libeap/src/common/sae.c

   1 /*
   2  * Simultaneous authentication of equals
   3  * Copyright (c) 2012-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "crypto/crypto.h"
  13 #include "crypto/sha256.h"
  14 #include "crypto/random.h"
  15 #include "crypto/dh_groups.h"
  16 #include "ieee802_11_defs.h"
  17 #include "sae.h"
  18
  19
  20 int sae_set_group(struct sae_data *sae, int group)
  21 {
  22         struct sae_temporary_data *tmp;
  23
  24         sae_clear_data(sae);
  25         tmp = sae->tmp = os_zalloc(sizeof(*tmp));
  26         if (tmp == NULL)
  27                 return -1;
  28
  29         /* First, check if this is an ECC group */
  30         tmp->ec = crypto_ec_init(group);
  31         if (tmp->ec) {
  32                 sae->group = group;
  33                 tmp->prime_len = crypto_ec_prime_len(tmp->ec);
  34                 tmp->prime = crypto_ec_get_prime(tmp->ec);
  35                 tmp->order = crypto_ec_get_order(tmp->ec);
  36                 return 0;
  37         }
  38
  39         /* Not an ECC group, check FFC */
  40         tmp->dh = dh_groups_get(group);
  41         if (tmp->dh) {
  42                 sae->group = group;
  43                 tmp->prime_len = tmp->dh->prime_len;
  44                 if (tmp->prime_len > SAE_MAX_PRIME_LEN) {
  45                         sae_clear_data(sae);
  46                         return -1;
  47                 }
  48
  49                 tmp->prime_buf = crypto_bignum_init_set(tmp->dh->prime,
  50                                                         tmp->prime_len);
  51                 if (tmp->prime_buf == NULL) {
  52                         sae_clear_data(sae);
  53                         return -1;
  54                 }
  55                 tmp->prime = tmp->prime_buf;
  56
  57                 tmp->order_buf = crypto_bignum_init_set(tmp->dh->order,
  58                                                         tmp->dh->order_len);
  59                 if (tmp->order_buf == NULL) {
  60                         sae_clear_data(sae);
  61                         return -1;
  62                 }
  63                 tmp->order = tmp->order_buf;
  64
  65                 return 0;
  66         }
  67
  68         /* Unsupported group */
  69         return -1;
  70 }
  71
  72
  73 void sae_clear_temp_data(struct sae_data *sae)
  74 {
  75         struct sae_temporary_data *tmp;
  76         if (sae == NULL || sae->tmp == NULL)
  77                 return;
  78         tmp = sae->tmp;
  79         crypto_ec_deinit(tmp->ec);
  80         crypto_bignum_deinit(tmp->prime_buf, 0);
  81         crypto_bignum_deinit(tmp->order_buf, 0);
  82         crypto_bignum_deinit(tmp->sae_rand, 1);
  83         crypto_bignum_deinit(tmp->pwe_ffc, 1);
  84         crypto_bignum_deinit(tmp->own_commit_scalar, 0);
  85         crypto_bignum_deinit(tmp->own_commit_element_ffc, 0);
  86         crypto_bignum_deinit(tmp->peer_commit_element_ffc, 0);
  87         crypto_ec_point_deinit(tmp->pwe_ecc, 1);
  88         crypto_ec_point_deinit(tmp->own_commit_element_ecc, 0);
  89         crypto_ec_point_deinit(tmp->peer_commit_element_ecc, 0);
  90         wpabuf_free(tmp->anti_clogging_token);
  91         bin_clear_free(tmp, sizeof(*tmp));
  92         sae->tmp = NULL;
  93 }
  94
  95
  96 void sae_clear_data(struct sae_data *sae)
  97 {
  98         if (sae == NULL)
  99                 return;
 100         sae_clear_temp_data(sae);
 101         crypto_bignum_deinit(sae->peer_commit_scalar, 0);
 102         os_memset(sae, 0, sizeof(*sae));
 103 }
 104
 105
 106 static void buf_shift_right(u8 *buf, size_t len, size_t bits)
 107 {
 108         size_t i;
 109         for (i = len - 1; i > 0; i--)
 110                 buf[i] = (buf[i - 1] << (8 - bits)) | (buf[i] >> bits);
 111         buf[0] >>= bits;
 112 }
 113
 114
 115 static struct crypto_bignum * sae_get_rand(struct sae_data *sae)
 116 {
 117         u8 val[SAE_MAX_PRIME_LEN];
 118         int iter = 0;
 119         struct crypto_bignum *bn = NULL;
 120         int order_len_bits = crypto_bignum_bits(sae->tmp->order);
 121         size_t order_len = (order_len_bits + 7) / 8;
 122
 123         if (order_len > sizeof(val))
 124                 return NULL;
 125
 126         for (;;) {
 127                 if (iter++ > 100 || random_get_bytes(val, order_len) < 0)
 128                         return NULL;
 129                 if (order_len_bits % 8)
 130                         buf_shift_right(val, order_len, 8 - order_len_bits % 8);
 131                 bn = crypto_bignum_init_set(val, order_len);
 132                 if (bn == NULL)
 133                         return NULL;
 134                 if (crypto_bignum_is_zero(bn) ||
 135                     crypto_bignum_is_one(bn) ||
 136                     crypto_bignum_cmp(bn, sae->tmp->order) >= 0) {
 137                         crypto_bignum_deinit(bn, 0);
 138                         continue;
 139                 }
 140                 break;
 141         }
 142
 143         os_memset(val, 0, order_len);
 144         return bn;
 145 }
 146
 147
 148 static struct crypto_bignum * sae_get_rand_and_mask(struct sae_data *sae)
 149 {
 150         crypto_bignum_deinit(sae->tmp->sae_rand, 1);
 151         sae->tmp->sae_rand = sae_get_rand(sae);
 152         if (sae->tmp->sae_rand == NULL)
 153                 return NULL;
 154         return sae_get_rand(sae);
 155 }
 156
 157
 158 static void sae_pwd_seed_key(const u8 *addr1, const u8 *addr2, u8 *key)
 159 {
 160         wpa_printf(MSG_DEBUG, "SAE: PWE derivation - addr1=" MACSTR
 161                    " addr2=" MACSTR, MAC2STR(addr1), MAC2STR(addr2));
 162         if (os_memcmp(addr1, addr2, ETH_ALEN) > 0) {
 163                 os_memcpy(key, addr1, ETH_ALEN);
 164                 os_memcpy(key + ETH_ALEN, addr2, ETH_ALEN);
 165         } else {
 166                 os_memcpy(key, addr2, ETH_ALEN);
 167                 os_memcpy(key + ETH_ALEN, addr1, ETH_ALEN);
 168         }
 169 }
 170
 171
 172 static struct crypto_bignum *
 173 get_rand_1_to_p_1(const u8 *prime, size_t prime_len, size_t prime_bits,
 174                   int *r_odd)
 175 {
 176         for (;;) {
 177                 struct crypto_bignum *r;
 178                 u8 tmp[SAE_MAX_ECC_PRIME_LEN];
 179
 180                 if (random_get_bytes(tmp, prime_len) < 0)
 181                         break;
 182                 if (prime_bits % 8)
 183                         buf_shift_right(tmp, prime_len, 8 - prime_bits % 8);
 184                 if (os_memcmp(tmp, prime, prime_len) >= 0)
 185                         continue;
 186                 r = crypto_bignum_init_set(tmp, prime_len);
 187                 if (!r)
 188                         break;
 189                 if (crypto_bignum_is_zero(r)) {
 190                         crypto_bignum_deinit(r, 0);
 191                         continue;
 192                 }
 193
 194                 *r_odd = tmp[prime_len - 1] & 0x01;
 195                 return r;
 196         }
 197
 198         return NULL;
 199 }
 200
 201
 202 static int is_quadratic_residue_blind(struct sae_data *sae,
 203                                       const u8 *prime, size_t bits,
 204                                       const struct crypto_bignum *qr,
 205                                       const struct crypto_bignum *qnr,
 206                                       const struct crypto_bignum *y_sqr)
 207 {
 208         struct crypto_bignum *r, *num;
 209         int r_odd, check, res = -1;
 210
 211         /*
 212          * Use the blinding technique to mask y_sqr while determining
 213          * whether it is a quadratic residue modulo p to avoid leaking
 214          * timing information while determining the Legendre symbol.
