jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

FT: Derive PMKR0Name/PMKR1Name using SHA-384 with AKM 00-0F-AC:13

Browse source 
The AKM 00-0F-AC:13 is supposed to use cryptographic algorithms
consistently, but the current IEEE 802.11 standard is not doing so for
the key names: PMKID (uses SHA-1), PMKR0Name/PMKR1Name (uses SHA-256).
The PMKID case was already implemented with SHA-384 and this commit
replaces use of SHA-256 with SHA-384 for PMKR0Name/PMKR1Name derivation
to be consistent in SHA-384. While this is not compliant with the
current IEEE 802.11 standard, this is clearly needed to meet CNSA Suite
requirements. Matching change is being proposed in REVmd to get the IEEE
802.11 standard to meet the use case requirements.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This commit is contained in:
Jouni Malinen 2018-06-06 21:57:58 +03:00 committed by Jouni Malinen
parent fe102801f6
commit c3e4f40cd6
4 changed files with 21 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/ap/wpa_auth_ft.c
View file

@ -2834,7 +2834,7 @@ static int wpa_ft_process_auth_req(struct wpa_state_machine *sm,
parse.rsn_pmkid, WPA_PMK_NAME_LEN); parse.rsn_pmkid, WPA_PMK_NAME_LEN);
if (wpa_derive_pmk_r1_name(parse.rsn_pmkid, if (wpa_derive_pmk_r1_name(parse.rsn_pmkid,
sm->wpa_auth->conf.r1_key_holder, sm->addr, sm->wpa_auth->conf.r1_key_holder, sm->addr,
pmk_r1_name) < 0) pmk_r1_name, use_sha384) < 0)
return WLAN_STATUS_UNSPECIFIED_FAILURE; return WLAN_STATUS_UNSPECIFIED_FAILURE;
wpa_hexdump(MSG_DEBUG, "FT: Derived requested PMKR1Name", wpa_hexdump(MSG_DEBUG, "FT: Derived requested PMKR1Name",
pmk_r1_name, WPA_PMK_NAME_LEN); pmk_r1_name, WPA_PMK_NAME_LEN);

