jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

mka: Support 256-bit CAK in SAK derivation

Browse source 
Pass the configured CAK length to SAK derivation instead of using
hardcoded 128-bit length.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2018-12-26 12:20:57 +02:00
parent 9dd701c12e
commit 9b4a266694
3 changed files with 10 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/pae/ieee802_1x_kay.c
View file

@ -2082,7 +2082,8 @@ ieee802_1x_kay_generate_new_sak(struct ieee802_1x_mka_participant *participant)
os_memcpy(context + ctx_offset, &kay->dist_kn, sizeof(kay->dist_kn)); os_memcpy(context + ctx_offset, &kay->dist_kn, sizeof(kay->dist_kn));
if (key_len == 16 || key_len == 32) { if (key_len == 16 || key_len == 32) {
if (ieee802_1x_sak_128bits_aes_cmac(participant->cak.key, if (ieee802_1x_sak_aes_cmac(participant->cak.key,
participant->cak.len,
context, ctx_len, context, ctx_len,
key, key_len)) { key, key_len)) {
wpa_printf(MSG_ERROR, "KaY: Failed to generate SAK"); wpa_printf(MSG_ERROR, "KaY: Failed to generate SAK");

6
src/pae/ieee802_1x_key.c
View file

@ -187,14 +187,14 @@ int ieee802_1x_icv_128bits_aes_cmac(const u8 *ick, const u8 *msg,
/** /**
* ieee802_1x_sak_128bits_aes_cmac * ieee802_1x_sak_aes_cmac
* *
* IEEE Std 802.1X-2010, 9.8.1 * IEEE Std 802.1X-2010, 9.8.1
* SAK = KDF(Key, Label, KS-nonce | MI-value list | KN, SAKLength) * SAK = KDF(Key, Label, KS-nonce | MI-value list | KN, SAKLength)
*/ */
int ieee802_1x_sak_128bits_aes_cmac(const u8 *cak, const u8 *ctx, int ieee802_1x_sak_aes_cmac(const u8 *cak, size_t cak_bytes, const u8 *ctx,
size_t ctx_bytes, u8 *sak, size_t sak_bytes) size_t ctx_bytes, u8 *sak, size_t sak_bytes)
{ {
return aes_kdf(cak, 128, "IEEE8021 SAK", ctx, ctx_bytes * 8, return aes_kdf(cak, cak_bytes * 8, "IEEE8021 SAK", ctx, ctx_bytes * 8,
sak_bytes * 8, sak); sak_bytes * 8, sak);
} }

5
src/pae/ieee802_1x_key.h
View file

@ -20,8 +20,7 @@ int ieee802_1x_ick_128bits_aes_cmac(const u8 *cak, const u8 *ckn,
size_t ckn_bytes, u8 *ick); size_t ckn_bytes, u8 *ick);
int ieee802_1x_icv_128bits_aes_cmac(const u8 *ick, const u8 *msg, int ieee802_1x_icv_128bits_aes_cmac(const u8 *ick, const u8 *msg,
size_t msg_bytes, u8 *icv); size_t msg_bytes, u8 *icv);
int ieee802_1x_sak_128bits_aes_cmac(const u8 *cak, const u8 *ctx, int ieee802_1x_sak_aes_cmac(const u8 *cak, size_t cak_bytes, const u8 *ctx,
size_t ctx_bytes, u8 *sak, size_t ctx_bytes, u8 *sak, size_t sak_bytes);
size_t sak_bytes);
#endif /* IEEE802_1X_KEY_H */ #endif /* IEEE802_1X_KEY_H */