 215          *
 216          * v = y_sqr
 217          * r = a random number between 1 and p-1, inclusive
 218          * num = (v * r * r) modulo p
 219          */
 220         r = get_rand_1_to_p_1(prime, sae->tmp->prime_len, bits, &r_odd);
 221         if (!r)
 222                 return -1;
 223
 224         num = crypto_bignum_init();
 225         if (!num ||
 226             crypto_bignum_mulmod(y_sqr, r, sae->tmp->prime, num) < 0 ||
 227             crypto_bignum_mulmod(num, r, sae->tmp->prime, num) < 0)
 228                 goto fail;
 229
 230         if (r_odd) {
 231                 /*
 232                  * num = (num * qr) module p
 233                  * LGR(num, p) = 1 ==> quadratic residue
 234                  */
 235                 if (crypto_bignum_mulmod(num, qr, sae->tmp->prime, num) < 0)
 236                         goto fail;
 237                 check = 1;
 238         } else {
 239                 /*
 240                  * num = (num * qnr) module p
 241                  * LGR(num, p) = -1 ==> quadratic residue
 242                  */
 243                 if (crypto_bignum_mulmod(num, qnr, sae->tmp->prime, num) < 0)
 244                         goto fail;
 245                 check = -1;
 246         }
 247
 248         res = crypto_bignum_legendre(num, sae->tmp->prime);
 249         if (res == -2) {
 250                 res = -1;
 251                 goto fail;
 252         }
 253         res = res == check;
 254 fail:
 255         crypto_bignum_deinit(num, 1);
 256         crypto_bignum_deinit(r, 1);
 257         return res;
 258 }
 259
 260
 261 static int sae_test_pwd_seed_ecc(struct sae_data *sae, const u8 *pwd_seed,
 262                                  const u8 *prime,
 263                                  const struct crypto_bignum *qr,
 264                                  const struct crypto_bignum *qnr,
 265                                  struct crypto_bignum **ret_x_cand)
 266 {
 267         u8 pwd_value[SAE_MAX_ECC_PRIME_LEN];
 268         struct crypto_bignum *y_sqr, *x_cand;
 269         int res;
 270         size_t bits;
 271
 272         *ret_x_cand = NULL;
 273
 274         wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-seed", pwd_seed, SHA256_MAC_LEN);
 275
 276         /* pwd-value = KDF-z(pwd-seed, "SAE Hunting and Pecking", p) */
 277         bits = crypto_ec_prime_len_bits(sae->tmp->ec);
 278         sha256_prf_bits(pwd_seed, SHA256_MAC_LEN, "SAE Hunting and Pecking",
 279                         prime, sae->tmp->prime_len, pwd_value, bits);
 280         if (bits % 8)
 281                 buf_shift_right(pwd_value, sizeof(pwd_value), 8 - bits % 8);
 282         wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value",
 283                         pwd_value, sae->tmp->prime_len);
 284
 285         if (os_memcmp(pwd_value, prime, sae->tmp->prime_len) >= 0)
 286                 return 0;
 287
 288         x_cand = crypto_bignum_init_set(pwd_value, sae->tmp->prime_len);
 289         if (!x_cand)
 290                 return -1;
 291         y_sqr = crypto_ec_point_compute_y_sqr(sae->tmp->ec, x_cand);
 292         if (!y_sqr) {
 293                 crypto_bignum_deinit(x_cand, 1);
 294                 return -1;
 295         }
 296
 297         res = is_quadratic_residue_blind(sae, prime, bits, qr, qnr, y_sqr);
 298         crypto_bignum_deinit(y_sqr, 1);
 299         if (res <= 0) {
 300                 crypto_bignum_deinit(x_cand, 1);
 301                 return res;
 302         }
 303
 304         *ret_x_cand = x_cand;
 305         return 1;
 306 }
 307
 308
 309 static int sae_test_pwd_seed_ffc(struct sae_data *sae, const u8 *pwd_seed,
 310                                  struct crypto_bignum *pwe)
 311 {
 312         u8 pwd_value[SAE_MAX_PRIME_LEN];
 313         size_t bits = sae->tmp->prime_len * 8;
 314         u8 exp[1];
 315         struct crypto_bignum *a, *b;
 316         int res;
 317
 318         wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-seed", pwd_seed, SHA256_MAC_LEN);
 319
 320         /* pwd-value = KDF-z(pwd-seed, "SAE Hunting and Pecking", p) */
 321         sha256_prf_bits(pwd_seed, SHA256_MAC_LEN, "SAE Hunting and Pecking",
 322                         sae->tmp->dh->prime, sae->tmp->prime_len, pwd_value,
 323                         bits);
 324         if (bits % 8)
 325                 buf_shift_right(pwd_value, sizeof(pwd_value), 8 - bits % 8);
 326         wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value", pwd_value,
 327                         sae->tmp->prime_len);
 328
 329         if (os_memcmp(pwd_value, sae->tmp->dh->prime, sae->tmp->prime_len) >= 0)
 330         {
 331                 wpa_printf(MSG_DEBUG, "SAE: pwd-value >= p");
 332                 return 0;
 333         }
 334
 335         /* PWE = pwd-value^((p-1)/r) modulo p */
 336
 337         a = crypto_bignum_init_set(pwd_value, sae->tmp->prime_len);
 338
 339         if (sae->tmp->dh->safe_prime) {
 340                 /*
 341                  * r = (p-1)/2 for the group used here, so this becomes:
 342                  * PWE = pwd-value^2 modulo p
 343                  */
 344                 exp[0] = 2;
 345                 b = crypto_bignum_init_set(exp, sizeof(exp));
 346         } else {
 347                 /* Calculate exponent: (p-1)/r */
 348                 exp[0] = 1;
 349                 b = crypto_bignum_init_set(exp, sizeof(exp));
 350                 if (b == NULL ||
 351                     crypto_bignum_sub(sae->tmp->prime, b, b) < 0 ||
 352                     crypto_bignum_div(b, sae->tmp->order, b) < 0) {
 353                         crypto_bignum_deinit(b, 0);
 354                         b = NULL;
 355                 }
 356         }
 357
 358         if (a == NULL || b == NULL)
 359                 res = -1;
 360         else
