Add reauth function for EAP-AKA'

diff --git a/src/modules/rlm_eap/lib/sim/crypto.c b/src/modules/rlm_eap/lib/sim/crypto.c
index 6a6336e435d8ce62fada1326c14dc92e9974f07f..37612914386fd68232eed5595f07747bff6d59da 100644 (file)
--- a/src/modules/rlm_eap/lib/sim/crypto.c
+++ b/src/modules/rlm_eap/lib/sim/crypto.c
@@ -500,7 +500,7 @@ void fr_sim_crypto_keys_init_kdf_0_reauth(fr_sim_keys_t *keys,
 
 /** Re-Derive keys from the master key
  *
- * @note expects keys to contain a populated master_key.
+ * @note expects keys to contain a populated master_key, none_s and counter values.
  *
  * Derives new MSK, EMSK, k_aut, k_encr
  *
@@ -566,15 +566,13 @@ int fr_sim_crypto_kdf_0_reauth(fr_sim_keys_t *keys)
        memcpy(p, keys->identity, keys->identity_len);
        p += keys->identity_len;
        FR_PROTO_HEX_DUMP("identity", keys->identity, keys->identity_len);
-       FR_PROTO_HEX_DUMP("buff", buf, p - buf);
-
 
        /*
         *      Counter
         */
        *p++ = ((keys->reauth.counter & 0xff00) >> 8);
        *p++ = (keys->reauth.counter & 0x00ff);
-       FR_PROTO_HEX_DUMP("buff", buf, p - buf);
+
        /*
         *      nonce_s
         */
@@ -711,14 +709,14 @@ int fr_sim_crypto_kdf_0_umts(fr_sim_keys_t *keys)
  *
  * @note expects keys to contain a SIM_VECTOR_UMTS.
  *
- *     CK' || IK' = HMAC-SHA-256(Key, S)
- *     S = FC || P0 || L0 || P1 || L1 || ... || Pn || Ln
- *     Key = CK || IK
- *     FC = 0x20
- *     P0 = access network identity (3GPP TS 24.302)
- *     L0 = length of acceess network identity (2 octets, big endian)
- *     P1 = SQN xor AK (if AK is not used, AK is treated as 000..0
- *     L1 = 0x00 0x06
+ *  CK' || IK' = HMAC-SHA-256(Key, S)
+ *  S = FC || P0 || L0 || P1 || L1 || ... || Pn || Ln
+ *  Key = CK || IK
+ *  FC = 0x20
+ *  P0 = access network identity (3GPP TS 24.302)
+ *  L0 = length of acceess network identity (2 octets, big endian)
+ *  P1 = SQN xor AK (if AK is not used, AK is treated as 000..0
+ *  L1 = 0x00 0x06
  *
  * @param[in,out] keys         Contains the authentication vectors and the buffers
  *                             to store the result of the derivation.
@@ -880,6 +878,13 @@ static int fr_sim_crypto_aka_prime_prf(uint8_t *out, size_t outlen,
  *
  * @note expects keys to contain a SIM_VECTOR_UMTS.
  *
+ *  MK = PRF'(IK'|CK',"EAP-AKA'"|Identity)
+ *  K_encr = MK[0..127]
+ *  K_aut  = MK[128..383]
+ *  K_re   = MK[384..639]
+ *  MSK    = MK[640..1151]
+ *  EMSK   = MK[1152..1663]
+ *
  * @param[in,out] keys         Contains the authentication vectors and the buffers
  *                             to store the result of the derivation.
  * @return
@@ -892,7 +897,7 @@ int fr_sim_crypto_kdf_1_umts(fr_sim_keys_t *keys)
        uint8_t s[384];
        uint8_t *p = s;
 
-       uint8_t mk[1664];
+       uint8_t mk[208];
        size_t  s_len;
 
        fr_sim_crypto_derive_ck_ik_prime(keys);
@@ -944,10 +949,78 @@ int fr_sim_crypto_kdf_1_umts(fr_sim_keys_t *keys)
        memcpy(keys->k_re, p, 32);                              /* 256 bits for reauthentication key */
        p += 32;
 
