src/eap_server/eap_server_pwd.c

   1 /*
   2  * hostapd / EAP-pwd (RFC 5931) server
   3  * Copyright (c) 2010, Dan Harkins <dharkins@lounge.org>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the BSD license.
   7  *
   8  * Alternatively, this software may be distributed under the terms of the
   9  * GNU General Public License version 2 as published by the Free Software
  10  * Foundation.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "eap_server/eap_i.h"
  19 #include "eap_common/eap_pwd_common.h"
  20
  21
  22 struct eap_pwd_data {
  23         enum {
  24                 PWD_ID_Req, PWD_Commit_Req, PWD_Confirm_Req, SUCCESS, FAILURE
  25         } state;
  26         u8 *id_peer;
  27         size_t id_peer_len;
  28         u8 *id_server;
  29         size_t id_server_len;
  30         u8 *password;
  31         size_t password_len;
  32         u32 token;
  33         u16 group_num;
  34         EAP_PWD_group *grp;
  35
  36         BIGNUM *k;
  37         BIGNUM *private_value;
  38         BIGNUM *peer_scalar;
  39         BIGNUM *my_scalar;
  40         EC_POINT *my_element;
  41         EC_POINT *peer_element;
  42
  43         u8 my_confirm[SHA256_DIGEST_LENGTH];
  44
  45         u8 msk[EAP_MSK_LEN];
  46         u8 emsk[EAP_EMSK_LEN];
  47
  48         BN_CTX *bnctx;
  49 };
  50
  51
  52 static const char * eap_pwd_state_txt(int state)
  53 {
  54         switch (state) {
  55         case PWD_ID_Req:
  56                 return "PWD-ID-Req";
  57         case PWD_Commit_Req:
  58                 return "PWD-Commit-Req";
  59         case PWD_Confirm_Req:
  60                 return "PWD-Confirm-Req";
  61         case SUCCESS:
  62                 return "SUCCESS";
  63         case FAILURE:
  64                 return "FAILURE";
  65         default:
  66                 return "PWD-Unk";
  67         }
  68 }
  69
  70
  71 static void eap_pwd_state(struct eap_pwd_data *data, int state)
  72 {
  73         wpa_printf(MSG_DEBUG, "EAP-pwd: %s -> %s",
  74                    eap_pwd_state_txt(data->state), eap_pwd_state_txt(state));
  75         data->state = state;
  76 }
  77
  78
  79 static void * eap_pwd_init(struct eap_sm *sm)
  80 {
  81         struct eap_pwd_data *data;
  82
  83         if (sm->user == NULL || sm->user->password == NULL ||
  84             sm->user->password_len == 0) {
  85                 wpa_printf(MSG_INFO, "EAP-PWD (server): Password is not "
  86                            "configured");
  87                 return NULL;
  88         }
  89
  90         data = os_zalloc(sizeof(*data));
  91         if (data == NULL)
  92                 return NULL;
  93
  94         data->group_num = sm->pwd_group;
  95         wpa_printf(MSG_DEBUG, "EAP-pwd: Selected group number %d",
  96                    data->group_num);
  97         data->state = PWD_ID_Req;
  98
  99         data->id_server = (u8 *) os_strdup("server");
 100         if (data->id_server)
 101                 data->id_server_len = os_strlen((char *) data->id_server);
 102
 103         data->password = os_malloc(sm->user->password_len);
 104         if (data->password == NULL) {
 105                 wpa_printf(MSG_INFO, "EAP-PWD: Memory allocation password "
 106                            "fail");
 107                 os_free(data->id_server);
 108                 os_free(data);
 109                 return NULL;
 110         }
 111         data->password_len = sm->user->password_len;
 112         os_memcpy(data->password, sm->user->password, data->password_len);
 113
 114         data->bnctx = BN_CTX_new();
 115         if (data->bnctx == NULL) {
 116                 wpa_printf(MSG_INFO, "EAP-PWD: bn context allocation fail");
 117                 os_free(data->password);
 118                 os_free(data->id_server);
 119                 os_free(data);
 120                 return NULL;
 121         }
 122
 123         return data;
 124 }
 125
 126
 127 static void eap_pwd_reset(struct eap_sm *sm, void *priv)
 128 {
 129         struct eap_pwd_data *data = priv;
 130
 131         BN_free(data->private_value);
 132         BN_free(data->peer_scalar);
 133         BN_free(data->my_scalar);
 134         BN_free(data->k);
 135         BN_CTX_free(data->bnctx);
 136         EC_POINT_free(data->my_element);
 137         EC_POINT_free(data->peer_element);
 138         os_free(data->id_peer);
 139         os_free(data->id_server);
 140         os_free(data->password);
