF); /* CSuite/Vendor = IETF */
156 WPA_PUT_BE16(pos, csuite_specifier); /* CSuite/Specifier */
158 os_memcpy(pos, seed, seed_len); /* inputString */
159 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: Data to MK derivation",
162 if (gkdf(psk, data, data_len, mk, mk_len) < 0) {
167 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: MK", mk, mk_len);
169 if (gkdf(mk, seed, seed_len, kdf_out, kdf_out_len) < 0)
173 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: MSK", pos, EAP_MSK_LEN);
174 os_memcpy(msk, pos, EAP_MSK_LEN);
177 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: EMSK", pos, EAP_EMSK_LEN);
178 os_memcpy(emsk, pos, EAP_EMSK_LEN);
181 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: SK", pos, sk_len);
182 os_memcpy(sk, pos, sk_len);
186 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: PK", pos, pk_len);
187 os_memcpy(pk, pos, pk_len);
194 static int eap_gpsk_derive_keys_aes(const u8 *psk, size_t psk_len,
195 const u8 *seed, size_t seed_len,
196 u8 *msk, u8 *emsk, u8 *sk, size_t *sk_len,
197 u8 *pk, size_t *pk_len)
199 #define EAP_GPSK_SK_LEN_AES 16
200 #define EAP_GPSK_PK_LEN_AES 16
201 u8 kdf_out[EAP_MSK_LEN + EAP_EMSK_LEN + EAP_GPSK_SK_LEN_AES +
202 EAP_GPSK_PK_LEN_AES];
205 * inputString = RAND_Peer || ID_Peer || RAND_Server || ID_Server
207 * KS = 16, PL = psk_len, CSuite_Sel = 0x00000000 0x0001
208 * MK = GKDF-16 (PSK[0..15], PL || PSK || CSuite_Sel || inputString)
209 * MSK = GKDF-160 (MK, inputString)[0..63]
210 * EMSK = GKDF-160 (MK, inputString)[64..127]
211 * SK = GKDF-160 (MK, inputString)[128..143]
212 * PK = GKDF-160 (MK, inputString)[144..159]
213 * zero = 0x00 || 0x00 || ... || 0x00 (16 times)
214 * Method-ID = GKDF-16 (zero, "Method ID" || EAP_Method_Type ||
215 * CSuite_Sel || inputString)
218 *sk_len = EAP_GPSK_SK_LEN_AES;
219 *pk_len = EAP_GPSK_PK_LEN_AES;
221 return eap_gpsk_derive_keys_helper(EAP_GPSK_CIPHER_AES,
222 kdf_out, sizeof(kdf_out),
223 psk, psk_len, seed, seed_len,
224 msk, emsk, sk, *sk_len,
229 #ifdef EAP_GPSK_SHA256
230 static int eap_gpsk_derive_keys_sha256(const u8 *psk, size_t psk_len,
231 const u8 *seed, size_t seed_len,
233 u8 *sk, size_t *sk_len)
235 #define EAP_GPSK_SK_LEN_SHA256 SHA256_MAC_LEN
236 #define EAP_GPSK_PK_LEN_SHA256 SHA256_MAC_LEN
237 u8 kdf_out[EAP_MSK_LEN + EAP_EMSK_LEN + EAP_GPSK_SK_LEN_SHA256 +
238 EAP_GPSK_PK_LEN_SHA256];
241 * inputString = RAND_Peer || ID_Peer || RAND_Server || ID_Server
243 * KS = 32, PL = psk_len, CSuite_Sel = 0x00000000 0x0002
244 * MK = GKDF-32 (PSK[0..31], PL || PSK || CSuite_Sel || inputString)
245 * MSK = GKDF-160 (MK, inputString)[0..63]
246 * EMSK = GKDF-160 (MK, inputString)[64..127]
247 * SK = GKDF-160 (MK, inputString)[128..159]
248 * zero = 0x00 || 0x00 || ... || 0x00 (32 times)
249 * Method-ID = GKDF-16 (zero, "Method ID" || EAP_Method_Type ||
250 * CSuite_Sel || inputString)
253 *sk_len = EAP_GPSK_SK_LEN_SHA256;
255 return eap_gpsk_derive_keys_helper(EAP_GPSK_CIPHER_SHA256,
256 kdf_out, sizeof(kdf_out),
257 psk, psk_len, seed, seed_len,
258 msk, emsk, sk, *sk_len,
261 #endif /* EAP_GPSK_SHA256 */
265 * eap_gpsk_derive_keys - Derive EAP-GPSK keys
266 * @psk: Pre-shared key
267 * @psk_len: Length of psk in bytes
268 * @vendor: CSuite/Vendor
269 * @specifier: CSuite/Specifier
270 * @rand_peer: 32-byte RAND_Peer
271 * @rand_server: 32-byte RAND_Server
273 * @id_peer_len: Length of ID_Peer
274 * @id_server: ID_Server