-       memcpy(keys->msk, p, 64);                               /* 64 bytes for Master Session Key */
-       p += 64;
+       memcpy(keys->msk, p, sizeof(keys->msk));                /* 64 bytes for Master Session Key */
+       p += sizeof(keys->msk);
 
-       memcpy(keys->emsk, p, 64);                              /* 64 bytes for Extended Master Session Key */
+       memcpy(keys->emsk, p, sizeof(keys->emsk));              /* 64 bytes for Extended Master Session Key */
+
+       return 0;
+}
+
+/** Derive fast-reauthentication keys
+ *
+ *  MK = PRF'(K_re,"EAP-AKA' re-auth"|Identity|counter|NONCE_S)
+ *  MSK  = MK[0..511]
+ *  EMSK = MK[512..1023]
+ *
+ * @param[in,out] keys         Contains the authentication vectors and the buffers
+ *                             to store the result of the derivation.
+ * @return
+ *     - 0 on success.
+ *     - -1 on failure.
+ */
+int fr_sim_crypto_kdf_1_reauth(fr_sim_keys_t *keys)
+{
+       uint8_t s[384];
+       uint8_t *p = s;
+
+       uint8_t mk[128];
+       size_t  s_len;
+
+#define KDF_1_S_REAUTH_STATIC  "EAP-AKA' re-auth"
+
+       s_len = (sizeof(KDF_1_S_REAUTH_STATIC) - 1) + keys->identity_len + sizeof(uint16_t) + SIM_NONCE_S_SIZE;
+       if (s_len > sizeof(s)) {
+               fr_strerror_printf("Identity too long. PRF input is %zu bytes, input buffer is %zu bytes",
+                                  s_len, sizeof(s));
+               return -1;
+       }
+
+       memcpy(p, KDF_1_S_STATIC, sizeof(KDF_1_S_STATIC) - 1);
+       p += sizeof(KDF_1_S_STATIC) - 1;
+
+       memcpy(p, keys->identity, keys->identity_len);
+       p += keys->identity_len;
+       FR_PROTO_HEX_DUMP("identity", keys->identity, keys->identity_len);
+
+       /*
+        *      Counter
+        */
+       *p++ = ((keys->reauth.counter & 0xff00) >> 8);
+       *p++ = (keys->reauth.counter & 0x00ff);
+
+       /*
+        *      nonce_s
+        */
+       memcpy(p, keys->reauth.nonce_s, sizeof(keys->reauth.nonce_s));
+       p += sizeof(keys->reauth.nonce_s);
+
+       FR_PROTO_HEX_DUMP("\"EAP-AKA' re-auth\" || Identity || counter || NONCE_S", s, p - s);
+
+       /*
+        *      Feed into PRF
+        */
+       if (fr_sim_crypto_aka_prime_prf(mk, sizeof(mk), keys->k_re, sizeof(keys->k_re), s, s_len) < 0) return -1;
+
+       FR_PROTO_HEX_DUMP("mk", mk, sizeof(mk));
+
+       p = mk;
+       memcpy(keys->msk, p, sizeof(keys->msk));                        /* 64 bytes for Master Session Key */
+       p += sizeof(keys->msk);
+       FR_PROTO_HEX_DUMP("K_msk", keys->msk, sizeof(keys->msk));
+
+       memcpy(keys->emsk, p, sizeof(keys->msk));                       /* 64 bytes for Extended Master Session Key */
+       FR_PROTO_HEX_DUMP("K_emsk", keys->emsk, sizeof(keys->emsk));
 
        return 0;
 }
@@ -1304,6 +1377,84 @@ static void test_eap_aka_derive_ck_ik(void)
        TEST_CHECK(memcmp(&rfc5448_vector0_out.ik_prime, keys.ik_prime, sizeof(keys.ik_prime)) == 0);
 }
 
