2 * EAP server/peer: EAP-GPSK shared routines
3 * Copyright (c) 2006-2007, Jouni Malinen <j@w1.fi>
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
12 #include "crypto/aes_wrap.h"
13 #include "crypto/sha256.h"
15 #include "eap_gpsk_common.h"
19 * eap_gpsk_supported_ciphersuite - Check whether ciphersuite is supported
20 * @vendor: CSuite/Vendor
21 * @specifier: CSuite/Specifier
22 * Returns: 1 if ciphersuite is support, or 0 if not
24 int eap_gpsk_supported_ciphersuite(int vendor, int specifier)
26 if (vendor == EAP_GPSK_VENDOR_IETF &&
27 specifier == EAP_GPSK_CIPHER_AES)
29 #ifdef EAP_GPSK_SHA256
30 if (vendor == EAP_GPSK_VENDOR_IETF &&
31 specifier == EAP_GPSK_CIPHER_SHA256)
33 #endif /* EAP_GPSK_SHA256 */
38 static int eap_gpsk_gkdf_cmac(const u8 *psk /* Y */,
39 const u8 *data /* Z */, size_t data_len,
40 u8 *buf, size_t len /* X */)
43 size_t i, n, hashlen, left, clen;
48 hashlen = sizeof(hash);
49 /* M_i = MAC_Y (i || Z); (MAC = AES-CMAC-128) */
51 vlen[0] = sizeof(ibuf);
57 n = (len + hashlen - 1) / hashlen;
58 for (i = 1; i <= n; i++) {
59 WPA_PUT_BE16(ibuf, i);
60 if (omac1_aes_128_vector(psk, 2, addr, vlen, hash))
62 clen = left > hashlen ? hashlen : left;
63 os_memcpy(opos, hash, clen);
72 #ifdef EAP_GPSK_SHA256
73 static int eap_gpsk_gkdf_sha256(const u8 *psk /* Y */,
74 const u8 *data /* Z */, size_t data_len,
75 u8 *buf, size_t len /* X */)
78 size_t i, n, hashlen, left, clen;
79 u8 ibuf[2], hash[SHA256_MAC_LEN];
83 hashlen = SHA256_MAC_LEN;
84 /* M_i = MAC_Y (i || Z); (MAC = HMAC-SHA256) */
86 vlen[0] = sizeof(ibuf);
92 n = (len + hashlen - 1) / hashlen;
93 for (i = 1; i <= n; i++) {
94 WPA_PUT_BE16(ibuf, i);
95 if (hmac_sha256_vector(psk, 32, 2, addr, vlen, hash))
97 clen = left > hashlen ? hashlen : left;
98 os_memcpy(opos, hash, clen);
105 #endif /* EAP_GPSK_SHA256 */
108 static int eap_gpsk_derive_keys_helper(u32 csuite_specifier,
109 u8 *kdf_out, size_t kdf_out_len,
110 const u8 *psk, size_t psk_len,
111 const u8 *seed, size_t seed_len,
113 u8 *sk, size_t sk_len,
114 u8 *pk, size_t pk_len)
116 u8 mk[32], *pos, *data;
117 size_t data_len, mk_len;
118 int (*gkdf)(const u8 *_psk, const u8 *_data, size_t _data_len,
119 u8 *buf, size_t len);
122 switch (csuite_specifier) {
123 case EAP_GPSK_CIPHER_AES:
124 gkdf = eap_gpsk_gkdf_cmac;
127 #ifdef EAP_GPSK_SHA256
128 case EAP_GPSK_CIPHER_SHA256:
129 gkdf = eap_gpsk_gkdf_sha256;
130 mk_len = SHA256_MAC_LEN;
132 #endif /* EAP_GPSK_SHA256 */
137 if (psk_len < mk_len)
140 data_len = 2 + psk_len + 6 + seed_len;
141 data = os_malloc(data_len);
145 WPA_PUT_BE16(pos, psk_len);
147 os_memcpy(pos, psk, psk_len);
149 WPA_PUT_BE32(pos, EAP_GPSK_VENDOR_IETF); /* CSuite/Vendor = IETF */
151 WPA_PUT_BE16(pos, csuite_specifier); /* CSuite/Specifier */
153 os_memcpy(pos, seed, seed_len); /* inputString */
154 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: Data to MK derivation",
157 if (gkdf(psk, data, data_len, mk, mk_len) < 0) {
162 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: MK", mk, mk_len);
164 if (gkdf(mk, seed, seed_len, kdf_out, kdf_out_len) < 0)
168 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: MSK", pos, EAP_MSK_LEN);
169 os_memcpy(msk, pos, EAP_MSK_LEN);