27
src/common/wpa_common.c
View file

@ -1480,7 +1480,7 @@ int wpa_derive_pmk_r0(const u8 *xxkey, size_t xxkey_len,
{ {
u8 buf[1 + SSID_MAX_LEN + MOBILITY_DOMAIN_ID_LEN + 1 + u8 buf[1 + SSID_MAX_LEN + MOBILITY_DOMAIN_ID_LEN + 1 +
FT_R0KH_ID_MAX_LEN + ETH_ALEN]; FT_R0KH_ID_MAX_LEN + ETH_ALEN];
u8 *pos, r0_key_data[64], hash[32]; u8 *pos, r0_key_data[64], hash[48];
const u8 *addr[2]; const u8 *addr[2];
size_t len[2]; size_t len[2];
size_t q = use_sha384 ? 48 : 32; size_t q = use_sha384 ? 48 : 32;
@ -1546,14 +1546,18 @@ int wpa_derive_pmk_r0(const u8 *xxkey, size_t xxkey_len,
wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R0Name-Salt", &r0_key_data[q], 16); wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R0Name-Salt", &r0_key_data[q], 16);
/* /*
* PMKR0Name = Truncate-128(SHA-256("FT-R0N" || PMK-R0Name-Salt) * PMKR0Name = Truncate-128(Hash("FT-R0N" || PMK-R0Name-Salt)
*/ */
addr[0] = (const u8 *) "FT-R0N"; addr[0] = (const u8 *) "FT-R0N";
len[0] = 6; len[0] = 6;
addr[1] = &r0_key_data[q]; addr[1] = &r0_key_data[q];
len[1] = 16; len[1] = 16;
if (sha256_vector(2, addr, len, hash) < 0) #ifdef CONFIG_SHA384
if (use_sha384 && sha384_vector(2, addr, len, hash) < 0)
return -1;
#endif /* CONFIG_SHA384 */
if (!use_sha384 && sha256_vector(2, addr, len, hash) < 0)
return -1; return -1;
os_memcpy(pmk_r0_name, hash, WPA_PMK_NAME_LEN); os_memcpy(pmk_r0_name, hash, WPA_PMK_NAME_LEN);
os_memset(r0_key_data, 0, sizeof(r0_key_data)); os_memset(r0_key_data, 0, sizeof(r0_key_data));
@ -1567,15 +1571,15 @@ int wpa_derive_pmk_r0(const u8 *xxkey, size_t xxkey_len,
* IEEE Std 802.11r-2008 - 8.5.1.5.4 * IEEE Std 802.11r-2008 - 8.5.1.5.4
*/ */
int wpa_derive_pmk_r1_name(const u8 *pmk_r0_name, const u8 *r1kh_id, int wpa_derive_pmk_r1_name(const u8 *pmk_r0_name, const u8 *r1kh_id,
const u8 *s1kh_id, u8 *pmk_r1_name) const u8 *s1kh_id, u8 *pmk_r1_name, int use_sha384)
{ {
u8 hash[32]; u8 hash[48];
const u8 *addr[4]; const u8 *addr[4];
size_t len[4]; size_t len[4];
/* /*
* PMKR1Name = Truncate-128(SHA-256("FT-R1N" || PMKR0Name || * PMKR1Name = Truncate-128(Hash("FT-R1N" || PMKR0Name ||
* R1KH-ID || S1KH-ID)) * R1KH-ID || S1KH-ID))
*/ */
addr[0] = (const u8 *) "FT-R1N"; addr[0] = (const u8 *) "FT-R1N";
len[0] = 6; len[0] = 6;
@ -1586,7 +1590,11 @@ int wpa_derive_pmk_r1_name(const u8 *pmk_r0_name, const u8 *r1kh_id,
addr[3] = s1kh_id; addr[3] = s1kh_id;
len[3] = ETH_ALEN; len[3] = ETH_ALEN;
if (sha256_vector(4, addr, len, hash) < 0) #ifdef CONFIG_SHA384
if (use_sha384 && sha384_vector(4, addr, len, hash) < 0)
return -1;
#endif /* CONFIG_SHA384 */
if (!use_sha384 && sha256_vector(4, addr, len, hash) < 0)
return -1; return -1;
os_memcpy(pmk_r1_name, hash, WPA_PMK_NAME_LEN); os_memcpy(pmk_r1_name, hash, WPA_PMK_NAME_LEN);
return 0; return 0;
@ -1636,7 +1644,8 @@ int wpa_derive_pmk_r1(const u8 *pmk_r0, size_t pmk_r0_len,
wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R1", pmk_r1, pmk_r0_len); wpa_hexdump_key(MSG_DEBUG, "FT: PMK-R1", pmk_r1, pmk_r0_len);
return wpa_derive_pmk_r1_name(pmk_r0_name, r1kh_id, s1kh_id, return wpa_derive_pmk_r1_name(pmk_r0_name, r1kh_id, s1kh_id,
pmk_r1_name); pmk_r1_name,
pmk_r0_len == SHA384_MAC_LEN);
} }

2
src/common/wpa_common.h
View file

@ -375,7 +375,7 @@ int wpa_derive_pmk_r0(const u8 *xxkey, size_t xxkey_len,
const u8 *s0kh_id, u8 *pmk_r0, u8 *pmk_r0_name, const u8 *s0kh_id, u8 *pmk_r0, u8 *pmk_r0_name,
int use_sha384); int use_sha384);
int wpa_derive_pmk_r1_name(const u8 *pmk_r0_name, const u8 *r1kh_id, int wpa_derive_pmk_r1_name(const u8 *pmk_r0_name, const u8 *r1kh_id,
const u8 *s1kh_id, u8 *pmk_r1_name); const u8 *s1kh_id, u8 *pmk_r1_name, int use_sha384);
int wpa_derive_pmk_r1(const u8 *pmk_r0, size_t pmk_r0_len, int wpa_derive_pmk_r1(const u8 *pmk_r0, size_t pmk_r0_len,
const u8 *pmk_r0_name, const u8 *pmk_r0_name,
const u8 *r1kh_id, const u8 *s1kh_id, const u8 *r1kh_id, const u8 *s1kh_id,

2
src/rsn_supp/wpa.c
View file

@ -3829,7 +3829,7 @@ static int fils_ft_build_assoc_req_rsne(struct wpa_sm *sm, struct wpabuf *buf)
MAC2STR(sm->r1kh_id)); MAC2STR(sm->r1kh_id));
pos = wpabuf_put(buf, WPA_PMK_NAME_LEN); pos = wpabuf_put(buf, WPA_PMK_NAME_LEN);
if (wpa_derive_pmk_r1_name(sm->pmk_r0_name, sm->r1kh_id, sm->own_addr, if (wpa_derive_pmk_r1_name(sm->pmk_r0_name, sm->r1kh_id, sm->own_addr,
pos) < 0) { pos, use_sha384) < 0) {
wpa_printf(MSG_WARNING, "FILS+FT: Could not derive PMKR1Name"); wpa_printf(MSG_WARNING, "FILS+FT: Could not derive PMKR1Name");
return -1; return -1;
} }