1 /*
2 * Simultaneous authentication of equals
3 * Copyright (c) 2012-2016, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10
11 #include "common.h"
12 #include "utils/const_time.h"
13 #include "crypto/crypto.h"
14 #include "crypto/sha256.h"
15 #include "crypto/sha384.h"
16 #include "crypto/sha512.h"
17 #include "crypto/random.h"
18 #include "crypto/dh_groups.h"
19 #include "ieee802_11_defs.h"
20 #include "dragonfly.h"
21 #include "sae.h"
22
23
sae_set_group(struct sae_data * sae,int group)24 int sae_set_group(struct sae_data *sae, int group)
25 {
26 struct sae_temporary_data *tmp;
27
28 #ifdef CONFIG_TESTING_OPTIONS
29 /* Allow all groups for testing purposes in non-production builds. */
30 #else /* CONFIG_TESTING_OPTIONS */
31 if (!dragonfly_suitable_group(group, 0)) {
32 wpa_printf(MSG_DEBUG, "SAE: Reject unsuitable group %d", group);
33 return -1;
34 }
35 #endif /* CONFIG_TESTING_OPTIONS */
36
37 sae_clear_data(sae);
38 tmp = sae->tmp = os_zalloc(sizeof(*tmp));
39 if (tmp == NULL)
40 return -1;
41
42 /* First, check if this is an ECC group */
43 tmp->ec = crypto_ec_init(group);
44 if (tmp->ec) {
45 wpa_printf(MSG_DEBUG, "SAE: Selecting supported ECC group %d",
46 group);
47 sae->group = group;
48 tmp->prime_len = crypto_ec_prime_len(tmp->ec);
49 tmp->prime = crypto_ec_get_prime(tmp->ec);
50 tmp->order_len = crypto_ec_order_len(tmp->ec);
51 tmp->order = crypto_ec_get_order(tmp->ec);
52 return 0;
53 }
54 #ifndef CONFIG_SAE_NO_FFC
55 /* Not an ECC group, check FFC */
56 tmp->dh = dh_groups_get(group);
57 if (tmp->dh) {
58 wpa_printf(MSG_DEBUG, "SAE: Selecting supported FFC group %d",
59 group);
60 sae->group = group;
61 tmp->prime_len = tmp->dh->prime_len;
62 if (tmp->prime_len > SAE_MAX_PRIME_LEN) {
63 sae_clear_data(sae);
64 return -1;
65 }
66
67 tmp->prime_buf = crypto_bignum_init_set(tmp->dh->prime,
68 tmp->prime_len);
69 if (tmp->prime_buf == NULL) {
70 sae_clear_data(sae);
71 return -1;
72 }
73 tmp->prime = tmp->prime_buf;
74
75 tmp->order_len = tmp->dh->order_len;
76 tmp->order_buf = crypto_bignum_init_set(tmp->dh->order,
77 tmp->dh->order_len);
78 if (tmp->order_buf == NULL) {
79 sae_clear_data(sae);
80 return -1;
81 }
82 tmp->order = tmp->order_buf;
83
84 return 0;
85 }
86 #endif /* CONFIG_SAE_NO_FFC */
87 /* Unsupported group */
88 wpa_printf(MSG_DEBUG,
89 "SAE: Group %d not supported by the crypto library", group);
90 return -1;
91 }
92
93
sae_clear_temp_data(struct sae_data * sae)94 void sae_clear_temp_data(struct sae_data *sae)
95 {
96 struct sae_temporary_data *tmp;
97 if (sae == NULL || sae->tmp == NULL)
98 return;
99 tmp = sae->tmp;
100 crypto_ec_deinit(tmp->ec);
101 crypto_bignum_deinit(tmp->prime_buf, 0);
102 crypto_bignum_deinit(tmp->order_buf, 0);
103 crypto_bignum_deinit(tmp->sae_rand, 1);
104 #ifndef CONFIG_SAE_NO_FFC
105 crypto_bignum_deinit(tmp->pwe_ffc, 1);
106 #endif /* CONFIG_SAE_NO_FFC */
107 crypto_bignum_deinit(tmp->own_commit_scalar, 0);
108 #ifndef CONFIG_SAE_NO_FFC
109 crypto_bignum_deinit(tmp->own_commit_element_ffc, 0);
110 crypto_bignum_deinit(tmp->peer_commit_element_ffc, 0);
111 #endif /* CONFIG_SAE_NO_FFC */
112 crypto_ec_point_deinit(tmp->pwe_ecc, 1);
113 crypto_ec_point_deinit(tmp->own_commit_element_ecc, 0);
114 crypto_ec_point_deinit(tmp->peer_commit_element_ecc, 0);
115 wpabuf_free(tmp->anti_clogging_token);
116 wpabuf_free(tmp->own_rejected_groups);
117 wpabuf_free(tmp->peer_rejected_groups);
118 #ifndef CONFIG_SAE_NO_PW_ID
119 os_free(tmp->pw_id);
120 #endif /* CONFIG_SAE_NO_PW_ID */
121 bin_clear_free(tmp, sizeof(*tmp));
122 sae->tmp = NULL;
123 }
124
125
sae_clear_data(struct sae_data * sae)126 void sae_clear_data(struct sae_data *sae)
127 {
128 if (sae == NULL)
129 return;
130 sae_clear_temp_data(sae);
131 crypto_bignum_deinit(sae->peer_commit_scalar, 0);
132 crypto_bignum_deinit(sae->peer_commit_scalar_accepted, 0);
133 os_memset(sae, 0, sizeof(*sae));
134 }
135
136
sae_pwd_seed_key(const u8 * addr1,const u8 * addr2,u8 * key)137 static void sae_pwd_seed_key(const u8 *addr1, const u8 *addr2, u8 *key)
138 {
139 wpa_warning_log4(MSG_DEBUG, "SAE: PWE derivation - addr1=" "%02x:xx:xx:%02x:%02x:%02x",
140 (addr1)[0], (addr1)[3], (addr1)[4], (addr1)[5]);
141 wpa_warning_log4(MSG_DEBUG, "SAE: PWE derivation"
142 " addr2=" "%02x:xx:xx:%02x:%02x:%02x", (addr2)[0], (addr2)[3], (addr2)[4], (addr2)[5]);
143 if (os_memcmp(addr1, addr2, ETH_ALEN) > 0) {
144 os_memcpy(key, addr1, ETH_ALEN);
145 os_memcpy(key + ETH_ALEN, addr2, ETH_ALEN);
146 } else {
147 os_memcpy(key, addr2, ETH_ALEN);
148 os_memcpy(key + ETH_ALEN, addr1, ETH_ALEN);
149 }
150 }
151
152
sae_test_pwd_seed_ecc(struct sae_data * sae,const u8 * pwd_seed,const u8 * prime,const u8 * qr,const u8 * qnr,u8 * pwd_value)153 static int sae_test_pwd_seed_ecc(struct sae_data *sae, const u8 *pwd_seed,
154 const u8 *prime, const u8 *qr, const u8 *qnr,
155 u8 *pwd_value)
156 {
157 struct crypto_bignum *y_sqr, *x_cand;
158 int res;
159 size_t bits;
160 int cmp_prime;
161 unsigned int in_range;
162
163 wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-seed", pwd_seed, SHA256_MAC_LEN);
164
165 /* pwd-value = KDF-z(pwd-seed, "SAE Hunting and Pecking", p) */
166 bits = crypto_ec_prime_len_bits(sae->tmp->ec);
167 if (sha256_prf_bits(pwd_seed, SHA256_MAC_LEN, "SAE Hunting and Pecking",
168 prime, sae->tmp->prime_len, pwd_value, bits) < 0)
169 return -1;
170 if (bits % 8)
171 buf_shift_right(pwd_value, sae->tmp->prime_len, 8 - bits % 8);
172 wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value",
173 pwd_value, sae->tmp->prime_len);
174
175 cmp_prime = const_time_memcmp(pwd_value, prime, sae->tmp->prime_len);
176 /* Create a const_time mask for selection based on prf result
177 * being smaller than prime. */
178 in_range = const_time_fill_msb((unsigned int) cmp_prime);
179 /* The algorithm description would skip the next steps if
180 * cmp_prime >= 0 (return 0 here), but go through them regardless to
181 * minimize externally observable differences in behavior. */
182
183 x_cand = crypto_bignum_init_set(pwd_value, sae->tmp->prime_len);
184 if (!x_cand)
185 return -1;
186 y_sqr = crypto_ec_point_compute_y_sqr(sae->tmp->ec, x_cand);
187 crypto_bignum_deinit(x_cand, 1);
188 if (!y_sqr)
189 return -1;
190
191 res = dragonfly_is_quadratic_residue_blind(sae->tmp->ec, qr, qnr,
192 y_sqr);
193 crypto_bignum_deinit(y_sqr, 1);
194 if (res < 0)
195 return res;
196 return const_time_select_int(in_range, res, 0);
197 }
198
199 #ifndef CONFIG_SAE_NO_FFC
200 /* Returns -1 on fatal failure, 0 if PWE cannot be derived from the provided
201 * pwd-seed, or 1 if a valid PWE was derived from pwd-seed. */
sae_test_pwd_seed_ffc(struct sae_data * sae,const u8 * pwd_seed,struct crypto_bignum * pwe)202 static int sae_test_pwd_seed_ffc(struct sae_data *sae, const u8 *pwd_seed,
203 struct crypto_bignum *pwe)
204 {
205 u8 pwd_value[SAE_MAX_PRIME_LEN];
206 size_t bits = sae->tmp->prime_len * 8;
207 u8 exp[1];
208 struct crypto_bignum *a, *b = NULL;
209 int res, is_val;
210 u8 pwd_value_valid;
211
212 wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-seed", pwd_seed, SHA256_MAC_LEN);
213
214 /* pwd-value = KDF-z(pwd-seed, "SAE Hunting and Pecking", p) */
215 if (sha256_prf_bits(pwd_seed, SHA256_MAC_LEN, "SAE Hunting and Pecking",
216 sae->tmp->dh->prime, sae->tmp->prime_len, pwd_value,
217 bits) < 0)
218 return -1;
219 wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value", pwd_value,
220 sae->tmp->prime_len);
221
222 /* Check whether pwd-value < p */
223 res = const_time_memcmp(pwd_value, sae->tmp->dh->prime,
224 sae->tmp->prime_len);
225 /* pwd-value >= p is invalid, so res is < 0 for the valid cases and
226 * the negative sign can be used to fill the mask for constant time
227 * selection */
228 pwd_value_valid = const_time_fill_msb(res);
229
230 /* If pwd-value >= p, force pwd-value to be < p and perform the
231 * calculations anyway to hide timing difference. The derived PWE will
232 * be ignored in that case. */
233 pwd_value[0] = const_time_select_u8(pwd_value_valid, pwd_value[0], 0);
234
235 /* PWE = pwd-value^((p-1)/r) modulo p */
236
237 res = -1;
238 a = crypto_bignum_init_set(pwd_value, sae->tmp->prime_len);
239 if (!a)
240 goto fail;
241
242 /* This is an optimization based on the used group that does not depend
243 * on the password in any way, so it is fine to use separate branches
244 * for this step without constant time operations. */
245 if (sae->tmp->dh->safe_prime) {
246 /*
247 * r = (p-1)/2 for the group used here, so this becomes:
248 * PWE = pwd-value^2 modulo p
249 */
250 exp[0] = 2;
251 b = crypto_bignum_init_set(exp, sizeof(exp));
252 } else {
253 /* Calculate exponent: (p-1)/r */
254 exp[0] = 1;
255 b = crypto_bignum_init_set(exp, sizeof(exp));
256 if (b == NULL ||
257 crypto_bignum_sub(sae->tmp->prime, b, b) < 0 ||
258 crypto_bignum_div(b, sae->tmp->order, b) < 0)
259 goto fail;
260 }
261
262 if (!b)
263 goto fail;
264
265 res = crypto_bignum_exptmod(a, b, sae->tmp->prime, pwe);
266 if (res < 0)
267 goto fail;
268
269 /* There were no fatal errors in calculations, so determine the return
270 * value using constant time operations. We get here for number of
271 * invalid cases which are cleared here after having performed all the
272 * computation. PWE is valid if pwd-value was less than prime and
273 * PWE > 1. Start with pwd-value check first and then use constant time
274 * operations to clear res to 0 if PWE is 0 or 1.
275 */
276 res = const_time_select_u8(pwd_value_valid, 1, 0);
277 is_val = crypto_bignum_is_zero(pwe);
278 res = const_time_select_u8(const_time_is_zero(is_val), res, 0);
279 is_val = crypto_bignum_is_one(pwe);
280 res = const_time_select_u8(const_time_is_zero(is_val), res, 0);
281
282 fail:
283 crypto_bignum_deinit(a, 1);
284 crypto_bignum_deinit(b, 1);
285 return res;
286 }
287 #endif /* CONFIG_SAE_NO_FFC */
288
289
sae_derive_pwe_ecc(struct sae_data * sae,const u8 * addr1,const u8 * addr2,const u8 * password,size_t password_len)290 static int sae_derive_pwe_ecc(struct sae_data *sae, const u8 *addr1,
291 const u8 *addr2, const u8 *password,
292 size_t password_len)
293 {
294 u8 counter, k;
295 u8 addrs[2 * ETH_ALEN];
296 const u8 *addr[2];
297 size_t len[2];
298 u8 *stub_password, *tmp_password;
299 int pwd_seed_odd = 0;
300 u8 prime[SAE_MAX_ECC_PRIME_LEN];
301 size_t prime_len;
302 struct crypto_bignum *x = NULL, *y = NULL, *qr = NULL, *qnr = NULL;
303 u8 x_bin[SAE_MAX_ECC_PRIME_LEN];
304 u8 x_cand_bin[SAE_MAX_ECC_PRIME_LEN];
305 u8 qr_bin[SAE_MAX_ECC_PRIME_LEN];
306 u8 qnr_bin[SAE_MAX_ECC_PRIME_LEN];
307 u8 x_y[2 * SAE_MAX_ECC_PRIME_LEN];
308 int res = -1;
309 u8 found = 0; /* 0 (false) or 0xff (true) to be used as const_time_*
310 * mask */
311 unsigned int is_eq;
312
313 os_memset(x_bin, 0, sizeof(x_bin));
314
315 stub_password = os_malloc(password_len);
316 tmp_password = os_malloc(password_len);
317 if (!stub_password || !tmp_password ||
318 random_get_bytes(stub_password, password_len) < 0)
319 goto fail;
320
321 prime_len = sae->tmp->prime_len;
322 if (crypto_bignum_to_bin(sae->tmp->prime, prime, sizeof(prime),
323 prime_len) < 0)
324 goto fail;
325
326 /*
327 * Create a random quadratic residue (qr) and quadratic non-residue
328 * (qnr) modulo p for blinding purposes during the loop.