 361                 res = crypto_bignum_exptmod(a, b, sae->tmp->prime, pwe);
 362
 363         crypto_bignum_deinit(a, 0);
 364         crypto_bignum_deinit(b, 0);
 365
 366         if (res < 0) {
 367                 wpa_printf(MSG_DEBUG, "SAE: Failed to calculate PWE");
 368                 return -1;
 369         }
 370
 371         /* if (PWE > 1) --> found */
 372         if (crypto_bignum_is_zero(pwe) || crypto_bignum_is_one(pwe)) {
 373                 wpa_printf(MSG_DEBUG, "SAE: PWE <= 1");
 374                 return 0;
 375         }
 376
 377         wpa_printf(MSG_DEBUG, "SAE: PWE found");
 378         return 1;
 379 }
 380
 381
 382 static int get_random_qr_qnr(const u8 *prime, size_t prime_len,
 383                              const struct crypto_bignum *prime_bn,
 384                              size_t prime_bits, struct crypto_bignum **qr,
 385                              struct crypto_bignum **qnr)
 386 {
 387         *qr = NULL;
 388         *qnr = NULL;
 389
 390         while (!(*qr) || !(*qnr)) {
 391                 u8 tmp[SAE_MAX_ECC_PRIME_LEN];
 392                 struct crypto_bignum *q;
 393                 int res;
 394
 395                 if (random_get_bytes(tmp, prime_len) < 0)
 396                         break;
 397                 if (prime_bits % 8)
 398                         buf_shift_right(tmp, prime_len, 8 - prime_bits % 8);
 399                 if (os_memcmp(tmp, prime, prime_len) >= 0)
 400                         continue;
 401                 q = crypto_bignum_init_set(tmp, prime_len);
 402                 if (!q)
 403                         break;
 404                 res = crypto_bignum_legendre(q, prime_bn);
 405
 406                 if (res == 1 && !(*qr))
 407                         *qr = q;
 408                 else if (res == -1 && !(*qnr))
 409                         *qnr = q;
 410                 else
 411                         crypto_bignum_deinit(q, 0);
 412         }
 413
 414         return (*qr && *qnr) ? 0 : -1;
 415 }
 416
 417
 418 static int sae_derive_pwe_ecc(struct sae_data *sae, const u8 *addr1,
 419                               const u8 *addr2, const u8 *password,
 420                               size_t password_len)
 421 {
 422         u8 counter, k = 40;
 423         u8 addrs[2 * ETH_ALEN];
 424         const u8 *addr[2];
 425         size_t len[2];
 426         u8 dummy_password[32];
 427         size_t dummy_password_len;
 428         int pwd_seed_odd = 0;
 429         u8 prime[SAE_MAX_ECC_PRIME_LEN];
 430         size_t prime_len;
 431         struct crypto_bignum *x = NULL, *qr, *qnr;
 432         size_t bits;
 433         int res;
 434
 435         dummy_password_len = password_len;
 436         if (dummy_password_len > sizeof(dummy_password))
 437                 dummy_password_len = sizeof(dummy_password);
 438         if (random_get_bytes(dummy_password, dummy_password_len) < 0)
 439                 return -1;
 440
 441         prime_len = sae->tmp->prime_len;
 442         if (crypto_bignum_to_bin(sae->tmp->prime, prime, sizeof(prime),
 443                                  prime_len) < 0)
 444                 return -1;
 445         bits = crypto_ec_prime_len_bits(sae->tmp->ec);
 446
 447         /*
 448          * Create a random quadratic residue (qr) and quadratic non-residue
 449          * (qnr) modulo p for blinding purposes during the loop.
 450          */
 451         if (get_random_qr_qnr(prime, prime_len, sae->tmp->prime, bits,
 452                               &qr, &qnr) < 0)
 453                 return -1;
 454
 455         wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password",
 456                               password, password_len);
 457
 458         /*
 459          * H(salt, ikm) = HMAC-SHA256(salt, ikm)
 460          * base = password
 461          * pwd-seed = H(MAX(STA-A-MAC, STA-B-MAC) || MIN(STA-A-MAC, STA-B-MAC),
 462          *              base || counter)
 463          */
 464         sae_pwd_seed_key(addr1, addr2, addrs);
 465
 466         addr[0] = password;
 467         len[0] = password_len;
 468         addr[1] = &counter;
 469         len[1] = sizeof(counter);
 470
 471         /*
 472          * Continue for at least k iterations to protect against side-channel
 473          * attacks that attempt to determine the number of iterations required
 474          * in the loop.
 475          */
 476         for (counter = 1; counter <= k || !x; counter++) {
 477                 u8 pwd_seed[SHA256_MAC_LEN];
 478                 struct crypto_bignum *x_cand;
 479
 480                 if (counter > 200) {
 481                         /* This should not happen in practice */
 482                         wpa_printf(MSG_DEBUG, "SAE: Failed to derive PWE");
 483                         break;
 484                 }
 485
 486                 wpa_printf(MSG_DEBUG, "SAE: counter = %u", counter);
 487                 if (hmac_sha256_vector(addrs, sizeof(addrs), 2, addr, len,
 488                                        pwd_seed) < 0)
 489                         break;
 490
 491                 res = sae_test_pwd_seed_ecc(sae, pwd_seed,
 492                                             prime, qr, qnr, &x_cand);
 493                 if (res < 0)
 494                         goto fail;
 495                 if (res > 0 && !x) {
 496                         wpa_printf(MSG_DEBUG,
 497                                    "SAE: Selected pwd-seed with counter %u",
 498                                    counter);
 499                         x = x_cand;
 500                         pwd_seed_odd = pwd_seed[SHA256_MAC_LEN - 1] & 0x01;
 501                         os_memset(pwd_seed, 0, sizeof(pwd_seed));
 502
 503                         /*
 504                          * Use a dummy password for the following rounds, if
 505                          * any.