+/*
+ *     EAP-AKA' (RFC5448) UMTS authentication vectors
+ */
+static fr_sim_keys_t const rfc5448_vector0_reauth_in = {
+       .identity = (uint8_t const *)"5555444333222111",
+       .identity_len = sizeof("5555444333222111") - 1,
+
+       .network = (uint8_t const *)"WLAN",
+       .network_len = sizeof("WLAN") - 1,
+
+       .reauth         = {
+                               .counter = 1,
+                               .nonce_s = { 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
+                                            0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10 }
+                         },
+       .k_encr         = { 0x76, 0x6f, 0xa0, 0xa6, 0xc3, 0x17, 0x17, 0x4b,
+                           0x81, 0x2d, 0x52, 0xfb, 0xcd, 0x11, 0xa1, 0x79 },
+       .k_aut          = { 0x08, 0x42, 0xea, 0x72, 0x2f, 0xf6, 0x83, 0x5b,
+                           0xfa, 0x20, 0x32, 0x49, 0x9f, 0xc3, 0xec, 0x23,
+                           0xc2, 0xf0, 0xe3, 0x88, 0xb4, 0xf0, 0x75, 0x43,
+                           0xff, 0xc6, 0x77, 0xf1, 0x69, 0x6d, 0x71, 0xea },
+       .k_aut_len      = 32,
+       .k_re           = { 0xcf, 0x83, 0xaa, 0x8b, 0xc7, 0xe0, 0xac, 0xed,
+                           0x89, 0x2a, 0xcc, 0x98, 0xe7, 0x6a, 0x9b, 0x20,
+                           0x95, 0xb5, 0x58, 0xc7, 0x79, 0x5c, 0x70, 0x94,
+                           0x71, 0x5c, 0xb3, 0x39, 0x3a, 0xa7, 0xd1, 0x7a }
+};
+
+static fr_sim_keys_t const rfc5448_vector0_reauth_out = {
+       .k_encr         = { 0x76, 0x6f, 0xa0, 0xa6, 0xc3, 0x17, 0x17, 0x4b,
+                           0x81, 0x2d, 0x52, 0xfb, 0xcd, 0x11, 0xa1, 0x79 },
+       .k_aut          = { 0x08, 0x42, 0xea, 0x72, 0x2f, 0xf6, 0x83, 0x5b,
+                           0xfa, 0x20, 0x32, 0x49, 0x9f, 0xc3, 0xec, 0x23,
+                           0xc2, 0xf0, 0xe3, 0x88, 0xb4, 0xf0, 0x75, 0x43,
+                           0xff, 0xc6, 0x77, 0xf1, 0x69, 0x6d, 0x71, 0xea },
+       .k_aut_len      = 32,
+       .msk            = { 0x07, 0xec, 0x5d, 0x12, 0x94, 0xeb, 0xea, 0x22,
+                           0x0c, 0xa7, 0x11, 0x72, 0x24, 0x5d, 0x56, 0x9a,
+                           0x6c, 0x2f, 0x4a, 0xd0, 0x76, 0xcb, 0x54, 0x64,
+                           0x65, 0x4b, 0x52, 0x72, 0xbf, 0x09, 0xce, 0x7b,
+                           0xf7, 0xdc, 0x3f, 0x46, 0x4c, 0x95, 0xbc, 0x27,
+                           0x9a, 0x3c, 0x52, 0x42, 0x21, 0xf8, 0xaa, 0xa7,
+                           0x14, 0x97, 0xb4, 0x65, 0x18, 0x2d, 0x4f, 0x18,
+                           0xf7, 0xc4, 0xbe, 0xc4, 0xcf, 0xff, 0xd4, 0xf6 },
+       .emsk           = { 0xc4, 0x1e, 0xe2, 0xff, 0x51, 0xba, 0x46, 0xcd,
+                           0x80, 0xa9, 0x69, 0x15, 0x5c, 0x78, 0x34, 0x92,
+                           0xf2, 0x73, 0x5a, 0x0e, 0xc0, 0x35, 0x9b, 0x31,
+                           0xfa, 0xc9, 0x3b, 0x62, 0xc2, 0x2d, 0x56, 0x95,
+                           0x1a, 0x95, 0x20, 0x98, 0xe6, 0x23, 0x6d, 0xb7,
+                           0x3b, 0xde, 0x64, 0xfc, 0x80, 0xc1, 0x03, 0xa2,
+                           0x9d, 0xf8, 0x17, 0x09, 0x0c, 0x2f, 0x64, 0x19,
+                           0x97, 0x87, 0x5a, 0xcb, 0x0a, 0x64, 0x29, 0x32 }
+};
+
+static void test_eap_aka_kdf_1_umts_reauth(void)
+{
+       fr_sim_keys_t   keys;
+       int             ret;
+
+/*
+       fr_log_fp = stdout;
+       fr_debug_lvl = 4;
+       printf("\n");
+*/
+
+       memcpy(&keys, &rfc5448_vector0_reauth_in, sizeof(keys));
+
+       ret = fr_sim_crypto_kdf_1_reauth(&keys);
+       TEST_CHECK(ret == 0);
+
+       TEST_CHECK(memcmp(&rfc5448_vector0_reauth_out.k_encr, keys.k_encr, sizeof(keys.k_encr)) == 0);
+       TEST_CHECK(rfc5448_vector0_reauth_out.k_aut_len == keys.k_aut_len);
+       TEST_CHECK(memcmp(&rfc5448_vector0_reauth_out.k_aut, keys.k_aut, keys.k_aut_len) == 0);
+       TEST_CHECK(memcmp(&rfc5448_vector0_reauth_out.msk, keys.msk, sizeof(keys.msk)) == 0);
+       TEST_CHECK(memcmp(&rfc5448_vector0_reauth_out.emsk, keys.emsk, sizeof(keys.emsk)) == 0);
+}
+
+
 TEST_LIST = {
        /*
         *      EAP-SIM
@@ -1316,6 +1467,8 @@ TEST_LIST = {
         */
        { "test_eap_aka_kdf_1_umts",            test_eap_aka_kdf_1_umts         },
        { "test_eap_aka_derive_ck_ik",          test_eap_aka_derive_ck_ik       },
+       { "test_eap_aka_kdf_1_umts_reauth",     test_eap_aka_kdf_1_umts_reauth  },
+
 