329 */
330 if (dragonfly_get_random_qr_qnr(sae->tmp->prime, &qr, &qnr) < 0 ||
331 crypto_bignum_to_bin(qr, qr_bin, sizeof(qr_bin), prime_len) < 0 ||
332 crypto_bignum_to_bin(qnr, qnr_bin, sizeof(qnr_bin), prime_len) < 0)
333 goto fail;
334
335 wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password",
336 password, password_len);
337
338 /*
339 * H(salt, ikm) = HMAC-SHA256(salt, ikm)
340 * base = password
341 * pwd-seed = H(MAX(STA-A-MAC, STA-B-MAC) || MIN(STA-A-MAC, STA-B-MAC),
342 * base || counter)
343 */
344 sae_pwd_seed_key(addr1, addr2, addrs);
345
346 addr[0] = tmp_password;
347 len[0] = password_len;
348 addr[1] = &counter;
349 len[1] = sizeof(counter);
350
351 /*
352 * Continue for at least k iterations to protect against side-channel
353 * attacks that attempt to determine the number of iterations required
354 * in the loop.
355 */
356 k = dragonfly_min_pwe_loop_iter(sae->group);
357
358 for (counter = 1; counter <= k || !found; counter++) {
359 u8 pwd_seed[SHA256_MAC_LEN];
360
361 if (counter > 200) {
362 /* This should not happen in practice */
363 wpa_printf(MSG_DEBUG, "SAE: Failed to derive PWE");
364 break;
365 }
366
367 wpa_printf(MSG_DEBUG, "SAE: counter = %03u", counter);
368 const_time_select_bin(found, stub_password, password,
369 password_len, tmp_password);
370 if (hmac_sha256_vector(addrs, sizeof(addrs), 2,
371 addr, len, pwd_seed) < 0)
372 break;
373
374 res = sae_test_pwd_seed_ecc(sae, pwd_seed,
375 prime, qr_bin, qnr_bin, x_cand_bin);
376 const_time_select_bin(found, x_bin, x_cand_bin, prime_len,
377 x_bin);
378 pwd_seed_odd = const_time_select_u8(
379 found, pwd_seed_odd,
380 pwd_seed[SHA256_MAC_LEN - 1] & 0x01);
381 os_memset(pwd_seed, 0, sizeof(pwd_seed));
382 if (res < 0)
383 goto fail;
384 /* Need to minimize differences in handling res == 0 and 1 here
385 * to avoid differences in timing and instruction cache access,
386 * so use const_time_select_*() to make local copies of the
387 * values based on whether this loop iteration was the one that
388 * found the pwd-seed/x. */
389
390 /* found is 0 or 0xff here and res is 0 or 1. Bitwise OR of them
391 * (with res converted to 0/0xff) handles this in constant time.
392 */
393 found |= res * 0xff;
394 wpa_printf(MSG_DEBUG, "SAE: pwd-seed result %d found=0x%02x",
395 res, found);
396 }
397
398 if (!found) {
399 wpa_printf(MSG_DEBUG, "SAE: Could not generate PWE");
400 res = -1;
401 goto fail;
402 }
403
404 x = crypto_bignum_init_set(x_bin, prime_len);
405 if (!x) {
406 res = -1;
407 goto fail;
408 }
409
410 /* y = sqrt(x^3 + ax + b) mod p
411 * if LSB(save) == LSB(y): PWE = (x, y)
412 * else: PWE = (x, p - y)
413 *
414 * Calculate y and the two possible values for PWE and after that,
415 * use constant time selection to copy the correct alternative.
416 */
417 y = crypto_ec_point_compute_y_sqr(sae->tmp->ec, x);
418 if (!y ||
419 dragonfly_sqrt(sae->tmp->ec, y, y) < 0 ||
420 crypto_bignum_to_bin(y, x_y, SAE_MAX_ECC_PRIME_LEN,
421 prime_len) < 0 ||
422 crypto_bignum_sub(sae->tmp->prime, y, y) < 0 ||
423 crypto_bignum_to_bin(y, x_y + SAE_MAX_ECC_PRIME_LEN,
424 SAE_MAX_ECC_PRIME_LEN, prime_len) < 0) {
425 wpa_printf(MSG_DEBUG, "SAE: Could not solve y");
426 goto fail;
427 }
428
429 is_eq = const_time_eq(pwd_seed_odd, x_y[prime_len - 1] & 0x01);
430 const_time_select_bin(is_eq, x_y, x_y + SAE_MAX_ECC_PRIME_LEN,
431 prime_len, x_y + prime_len);
432 os_memcpy(x_y, x_bin, prime_len);
433 wpa_hexdump_key(MSG_DEBUG, "SAE: PWE", x_y, 2 * prime_len);
434 crypto_ec_point_deinit(sae->tmp->pwe_ecc, 1);
435 sae->tmp->pwe_ecc = crypto_ec_point_from_bin(sae->tmp->ec, x_y);
436 if (!sae->tmp->pwe_ecc) {
437 wpa_printf(MSG_DEBUG, "SAE: Could not generate PWE");
438 res = -1;
439 }
440
441 fail:
442 forced_memzero(x_y, sizeof(x_y));
443 crypto_bignum_deinit(qr, 0);
444 crypto_bignum_deinit(qnr, 0);
445 crypto_bignum_deinit(y, 1);
446 os_free(stub_password);
447 bin_clear_free(tmp_password, password_len);
448 crypto_bignum_deinit(x, 1);
449 os_memset(x_bin, 0, sizeof(x_bin));
450 os_memset(x_cand_bin, 0, sizeof(x_cand_bin));
451
452 return res;
453 }
454
455 #ifndef CONFIG_SAE_NO_FFC
sae_derive_pwe_ffc(struct sae_data * sae,const u8 * addr1,const u8 * addr2,const u8 * password,size_t password_len)456 static int sae_derive_pwe_ffc(struct sae_data *sae, const u8 *addr1,
457 const u8 *addr2, const u8 *password,
458 size_t password_len)
459 {
460 u8 counter, k, sel_counter = 0;
461 u8 addrs[2 * ETH_ALEN];
462 const u8 *addr[2];
463 size_t len[2];
464 u8 found = 0; /* 0 (false) or 0xff (true) to be used as const_time_*
465 * mask */
466 u8 mask;
467 struct crypto_bignum *pwe;
468 size_t prime_len = sae->tmp->prime_len * 8;
469 u8 *pwe_buf;
470
471 crypto_bignum_deinit(sae->tmp->pwe_ffc, 1);
472 sae->tmp->pwe_ffc = NULL;
473
474 /* Allocate a buffer to maintain selected and candidate PWE for constant
475 * time selection. */
476 pwe_buf = os_zalloc(prime_len * 2);
477 pwe = crypto_bignum_init();
478 if (!pwe_buf || !pwe)
479 goto fail;
480
481 wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password",
482 password, password_len);
483
484 /*
485 * H(salt, ikm) = HMAC-SHA256(salt, ikm)
486 * pwd-seed = H(MAX(STA-A-MAC, STA-B-MAC) || MIN(STA-A-MAC, STA-B-MAC),
487 * password || counter)
488 */
489 sae_pwd_seed_key(addr1, addr2, addrs);
490
491 addr[0] = password;
492 len[0] = password_len;
493 addr[1] = &counter;
494 len[1] = sizeof(counter);
495
496 k = dragonfly_min_pwe_loop_iter(sae->group);
497
498 for (counter = 1; counter <= k || !found; counter++) {
499 u8 pwd_seed[SHA256_MAC_LEN];
500 int res;
501
502 if (counter > 200) {
503 /* This should not happen in practice */
504 wpa_printf(MSG_DEBUG, "SAE: Failed to derive PWE");
505 break;
506 }
507
508 wpa_printf(MSG_DEBUG, "SAE: counter = %02u", counter);
509 if (hmac_sha256_vector(addrs, sizeof(addrs), 2,
510 addr, len, pwd_seed) < 0)
511 break;
512 res = sae_test_pwd_seed_ffc(sae, pwd_seed, pwe);
513 /* res is -1 for fatal failure, 0 if a valid PWE was not found,
514 * or 1 if a valid PWE was found. */
515 if (res < 0)
516 break;
517 /* Store the candidate PWE into the second half of pwe_buf and
518 * the selected PWE in the beginning of pwe_buf using constant
519 * time selection. */
520 if (crypto_bignum_to_bin(pwe, pwe_buf + prime_len, prime_len,
521 prime_len) < 0)
522 break;
523 const_time_select_bin(found, pwe_buf, pwe_buf + prime_len,
524 prime_len, pwe_buf);
525 sel_counter = const_time_select_u8(found, sel_counter, counter);
526 mask = const_time_eq_u8(res, 1);
527 found = const_time_select_u8(found, found, mask);
528 }
529
530 if (!found)
531 goto fail;
532
533 wpa_printf(MSG_DEBUG, "SAE: Use PWE from counter = %02u", sel_counter);
534 sae->tmp->pwe_ffc = crypto_bignum_init_set(pwe_buf, prime_len);
535 fail:
536 crypto_bignum_deinit(pwe, 1);
537 bin_clear_free(pwe_buf, prime_len * 2);
538 return sae->tmp->pwe_ffc ? 0 : -1;
539 }
540 #endif /* CONFIG_SAE_NO_FFC */
541
hkdf_extract(size_t hash_len,const u8 * salt,size_t salt_len,size_t num_elem,const u8 * addr[],const size_t len[],u8 * prk)542 static int hkdf_extract(size_t hash_len, const u8 *salt, size_t salt_len,
543 size_t num_elem, const u8 *addr[], const size_t len[],
544 u8 *prk)
545 {
546 if (hash_len == 32)
547 return hmac_sha256_vector(salt, salt_len, num_elem, addr, len,
548 prk);
549 #ifdef CONFIG_SHA384
550 if (hash_len == 48)
551 return hmac_sha384_vector(salt, salt_len, num_elem, addr, len,
552 prk);
553 #endif /* CONFIG_SHA384 */
554 #ifdef CONFIG_SHA512
555 if (hash_len == 64)
556 return hmac_sha512_vector(salt, salt_len, num_elem, addr, len,
557 prk);
558 #endif /* CONFIG_SHA512 */
559 return -1;
560 }
561
562
hkdf_expand(size_t hash_len,const u8 * prk,size_t prk_len,const char * info,u8 * okm,size_t okm_len)563 static int hkdf_expand(size_t hash_len, const u8 *prk, size_t prk_len,
564 const char *info, u8 *okm, size_t okm_len)
565 {
566 size_t info_len = os_strlen(info);
567
568 if (hash_len == 32)
569 return hmac_sha256_kdf(prk, prk_len, NULL,
570 (const u8 *) info, info_len,
571 okm, okm_len);
572 #ifdef CONFIG_SHA384
573 if (hash_len == 48)
574 return hmac_sha384_kdf(prk, prk_len, NULL,
575 (const u8 *) info, info_len,
576 okm, okm_len);
577 #endif /* CONFIG_SHA384 */
578 #ifdef CONFIG_SHA512
579 if (hash_len == 64)
580 return hmac_sha512_kdf(prk, prk_len, NULL,
581 (const u8 *) info, info_len,
582 okm, okm_len);
583 #endif /* CONFIG_SHA512 */
584 return -1;
585 }
586
587
sswu_curve_param(int group,int * z)588 static int sswu_curve_param(int group, int *z)
589 {
590 switch (group) {
591 case 19:
592 *z = -10;
593 return 0;
594 case 20:
595 *z = -12;
596 return 0;
597 case 21:
598 *z = -4;
599 return 0;
600 case 25:
601 case 29:
602 *z = -5;
603 return 0;
604 case 26:
605 *z = 31;
606 return 0;
607 case 28:
608 *z = -2;
609 return 0;
610 case 30:
611 *z = 7;
612 return 0;
613 }
614
615 return -1;
616 }
617
618
debug_print_bignum(const char * title,const struct crypto_bignum * a,size_t prime_len)619 static void debug_print_bignum(const char *title, const struct crypto_bignum *a,
620 size_t prime_len)
621 {
622 u8 *bin;
623
624 bin = os_malloc(prime_len);
625 if (bin && crypto_bignum_to_bin(a, bin, prime_len, prime_len) >= 0)
626 wpa_hexdump_key(MSG_DEBUG, title, bin, prime_len);
627 else
628 wpa_printf(MSG_DEBUG, "Could not print bignum (%s)", title);
629 bin_clear_free(bin, prime_len);
630 }
631
632
sswu(struct crypto_ec * ec,int group,const struct crypto_bignum * u)633 static struct crypto_ec_point * sswu(struct crypto_ec *ec, int group,