 506                          */
 507                         addr[0] = dummy_password;
 508                         len[0] = dummy_password_len;
 509                 } else if (res > 0) {
 510                         crypto_bignum_deinit(x_cand, 1);
 511                 }
 512         }
 513
 514         if (!x) {
 515                 wpa_printf(MSG_DEBUG, "SAE: Could not generate PWE");
 516                 res = -1;
 517                 goto fail;
 518         }
 519
 520         if (!sae->tmp->pwe_ecc)
 521                 sae->tmp->pwe_ecc = crypto_ec_point_init(sae->tmp->ec);
 522         if (!sae->tmp->pwe_ecc)
 523                 res = -1;
 524         else
 525                 res = crypto_ec_point_solve_y_coord(sae->tmp->ec,
 526                                                     sae->tmp->pwe_ecc, x,
 527                                                     pwd_seed_odd);
 528         crypto_bignum_deinit(x, 1);
 529         if (res < 0) {
 530                 /*
 531                  * This should not happen since we already checked that there
 532                  * is a result.
 533                  */
 534                 wpa_printf(MSG_DEBUG, "SAE: Could not solve y");
 535         }
 536
 537 fail:
 538         crypto_bignum_deinit(qr, 0);
 539         crypto_bignum_deinit(qnr, 0);
 540
 541         return res;
 542 }
 543
 544
 545 static int sae_derive_pwe_ffc(struct sae_data *sae, const u8 *addr1,
 546                               const u8 *addr2, const u8 *password,
 547                               size_t password_len)
 548 {
 549         u8 counter;
 550         u8 addrs[2 * ETH_ALEN];
 551         const u8 *addr[2];
 552         size_t len[2];
 553         int found = 0;
 554
 555         if (sae->tmp->pwe_ffc == NULL) {
 556                 sae->tmp->pwe_ffc = crypto_bignum_init();
 557                 if (sae->tmp->pwe_ffc == NULL)
 558                         return -1;
 559         }
 560
 561         wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password",
 562                               password, password_len);
 563
 564         /*
 565          * H(salt, ikm) = HMAC-SHA256(salt, ikm)
 566          * pwd-seed = H(MAX(STA-A-MAC, STA-B-MAC) || MIN(STA-A-MAC, STA-B-MAC),
 567          *              password || counter)
 568          */
 569         sae_pwd_seed_key(addr1, addr2, addrs);
 570
 571         addr[0] = password;
 572         len[0] = password_len;
 573         addr[1] = &counter;
 574         len[1] = sizeof(counter);
 575
 576         for (counter = 1; !found; counter++) {
 577                 u8 pwd_seed[SHA256_MAC_LEN];
 578                 int res;
 579
 580                 if (counter > 200) {
 581                         /* This should not happen in practice */
 582                         wpa_printf(MSG_DEBUG, "SAE: Failed to derive PWE");
 583                         break;
 584                 }
 585
 586                 wpa_printf(MSG_DEBUG, "SAE: counter = %u", counter);
 587                 if (hmac_sha256_vector(addrs, sizeof(addrs), 2, addr, len,
 588                                        pwd_seed) < 0)
 589                         break;
 590                 res = sae_test_pwd_seed_ffc(sae, pwd_seed, sae->tmp->pwe_ffc);
 591                 if (res < 0)
 592                         break;
 593                 if (res > 0) {
 594                         wpa_printf(MSG_DEBUG, "SAE: Use this PWE");
 595                         found = 1;
 596                 }
 597         }
 598
 599         return found ? 0 : -1;
 600 }
 601
 602
 603 static int sae_derive_commit_element_ecc(struct sae_data *sae,
 604                                          struct crypto_bignum *mask)
 605 {
 606         /* COMMIT-ELEMENT = inverse(scalar-op(mask, PWE)) */
 607         if (!sae->tmp->own_commit_element_ecc) {
 608                 sae->tmp->own_commit_element_ecc =
 609                         crypto_ec_point_init(sae->tmp->ec);
 610                 if (!sae->tmp->own_commit_element_ecc)
 611                         return -1;
 612         }
 613
 614         if (crypto_ec_point_mul(sae->tmp->ec, sae->tmp->pwe_ecc, mask,
 615                                 sae->tmp->own_commit_element_ecc) < 0 ||
 616             crypto_ec_point_invert(sae->tmp->ec,
 617                                    sae->tmp->own_commit_element_ecc) < 0) {
 618                 wpa_printf(MSG_DEBUG, "SAE: Could not compute commit-element");
 619                 return -1;
 620         }
 621
 622         return 0;
 623 }
 624
 625
 626 static int sae_derive_commit_element_ffc(struct sae_data *sae,
 627                                          struct crypto_bignum *mask)
 628 {
 629         /* COMMIT-ELEMENT = inverse(scalar-op(mask, PWE)) */
 630         if (!sae->tmp->own_commit_element_ffc) {
 631                 sae->tmp->own_commit_element_ffc = crypto_bignum_init();
 632                 if (!sae->tmp->own_commit_element_ffc)
 633                         return -1;
 634         }
 635
 636         if (crypto_bignum_exptmod(sae->tmp->pwe_ffc, mask, sae->tmp->prime,
 637                                   sae->tmp->own_commit_element_ffc) < 0 ||
 638             crypto_bignum_inverse(sae->tmp->own_commit_element_ffc,
 639                                   sae->tmp->prime,
 640                                   sae->tmp->own_commit_element_ffc) < 0) {
 641                 wpa_printf(MSG_DEBUG, "SAE: Could not compute commit-element");
 642                 return -1;
 643         }
 644
 645         return 0;
 646 }
 647
 648
 649 static int sae_derive_commit(struct sae_data *sae)
 650 {
 651         struct crypto_bignum *mask;
 652         int ret = -1;
 653         unsigned int counter = 0;
 654
 655         do {
 656                 counter++;
 657                 if (counter > 100) {
 658                         /*
 659                          * This cannot really happen in practice if the random
 660                          * number generator is working. Anyway, to avoid even a
 661                          * theoretical infinite loop, break out after 100
 662                          * attemps.