        { NULL }
 };

diff --git a/src/modules/rlm_eap/lib/sim/sim_proto.h b/src/modules/rlm_eap/lib/sim/sim_proto.h
index 50c824a98516e381e13b618c53acd69c1f5005ba..a672f20f1f583261d75208cce2663b97a16dbe91 100644 (file)
--- a/src/modules/rlm_eap/lib/sim/sim_proto.h
+++ b/src/modules/rlm_eap/lib/sim/sim_proto.h
@@ -260,7 +260,7 @@ int         fr_sim_crypto_update_checkcode(fr_sim_checkcode_t *checkcode, eap_packet_t
 
 ssize_t                fr_sim_crypto_finalise_checkcode(uint8_t *out, fr_sim_checkcode_t **checkcode);
 
-ssize_t                fr_sim_crypto_sign_packet(uint8_t out[16], eap_packet_t *eap_packet, bool zero_mac,
+ssize_t                fr_sim_crypto_sign_packet(uint8_t out[SIM_MAC_DIGEST_SIZE], eap_packet_t *eap_packet, bool zero_mac,
                                          EVP_MD const *md, uint8_t const *key, size_t const key_len,
                                          uint8_t const *hmac_extra, size_t const hmac_extra_len);
 
@@ -277,6 +277,8 @@ int         fr_sim_crypto_derive_ck_ik_prime(fr_sim_keys_t *keys);
 
 int            fr_sim_crypto_kdf_1_umts(fr_sim_keys_t *keys);
 
+int            fr_sim_crypto_kdf_1_reauth(fr_sim_keys_t *keys);
+
 void           fr_sim_crypto_keys_log(REQUEST *request, fr_sim_keys_t *keys);
 
 /*