634 const struct crypto_bignum *u)
635 {
636 int z_int;
637 const struct crypto_bignum *a, *b, *prime;
638 struct crypto_bignum *u2, *t1, *t2, *z, *t, *zero, *one, *two, *three,
639 *x1a, *x1b, *y = NULL;
640 struct crypto_bignum *x1 = NULL, *x2, *gx1, *gx2, *v = NULL;
641 struct crypto_bignum *tmp = NULL;
642 unsigned int m_is_zero, is_qr, is_eq;
643 size_t prime_len;
644 u8 bin[SAE_MAX_ECC_PRIME_LEN];
645 u8 bin1[SAE_MAX_ECC_PRIME_LEN];
646 u8 bin2[SAE_MAX_ECC_PRIME_LEN];
647 u8 x_y[2 * SAE_MAX_ECC_PRIME_LEN];
648 struct crypto_ec_point *p = NULL;
649
650 if (sswu_curve_param(group, &z_int) < 0)
651 return NULL;
652
653 prime = crypto_ec_get_prime(ec);
654 prime_len = crypto_ec_prime_len(ec);
655 a = crypto_ec_get_a(ec);
656 b = crypto_ec_get_b(ec);
657
658 u2 = crypto_bignum_init();
659 t1 = crypto_bignum_init();
660 t2 = crypto_bignum_init();
661 z = crypto_bignum_init_uint(abs(z_int));
662 t = crypto_bignum_init();
663 zero = crypto_bignum_init_uint(0);
664 one = crypto_bignum_init_uint(1);
665 two = crypto_bignum_init_uint(2);
666 three = crypto_bignum_init_uint(3);
667 x1a = crypto_bignum_init();
668 x1b = crypto_bignum_init();
669 x2 = crypto_bignum_init();
670 gx1 = crypto_bignum_init();
671 gx2 = crypto_bignum_init();
672 tmp = crypto_bignum_init();
673 if (!u2 || !t1 || !t2 || !z || !t || !zero || !one || !two || !three ||
674 !x1a || !x1b || !x2 || !gx1 || !gx2 || !tmp)
675 goto fail;
676
677 if (z_int < 0 && crypto_bignum_sub(prime, z, z) < 0)
678 goto fail;
679
680 /* m = z^2 * u^4 + z * u^2 */
681 /* --> tmp = z * u^2, m = tmp^2 + tmp */
682
683 /* u2 = u^2
684 * t1 = z * u2
685 * t2 = t1^2
686 * m = t1 = t1 + t2 */
687 if (crypto_bignum_sqrmod(u, prime, u2) < 0 ||
688 crypto_bignum_mulmod(z, u2, prime, t1) < 0 ||
689 crypto_bignum_sqrmod(t1, prime, t2) < 0 ||
690 crypto_bignum_addmod(t1, t2, prime, t1) < 0)
691 goto fail;
692 debug_print_bignum("SSWU: m", t1, prime_len);
693
694 /* l = CEQ(m, 0)
695 * t = CSEL(l, 0, inverse(m); where inverse(x) is calculated as
696 * x^(p-2) modulo p which will handle m == 0 case correctly */
697 /* TODO: Make sure crypto_bignum_is_zero() is constant time */
698 m_is_zero = const_time_eq(crypto_bignum_is_zero(t1), 1);
699 /* t = m^(p-2) modulo p */
700 if (crypto_bignum_sub(prime, two, t2) < 0 ||
701 crypto_bignum_exptmod(t1, t2, prime, t) < 0)
702 goto fail;
703 debug_print_bignum("SSWU: t", t, prime_len);
704
705 /* b / (z * a) */
706 if (crypto_bignum_mulmod(z, a, prime, t1) < 0 ||
707 crypto_bignum_inverse(t1, prime, t1) < 0 ||
708 crypto_bignum_mulmod(b, t1, prime, x1a) < 0)
709 goto fail;
710 debug_print_bignum("SSWU: x1a = b / (z * a)", x1a, prime_len);
711
712 /* (-b/a) * (1 + t) */
713 if (crypto_bignum_sub(prime, b, t1) < 0 ||
714 crypto_bignum_inverse(a, prime, t2) < 0 ||
715 crypto_bignum_mulmod(t1, t2, prime, t1) < 0 ||
716 crypto_bignum_addmod(one, t, prime, t2) < 0 ||
717 crypto_bignum_mulmod(t1, t2, prime, x1b) < 0)
718 goto fail;
719 debug_print_bignum("SSWU: x1b = (-b/a) * (1 + t)", x1b, prime_len);
720
721 /* x1 = CSEL(CEQ(m, 0), x1a, x1b) */
722 if (crypto_bignum_to_bin(x1a, bin1, sizeof(bin1), prime_len) < 0 ||
723 crypto_bignum_to_bin(x1b, bin2, sizeof(bin2), prime_len) < 0)
724 goto fail;
725 const_time_select_bin(m_is_zero, bin1, bin2, prime_len, bin);
726 x1 = crypto_bignum_init_set(bin, prime_len);
727 if (!x1)
728 goto fail;
729 debug_print_bignum("SSWU: x1 = CSEL(l, x1a, x1b)", x1, prime_len);
730
731 /* gx1 = x1^3 + a * x1 + b */
732 if (crypto_bignum_exptmod(x1, three, prime, t1) < 0 ||
733 crypto_bignum_mulmod(a, x1, prime, t2) < 0 ||
734 crypto_bignum_addmod(t1, t2, prime, t1) < 0 ||
735 crypto_bignum_addmod(t1, b, prime, gx1) < 0)
736 goto fail;
737 debug_print_bignum("SSWU: gx1 = x1^3 + a * x1 + b", gx1, prime_len);
738
739 /* x2 = z * u^2 * x1 */
740 if (crypto_bignum_mulmod(z, u2, prime, t1) < 0 ||
741 crypto_bignum_mulmod(t1, x1, prime, x2) < 0)
742 goto fail;
743 debug_print_bignum("SSWU: x2 = z * u^2 * x1", x2, prime_len);
744
745 /* gx2 = x2^3 + a * x2 + b */
746 if (crypto_bignum_exptmod(x2, three, prime, t1) < 0 ||
747 crypto_bignum_mulmod(a, x2, prime, t2) < 0 ||
748 crypto_bignum_addmod(t1, t2, prime, t1) < 0 ||
749 crypto_bignum_addmod(t1, b, prime, gx2) < 0)
750 goto fail;
751 debug_print_bignum("SSWU: gx2 = x2^3 + a * x2 + b", gx2, prime_len);
752
753 /* l = gx1 is a quadratic residue modulo p
754 * --> gx1^((p-1)/2) modulo p is zero or one */
755 if (crypto_bignum_sub(prime, one, t1) < 0 ||
756 crypto_bignum_rshift(t1, 1, t1) < 0 ||
757 crypto_bignum_exptmod(gx1, t1, prime, tmp) < 0)
758 goto fail;
759 debug_print_bignum("SSWU: gx1^((p-1)/2) modulo p", t1, prime_len);
760 is_qr = const_time_eq(crypto_bignum_is_zero(tmp) |
761 crypto_bignum_is_one(tmp), 1);
762
763 /* v = CSEL(l, gx1, gx2) */
764 if (crypto_bignum_to_bin(gx1, bin1, sizeof(bin1), prime_len) < 0 ||
765 crypto_bignum_to_bin(gx2, bin2, sizeof(bin2), prime_len) < 0)
766 goto fail;
767 const_time_select_bin(is_qr, bin1, bin2, prime_len, bin);
768 v = crypto_bignum_init_set(bin, prime_len);
769 if (!v)
770 goto fail;
771 debug_print_bignum("SSWU: v = CSEL(l, gx1, gx2)", v, prime_len);
772
773 /* x = CSEL(l, x1, x2) */
774 if (crypto_bignum_to_bin(x1, bin1, sizeof(bin1), prime_len) < 0 ||
775 crypto_bignum_to_bin(x2, bin2, sizeof(bin2), prime_len) < 0)
776 goto fail;
777 const_time_select_bin(is_qr, bin1, bin2, prime_len, x_y);
778 wpa_hexdump_key(MSG_DEBUG, "SSWU: x = CSEL(l, x1, x2)", x_y, prime_len);
779
780 /* y = sqrt(v) */
781 y = crypto_bignum_init();
782 if (!y || dragonfly_sqrt(ec, v, y) < 0)
783 goto fail;
784 debug_print_bignum("SSWU: y = sqrt(v)", y, prime_len);
785
786 /* l = CEQ(LSB(u), LSB(y)) */
787 if (crypto_bignum_to_bin(u, bin1, sizeof(bin1), prime_len) < 0 ||
788 crypto_bignum_to_bin(y, bin2, sizeof(bin2), prime_len) < 0)
789 goto fail;
790 is_eq = const_time_eq(bin1[prime_len - 1] & 0x01,
791 bin2[prime_len - 1] & 0x01);
792
793 /* P = CSEL(l, (x,y), (x, p-y)) */
794 if (crypto_bignum_sub(prime, y, t1) < 0)
795 goto fail;
796 debug_print_bignum("SSWU: p - y", t1, prime_len);
797 if (crypto_bignum_to_bin(y, bin1, sizeof(bin1), prime_len) < 0 ||
798 crypto_bignum_to_bin(t1, bin2, sizeof(bin2), prime_len) < 0)
799 goto fail;
800 const_time_select_bin(is_eq, bin1, bin2, prime_len, &x_y[prime_len]);
801
802 /* output P */
803 wpa_hexdump_key(MSG_DEBUG, "SSWU: P.x", x_y, prime_len);
804 wpa_hexdump_key(MSG_DEBUG, "SSWU: P.y", &x_y[prime_len], prime_len);
805 p = crypto_ec_point_from_bin(ec, x_y);
806
807 fail:
808 crypto_bignum_deinit(tmp, 0);
809 crypto_bignum_deinit(u2, 1);
810 crypto_bignum_deinit(t1, 1);
811 crypto_bignum_deinit(t2, 1);
812 crypto_bignum_deinit(z, 0);
813 crypto_bignum_deinit(t, 1);
814 crypto_bignum_deinit(x1a, 1);
815 crypto_bignum_deinit(x1b, 1);
816 crypto_bignum_deinit(x1, 1);
817 crypto_bignum_deinit(x2, 1);
818 crypto_bignum_deinit(gx1, 1);
819 crypto_bignum_deinit(gx2, 1);
820 crypto_bignum_deinit(y, 1);
821 crypto_bignum_deinit(v, 1);
822 crypto_bignum_deinit(zero, 0);
823 crypto_bignum_deinit(one, 0);
824 crypto_bignum_deinit(two, 0);
825 crypto_bignum_deinit(three, 0);
826 forced_memzero(bin, sizeof(bin));
827 forced_memzero(bin1, sizeof(bin1));
828 forced_memzero(bin2, sizeof(bin2));
829 forced_memzero(x_y, sizeof(x_y));
830 return p;
831 }
832
833
sae_pwd_seed(size_t hash_len,const u8 * ssid,size_t ssid_len,const u8 * password,size_t password_len,const char * identifier,u8 * pwd_seed)834 static int sae_pwd_seed(size_t hash_len, const u8 *ssid, size_t ssid_len,
835 const u8 *password, size_t password_len,
836 const char *identifier, u8 *pwd_seed)
837 {
838 const u8 *addr[2];
839 size_t len[2];
840 size_t num_elem;
841
842 /* pwd-seed = HKDF-Extract(ssid, password [ || identifier ]) */
843 addr[0] = password;
844 len[0] = password_len;
845 num_elem = 1;
846 wpa_hexdump_ascii(MSG_DEBUG, "SAE: SSID", ssid, ssid_len);
847 wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password",
848 password, password_len);
849 if (identifier) {
850 wpa_printf(MSG_DEBUG, "SAE: password identifier: %s",
851 identifier);
852 addr[num_elem] = (const u8 *) identifier;
853 len[num_elem] = os_strlen(identifier);
854 num_elem++;
855 }
856 if (hkdf_extract(hash_len, ssid, ssid_len, num_elem, addr, len,
857 pwd_seed) < 0)
858 return -1;
859 wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-seed", pwd_seed, hash_len);
860 return 0;
861 }
862
863
sae_ecc_prime_len_2_hash_len(size_t prime_len)864 size_t sae_ecc_prime_len_2_hash_len(size_t prime_len)
865 {
866 if (prime_len <= 256 / 8)
867 return 32;
868 if (prime_len <= 384 / 8)
869 return 48;
870 return 64;
871 }
872
873
874 static struct crypto_ec_point *
sae_derive_pt_ecc(struct crypto_ec * ec,int group,const u8 * ssid,size_t ssid_len,const u8 * password,size_t password_len,const char * identifier)875 sae_derive_pt_ecc(struct crypto_ec *ec, int group,
876 const u8 *ssid, size_t ssid_len,
877 const u8 *password, size_t password_len,
878 const char *identifier)
879 {
880 u8 pwd_seed[64];
881 u8 pwd_value[SAE_MAX_ECC_PRIME_LEN * 2];
882 size_t pwd_value_len, hash_len, prime_len;
883 const struct crypto_bignum *prime;
884 struct crypto_bignum *bn = NULL;
885 struct crypto_ec_point *p1 = NULL, *p2 = NULL, *pt = NULL;
886
887 prime = crypto_ec_get_prime(ec);
888 prime_len = crypto_ec_prime_len(ec);
889 if (prime_len > SAE_MAX_ECC_PRIME_LEN)
890 goto fail;
891 hash_len = sae_ecc_prime_len_2_hash_len(prime_len);
892
893 /* len = olen(p) + ceil(olen(p)/2) */
894 pwd_value_len = prime_len + (prime_len + 1) / 2;
895