172 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: EMSK", pos, EAP_EMSK_LEN);
173 os_memcpy(emsk, pos, EAP_EMSK_LEN);
176 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: SK", pos, sk_len);
177 os_memcpy(sk, pos, sk_len);
181 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: PK", pos, pk_len);
182 os_memcpy(pk, pos, pk_len);
189 static int eap_gpsk_derive_keys_aes(const u8 *psk, size_t psk_len,
190 const u8 *seed, size_t seed_len,
191 u8 *msk, u8 *emsk, u8 *sk, size_t *sk_len,
192 u8 *pk, size_t *pk_len)
194 #define EAP_GPSK_SK_LEN_AES 16
195 #define EAP_GPSK_PK_LEN_AES 16
196 u8 kdf_out[EAP_MSK_LEN + EAP_EMSK_LEN + EAP_GPSK_SK_LEN_AES +
197 EAP_GPSK_PK_LEN_AES];
200 * inputString = RAND_Peer || ID_Peer || RAND_Server || ID_Server
202 * KS = 16, PL = psk_len, CSuite_Sel = 0x00000000 0x0001
203 * MK = GKDF-16 (PSK[0..15], PL || PSK || CSuite_Sel || inputString)
204 * MSK = GKDF-160 (MK, inputString)[0..63]
205 * EMSK = GKDF-160 (MK, inputString)[64..127]
206 * SK = GKDF-160 (MK, inputString)[128..143]
207 * PK = GKDF-160 (MK, inputString)[144..159]
208 * zero = 0x00 || 0x00 || ... || 0x00 (16 times)
209 * Method-ID = GKDF-16 (zero, "Method ID" || EAP_Method_Type ||
210 * CSuite_Sel || inputString)
213 *sk_len = EAP_GPSK_SK_LEN_AES;
214 *pk_len = EAP_GPSK_PK_LEN_AES;
216 return eap_gpsk_derive_keys_helper(EAP_GPSK_CIPHER_AES,
217 kdf_out, sizeof(kdf_out),
218 psk, psk_len, seed, seed_len,
219 msk, emsk, sk, *sk_len,
224 #ifdef EAP_GPSK_SHA256
225 static int eap_gpsk_derive_keys_sha256(const u8 *psk, size_t psk_len,
226 const u8 *seed, size_t seed_len,
228 u8 *sk, size_t *sk_len)
230 #define EAP_GPSK_SK_LEN_SHA256 SHA256_MAC_LEN
231 #define EAP_GPSK_PK_LEN_SHA256 SHA256_MAC_LEN
232 u8 kdf_out[EAP_MSK_LEN + EAP_EMSK_LEN + EAP_GPSK_SK_LEN_SHA256 +
233 EAP_GPSK_PK_LEN_SHA256];
236 * inputString = RAND_Peer || ID_Peer || RAND_Server || ID_Server
238 * KS = 32, PL = psk_len, CSuite_Sel = 0x00000000 0x0002
239 * MK = GKDF-32 (PSK[0..31], PL || PSK || CSuite_Sel || inputString)
240 * MSK = GKDF-160 (MK, inputString)[0..63]
241 * EMSK = GKDF-160 (MK, inputString)[64..127]
242 * SK = GKDF-160 (MK, inputString)[128..159]
243 * zero = 0x00 || 0x00 || ... || 0x00 (32 times)
244 * Method-ID = GKDF-16 (zero, "Method ID" || EAP_Method_Type ||
245 * CSuite_Sel || inputString)
248 *sk_len = EAP_GPSK_SK_LEN_SHA256;
250 return eap_gpsk_derive_keys_helper(EAP_GPSK_CIPHER_SHA256,
251 kdf_out, sizeof(kdf_out),
252 psk, psk_len, seed, seed_len,
253 msk, emsk, sk, *sk_len,
256 #endif /* EAP_GPSK_SHA256 */
260 * eap_gpsk_derive_keys - Derive EAP-GPSK keys
261 * @psk: Pre-shared key
262 * @psk_len: Length of psk in bytes
263 * @vendor: CSuite/Vendor
264 * @specifier: CSuite/Specifier
265 * @rand_peer: 32-byte RAND_Peer
266 * @rand_server: 32-byte RAND_Server
268 * @id_peer_len: Length of ID_Peer
269 * @id_server: ID_Server
270 * @id_server_len: Length of ID_Server
271 * @msk: Buffer for 64-byte MSK
272 * @emsk: Buffer for 64-byte EMSK
273 * @sk: Buffer for SK (at least EAP_GPSK_MAX_SK_LEN bytes)
274 * @sk_len: Buffer for returning length of SK
275 * @pk: Buffer for PK (at least EAP_GPSK_MAX_PK_LEN bytes)
276 * @pk_len: Buffer for returning length of PK
