src/eap_peer/eap_pwd.c

   1 /*
   2  * EAP peer method: EAP-pwd (RFC 5931)
   3  * Copyright (c) 2010, Dan Harkins <dharkins@lounge.org>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the BSD license.
   7  *
   8  * Alternatively, this software may be distributed under the terms of the
   9  * GNU General Public License version 2 as published by the Free Software
  10  * Foundation.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "eap_peer/eap_i.h"
  19 #include "eap_common/eap_pwd_common.h"
  20
  21
  22 struct eap_pwd_data {
  23         enum {
  24                 PWD_ID_Req, PWD_Commit_Req, PWD_Confirm_Req, SUCCESS, FAILURE
  25         } state;
  26         u8 *id_peer;
  27         size_t id_peer_len;
  28         u8 *id_server;
  29         size_t id_server_len;
  30         u8 *password;
  31         size_t password_len;
  32         u16 group_num;
  33         EAP_PWD_group *grp;
  34
  35         BIGNUM *k;
  36         BIGNUM *private_value;
  37         BIGNUM *server_scalar;
  38         BIGNUM *my_scalar;
  39         EC_POINT *my_element;
  40         EC_POINT *server_element;
  41
  42         u8 msk[EAP_MSK_LEN];
  43         u8 emsk[EAP_EMSK_LEN];
  44
  45         BN_CTX *bnctx;
  46 };
  47
  48
  49 #ifndef CONFIG_NO_STDOUT_DEBUG
  50 static const char * eap_pwd_state_txt(int state)
  51 {
  52         switch (state) {
  53         case PWD_ID_Req:
  54                 return "PWD-ID-Req";
  55         case PWD_Commit_Req:
  56                 return "PWD-Commit-Req";
  57         case PWD_Confirm_Req:
  58                 return "PWD-Confirm-Req";
  59         case SUCCESS:
  60                 return "SUCCESS";
  61         case FAILURE:
  62                 return "FAILURE";
  63         default:
  64                 return "PWD-UNK";
  65         }
  66 }
  67 #endif  /* CONFIG_NO_STDOUT_DEBUG */
  68
  69
  70 static void eap_pwd_state(struct eap_pwd_data *data, int state)
  71 {
  72         wpa_printf(MSG_INFO, "EAP-PWD: %s -> %s",
  73                    eap_pwd_state_txt(data->state), eap_pwd_state_txt(state));
  74         data->state = state;
  75 }
  76
  77
  78 static void * eap_pwd_init(struct eap_sm *sm)
  79 {
  80         struct eap_pwd_data *data;
  81         const u8 *identity, *password;
  82         size_t identity_len, password_len;
  83
  84         password = eap_get_config_password(sm, &password_len);
  85         if (password == NULL) {
  86                 wpa_printf(MSG_INFO, "EAP-PWD: No password configured!");
  87                 return NULL;
  88         }
  89
  90         identity = eap_get_config_identity(sm, &identity_len);
  91         if (identity == NULL) {
  92                 wpa_printf(MSG_INFO, "EAP-PWD: No identity configured!");
  93                 return NULL;
  94         }
  95
  96         if ((data = os_zalloc(sizeof(*data))) == NULL) {
  97                 wpa_printf(MSG_INFO, "EAP-PWD: memory allocation data fail");
  98                 return NULL;
  99         }
 100
 101         if ((data->bnctx = BN_CTX_new()) == NULL) {
 102                 wpa_printf(MSG_INFO, "EAP-PWD: bn context allocation fail");
 103                 os_free(data);
 104                 return NULL;
 105         }
 106
 107         if ((data->id_peer = os_malloc(identity_len)) == NULL) {
 108                 wpa_printf(MSG_INFO, "EAP-PWD: memory allocation id fail");
 109                 BN_CTX_free(data->bnctx);
 110                 os_free(data);
 111                 return NULL;
 112         }
 113
 114         os_memcpy(data->id_peer, identity, identity_len);
 115         data->id_peer_len = identity_len;
 116
 117         if ((data->password = os_malloc(password_len)) == NULL) {
 118                 wpa_printf(MSG_INFO, "EAP-PWD: memory allocation psk fail");
 119                 BN_CTX_free(data->bnctx);
 120                 os_free(data->id_peer);
 121                 os_free(data);
 122                 return NULL;
 123         }
 124         os_memcpy(data->password, password, password_len);
