1 /*
2 * WPA/RSN - Shared functions for supplicant and authenticator
3 * Copyright (c) 2002-2008, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14 #ifdef ESP_SUPPLICANT
15
16 #include "utils/includes.h"
17 #include "utils/common.h"
18 #include "common/defs.h"
19 #include "common/ieee802_11_defs.h"
20 #include "common/wpa_common.h"
21 #include "rsn_supp/wpa.h"
22 #include "crypto/sha1.h"
23 #include "crypto/sha256.h"
24 #include "crypto/sha384.h"
25 #include "crypto/md5.h"
26 #include "crypto/aes.h"
27 #include "crypto/aes_wrap.h"
28
29 #define MD5_MAC_LEN 16
30
wpa_kck_len(int akmp)31 static unsigned int wpa_kck_len(int akmp)
32 {
33 if (akmp == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
34 return 24;
35 return 16;
36 }
37
wpa_kek_len(int akmp)38 static unsigned int wpa_kek_len(int akmp)
39 {
40 if (akmp == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
41 return 32;
42 return 16;
43 }
44
45
wpa_mic_len(int akmp)46 unsigned int wpa_mic_len(int akmp)
47 {
48 if (akmp == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192)
49 return 24;
50
51 return 16;
52 }
53
rsn_selector_to_bitfield(const u8 * s)54 static int rsn_selector_to_bitfield(const u8 *s)
55 {
56 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_NONE)
57 return WPA_CIPHER_NONE;
58 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_WEP40)
59 return WPA_CIPHER_WEP40;
60 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_TKIP)
61 return WPA_CIPHER_TKIP;
62 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_CCMP)
63 return WPA_CIPHER_CCMP;
64 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_WEP104)
65 return WPA_CIPHER_WEP104;
66 #ifdef COFIG_GCMP
67 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_GCMP)
68 return WPA_CIPHER_GCMP;
69 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_GCMP_256)
70 return WPA_CIPHER_GCMP_256;
71 #endif
72 #ifdef CONFIG_IEEE80211W
73 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_AES_128_CMAC)
74 return WPA_CIPHER_AES_128_CMAC;
75 #ifdef COFIG_GMAC
76 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_BIP_GMAC_128)
77 return WPA_CIPHER_BIP_GMAC_128;
78 if (RSN_SELECTOR_GET(s) == RSN_CIPHER_SUITE_BIP_GMAC_256)
79 return WPA_CIPHER_BIP_GMAC_256;
80 #endif
81 #endif /* CONFIG_IEEE80211W */
82
83 return 0;
84 }
85
rsn_key_mgmt_to_bitfield(const u8 * s)86 static int rsn_key_mgmt_to_bitfield(const u8 *s)
87 {
88 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_UNSPEC_802_1X)
89 return WPA_KEY_MGMT_IEEE8021X;
90 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X)
91 return WPA_KEY_MGMT_PSK;
92 #ifdef CONFIG_IEEE80211R
93 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_802_1X)
94 return WPA_KEY_MGMT_FT_IEEE8021X;
95 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_FT_PSK)
96 return WPA_KEY_MGMT_FT_PSK;
97 #endif /* CONFIG_IEEE80211R */
98 #ifdef CONFIG_IEEE80211W
99 #ifdef CONFIG_WPA3_SAE
100 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_SAE)
101 return WPA_KEY_MGMT_SAE;
102 #endif /* CONFIG_WPA3_SAE */
103 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SHA256)
104 return WPA_KEY_MGMT_IEEE8021X_SHA256;
105 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_PSK_SHA256)
106 return WPA_KEY_MGMT_PSK_SHA256;
107 #endif /* CONFIG_IEEE80211W */
108 #ifdef CONFIG_SUITEB
109 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SUITE_B)
110 return WPA_KEY_MGMT_IEEE8021X_SUITE_B;
111 #endif
112 #ifdef CONFIG_SUITEB192
113 if (RSN_SELECTOR_GET(s) == RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192)
114 return WPA_KEY_MGMT_IEEE8021X_SUITE_B_192;
115 #endif
116 return 0;
117 }
118
wpa_selector_to_bitfield(const u8 * s)119 static int wpa_selector_to_bitfield(const u8 *s)
120 {
121 if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_NONE)
122 return WPA_CIPHER_NONE;
123 if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_WEP40)