277 * Returns: 0 on success, -1 on failure
279 int eap_gpsk_derive_keys(const u8 *psk, size_t psk_len, int vendor,
281 const u8 *rand_peer, const u8 *rand_server,
282 const u8 *id_peer, size_t id_peer_len,
283 const u8 *id_server, size_t id_server_len,
284 u8 *msk, u8 *emsk, u8 *sk, size_t *sk_len,
285 u8 *pk, size_t *pk_len)
290 wpa_printf(MSG_DEBUG, "EAP-GPSK: Deriving keys (%d:%d)",
293 if (vendor != EAP_GPSK_VENDOR_IETF)
296 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: PSK", psk, psk_len);
298 /* Seed = RAND_Peer || ID_Peer || RAND_Server || ID_Server */
299 seed = os_malloc(2 * EAP_GPSK_RAND_LEN + id_server_len + id_peer_len);
301 wpa_printf(MSG_DEBUG, "EAP-GPSK: Failed to allocate memory "
302 "for key derivation");
307 os_memcpy(pos, rand_peer, EAP_GPSK_RAND_LEN);
308 pos += EAP_GPSK_RAND_LEN;
309 os_memcpy(pos, id_peer, id_peer_len);
311 os_memcpy(pos, rand_server, EAP_GPSK_RAND_LEN);
312 pos += EAP_GPSK_RAND_LEN;
313 os_memcpy(pos, id_server, id_server_len);
314 pos += id_server_len;
315 wpa_hexdump(MSG_DEBUG, "EAP-GPSK: Seed", seed, pos - seed);
318 case EAP_GPSK_CIPHER_AES:
319 ret = eap_gpsk_derive_keys_aes(psk, psk_len, seed, pos - seed,
320 msk, emsk, sk, sk_len,
323 #ifdef EAP_GPSK_SHA256
324 case EAP_GPSK_CIPHER_SHA256:
325 ret = eap_gpsk_derive_keys_sha256(psk, psk_len, seed,
327 msk, emsk, sk, sk_len);
329 #endif /* EAP_GPSK_SHA256 */
331 wpa_printf(MSG_DEBUG, "EAP-GPSK: Unknown cipher %d:%d used in "
332 "key derivation", vendor, specifier);
343 static int eap_gpsk_derive_mid_helper(u32 csuite_specifier,
344 u8 *kdf_out, size_t kdf_out_len,
345 const u8 *psk, const u8 *seed,
346 size_t seed_len, u8 method_type)
350 int (*gkdf)(const u8 *_psk, const u8 *_data, size_t _data_len,
351 u8 *buf, size_t len);
354 switch (csuite_specifier) {
355 case EAP_GPSK_CIPHER_AES:
356 gkdf = eap_gpsk_gkdf_cmac;
358 #ifdef EAP_GPSK_SHA256
359 case EAP_GPSK_CIPHER_SHA256:
360 gkdf = eap_gpsk_gkdf_sha256;
362 #endif /* EAP_GPSK_SHA256 */
364 wpa_printf(MSG_DEBUG, "EAP-GPSK: Unknown cipher %d used in "
365 "Session-Id derivation", csuite_specifier);
369 #define SID_LABEL "Method ID"
370 /* "Method ID" || EAP_Method_Type || CSuite_Sel || inputString */
371 data_len = strlen(SID_LABEL) + 1 + 6 + seed_len;
372 data = os_malloc(data_len);
376 os_memcpy(pos, SID_LABEL, strlen(SID_LABEL));
377 pos += strlen(SID_LABEL);
379 os_memcpy(pos, &method_type, 1);
381 WPA_PUT_BE32(pos, EAP_GPSK_VENDOR_IETF); /* CSuite/Vendor = IETF */
383 WPA_PUT_BE16(pos, csuite_specifier); /* CSuite/Specifier */
385 os_memcpy(pos, seed, seed_len); /* inputString */
386 wpa_hexdump(MSG_DEBUG, "EAP-GPSK: Data to Method ID derivation",
389 if (gkdf(psk, data, data_len, kdf_out, kdf_out_len) < 0) {
394 wpa_hexdump(MSG_DEBUG, "EAP-GPSK: Method ID", kdf_out, kdf_out_len);
401 * eap_gpsk_session_id - Derive EAP-GPSK Session ID
402 * @psk: Pre-shared key
403 * @psk_len: Length of psk in bytes
404 * @vendor: CSuite/Vendor
405 * @specifier: CSuite/Specifier
406 * @rand_peer: 32-byte RAND_Peer
407 * @rand_server: 32-byte RAND_Server
409 * @id_peer_len: Length of ID_Peer
410 * @id_server: ID_Server
411 * @id_server_len: Length of ID_Server