 663                          */
 664                         return -1;
 665                 }
 666
 667                 mask = sae_get_rand_and_mask(sae);
 668                 if (mask == NULL) {
 669                         wpa_printf(MSG_DEBUG, "SAE: Could not get rand/mask");
 670                         return -1;
 671                 }
 672
 673                 /* commit-scalar = (rand + mask) modulo r */
 674                 if (!sae->tmp->own_commit_scalar) {
 675                         sae->tmp->own_commit_scalar = crypto_bignum_init();
 676                         if (!sae->tmp->own_commit_scalar)
 677                                 goto fail;
 678                 }
 679                 crypto_bignum_add(sae->tmp->sae_rand, mask,
 680                                   sae->tmp->own_commit_scalar);
 681                 crypto_bignum_mod(sae->tmp->own_commit_scalar, sae->tmp->order,
 682                                   sae->tmp->own_commit_scalar);
 683         } while (crypto_bignum_is_zero(sae->tmp->own_commit_scalar) ||
 684                  crypto_bignum_is_one(sae->tmp->own_commit_scalar));
 685
 686         if ((sae->tmp->ec && sae_derive_commit_element_ecc(sae, mask) < 0) ||
 687             (sae->tmp->dh && sae_derive_commit_element_ffc(sae, mask) < 0))
 688                 goto fail;
 689
 690         ret = 0;
 691 fail:
 692         crypto_bignum_deinit(mask, 1);
 693         return ret;
 694 }
 695
 696
 697 int sae_prepare_commit(const u8 *addr1, const u8 *addr2,
 698                        const u8 *password, size_t password_len,
 699                        struct sae_data *sae)
 700 {
 701         if (sae->tmp == NULL ||
 702             (sae->tmp->ec && sae_derive_pwe_ecc(sae, addr1, addr2, password,
 703                                                 password_len) < 0) ||
 704             (sae->tmp->dh && sae_derive_pwe_ffc(sae, addr1, addr2, password,
 705                                                 password_len) < 0) ||
 706             sae_derive_commit(sae) < 0)
 707                 return -1;
 708         return 0;
 709 }
 710
 711
 712 static int sae_derive_k_ecc(struct sae_data *sae, u8 *k)
 713 {
 714         struct crypto_ec_point *K;
 715         int ret = -1;
 716
 717         K = crypto_ec_point_init(sae->tmp->ec);
 718         if (K == NULL)
 719                 goto fail;
 720
 721         /*
 722          * K = scalar-op(rand, (elem-op(scalar-op(peer-commit-scalar, PWE),
 723          *                                        PEER-COMMIT-ELEMENT)))
 724          * If K is identity element (point-at-infinity), reject
 725          * k = F(K) (= x coordinate)
 726          */
 727
 728         if (crypto_ec_point_mul(sae->tmp->ec, sae->tmp->pwe_ecc,
 729                                 sae->peer_commit_scalar, K) < 0 ||
 730             crypto_ec_point_add(sae->tmp->ec, K,
 731                                 sae->tmp->peer_commit_element_ecc, K) < 0 ||
 732             crypto_ec_point_mul(sae->tmp->ec, K, sae->tmp->sae_rand, K) < 0 ||
 733             crypto_ec_point_is_at_infinity(sae->tmp->ec, K) ||
 734             crypto_ec_point_to_bin(sae->tmp->ec, K, k, NULL) < 0) {
 735                 wpa_printf(MSG_DEBUG, "SAE: Failed to calculate K and k");
 736                 goto fail;
 737         }
 738
 739         wpa_hexdump_key(MSG_DEBUG, "SAE: k", k, sae->tmp->prime_len);
 740
 741         ret = 0;
 742 fail:
 743         crypto_ec_point_deinit(K, 1);
 744         return ret;
 745 }
 746
 747
 748 static int sae_derive_k_ffc(struct sae_data *sae, u8 *k)
 749 {
 750         struct crypto_bignum *K;
 751         int ret = -1;
 752
 753         K = crypto_bignum_init();
 754         if (K == NULL)
 755                 goto fail;
 756
 757         /*
 758          * K = scalar-op(rand, (elem-op(scalar-op(peer-commit-scalar, PWE),
 759          *                                        PEER-COMMIT-ELEMENT)))
 760          * If K is identity element (one), reject.
 761          * k = F(K) (= x coordinate)
 762          */
 763
 764         if (crypto_bignum_exptmod(sae->tmp->pwe_ffc, sae->peer_commit_scalar,
 765                                   sae->tmp->prime, K) < 0 ||
 766             crypto_bignum_mulmod(K, sae->tmp->peer_commit_element_ffc,
 767                                  sae->tmp->prime, K) < 0 ||
 768             crypto_bignum_exptmod(K, sae->tmp->sae_rand, sae->tmp->prime, K) < 0
 769             ||
 770             crypto_bignum_is_one(K) ||
 771             crypto_bignum_to_bin(K, k, SAE_MAX_PRIME_LEN, sae->tmp->prime_len) <
 772             0) {
 773                 wpa_printf(MSG_DEBUG, "SAE: Failed to calculate K and k");
 774                 goto fail;
 775         }
 776
 777         wpa_hexdump_key(MSG_DEBUG, "SAE: k", k, sae->tmp->prime_len);
 778
 779         ret = 0;
 780 fail:
 781         crypto_bignum_deinit(K, 1);
 782         return ret;
 783 }
 784
 785
 786 static int sae_derive_keys(struct sae_data *sae, const u8 *k)
 787 {
 788         u8 null_key[SAE_KEYSEED_KEY_LEN], val[SAE_MAX_PRIME_LEN];
 789         u8 keyseed[SHA256_MAC_LEN];
 790         u8 keys[SAE_KCK_LEN + SAE_PMK_LEN];
 791         struct crypto_bignum *tmp;
 792         int ret = -1;
 793
 794         tmp = crypto_bignum_init();
 795         if (tmp == NULL)
 796                 goto fail;
 797
 798         /* keyseed = H(<0>32, k)
 799          * KCK || PMK = KDF-512(keyseed, "SAE KCK and PMK",
 800          *                      (commit-scalar + peer-commit-scalar) modulo r)
 801          * PMKID = L((commit-scalar + peer-commit-scalar) modulo r, 0, 128)
 802          */
 803
 804         os_memset(null_key, 0, sizeof(null_key));
 805         hmac_sha256(null_key, sizeof(null_key), k, sae->tmp->prime_len,
 806                     keyseed);
 807         wpa_hexdump_key(MSG_DEBUG, "SAE: keyseed", keyseed, sizeof(keyseed));
 808
 809         crypto_bignum_add(sae->tmp->own_commit_scalar, sae->peer_commit_scalar,
 810                           tmp);
 811         crypto_bignum_mod(tmp, sae->tmp->order, tmp);
 812         crypto_bignum_to_bin(tmp, val, sizeof(val), sae->tmp->prime_len);
 813         wpa_hexdump(MSG_DEBUG, "SAE: PMKID", val, SAE_PMKID_LEN);
 814         sha256_prf(keyseed, sizeof(keyseed), "SAE KCK and PMK",
 815                    val, sae->tmp->prime_len, keys, sizeof(keys));
 816         os_memset(keyseed, 0, sizeof(keyseed));