 141         if (data->grp) {
 142                 EC_GROUP_free(data->grp->group);
 143                 EC_POINT_free(data->grp->pwe);
 144                 BN_free(data->grp->order);
 145                 BN_free(data->grp->prime);
 146                 os_free(data->grp);
 147         }
 148         os_free(data);
 149 }
 150
 151
 152 static struct wpabuf *
 153 eap_pwd_build_id_req(struct eap_sm *sm, struct eap_pwd_data *data, u8 id)
 154 {
 155         struct wpabuf *req;
 156
 157         wpa_printf(MSG_DEBUG, "EAP-pwd: ID/Request");
 158         req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
 159                             1 + sizeof(struct eap_pwd_id) +
 160                             data->id_server_len,
 161                             EAP_CODE_REQUEST, id);
 162         if (req == NULL) {
 163                 eap_pwd_state(data, FAILURE);
 164                 return NULL;
 165         }
 166
 167         /* an lfsr is good enough to generate unpredictable tokens */
 168         data->token = os_random();
 169         wpabuf_put_u8(req, EAP_PWD_OPCODE_ID_EXCH);
 170         wpabuf_put_be16(req, data->group_num);
 171         wpabuf_put_u8(req, EAP_PWD_DEFAULT_RAND_FUNC);
 172         wpabuf_put_u8(req, EAP_PWD_DEFAULT_PRF);
 173         wpabuf_put_data(req, &data->token, sizeof(data->token));
 174         wpabuf_put_u8(req, EAP_PWD_PREP_NONE);
 175         wpabuf_put_data(req, data->id_server, data->id_server_len);
 176
 177         return req;
 178 }
 179
 180
 181 static struct wpabuf *
 182 eap_pwd_build_commit_req(struct eap_sm *sm, struct eap_pwd_data *data, u8 id)
 183 {
 184         struct wpabuf *req = NULL;
 185         BIGNUM *mask = NULL, *x = NULL, *y = NULL;
 186         u8 *scalar = NULL, *element = NULL;
 187         u16 offset;
 188
 189         wpa_printf(MSG_DEBUG, "EAP-pwd: Commit/Request");
 190
 191         if (((data->private_value = BN_new()) == NULL) ||
 192             ((data->my_element = EC_POINT_new(data->grp->group)) == NULL) ||
 193             ((data->my_scalar = BN_new()) == NULL) ||
 194             ((mask = BN_new()) == NULL)) {
 195                 wpa_printf(MSG_INFO, "EAP-PWD (server): scalar allocation "
 196                            "fail");
 197                 goto fin;
 198         }
 199
 200         BN_rand_range(data->private_value, data->grp->order);
 201         BN_rand_range(mask, data->grp->order);
 202         BN_add(data->my_scalar, data->private_value, mask);
 203         BN_mod(data->my_scalar, data->my_scalar, data->grp->order,
 204                data->bnctx);
 205
 206         if (!EC_POINT_mul(data->grp->group, data->my_element, NULL,
 207                           data->grp->pwe, mask, data->bnctx)) {
 208                 wpa_printf(MSG_INFO, "EAP-PWD (server): element allocation "
 209                            "fail");
 210                 eap_pwd_state(data, FAILURE);
 211                 goto fin;
 212         }
 213
 214         if (!EC_POINT_invert(data->grp->group, data->my_element, data->bnctx))
 215         {
 216                 wpa_printf(MSG_INFO, "EAP-PWD (server): element inversion "
 217                            "fail");
 218                 goto fin;
 219         }
 220         BN_free(mask);
 221
 222         if (((x = BN_new()) == NULL) ||
 223             ((y = BN_new()) == NULL)) {
 224                 wpa_printf(MSG_INFO, "EAP-PWD (server): point allocation "
 225                            "fail");
 226                 goto fin;
 227         }
 228         if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
 229                                                  data->my_element, x, y,
 230                                                  data->bnctx)) {
 231                 wpa_printf(MSG_INFO, "EAP-PWD (server): point assignment "
 232                            "fail");
 233                 goto fin;
 234         }
 235
 236         if (((scalar = os_malloc(BN_num_bytes(data->grp->order))) == NULL) ||
 237             ((element = os_malloc(BN_num_bytes(data->grp->prime) * 2)) ==
 238              NULL)) {
 239                 wpa_printf(MSG_INFO, "EAP-PWD (server): data allocation fail");
 240                 goto fin;
 241         }
 242
 243         /*
 244          * bignums occupy as little memory as possible so one that is
 245          * sufficiently smaller than the prime or order might need pre-pending
 246          * with zeros.
