source: mainline/uspace/lib/crypto/crypto.c@ a931b7b

lfn serial ticket/834-toolchain-update topic/msim-upgrade topic/simplify-dev-export
Last change on this file since a931b7b was a931b7b, checked in by Jan Kolarik <kolarik@…>, 11 years ago

Added TKIP support, handling old WPA in 4way handshake, some fixes in wifi_supplicant app
  • Property mode set to 100644
File size: 10.4 KB
Line 
1/*
2 * Copyright (c) 2015 Jan Kolarik
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * - Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * - Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * - The name of the author may not be used to endorse or promote products
15 * derived from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27 */
28
29/** @file crypto.c
30 *
31 * Cryptographic functions library.
32 */
33
34#include <unistd.h>
35#include <str.h>
36#include <macros.h>
37#include <errno.h>
38#include <byteorder.h>
39
40#include "crypto.h"
41
42/* Hash function procedure definition. */
43typedef void (*HASH_FUNC)(uint32_t*, uint32_t*);
44
45/* Length of HMAC block. */
46#define HMAC_BLOCK_LENGTH 64
47
48/* Ceiling for UINT32. */
49#define ceil_uint32(val) (((val) - (uint32_t)(val)) > 0 ? \
50 (uint32_t)((val) + 1) : (uint32_t)(val))
51
52/* Floor for UINT32. */
53#define floor_uint32(val) (((val) - (uint32_t)(val)) < 0 ? \
54 (uint32_t)((val) - 1) : (uint32_t)(val))
55
56/* Left rotation for UINT32. */
57#define rotl_uint32(val, shift) (((val) << shift) | ((val) >> (32 - shift)))
58
59/* Pick value at specified index from array or zero if out of bounds. */
60#define get_at(input, size, i) (i < size ? input[i] : 0)
61
62/* Init values used in SHA1 and MD5 functions. */
63static const uint32_t hash_init[] = {
64 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0
65};
66
67/* Shift amount array for MD5 algorithm. */
68static const uint32_t md5_shift[] = {
69 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22,
70 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20,
71 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23,
72 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21
73};
74
75/* Substitution box for MD5 algorithm. */
76static const uint32_t md5_sbox[] = {
77 0xd76aa478, 0xe8c7b756, 0x242070db, 0xc1bdceee,
78 0xf57c0faf, 0x4787c62a, 0xa8304613, 0xfd469501,
79 0x698098d8, 0x8b44f7af, 0xffff5bb1, 0x895cd7be,
80 0x6b901122, 0xfd987193, 0xa679438e, 0x49b40821,
81 0xf61e2562, 0xc040b340, 0x265e5a51, 0xe9b6c7aa,
82 0xd62f105d, 0x02441453, 0xd8a1e681, 0xe7d3fbc8,
83 0x21e1cde6, 0xc33707d6, 0xf4d50d87, 0x455a14ed,
84 0xa9e3e905, 0xfcefa3f8, 0x676f02d9, 0x8d2a4c8a,
85 0xfffa3942, 0x8771f681, 0x6d9d6122, 0xfde5380c,
86 0xa4beea44, 0x4bdecfa9, 0xf6bb4b60, 0xbebfbc70,
87 0x289b7ec6, 0xeaa127fa, 0xd4ef3085, 0x04881d05,
88 0xd9d4d039, 0xe6db99e5, 0x1fa27cf8, 0xc4ac5665,
89 0xf4292244, 0x432aff97, 0xab9423a7, 0xfc93a039,
90 0x655b59c3, 0x8f0ccc92, 0xffeff47d, 0x85845dd1,
91 0x6fa87e4f, 0xfe2ce6e0, 0xa3014314, 0x4e0811a1,
92 0xf7537e82, 0xbd3af235, 0x2ad7d2bb, 0xeb86d391
93};
94
95/**
96 * Working procedure of MD5 cryptographic hash function.
97 *
98 * @param h Working array with interim hash parts values.
99 * @param sched_arr Input array with scheduled values from input string.
100 */
101static void md5_proc(uint32_t *h, uint32_t *sched_arr)
102{
103 uint32_t f, g, temp;
104 uint32_t w[HASH_MD5/4];
105
106 memcpy(w, h, (HASH_MD5/4) * sizeof(uint32_t));
107
108 for(size_t k = 0; k < 64; k++) {
109 if(k < 16) {
110 f = (w[1] & w[2]) | (~w[1] & w[3]);
111 g = k;
112 } else if(k >= 16 && k < 32) {
113 f = (w[1] & w[3]) | (w[2] & ~w[3]);
114 g = (5*k + 1) % 16;
115 } else if(k >= 32 && k < 48) {
116 f = w[1] ^ w[2] ^ w[3];
117 g = (3*k + 5) % 16;
118 } else {
119 f = w[2] ^ (w[1] | ~w[3]);
120 g = 7*k % 16;
121 }
122 temp = w[3];
123 w[3] = w[2];
124 w[2] = w[1];
125 w[1] += rotl_uint32(w[0] + f + md5_sbox[k] +
126 uint32_t_byteorder_swap(sched_arr[g]),
127 md5_shift[k]);
128 w[0] = temp;
129 }
130
131 for(uint8_t k = 0; k < HASH_MD5/4; k++)
132 h[k] += w[k];
133}
134
135/**
136 * Working procedure of SHA-1 cryptographic hash function.