896 if (sae_pwd_seed(hash_len, ssid, ssid_len, password, password_len,
897 identifier, pwd_seed) < 0)
898 goto fail;
899
900 /* pwd-value = HKDF-Expand(pwd-seed, "SAE Hash to Element u1 P1", len)
901 */
902 if (hkdf_expand(hash_len, pwd_seed, hash_len,
903 "SAE Hash to Element u1 P1", pwd_value, pwd_value_len) <
904 0)
905 goto fail;
906 wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value (u1 P1)",
907 pwd_value, pwd_value_len);
908
909 /* u1 = pwd-value modulo p */
910 bn = crypto_bignum_init_set(pwd_value, pwd_value_len);
911 if (!bn || crypto_bignum_mod(bn, prime, bn) < 0 ||
912 crypto_bignum_to_bin(bn, pwd_value, sizeof(pwd_value),
913 prime_len) < 0)
914 goto fail;
915 wpa_hexdump_key(MSG_DEBUG, "SAE: u1", pwd_value, prime_len);
916
917 /* P1 = SSWU(u1) */
918 p1 = sswu(ec, group, bn);
919 if (!p1)
920 goto fail;
921
922 /* pwd-value = HKDF-Expand(pwd-seed, "SAE Hash to Element u2 P2", len)
923 */
924 if (hkdf_expand(hash_len, pwd_seed, hash_len,
925 "SAE Hash to Element u2 P2", pwd_value,
926 pwd_value_len) < 0)
927 goto fail;
928 wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value (u2 P2)",
929 pwd_value, pwd_value_len);
930
931 /* u2 = pwd-value modulo p */
932 crypto_bignum_deinit(bn, 1);
933 bn = crypto_bignum_init_set(pwd_value, pwd_value_len);
934 if (!bn || crypto_bignum_mod(bn, prime, bn) < 0 ||
935 crypto_bignum_to_bin(bn, pwd_value, sizeof(pwd_value),
936 prime_len) < 0)
937 goto fail;
938 wpa_hexdump_key(MSG_DEBUG, "SAE: u2", pwd_value, prime_len);
939
940 /* P2 = SSWU(u2) */
941 p2 = sswu(ec, group, bn);
942 if (!p2)
943 goto fail;
944
945 /* PT = elem-op(P1, P2) */
946 pt = crypto_ec_point_init(ec);
947 if (!pt)
948 goto fail;
949 if (crypto_ec_point_add(ec, p1, p2, pt) < 0) {
950 crypto_ec_point_deinit(pt, 1);
951 pt = NULL;
952 }
953
954 fail:
955 forced_memzero(pwd_seed, sizeof(pwd_seed));
956 forced_memzero(pwd_value, sizeof(pwd_value));
957 crypto_bignum_deinit(bn, 1);
958 crypto_ec_point_deinit(p1, 1);
959 crypto_ec_point_deinit(p2, 1);
960 return pt;
961 }
962
963
sae_ffc_prime_len_2_hash_len(size_t prime_len)964 size_t sae_ffc_prime_len_2_hash_len(size_t prime_len)
965 {
966 if (prime_len <= 2048 / 8)
967 return 32;
968 if (prime_len <= 3072 / 8)
969 return 48;
970 return 64;
971 }
972
973
974 static struct crypto_bignum *
sae_derive_pt_ffc(const struct dh_group * dh,int group,const u8 * ssid,size_t ssid_len,const u8 * password,size_t password_len,const char * identifier)975 sae_derive_pt_ffc(const struct dh_group *dh, int group,
976 const u8 *ssid, size_t ssid_len,
977 const u8 *password, size_t password_len,
978 const char *identifier)
979 {
980 size_t hash_len, prime_len, pwd_value_len;
981 struct crypto_bignum *prime, *order;
982 struct crypto_bignum *one = NULL, *two = NULL, *bn = NULL, *tmp = NULL,
983 *pt = NULL;
984 u8 pwd_seed[64];
985 u8 pwd_value[SAE_MAX_PRIME_LEN + SAE_MAX_PRIME_LEN / 2];
986
987 prime = crypto_bignum_init_set(dh->prime, dh->prime_len);
988 order = crypto_bignum_init_set(dh->order, dh->order_len);
989 if (!prime || !order)
990 goto fail;
991 prime_len = dh->prime_len;
992 if (prime_len > SAE_MAX_PRIME_LEN)
993 goto fail;
994 hash_len = sae_ffc_prime_len_2_hash_len(prime_len);
995
996 /* len = olen(p) + ceil(olen(p)/2) */
997 pwd_value_len = prime_len + (prime_len + 1) / 2;
998 if (pwd_value_len > sizeof(pwd_value))
999 goto fail;
1000
1001 if (sae_pwd_seed(hash_len, ssid, ssid_len, password, password_len,
1002 identifier, pwd_seed) < 0)
1003 goto fail;
1004
1005 /* pwd-value = HKDF-Expand(pwd-seed, "SAE Hash to Element", len) */
1006 if (hkdf_expand(hash_len, pwd_seed, hash_len,
1007 "SAE Hash to Element", pwd_value, pwd_value_len) < 0)
1008 goto fail;
1009 wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value",
1010 pwd_value, pwd_value_len);
1011
1012 /* pwd-value = (pwd-value modulo (p-2)) + 2 */
1013 bn = crypto_bignum_init_set(pwd_value, pwd_value_len);
1014 one = crypto_bignum_init_uint(1);
1015 two = crypto_bignum_init_uint(2);
1016 tmp = crypto_bignum_init();
1017 if (!bn || !one || !two || !tmp ||
1018 crypto_bignum_sub(prime, two, tmp) < 0 ||
1019 crypto_bignum_mod(bn, tmp, bn) < 0 ||
1020 crypto_bignum_add(bn, two, bn) < 0 ||
1021 crypto_bignum_to_bin(bn, pwd_value, sizeof(pwd_value),
1022 prime_len) < 0)
1023 goto fail;
1024 wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value(reduced)",
1025 pwd_value, prime_len);
1026
1027 /* PT = pwd-value^((p-1)/q) modulo p */
1028 pt = crypto_bignum_init();
1029 if (!pt ||
1030 crypto_bignum_sub(prime, one, tmp) < 0 ||
1031 crypto_bignum_div(tmp, order, tmp) < 0 ||
1032 crypto_bignum_exptmod(bn, tmp, prime, pt) < 0) {
1033 crypto_bignum_deinit(pt, 1);
1034 pt = NULL;
1035 goto fail;
1036 }
1037 debug_print_bignum("SAE: PT", pt, prime_len);
1038
1039 fail:
1040 forced_memzero(pwd_seed, sizeof(pwd_seed));
1041 forced_memzero(pwd_value, sizeof(pwd_value));
1042 crypto_bignum_deinit(bn, 1);
1043 crypto_bignum_deinit(tmp, 1);
1044 crypto_bignum_deinit(one, 0);
1045 crypto_bignum_deinit(two, 0);
1046 crypto_bignum_deinit(prime, 0);
1047 crypto_bignum_deinit(order, 0);
1048 return pt;
1049 }
1050
1051
1052 static struct sae_pt *
sae_derive_pt_group(int group,const u8 * ssid,size_t ssid_len,const u8 * password,size_t password_len,const char * identifier)1053 sae_derive_pt_group(int group, const u8 *ssid, size_t ssid_len,
1054 const u8 *password, size_t password_len,
1055 const char *identifier)
1056 {
1057 struct sae_pt *pt;
1058
1059 wpa_printf(MSG_DEBUG, "SAE: Derive PT - group %d", group);
1060
1061 if (ssid_len > 32)
1062 return NULL;
1063
1064 pt = os_zalloc(sizeof(*pt));
1065 if (!pt)
1066 return NULL;
1067
1068 #ifdef CONFIG_SAE_PK
1069 os_memcpy(pt->ssid, ssid, ssid_len);
1070 pt->ssid_len = ssid_len;
1071 #endif /* CONFIG_SAE_PK */
1072 pt->group = group;
1073 pt->ec = crypto_ec_init(group);
1074 if (pt->ec) {
1075 pt->ecc_pt = sae_derive_pt_ecc(pt->ec, group, ssid, ssid_len,
1076 password, password_len,
1077 identifier);
1078 if (!pt->ecc_pt) {
1079 wpa_printf(MSG_DEBUG, "SAE: Failed to derive PT");
1080 goto fail;
1081 }
1082
1083 return pt;
1084 }
1085
1086 pt->dh = dh_groups_get(group);
1087 if (!pt->dh) {
1088 wpa_printf(MSG_DEBUG, "SAE: Unsupported group %d", group);
1089 goto fail;
1090 }
1091
1092 pt->ffc_pt = sae_derive_pt_ffc(pt->dh, group, ssid, ssid_len,
1093 password, password_len, identifier);
1094 if (!pt->ffc_pt) {
1095 wpa_printf(MSG_DEBUG, "SAE: Failed to derive PT");
1096 goto fail;
1097 }
1098
1099 return pt;
1100 fail:
1101 sae_deinit_pt(pt);
1102 return NULL;
1103 }
1104
1105
sae_derive_pt(int * groups,const u8 * ssid,size_t ssid_len,const u8 * password,size_t password_len,const char * identifier)1106 struct sae_pt * sae_derive_pt(int *groups, const u8 *ssid, size_t ssid_len,
1107 const u8 *password, size_t password_len,
1108 const char *identifier)
1109 {
1110 struct sae_pt *pt = NULL, *last = NULL, *tmp;
1111 int default_groups[] = { 19, 0 };
1112 int i;
1113
1114 if (!groups)
1115 groups = default_groups;
1116 for (i = 0; groups[i] > 0; i++) {
1117 tmp = sae_derive_pt_group(groups[i], ssid, ssid_len, password,
1118 password_len, identifier);
1119 if (!tmp)
1120 continue;
1121
1122 if (last)
1123 last->next = tmp;
1124 else
1125 pt = tmp;
1126 last = tmp;
1127 }
1128
1129 return pt;
1130 }
1131
1132
sae_max_min_addr(const u8 * addr[],size_t len[],const u8 * addr1,const u8 * addr2)1133 static void sae_max_min_addr(const u8 *addr[], size_t len[],
1134 const u8 *addr1, const u8 *addr2)
1135 {
1136 len[0] = ETH_ALEN;
1137 len[1] = ETH_ALEN;
1138 if (os_memcmp(addr1, addr2, ETH_ALEN) > 0) {
1139 addr[0] = addr1;
1140 addr[1] = addr2;
1141 } else {
1142 addr[0] = addr2;
1143 addr[1] = addr1;
1144 }
1145 }
1146
1147
1148 struct crypto_ec_point *
sae_derive_pwe_from_pt_ecc(const struct sae_pt * pt,const u8 * addr1,const u8 * addr2)1149 sae_derive_pwe_from_pt_ecc(const struct sae_pt *pt,
1150 const u8 *addr1, const u8 *addr2)
1151 {
1152 u8 bin[SAE_MAX_ECC_PRIME_LEN * 2];
1153 size_t prime_len;
1154 const u8 *addr[2];
1155 size_t len[2];
1156 u8 salt[64], hash[64];
1157 size_t hash_len;
1158 const struct crypto_bignum *order;
1159 struct crypto_bignum *tmp = NULL, *val = NULL, *one = NULL;
1160 struct crypto_ec_point *pwe = NULL;
1161
1162 wpa_printf(MSG_DEBUG, "SAE: Derive PWE from PT");
1163 prime_len = crypto_ec_prime_len(pt->ec);
1164 if (crypto_ec_point_to_bin(pt->ec, pt->ecc_pt,
1165 bin, bin + prime_len) < 0)
1166 return NULL;
1167 wpa_hexdump_key(MSG_DEBUG, "SAE: PT.x", bin, prime_len);
1168 wpa_hexdump_key(MSG_DEBUG, "SAE: PT.y", bin + prime_len, prime_len);
1169
1170 sae_max_min_addr(addr, len, addr1, addr2);
1171
1172 /* val = H(0^n,
1173 * MAX(STA-A-MAC, STA-B-MAC) || MIN(STA-A-MAC, STA-B-MAC)) */
1174 wpa_printf(MSG_DEBUG, "SAE: val = H(0^n, MAX(addrs) || MIN(addrs))");
1175 hash_len = sae_ecc_prime_len_2_hash_len(prime_len);
1176 os_memset(salt, 0, hash_len);
1177 if (hkdf_extract(hash_len, salt, hash_len, 2, addr, len, hash) < 0)
1178 goto fail;
1179 wpa_hexdump(MSG_DEBUG, "SAE: val", hash, hash_len);
1180
1181 /* val = val modulo (q - 1) + 1 */
1182 order = crypto_ec_get_order(pt->ec);
1183 tmp = crypto_bignum_init();
1184 val = crypto_bignum_init_set(hash, hash_len);
1185 one = crypto_bignum_init_uint(1);
1186 if (!tmp || !val || !one ||
1187 crypto_bignum_sub(order, one, tmp) < 0 ||
1188 crypto_bignum_mod(val, tmp, val) < 0 ||
1189 crypto_bignum_add(val, one, val) < 0)
1190 goto fail;
1191 debug_print_bignum("SAE: val(reduced to 1..q-1)", val, prime_len);
1192