124 return WPA_CIPHER_WEP40;
125 if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_TKIP)
126 return WPA_CIPHER_TKIP;
127 if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_CCMP)
128 return WPA_CIPHER_CCMP;
129 if (RSN_SELECTOR_GET(s) == WPA_CIPHER_SUITE_WEP104)
130 return WPA_CIPHER_WEP104;
131 return 0;
132 }
133
wpa_key_mgmt_to_bitfield(const u8 * s)134 static int wpa_key_mgmt_to_bitfield(const u8 *s)
135 {
136 if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_UNSPEC_802_1X)
137 return WPA_KEY_MGMT_IEEE8021X;
138 if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X)
139 return WPA_KEY_MGMT_PSK;
140 if (RSN_SELECTOR_GET(s) == WPA_AUTH_KEY_MGMT_NONE)
141 return WPA_KEY_MGMT_WPA_NONE;
142 return 0;
143 }
144
wpa_cipher_valid_mgmt_group(int cipher)145 int wpa_cipher_valid_mgmt_group(int cipher)
146 {
147 return cipher == WPA_CIPHER_AES_128_CMAC ||
148 cipher == WPA_CIPHER_BIP_GMAC_128 ||
149 cipher == WPA_CIPHER_BIP_GMAC_256;
150 }
151
152 /**
153 * wpa_parse_wpa_ie_rsn - Parse RSN IE
154 * @rsn_ie: Buffer containing RSN IE
155 * @rsn_ie_len: RSN IE buffer length (including IE number and length octets)
156 * @data: Pointer to structure that will be filled in with parsed data
157 * Returns: 0 on success, <0 on failure
158 */
wpa_parse_wpa_ie_rsn(const u8 * rsn_ie,size_t rsn_ie_len,struct wpa_ie_data * data)159 int wpa_parse_wpa_ie_rsn(const u8 *rsn_ie, size_t rsn_ie_len,
160 struct wpa_ie_data *data)
161 {
162 const struct rsn_ie_hdr *hdr;
163 const u8 *pos;
164 int left;
165 int i, count;
166
167 memset(data, 0, sizeof(*data));
168 data->proto = WPA_PROTO_RSN;
169 data->pairwise_cipher = WPA_CIPHER_CCMP;
170 data->group_cipher = WPA_CIPHER_CCMP;
171 data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
172 data->capabilities = 0;
173 data->pmkid = NULL;
174 data->num_pmkid = 0;
175 data->mgmt_group_cipher = WPA_CIPHER_AES_128_CMAC;
176
177 wpa_hexdump(MSG_DEBUG, "rsn_ie", rsn_ie, rsn_ie_len);
178 if (rsn_ie_len == 0) {
179 /* No RSN IE - fail silently */
180 return -1;
181 }
182
183 if (rsn_ie_len < sizeof(struct rsn_ie_hdr)) {
184 #ifdef DEBUG_PRINT
185 wpa_printf(MSG_DEBUG, "%s: ie len too short %lu",
186 __func__, (unsigned long) rsn_ie_len);
187 #endif
188 return -1;
189 }
190
191 hdr = (const struct rsn_ie_hdr *) rsn_ie;
192
193 if (hdr->elem_id != WLAN_EID_RSN ||
194 hdr->len != rsn_ie_len - 2 ||
195 WPA_GET_LE16(hdr->version) != RSN_VERSION) {
196 #ifdef DEBUG_PRINT
197 wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
198 __func__);
199 #endif
200 return -2;
201 }
202
203 pos = (const u8 *) (hdr + 1);
204 left = rsn_ie_len - sizeof(*hdr);
205
206 if (left >= RSN_SELECTOR_LEN) {
207 data->group_cipher = rsn_selector_to_bitfield(pos);
208 pos += RSN_SELECTOR_LEN;
209 left -= RSN_SELECTOR_LEN;
210 } else if (left > 0) {
211 #ifdef DEBUG_PRINT
212 wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
213 __func__, left);
214 #endif
215 return -3;
216 }
217
218 if (left >= 2) {
219 data->pairwise_cipher = 0;
220 count = WPA_GET_LE16(pos);
221 pos += 2;
222 left -= 2;
223 if (count == 0 || left < count * RSN_SELECTOR_LEN) {
224 #ifdef DEBUG_PRINT
225 wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
226 "count %u left %u", __func__, count, left);
227 #endif
228 return -4;
229 }
230 for (i = 0; i < count; i++) {
231 data->pairwise_cipher |= rsn_selector_to_bitfield(pos);
232 pos += RSN_SELECTOR_LEN;
233 left -= RSN_SELECTOR_LEN;
234 }
235 } else if (left == 1) {
236 #ifdef DEBUG_PRINT
237 wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
238 __func__);
239 #endif
240 return -5;
241 }
242
243 if (left >= 2) {
244 data->key_mgmt = 0;
245 count = WPA_GET_LE16(pos);
246 pos += 2;
247 left -= 2;
248 if (count == 0 || left < count * RSN_SELECTOR_LEN) {
249 #ifdef DEBUG_PRINT
250 wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