275 * @id_server_len: Length of ID_Server
276 * @msk: Buffer for 64-byte MSK
277 * @emsk: Buffer for 64-byte EMSK
278 * @sk: Buffer for SK (at least EAP_GPSK_MAX_SK_LEN bytes)
279 * @sk_len: Buffer for returning length of SK
280 * @pk: Buffer for PK (at least EAP_GPSK_MAX_PK_LEN bytes)
281 * @pk_len: Buffer for returning length of PK
282 * Returns: 0 on success, -1 on failure
284 int eap_gpsk_derive_keys(const u8 *psk, size_t psk_len, int vendor,
286 const u8 *rand_peer, const u8 *rand_server,
287 const u8 *id_peer, size_t id_peer_len,
288 const u8 *id_server, size_t id_server_len,
289 u8 *msk, u8 *emsk, u8 *sk, size_t *sk_len,
290 u8 *pk, size_t *pk_len)
296 wpa_printf(MSG_DEBUG, "EAP-GPSK: Deriving keys (%d:%d)",
299 if (vendor != EAP_GPSK_VENDOR_IETF)
302 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: PSK", psk, psk_len);
304 /* Seed = RAND_Peer || ID_Peer || RAND_Server || ID_Server */
305 seed_len = 2 * EAP_GPSK_RAND_LEN + id_server_len + id_peer_len;
306 seed = os_malloc(seed_len);
308 wpa_printf(MSG_DEBUG, "EAP-GPSK: Failed to allocate memory "
309 "for key derivation");
314 os_memcpy(pos, rand_peer, EAP_GPSK_RAND_LEN);
315 pos += EAP_GPSK_RAND_LEN;
316 os_memcpy(pos, id_peer, id_peer_len);
318 os_memcpy(pos, rand_server, EAP_GPSK_RAND_LEN);
319 pos += EAP_GPSK_RAND_LEN;
320 os_memcpy(pos, id_server, id_server_len);
321 pos += id_server_len;
322 wpa_hexdump(MSG_DEBUG, "EAP-GPSK: Seed", seed, seed_len);
325 case EAP_GPSK_CIPHER_AES:
326 ret = eap_gpsk_derive_keys_aes(psk, psk_len, seed, seed_len,
327 msk, emsk, sk, sk_len,
330 #ifdef EAP_GPSK_SHA256
331 case EAP_GPSK_CIPHER_SHA256:
332 ret = eap_gpsk_derive_keys_sha256(psk, psk_len, seed, seed_len,
333 msk, emsk, sk, sk_len);
335 #endif /* EAP_GPSK_SHA256 */
337 wpa_printf(MSG_DEBUG, "EAP-GPSK: Unknown cipher %d:%d used in "
338 "key derivation", vendor, specifier);
350 * eap_gpsk_mic_len - Get the length of the MIC
351 * @vendor: CSuite/Vendor
352 * @specifier: CSuite/Specifier
353 * Returns: MIC length in bytes
355 size_t eap_gpsk_mic_len(int vendor, int specifier)
357 if (vendor != EAP_GPSK_VENDOR_IETF)
361 case EAP_GPSK_CIPHER_AES:
363 #ifdef EAP_GPSK_SHA256
364 case EAP_GPSK_CIPHER_SHA256:
366 #endif /* EAP_GPSK_SHA256 */
373 static int eap_gpsk_compute_mic_aes(const u8 *sk, size_t sk_len,
374 const u8 *data, size_t len, u8 *mic)
377 wpa_printf(MSG_DEBUG, "EAP-GPSK: Invalid SK length %lu for "
378 "AES-CMAC MIC", (unsigned long) sk_len);
382 return omac1_aes_128(sk, data, len, mic);
387 * eap_gpsk_compute_mic - Compute EAP-GPSK MIC for an EAP packet
388 * @sk: Session key SK from eap_gpsk_derive_keys()
389 * @sk_len: SK length in bytes from eap_gpsk_derive_keys()
390 * @vendor: CSuite/Vendor
391 * @specifier: CSuite/Specifier
392 * @data: Input data to MIC
393 * @len: Input data length in bytes
394 * @mic: Buffer for the computed MIC, eap_gpsk_mic_len(cipher) bytes
395 * Returns: 0 on success, -1 on failure
397 int eap_gpsk_compute_mic(const u8 *sk, size_t sk_len, int vendor,
398 int specifier, const u8 *data, size_t len, u8 *mic)
402 if (vendor != EAP_GPSK_VENDOR_IETF)
406 case EAP_GPSK_CIPHER_AES:
407 ret = eap_gpsk_compute_mic_aes(sk, sk_len, data, len, mic);
409 #ifdef EAP_GPSK_SHA256
410 case EAP_GPSK_CIPHER_SHA256:
411 hmac_sha256(sk, sk_len, data, len, mic);
414 #endif /* EAP_GPSK_SHA256 */
416 wpa_printf(MSG_DEBUG, "EAP-GPSK: Unknown cipher %d:%d used in "
417 "MIC computation", vendor, specifier);