1193 /* PWE = scalar-op(val, PT) */
1194 pwe = crypto_ec_point_init(pt->ec);
1195 if (!pwe ||
1196 crypto_ec_point_mul(pt->ec, pt->ecc_pt, val, pwe) < 0 ||
1197 crypto_ec_point_to_bin(pt->ec, pwe, bin, bin + prime_len) < 0) {
1198 crypto_ec_point_deinit(pwe, 1);
1199 pwe = NULL;
1200 goto fail;
1201 }
1202 wpa_hexdump_key(MSG_DEBUG, "SAE: PWE.x", bin, prime_len);
1203 wpa_hexdump_key(MSG_DEBUG, "SAE: PWE.y", bin + prime_len, prime_len);
1204
1205 fail:
1206 crypto_bignum_deinit(tmp, 1);
1207 crypto_bignum_deinit(val, 1);
1208 crypto_bignum_deinit(one, 0);
1209 return pwe;
1210 }
1211
1212
1213 struct crypto_bignum *
sae_derive_pwe_from_pt_ffc(const struct sae_pt * pt,const u8 * addr1,const u8 * addr2)1214 sae_derive_pwe_from_pt_ffc(const struct sae_pt *pt,
1215 const u8 *addr1, const u8 *addr2)
1216 {
1217 size_t prime_len;
1218 const u8 *addr[2];
1219 size_t len[2];
1220 u8 salt[64], hash[64];
1221 size_t hash_len;
1222 struct crypto_bignum *tmp = NULL, *val = NULL, *one = NULL;
1223 struct crypto_bignum *pwe = NULL, *order = NULL, *prime = NULL;
1224
1225 wpa_printf(MSG_DEBUG, "SAE: Derive PWE from PT");
1226 prime = crypto_bignum_init_set(pt->dh->prime, pt->dh->prime_len);
1227 order = crypto_bignum_init_set(pt->dh->order, pt->dh->order_len);
1228 if (!prime || !order)
1229 goto fail;
1230 prime_len = pt->dh->prime_len;
1231
1232 sae_max_min_addr(addr, len, addr1, addr2);
1233
1234 /* val = H(0^n,
1235 * MAX(STA-A-MAC, STA-B-MAC) || MIN(STA-A-MAC, STA-B-MAC)) */
1236 wpa_printf(MSG_DEBUG, "SAE: val = H(0^n, MAX(addrs) || MIN(addrs))");
1237 hash_len = sae_ffc_prime_len_2_hash_len(prime_len);
1238 os_memset(salt, 0, hash_len);
1239 if (hkdf_extract(hash_len, salt, hash_len, 2, addr, len, hash) < 0)
1240 goto fail;
1241 wpa_hexdump(MSG_DEBUG, "SAE: val", hash, hash_len);
1242
1243 /* val = val modulo (q - 1) + 1 */
1244 tmp = crypto_bignum_init();
1245 val = crypto_bignum_init_set(hash, hash_len);
1246 one = crypto_bignum_init_uint(1);
1247 if (!tmp || !val || !one ||
1248 crypto_bignum_sub(order, one, tmp) < 0 ||
1249 crypto_bignum_mod(val, tmp, val) < 0 ||
1250 crypto_bignum_add(val, one, val) < 0)
1251 goto fail;
1252 debug_print_bignum("SAE: val(reduced to 1..q-1)", val, prime_len);
1253
1254 /* PWE = scalar-op(val, PT) */
1255 pwe = crypto_bignum_init();
1256 if (!pwe || crypto_bignum_exptmod(pt->ffc_pt, val, prime, pwe) < 0) {
1257 crypto_bignum_deinit(pwe, 1);
1258 pwe = NULL;
1259 goto fail;
1260 }
1261 debug_print_bignum("SAE: PWE", pwe, prime_len);
1262
1263 fail:
1264 crypto_bignum_deinit(tmp, 1);
1265 crypto_bignum_deinit(val, 1);
1266 crypto_bignum_deinit(one, 0);
1267 crypto_bignum_deinit(prime, 0);
1268 crypto_bignum_deinit(order, 0);
1269 return pwe;
1270 }
1271
1272
sae_deinit_pt(struct sae_pt * pt)1273 void sae_deinit_pt(struct sae_pt *pt)
1274 {
1275 struct sae_pt *prev;
1276
1277 while (pt) {
1278 crypto_ec_point_deinit(pt->ecc_pt, 1);
1279 crypto_bignum_deinit(pt->ffc_pt, 1);
1280 crypto_ec_deinit(pt->ec);
1281 prev = pt;
1282 pt = pt->next;
1283 os_free(prev);
1284 }
1285 }
1286
1287
sae_derive_commit_element_ecc(struct sae_data * sae,struct crypto_bignum * mask)1288 static int sae_derive_commit_element_ecc(struct sae_data *sae,
1289 struct crypto_bignum *mask)
1290 {
1291 /* COMMIT-ELEMENT = inverse(scalar-op(mask, PWE)) */
1292 if (!sae->tmp->own_commit_element_ecc) {
1293 sae->tmp->own_commit_element_ecc =
1294 crypto_ec_point_init(sae->tmp->ec);
1295 if (!sae->tmp->own_commit_element_ecc)
1296 return -1;
1297 }
1298
1299 if (crypto_ec_point_mul(sae->tmp->ec, sae->tmp->pwe_ecc, mask,
1300 sae->tmp->own_commit_element_ecc) < 0 ||
1301 crypto_ec_point_invert(sae->tmp->ec,
1302 sae->tmp->own_commit_element_ecc) < 0) {
1303 wpa_printf(MSG_DEBUG, "SAE: Could not compute commit-element");
1304 return -1;
1305 }
1306
1307 return 0;
1308 }
1309
1310 #ifndef CONFIG_SAE_NO_FFC
sae_derive_commit_element_ffc(struct sae_data * sae,struct crypto_bignum * mask)1311 static int sae_derive_commit_element_ffc(struct sae_data *sae,
1312 struct crypto_bignum *mask)
1313 {
1314 /* COMMIT-ELEMENT = inverse(scalar-op(mask, PWE)) */
1315 if (!sae->tmp->own_commit_element_ffc) {
1316 sae->tmp->own_commit_element_ffc = crypto_bignum_init();
1317 if (!sae->tmp->own_commit_element_ffc)
1318 return -1;
1319 }
1320
1321 if (crypto_bignum_exptmod(sae->tmp->pwe_ffc, mask, sae->tmp->prime,
1322 sae->tmp->own_commit_element_ffc) < 0 ||
1323 crypto_bignum_inverse(sae->tmp->own_commit_element_ffc,
1324 sae->tmp->prime,
1325 sae->tmp->own_commit_element_ffc) < 0) {
1326 wpa_printf(MSG_DEBUG, "SAE: Could not compute commit-element");
1327 return -1;
1328 }
1329
1330 return 0;
1331 }
1332 #endif /* CONFIG_SAE_NO_FFC */
1333
sae_derive_commit(struct sae_data * sae)1334 static int sae_derive_commit(struct sae_data *sae)
1335 {
1336 struct crypto_bignum *mask;
1337 int ret;
1338
1339 mask = crypto_bignum_init();
1340 if (!sae->tmp->sae_rand)
1341 sae->tmp->sae_rand = crypto_bignum_init();
1342 if (!sae->tmp->own_commit_scalar)
1343 sae->tmp->own_commit_scalar = crypto_bignum_init();
1344 ret = !mask || !sae->tmp->sae_rand || !sae->tmp->own_commit_scalar ||
1345 dragonfly_generate_scalar(sae->tmp->order, sae->tmp->sae_rand,
1346 mask,
1347 sae->tmp->own_commit_scalar) < 0 ||
1348 #ifndef CONFIG_SAE_NO_FFC
1349 (sae->tmp->ec &&
1350 sae_derive_commit_element_ecc(sae, mask) < 0) ||
1351 (sae->tmp->dh &&
1352 sae_derive_commit_element_ffc(sae, mask) < 0);
1353 #else
1354 (sae->tmp->ec &&
1355 sae_derive_commit_element_ecc(sae, mask) < 0);
1356 #endif
1357 crypto_bignum_deinit(mask, 1);
1358 return ret ? -1 : 0;
1359 }
1360
1361
sae_prepare_commit(const u8 * addr1,const u8 * addr2,const u8 * password,size_t password_len,struct sae_data * sae)1362 int sae_prepare_commit(const u8 *addr1, const u8 *addr2,
1363 const u8 *password, size_t password_len,
1364 struct sae_data *sae)
1365 {
1366 if (sae->tmp == NULL ||
1367 (sae->tmp->ec && sae_derive_pwe_ecc(sae, addr1, addr2, password,
1368 password_len) < 0)
1369 #ifndef CONFIG_SAE_NO_FFC
1370 || (sae->tmp->dh && sae_derive_pwe_ffc(sae, addr1, addr2, password, password_len) < 0)
1371 #endif
1372 )
1373 return -1;
1374
1375 sae->h2e = 0;
1376 sae->pk = 0;
1377 return sae_derive_commit(sae);
1378 }
1379
1380
sae_prepare_commit_pt(struct sae_data * sae,const struct sae_pt * pt,const u8 * addr1,const u8 * addr2,int * rejected_groups,const struct sae_pk * pk)1381 int sae_prepare_commit_pt(struct sae_data *sae, const struct sae_pt *pt,
1382 const u8 *addr1, const u8 *addr2,
1383 int *rejected_groups, const struct sae_pk *pk)
1384 {
1385 if (!sae->tmp)
1386 return -1;
1387
1388 while (pt) {
1389 if (pt->group == sae->group)
1390 break;
1391 pt = pt->next;
1392 }
1393 if (!pt) {
1394 wpa_printf(MSG_INFO, "SAE: Could not find PT for group %u",
1395 sae->group);
1396 return -1;
1397 }
1398
1399 #ifdef CONFIG_SAE_PK
1400 os_memcpy(sae->tmp->ssid, pt->ssid, pt->ssid_len);
1401 sae->tmp->ssid_len = pt->ssid_len;
1402 sae->tmp->ap_pk = pk;
1403 #endif /* CONFIG_SAE_PK */
1404 sae->tmp->own_addr_higher = os_memcmp(addr1, addr2, ETH_ALEN) > 0;
1405 wpabuf_free(sae->tmp->own_rejected_groups);
1406 sae->tmp->own_rejected_groups = NULL;
1407 if (rejected_groups) {
1408 int count, i;
1409 struct wpabuf *groups;
1410
1411 count = int_array_len(rejected_groups);
1412 groups = wpabuf_alloc(count * 2);
1413 if (!groups)
1414 return -1;
1415 for (i = 0; i < count; i++)
1416 wpabuf_put_le16(groups, rejected_groups[i]);
1417 sae->tmp->own_rejected_groups = groups;
1418 }
1419
1420 if (pt->ec) {
1421 crypto_ec_point_deinit(sae->tmp->pwe_ecc, 1);
1422 sae->tmp->pwe_ecc = sae_derive_pwe_from_pt_ecc(pt, addr1,
1423 addr2);
1424 if (!sae->tmp->pwe_ecc)
1425 return -1;
1426 }
1427
1428 if (pt->dh) {
1429 crypto_bignum_deinit(sae->tmp->pwe_ffc, 1);
1430 sae->tmp->pwe_ffc = sae_derive_pwe_from_pt_ffc(pt, addr1,
1431 addr2);
1432 if (!sae->tmp->pwe_ffc)
1433 return -1;
1434 }
1435
1436 sae->h2e = 1;
1437 return sae_derive_commit(sae);
1438 }
1439
1440
sae_derive_k_ecc(struct sae_data * sae,u8 * k)1441 static int sae_derive_k_ecc(struct sae_data *sae, u8 *k)
1442 {
1443 struct crypto_ec_point *K;
1444 int ret = -1;
1445
1446 K = crypto_ec_point_init(sae->tmp->ec);
1447 if (K == NULL)
1448 goto fail;
1449
1450 /*
1451 * K = scalar-op(rand, (elem-op(scalar-op(peer-commit-scalar, PWE),
1452 * PEER-COMMIT-ELEMENT)))
1453 * If K is identity element (point-at-infinity), reject
1454 * k = F(K) (= x coordinate)
1455 */
1456
1457 if (crypto_ec_point_mul(sae->tmp->ec, sae->tmp->pwe_ecc,
1458 sae->peer_commit_scalar, K) < 0 ||
1459 crypto_ec_point_add(sae->tmp->ec, K,
1460 sae->tmp->peer_commit_element_ecc, K) < 0 ||
1461 crypto_ec_point_mul(sae->tmp->ec, K, sae->tmp->sae_rand, K) < 0 ||
1462 crypto_ec_point_is_at_infinity(sae->tmp->ec, K) ||
1463 crypto_ec_point_to_bin(sae->tmp->ec, K, k, NULL) < 0) {
1464 wpa_printf(MSG_DEBUG, "SAE: Failed to calculate K and k");
1465 goto fail;
1466 }
1467
1468 wpa_hexdump_key(MSG_DEBUG, "SAE: k", k, sae->tmp->prime_len);
1469
1470 ret = 0;
1471 fail:
1472 crypto_ec_point_deinit(K, 1);
1473 return ret;
1474 }
1475
1476 #ifndef CONFIG_SAE_NO_FFC
sae_derive_k_ffc(struct sae_data * sae,u8 * k)1477 static int sae_derive_k_ffc(struct sae_data *sae, u8 *k)
1478 {
1479 struct crypto_bignum *K;
1480 int ret = -1;
1481
1482 K = crypto_bignum_init();
1483 if (K == NULL)
1484 goto fail;
1485
1486 /*
1487 * K = scalar-op(rand, (elem-op(scalar-op(peer-commit-scalar, PWE),
1488 * PEER-COMMIT-ELEMENT)))
1489 * If K is identity element (one), reject.