251 "count %u left %u", __func__, count, left);
252 #endif
253 return -6;
254 }
255 for (i = 0; i < count; i++) {
256 data->key_mgmt |= rsn_key_mgmt_to_bitfield(pos);
257 pos += RSN_SELECTOR_LEN;
258 left -= RSN_SELECTOR_LEN;
259 }
260 } else if (left == 1) {
261 #ifdef DEBUG_PRINT
262 wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
263 __func__);
264 #endif
265 return -7;
266 }
267
268 if (left >= 2) {
269 data->capabilities = WPA_GET_LE16(pos);
270 pos += 2;
271 left -= 2;
272 }
273
274 if (left >= 2) {
275 data->num_pmkid = WPA_GET_LE16(pos);
276 pos += 2;
277 left -= 2;
278 if (left < (int) data->num_pmkid * PMKID_LEN) {
279 #ifdef DEBUG_PRINT
280 wpa_printf(MSG_DEBUG, "%s: PMKID underflow "
281 "(num_pmkid=%lu left=%d)",
282 __func__, (unsigned long) data->num_pmkid,
283 left);
284 #endif
285 data->num_pmkid = 0;
286 return -9;
287 } else {
288 data->pmkid = pos;
289 pos += data->num_pmkid * PMKID_LEN;
290 left -= data->num_pmkid * PMKID_LEN;
291 }
292 }
293
294 if (left >= 4) {
295 data->mgmt_group_cipher = rsn_selector_to_bitfield(pos);
296 if (!wpa_cipher_valid_mgmt_group(data->mgmt_group_cipher)) {
297 wpa_printf(MSG_DEBUG,
298 "%s: Unsupported management group cipher 0x%x (%08x)",
299 __func__, data->mgmt_group_cipher,
300 WPA_GET_BE32(pos));
301 return -10;
302 }
303 pos += RSN_SELECTOR_LEN;
304 left -= RSN_SELECTOR_LEN;
305 }
306
307 if (left > 0) {
308 #ifdef DEBUG_PRINT
309 wpa_printf(MSG_DEBUG, "%s: ie has %u trailing bytes - ignored",
310 __func__, left);
311 #endif
312 }
313
314 return 0;
315 }
316
wpa_parse_wpa_ie_wpa(const u8 * wpa_ie,size_t wpa_ie_len,struct wpa_ie_data * data)317 int wpa_parse_wpa_ie_wpa(const u8 *wpa_ie, size_t wpa_ie_len,
318 struct wpa_ie_data *data)
319 {
320 const struct wpa_ie_hdr *hdr;
321 const u8 *pos;
322 int left;
323 int i, count;
324
325 memset(data, 0, sizeof(*data));
326 data->proto = WPA_PROTO_WPA;
327 data->pairwise_cipher = WPA_CIPHER_TKIP;
328 data->group_cipher = WPA_CIPHER_TKIP;
329 data->key_mgmt = WPA_KEY_MGMT_IEEE8021X;
330 data->capabilities = 0;
331 data->pmkid = NULL;
332 data->num_pmkid = 0;
333 data->mgmt_group_cipher = 0;
334
335 if (wpa_ie_len == 0) {
336 /* No WPA IE - fail silently */
337 return -1;
338 }
339
340 if (wpa_ie_len < sizeof(struct wpa_ie_hdr)) {
341 wpa_printf(MSG_DEBUG, "%s: ie len too short %lu",
342 __func__, (unsigned long) wpa_ie_len);
343 return -1;
344 }
345
346 hdr = (const struct wpa_ie_hdr *) wpa_ie;
347
348 if (hdr->elem_id != WLAN_EID_VENDOR_SPECIFIC ||
349 hdr->len != wpa_ie_len - 2 ||
350 RSN_SELECTOR_GET(hdr->oui) != WPA_OUI_TYPE ||
351 WPA_GET_LE16(hdr->version) != WPA_VERSION) {
352 wpa_printf(MSG_DEBUG, "%s: malformed ie or unknown version",
353 __func__);
354 return -2;
355 }
356
357 pos = (const u8 *) (hdr + 1);
358 left = wpa_ie_len - sizeof(*hdr);
359
360 if (left >= WPA_SELECTOR_LEN) {
361 data->group_cipher = wpa_selector_to_bitfield(pos);
362 pos += WPA_SELECTOR_LEN;
363 left -= WPA_SELECTOR_LEN;
364 } else if (left > 0) {
365 wpa_printf(MSG_DEBUG, "%s: ie length mismatch, %u too much",
366 __func__, left);
367 return -3;
368 }
369
370 if (left >= 2) {
371 data->pairwise_cipher = 0;
372 count = WPA_GET_LE16(pos);
373 pos += 2;
374 left -= 2;
375 if (count == 0 || left < count * WPA_SELECTOR_LEN) {
376 wpa_printf(MSG_DEBUG, "%s: ie count botch (pairwise), "
377 "count %u left %u", __func__, count, left);
378 return -4;
379 }
380 for (i = 0; i < count; i++) {
381 data->pairwise_cipher |= wpa_selector_to_bitfield(pos);
382 pos += WPA_SELECTOR_LEN;
383 left -= WPA_SELECTOR_LEN;
384 }
385 } else if (left == 1) {
386 wpa_printf(MSG_DEBUG, "%s: ie too short (for key mgmt)",
387 __func__);
388 return -5;
389 }
390
391 if (left >= 2) {
392 data->key_mgmt = 0;
393 count = WPA_GET_LE16(pos);
394 pos += 2;
395 left -= 2;
396 if (count == 0 || left < count * WPA_SELECTOR_LEN) {
