mirror of
https://github.com/vanhoefm/fragattacks.git
synced 2024-11-28 10:18:21 -05:00
wlantest: Move GCM-AE and GCM-AD into separate functions
This splits the more generic GCM operations from GCMP specific implementation. Signed-hostap: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen
parent
455bcc0f5c
commit
37c8fe2e3b
345
wlantest/gcmp.c
345
wlantest/gcmp.c
@ -152,6 +152,179 @@ static void aes_gctr(void *aes, const u8 *icb, const u8 *x, size_t xlen, u8 *y)
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* aes_gcm_ae - GCM-AE_K(IV, P, A) with len(IV) = 96
|
||||
*/
|
||||
static int aes_gcm_ae(const u8 *key, const u8 *iv,
|
||||
const u8 *plain, size_t plain_len,
|
||||
const u8 *aad, size_t aad_len,
|
||||
u8 *crypt, u8 *tag)
|
||||
{
|
||||
u8 *auth, *apos;
|
||||
u8 H[AES_BLOCK_SIZE];
|
||||
u8 J0[AES_BLOCK_SIZE];
|
||||
u8 S[16];
|
||||
void *aes;
|
||||
size_t padlen;
|
||||
size_t iv_len = 12;
|
||||
|
||||
aes = aes_encrypt_init(key, 16);
|
||||
if (aes == NULL)
|
||||
return -1;
|
||||
|
||||
/* 1. Generate hash subkey H = AES_K(0^128) */
|
||||
os_memset(H, 0, sizeof(H));
|
||||
aes_encrypt(aes, H, H);
|
||||
wpa_hexdump_key(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H));
|
||||
|
||||
/* 2. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
|
||||
os_memcpy(J0, iv, iv_len);
|
||||
os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len);
|
||||
J0[AES_BLOCK_SIZE - 1] = 0x01;
|
||||
|
||||
/* 3. C = GCTR_K(inc_32(J_0), P) */
|
||||
inc32(J0);
|
||||
aes_gctr(aes, J0, plain, plain_len, crypt);
|
||||
|
||||
/*
|
||||
* 4. u = 128 * ceil[len(C)/128] - len(C)
|
||||
* v = 128 * ceil[len(A)/128] - len(A)
|
||||
* 5. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
|
||||
* (i.e., zero padded to block size A || C and lengths of each in bits)
|
||||
*/
|
||||
auth = os_malloc(32 + 16 + plain_len + 8 + 8);
|
||||
if (auth == NULL) {
|
||||
aes_encrypt_deinit(aes);
|
||||
return -1;
|
||||
}
|
||||
|
||||
apos = auth;
|
||||
|
||||
/* Zero-padded AAD */
|
||||
os_memcpy(apos, aad, aad_len);
|
||||
apos += aad_len;
|
||||
padlen = (16 - aad_len % 16) % 16;
|
||||
os_memset(apos, 0, padlen);
|
||||
apos += padlen;
|
||||
|
||||
/* Zero-padded C */
|
||||
os_memcpy(apos, crypt, plain_len);
|
||||
apos += plain_len;
|
||||
padlen = (16 - plain_len % 16) % 16;
|
||||
os_memset(apos, 0, padlen);
|
||||
apos += padlen;
|
||||
|
||||
/* Length of AAD and C in bits */
|
||||
WPA_PUT_BE64(apos, aad_len * 8);
|
||||
apos += 8;
|
||||
WPA_PUT_BE64(apos, plain_len * 8);
|
||||
apos += 8;
|
||||
|
||||
wpa_hexdump_key(MSG_EXCESSIVE, "GHASH_H input", auth, apos - auth);
|
||||
ghash(H, auth, apos - auth, S);
|
||||