1490 * k = F(K) (= x coordinate)
1491 */
1492
1493 if (crypto_bignum_exptmod(sae->tmp->pwe_ffc, sae->peer_commit_scalar,
1494 sae->tmp->prime, K) < 0 ||
1495 crypto_bignum_mulmod(K, sae->tmp->peer_commit_element_ffc,
1496 sae->tmp->prime, K) < 0 ||
1497 crypto_bignum_exptmod(K, sae->tmp->sae_rand, sae->tmp->prime, K) < 0
1498 ||
1499 crypto_bignum_is_one(K) ||
1500 crypto_bignum_to_bin(K, k, SAE_MAX_PRIME_LEN, sae->tmp->prime_len) <
1501 0) {
1502 wpa_printf(MSG_DEBUG, "SAE: Failed to calculate K and k");
1503 goto fail;
1504 }
1505
1506 wpa_hexdump_key(MSG_DEBUG, "SAE: k", k, sae->tmp->prime_len);
1507
1508 ret = 0;
1509 fail:
1510 crypto_bignum_deinit(K, 1);
1511 return ret;
1512 }
1513 #endif /* CONFIG_SAE_NO_FFC */
1514
sae_kdf_hash(size_t hash_len,const u8 * k,const char * label,const u8 * context,size_t context_len,u8 * out,size_t out_len)1515 static int sae_kdf_hash(size_t hash_len, const u8 *k, const char *label,
1516 const u8 *context, size_t context_len,
1517 u8 *out, size_t out_len)
1518 {
1519 if (hash_len == 32)
1520 return sha256_prf(k, hash_len, label,
1521 context, context_len, out, out_len);
1522 #ifdef CONFIG_SHA384
1523 if (hash_len == 48)
1524 return sha384_prf(k, hash_len, label,
1525 context, context_len, out, out_len);
1526 #endif /* CONFIG_SHA384 */
1527 #ifdef CONFIG_SHA512
1528 if (hash_len == 64)
1529 return sha512_prf(k, hash_len, label,
1530 context, context_len, out, out_len);
1531 #endif /* CONFIG_SHA512 */
1532 return -1;
1533 }
1534
1535
sae_derive_keys(struct sae_data * sae,const u8 * k)1536 static int sae_derive_keys(struct sae_data *sae, const u8 *k)
1537 {
1538 u8 zero[SAE_MAX_HASH_LEN], val[SAE_MAX_PRIME_LEN];
1539 const u8 *salt;
1540 struct wpabuf *rejected_groups = NULL;
1541 u8 keyseed[SAE_MAX_HASH_LEN];
1542 u8 keys[2 * SAE_MAX_HASH_LEN + SAE_PMK_LEN];
1543 struct crypto_bignum *tmp;
1544 int ret = -1;
1545 size_t hash_len, salt_len, prime_len = sae->tmp->prime_len;
1546 const u8 *addr[1];
1547 size_t len[1];
1548
1549 tmp = crypto_bignum_init();
1550 if (tmp == NULL)
1551 goto fail;
1552
1553 /* keyseed = H(salt, k)
1554 * KCK || PMK = KDF-Hash-Length(keyseed, "SAE KCK and PMK",
1555 * (commit-scalar + peer-commit-scalar) modulo r)
1556 * PMKID = L((commit-scalar + peer-commit-scalar) modulo r, 0, 128)
1557 *
1558 * When SAE-PK is used,
1559 * KCK || PMK || KEK = KDF-Hash-Length(keyseed, "SAE-PK keys", context)
1560 */
1561 if (!sae->h2e)
1562 hash_len = SHA256_MAC_LEN;
1563 else if (sae->tmp->dh)
1564 hash_len = sae_ffc_prime_len_2_hash_len(prime_len);
1565 else
1566 hash_len = sae_ecc_prime_len_2_hash_len(prime_len);
1567 if (sae->h2e && (sae->tmp->own_rejected_groups ||
1568 sae->tmp->peer_rejected_groups)) {
1569 struct wpabuf *own, *peer;
1570
1571 own = sae->tmp->own_rejected_groups;
1572 peer = sae->tmp->peer_rejected_groups;
1573 salt_len = 0;
1574 if (own)
1575 salt_len += wpabuf_len(own);
1576 if (peer)
1577 salt_len += wpabuf_len(peer);
1578 rejected_groups = wpabuf_alloc(salt_len);
1579 if (!rejected_groups)
1580 goto fail;
1581 if (sae->tmp->own_addr_higher) {
1582 if (own)
1583 wpabuf_put_buf(rejected_groups, own);
1584 if (peer)
1585 wpabuf_put_buf(rejected_groups, peer);
1586 } else {
1587 if (peer)
1588 wpabuf_put_buf(rejected_groups, peer);
1589 if (own)
1590 wpabuf_put_buf(rejected_groups, own);
1591 }
1592 salt = wpabuf_head(rejected_groups);
1593 salt_len = wpabuf_len(rejected_groups);
1594 } else {
1595 os_memset(zero, 0, hash_len);
1596 salt = zero;
1597 salt_len = hash_len;
1598 }
1599 wpa_hexdump(MSG_DEBUG, "SAE: salt for keyseed derivation",
1600 salt, salt_len);
1601 addr[0] = k;
1602 len[0] = prime_len;
1603 if (hkdf_extract(hash_len, salt, salt_len, 1, addr, len, keyseed) < 0)
1604 goto fail;
1605 wpa_hexdump_key(MSG_DEBUG, "SAE: keyseed", keyseed, hash_len);
1606
1607 if (crypto_bignum_add(sae->tmp->own_commit_scalar,
1608 sae->peer_commit_scalar, tmp) < 0 ||
1609 crypto_bignum_mod(tmp, sae->tmp->order, tmp) < 0)
1610 goto fail;
1611 /* IEEE Std 802.11-2016 is not exactly clear on the encoding of the bit
1612 * string that is needed for KCK, PMK, and PMKID derivation, but it
1613 * seems to make most sense to encode the
1614 * (commit-scalar + peer-commit-scalar) mod r part as a bit string by
1615 * zero padding it from left to the length of the order (in full
1616 * octets). */
1617 crypto_bignum_to_bin(tmp, val, sizeof(val), sae->tmp->order_len);
1618 wpa_hexdump(MSG_DEBUG, "SAE: PMKID", val, SAE_PMKID_LEN);
1619
1620 #ifdef CONFIG_SAE_PK
1621 if (sae->pk) {
1622 if (sae_kdf_hash(hash_len, keyseed, "SAE-PK keys",
1623 val, sae->tmp->order_len,
1624 keys, 2 * hash_len + SAE_PMK_LEN) < 0)
1625 goto fail;
1626 } else {
1627 if (sae_kdf_hash(hash_len, keyseed, "SAE KCK and PMK",
1628 val, sae->tmp->order_len,
1629 keys, hash_len + SAE_PMK_LEN) < 0)
1630 goto fail;
1631 }
1632 #else /* CONFIG_SAE_PK */
1633 if (sae_kdf_hash(hash_len, keyseed, "SAE KCK and PMK",
1634 val, sae->tmp->order_len,
1635 keys, hash_len + SAE_PMK_LEN) < 0)
1636 goto fail;
1637 #endif /* !CONFIG_SAE_PK */
1638
1639 forced_memzero(keyseed, sizeof(keyseed));
1640 os_memcpy(sae->tmp->kck, keys, hash_len);
1641 sae->tmp->kck_len = hash_len;
1642 os_memcpy(sae->pmk, keys + hash_len, SAE_PMK_LEN);
1643 os_memcpy(sae->pmkid, val, SAE_PMKID_LEN);
1644 #ifdef CONFIG_SAE_PK
1645 if (sae->pk) {
1646 os_memcpy(sae->tmp->kek, keys + hash_len + SAE_PMK_LEN,
1647 hash_len);
1648 sae->tmp->kek_len = hash_len;
1649 wpa_hexdump_key(MSG_DEBUG, "SAE: KEK for SAE-PK",
1650 sae->tmp->kek, sae->tmp->kek_len);
1651 }
1652 #endif /* CONFIG_SAE_PK */
1653 forced_memzero(keys, sizeof(keys));
1654 wpa_hexdump_key(MSG_DEBUG, "SAE: KCK",
1655 sae->tmp->kck, sae->tmp->kck_len);
1656 wpa_hexdump_key(MSG_DEBUG, "SAE: PMK", sae->pmk, SAE_PMK_LEN);
1657
1658 ret = 0;
1659 fail:
1660 wpabuf_free(rejected_groups);
1661 crypto_bignum_deinit(tmp, 0);
1662 return ret;
1663 }
1664
1665
sae_process_commit(struct sae_data * sae)1666 int sae_process_commit(struct sae_data *sae)
1667 {
1668 u8 k[SAE_MAX_PRIME_LEN];
1669 if (sae->tmp == NULL ||
1670 (sae->tmp->ec && sae_derive_k_ecc(sae, k) < 0) ||
1671 #ifndef CONFIG_SAE_NO_FFC
1672 (sae->tmp->dh && sae_derive_k_ffc(sae, k) < 0) ||
1673 #endif /* CONFIG_SAE_NO_FFC */
1674 sae_derive_keys(sae, k) < 0)
1675 return -1;
1676 return 0;
1677 }
1678
1679
sae_write_commit(struct sae_data * sae,struct wpabuf * buf,const struct wpabuf * token,const char * identifier)1680 int sae_write_commit(struct sae_data *sae, struct wpabuf *buf,
1681 const struct wpabuf *token, const char *identifier)
1682 {
1683 u8 *pos;
1684
1685 if (sae->tmp == NULL)
1686 return -1;
1687
1688 wpabuf_put_le16(buf, sae->group); /* Finite Cyclic Group */
1689 if (!sae->h2e && token) {
1690 wpabuf_put_buf(buf, token);
1691 wpa_hexdump(MSG_DEBUG, "SAE: Anti-clogging token",
1692 wpabuf_head(token), wpabuf_len(token));
1693 }
1694 pos = wpabuf_put(buf, sae->tmp->prime_len);
1695 if (crypto_bignum_to_bin(sae->tmp->own_commit_scalar, pos,
1696 sae->tmp->prime_len, sae->tmp->prime_len) < 0)
1697 return -1;
1698 wpa_hexdump(MSG_DEBUG, "SAE: own commit-scalar",
1699 pos, sae->tmp->prime_len);
1700 if (sae->tmp->ec) {
1701 pos = wpabuf_put(buf, 2 * sae->tmp->prime_len);
1702 if (crypto_ec_point_to_bin(sae->tmp->ec,
1703 sae->tmp->own_commit_element_ecc,
1704 pos, pos + sae->tmp->prime_len) < 0)
1705 return -1;
1706 wpa_hexdump(MSG_DEBUG, "SAE: own commit-element(x)",
1707 pos, sae->tmp->prime_len);
1708 wpa_hexdump(MSG_DEBUG, "SAE: own commit-element(y)",
1709 pos + sae->tmp->prime_len, sae->tmp->prime_len);
1710 } else {
1711 pos = wpabuf_put(buf, sae->tmp->prime_len);
1712 if (crypto_bignum_to_bin(sae->tmp->own_commit_element_ffc, pos,
1713 sae->tmp->prime_len,
1714 sae->tmp->prime_len) < 0)
1715 return -1;
1716 wpa_hexdump(MSG_DEBUG, "SAE: own commit-element",
1717 pos, sae->tmp->prime_len);
1718 }
1719
1720 if (identifier) {
1721 /* Password Identifier element */
1722 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
1723 wpabuf_put_u8(buf, 1 + os_strlen(identifier));
1724 wpabuf_put_u8(buf, WLAN_EID_EXT_PASSWORD_IDENTIFIER);
1725 wpabuf_put_str(buf, identifier);
1726 wpa_printf(MSG_DEBUG, "SAE: own Password Identifier: %s",
1727 identifier);
1728 }
1729
1730 if (sae->h2e && sae->tmp->own_rejected_groups) {
1731 wpa_hexdump_buf(MSG_DEBUG, "SAE: own Rejected Groups",
1732 sae->tmp->own_rejected_groups);
1733 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
1734 wpabuf_put_u8(buf,
1735 1 + wpabuf_len(sae->tmp->own_rejected_groups));
1736 wpabuf_put_u8(buf, WLAN_EID_EXT_REJECTED_GROUPS);
1737 wpabuf_put_buf(buf, sae->tmp->own_rejected_groups);
1738 }
1739
1740 if (sae->h2e && token) {
1741 wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
1742 wpabuf_put_u8(buf, 1 + wpabuf_len(token));
1743 wpabuf_put_u8(buf, WLAN_EID_EXT_ANTI_CLOGGING_TOKEN);
1744 wpabuf_put_buf(buf, token);
1745 wpa_hexdump_buf(MSG_DEBUG,
1746 "SAE: Anti-clogging token (in container)",
1747 token);
1748 }
1749
1750 return 0;
1751 }
1752
1753
sae_group_allowed(struct sae_data * sae,int * allowed_groups,u16 group)1754 u16 sae_group_allowed(struct sae_data *sae, int *allowed_groups, u16 group)
1755 {
1756 if (allowed_groups) {
1757 int i;
1758 for (i = 0; allowed_groups[i] > 0; i++) {
1759 if (allowed_groups[i] == group)
1760 break;
1761 }
1762 if (allowed_groups[i] != group) {
1763 wpa_printf(MSG_DEBUG, "SAE: Proposed group %u not "
1764 "enabled in the current configuration",
1765 group);
1766 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
1767 }
1768 }
1769
1770 if (sae->state == SAE_COMMITTED && group != sae->group) {
1771 wpa_printf(MSG_DEBUG, "SAE: Do not allow group to be changed");
1772 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
1773 }
1774
1775 if (group != sae->group && sae_set_group(sae, group) < 0) {
1776 wpa_printf(MSG_DEBUG, "SAE: Unsupported Finite Cyclic Group %u",
1777 group);
1778 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
1779 }
1780
1781 if (sae->tmp == NULL) {
1782 wpa_printf(MSG_DEBUG, "SAE: Group information not yet initialized");
1783 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1784 }
1785
1786 #ifndef CONFIG_SAE_NO_FFC
1787 if (sae->tmp->dh && !allowed_groups) {
1788 wpa_printf(MSG_DEBUG, "SAE: Do not allow FFC group %u without "
1789 "explicit configuration enabling it", group);
1790 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
1791 }
1792 #endif /* CONFIG_SAE_NO_FFC */
1793
1794 return WLAN_STATUS_SUCCESS;
1795 }
1796
1797
sae_is_password_id_elem(const u8 * pos,const u8 * end)1798 static int sae_is_password_id_elem(const u8 *pos, const u8 *end)
1799 {
1800 return end - pos >= 3 &&
1801 pos[0] == WLAN_EID_EXTENSION &&
1802 pos[1] >= 1 &&
1803 end - pos - 2 >= pos[1] &&
1804 pos[2] == WLAN_EID_EXT_PASSWORD_IDENTIFIER;
1805 }
1806
1807
sae_is_rejected_groups_elem(const u8 * pos,const u8 * end)1808 static int sae_is_rejected_groups_elem(const u8 *pos, const u8 *end)
1809 {
1810 return end - pos >= 3 &&
1811 pos[0] == WLAN_EID_EXTENSION &&
1812 pos[1] >= 2 &&
1813 end - pos - 2 >= pos[1] &&
1814 pos[2] == WLAN_EID_EXT_REJECTED_GROUPS;
1815 }
1816
1817
sae_is_token_container_elem(const u8 * pos,const u8 * end)1818 static int sae_is_token_container_elem(const u8 *pos, const u8 *end)
1819 {
1820 return end - pos >= 3 &&
1821 pos[0] == WLAN_EID_EXTENSION &&
1822 pos[1] >= 1 &&
1823 end - pos - 2 >= pos[1] &&
1824 pos[2] == WLAN_EID_EXT_ANTI_CLOGGING_TOKEN;
1825 }
1826
1827
sae_parse_commit_token(struct sae_data * sae,const u8 ** pos,const u8 * end,const u8 ** token,size_t * token_len,int h2e)1828 static void sae_parse_commit_token(struct sae_data *sae, const u8 **pos,
1829 const u8 *end, const u8 **token,
1830 size_t *token_len, int h2e)
1831 {
1832 size_t scalar_elem_len, tlen;
1833
1834 if (token)
1835 *token = NULL;
1836 if (token_len)
1837 *token_len = 0;
1838