412 * @method_type: EAP Authentication Method Type
413 * @sid: Buffer for 17-byte Session ID
414 * @sid_len: Buffer for returning length of Session ID
415 * Returns: 0 on success, -1 on failure
417 int eap_gpsk_derive_session_id(const u8 *psk, size_t psk_len, int vendor,
419 const u8 *rand_peer, const u8 *rand_server,
420 const u8 *id_peer, size_t id_peer_len,
421 const u8 *id_server, size_t id_server_len,
422 u8 method_type, u8 *sid, size_t *sid_len)
428 wpa_printf(MSG_DEBUG, "EAP-GPSK: Deriving Session ID(%d:%d)",
431 if (vendor != EAP_GPSK_VENDOR_IETF)
434 wpa_hexdump_key(MSG_DEBUG, "EAP-GPSK: PSK", psk, psk_len);
437 * inputString = RAND_Peer || ID_Peer || RAND_Server || ID_Server
439 * KS = 16, CSuite_Sel = 0x00000000 0x0001
440 * Method-ID = GKDF-16 (zero, "Method ID" || EAP_Method_Type ||
441 * CSuite_Sel || inputString)
443 seed = os_malloc(2 * EAP_GPSK_RAND_LEN + id_server_len + id_peer_len);
445 wpa_printf(MSG_DEBUG, "EAP-GPSK: Failed to allocate memory "
446 "for Session-Id derivation");
451 os_memcpy(pos, rand_peer, EAP_GPSK_RAND_LEN);
452 pos += EAP_GPSK_RAND_LEN;
453 os_memcpy(pos, id_peer, id_peer_len);
455 os_memcpy(pos, rand_server, EAP_GPSK_RAND_LEN);
456 pos += EAP_GPSK_RAND_LEN;
457 os_memcpy(pos, id_server, id_server_len);
458 pos += id_server_len;
459 wpa_hexdump(MSG_DEBUG, "EAP-GPSK: Seed", seed, pos - seed);
461 ret = eap_gpsk_derive_mid_helper(specifier,
462 kdf_out, sizeof(kdf_out),
463 psk, seed, pos - seed,
466 sid[0] = method_type;
467 os_memcpy(sid + 1, kdf_out, sizeof(kdf_out));
468 *sid_len = 1 + sizeof(kdf_out);
477 * eap_gpsk_mic_len - Get the length of the MIC
478 * @vendor: CSuite/Vendor
479 * @specifier: CSuite/Specifier
480 * Returns: MIC length in bytes
482 size_t eap_gpsk_mic_len(int vendor, int specifier)
484 if (vendor != EAP_GPSK_VENDOR_IETF)
488 case EAP_GPSK_CIPHER_AES:
490 #ifdef EAP_GPSK_SHA256
491 case EAP_GPSK_CIPHER_SHA256:
493 #endif /* EAP_GPSK_SHA256 */
500 static int eap_gpsk_compute_mic_aes(const u8 *sk, size_t sk_len,
501 const u8 *data, size_t len, u8 *mic)
504 wpa_printf(MSG_DEBUG, "EAP-GPSK: Invalid SK length %lu for "
505 "AES-CMAC MIC", (unsigned long) sk_len);
509 return omac1_aes_128(sk, data, len, mic);
514 * eap_gpsk_compute_mic - Compute EAP-GPSK MIC for an EAP packet
515 * @sk: Session key SK from eap_gpsk_derive_keys()
516 * @sk_len: SK length in bytes from eap_gpsk_derive_keys()
517 * @vendor: CSuite/Vendor
518 * @specifier: CSuite/Specifier
519 * @data: Input data to MIC
520 * @len: Input data length in bytes
521 * @mic: Buffer for the computed MIC, eap_gpsk_mic_len(cipher) bytes
522 * Returns: 0 on success, -1 on failure
524 int eap_gpsk_compute_mic(const u8 *sk, size_t sk_len, int vendor,
525 int specifier, const u8 *data, size_t len, u8 *mic)
529 if (vendor != EAP_GPSK_VENDOR_IETF)
533 case EAP_GPSK_CIPHER_AES:
534 ret = eap_gpsk_compute_mic_aes(sk, sk_len, data, len, mic);
536 #ifdef EAP_GPSK_SHA256
537 case EAP_GPSK_CIPHER_SHA256:
538 ret = hmac_sha256(sk, sk_len, data, len, mic);
540 #endif /* EAP_GPSK_SHA256 */
542 wpa_printf(MSG_DEBUG, "EAP-GPSK: Unknown cipher %d:%d used in "
543 "MIC computation", vendor, specifier);
549 wpa_printf(MSG_DEBUG, "EAP-GPSK: Could not compute MIC");