 817         os_memcpy(sae->tmp->kck, keys, SAE_KCK_LEN);
 818         os_memcpy(sae->pmk, keys + SAE_KCK_LEN, SAE_PMK_LEN);
 819         os_memset(keys, 0, sizeof(keys));
 820         wpa_hexdump_key(MSG_DEBUG, "SAE: KCK", sae->tmp->kck, SAE_KCK_LEN);
 821         wpa_hexdump_key(MSG_DEBUG, "SAE: PMK", sae->pmk, SAE_PMK_LEN);
 822
 823         ret = 0;
 824 fail:
 825         crypto_bignum_deinit(tmp, 0);
 826         return ret;
 827 }
 828
 829
 830 int sae_process_commit(struct sae_data *sae)
 831 {
 832         u8 k[SAE_MAX_PRIME_LEN];
 833         if (sae->tmp == NULL ||
 834             (sae->tmp->ec && sae_derive_k_ecc(sae, k) < 0) ||
 835             (sae->tmp->dh && sae_derive_k_ffc(sae, k) < 0) ||
 836             sae_derive_keys(sae, k) < 0)
 837                 return -1;
 838         return 0;
 839 }
 840
 841
 842 void sae_write_commit(struct sae_data *sae, struct wpabuf *buf,
 843                       const struct wpabuf *token)
 844 {
 845         u8 *pos;
 846
 847         if (sae->tmp == NULL)
 848                 return;
 849
 850         wpabuf_put_le16(buf, sae->group); /* Finite Cyclic Group */
 851         if (token) {
 852                 wpabuf_put_buf(buf, token);
 853                 wpa_hexdump(MSG_DEBUG, "SAE: Anti-clogging token",
 854                             wpabuf_head(token), wpabuf_len(token));
 855         }
 856         pos = wpabuf_put(buf, sae->tmp->prime_len);
 857         crypto_bignum_to_bin(sae->tmp->own_commit_scalar, pos,
 858                              sae->tmp->prime_len, sae->tmp->prime_len);
 859         wpa_hexdump(MSG_DEBUG, "SAE: own commit-scalar",
 860                     pos, sae->tmp->prime_len);
 861         if (sae->tmp->ec) {
 862                 pos = wpabuf_put(buf, 2 * sae->tmp->prime_len);
 863                 crypto_ec_point_to_bin(sae->tmp->ec,
 864                                        sae->tmp->own_commit_element_ecc,
 865                                        pos, pos + sae->tmp->prime_len);
 866                 wpa_hexdump(MSG_DEBUG, "SAE: own commit-element(x)",
 867                             pos, sae->tmp->prime_len);
 868                 wpa_hexdump(MSG_DEBUG, "SAE: own commit-element(y)",
 869                             pos + sae->tmp->prime_len, sae->tmp->prime_len);
 870         } else {
 871                 pos = wpabuf_put(buf, sae->tmp->prime_len);
 872                 crypto_bignum_to_bin(sae->tmp->own_commit_element_ffc, pos,
 873                                      sae->tmp->prime_len, sae->tmp->prime_len);
 874                 wpa_hexdump(MSG_DEBUG, "SAE: own commit-element",
 875                             pos, sae->tmp->prime_len);
 876         }
 877 }
 878
 879
 880 u16 sae_group_allowed(struct sae_data *sae, int *allowed_groups, u16 group)
 881 {
 882         if (allowed_groups) {
 883                 int i;
 884                 for (i = 0; allowed_groups[i] > 0; i++) {
 885                         if (allowed_groups[i] == group)
 886                                 break;
 887                 }
 888                 if (allowed_groups[i] != group) {
 889                         wpa_printf(MSG_DEBUG, "SAE: Proposed group %u not "
 890                                    "enabled in the current configuration",
 891                                    group);
 892                         return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
 893                 }
 894         }
 895
 896         if (sae->state == SAE_COMMITTED && group != sae->group) {
 897                 wpa_printf(MSG_DEBUG, "SAE: Do not allow group to be changed");
 898                 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
 899         }
 900
 901         if (group != sae->group && sae_set_group(sae, group) < 0) {
 902                 wpa_printf(MSG_DEBUG, "SAE: Unsupported Finite Cyclic Group %u",
 903                            group);
 904                 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
 905         }
 906
 907         if (sae->tmp == NULL) {
 908                 wpa_printf(MSG_DEBUG, "SAE: Group information not yet initialized");
 909                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 910         }
 911
 912         if (sae->tmp->dh && !allowed_groups) {
 913                 wpa_printf(MSG_DEBUG, "SAE: Do not allow FFC group %u without "
 914                            "explicit configuration enabling it", group);
 915                 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
 916         }
 917
 918         return WLAN_STATUS_SUCCESS;
 919 }
 920
 921
 922 static void sae_parse_commit_token(struct sae_data *sae, const u8 **pos,
 923                                    const u8 *end, const u8 **token,
 924                                    size_t *token_len)
 925 {
 926         if (*pos + (sae->tmp->ec ? 3 : 2) * sae->tmp->prime_len < end) {
 927                 size_t tlen = end - (*pos + (sae->tmp->ec ? 3 : 2) *
 928                                      sae->tmp->prime_len);
 929                 wpa_hexdump(MSG_DEBUG, "SAE: Anti-Clogging Token", *pos, tlen);
 930                 if (token)
 931                         *token = *pos;
 932                 if (token_len)
 933                         *token_len = tlen;
 934                 *pos += tlen;
 935         } else {
 936                 if (token)
 937                         *token = NULL;
 938                 if (token_len)
 939                         *token_len = 0;
 940         }
 941 }
 942
 943
 944 static u16 sae_parse_commit_scalar(struct sae_data *sae, const u8 **pos,
 945                                    const u8 *end)
 946 {
 947         struct crypto_bignum *peer_scalar;
 948
 949         if (*pos + sae->tmp->prime_len > end) {
 950                 wpa_printf(MSG_DEBUG, "SAE: Not enough data for scalar");
 951                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 952         }
 953
 954         peer_scalar = crypto_bignum_init_set(*pos, sae->tmp->prime_len);
 955         if (peer_scalar == NULL)
 956                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 957
 958         /*
 959          * IEEE Std 802.11-2012, 11.3.8.6.1: If there is a protocol instance for
 960          * the peer and it is in Authenticated state, the new Commit Message
 961          * shall be dropped if the peer-scalar is identical to the one used in
 962          * the existing protocol instance.
