static int ikev2_derive_keys(struct ikev2_responder_data *data)
{
u8 *buf, *pos, *pad, skeyseed[IKEV2_MAX_HASH_LEN];
size_t buf_len, pad_len;
struct wpabuf *shared;
const struct ikev2_integ_alg *integ;
const struct ikev2_prf_alg *prf;
const struct ikev2_encr_alg *encr;
int ret;
const u8 *addr[2];
size_t len[2];
/* RFC 4306, Sect. 2.14 */
integ = ikev2_get_integ(data->proposal.integ);
prf = ikev2_get_prf(data->proposal.prf);
encr = ikev2_get_encr(data->proposal.encr);
if (integ == NULL || prf == NULL || encr == NULL) {
wpa_printf(MSG_INFO, "IKEV2: Unsupported proposal");
return -1;
}
shared = dh_derive_shared(data->i_dh_public, data->r_dh_private,
data->dh);
if (shared == NULL)
return -1;
/* Construct Ni | Nr | SPIi | SPIr */
buf_len = data->i_nonce_len + data->r_nonce_len + 2 * IKEV2_SPI_LEN;
buf = os_malloc(buf_len);
if (buf == NULL) {
wpabuf_free(shared);
return -1;
}
pos = buf;
os_memcpy(pos, data->i_nonce, data->i_nonce_len);
pos += data->i_nonce_len;
os_memcpy(pos, data->r_nonce, data->r_nonce_len);
pos += data->r_nonce_len;
os_memcpy(pos, data->i_spi, IKEV2_SPI_LEN);
pos += IKEV2_SPI_LEN;
os_memcpy(pos, data->r_spi, IKEV2_SPI_LEN);
#ifdef CCNS_PL
#if __BYTE_ORDER == __LITTLE_ENDIAN
{
int i;
u8 *tmp = pos - IKEV2_SPI_LEN;
/* Incorrect byte re-ordering on little endian hosts.. */
for (i = 0; i < IKEV2_SPI_LEN; i++)
*tmp++ = data->i_spi[IKEV2_SPI_LEN - 1 - i];
for (i = 0; i < IKEV2_SPI_LEN; i++)
*tmp++ = data->r_spi[IKEV2_SPI_LEN - 1 - i];
}
#endif
#endif /* CCNS_PL */
/* SKEYSEED = prf(Ni | Nr, g^ir) */
/* Use zero-padding per RFC 4306, Sect. 2.14 */
pad_len = data->dh->prime_len - wpabuf_len(shared);
#ifdef CCNS_PL
/* Shared secret is not zero-padded correctly */
pad_len = 0;
#endif /* CCNS_PL */
pad = os_zalloc(pad_len ? pad_len : 1);
if (pad == NULL) {
wpabuf_free(shared);
os_free(buf);
return -1;
}
addr[0] = pad;
len[0] = pad_len;
addr[1] = wpabuf_head(shared);
len[1] = wpabuf_len(shared);
if (ikev2_prf_hash(prf->id, buf, data->i_nonce_len + data->r_nonce_len,
2, addr, len, skeyseed) < 0) {
wpabuf_free(shared);
os_free(buf);
os_free(pad);
return -1;
}
os_free(pad);
wpabuf_free(shared);
/* DH parameters are not needed anymore, so free them */
wpabuf_free(data->i_dh_public);
data->i_dh_public = NULL;
wpabuf_free(data->r_dh_private);
data->r_dh_private = NULL;
wpa_hexdump_key(MSG_DEBUG, "IKEV2: SKEYSEED",
skeyseed, prf->hash_len);
ret = ikev2_derive_sk_keys(prf, integ, encr, skeyseed, buf, buf_len,
&data->keys);
os_free(buf);
return ret;
}
struct wpabuf * dh5_derive_shared(void *ctx, const struct wpabuf *peer_public,
const struct wpabuf *own_private)
{
return dh_derive_shared(peer_public, own_private, dh_groups_get(5));
}
static int ikev2_derive_keys(struct ikev2_initiator_data *data)
{
u8 *buf, *pos, *pad, skeyseed[IKEV2_MAX_HASH_LEN];
size_t buf_len, pad_len;
struct wpabuf *shared;
const struct ikev2_integ_alg *integ;
const struct ikev2_prf_alg *prf;
const struct ikev2_encr_alg *encr;
int ret;
const u8 *addr[2];
size_t len[2];
/* RFC 4306, Sect. 2.14 */
integ = ikev2_get_integ(data->proposal.integ);
prf = ikev2_get_prf(data->proposal.prf);
encr = ikev2_get_encr(data->proposal.encr);
if (integ == NULL || prf == NULL || encr == NULL) {
asd_printf(ASD_DEFAULT,MSG_DEBUG, "IKEV2: Unsupported proposal");
return -1;
}
shared = dh_derive_shared(data->r_dh_public, data->i_dh_private,