wpa_hexdump_key(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16);
|
||||
os_free(auth);
|
||||
|
||||
/* 6. T = MSB_t(GCTR_K(J_0, S)) */
|
||||
J0[AES_BLOCK_SIZE - 1] = 0x01;
|
||||
aes_gctr(aes, J0, S, sizeof(S), tag);
|
||||
|
||||
/* 7. Return (C, T) */
|
||||
|
||||
aes_encrypt_deinit(aes);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* aes_gcm_ad - GCM-AD_K(IV, C, A, T) with len(IV) = 96
|
||||
*/
|
||||
static int aes_gcm_ad(const u8 *key, const u8 *iv,
|
||||
const u8 *crypt, size_t crypt_len,
|
||||
const u8 *aad, size_t aad_len, const u8 *tag,
|
||||
u8 *plain)
|
||||
{
|
||||
u8 *auth, *apos;
|
||||
u8 H[AES_BLOCK_SIZE];
|
||||
u8 J0[AES_BLOCK_SIZE];
|
||||
u8 S[16], T[16];
|
||||
void *aes;
|
||||
size_t padlen;
|
||||
size_t iv_len = 12;
|
||||
|
||||
aes = aes_encrypt_init(key, 16);
|
||||
if (aes == NULL)
|
||||
return -1;
|
||||
|
||||
/* 2. Generate hash subkey H = AES_K(0^128) */
|
||||
os_memset(H, 0, sizeof(H));
|
||||
aes_encrypt(aes, H, H);
|
||||
wpa_hexdump(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H));
|
||||
|
||||
/* 3. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
|
||||
os_memcpy(J0, iv, iv_len);
|
||||
os_memset(J0 + iv_len, 0, AES_BLOCK_SIZE - iv_len);
|
||||
J0[AES_BLOCK_SIZE - 1] = 0x01;
|
||||
|
||||
/* 4. C = GCTR_K(inc_32(J_0), C) */
|
||||
inc32(J0);
|
||||
aes_gctr(aes, J0, crypt, crypt_len, plain);
|
||||
|
||||
/*
|
||||
* 5. u = 128 * ceil[len(C)/128] - len(C)
|
||||
* v = 128 * ceil[len(A)/128] - len(A)
|
||||
* 6. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
|
||||
* (i.e., zero padded to block size A || C and lengths of each in bits)
|
||||
*/
|
||||
auth = os_malloc(32 + 16 + crypt_len + 8 + 8);
|
||||
if (auth == NULL) {
|
||||
aes_encrypt_deinit(aes);
|
||||
return -1;
|
||||
}
|
||||
|
||||
apos = auth;
|
||||
|
||||
/* Zero-padded AAD */
|
||||
os_memcpy(apos, aad, aad_len);
|
||||
apos += aad_len;
|
||||
padlen = (16 - aad_len % 16) % 16;
|
||||
os_memset(apos, 0, padlen);
|
||||
apos += padlen;
|
||||
|
||||
/* Zero-padded C */
|
||||
os_memcpy(apos, crypt, crypt_len);
|
||||
apos += crypt_len;
|
||||
padlen = (16 - crypt_len % 16) % 16;
|
||||
os_memset(apos, 0, padlen);
|
||||
apos += padlen;
|
||||
|
||||
/* Length of AAD and C in bits */
|
||||
WPA_PUT_BE64(apos, aad_len * 8);
|
||||
apos += 8;
|
||||
WPA_PUT_BE64(apos, crypt_len * 8);
|
||||
apos += 8;
|
||||
|
||||
wpa_hexdump(MSG_EXCESSIVE, "GHASH_H input", auth, apos - auth);
|
||||
ghash(H, auth, apos - auth, S);
|
||||
wpa_hexdump(MSG_EXCESSIVE, "S = GHASH_H(...)", S, 16);
|
||||
os_free(auth);
|
||||
|
||||
/* 7. T' = MSB_t(GCTR_K(J_0, S)) */
|
||||
J0[AES_BLOCK_SIZE - 1] = 0x01;
|
||||
aes_gctr(aes, J0, S, sizeof(S), T);
|
||||