1839 if (h2e)
1840 return; /* No Anti-Clogging Token field outside container IE */
1841
1842 scalar_elem_len = (sae->tmp->ec ? 3 : 2) * sae->tmp->prime_len;
1843 if (scalar_elem_len >= (size_t) (end - *pos))
1844 return; /* No extra data beyond peer scalar and element */
1845
1846 tlen = end - (*pos + scalar_elem_len);
1847
1848 if (tlen < SHA256_MAC_LEN) {
1849 wpa_printf(MSG_DEBUG,
1850 "SAE: Too short optional data (%u octets) to include our Anti-Clogging Token",
1851 (unsigned int) tlen);
1852 return;
1853 }
1854
1855 wpa_hexdump(MSG_DEBUG, "SAE: Anti-Clogging Token", *pos, tlen);
1856 if (token)
1857 *token = *pos;
1858 if (token_len)
1859 *token_len = tlen;
1860 *pos += tlen;
1861 }
1862
1863
sae_parse_token_container(struct sae_data * sae,const u8 * pos,const u8 * end,const u8 ** token,size_t * token_len)1864 static void sae_parse_token_container(struct sae_data *sae,
1865 const u8 *pos, const u8 *end,
1866 const u8 **token, size_t *token_len)
1867 {
1868 wpa_hexdump(MSG_DEBUG, "SAE: Possible elements at the end of the frame",
1869 pos, end - pos);
1870 if (!sae_is_token_container_elem(pos, end))
1871 return;
1872 *token = pos + 3;
1873 *token_len = pos[1] - 1;
1874 wpa_hexdump(MSG_DEBUG, "SAE: Anti-Clogging Token (in container)",
1875 *token, *token_len);
1876 }
1877
1878
sae_parse_commit_scalar(struct sae_data * sae,const u8 ** pos,const u8 * end)1879 static u16 sae_parse_commit_scalar(struct sae_data *sae, const u8 **pos,
1880 const u8 *end)
1881 {
1882 struct crypto_bignum *peer_scalar;
1883
1884 if (sae->tmp->prime_len > end - *pos) {
1885 wpa_printf(MSG_DEBUG, "SAE: Not enough data for scalar");
1886 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1887 }
1888
1889 peer_scalar = crypto_bignum_init_set(*pos, sae->tmp->prime_len);
1890 if (peer_scalar == NULL)
1891 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1892
1893 /*
1894 * IEEE Std 802.11-2012, 11.3.8.6.1: If there is a protocol instance for
1895 * the peer and it is in Authenticated state, the new Commit Message
1896 * shall be dropped if the peer-scalar is identical to the one used in
1897 * the existing protocol instance.
1898 */
1899 if (sae->state == SAE_ACCEPTED && sae->peer_commit_scalar_accepted &&
1900 crypto_bignum_cmp(sae->peer_commit_scalar_accepted,
1901 peer_scalar) == 0) {
1902 wpa_printf(MSG_DEBUG, "SAE: Do not accept re-use of previous "
1903 "peer-commit-scalar");
1904 crypto_bignum_deinit(peer_scalar, 0);
1905 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1906 }
1907
1908 /* 1 < scalar < r */
1909 if (crypto_bignum_is_zero(peer_scalar) ||
1910 crypto_bignum_is_one(peer_scalar) ||
1911 crypto_bignum_cmp(peer_scalar, sae->tmp->order) >= 0) {
1912 wpa_printf(MSG_DEBUG, "SAE: Invalid peer scalar");
1913 crypto_bignum_deinit(peer_scalar, 0);
1914 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1915 }
1916
1917
1918 crypto_bignum_deinit(sae->peer_commit_scalar, 0);
1919 sae->peer_commit_scalar = peer_scalar;
1920 wpa_hexdump(MSG_DEBUG, "SAE: Peer commit-scalar",
1921 *pos, sae->tmp->prime_len);
1922 *pos += sae->tmp->prime_len;
1923
1924 return WLAN_STATUS_SUCCESS;
1925 }
1926
1927
sae_parse_commit_element_ecc(struct sae_data * sae,const u8 ** pos,const u8 * end)1928 static u16 sae_parse_commit_element_ecc(struct sae_data *sae, const u8 **pos,
1929 const u8 *end)
1930 {
1931 u8 prime[SAE_MAX_ECC_PRIME_LEN];
1932
1933 if (2 * sae->tmp->prime_len > end - *pos) {
1934 wpa_printf(MSG_DEBUG, "SAE: Not enough data for "
1935 "commit-element");
1936 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1937 }
1938
1939 if (crypto_bignum_to_bin(sae->tmp->prime, prime, sizeof(prime),
1940 sae->tmp->prime_len) < 0)
1941 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1942
1943 /* element x and y coordinates < p */
1944 if (os_memcmp(*pos, prime, sae->tmp->prime_len) >= 0 ||
1945 os_memcmp(*pos + sae->tmp->prime_len, prime,
1946 sae->tmp->prime_len) >= 0) {
1947 wpa_printf(MSG_DEBUG, "SAE: Invalid coordinates in peer "
1948 "element");
1949 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1950 }
1951
1952 wpa_hexdump(MSG_DEBUG, "SAE: Peer commit-element(x)",
1953 *pos, sae->tmp->prime_len);
1954 wpa_hexdump(MSG_DEBUG, "SAE: Peer commit-element(y)",
1955 *pos + sae->tmp->prime_len, sae->tmp->prime_len);
1956
1957 crypto_ec_point_deinit(sae->tmp->peer_commit_element_ecc, 0);
1958 sae->tmp->peer_commit_element_ecc =
1959 crypto_ec_point_from_bin(sae->tmp->ec, *pos);
1960 if (sae->tmp->peer_commit_element_ecc == NULL)
1961 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1962
1963 if (!crypto_ec_point_is_on_curve(sae->tmp->ec,
1964 sae->tmp->peer_commit_element_ecc)) {
1965 wpa_printf(MSG_DEBUG, "SAE: Peer element is not on curve");
1966 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1967 }
1968
1969 *pos += 2 * sae->tmp->prime_len;
1970
1971 return WLAN_STATUS_SUCCESS;
1972 }
1973
1974 #ifndef CONFIG_SAE_NO_FFC
sae_parse_commit_element_ffc(struct sae_data * sae,const u8 ** pos,const u8 * end)1975 static u16 sae_parse_commit_element_ffc(struct sae_data *sae, const u8 **pos,
1976 const u8 *end)
1977 {
1978 struct crypto_bignum *res, *one;
1979 const u8 one_bin[1] = { 0x01 };
1980
1981 if (sae->tmp->prime_len > end - *pos) {
1982 wpa_printf(MSG_DEBUG, "SAE: Not enough data for "
1983 "commit-element");
1984 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1985 }
1986 wpa_hexdump(MSG_DEBUG, "SAE: Peer commit-element", *pos,
1987 sae->tmp->prime_len);
1988
1989 crypto_bignum_deinit(sae->tmp->peer_commit_element_ffc, 0);
1990 sae->tmp->peer_commit_element_ffc =
1991 crypto_bignum_init_set(*pos, sae->tmp->prime_len);
1992 if (sae->tmp->peer_commit_element_ffc == NULL)
1993 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1994 /* 1 < element < p - 1 */
1995 res = crypto_bignum_init();
1996 one = crypto_bignum_init_set(one_bin, sizeof(one_bin));
1997 if (!res || !one ||
1998 crypto_bignum_sub(sae->tmp->prime, one, res) ||
1999 crypto_bignum_is_zero(sae->tmp->peer_commit_element_ffc) ||
2000 crypto_bignum_is_one(sae->tmp->peer_commit_element_ffc) ||
2001 crypto_bignum_cmp(sae->tmp->peer_commit_element_ffc, res) >= 0) {
2002 crypto_bignum_deinit(res, 0);
2003 crypto_bignum_deinit(one, 0);
2004 wpa_printf(MSG_DEBUG, "SAE: Invalid peer element");
2005 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2006 }
2007 crypto_bignum_deinit(one, 0);
2008
2009 /* scalar-op(r, ELEMENT) = 1 modulo p */
2010 if (crypto_bignum_exptmod(sae->tmp->peer_commit_element_ffc,
2011 sae->tmp->order, sae->tmp->prime, res) < 0 ||
2012 !crypto_bignum_is_one(res)) {
2013 wpa_printf(MSG_DEBUG, "SAE: Invalid peer element (scalar-op)");
2014 crypto_bignum_deinit(res, 0);
2015 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2016 }
2017 crypto_bignum_deinit(res, 0);
2018
2019 *pos += sae->tmp->prime_len;
2020
2021 return WLAN_STATUS_SUCCESS;
2022 }
2023 #endif /* CONFIG_SAE_NO_FFC */
2024
sae_parse_commit_element(struct sae_data * sae,const u8 ** pos,const u8 * end)2025 static u16 sae_parse_commit_element(struct sae_data *sae, const u8 **pos,
2026 const u8 *end)
2027 {
2028 #ifndef CONFIG_SAE_NO_FFC
2029 if (sae->tmp->dh)
2030 return sae_parse_commit_element_ffc(sae, pos, end);
2031 #endif /* CONFIG_SAE_NO_FFC */
2032 return sae_parse_commit_element_ecc(sae, pos, end);
2033 }
2034
2035 #ifndef CONFIG_SAE_NO_PW_ID
sae_parse_password_identifier(struct sae_data * sae,const u8 ** pos,const u8 * end)2036 static int sae_parse_password_identifier(struct sae_data *sae,
2037 const u8 **pos, const u8 *end)
2038 {
2039 const u8 *epos;
2040 u8 len;
2041
2042 wpa_hexdump(MSG_DEBUG, "SAE: Possible elements at the end of the frame",
2043 *pos, end - *pos);
2044 if (!sae_is_password_id_elem(*pos, end)) {
2045 if (sae->tmp->pw_id) {
2046 wpa_printf(MSG_DEBUG,
2047 "SAE: No Password Identifier included, but expected one (%s)",
2048 sae->tmp->pw_id);
2049 return WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER;
2050 }
2051 os_free(sae->tmp->pw_id);
2052 sae->tmp->pw_id = NULL;
2053 return WLAN_STATUS_SUCCESS; /* No Password Identifier */
2054 }
2055
2056 epos = *pos;
2057 epos++; /* skip IE type */
2058 len = *epos++; /* IE length */
2059 if (len > end - epos || len < 1)
2060 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2061 epos++; /* skip ext ID */
2062 len--;
2063
2064 if (sae->tmp->pw_id &&
2065 (len != os_strlen(sae->tmp->pw_id) ||
2066 os_memcmp(sae->tmp->pw_id, epos, len) != 0)) {
2067 wpa_printf(MSG_DEBUG,
2068 "SAE: The included Password Identifier does not match the expected one (%s)",
2069 sae->tmp->pw_id);
2070 return WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER;
2071 }
2072
2073 os_free(sae->tmp->pw_id);
2074 sae->tmp->pw_id = os_malloc(len + 1);
2075 if (!sae->tmp->pw_id)
2076 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2077 os_memcpy(sae->tmp->pw_id, epos, len);
2078 sae->tmp->pw_id[len] = '\0';
2079 wpa_hexdump_ascii(MSG_DEBUG, "SAE: Received Password Identifier",
2080 sae->tmp->pw_id, len);
2081 *pos = epos + len;
2082 return WLAN_STATUS_SUCCESS;
2083 }
2084 #endif
2085
sae_parse_rejected_groups(struct sae_data * sae,const u8 ** pos,const u8 * end)2086 static int sae_parse_rejected_groups(struct sae_data *sae,
2087 const u8 **pos, const u8 *end)
2088 {
2089 const u8 *epos;
2090 u8 len;
2091
2092 wpa_hexdump(MSG_DEBUG, "SAE: Possible elements at the end of the frame",
2093 *pos, end - *pos);
2094 if (!sae_is_rejected_groups_elem(*pos, end))
2095 return WLAN_STATUS_SUCCESS;
2096
2097 epos = *pos;
2098 epos++; /* skip IE type */
2099 len = *epos++; /* IE length */
2100 if (len > end - epos || len < 1)
2101 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2102 epos++; /* skip ext ID */
2103 len--;
2104
2105 wpabuf_free(sae->tmp->peer_rejected_groups);
2106 sae->tmp->peer_rejected_groups = wpabuf_alloc(len);
2107 if (!sae->tmp->peer_rejected_groups)
2108 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2109 wpabuf_put_data(sae->tmp->peer_rejected_groups, epos, len);
2110 wpa_hexdump_buf(MSG_DEBUG, "SAE: Received Rejected Groups list",
2111 sae->tmp->peer_rejected_groups);
2112 *pos = epos + len;
2113 return WLAN_STATUS_SUCCESS;
2114 }
2115
2116
sae_parse_commit(struct sae_data * sae,const u8 * data,size_t len,const u8 ** token,size_t * token_len,int * allowed_groups,int h2e)2117 u16 sae_parse_commit(struct sae_data *sae, const u8 *data, size_t len,
2118 const u8 **token, size_t *token_len, int *allowed_groups,
2119 int h2e)
2120 {
2121 const u8 *pos = data, *end = data + len;
2122 u16 res;
2123
2124 /* Check Finite Cyclic Group */
2125 if (end - pos < 2)
2126 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2127 res = sae_group_allowed(sae, allowed_groups, WPA_GET_LE16(pos));
2128 if (res != WLAN_STATUS_SUCCESS)
2129 return res;
2130 pos += 2;
2131
2132 /* Optional Anti-Clogging Token */
2133 sae_parse_commit_token(sae, &pos, end, token, token_len, h2e);
2134
2135 /* commit-scalar */
2136 res = sae_parse_commit_scalar(sae, &pos, end);
2137 if (res != WLAN_STATUS_SUCCESS)
2138 return res;
2139
2140 /* commit-element */
2141 res = sae_parse_commit_element(sae, &pos, end);
2142 if (res != WLAN_STATUS_SUCCESS)
2143 return res;
2144
2145 #ifndef CONFIG_SAE_NO_PW_ID
2146 /* Optional Password Identifier element */
2147 res = sae_parse_password_identifier(sae, &pos, end);
2148 if (res != WLAN_STATUS_SUCCESS)
2149 return res;
2150 #endif
2151 /* Conditional Rejected Groups element */
2152 if (h2e) {
2153 res = sae_parse_rejected_groups(sae, &pos, end);
2154 if (res != WLAN_STATUS_SUCCESS)
2155 return res;
2156 }
2157
2158 /* Optional Anti-Clogging Token Container element */
2159 if (h2e)
2160 sae_parse_token_container(sae, pos, end, token, token_len);
2161
2162 /*
2163 * Check whether peer-commit-scalar and PEER-COMMIT-ELEMENT are same as
2164 * the values we sent which would be evidence of a reflection attack.