 125         data->password_len = password_len;
 126
 127         data->state = PWD_ID_Req;
 128
 129         return data;
 130 }
 131
 132
 133 static void eap_pwd_deinit(struct eap_sm *sm, void *priv)
 134 {
 135         struct eap_pwd_data *data = priv;
 136
 137         BN_free(data->private_value);
 138         BN_free(data->server_scalar);
 139         BN_free(data->my_scalar);
 140         BN_free(data->k);
 141         BN_CTX_free(data->bnctx);
 142         EC_POINT_free(data->my_element);
 143         EC_POINT_free(data->server_element);
 144         os_free(data->id_peer);
 145         os_free(data->password);
 146         os_free(data->grp);
 147         os_free(data);
 148 }
 149
 150
 151 static u8 * eap_pwd_getkey(struct eap_sm *sm, void *priv, size_t *len)
 152 {
 153         struct eap_pwd_data *data = priv;
 154         u8 *key;
 155
 156         if (data->state != SUCCESS)
 157                 return NULL;
 158
 159         key = os_malloc(EAP_MSK_LEN);
 160         if (key == NULL)
 161                 return NULL;
 162
 163         os_memcpy(key, data->msk, EAP_MSK_LEN);
 164         *len = EAP_MSK_LEN;
 165
 166         return key;
 167 }
 168
 169
 170 static struct wpabuf *
 171 eap_pwd_perform_id_exchange(struct eap_sm *sm, struct eap_pwd_data *data,
 172                             struct eap_method_ret *ret,
 173                             const struct wpabuf *reqData,
 174                             const u8 *payload, size_t payload_len)
 175 {
 176         struct eap_pwd_id *id;
 177         struct wpabuf *resp;
 178
 179         if (data->state != PWD_ID_Req) {
 180                 ret->ignore = TRUE;
 181                 return NULL;
 182         }
 183
 184         if (payload_len < sizeof(struct eap_pwd_id)) {
 185                 ret->ignore = TRUE;
 186                 return NULL;
 187         }
 188
 189         id = (struct eap_pwd_id *) payload;
 190         data->group_num = be_to_host16(id->group_num);
 191         if ((id->random_function != EAP_PWD_DEFAULT_RAND_FUNC) ||
 192             (id->prf != EAP_PWD_DEFAULT_PRF)) {
 193                 ret->ignore = TRUE;
 194                 return NULL;
 195         }
 196
 197         wpa_printf(MSG_DEBUG, "EAP-PWD (peer): server said group %d",
 198                    data->group_num);
 199
 200         data->id_server = os_malloc(payload_len - sizeof(struct eap_pwd_id));
 201         if (data->id_server == NULL) {
 202                 wpa_printf(MSG_INFO, "EAP-PWD: memory allocation id fail");
 203                 return NULL;
 204         }
 205         data->id_server_len = payload_len - sizeof(struct eap_pwd_id);
 206         os_memcpy(data->id_server, id->identity, data->id_server_len);
 207         wpa_hexdump_ascii(MSG_INFO, "EAP-PWD (peer): server sent id of",
 208                           data->id_server, data->id_server_len);
 209
 210         if ((data->grp = (EAP_PWD_group *) os_malloc(sizeof(EAP_PWD_group))) ==
 211             NULL) {
 212                 wpa_printf(MSG_INFO, "EAP-PWD: failed to allocate memory for "
 213                            "group");
 214                 return NULL;
 215         }
 216
 217         /* compute PWE */
 218         if (compute_password_element(data->grp, data->group_num,
 219                                      data->password, data->password_len,
 220                                      data->id_server, data->id_server_len,
 221                                      data->id_peer, data->id_peer_len,
 222                                      id->token)) {
 223                 wpa_printf(MSG_INFO, "EAP-PWD (peer): unable to compute PWE");
 224                 return NULL;
 225         }
 226
 227         wpa_printf(MSG_INFO, "EAP-PWD (peer): computed %d bit PWE...",
 228                    BN_num_bits(data->grp->prime));
 229
 230         resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
 231                              1 + sizeof(struct eap_pwd_id) + data->id_peer_len,
 232                              EAP_CODE_RESPONSE, eap_get_id(reqData));