137 *
138 * @param h Working array with interim hash parts values.
139 * @param sched_arr Input array with scheduled values from input string.
140 */
141static void sha1_proc(uint32_t *h, uint32_t *sched_arr)
142{
143 uint32_t f, cf, temp;
144 uint32_t w[HASH_SHA1/4];
145
146 for(size_t k = 16; k < 80; k++) {
147 sched_arr[k] = rotl_uint32(
148 sched_arr[k-3] ^
149 sched_arr[k-8] ^
150 sched_arr[k-14] ^
151 sched_arr[k-16],
152 1);
153 }
154
155 memcpy(w, h, (HASH_SHA1/4) * sizeof(uint32_t));
156
157 for(size_t k = 0; k < 80; k++) {
158 if(k < 20) {
159 f = (w[1] & w[2]) | (~w[1] & w[3]);
160 cf = 0x5A827999;
161 } else if(k >= 20 && k < 40) {
162 f = w[1] ^ w[2] ^ w[3];
163 cf = 0x6ED9EBA1;
164 } else if(k >= 40 && k < 60) {
165 f = (w[1] & w[2]) | (w[1] & w[3]) | (w[2] & w[3]);
166 cf = 0x8F1BBCDC;
167 } else {
168 f = w[1] ^ w[2] ^ w[3];
169 cf = 0xCA62C1D6;
170 }
171
172 temp = rotl_uint32(w[0], 5) + f + w[4] + cf + sched_arr[k];
173
174 w[4] = w[3];
175 w[3] = w[2];
176 w[2] = rotl_uint32(w[1], 30);
177 w[1] = w[0];
178 w[0] = temp;
179 }
180
181 for(uint8_t k = 0; k < HASH_SHA1/4; k++)
182 h[k] += w[k];
183}
184
185/**
186 * Create hash based on selected algorithm.
187 *
188 * @param input Input message byte sequence.
189 * @param input_size Size of message sequence.
190 * @param output Result hash byte sequence.
191 * @param hash_sel Hash function selector.
192 *
193 * @return EINVAL when input not specified, ENOMEM when pointer for
194 * output hash result is not allocated, otherwise EOK.
195 */
196int create_hash(uint8_t *input, size_t input_size, uint8_t *output,
197 hash_func_t hash_sel)
198{
199 if(!input)
200 return EINVAL;
201
202 if(!output)
203 return ENOMEM;
204
205 HASH_FUNC hash_func = (hash_sel == HASH_MD5) ? md5_proc : sha1_proc;
206
207 /* Prepare scheduled input. */
208 uint8_t work_input[input_size + 1];
209 memcpy(work_input, input, input_size);
210 work_input[input_size] = 0x80;
211
212 size_t blocks = ceil_uint32((((double)input_size + 1) / 4 + 2) / 16);
213 uint32_t work_arr[blocks * 16];
214 for(size_t i = 0; i < blocks; i++) {
215 for(size_t j = 0; j < 16; j++) {
216 work_arr[i*16 + j] =
217 (get_at(work_input, input_size+1, i*64+j*4) << 24) |
218 (get_at(work_input, input_size+1, i*64+j*4+1) << 16) |
219 (get_at(work_input, input_size+1, i*64+j*4+2) << 8) |
220 get_at(work_input, input_size+1, i*64+j*4+3);
221 }
222 }
223
224 uint64_t bits_size = (uint64_t)(input_size * 8);
225 if(hash_sel == HASH_MD5)
226 bits_size = uint64_t_byteorder_swap(bits_size);
227
228 work_arr[(blocks - 1) * 16 + 14] = bits_size >> 32;
229 work_arr[(blocks - 1) * 16 + 15] = bits_size & 0xFFFFFFFF;
230
231 /* Hash computation. */
232 uint32_t h[hash_sel/4];
233 memcpy(h, hash_init, (hash_sel/4) * sizeof(uint32_t));
234 uint32_t sched_arr[80];
235 for(size_t i = 0; i < blocks; i++) {
236 for(size_t k = 0; k < 16; k++) {
237 sched_arr[k] = work_arr[i*16 + k];
238 }
239
240 hash_func(h, sched_arr);
241 }
242
243 /* Copy hash parts into final result. */
244 for(size_t i = 0; i < hash_sel/4; i++) {
245 if(hash_sel == HASH_SHA1)
246 h[i] = uint32_t_byteorder_swap(h[i]);
247 memcpy(output + i*sizeof(uint32_t), &h[i], sizeof(uint32_t));
248 }
249
250 return EOK;
251}
252
253/**
254 * Hash-based message authentication code.