|
||||
aes_encrypt_deinit(aes);
|
||||
|
||||
if (os_memcmp(tag, T, 16) != 0) {
|
||||
wpa_printf(MSG_EXCESSIVE, "GCM: Tag mismatch");
|
||||
return -1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
static void gcmp_aad_nonce(const struct ieee80211_hdr *hdr, const u8 *data,
|
||||
u8 *aad, size_t *aad_len, u8 *nonce)
|
||||
{
|
||||
@ -213,12 +386,8 @@ static void gcmp_aad_nonce(const struct ieee80211_hdr *hdr, const u8 *data,
|
||||
u8 * gcmp_decrypt(const u8 *tk, const struct ieee80211_hdr *hdr,
|
||||
const u8 *data, size_t data_len, size_t *decrypted_len)
|
||||
{
|
||||
u8 aad[2 + 30], nonce[12], *plain, *auth, *apos;
|
||||
u8 H[AES_BLOCK_SIZE];
|
||||
u8 J0[AES_BLOCK_SIZE];
|
||||
u8 S[16], T[16];
|
||||
size_t aad_len, padlen, mlen;
|
||||
void *aes;
|
||||
u8 aad[2 + 30], nonce[12], *plain;
|
||||
size_t aad_len, mlen;
|
||||
const u8 *m;
|
||||
|
||||
if (data_len < 8 + 16)
|
||||
@ -228,12 +397,6 @@ u8 * gcmp_decrypt(const u8 *tk, const struct ieee80211_hdr *hdr,
|
||||
if (plain == NULL)
|
||||
return NULL;
|
||||
|
||||
aes = aes_encrypt_init(tk, 16);
|
||||
if (aes == NULL) {
|
||||
os_free(plain);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
m = data + 8;
|
||||
mlen = data_len - 8 - 16;
|
||||
|
||||
@ -243,86 +406,20 @@ u8 * gcmp_decrypt(const u8 *tk, const struct ieee80211_hdr *hdr,
|
||||
wpa_hexdump(MSG_EXCESSIVE, "GCMP AAD", &aad[2], aad_len);
|
||||
wpa_hexdump(MSG_EXCESSIVE, "GCMP nonce", nonce, sizeof(nonce));
|
||||
|
||||
/* GCM-AD_K(IV, C, A, T)
|
||||
*
|
||||
* IV = GCMP nonce
|
||||
* A = AAD
|
||||
* C | T = received frame
|
||||
*/
|
||||
|
||||
/* 2. Generate hash subkey H = AES_K(0^128) */
|
||||
os_memset(H, 0, sizeof(H));
|
||||
aes_encrypt(aes, H, H);
|
||||
wpa_hexdump(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H));
|
||||
|
||||
/* 3. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
|
||||
os_memcpy(J0, nonce, sizeof(nonce));
|
||||
os_memset(J0 + sizeof(nonce), 0, AES_BLOCK_SIZE - sizeof(nonce));
|
||||
J0[AES_BLOCK_SIZE - 1] = 0x01;
|
||||
|
||||
/* 4. C = GCTR_K(inc_32(J_0), C) */
|
||||
inc32(J0);
|
||||
aes_gctr(aes, J0, m, mlen, plain);
|
||||
|
||||
/*
|
||||
* 5. u = 128 * ceil[len(C)/128] - len(C)
|
||||
* v = 128 * ceil[len(A)/128] - len(A)
|
||||
* 6. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
|
||||
* (i.e., zero padded to block size A || C and lengths of each in bits)
|
||||
*/
|
||||
auth = os_malloc(32 + 16 + data_len - 16 + 8 + 8);
|
||||
if (auth == NULL) {
|
||||
os_free(plain);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
apos = auth;
|
||||
|
||||
/* Zero-padded AAD */
|
||||
os_memcpy(apos, &aad[2], aad_len);
|
||||
apos += aad_len;
|
||||