 233         if (resp == NULL)
 234                 return NULL;
 235
 236         wpabuf_put_u8(resp, EAP_PWD_OPCODE_ID_EXCH);
 237         wpabuf_put_be16(resp, data->group_num);
 238         wpabuf_put_u8(resp, EAP_PWD_DEFAULT_RAND_FUNC);
 239         wpabuf_put_u8(resp, EAP_PWD_DEFAULT_PRF);
 240         wpabuf_put_data(resp, id->token, sizeof(id->token));
 241         wpabuf_put_u8(resp, EAP_PWD_PREP_NONE);
 242         wpabuf_put_data(resp, data->id_peer, data->id_peer_len);
 243
 244         eap_pwd_state(data, PWD_Commit_Req);
 245
 246         return resp;
 247 }
 248
 249
 250 static struct wpabuf *
 251 eap_pwd_perform_commit_exchange(struct eap_sm *sm, struct eap_pwd_data *data,
 252                                 struct eap_method_ret *ret,
 253                                 const struct wpabuf *reqData,
 254                                 const u8 *payload, size_t payload_len)
 255 {
 256         struct wpabuf *resp = NULL;
 257         EC_POINT *K = NULL, *point = NULL;
 258         BIGNUM *mask = NULL, *x = NULL, *y = NULL, *cofactor = NULL;
 259         u16 offset;
 260         u8 *ptr, *scalar = NULL, *element = NULL;
 261
 262         if (((data->private_value = BN_new()) == NULL) ||
 263             ((data->my_element = EC_POINT_new(data->grp->group)) == NULL) ||
 264             ((cofactor = BN_new()) == NULL) ||
 265             ((data->my_scalar = BN_new()) == NULL) ||
 266             ((mask = BN_new()) == NULL)) {
 267                 wpa_printf(MSG_INFO, "EAP-PWD (peer): scalar allocation fail");
 268                 goto fin;
 269         }
 270
 271         if (!EC_GROUP_get_cofactor(data->grp->group, cofactor, NULL)) {
 272                 wpa_printf(MSG_INFO, "EAP-pwd (peer): unable to get cofactor "
 273                            "for curve");
 274                 goto fin;
 275         }
 276
 277         BN_rand_range(data->private_value, data->grp->order);
 278         BN_rand_range(mask, data->grp->order);
 279         BN_add(data->my_scalar, data->private_value, mask);
 280         BN_mod(data->my_scalar, data->my_scalar, data->grp->order,
 281                data->bnctx);
 282
 283         if (!EC_POINT_mul(data->grp->group, data->my_element, NULL,
 284                           data->grp->pwe, mask, data->bnctx)) {
 285                 wpa_printf(MSG_INFO, "EAP-PWD (peer): element allocation "
 286                            "fail");
 287                 eap_pwd_state(data, FAILURE);
 288                 goto fin;
 289         }
 290
 291         if (!EC_POINT_invert(data->grp->group, data->my_element, data->bnctx))
 292         {
 293                 wpa_printf(MSG_INFO, "EAP-PWD (peer): element inversion fail");
 294                 goto fin;
 295         }
 296         BN_free(mask);
 297
 298         if (((x = BN_new()) == NULL) ||
 299             ((y = BN_new()) == NULL)) {
 300                 wpa_printf(MSG_INFO, "EAP-PWD (peer): point allocation fail");
 301                 goto fin;
 302         }
 303
 304         /* process the request */
 305         if (((data->server_scalar = BN_new()) == NULL) ||
 306             ((data->k = BN_new()) == NULL) ||
 307             ((K = EC_POINT_new(data->grp->group)) == NULL) ||
 308             ((point = EC_POINT_new(data->grp->group)) == NULL) ||
 309             ((data->server_element = EC_POINT_new(data->grp->group)) == NULL))
 310         {
 311                 wpa_printf(MSG_INFO, "EAP-PWD (peer): peer data allocation "
 312                            "fail");
 313                 goto fin;
 314         }
 315
 316         /* element, x then y, followed by scalar */
 317         ptr = (u8 *) payload;
 318         BN_bin2bn(ptr, BN_num_bytes(data->grp->prime), x);
 319         ptr += BN_num_bytes(data->grp->prime);
 320         BN_bin2bn(ptr, BN_num_bytes(data->grp->prime), y);
 321         ptr += BN_num_bytes(data->grp->prime);
 322         BN_bin2bn(ptr, BN_num_bytes(data->grp->order), data->server_scalar);
 323         if (!EC_POINT_set_affine_coordinates_GFp(data->grp->group,