2165 */
2166 if (!sae->tmp->own_commit_scalar ||
2167 crypto_bignum_cmp(sae->tmp->own_commit_scalar,
2168 sae->peer_commit_scalar) != 0 ||
2169 #ifndef CONFIG_SAE_NO_FFC
2170 (sae->tmp->dh &&
2171 (!sae->tmp->own_commit_element_ffc ||
2172 crypto_bignum_cmp(sae->tmp->own_commit_element_ffc,
2173 sae->tmp->peer_commit_element_ffc) != 0)) ||
2174 #endif /* CONFIG_SAE_NO_FFC */
2175 (sae->tmp->ec &&
2176 (!sae->tmp->own_commit_element_ecc ||
2177 crypto_ec_point_cmp(sae->tmp->ec,
2178 sae->tmp->own_commit_element_ecc,
2179 sae->tmp->peer_commit_element_ecc) != 0)))
2180 return WLAN_STATUS_SUCCESS; /* scalars/elements are different */
2181
2182 /*
2183 * This is a reflection attack - return special value to trigger caller
2184 * to silently discard the frame instead of replying with a specific
2185 * status code.
2186 */
2187 return SAE_SILENTLY_DISCARD;
2188 }
2189
2190
sae_cn_confirm(struct sae_data * sae,const u8 * sc,const struct crypto_bignum * scalar1,const u8 * element1,size_t element1_len,const struct crypto_bignum * scalar2,const u8 * element2,size_t element2_len,u8 * confirm)2191 static int sae_cn_confirm(struct sae_data *sae, const u8 *sc,
2192 const struct crypto_bignum *scalar1,
2193 const u8 *element1, size_t element1_len,
2194 const struct crypto_bignum *scalar2,
2195 const u8 *element2, size_t element2_len,
2196 u8 *confirm)
2197 {
2198 const u8 *addr[5];
2199 size_t len[5];
2200 u8 scalar_b1[SAE_MAX_PRIME_LEN], scalar_b2[SAE_MAX_PRIME_LEN];
2201
2202 /* Confirm
2203 * CN(key, X, Y, Z, ...) =
2204 * HMAC-SHA256(key, D2OS(X) || D2OS(Y) || D2OS(Z) | ...)
2205 * confirm = CN(KCK, send-confirm, commit-scalar, COMMIT-ELEMENT,
2206 * peer-commit-scalar, PEER-COMMIT-ELEMENT)
2207 * verifier = CN(KCK, peer-send-confirm, peer-commit-scalar,
2208 * PEER-COMMIT-ELEMENT, commit-scalar, COMMIT-ELEMENT)
2209 */
2210 if (crypto_bignum_to_bin(scalar1, scalar_b1, sizeof(scalar_b1),
2211 sae->tmp->prime_len) < 0 ||
2212 crypto_bignum_to_bin(scalar2, scalar_b2, sizeof(scalar_b2),
2213 sae->tmp->prime_len) < 0)
2214 return -1;
2215 addr[0] = sc;
2216 len[0] = 2;
2217 addr[1] = scalar_b1;
2218 len[1] = sae->tmp->prime_len;
2219 addr[2] = element1;
2220 len[2] = element1_len;
2221 addr[3] = scalar_b2;
2222 len[3] = sae->tmp->prime_len;
2223 addr[4] = element2;
2224 len[4] = element2_len;
2225 return hkdf_extract(sae->tmp->kck_len, sae->tmp->kck, sae->tmp->kck_len,
2226 5, addr, len, confirm);
2227 }
2228
2229
sae_cn_confirm_ecc(struct sae_data * sae,const u8 * sc,const struct crypto_bignum * scalar1,const struct crypto_ec_point * element1,const struct crypto_bignum * scalar2,const struct crypto_ec_point * element2,u8 * confirm)2230 static int sae_cn_confirm_ecc(struct sae_data *sae, const u8 *sc,
2231 const struct crypto_bignum *scalar1,
2232 const struct crypto_ec_point *element1,
2233 const struct crypto_bignum *scalar2,
2234 const struct crypto_ec_point *element2,
2235 u8 *confirm)
2236 {
2237 u8 element_b1[2 * SAE_MAX_ECC_PRIME_LEN];
2238 u8 element_b2[2 * SAE_MAX_ECC_PRIME_LEN];
2239
2240 if (crypto_ec_point_to_bin(sae->tmp->ec, element1, element_b1,
2241 element_b1 + sae->tmp->prime_len) < 0 ||
2242 crypto_ec_point_to_bin(sae->tmp->ec, element2, element_b2,
2243 element_b2 + sae->tmp->prime_len) < 0 ||
2244 sae_cn_confirm(sae, sc, scalar1, element_b1,
2245 2 * sae->tmp->prime_len,
2246 scalar2, element_b2, 2 * sae->tmp->prime_len,
2247 confirm) < 0)
2248 return -1;
2249 return 0;
2250 }
2251
2252 #ifndef CONFIG_SAE_NO_FFC
sae_cn_confirm_ffc(struct sae_data * sae,const u8 * sc,const struct crypto_bignum * scalar1,const struct crypto_bignum * element1,const struct crypto_bignum * scalar2,const struct crypto_bignum * element2,u8 * confirm)2253 static int sae_cn_confirm_ffc(struct sae_data *sae, const u8 *sc,
2254 const struct crypto_bignum *scalar1,
2255 const struct crypto_bignum *element1,
2256 const struct crypto_bignum *scalar2,
2257 const struct crypto_bignum *element2,
2258 u8 *confirm)
2259 {
2260 u8 element_b1[SAE_MAX_PRIME_LEN];
2261 u8 element_b2[SAE_MAX_PRIME_LEN];
2262
2263 if (crypto_bignum_to_bin(element1, element_b1, sizeof(element_b1),
2264 sae->tmp->prime_len) < 0 ||
2265 crypto_bignum_to_bin(element2, element_b2, sizeof(element_b2),
2266 sae->tmp->prime_len) < 0 ||
2267 sae_cn_confirm(sae, sc, scalar1, element_b1, sae->tmp->prime_len,
2268 scalar2, element_b2, sae->tmp->prime_len,
2269 confirm) < 0)
2270 return -1;
2271 return 0;
2272 }
2273 #endif /* CONFIG_SAE_NO_FFC */
2274
sae_write_confirm(struct sae_data * sae,struct wpabuf * buf)2275 int sae_write_confirm(struct sae_data *sae, struct wpabuf *buf)
2276 {
2277 const u8 *sc;
2278 size_t hash_len;
2279 int res;
2280
2281 if (sae->tmp == NULL)
2282 return -1;
2283
2284 hash_len = sae->tmp->kck_len;
2285
2286 /* Send-Confirm */
2287 if (sae->send_confirm < 0xffff)
2288 sae->send_confirm++;
2289 sc = wpabuf_put(buf, 0);
2290 wpabuf_put_le16(buf, sae->send_confirm);
2291
2292 if (sae->tmp->ec)
2293 res = sae_cn_confirm_ecc(sae, sc, sae->tmp->own_commit_scalar,
2294 sae->tmp->own_commit_element_ecc,
2295 sae->peer_commit_scalar,
2296 sae->tmp->peer_commit_element_ecc,
2297 wpabuf_put(buf, hash_len));
2298 #ifndef CONFIG_SAE_NO_FFC
2299 else
2300 res = sae_cn_confirm_ffc(sae, sc, sae->tmp->own_commit_scalar,
2301 sae->tmp->own_commit_element_ffc,
2302 sae->peer_commit_scalar,
2303 sae->tmp->peer_commit_element_ffc,
2304 wpabuf_put(buf, hash_len));
2305 #endif /* CONFIG_SAE_NO_FFC */
2306 if (res)
2307 return res;
2308
2309 #ifdef CONFIG_SAE_PK
2310 if (sae_write_confirm_pk(sae, buf) < 0)
2311 return -1;
2312 #endif /* CONFIG_SAE_PK */
2313
2314 return 0;
2315 }
2316
2317
sae_check_confirm(struct sae_data * sae,const u8 * data,size_t len)2318 int sae_check_confirm(struct sae_data *sae, const u8 *data, size_t len)
2319 {
2320 u8 verifier[SAE_MAX_HASH_LEN];
2321 size_t hash_len;
2322
2323 if (!sae->tmp)
2324 return -1;
2325
2326 hash_len = sae->tmp->kck_len;
2327 if (len < 2 + hash_len) {
2328 wpa_printf(MSG_DEBUG, "SAE: Too short confirm message");
2329 return -1;
2330 }
2331
2332 wpa_printf(MSG_DEBUG, "SAE: peer-send-confirm %u", WPA_GET_LE16(data));
2333
2334 if (!sae->peer_commit_scalar || !sae->tmp->own_commit_scalar) {
2335 wpa_printf(MSG_DEBUG, "SAE: Temporary data not yet available");
2336 return -1;
2337 }
2338
2339 if (sae->tmp->ec) {
2340 if (!sae->tmp->peer_commit_element_ecc ||
2341 !sae->tmp->own_commit_element_ecc ||
2342 sae_cn_confirm_ecc(sae, data, sae->peer_commit_scalar,
2343 sae->tmp->peer_commit_element_ecc,
2344 sae->tmp->own_commit_scalar,
2345 sae->tmp->own_commit_element_ecc,
2346 verifier) < 0)
2347 return -1;
2348 }
2349 #ifndef CONFIG_SAE_NO_FFC
2350 else {
2351 if (!sae->tmp->peer_commit_element_ffc ||
2352 !sae->tmp->own_commit_element_ffc ||
2353 sae_cn_confirm_ffc(sae, data, sae->peer_commit_scalar,
2354 sae->tmp->peer_commit_element_ffc,
2355 sae->tmp->own_commit_scalar,
2356 sae->tmp->own_commit_element_ffc,
2357 verifier) < 0)
2358 return -1;
2359 }
2360 #endif /* CONFIG_SAE_NO_FFC */
2361
2362 if (os_memcmp_const(verifier, data + 2, hash_len) != 0) {
2363 wpa_printf(MSG_DEBUG, "SAE: Confirm mismatch");
2364 wpa_hexdump(MSG_DEBUG, "SAE: Received confirm",
2365 data + 2, hash_len);
2366 wpa_hexdump(MSG_DEBUG, "SAE: Calculated verifier",
2367 verifier, hash_len);
2368 return -1;
2369 }
2370
2371 #ifdef CONFIG_SAE_PK
2372 if (sae_check_confirm_pk(sae, data + 2 + hash_len,
2373 len - 2 - hash_len) < 0)
2374 return -1;
2375 #endif /* CONFIG_SAE_PK */
2376
2377 return 0;
2378 }
2379
2380 #ifndef CONFIG_SAE_CROP
sae_state_txt(enum sae_state state)2381 const char * sae_state_txt(enum sae_state state)
2382 {
2383 switch (state) {
2384 case SAE_NOTHING:
2385 return "Nothing";
2386 case SAE_COMMITTED:
2387 return "Committed";
2388 case SAE_CONFIRMED:
2389 return "Confirmed";
2390 case SAE_ACCEPTED:
2391 return "Accepted";
2392 }
2393 return "?";
2394 }
2395 #endif
2396