2 * EAP-FAST common helper functions (RFC 4851)
3 * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
12 #include "crypto/sha1.h"
13 #include "crypto/tls.h"
15 #include "eap_tlv_common.h"
16 #include "eap_fast_common.h"
19 void eap_fast_put_tlv_hdr(struct wpabuf *buf, u16 type, u16 len)
21 struct pac_tlv_hdr hdr;
22 hdr.type = host_to_be16(type);
23 hdr.len = host_to_be16(len);
24 wpabuf_put_data(buf, &hdr, sizeof(hdr));
28 void eap_fast_put_tlv(struct wpabuf *buf, u16 type, const void *data,
31 eap_fast_put_tlv_hdr(buf, type, len);
32 wpabuf_put_data(buf, data, len);
36 void eap_fast_put_tlv_buf(struct wpabuf *buf, u16 type,
37 const struct wpabuf *data)
39 eap_fast_put_tlv_hdr(buf, type, wpabuf_len(data));
40 wpabuf_put_buf(buf, data);
44 struct wpabuf * eap_fast_tlv_eap_payload(struct wpabuf *buf)
51 /* Encapsulate EAP packet in EAP-Payload TLV */
52 wpa_printf(MSG_DEBUG, "EAP-FAST: Add EAP-Payload TLV");
53 e = wpabuf_alloc(sizeof(struct pac_tlv_hdr) + wpabuf_len(buf));
55 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to allocate memory "
56 "for TLV encapsulation");
60 eap_fast_put_tlv_buf(e,
61 EAP_TLV_TYPE_MANDATORY | EAP_TLV_EAP_PAYLOAD_TLV,
68 void eap_fast_derive_master_secret(const u8 *pac_key, const u8 *server_random,
69 const u8 *client_random, u8 *master_secret)
71 #define TLS_RANDOM_LEN 32
72 #define TLS_MASTER_SECRET_LEN 48
73 u8 seed[2 * TLS_RANDOM_LEN];
75 wpa_hexdump(MSG_DEBUG, "EAP-FAST: client_random",
76 client_random, TLS_RANDOM_LEN);
77 wpa_hexdump(MSG_DEBUG, "EAP-FAST: server_random",
78 server_random, TLS_RANDOM_LEN);
81 * RFC 4851, Section 5.1:
82 * master_secret = T-PRF(PAC-Key, "PAC to master secret label hash",
83 * server_random + client_random, 48)
85 os_memcpy(seed, server_random, TLS_RANDOM_LEN);
86 os_memcpy(seed + TLS_RANDOM_LEN, client_random, TLS_RANDOM_LEN);
87 sha1_t_prf(pac_key, EAP_FAST_PAC_KEY_LEN,
88 "PAC to master secret label hash",
89 seed, sizeof(seed), master_secret, TLS_MASTER_SECRET_LEN);
91 wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: master_secret",
92 master_secret, TLS_MASTER_SECRET_LEN);
96 u8 * eap_fast_derive_key(void *ssl_ctx, struct tls_connection *conn, size_t len)
100 out = os_malloc(len);
104 if (tls_connection_get_eap_fast_key(ssl_ctx, conn, out, len)) {
113 int eap_fast_derive_eap_msk(const u8 *simck, u8 *msk)
116 * RFC 4851, Section 5.4: EAP Master Session Key Generation
117 * MSK = T-PRF(S-IMCK[j], "Session Key Generating Function", 64)
120 if (sha1_t_prf(simck, EAP_FAST_SIMCK_LEN,
121 "Session Key Generating Function", (u8 *) "", 0,
122 msk, EAP_FAST_KEY_LEN) < 0)
124 wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (MSK)",
125 msk, EAP_FAST_KEY_LEN);
130 int eap_fast_derive_eap_emsk(const u8 *simck, u8 *emsk)
133 * RFC 4851, Section 5.4: EAP Master Session Key Genreration
134 * EMSK = T-PRF(S-IMCK[j],
135 * "Extended Session Key Generating Function", 64)
138 if (sha1_t_prf(simck, EAP_FAST_SIMCK_LEN,
139 "Extended Session Key Generating Function", (u8 *) "", 0,
140 emsk, EAP_EMSK_LEN) < 0)
142 wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (EMSK)",
148 int eap_fast_parse_tlv(struct eap_fast_tlv_parse *tlv,
149 int tlv_type, u8 *pos, size_t len)
152 case EAP_TLV_EAP_PAYLOAD_TLV:
153 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: EAP-Payload TLV",
155 if (tlv->eap_payload_tlv) {
156 wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
157 "EAP-Payload TLV in the message");
158 tlv->iresult = EAP_TLV_RESULT_FAILURE;
161 tlv->eap_payload_tlv = pos;
162 tlv->eap_payload_tlv_len = len;
164 case EAP_TLV_RESULT_TLV:
165 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Result TLV", pos, len);
167 wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
168 "Result TLV in the message");
169 tlv->result = EAP_TLV_RESULT_FAILURE;
173 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
175 tlv->result = EAP_TLV_RESULT_FAILURE;
178 tlv->result = WPA_GET_BE16(pos);
179 if (tlv->result != EAP_TLV_RESULT_SUCCESS &&
180 tlv->result != EAP_TLV_RESULT_FAILURE) {
181 wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown Result %d",
183 tlv->result = EAP_TLV_RESULT_FAILURE;
185 wpa_printf(MSG_DEBUG, "EAP-FAST: Result: %s",
186 tlv->result == EAP_TLV_RESULT_SUCCESS ?
187 "Success" : "Failure");
189 case EAP_TLV_INTERMEDIATE_RESULT_TLV:
190 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Intermediate Result TLV",
193 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
194 "Intermediate-Result TLV");
195 tlv->iresult = EAP_TLV_RESULT_FAILURE;
199 wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
200 "Intermediate-Result TLV in the message");
201 tlv->iresult = EAP_TLV_RESULT_FAILURE;
204 tlv->iresult = WPA_GET_BE16(pos);
205 if (tlv->iresult != EAP_TLV_RESULT_SUCCESS &&
206 tlv->iresult != EAP_TLV_RESULT_FAILURE) {
207 wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown Intermediate "
208 "Result %d", tlv->iresult);
209 tlv->iresult = EAP_TLV_RESULT_FAILURE;
211 wpa_printf(MSG_DEBUG, "EAP-FAST: Intermediate Result: %s",
212 tlv->iresult == EAP_TLV_RESULT_SUCCESS ?
213 "Success" : "Failure");
215 case EAP_TLV_CRYPTO_BINDING_TLV:
216 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV",
218 if (tlv->crypto_binding) {
219 wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
220 "Crypto-Binding TLV in the message");
221 tlv->iresult = EAP_TLV_RESULT_FAILURE;
224 tlv->crypto_binding_len = sizeof(struct eap_tlv_hdr) + len;
225 if (tlv->crypto_binding_len < sizeof(*tlv->crypto_binding)) {
226 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
227 "Crypto-Binding TLV");
228 tlv->iresult = EAP_TLV_RESULT_FAILURE;
231 tlv->crypto_binding = (struct eap_tlv_crypto_binding_tlv *)
232 (pos - sizeof(struct eap_tlv_hdr));
234 case EAP_TLV_REQUEST_ACTION_TLV:
235 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Request-Action TLV",
237 if (tlv->request_action) {
238 wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
239 "Request-Action TLV in the message");
240 tlv->iresult = EAP_TLV_RESULT_FAILURE;
244 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
245 "Request-Action TLV");
246 tlv->iresult = EAP_TLV_RESULT_FAILURE;
249 tlv->request_action = WPA_GET_BE16(pos);
250 wpa_printf(MSG_DEBUG, "EAP-FAST: Request-Action: %d",
251 tlv->request_action);
253 case EAP_TLV_PAC_TLV:
254 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: PAC TLV", pos, len);
256 wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
257 "PAC TLV in the message");
258 tlv->iresult = EAP_TLV_RESULT_FAILURE;