 324                                                  data->server_element, x, y,
 325                                                  data->bnctx)) {
 326                 wpa_printf(MSG_INFO, "EAP-PWD (peer): setting peer element "
 327                            "fail");
 328                 goto fin;
 329         }
 330
 331         /* check to ensure server's element is not in a small sub-group */
 332         if (BN_cmp(cofactor, BN_value_one())) {
 333                 if (!EC_POINT_mul(data->grp->group, point, NULL,
 334                                   data->server_element, cofactor, NULL)) {
 335                         wpa_printf(MSG_INFO, "EAP-PWD (peer): cannot multiply "
 336                                    "server element by order!\n");
 337                         goto fin;
 338                 }
 339                 if (EC_POINT_is_at_infinity(data->grp->group, point)) {
 340                         wpa_printf(MSG_INFO, "EAP-PWD (peer): server element "
 341                                    "is at infinity!\n");
 342                         goto fin;
 343                 }
 344         }
 345
 346         /* compute the shared key, k */
 347         if ((!EC_POINT_mul(data->grp->group, K, NULL, data->grp->pwe,
 348                            data->server_scalar, data->bnctx)) ||
 349             (!EC_POINT_add(data->grp->group, K, K, data->server_element,
 350                            data->bnctx)) ||
 351             (!EC_POINT_mul(data->grp->group, K, NULL, K, data->private_value,
 352                            data->bnctx))) {
 353                 wpa_printf(MSG_INFO, "EAP-PWD (peer): computing shared key "
 354                            "fail");
 355                 goto fin;
 356         }
 357
 358         /* ensure that the shared key isn't in a small sub-group */
 359         if (BN_cmp(cofactor, BN_value_one())) {
 360                 if (!EC_POINT_mul(data->grp->group, K, NULL, K, cofactor,
 361                                   NULL)) {
 362                         wpa_printf(MSG_INFO, "EAP-PWD (peer): cannot multiply "
 363                                    "shared key point by order");
 364                         goto fin;
 365                 }
 366         }
 367
 368         /*
 369          * This check is strictly speaking just for the case above where
 370          * co-factor > 1 but it was suggested that even though this is probably
 371          * never going to happen it is a simple and safe check "just to be
 372          * sure" so let's be safe.
 373          */
 374         if (EC_POINT_is_at_infinity(data->grp->group, K)) {
 375                 wpa_printf(MSG_INFO, "EAP-PWD (peer): shared key point is at "
 376                            "infinity!\n");
 377                 goto fin;
 378         }
 379
 380         if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group, K, data->k,
 381                                                  NULL, data->bnctx)) {
 382                 wpa_printf(MSG_INFO, "EAP-PWD (peer): unable to extract "
 383                            "shared secret from point");
 384                 goto fin;
 385         }
 386
 387         /* now do the response */
 388         if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
 389                                                  data->my_element, x, y,
 390                                                  data->bnctx)) {
 391                 wpa_printf(MSG_INFO, "EAP-PWD (peer): point assignment fail");
 392                 goto fin;
 393         }
 394
 395         if (((scalar = os_malloc(BN_num_bytes(data->grp->order))) == NULL) ||
 396             ((element = os_malloc(BN_num_bytes(data->grp->prime) * 2)) ==
 397              NULL)) {
 398                 wpa_printf(MSG_INFO, "EAP-PWD (peer): data allocation fail");
 399                 goto fin;
 400         }
 401
 402         /*
 403          * bignums occupy as little memory as possible so one that is
 404          * sufficiently smaller than the prime or order might need pre-pending
 405          * with zeros.
