From 455bcc0f5c6347dd76fb2aeac6e1933146d58be1 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sat, 8 Sep 2012 20:00:54 +0300 Subject: [PATCH] wlantest: Add GCMP implementation and test vectors from P802.11ad/D9.0 Signed-hostap: Jouni Malinen --- wlantest/Makefile | 1 + wlantest/gcmp.c | 448 ++++++++++++++++++++++++++++++++++++++++ wlantest/test_vectors.c | 63 ++++++ wlantest/wlantest.h | 5 + 4 files changed, 517 insertions(+) create mode 100644 wlantest/gcmp.c diff --git a/wlantest/Makefile b/wlantest/Makefile index 458fa953d..6594b345c 100644 --- a/wlantest/Makefile +++ b/wlantest/Makefile @@ -77,6 +77,7 @@ TOBJS += ccmp.o TOBJS += tkip.o TOBJS += wep.o TOBJS += bip.o +TOBJS += gcmp.o ../src/utils/libutils.a: diff --git a/wlantest/gcmp.c b/wlantest/gcmp.c new file mode 100644 index 000000000..27beea292 --- /dev/null +++ b/wlantest/gcmp.c @@ -0,0 +1,448 @@ +/* + * GCM with GMAC Protocol (GCMP) + * Copyright (c) 2012, Jouni Malinen + * + * This software may be distributed under the terms of the BSD license. + * See README for more details. + */ + +#include "utils/includes.h" + +#include "utils/common.h" +#include "common/ieee802_11_defs.h" +#include "crypto/aes.h" +#include "wlantest.h" + + +static void inc32(u8 *block) +{ + u32 val; + val = WPA_GET_BE32(block + AES_BLOCK_SIZE - 4); + val++; + WPA_PUT_BE32(block + AES_BLOCK_SIZE - 4, val); +} + + +static void xor_block(u8 *dst, const u8 *src) +{ + u32 *d = (u32 *) dst; + u32 *s = (u32 *) src; + *d++ ^= *s++; + *d++ ^= *s++; + *d++ ^= *s++; + *d++ ^= *s++; +} + + +static void shift_right_block(u8 *v) +{ + u32 val; + + val = WPA_GET_BE32(v + 12); + val >>= 1; + if (v[11] & 0x01) + val |= 0x80000000; + WPA_PUT_BE32(v + 12, val); + + val = WPA_GET_BE32(v + 8); + val >>= 1; + if (v[7] & 0x01) + val |= 0x80000000; + WPA_PUT_BE32(v + 8, val); + + val = WPA_GET_BE32(v + 4); + val >>= 1; + if (v[3] & 0x01) + val |= 0x80000000; + WPA_PUT_BE32(v + 4, val); + + val = WPA_GET_BE32(v); + val >>= 1; + WPA_PUT_BE32(v, val); +} + + +/* Multiplication in GF(2^128) */ +static void gf_mult(const u8 *x, const u8 *y, u8 *z) +{ + u8 v[16]; + int i, j; + + os_memset(z, 0, 16); /* Z_0 = 0^128 */ + os_memcpy(v, y, 16); /* V_0 = Y */ + + for (i = 0; i < 16; i++) { + for (j = 0; j < 8; j++) { + if (x[i] & BIT(7 - j)) { + /* Z_(i + 1) = Z_i XOR V_i */ + xor_block(z, v); + } else { + /* Z_(i + 1) = Z_i */ + } + + if (v[15] & 0x01) { + /* V_(i + 1) = (V_i >> 1) XOR R */ + shift_right_block(v); + /* R = 11100001 || 0^120 */ + v[0] ^= 0xe1; + } else { + /* V_(i + 1) = V_i >> 1 */ + shift_right_block(v); + } + } + } +} + + +static void ghash(const u8 *h, const u8 *x, size_t xlen, u8 *y) +{ + size_t m, i; + const u8 *xpos = x; + u8 tmp[16]; + + m = xlen / 16; + + /* Y_0 = 0^128 */ + os_memset(y, 0, 16); + for (i = 0; i < m; i++) { + /* Y_i = (Y^(i-1) XOR X_i) dot H */ + xor_block(y, xpos); + xpos += 16; + + /* dot operation: + * multiplication operation for binary Galois (finite) field of + * 2^128 elements */ + gf_mult(y, h, tmp); + os_memcpy(y, tmp, 16); + } + + /* Return Y_m */ +} + + +static void aes_gctr(void *aes, const u8 *icb, const u8 *x, size_t xlen, u8 *y) +{ + size_t i, n, last; + u8 cb[AES_BLOCK_SIZE], tmp[AES_BLOCK_SIZE]; + const u8 *xpos = x; + u8 *ypos = y; + + if (xlen == 0) + return; + + n = xlen / 16; + + os_memcpy(cb, icb, AES_BLOCK_SIZE); + /* Full blocks */ + for (i = 0; i < n; i++) { + aes_encrypt(aes, cb, ypos); + xor_block(ypos, xpos); + xpos += AES_BLOCK_SIZE; + ypos += AES_BLOCK_SIZE; + inc32(cb); + } + + last = x + xlen - xpos; + if (last) { + /* Last, partial block */ + aes_encrypt(aes, cb, tmp); + for (i = 0; i < last; i++) + *ypos++ = *xpos++ ^ tmp[i]; + } +} + + +static void gcmp_aad_nonce(const struct ieee80211_hdr *hdr, const u8 *data, + u8 *aad, size_t *aad_len, u8 *nonce) +{ + u16 fc, stype, seq; + int qos = 0, addr4 = 0; + u8 *pos; + + fc = le_to_host16(hdr->frame_control); + stype = WLAN_FC_GET_STYPE(fc); + if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) == + (WLAN_FC_TODS | WLAN_FC_FROMDS)) + addr4 = 1; + + if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA) { + fc &= ~0x0070; /* Mask subtype bits */ + if (stype & 0x08) { + const u8 *qc; + qos = 1; + fc &= ~WLAN_FC_ORDER; + qc = (const u8 *) (hdr + 1); + if (addr4) + qc += ETH_ALEN; + } + } + + fc &= ~(WLAN_FC_RETRY | WLAN_FC_PWRMGT | WLAN_FC_MOREDATA); + fc |= WLAN_FC_ISWEP; + WPA_PUT_LE16(aad, fc); + pos = aad + 2; + os_memcpy(pos, hdr->addr1, 3 * ETH_ALEN); + pos += 3 * ETH_ALEN; + seq = le_to_host16(hdr->seq_ctrl); + seq &= ~0xfff0; /* Mask Seq#; do not modify Frag# */ + WPA_PUT_LE16(pos, seq); + pos += 2; + + os_memcpy(pos, hdr + 1, addr4 * ETH_ALEN + qos * 2); + pos += addr4 * ETH_ALEN; + if (qos) { + pos[0] &= ~0x70; + if (1 /* FIX: either device has SPP A-MSDU Capab = 0 */) + pos[0] &= ~0x80; + pos++; + *pos++ = 0x00; + } + + *aad_len = pos - aad; + + os_memcpy(nonce, hdr->addr2, ETH_ALEN); + nonce[6] = data[7]; /* PN5 */ + nonce[7] = data[6]; /* PN4 */ + nonce[8] = data[5]; /* PN3 */ + nonce[9] = data[4]; /* PN2 */ + nonce[10] = data[1]; /* PN1 */ + nonce[11] = data[0]; /* PN0 */ +} + + +u8 * gcmp_decrypt(const u8 *tk, const struct ieee80211_hdr *hdr, + const u8 *data, size_t data_len, size_t *decrypted_len) +{ + u8 aad[2 + 30], nonce[12], *plain, *auth, *apos; + u8 H[AES_BLOCK_SIZE]; + u8 J0[AES_BLOCK_SIZE]; + u8 S[16], T[16]; + size_t aad_len, padlen, mlen; + void *aes; + const u8 *m; + + if (data_len < 8 + 16) + return NULL; + + plain = os_malloc(data_len + AES_BLOCK_SIZE); + if (plain == NULL) + return NULL; + + aes = aes_encrypt_init(tk, 16); + if (aes == NULL) { + os_free(plain); + return NULL; + } + + m = data + 8; + mlen = data_len - 8 - 16; + + os_memset(aad, 