397 wpa_printf(MSG_DEBUG, "%s: ie count botch (key mgmt), "
398 "count %u left %u", __func__, count, left);
399 return -6;
400 }
401 for (i = 0; i < count; i++) {
402 data->key_mgmt |= wpa_key_mgmt_to_bitfield(pos);
403 pos += WPA_SELECTOR_LEN;
404 left -= WPA_SELECTOR_LEN;
405 }
406 } else if (left == 1) {
407 wpa_printf(MSG_DEBUG, "%s: ie too short (for capabilities)",
408 __func__);
409 return -7;
410 }
411
412 if (left >= 2) {
413 data->capabilities = WPA_GET_LE16(pos);
414 pos += 2;
415 left -= 2;
416 }
417
418 if (left > 0) {
419 wpa_printf(MSG_DEBUG, "%s: ie has %u trailing bytes - ignored",
420 __func__, left);
421 }
422
423 return 0;
424 }
425
426 /**
427 * wpa_eapol_key_mic - Calculate EAPOL-Key MIC
428 * @key: EAPOL-Key Key Confirmation Key (KCK)
429 * @key_len: KCK length in octets
430 * @akmp: WPA_KEY_MGMT_* used in key derivation
431 * @ver: Key descriptor version (WPA_KEY_INFO_TYPE_*)
432 * @buf: Pointer to the beginning of the EAPOL header (version field)
433 * @len: Length of the EAPOL frame (from EAPOL header to the end of the frame)
434 * @mic: Pointer to the buffer to which the EAPOL-Key MIC is written
435 * Returns: 0 on success, -1 on failure
436 *
437 * Calculate EAPOL-Key MIC for an EAPOL-Key packet. The EAPOL-Key MIC field has
438 * to be cleared (all zeroes) when calling this function.
439 *
440 * Note: 'IEEE Std 802.11i-2004 - 8.5.2 EAPOL-Key frames' has an error in the
441 * description of the Key MIC calculation. It includes packet data from the
442 * beginning of the EAPOL-Key header, not EAPOL header. This incorrect change
443 * happened during final editing of the standard and the correct behavior is
444 * defined in the last draft (IEEE 802.11i/D10).
445 */
wpa_eapol_key_mic(const u8 * key,size_t key_len,int akmp,int ver,const u8 * buf,size_t len,u8 * mic)446 int wpa_eapol_key_mic(const u8 *key, size_t key_len, int akmp, int ver,
447 const u8 *buf, size_t len, u8 *mic)
448 {
449 u8 hash[SHA384_MAC_LEN];
450
451 switch (ver) {
452 case WPA_KEY_INFO_TYPE_HMAC_MD5_RC4:
453 return hmac_md5(key, key_len, buf, len, mic);
454 case WPA_KEY_INFO_TYPE_HMAC_SHA1_AES:
455 if (hmac_sha1(key, key_len, buf, len, hash))
456 return -1;
457 memcpy(mic, hash, MD5_MAC_LEN);
458 break;
459 case WPA_KEY_INFO_TYPE_AES_128_CMAC:
460 return omac1_aes_128(key, buf, len, mic);
461 #ifdef CONFIG_IEEE80211W
462 case WPA_KEY_INFO_TYPE_AKM_DEFINED:
463 switch (akmp) {
464 #ifdef CONFIG_WPA3_SAE
465 case WPA_KEY_MGMT_SAE:
466 return omac1_aes_128(key, buf, len, mic);
467 #endif /* CONFIG_WPA3_SAE */
468 #ifdef CONFIG_SUITEB
469 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
470 if (hmac_sha256(key, key_len, buf, len, hash))
471 return -1;
472 os_memcpy(mic, hash, MD5_MAC_LEN);
473 break;
474 #endif /* CONFIG_SUITEB */
475 #ifdef CONFIG_SUITEB192
476 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
477 if (hmac_sha384(key, key_len, buf, len, hash))
478 return -1;
479 os_memcpy(mic, hash, 24);
480 break;
481 #endif /* CONFIG_SUITEB192 */
482
483 #endif /* CONFIG_IEEE80211W */
484 default:
485 return -1;
486 }
487 break;
488
489 default:
490 return -1;
491 }
492
493 return 0;
494 }
495
wpa_compare_rsn_ie(int ft_initial_assoc,const u8 * ie1,size_t ie1len,const u8 * ie2,size_t ie2len)496 int wpa_compare_rsn_ie(int ft_initial_assoc,
497 const u8 *ie1, size_t ie1len,
498 const u8 *ie2, size_t ie2len)
499 {
500 if (ie1 == NULL || ie2 == NULL)
501 return -1;
502
503 if (ie1len == ie2len && memcmp(ie1, ie2, ie1len) == 0)
504 return 0; /* identical IEs */
505
506 #ifdef CONFIG_IEEE80211R
507 if (ft_initial_assoc) {
508 struct wpa_ie_data ie1d, ie2d;
509 /*
510 * The PMKID-List in RSN IE is different between Beacon/Probe
511 * Response/(Re)Association Request frames and EAPOL-Key
512 * messages in FT initial mobility domain association. Allow
513 * for this, but verify that other parts of the RSN IEs are
514 * identical.