 406          */
 407         os_memset(scalar, 0, BN_num_bytes(data->grp->order));
 408         os_memset(element, 0, BN_num_bytes(data->grp->prime) * 2);
 409         offset = BN_num_bytes(data->grp->order) -
 410                 BN_num_bytes(data->my_scalar);
 411         BN_bn2bin(data->my_scalar, scalar + offset);
 412
 413         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x);
 414         BN_bn2bin(x, element + offset);
 415         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y);
 416         BN_bn2bin(y, element + BN_num_bytes(data->grp->prime) + offset);
 417
 418         resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
 419                              sizeof(struct eap_pwd_hdr) +
 420                              BN_num_bytes(data->grp->order) +
 421                              (2 * BN_num_bytes(data->grp->prime)),
 422                              EAP_CODE_RESPONSE, eap_get_id(reqData));
 423         if (resp == NULL)
 424                 goto fin;
 425
 426         wpabuf_put_u8(resp, EAP_PWD_OPCODE_COMMIT_EXCH);
 427
 428         /* we send the element as (x,y) follwed by the scalar */
 429         wpabuf_put_data(resp, element, (2 * BN_num_bytes(data->grp->prime)));
 430         wpabuf_put_data(resp, scalar, BN_num_bytes(data->grp->order));
 431
 432 fin:
 433         os_free(scalar);
 434         os_free(element);
 435         BN_free(x);
 436         BN_free(y);
 437         BN_free(cofactor);
 438         EC_POINT_free(K);
 439         EC_POINT_free(point);
 440         if (resp == NULL)
 441                 eap_pwd_state(data, FAILURE);
 442         else
 443                 eap_pwd_state(data, PWD_Confirm_Req);
 444
 445         return resp;
 446 }
 447
 448
 449 static struct wpabuf *
 450 eap_pwd_perform_confirm_exchange(struct eap_sm *sm, struct eap_pwd_data *data,
 451                                  struct eap_method_ret *ret,
 452                                  const struct wpabuf *reqData,
 453                                  const u8 *payload, size_t payload_len)
 454 {
 455         struct wpabuf *resp = NULL;
 456         BIGNUM *x = NULL, *y = NULL;
 457         HMAC_CTX ctx;
 458         u32 cs;
 459         u8 conf[SHA256_DIGEST_LENGTH], *cruft = NULL, *ptr;
 460
 461         /*
 462          * first build up the ciphersuite which is group | random_function |
 463          *      prf
 464          */
 465         ptr = (u8 *) &cs;
 466         os_memcpy(ptr, &data->group_num, sizeof(u16));
 467         ptr += sizeof(u16);
 468         *ptr = EAP_PWD_DEFAULT_RAND_FUNC;
 469         ptr += sizeof(u8);
 470         *ptr = EAP_PWD_DEFAULT_PRF;
 471
 472         /* each component of the cruft will be at most as big as the prime */
 473         if (((cruft = os_malloc(BN_num_bytes(data->grp->prime))) == NULL) ||
 474             ((x = BN_new()) == NULL) || ((y = BN_new()) == NULL)) {
 475                 wpa_printf(MSG_INFO, "EAP-PWD (server): debug allocation "
 476                            "fail");
 477                 goto fin;
 478         }
 479
 480         /*
 481          * server's commit is H(k | server_element | server_scalar |
 482          *                      peer_element | peer_scalar | ciphersuite)
 483          */
 484         H_Init(&ctx);
 485
 486         /*
 487          * zero the memory each time because this is mod prime math and some
 488          * value may start with a few zeros and the previous one did not.