padlen = (16 - aad_len % 16) % 16;
|
||||
os_memset(apos, 0, padlen);
|
||||
apos += padlen;
|
||||
|
||||
/* Zero-padded C */
|
||||
os_memcpy(apos, m, mlen);
|
||||
apos += mlen;
|
||||
padlen = (16 - mlen % 16) % 16;
|
||||
os_memset(apos, 0, padlen);
|
||||
apos += padlen;
|
||||
|
||||
/* Length of AAD and C in bits */
|
||||
WPA_PUT_BE64(apos, aad_len * 8);
|
||||
apos += 8;
|
||||
WPA_PUT_BE64(apos, mlen * 8);
|
||||
apos += 8;
|
||||
|
||||
wpa_hexdump(MSG_EXCESSIVE, "GCMP GHASH_H input", auth, apos - auth);
|
||||
ghash(H, auth, apos - auth, S);
|
||||
wpa_hexdump(MSG_EXCESSIVE, "GCMP S = GHASH_H(...)", S, 16);
|
||||
os_free(auth);
|
||||
|
||||
/* 7. T' = MSB_t(GCTR_K(J_0, S)) */
|
||||
J0[AES_BLOCK_SIZE - 1] = 0x01;
|
||||
aes_gctr(aes, J0, S, sizeof(S), T);
|
||||
|
||||
aes_encrypt_deinit(aes);
|
||||
|
||||
if (os_memcmp(data + data_len - 16, T, 16) != 0) {
|
||||
if (aes_gcm_ad(tk, nonce, m, mlen, &aad[2], aad_len, m + mlen, plain) <
|
||||
0) {
|
||||
u16 seq_ctrl = le_to_host16(hdr->seq_ctrl);
|
||||
wpa_printf(MSG_INFO, "Invalid GCMP MIC in frame: A1=" MACSTR
|
||||
wpa_printf(MSG_INFO, "Invalid GCMP frame: A1=" MACSTR
|
||||
" A2=" MACSTR " A3=" MACSTR " seq=%u frag=%u",
|
||||
MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
|
||||
MAC2STR(hdr->addr3),
|
||||
WLAN_GET_SEQ_SEQ(seq_ctrl),
|
||||
WLAN_GET_SEQ_FRAG(seq_ctrl));
|
||||
wpa_hexdump(MSG_DEBUG, "GCMP decrypted", plain, data_len - 16);
|
||||
os_free(plain);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
*decrypted_len = data_len - 8 - 16;
|
||||
*decrypted_len = mlen;
|
||||
return plain;
|
||||
}
|
||||
|
||||
@ -330,13 +427,9 @@ u8 * gcmp_decrypt(const u8 *tk, const struct ieee80211_hdr *hdr,
|
||||
u8 * gcmp_encrypt(const u8 *tk, u8 *frame, size_t len, size_t hdrlen, u8 *qos,
|
||||
u8 *pn, int keyid, size_t *encrypted_len)
|
||||
{
|
||||
u8 aad[2 + 30], nonce[12], *crypt, *pos, *auth, *apos;
|
||||
u8 H[AES_BLOCK_SIZE];
|
||||
u8 J0[AES_BLOCK_SIZE];
|
||||
u8 S[16];
|
||||
size_t aad_len, plen, padlen;
|
||||
u8 aad[2 + 30], nonce[12], *crypt, *pos;
|
||||
size_t aad_len, plen;
|
||||
struct ieee80211_hdr *hdr;
|
||||
void *aes;
|
||||
|
||||
if (len < hdrlen || hdrlen < 24)
|
||||
return NULL;
|
||||
@ -359,88 +452,20 @@ u8 * gcmp_encrypt(const u8 *tk, u8 *frame, size_t len, size_t hdrlen, u8 *qos,
|
||||
*pos++ = pn[1]; /* PN4 */
|
||||
*pos++ = pn[0]; /* PN5 */
|
||||
|
||||
aes = aes_encrypt_init(tk, 16);
|
||||
if (aes == NULL) {
|
||||
os_free(crypt);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
os_memset(aad, 0, sizeof(aad));
|
||||
gcmp_aad_nonce(hdr, crypt + hdrlen, &aad[2], &aad_len, nonce);
|
||||
WPA_PUT_BE16(aad, aad_len);
|
||||