515 */
516 if (wpa_parse_wpa_ie_rsn(ie1, ie1len, &ie1d) < 0 ||
517 wpa_parse_wpa_ie_rsn(ie2, ie2len, &ie2d) < 0)
518 return -1;
519 if (ie1d.proto == ie2d.proto &&
520 ie1d.pairwise_cipher == ie2d.pairwise_cipher &&
521 ie1d.group_cipher == ie2d.group_cipher &&
522 ie1d.key_mgmt == ie2d.key_mgmt &&
523 ie1d.capabilities == ie2d.capabilities &&
524 ie1d.mgmt_group_cipher == ie2d.mgmt_group_cipher)
525 return 0;
526 }
527 #endif /* CONFIG_IEEE80211R */
528
529 return -1;
530 }
531
532 #ifdef CONFIG_SUITEB
533 /**
534 * rsn_pmkid_suite_b - Calculate PMK identifier for Suite B AKM
535 * @kck: Key confirmation key
536 * @kck_len: Length of kck in bytes
537 * @aa: Authenticator address
538 * @spa: Supplicant address
539 * @pmkid: Buffer for PMKID
540 * Returns: 0 on success, -1 on failure
541 *
542 * IEEE Std 802.11ac-2013 - 11.6.1.3 Pairwise key hierarchy
543 * PMKID = Truncate(HMAC-SHA-256(KCK, "PMK Name" || AA || SPA))
544 */
rsn_pmkid_suite_b(const u8 * kck,size_t kck_len,const u8 * aa,const u8 * spa,u8 * pmkid)545 int rsn_pmkid_suite_b(const u8 *kck, size_t kck_len, const u8 *aa,
546 const u8 *spa, u8 *pmkid)
547 {
548 char *title = "PMK Name";
549 const u8 *addr[3];
550 const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
551 unsigned char hash[SHA256_MAC_LEN];
552
553 addr[0] = (u8 *) title;
554 addr[1] = aa;
555 addr[2] = spa;
556
557 if (hmac_sha256_vector(kck, kck_len, 3, addr, len, hash) < 0)
558 return -1;
559 os_memcpy(pmkid, hash, PMKID_LEN);
560 return 0;
561 }
562 #endif /* CONFIG_SUITEB */
563
564 #ifdef CONFIG_SUITEB192
565 /**
566 * rsn_pmkid_suite_b_192 - Calculate PMK identifier for Suite B AKM
567 * @kck: Key confirmation key
568 * @kck_len: Length of kck in bytes
569 * @aa: Authenticator address
570 * @spa: Supplicant address
571 * @pmkid: Buffer for PMKID
572 * Returns: 0 on success, -1 on failure
573 *
574 * IEEE Std 802.11ac-2013 - 11.6.1.3 Pairwise key hierarchy
575 * PMKID = Truncate(HMAC-SHA-384(KCK, "PMK Name" || AA || SPA))
576 */
rsn_pmkid_suite_b_192(const u8 * kck,size_t kck_len,const u8 * aa,const u8 * spa,u8 * pmkid)577 int rsn_pmkid_suite_b_192(const u8 *kck, size_t kck_len, const u8 *aa,
578 const u8 *spa, u8 *pmkid)
579 {
580 char *title = "PMK Name";
581 const u8 *addr[3];
582 const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
583 unsigned char hash[SHA384_MAC_LEN];
584
585 addr[0] = (u8 *) title;
586 addr[1] = aa;
587 addr[2] = spa;
588
589 if (hmac_sha384_vector(kck, kck_len, 3, addr, len, hash) < 0)
590 return -1;
591 os_memcpy(pmkid, hash, PMKID_LEN);
592 return 0;
593 }
594 #endif /* CONFIG_SUITEB192 */
595
596 #ifdef DEBUG_PRINT
597 /**
598 * wpa_cipher_txt - Convert cipher suite to a text string
599 * @cipher: Cipher suite (WPA_CIPHER_* enum)
600 * Returns: Pointer to a text string of the cipher suite name
601 */
wpa_cipher_txt(int cipher)602 const char * wpa_cipher_txt(int cipher)
603 {
604 switch (cipher) {
605 case WPA_CIPHER_NONE:
606 return "NONE";
607 case WPA_CIPHER_WEP40:
608 return "WEP-40";
609 case WPA_CIPHER_WEP104:
610 return "WEP-104";
611 case WPA_CIPHER_TKIP:
612 return "TKIP";
613 case WPA_CIPHER_CCMP:
614 return "CCMP";