 489          */
 490         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 491         BN_bn2bin(data->k, cruft);
 492         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 493
 494         /* server element: x, y */
 495         if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
 496                                                  data->server_element, x, y,
 497                                                  data->bnctx)) {
 498                 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
 499                            "assignment fail");
 500                 goto fin;
 501         }
 502         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 503         BN_bn2bin(x, cruft);
 504         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 505         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 506         BN_bn2bin(y, cruft);
 507         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 508
 509         /* server scalar */
 510         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 511         BN_bn2bin(data->server_scalar, cruft);
 512         H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
 513
 514         /* my element: x, y */
 515         if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
 516                                                  data->my_element, x, y,
 517                                                  data->bnctx)) {
 518                 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
 519                            "assignment fail");
 520                 goto fin;
 521         }
 522
 523         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 524         BN_bn2bin(x, cruft);
 525         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 526         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 527         BN_bn2bin(y, cruft);
 528         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 529
 530         /* my scalar */
 531         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 532         BN_bn2bin(data->my_scalar, cruft);
 533         H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
 534
 535         /* the ciphersuite */
 536         H_Update(&ctx, (u8 *) &cs, sizeof(u32));
 537
 538         /* random function fin */
 539         H_Final(&ctx, conf);
 540
 541         ptr = (u8 *) payload;
 542         if (os_memcmp(conf, ptr, SHA256_DIGEST_LENGTH)) {
 543                 wpa_printf(MSG_INFO, "EAP-PWD (peer): confirm did not verify");
 544                 goto fin;
 545         }
 546
 547         wpa_printf(MSG_DEBUG, "EAP-pwd (peer): confirm verified");
 548
 549         /*
 550          * compute confirm:
 551          *  H(k | peer_element | peer_scalar | server_element | server_scalar |
 552          *    ciphersuite)
 553          */
 554         H_Init(&ctx);
 555
 556         /* k */
 557         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 558         BN_bn2bin(data->k, cruft);
 559         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 560
 561         /* my element */
 562         if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
 563                                                  data->my_element, x, y,
 564                                                  data->bnctx)) {
 565                 wpa_printf(MSG_INFO, "EAP-PWD (peer): confirm point "
 566                            "assignment fail");
 567                 goto fin;
 568         }
 569         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 570         BN_bn2bin(x, cruft);
 571         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 572         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 573         BN_bn2bin(y, cruft);
 574         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 575
 576         /* my scalar */
 577         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 578         BN_bn2bin(data->my_scalar, cruft);
 579         H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
 580
 581         /* server element: x, y */
 582         if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
 583                                                  data->server_element, x, y,
 584                                                  data->bnctx)) {
 585                 wpa_printf(MSG_INFO, "EAP-PWD (peer): confirm point "
 586                            "assignment fail");
 587                 goto fin;
 588         }
 589         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 590         BN_bn2bin(x, cruft);
 591         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 592         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 593         BN_bn2bin(y, cruft);
 594         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 595
 596         /* server scalar */