255 *
256 * @param key Cryptographic key sequence.
257 * @param key_size Size of key sequence.
258 * @param msg Message sequence.
259 * @param msg_size Size of message sequence.
260 * @param hash Output parameter for result hash.
261 * @param hash_sel Hash function selector.
262 *
263 * @return EINVAL when key or message not specified, ENOMEM when pointer for
264 * output hash result is not allocated, otherwise EOK.
265 */
266int hmac(uint8_t *key, size_t key_size, uint8_t *msg, size_t msg_size,
267 uint8_t *hash, hash_func_t hash_sel)
268{
269 if(!key || !msg)
270 return EINVAL;
271
272 if(!hash)
273 return ENOMEM;
274
275 uint8_t work_key[HMAC_BLOCK_LENGTH];
276 uint8_t o_key_pad[HMAC_BLOCK_LENGTH];
277 uint8_t i_key_pad[HMAC_BLOCK_LENGTH];
278 uint8_t temp_hash[hash_sel];
279 memset(work_key, 0, HMAC_BLOCK_LENGTH);
280
281 if(key_size > HMAC_BLOCK_LENGTH) {
282 create_hash(key, key_size, work_key, hash_sel);
283 } else {
284 memcpy(work_key, key, key_size);
285 }
286
287 for(size_t i = 0; i < HMAC_BLOCK_LENGTH; i++) {
288 o_key_pad[i] = work_key[i] ^ 0x5C;
289 i_key_pad[i] = work_key[i] ^ 0x36;
290 }
291
292 uint8_t temp_work[HMAC_BLOCK_LENGTH + msg_size];
293 memcpy(temp_work, i_key_pad, HMAC_BLOCK_LENGTH);
294 memcpy(temp_work + HMAC_BLOCK_LENGTH, msg, msg_size);
295
296 create_hash(temp_work, HMAC_BLOCK_LENGTH + msg_size, temp_hash,
297 hash_sel);
298
299 memcpy(temp_work, o_key_pad, HMAC_BLOCK_LENGTH);
300 memcpy(temp_work + HMAC_BLOCK_LENGTH, temp_hash, hash_sel);
301
302 create_hash(temp_work, HMAC_BLOCK_LENGTH + hash_sel, hash, hash_sel);
303
304 return EOK;
305}
306
307/**
308 * Password-Based Key Derivation Function 2 as defined in RFC 2898,
309 * using HMAC-SHA1 with 4096 iterations and 32 bytes key result used
310 * for WPA/WPA2.
311 *
312 * @param pass Password sequence.
313 * @param pass_size Password sequence length.
314 * @param salt Salt sequence to be used with password.
315 * @param salt_size Salt sequence length.
316 * @param hash Output parameter for result hash (32 byte value).
317 *
318 * @return EINVAL when pass or salt not specified, ENOMEM when pointer for
319 * output hash result is not allocated, otherwise EOK.
320 */
321int pbkdf2(uint8_t *pass, size_t pass_size, uint8_t *salt, size_t salt_size,
322 uint8_t *hash)
323{
324 if(!pass || !salt)
325 return EINVAL;
326
327 if(!hash)
328 return ENOMEM;
329
330 uint8_t work_salt[salt_size + sizeof(uint32_t)];
331 memcpy(work_salt, salt, salt_size);
332 uint8_t work_hmac[HASH_SHA1];
333 uint8_t temp_hmac[HASH_SHA1];
334 uint8_t xor_hmac[HASH_SHA1];
335 uint8_t temp_hash[HASH_SHA1*2];
336
337 for(size_t i = 0; i < 2; i++) {
338 uint32_t big_i = host2uint32_t_be(i+1);
339 memcpy(work_salt + salt_size, &big_i, sizeof(uint32_t));
340 hmac(pass, pass_size, work_salt, salt_size + sizeof(uint32_t),
341 work_hmac, HASH_SHA1);
342 memcpy(xor_hmac, work_hmac, HASH_SHA1);
343 for(size_t k = 1; k < 4096; k++) {
344 memcpy(temp_hmac, work_hmac, HASH_SHA1);
345 hmac(pass, pass_size, temp_hmac, HASH_SHA1,
346 work_hmac, HASH_SHA1);
347 for(size_t t = 0; t < HASH_SHA1; t++) {
348 xor_hmac[t] ^= work_hmac[t];
349 }
350 }
351 memcpy(temp_hash + i*HASH_SHA1, xor_hmac, HASH_SHA1);
352 }
353
354 memcpy(hash, temp_hash, PBKDF2_KEY_LENGTH);
355
356 return EOK;
357}
Note: See TracBrowser for help on using the repository browser.