615 case WPA_CIPHER_CCMP | WPA_CIPHER_TKIP:
616 return "CCMP+TKIP";
617 case WPA_CIPHER_GCMP:
618 return "GCMP";
619 case WPA_CIPHER_GCMP_256:
620 return "GCMP-256";
621 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
622 return "WPA2-EAP-SUITE-B";
623 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
624 return "WPA2-EAP-SUITE-B-192";
625 default:
626 return "UNKNOWN";
627 }
628 }
629 #endif
630
631 /**
632 * wpa_pmk_to_ptk - Calculate PTK from PMK, addresses, and nonces
633 * @pmk: Pairwise master key
634 * @pmk_len: Length of PMK
635 * @label: Label to use in derivation
636 * @addr1: AA or SA
637 * @addr2: SA or AA
638 * @nonce1: ANonce or SNonce
639 * @nonce2: SNonce or ANonce
640 * @ptk: Buffer for pairwise transient key
641 * @akmp: Negotiated AKM
642 * @cipher: Negotiated pairwise cipher
643 * Returns: 0 on success, -1 on failure
644 *
645 * IEEE Std 802.11i-2004 - 8.5.1.2 Pairwise key hierarchy
646 * PTK = PRF-X(PMK, "Pairwise key expansion",
647 * Min(AA, SA) || Max(AA, SA) ||
648 * Min(ANonce, SNonce) || Max(ANonce, SNonce))
649 *
650 * STK = PRF-X(SMK, "Peer key expansion",
651 * Min(MAC_I, MAC_P) || Max(MAC_I, MAC_P) ||
652 * Min(INonce, PNonce) || Max(INonce, PNonce))
653 */
wpa_pmk_to_ptk(const u8 * pmk,size_t pmk_len,const char * label,const u8 * addr1,const u8 * addr2,const u8 * nonce1,const u8 * nonce2,struct wpa_ptk * ptk,int akmp,int cipher)654 int wpa_pmk_to_ptk(const u8 *pmk, size_t pmk_len, const char *label,
655 const u8 *addr1, const u8 *addr2,
656 const u8 *nonce1, const u8 *nonce2,
657 struct wpa_ptk *ptk, int akmp, int cipher)
658 {
659 u8 data[2 * ETH_ALEN + 2 * WPA_NONCE_LEN];
660 u8 tmp[WPA_KCK_MAX_LEN + WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN];
661 size_t ptk_len;
662
663 if (memcmp(addr1, addr2, ETH_ALEN) < 0) {
664 memcpy(data, addr1, ETH_ALEN);
665 memcpy(data + ETH_ALEN, addr2, ETH_ALEN);
666 } else {
667 memcpy(data, addr2, ETH_ALEN);
668 memcpy(data + ETH_ALEN, addr1, ETH_ALEN);
669 }
670
671 if (memcmp(nonce1, nonce2, WPA_NONCE_LEN) < 0) {
672 memcpy(data + 2 * ETH_ALEN, nonce1, WPA_NONCE_LEN);
673 memcpy(data + 2 * ETH_ALEN + WPA_NONCE_LEN, nonce2,
674 WPA_NONCE_LEN);
675 } else {
676 memcpy(data + 2 * ETH_ALEN, nonce2, WPA_NONCE_LEN);
677 memcpy(data + 2 * ETH_ALEN + WPA_NONCE_LEN, nonce1,
678 WPA_NONCE_LEN);
679 }
680
681 ptk->kck_len = wpa_kck_len(akmp);
682 ptk->kek_len = wpa_kek_len(akmp);
683 ptk->tk_len = wpa_cipher_key_len(cipher);
684 ptk_len = ptk->kck_len + ptk->kek_len + ptk->tk_len;
685
686 #if defined(CONFIG_SUITEB192)
687 if (wpa_key_mgmt_sha384(akmp)) {
688 wpa_printf(MSG_DEBUG, "WPA: PTK derivation using PRF(SHA384)");
689 if (sha384_prf(pmk, pmk_len, label, data, sizeof(data),
690 tmp, ptk_len) < 0)
691 return -1;
692 } else
693 #endif
694 if (wpa_key_mgmt_sha256(akmp))
695 sha256_prf(pmk, pmk_len, label, data, sizeof(data),
696 tmp, ptk_len);
697 else
698 sha1_prf(pmk, pmk_len, label, data, sizeof(data), tmp, ptk_len);
699
700 wpa_printf(MSG_DEBUG, "WPA: PTK derivation - A1=" MACSTR " A2=" MACSTR"\n",
701 MAC2STR(addr1), MAC2STR(addr2));
702
703 wpa_hexdump(MSG_MSGDUMP, "WPA: PMK", pmk, pmk_len);
