From ca24117a5a11ea8c9b4418cdd2cb8c9a77d9c31f Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sun, 24 May 2015 11:58:45 +0300 Subject: [PATCH] EAP-EKE: Add Session-Id While RFC 6124 does not define how Session-Id is constructed for EAP-EKE, there seems to be consensus among the authors on the construction. Use this Type | Nonce_P | Nonce_S construction based on the following email: From: Yaron Sheffer To: ietf at ietf.org Date: Wed, 17 Nov 2010 13:13:42 +0200 Expanding on my previous response, I suggest to resolve Bernard's concern by adding the following text: 5.6 EAP Key Generation EAP-EKE can be used for EAP key generation, as defined by [RFC 5247]. When used in this manner, the values required to establish the key hierarchy are defined as follows: - Peer-Id is the EAP-EKE ID_P value. - Server-Id is the EAP-EKE ID_S value. - Session-Id is the concatenated Type | Nonce_P | Nonce_S, where Type is the method type defined for EAP-EKE in [Sec. 4.1], a single octet. Thanks, Yaron Signed-off-by: Jouni Malinen --- src/eap_peer/eap_eke.c | 24 ++++++++++++++++++++++++ src/eap_server/eap_server_eke.c | 24 ++++++++++++++++++++++++ 2 files changed, 48 insertions(+) diff --git a/src/eap_peer/eap_eke.c b/src/eap_peer/eap_eke.c index 987af83f5..dfbda5644 100644 --- a/src/eap_peer/eap_eke.c +++ b/src/eap_peer/eap_eke.c @@ -744,6 +744,29 @@ static u8 * eap_eke_get_emsk(struct eap_sm *sm, void *priv, size_t *len) } +static u8 * eap_eke_get_session_id(struct eap_sm *sm, void *priv, size_t *len) +{ + struct eap_eke_data *data = priv; + u8 *sid; + size_t sid_len; + + if (data->state != SUCCESS) + return NULL; + + sid_len = 1 + 2 * data->sess.nonce_len; + sid = os_malloc(sid_len); + if (sid == NULL) + return NULL; + sid[0] = EAP_TYPE_EKE; + os_memcpy(sid + 1, data->nonce_p, data->sess.nonce_len); + os_memcpy(sid + 1 + data->sess.nonce_len, data->nonce_s, + data->sess.nonce_len); + *len = sid_len; + + return sid; +} + + int eap_peer_eke_register(void) { struct eap_method *eap; @@ -760,6 +783,7 @@ int eap_peer_eke_register(void) eap->isKeyAvailable = eap_eke_isKeyAvailable; eap->getKey = eap_eke_getKey; eap->get_emsk = eap_eke_get_emsk; + eap->getSessionId = eap_eke_get_session_id; ret = eap_peer_method_register(eap); if (ret) diff --git a/src/eap_server/eap_server_eke.c b/src/eap_server/eap_server_eke.c index 966f511dd..ba82be9c3 100644 --- a/src/eap_server/eap_server_eke.c +++ b/src/eap_server/eap_server_eke.c @@ -766,6 +766,29 @@ static Boolean eap_eke_isSuccess(struct eap_sm *sm, void *priv) } +static u8 * eap_eke_get_session_id(struct eap_sm *sm, void *priv, size_t *len) +{ + struct eap_eke_data *data = priv; + u8 *sid; + size_t sid_len; + + if (data->state != SUCCESS) + return NULL; + + sid_len = 1 + 2 * data->sess.nonce_len; + sid = os_malloc(sid_len); + if (sid == NULL) + return NULL; + sid[0] = EAP_TYPE_EKE; + os_memcpy(sid + 1, data->nonce_p, data->sess.nonce_len); + os_memcpy(sid + 1 + data->sess.nonce_len, data->nonce_s, + data->sess.nonce_len); + *len = sid_len; + + return sid; +} + + int eap_server_eke_register(void) { struct eap_method *eap; @@ -785,6 +808,7 @@ int eap_server_eke_register(void) eap->getKey = eap_eke_getKey; eap->isSuccess = eap_eke_isSuccess; eap->get_emsk = eap_eke_get_emsk; + eap->getSessionId = eap_eke_get_session_id; ret = eap_server_method_register(eap); if (ret)