wpa_hexdump(MSG_EXCESSIVE, "GCMP AAD", &aad[2], aad_len);
|
||||
wpa_hexdump(MSG_EXCESSIVE, "GCMP nonce", nonce, sizeof(nonce));
|
||||
|
||||
/* GCM-AE_K(IV, P, A)
|
||||
*
|
||||
* IV = GCMP nonce
|
||||
* A = AAD
|
||||
*/
|
||||
|
||||
/* 1. Generate hash subkey H = AES_K(0^128) */
|
||||
os_memset(H, 0, sizeof(H));
|
||||
aes_encrypt(aes, H, H);
|
||||
wpa_hexdump(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H));
|
||||
|
||||
/* 2. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */
|
||||
os_memcpy(J0, nonce, sizeof(nonce));
|
||||
os_memset(J0 + sizeof(nonce), 0, AES_BLOCK_SIZE - sizeof(nonce));
|
||||
J0[AES_BLOCK_SIZE - 1] = 0x01;
|
||||
|
||||
/* 3. C = GCTR_K(inc_32(J_0), P) */
|
||||
inc32(J0);
|
||||
aes_gctr(aes, J0, frame + hdrlen, len - hdrlen, pos);
|
||||
pos += len - hdrlen;
|
||||
|
||||
/*
|
||||
* 4. u = 128 * ceil[len(C)/128] - len(C)
|
||||
* v = 128 * ceil[len(A)/128] - len(A)
|
||||
* 5. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64)
|
||||
* (i.e., zero padded to block size A || C and lengths of each in bits)
|
||||
*/
|
||||
auth = os_malloc(32 + 16 + len - hdrlen + 8 + 8);
|
||||
if (auth == NULL) {
|
||||
if (aes_gcm_ae(tk, nonce, frame + hdrlen, plen, &aad[2], aad_len,
|
||||
pos, pos + plen) < 0) {
|
||||
os_free(crypt);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
apos = auth;
|
||||
|
||||
/* Zero-padded AAD */
|
||||
os_memcpy(apos, &aad[2], aad_len);
|
||||
apos += aad_len;
|
||||
padlen = (16 - aad_len % 16) % 16;
|
||||
os_memset(apos, 0, padlen);
|
||||
apos += padlen;
|
||||
|
||||
/* Zero-padded C */
|
||||
os_memcpy(apos, crypt + hdrlen + 8, plen);
|
||||
apos += plen;
|
||||
padlen = (16 - plen % 16) % 16;
|
||||
os_memset(apos, 0, padlen);
|
||||
apos += padlen;
|
||||
|
||||
/* Length of AAD and C in bits */
|
||||
WPA_PUT_BE64(apos, aad_len * 8);
|
||||
apos += 8;
|
||||
WPA_PUT_BE64(apos, plen * 8);
|
||||
apos += 8;
|
||||
|
||||
wpa_hexdump(MSG_EXCESSIVE, "GCMP GHASH_H input", auth, apos - auth);
|
||||
ghash(H, auth, apos - auth, S);
|
||||
wpa_hexdump(MSG_EXCESSIVE, "GCMP S = GHASH_H(...)", S, 16);
|
||||
os_free(auth);
|
||||
|
||||
/* 6. T = MSB_t(GCTR_K(J_0, S)) */
|
||||
J0[AES_BLOCK_SIZE - 1] = 0x01;
|
||||
aes_gctr(aes, J0, S, sizeof(S), pos);
|
||||
wpa_hexdump(MSG_EXCESSIVE, "GCMP MIC", pos, 16);
|
||||
|
||||
/* 7. Return (C, T) */
|
||||
|
||||
wpa_hexdump(MSG_EXCESSIVE, "GCMP encrypted", crypt + hdrlen + 8, plen);
|
||||
|
||||
aes_encrypt_deinit(aes);
|
||||
wpa_hexdump(MSG_EXCESSIVE, "GCMP MIC", pos + plen, 16);
|
||||
wpa_hexdump(MSG_EXCESSIVE, "GCMP encrypted", pos, plen);
|
||||
|
||||
*encrypted_len = hdrlen + 8 + plen + 16;
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user