704 wpa_hexdump_key(MSG_DEBUG, "WPA: PTK", tmp, ptk_len);
705
706 os_memcpy(ptk->kck, tmp, ptk->kck_len);
707 wpa_hexdump_key(MSG_DEBUG, "WPA: KCK", ptk->kck, ptk->kck_len);
708
709 os_memcpy(ptk->kek, tmp + ptk->kck_len, ptk->kek_len);
710 wpa_hexdump_key(MSG_DEBUG, "WPA: KEK", ptk->kek, ptk->kek_len);
711
712 os_memcpy(ptk->tk, tmp + ptk->kck_len + ptk->kek_len, ptk->tk_len);
713 wpa_hexdump_key(MSG_DEBUG, "WPA: TK", ptk->tk, ptk->tk_len);
714
715 os_memset(tmp, 0, sizeof(tmp));
716 return 0;
717 }
718
719 /**
720 * rsn_pmkid - Calculate PMK identifier
721 * @pmk: Pairwise master key
722 * @pmk_len: Length of pmk in bytes
723 * @aa: Authenticator address
724 * @spa: Supplicant address
725 * @pmkid: Buffer for PMKID
726 * @use_sha256: Whether to use SHA256-based KDF
727 *
728 * IEEE Std 802.11i-2004 - 8.5.1.2 Pairwise key hierarchy
729 * PMKID = HMAC-SHA1-128(PMK, "PMK Name" || AA || SPA)
730 */
rsn_pmkid(const u8 * pmk,size_t pmk_len,const u8 * aa,const u8 * spa,u8 * pmkid,int use_sha256)731 void rsn_pmkid(const u8 *pmk, size_t pmk_len, const u8 *aa, const u8 *spa,
732 u8 *pmkid, int use_sha256)
733 {
734 char title[9];
735 const u8 *addr[3];
736 const size_t len[3] = { 8, ETH_ALEN, ETH_ALEN };
737 unsigned char hash[SHA256_MAC_LEN];
738
739 os_memcpy(title, "PMK Name", sizeof("PMK Name"));
740 addr[0] = (u8 *) title;
741 addr[1] = aa;
742 addr[2] = spa;
743
744 #ifdef CONFIG_IEEE80211W
745 if (use_sha256) {
746 hmac_sha256_vector(pmk, pmk_len, 3, addr, len, hash);
747 }
748 else
749 #endif /* CONFIG_IEEE80211W */
750 hmac_sha1_vector(pmk, pmk_len, 3, addr, len, hash);
751 memcpy(pmkid, hash, PMKID_LEN);
752 }
753
wpa_cipher_key_len(int cipher)754 int wpa_cipher_key_len(int cipher)
755 {
756 switch (cipher) {
757 case WPA_CIPHER_TKIP:
758 #ifdef CONFIG_GCMP
759 case WPA_CIPHER_GCMP_256:
760 #endif
761 #ifdef CONFIG_GMAC
762 case WPA_CIPHER_BIP_GMAC_256:
763 #endif
764 return 32;
765 case WPA_CIPHER_CCMP:
766 #ifdef CONFIG_GCMP
767 case WPA_CIPHER_GCMP:
768 #endif
769 #ifdef CONFIG_GMAC
770 case WPA_CIPHER_BIP_GMAC_128:
771 #endif
772 case WPA_CIPHER_AES_128_CMAC:
773 return 16;
774 case WPA_CIPHER_WEP104:
775 return 13;
776 case WPA_CIPHER_WEP40:
777 return 5;
778 }
779
780 return 0;
781 }
782
wpa_cipher_rsc_len(int cipher)783 int wpa_cipher_rsc_len(int cipher)
784 {
785 switch (cipher) {
786 case WPA_CIPHER_GCMP_256:
787 case WPA_CIPHER_CCMP:
788 case WPA_CIPHER_GCMP:
789 case WPA_CIPHER_TKIP:
790 return 6;
791 }
792
793 return 0;
794 }
795
wpa_cipher_to_alg(int cipher)796 int wpa_cipher_to_alg(int cipher)
797 {
798 switch (cipher) {
799 case WPA_CIPHER_CCMP:
800 return WIFI_WPA_ALG_CCMP;
801 #ifdef CONFIG_GCMP
802 case WPA_CIPHER_GCMP_256:
803 case WPA_CIPHER_GCMP:
804 return WIFI_WPA_ALG_GCMP;
805 #endif
806 case WPA_CIPHER_TKIP:
807 return WIFI_WPA_ALG_TKIP;
808 case WPA_CIPHER_WEP104:
809 return WIFI_WPA_ALG_WEP104;
810 case WPA_CIPHER_WEP40:
811 return WIFI_WPA_ALG_WEP40;
812 }
813 return WIFI_WPA_ALG_NONE;
814 }
815
wpa_cipher_to_suite(int proto,int cipher)816 u32 wpa_cipher_to_suite(int proto, int cipher)
817 {
818 if (cipher & WPA_CIPHER_CCMP)
819 return (proto == WPA_PROTO_RSN ?