0, sizeof(aad)); + gcmp_aad_nonce(hdr, data, &aad[2], &aad_len, nonce); + WPA_PUT_BE16(aad, aad_len); + wpa_hexdump(MSG_EXCESSIVE, "GCMP AAD", &aad[2], aad_len); + wpa_hexdump(MSG_EXCESSIVE, "GCMP nonce", nonce, sizeof(nonce)); + + /* GCM-AD_K(IV, C, A, T) + * + * IV = GCMP nonce + * A = AAD + * C | T = received frame + */ + + /* 2. Generate hash subkey H = AES_K(0^128) */ + os_memset(H, 0, sizeof(H)); + aes_encrypt(aes, H, H); + wpa_hexdump(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H)); + + /* 3. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */ + os_memcpy(J0, nonce, sizeof(nonce)); + os_memset(J0 + sizeof(nonce), 0, AES_BLOCK_SIZE - sizeof(nonce)); + J0[AES_BLOCK_SIZE - 1] = 0x01; + + /* 4. C = GCTR_K(inc_32(J_0), C) */ + inc32(J0); + aes_gctr(aes, J0, m, mlen, plain); + + /* + * 5. u = 128 * ceil[len(C)/128] - len(C) + * v = 128 * ceil[len(A)/128] - len(A) + * 6. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64) + * (i.e., zero padded to block size A || C and lengths of each in bits) + */ + auth = os_malloc(32 + 16 + data_len - 16 + 8 + 8); + if (auth == NULL) { + os_free(plain); + return NULL; + } + + apos = auth; + + /* Zero-padded AAD */ + os_memcpy(apos, &aad[2], aad_len); + apos += aad_len; + padlen = (16 - aad_len % 16) % 16; + os_memset(apos, 0, padlen); + apos += padlen; + + /* Zero-padded C */ + os_memcpy(apos, m, mlen); + apos += mlen; + padlen = (16 - mlen % 16) % 16; + os_memset(apos, 0, padlen); + apos += padlen; + + /* Length of AAD and C in bits */ + WPA_PUT_BE64(apos, aad_len * 8); + apos += 8; + WPA_PUT_BE64(apos, mlen * 8); + apos += 8; + + wpa_hexdump(MSG_EXCESSIVE, "GCMP GHASH_H input", auth, apos - auth); + ghash(H, auth, apos - auth, S); + wpa_hexdump(MSG_EXCESSIVE, "GCMP S = GHASH_H(...)", S, 16); + os_free(auth); + + /* 7. T' = MSB_t(GCTR_K(J_0, S)) */ + J0[AES_BLOCK_SIZE - 1] = 0x01; + aes_gctr(aes, J0, S, sizeof(S), T); + + aes_encrypt_deinit(aes); + + if (os_memcmp(data + data_len - 16, T, 16) != 0) { + u16 seq_ctrl = le_to_host16(hdr->seq_ctrl); + wpa_printf(MSG_INFO, "Invalid GCMP MIC in frame: A1=" MACSTR + " A2=" MACSTR " A3=" MACSTR " seq=%u frag=%u", + MAC2STR(hdr->addr1), MAC2STR(hdr->addr2), + MAC2STR(hdr->addr3), + WLAN_GET_SEQ_SEQ(seq_ctrl), + WLAN_GET_SEQ_FRAG(seq_ctrl)); + wpa_hexdump(MSG_DEBUG, "GCMP decrypted", plain, data_len - 16); + os_free(plain); + return NULL; + } + + *decrypted_len = data_len - 8 - 16; + return plain; +} + + +u8 * gcmp_encrypt(const u8 *tk, u8 *frame, size_t len, size_t hdrlen, u8 *qos, + u8 *pn, int keyid, size_t *encrypted_len) +{ + u8 aad[2 + 30], nonce[12], *crypt, *pos, *auth, *apos; + u8 H[AES_BLOCK_SIZE]; + u8 J0[AES_BLOCK_SIZE]; + u8 S[16]; + size_t aad_len, plen, padlen; + struct ieee80211_hdr *hdr; + void *aes; + + if (len < hdrlen || hdrlen < 24) + return NULL; + plen = len - hdrlen; + + crypt = os_malloc(hdrlen + 8 + plen + 16 + AES_BLOCK_SIZE); + if (crypt == NULL) + return NULL; + + os_memcpy(crypt, frame, hdrlen); + hdr = (struct ieee80211_hdr *) crypt; + hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP); + pos = crypt + hdrlen; + *pos++ = pn[5]; /* PN0 */ + *pos++ = pn[4]; /* PN1 */ + *pos++ = 0x00; /* Rsvd */ + *pos++ = 0x20 | (keyid << 6); + *pos++ = pn[3]; /* PN2 */ + *pos++ = pn[2]; /* PN3 */ + *pos++ = pn[1]; /* PN4 */ + *pos++ = pn[0]; /* PN5 */ + + aes = aes_encrypt_init(tk, 16); + if (aes == NULL) { + os_free(crypt); + return NULL; + } + + os_memset(aad, 0, sizeof(aad)); + gcmp_aad_nonce(hdr, crypt + hdrlen, &aad[2], &aad_len, nonce); + WPA_PUT_BE16(aad, aad_len); + wpa_hexdump(MSG_EXCESSIVE, "GCMP AAD", &aad[2], aad_len); + wpa_hexdump(MSG_EXCESSIVE, "GCMP nonce", nonce, sizeof(nonce)); + + /* GCM-AE_K(IV, P, A) + * + * IV = GCMP nonce + * A = AAD + */ + + /* 1. Generate hash subkey H = AES_K(0^128) */ + os_memset(H, 0, sizeof(H)); + aes_encrypt(aes, H, H); + wpa_hexdump(MSG_EXCESSIVE, "Hash subkey H for GHASH", H, sizeof(H)); + + /* 2. Prepare block J_0 = IV || 0^31 || 1 [len(IV) = 96] */ + os_memcpy(J0, nonce, sizeof(nonce)); + os_memset(J0 + sizeof(nonce), 0, AES_BLOCK_SIZE - sizeof(nonce)); + J0[AES_BLOCK_SIZE - 1] = 0x01; + + /* 3. C = GCTR_K(inc_32(J_0), P) */ + inc32(J0); + aes_gctr(aes, J0, frame + hdrlen, len - hdrlen, pos); + pos += len - hdrlen; + + /* + * 4. u = 128 * ceil[len(C)/128] - len(C) + * v = 128 * ceil[len(A)/128] - len(A) + * 5. S = GHASH_H(A || 0^v || C || 0^u || [len(A)]64 || [len(C)]64) + * (i.e., zero padded to block size A || C and lengths of each in bits) + */ + auth = os_malloc(32 + 16 + len - hdrlen + 8 + 8); + if (auth == NULL) { + os_free(crypt); + return NULL; + } + + apos = auth; + + /* Zero-padded AAD */ + os_memcpy(apos, &aad[2], aad_len); + apos += aad_len; + padlen = (16 - aad_len % 16) % 16; + os_memset(apos, 0, padlen); + apos += padlen; + + /* Zero-padded C */ + os_memcpy(apos, crypt + hdrlen + 8, plen); + apos += plen; + padlen = (16 - plen % 16) % 16; + os_memset(apos, 0, padlen); + apos += padlen; + + /* Length of AAD and C in bits */ + WPA_PUT_BE64(apos, aad_len * 8); + apos += 8; + WPA_PUT_BE64(apos, plen * 8); + apos += 8; + + wpa_hexdump(MSG_EXCESSIVE, "GCMP GHASH_H input", auth, apos - auth); + ghash(H, auth, apos - auth, S); + wpa_hexdump(MSG_EXCESSIVE, "GCMP S = GHASH_H(...)", S, 16); + os_free(auth); + + /* 6. T = MSB_t(GCTR_K(J_0, S)) */ + J0[AES_BLOCK_SIZE - 1] = 0x01; + aes_gctr(aes, J0, S, sizeof(S), pos); + wpa_hexdump(MSG_EXCESSIVE, "GCMP MIC", pos, 16); + + /* 7. Return (C, T) */ + + wpa_hexdump(MSG_EXCESSIVE, "GCMP encrypted", crypt + hdrlen + 8, plen); + + aes_encrypt_deinit(aes); + + *encrypted_len = hdrlen + 8 + plen + 16; + + return crypt; +} diff --git a/wlantest/test_vectors.c b/wlantest/test_vectors.c index 143703f59..011620bd0 100644 --- a/wlantest/test_vectors.c +++ b/wlantest/test_vectors.c @@ -225,6 +225,68 @@ static void test_vector_ccmp_mgmt(void) } +static void test_vector_gcmp(void) +{ + u8 tk[] = { 0xc9, 0x7c, 0x1f, 0x67, 0xce, 0x37, 0x11, 0x85, + 0x51, 0x4a, 0x8a, 0x19, 0xf2, 0xbd, 0xd5, 0x2f }; + u8 pn[] = { + 0x00, 0x89, 0x5F, 0x5F, 0x2B, 0x08 + }; + u8 frame[] = { + 0x88, 0x48, 0x0b, 0x00, 0x0f, 0xd2, 0xe1, 0x28, + 0xa5, 0x7c, 0x50, 0x30, 0xf1, 0x84, 0x44, 0x08, + 0x50, 0x30, 0xf1, 0x84, 0x44, 0x08, 0x80, 0x33, + 0x03, 0x00, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, + 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, + 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, + 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, + 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, + 0x26, 0x27 + }; + u8 *enc, *plain; + size_t enc_len, plain_len; + u8 fcs[4]; + + wpa_printf(MSG_INFO, "\nIEEE P802.11ad/D9.0, M.11.1 GCMP test " + "vector #2\n"); + + wpa_hexdump(MSG_INFO, "TK", tk, sizeof(tk)); + wpa_hexdump(MSG_INFO, "PN", pn, sizeof(pn)); + wpa_hexdump(MSG_INFO, "802.11 Header", frame, 26); + wpa_hexdump(MSG_INFO, "Plaintext Data", frame + 26, sizeof(frame) - 26); + + enc = gcmp_encrypt(tk, frame, sizeof(frame), 26, frame + 24, pn, 0, + &enc_len); + if (enc == NULL) { + wpa_printf(MSG_ERROR, "Failed to encrypt GCMP frame"); + return; + } + + wpa_hexdump(MSG_INFO, "Encrypted MPDU (without FCS)", enc, enc_len); + WPA_PUT_LE32(fcs, crc32(enc, enc_len)); + wpa_hexdump(MSG_INFO, "FCS", fcs, sizeof(fcs)); + + wpa_debug_level = MSG_INFO; + plain = gcmp_decrypt(tk, (const struct ieee80211_hdr *) enc, + enc + 26, enc_len - 26, &plain_len); + wpa_debug_level = MSG_EXCESSIVE; + os_free(enc); + + if (plain == NULL) { + wpa_printf(MSG_ERROR, "Failed to decrypt GCMP frame"); + return; + } + + if (plain_len != sizeof(frame) - 26 || + os_memcmp(plain, frame + 26, plain_len) != 0) { + wpa_hexdump(MSG_ERROR, "Decryption result did not match", + plain, plain_len); + } + + os_free(plain); +} + + int main(int argc, char *argv[]) { wpa_debug_level = MSG_EXCESSIVE; @@ -237,6 +299,7 @@ int main(int argc, char *argv[]) test_vector_ccmp(); test_vector_bip(); test_vector_ccmp_mgmt(); + test_vector_gcmp(); os_program_deinit(); diff --git a/wlantest/wlantest.h b/wlantest/wlantest.h index ad5849bae..be8f1f145 100644 --- a/wlantest/wlantest.h +++ b/wlantest/wlantest.h @@ -240,6 +240,11 @@ u8 * wep_decrypt(struct wlantest *wt, const struct ieee80211_hdr *hdr, u8 * bip_protect(const u8 *igtk, u8 *frame, size_t len, u8 *ipn, int keyid, size_t *prot_len); +u8 * gcmp_decrypt(const u8 *tk, const struct ieee80211_hdr *hdr, + const u8 *data, size_t data_len, size_t *decrypted_len); +u8 * gcmp_encrypt(const u8 *tk, u8 *frame, size_t len, size_t hdrlen, u8 *qos, + u8 *pn, int keyid, size_t *encrypted_len); + int ctrl_init(struct wlantest *wt); void ctrl_deinit(struct wlantest *wt);