 597         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 598         BN_bn2bin(data->server_scalar, cruft);
 599         H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
 600
 601         /* the ciphersuite */
 602         H_Update(&ctx, (u8 *) &cs, sizeof(u32));
 603
 604         /* all done */
 605         H_Final(&ctx, conf);
 606
 607         resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
 608                              sizeof(struct eap_pwd_hdr) + SHA256_DIGEST_LENGTH,
 609                              EAP_CODE_RESPONSE, eap_get_id(reqData));
 610         if (resp == NULL)
 611                 goto fin;
 612
 613         wpabuf_put_u8(resp, EAP_PWD_OPCODE_CONFIRM_EXCH);
 614         wpabuf_put_data(resp, conf, SHA256_DIGEST_LENGTH);
 615
 616         if (compute_keys(data->grp, data->bnctx, data->k, data->server_element,
 617                          data->my_element, data->server_scalar,
 618                          data->my_scalar, &cs, data->msk, data->emsk) < 0) {
 619                 wpa_printf(MSG_INFO, "EAP-PWD (peer): unable to compute MSK | "
 620                            "EMSK");
 621                 goto fin;
 622         }
 623
 624 fin:
 625         os_free(cruft);
 626         BN_free(x);
 627         BN_free(y);
 628         ret->methodState = METHOD_DONE;
 629         if (resp == NULL) {
 630                 ret->decision = DECISION_FAIL;
 631                 eap_pwd_state(data, FAILURE);
 632         } else {
 633                 ret->decision = DECISION_UNCOND_SUCC;
 634                 eap_pwd_state(data, SUCCESS);
 635         }
 636
 637         return resp;
 638 }
 639
 640
 641 static struct wpabuf *
 642 eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret,
 643                 const struct wpabuf *reqData)
 644 {
 645         struct eap_pwd_data *data = priv;
 646         struct wpabuf *resp = NULL;
 647         const u8 *pos;
 648         size_t len;
 649         u8 exch;
 650
 651         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_PWD, reqData, &len);
 652         if ((pos == NULL) || (len < 1)) {
 653                 ret->ignore = TRUE;
 654                 return NULL;
 655         }
 656
 657         wpa_printf(MSG_INFO, "EAP-pwd: Received frame: opcode %d", *pos);
 658
 659         ret->ignore = FALSE;
 660         ret->methodState = METHOD_MAY_CONT;
 661         ret->decision = DECISION_FAIL;
 662         ret->allowNotifications = FALSE;
 663
 664         exch = *pos & 0x3f;
 665         switch (exch) {
 666         case EAP_PWD_OPCODE_ID_EXCH:
 667                 resp = eap_pwd_perform_id_exchange(sm, data, ret, reqData,
 668                                                    pos + 1, len - 1);
 669                 break;
 670         case EAP_PWD_OPCODE_COMMIT_EXCH:
 671                 resp = eap_pwd_perform_commit_exchange(sm, data, ret, reqData,
 672                                                        pos + 1, len - 1);
 673                 break;
 674         case EAP_PWD_OPCODE_CONFIRM_EXCH:
 675                 resp = eap_pwd_perform_confirm_exchange(sm, data, ret, reqData,
 676                                                         pos + 1, len - 1);
 677                 break;
 678         default:
 679                 wpa_printf(MSG_INFO, "EAP-pwd: Ignoring message with unknown "
 680                            "opcode %d", exch);
 681                 break;
 682         }
 683
 684         return resp;
 685 }
 686
 687
 688 static Boolean eap_pwd_key_available(struct eap_sm *sm, void *priv)
 689 {
 690         struct eap_pwd_data *data = priv;
 691         return data->state == SUCCESS;
 692 }
 693
 694
 695 static u8 * eap_pwd_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
 696 {
 697         struct eap_pwd_data *data = priv;
 698         u8 *key;
 699
 700         if (data->state != SUCCESS)
 701                 return NULL;
 702
 703         if ((key = os_malloc(EAP_EMSK_LEN)) == NULL)
 704                 return NULL;
 705
 706         os_memcpy(key, data->emsk, EAP_EMSK_LEN);
 707         *len = EAP_EMSK_LEN;
 708
 709         return key;
 710 }
 711
 712
 713 int eap_peer_pwd_register(void)
 714 {
 715         struct eap_method *eap;
 716         int ret;
 717
 718         EVP_add_digest(EVP_sha256());
 719         eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
 720                                     EAP_VENDOR_IETF, EAP_TYPE_PWD, "PWD");
 721         if (eap == NULL)
 722                 return -1;
 723
 724         eap->init = eap_pwd_init;
 725         eap->deinit = eap_pwd_deinit;
 726         eap->process = eap_pwd_process;
 727         eap->isKeyAvailable = eap_pwd_key_available;
 728         eap->getKey = eap_pwd_getkey;
 729         eap->get_emsk = eap_pwd_get_emsk;
 730
 731         ret = eap_peer_method_register(eap);
 732         if (ret)
 733                 eap_peer_method_free(eap);
 734         return ret;
 735 }