820 RSN_CIPHER_SUITE_CCMP : WPA_CIPHER_SUITE_CCMP);
821 #ifdef CONFIG_GCMP
822 if (cipher & WPA_CIPHER_GCMP_256)
823 return RSN_CIPHER_SUITE_GCMP_256;
824 if (cipher & WPA_CIPHER_GCMP)
825 return RSN_CIPHER_SUITE_GCMP;
826 #endif
827 if (cipher & WPA_CIPHER_TKIP)
828 return (proto == WPA_PROTO_RSN ?
829 RSN_CIPHER_SUITE_TKIP : WPA_CIPHER_SUITE_TKIP);
830 if (cipher & WPA_CIPHER_WEP104)
831 return (proto == WPA_PROTO_RSN ?
832 RSN_CIPHER_SUITE_WEP104 : WPA_CIPHER_SUITE_WEP104);
833 if (cipher & WPA_CIPHER_WEP40)
834 return (proto == WPA_PROTO_RSN ?
835 RSN_CIPHER_SUITE_WEP40 : WPA_CIPHER_SUITE_WEP40);
836 if (cipher & WPA_CIPHER_NONE)
837 return (proto == WPA_PROTO_RSN ?
838 RSN_CIPHER_SUITE_NONE : WPA_CIPHER_SUITE_NONE);
839 if (cipher & WPA_CIPHER_AES_128_CMAC)
840 return RSN_CIPHER_SUITE_AES_128_CMAC;
841 #if CONFIG_GMAC
842 if (cipher & WPA_CIPHER_BIP_GMAC_128)
843 return RSN_CIPHER_SUITE_BIP_GMAC_128;
844 if (cipher & WPA_CIPHER_BIP_GMAC_256)
845 return RSN_CIPHER_SUITE_BIP_GMAC_256;
846 #endif
847 return 0;
848 }
849
rsn_cipher_put_suites(u8 * pos,int ciphers)850 int rsn_cipher_put_suites(u8 *pos, int ciphers)
851 {
852 int num_suites = 0;
853
854 #ifdef CONFIG_GCMP
855 if (ciphers & WPA_CIPHER_GCMP_256) {
856 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_GCMP_256);
857 pos += RSN_SELECTOR_LEN;
858 num_suites++;
859 }
860 if (ciphers & WPA_CIPHER_GCMP) {
861 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_GCMP);
862 pos += RSN_SELECTOR_LEN;
863 num_suites++;
864 }
865 #endif
866 if (ciphers & WPA_CIPHER_CCMP) {
867 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
868 pos += RSN_SELECTOR_LEN;
869 num_suites++;
870 }
871 if (ciphers & WPA_CIPHER_TKIP) {
872 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_TKIP);
873 pos += RSN_SELECTOR_LEN;
874 num_suites++;
875 }
876 if (ciphers & WPA_CIPHER_NONE) {
877 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NONE);
878 pos += RSN_SELECTOR_LEN;
879 num_suites++;
880 }
881
882 return num_suites;
883 }
884
wpa_cipher_put_suites(u8 * pos,int ciphers)885 int wpa_cipher_put_suites(u8 *pos, int ciphers)
886 {
887 int num_suites = 0;
888
889 if (ciphers & WPA_CIPHER_CCMP) {
890 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_CCMP);
891 pos += WPA_SELECTOR_LEN;
892 num_suites++;
893 }
894 if (ciphers & WPA_CIPHER_TKIP) {
895 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_TKIP);
896 pos += WPA_SELECTOR_LEN;
897 num_suites++;
898 }
899 if (ciphers & WPA_CIPHER_NONE) {
900 RSN_SELECTOR_PUT(pos, WPA_CIPHER_SUITE_NONE);
901 pos += WPA_SELECTOR_LEN;
902 num_suites++;
903 }
904
905 return num_suites;
906 }
907
908 #endif // ESP_SUPPLICANT
909