 963          */
 964         if (sae->state == SAE_ACCEPTED && sae->peer_commit_scalar &&
 965             crypto_bignum_cmp(sae->peer_commit_scalar, peer_scalar) == 0) {
 966                 wpa_printf(MSG_DEBUG, "SAE: Do not accept re-use of previous "
 967                            "peer-commit-scalar");
 968                 crypto_bignum_deinit(peer_scalar, 0);
 969                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 970         }
 971
 972         /* 1 < scalar < r */
 973         if (crypto_bignum_is_zero(peer_scalar) ||
 974             crypto_bignum_is_one(peer_scalar) ||
 975             crypto_bignum_cmp(peer_scalar, sae->tmp->order) >= 0) {
 976                 wpa_printf(MSG_DEBUG, "SAE: Invalid peer scalar");
 977                 crypto_bignum_deinit(peer_scalar, 0);
 978                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 979         }
 980
 981
 982         crypto_bignum_deinit(sae->peer_commit_scalar, 0);
 983         sae->peer_commit_scalar = peer_scalar;
 984         wpa_hexdump(MSG_DEBUG, "SAE: Peer commit-scalar",
 985                     *pos, sae->tmp->prime_len);
 986         *pos += sae->tmp->prime_len;
 987
 988         return WLAN_STATUS_SUCCESS;
 989 }
 990
 991
 992 static u16 sae_parse_commit_element_ecc(struct sae_data *sae, const u8 *pos,
 993                                         const u8 *end)
 994 {
 995         u8 prime[SAE_MAX_ECC_PRIME_LEN];
 996
 997         if (pos + 2 * sae->tmp->prime_len > end) {
 998                 wpa_printf(MSG_DEBUG, "SAE: Not enough data for "
 999                            "commit-element");
1000                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1001         }
1002
1003         if (crypto_bignum_to_bin(sae->tmp->prime, prime, sizeof(prime),
1004                                  sae->tmp->prime_len) < 0)
1005                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1006
1007         /* element x and y coordinates < p */
1008         if (os_memcmp(pos, prime, sae->tmp->prime_len) >= 0 ||
1009             os_memcmp(pos + sae->tmp->prime_len, prime,
1010                       sae->tmp->prime_len) >= 0) {
1011                 wpa_printf(MSG_DEBUG, "SAE: Invalid coordinates in peer "
1012                            "element");
1013                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1014         }
1015
1016         wpa_hexdump(MSG_DEBUG, "SAE: Peer commit-element(x)",
1017                     pos, sae->tmp->prime_len);
1018         wpa_hexdump(MSG_DEBUG, "SAE: Peer commit-element(y)",
1019                     pos + sae->tmp->prime_len, sae->tmp->prime_len);
1020
1021         crypto_ec_point_deinit(sae->tmp->peer_commit_element_ecc, 0);
1022         sae->tmp->peer_commit_element_ecc =
1023                 crypto_ec_point_from_bin(sae->tmp->ec, pos);
1024         if (sae->tmp->peer_commit_element_ecc == NULL)
1025                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1026
1027         if (!crypto_ec_point_is_on_curve(sae->tmp->ec,
1028                                          sae->tmp->peer_commit_element_ecc)) {
1029                 wpa_printf(MSG_DEBUG, "SAE: Peer element is not on curve");
1030                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1031         }
1032
1033         return WLAN_STATUS_SUCCESS;
1034 }
1035
1036
1037 static u16 sae_parse_commit_element_ffc(struct sae_data *sae, const u8 *pos,
1038                                         const u8 *end)
1039 {
1040         struct crypto_bignum *res, *one;
1041         const u8 one_bin[1] = { 0x01 };
1042
1043         if (pos + sae->tmp->prime_len > end) {
1044                 wpa_printf(MSG_DEBUG, "SAE: Not enough data for "
1045                            "commit-element");
1046                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1047         }
1048         wpa_hexdump(MSG_DEBUG, "SAE: Peer commit-element", pos,
1049                     sae->tmp->prime_len);
1050
1051         crypto_bignum_deinit(sae->tmp->peer_commit_element_ffc, 0);
1052         sae->tmp->peer_commit_element_ffc =
1053                 crypto_bignum_init_set(pos, sae->tmp->prime_len);
1054         if (sae->tmp->peer_commit_element_ffc == NULL)
1055                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1056         /* 1 < element < p - 1 */
1057         res = crypto_bignum_init();
1058         one = crypto_bignum_init_set(one_bin, sizeof(one_bin));
1059         if (!res || !one ||
1060             crypto_bignum_sub(sae->tmp->prime, one, res) ||
1061             crypto_bignum_is_zero(sae->tmp->peer_commit_element_ffc) ||
1062             crypto_bignum_is_one(sae->tmp->peer_commit_element_ffc) ||
1063             crypto_bignum_cmp(sae->tmp->peer_commit_element_ffc, res) >= 0) {
1064                 crypto_bignum_deinit(res, 0);
1065                 crypto_bignum_deinit(one, 0);
1066                 wpa_printf(MSG_DEBUG, "SAE: Invalid peer element");
1067                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1068         }
1069         crypto_bignum_deinit(one, 0);
1070
1071         /* scalar-op(r, ELEMENT) = 1 modulo p */
1072         if (crypto_bignum_exptmod(sae->tmp->peer_commit_element_ffc,
1073                                   sae->tmp->order, sae->tmp->prime, res) < 0 ||
1074             !crypto_bignum_is_one(res)) {
1075                 wpa_printf(MSG_DEBUG, "SAE: Invalid peer element (scalar-op)");
1076                 crypto_bignum_deinit(res, 0);
1077                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1078         }
1079         crypto_bignum_deinit(res, 0);
1080
1081         return WLAN_STATUS_SUCCESS;
1082 }
1083
1084
1085 static u16 sae_parse_commit_element(struct sae_data *sae, const u8 *pos,
1086                                     const u8 *end)
1087 {
1088         if (sae->tmp->dh)
1089                 return sae_parse_commit_element_ffc(sae, pos, end);
1090         return sae_parse_commit_element_ecc(sae, pos, end);
1091 }
1092
1093
1094 u16 sae_parse_commit(struct sae_data *sae, const u8 *data, size_t len,
1095                      const u8 **token, size_t *token_len, int *allowed_groups)
1096 {
1097         const u8 *pos = data, *end = data + len;
1098         u16 res;
1099
1100         /* Check Finite Cyclic Group */
1101         if (pos + 2 > end)
1102                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1103         res = sae_group_allowed(sae, allowed_groups, WPA_GET_LE16(pos));
1104         if (res != WLAN_STATUS_SUCCESS)
1105                 return res;
1106         pos += 2;
1107
1108         /* Optional Anti-Clogging Token */
1109         sae_parse_commit_token(sae, &pos, end, token, token_len);
1110
1111         /* commit-scalar */
1112         res = sae_parse_commit_scalar(sae, &pos, end);
1113         if (res != WLAN_STATUS_SUCCESS)
1114                 return res;
1115
1116         /* commit-element */
1117         res = sae_parse_commit_element(sae, pos, end);
1118         if (res != WLAN_STATUS_SUCCESS)
1119                 return res;
1120
1121         /*
1122          * Check whether peer-commit-scalar and PEER-COMMIT-ELEMENT are same as
1123          * the values we sent which would be evidence of a reflection attack.
1124          */
1125         if (!sae->tmp->own_commit_scalar ||
1126             crypto_bignum_cmp(sae->tmp->own_commit_scalar,
1127                               sae->peer_commit_scalar) != 0 ||
1128             (sae->tmp->dh &&
1129              (!sae->tmp->own_commit_element_ffc ||
1130               crypto_bignum_cmp(sae->tmp->own_commit_element_ffc,
1131                                 sae->tmp->peer_commit_element_ffc) != 0)) ||
1132             (sae->tmp->ec &&
1133              (!sae->tmp->own_commit_element_ecc ||
1134               crypto_ec_point_cmp(sae->tmp->ec,
1135                                   sae->tmp->own_commit_element_ecc,
1136                                   sae->tmp->peer_commit_element_ecc) != 0)))
1137                 return WLAN_STATUS_SUCCESS; /* scalars/elements are different */
1138
1139         /*
1140          * This is a reflection attack - return special value to trigger caller
1141          * to silently discard the frame instead of replying with a specific
1142          * status code.
