EAP-EKE: Add Session-Id

While RFC 6124 does not define how Session-Id is constructed for
EAP-EKE, there seems to be consensus among the authors on the
construction. Use this Type | Nonce_P | Nonce_S construction based on
the following email:

 From: Yaron Sheffer <yaronf.ietf at gmail.com>
 To: ietf at ietf.org
 Date: Wed, 17 Nov 2010 13:13:42 +0200

Expanding on my previous response, I suggest to resolve Bernard's
concern by adding the following text:

5.6 EAP Key Generation

EAP-EKE can be used for EAP key generation, as defined by [RFC 5247].
When used in this manner, the values required to establish the key
hierarchy are defined as follows:

- Peer-Id is the EAP-EKE ID_P value.
- Server-Id is the EAP-EKE ID_S value.
- Session-Id is the concatenated Type | Nonce_P | Nonce_S, where Type is
  the method type defined for EAP-EKE in [Sec. 4.1], a single octet.

Thanks,
	Yaron

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/eap_peer/eap_eke.c b/src/eap_peer/eap_eke.c
index 987af83..dfbda56 100644 (file)
--- a/src/eap_peer/eap_eke.c
+++ b/src/eap_peer/eap_eke.c
@@ -744,6 +744,29 @@ static u8 * eap_eke_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
 }
 
 
+static u8 * eap_eke_get_session_id(struct eap_sm *sm, void *priv, size_t *len)
+{
+       struct eap_eke_data *data = priv;
+       u8 *sid;
+       size_t sid_len;
+
+       if (data->state != SUCCESS)
+               return NULL;
+
+       sid_len = 1 + 2 * data->sess.nonce_len;
+       sid = os_malloc(sid_len);
+       if (sid == NULL)
+               return NULL;
+       sid[0] = EAP_TYPE_EKE;
+       os_memcpy(sid + 1, data->nonce_p, data->sess.nonce_len);
+       os_memcpy(sid + 1 + data->sess.nonce_len, data->nonce_s,
+                 data->sess.nonce_len);
+       *len = sid_len;
+
+       return sid;
+}
+
+
 int eap_peer_eke_register(void)
 {
        struct eap_method *eap;
@@ -760,6 +783,7 @@ int eap_peer_eke_register(void)
        eap->isKeyAvailable = eap_eke_isKeyAvailable;
        eap->getKey = eap_eke_getKey;
        eap->get_emsk = eap_eke_get_emsk;
+       eap->getSessionId = eap_eke_get_session_id;
 
        ret = eap_peer_method_register(eap);
        if (ret)

diff --git a/src/eap_server/eap_server_eke.c b/src/eap_server/eap_server_eke.c
index 966f511..ba82be9 100644 (file)
--- a/src/eap_server/eap_server_eke.c
+++ b/src/eap_server/eap_server_eke.c
@@ -766,6 +766,29 @@ static Boolean eap_eke_isSuccess(struct eap_sm *sm, void *priv)
 }
 
 
+static u8 * eap_eke_get_session_id(struct eap_sm *sm, void *priv, size_t *len)
+{
+       struct eap_eke_data *data = priv;
+       u8 *sid;
+       size_t sid_len;
+
+       if (data->state != SUCCESS)
+               return NULL;
+
+       sid_len = 1 + 2 * data->sess.nonce_len;
+       sid = os_malloc(sid_len);
+       if (sid == NULL)
+               return NULL;
+       sid[0] = EAP_TYPE_EKE;
+       os_memcpy(sid + 1, data->nonce_p, data->sess.nonce_len);
+       os_memcpy(sid + 1 + data->sess.nonce_len, data->nonce_s,
+                 data->sess.nonce_len);
+       *len = sid_len;
+
+       return sid;
+}
+
+
 int eap_server_eke_register(void)
 {
        struct eap_method *eap;
@@ -785,6 +808,7 @@ int eap_server_eke_register(void)
        eap->getKey = eap_eke_getKey;
        eap->isSuccess = eap_eke_isSuccess;
        eap->get_emsk = eap_eke_get_emsk;
+       eap->getSessionId = eap_eke_get_session_id;
 
        ret = eap_server_method_register(eap);
        if (ret)