data->dh);
if (shared == NULL)
return -1;
/* Construct Ni | Nr | SPIi | SPIr */
buf_len = data->i_nonce_len + data->r_nonce_len + 2 * IKEV2_SPI_LEN;
buf = os_zalloc(buf_len);
if (buf == NULL) {
wpabuf_free(shared);
return -1;
}
pos = buf;
os_memcpy(pos, data->i_nonce, data->i_nonce_len);
pos += data->i_nonce_len;
os_memcpy(pos, data->r_nonce, data->r_nonce_len);
pos += data->r_nonce_len;
os_memcpy(pos, data->i_spi, IKEV2_SPI_LEN);
pos += IKEV2_SPI_LEN;
os_memcpy(pos, data->r_spi, IKEV2_SPI_LEN);
/* SKEYSEED = prf(Ni | Nr, g^ir) */
/* Use zero-padding per RFC 4306, Sect. 2.14 */
pad_len = data->dh->prime_len - wpabuf_len(shared);
pad = os_zalloc(pad_len ? pad_len : 1);
if (pad == NULL) {
wpabuf_free(shared);
os_free(buf);
return -1;
}
addr[0] = pad;
len[0] = pad_len;
addr[1] = wpabuf_head(shared);
len[1] = wpabuf_len(shared);
if (ikev2_prf_hash(prf->id, buf, data->i_nonce_len + data->r_nonce_len,
2, addr, len, skeyseed) < 0) {
wpabuf_free(shared);
os_free(buf);
os_free(pad);
return -1;
}
os_free(pad);
wpabuf_free(shared);
/* DH parameters are not needed anymore, so free them */
wpabuf_free(data->r_dh_public);
data->r_dh_public = NULL;
wpabuf_free(data->i_dh_private);
data->i_dh_private = NULL;
wpa_hexdump_key(MSG_DEBUG, "IKEV2: SKEYSEED",
skeyseed, prf->hash_len);
ret = ikev2_derive_sk_keys(prf, integ, encr, skeyseed, buf, buf_len,
&data->keys);
os_free(buf);
return ret;
}
int wps_derive_keys(struct wps_data *wps)
{
struct wpabuf *pubkey, *dh_shared;
u8 dhkey[SHA256_MAC_LEN], kdk[SHA256_MAC_LEN];
const u8 *addr[3];
size_t len[3];
u8 keys[WPS_AUTHKEY_LEN + WPS_KEYWRAPKEY_LEN + WPS_EMSK_LEN];
if (wps->dh_privkey == NULL) {
wpa_printf(MSG_DEBUG, "WPS: Own DH private key not available");
return -1;
}
pubkey = wps->registrar ? wps->dh_pubkey_e : wps->dh_pubkey_r;
if (pubkey == NULL) {
wpa_printf(MSG_DEBUG, "WPS: Peer DH public key not available");
return -1;
}
dh_shared = dh_derive_shared(pubkey, wps->dh_privkey,
dh_groups_get(WPS_DH_GROUP));
dh_shared = wpabuf_zeropad(dh_shared, 192);
if (dh_shared == NULL) {
wpa_printf(MSG_DEBUG, "WPS: Failed to derive DH shared key");
return -1;
}
/* Own DH private key is not needed anymore */
wpabuf_free(wps->dh_privkey);
wps->dh_privkey = NULL;
wpa_hexdump_buf_key(MSG_DEBUG, "WPS: DH shared key", dh_shared);
/* DHKey = SHA-256(g^AB mod p) */
addr[0] = wpabuf_head(dh_shared);
len[0] = wpabuf_len(dh_shared);
sha256_vector(1, addr, len, dhkey);
wpa_hexdump_key(MSG_DEBUG, "WPS: DHKey", dhkey, sizeof(dhkey));
wpabuf_free(dh_shared);
/* KDK = HMAC-SHA-256_DHKey(N1 || EnrolleeMAC || N2) */
addr[0] = wps->nonce_e;
len[0] = WPS_NONCE_LEN;
addr[1] = wps->mac_addr_e;
len[1] = ETH_ALEN;
addr[2] = wps->nonce_r;
len[2] = WPS_NONCE_LEN;
hmac_sha256_vector(dhkey, sizeof(dhkey), 3, addr, len, kdk);
wpa_hexdump_key(MSG_DEBUG, "WPS: KDK", kdk, sizeof(kdk));
wps_kdf(kdk, NULL, 0, "Wi-Fi Easy and Secure Key Derivation",
keys, sizeof(keys));
os_memcpy(wps->authkey, keys, WPS_AUTHKEY_LEN);
os_memcpy(wps->keywrapkey, keys + WPS_AUTHKEY_LEN, WPS_KEYWRAPKEY_LEN);
os_memcpy(wps->emsk, keys + WPS_AUTHKEY_LEN + WPS_KEYWRAPKEY_LEN,
WPS_EMSK_LEN);
wpa_hexdump_key(MSG_DEBUG, "WPS: AuthKey",
wps->authkey, WPS_AUTHKEY_LEN);
wpa_hexdump_key(MSG_DEBUG, "WPS: KeyWrapKey",
wps->keywrapkey, WPS_KEYWRAPKEY_LEN);
wpa_hexdump_key(MSG_DEBUG, "WPS: EMSK", wps->emsk, WPS_EMSK_LEN);
return 0;
}