1143          */
1144         return SAE_SILENTLY_DISCARD;
1145 }
1146
1147
1148 static void sae_cn_confirm(struct sae_data *sae, const u8 *sc,
1149                            const struct crypto_bignum *scalar1,
1150                            const u8 *element1, size_t element1_len,
1151                            const struct crypto_bignum *scalar2,
1152                            const u8 *element2, size_t element2_len,
1153                            u8 *confirm)
1154 {
1155         const u8 *addr[5];
1156         size_t len[5];
1157         u8 scalar_b1[SAE_MAX_PRIME_LEN], scalar_b2[SAE_MAX_PRIME_LEN];
1158
1159         /* Confirm
1160          * CN(key, X, Y, Z, ...) =
1161          *    HMAC-SHA256(key, D2OS(X) || D2OS(Y) || D2OS(Z) | ...)
1162          * confirm = CN(KCK, send-confirm, commit-scalar, COMMIT-ELEMENT,
1163          *              peer-commit-scalar, PEER-COMMIT-ELEMENT)
1164          * verifier = CN(KCK, peer-send-confirm, peer-commit-scalar,
1165          *               PEER-COMMIT-ELEMENT, commit-scalar, COMMIT-ELEMENT)
1166          */
1167         addr[0] = sc;
1168         len[0] = 2;
1169         crypto_bignum_to_bin(scalar1, scalar_b1, sizeof(scalar_b1),
1170                              sae->tmp->prime_len);
1171         addr[1] = scalar_b1;
1172         len[1] = sae->tmp->prime_len;
1173         addr[2] = element1;
1174         len[2] = element1_len;
1175         crypto_bignum_to_bin(scalar2, scalar_b2, sizeof(scalar_b2),
1176                              sae->tmp->prime_len);
1177         addr[3] = scalar_b2;
1178         len[3] = sae->tmp->prime_len;
1179         addr[4] = element2;
1180         len[4] = element2_len;
1181         hmac_sha256_vector(sae->tmp->kck, sizeof(sae->tmp->kck), 5, addr, len,
1182                            confirm);
1183 }
1184
1185
1186 static void sae_cn_confirm_ecc(struct sae_data *sae, const u8 *sc,
1187                                const struct crypto_bignum *scalar1,
1188                                const struct crypto_ec_point *element1,
1189                                const struct crypto_bignum *scalar2,
1190                                const struct crypto_ec_point *element2,
1191                                u8 *confirm)
1192 {
1193         u8 element_b1[2 * SAE_MAX_ECC_PRIME_LEN];
1194         u8 element_b2[2 * SAE_MAX_ECC_PRIME_LEN];
1195
1196         crypto_ec_point_to_bin(sae->tmp->ec, element1, element_b1,
1197                                element_b1 + sae->tmp->prime_len);
1198         crypto_ec_point_to_bin(sae->tmp->ec, element2, element_b2,
1199                                element_b2 + sae->tmp->prime_len);
1200
1201         sae_cn_confirm(sae, sc, scalar1, element_b1, 2 * sae->tmp->prime_len,
1202                        scalar2, element_b2, 2 * sae->tmp->prime_len, confirm);
1203 }
1204
1205
1206 static void sae_cn_confirm_ffc(struct sae_data *sae, const u8 *sc,
1207                                const struct crypto_bignum *scalar1,
1208                                const struct crypto_bignum *element1,
1209                                const struct crypto_bignum *scalar2,
1210                                const struct crypto_bignum *element2,
1211                                u8 *confirm)
1212 {
1213         u8 element_b1[SAE_MAX_PRIME_LEN];
1214         u8 element_b2[SAE_MAX_PRIME_LEN];
1215
1216         crypto_bignum_to_bin(element1, element_b1, sizeof(element_b1),
1217                              sae->tmp->prime_len);
1218         crypto_bignum_to_bin(element2, element_b2, sizeof(element_b2),
1219                              sae->tmp->prime_len);
1220
1221         sae_cn_confirm(sae, sc, scalar1, element_b1, sae->tmp->prime_len,
1222                        scalar2, element_b2, sae->tmp->prime_len, confirm);
1223 }
1224
1225
1226 void sae_write_confirm(struct sae_data *sae, struct wpabuf *buf)
1227 {
1228         const u8 *sc;
1229
1230         if (sae->tmp == NULL)
1231                 return;
1232
1233         /* Send-Confirm */
1234         sc = wpabuf_put(buf, 0);
1235         wpabuf_put_le16(buf, sae->send_confirm);
1236         sae->send_confirm++;
1237
1238         if (sae->tmp->ec)
1239                 sae_cn_confirm_ecc(sae, sc, sae->tmp->own_commit_scalar,
1240                                    sae->tmp->own_commit_element_ecc,
1241                                    sae->peer_commit_scalar,
1242                                    sae->tmp->peer_commit_element_ecc,
1243                                    wpabuf_put(buf, SHA256_MAC_LEN));
1244         else
1245                 sae_cn_confirm_ffc(sae, sc, sae->tmp->own_commit_scalar,
1246                                    sae->tmp->own_commit_element_ffc,
1247                                    sae->peer_commit_scalar,
1248                                    sae->tmp->peer_commit_element_ffc,
1249                                    wpabuf_put(buf, SHA256_MAC_LEN));
1250 }
1251
1252
1253 int sae_check_confirm(struct sae_data *sae, const u8 *data, size_t len)
1254 {
1255         u8 verifier[SHA256_MAC_LEN];
1256
1257         if (len < 2 + SHA256_MAC_LEN) {
1258                 wpa_printf(MSG_DEBUG, "SAE: Too short confirm message");
1259                 return -1;
1260         }
1261
1262         wpa_printf(MSG_DEBUG, "SAE: peer-send-confirm %u", WPA_GET_LE16(data));
1263
1264         if (sae->tmp == NULL) {
1265                 wpa_printf(MSG_DEBUG, "SAE: Temporary data not yet available");
1266                 return -1;
1267         }
1268
1269         if (sae->tmp->ec)
1270                 sae_cn_confirm_ecc(sae, data, sae->peer_commit_scalar,
1271                                    sae->tmp->peer_commit_element_ecc,
1272                                    sae->tmp->own_commit_scalar,
1273                                    sae->tmp->own_commit_element_ecc,
1274                                    verifier);
1275         else
1276                 sae_cn_confirm_ffc(sae, data, sae->peer_commit_scalar,
1277                                    sae->tmp->peer_commit_element_ffc,
1278                                    sae->tmp->own_commit_scalar,
1279                                    sae->tmp->own_commit_element_ffc,
1280                                    verifier);
1281
1282         if (os_memcmp_const(verifier, data + 2, SHA256_MAC_LEN) != 0) {
1283                 wpa_printf(MSG_DEBUG, "SAE: Confirm mismatch");
1284                 wpa_hexdump(MSG_DEBUG, "SAE: Received confirm",
1285                             data + 2, SHA256_MAC_LEN);
1286                 wpa_hexdump(MSG_DEBUG, "SAE: Calculated verifier",
1287                             verifier, SHA256_MAC_LEN);
1288                 return -1;
1289         }
1290
1291         return 0;
1292 }