 247          */
 248         os_memset(scalar, 0, BN_num_bytes(data->grp->order));
 249         os_memset(element, 0, BN_num_bytes(data->grp->prime) * 2);
 250         offset = BN_num_bytes(data->grp->order) -
 251                 BN_num_bytes(data->my_scalar);
 252         BN_bn2bin(data->my_scalar, scalar + offset);
 253
 254         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x);
 255         BN_bn2bin(x, element + offset);
 256         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y);
 257         BN_bn2bin(y, element + BN_num_bytes(data->grp->prime) + offset);
 258
 259         req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
 260                             1 + (2 * BN_num_bytes(data->grp->prime)) +
 261                             BN_num_bytes(data->grp->order),
 262                             EAP_CODE_REQUEST, id);
 263         if (req == NULL)
 264                 goto fin;
 265         wpabuf_put_u8(req, EAP_PWD_OPCODE_COMMIT_EXCH);
 266
 267         /* We send the element as (x,y) followed by the scalar */
 268         wpabuf_put_data(req, element, (2 * BN_num_bytes(data->grp->prime)));
 269         wpabuf_put_data(req, scalar, BN_num_bytes(data->grp->order));
 270
 271 fin:
 272         os_free(scalar);
 273         os_free(element);
 274         BN_free(x);
 275         BN_free(y);
 276         if (req == NULL)
 277                 eap_pwd_state(data, FAILURE);
 278
 279         return req;
 280 }
 281
 282
 283 static struct wpabuf *
 284 eap_pwd_build_confirm_req(struct eap_sm *sm, struct eap_pwd_data *data, u8 id)
 285 {
 286         struct wpabuf *req = NULL;
 287         BIGNUM *x = NULL, *y = NULL;
 288         HMAC_CTX ctx;
 289         u8 conf[SHA256_DIGEST_LENGTH], *cruft = NULL, *ptr;
 290         u16 grp;
 291         int offset;
 292
 293         wpa_printf(MSG_DEBUG, "EAP-pwd: Confirm/Request");
 294
 295         /* Each component of the cruft will be at most as big as the prime */
 296         if (((cruft = os_malloc(BN_num_bytes(data->grp->prime))) == NULL) ||
 297             ((x = BN_new()) == NULL) || ((y = BN_new()) == NULL)) {
 298                 wpa_printf(MSG_INFO, "EAP-PWD (server): debug allocation "
 299                            "fail");
 300                 goto fin;
 301         }
 302
 303         /*
 304          * commit is H(k | server_element | server_scalar | peer_element |
 305          *             peer_scalar | ciphersuite)
 306          */
 307         H_Init(&ctx);
 308
 309         /*
 310          * Zero the memory each time because this is mod prime math and some
 311          * value may start with a few zeros and the previous one did not.
 312          *
 313          * First is k
 314          */
 315         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 316         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(data->k);
 317         BN_bn2bin(data->k, cruft + offset);
 318         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 319
 320         /* server element: x, y */
 321         if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
 322                                                  data->my_element, x, y,
 323                                                  data->bnctx)) {
 324                 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
 325                            "assignment fail");
 326                 goto fin;
 327         }
 328
 329         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 330         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x);
 331         BN_bn2bin(x, cruft + offset);
 332         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 333         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 334         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y);
 335         BN_bn2bin(y, cruft + offset);
 336         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 337
 338         /* server scalar */
 339         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 340         offset = BN_num_bytes(data->grp->order) -
 341                 BN_num_bytes(data->my_scalar);
 342         BN_bn2bin(data->my_scalar, cruft + offset);
 343         H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
 344
 345         /* peer element: x, y */
 346         if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
 347                                                  data->peer_element, x, y,
 348                                                  data->bnctx)) {
 349                 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
 350                            "assignment fail");
 351                 goto fin;
 352         }
 353
 354         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 355         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x);
 356         BN_bn2bin(x, cruft + offset);
 357         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 358         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 359         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y);
 360         BN_bn2bin(y, cruft + offset);
 361         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 362
 363         /* peer scalar */
 364         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 365         offset = BN_num_bytes(data->grp->order) -
 366                 BN_num_bytes(data->peer_scalar);
 367         BN_bn2bin(data->peer_scalar, cruft + offset);
 368         H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
 369
 370         /* ciphersuite */
 371         grp = htons(data->group_num);
 372         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 373         ptr = cruft;
 374         os_memcpy(ptr, &grp, sizeof(u16));
 375         ptr += sizeof(u16);
 376         *ptr = EAP_PWD_DEFAULT_RAND_FUNC;
 377         ptr += sizeof(u8);
 378         *ptr = EAP_PWD_DEFAULT_PRF;
 379         ptr += sizeof(u8);
 380         H_Update(&ctx, cruft, ptr-cruft);
 381
 382         /* all done with the random function */
 383         H_Final(&ctx, conf);
 384         os_memcpy(data->my_confirm, conf, SHA256_DIGEST_LENGTH);
 385
 386         req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
 387                             1 + SHA256_DIGEST_LENGTH,
 388                             EAP_CODE_REQUEST, id);
 389         if (req == NULL)
 390                 goto fin;
 391
 392         wpabuf_put_u8(req, EAP_PWD_OPCODE_CONFIRM_EXCH);
 393         wpabuf_put_data(req, conf, SHA256_DIGEST_LENGTH);
 394
 395 fin:
 396         os_free(cruft);
 397         BN_free(x);
 398         BN_free(y);
 399         if (req == NULL)
 400                 eap_pwd_state(data, FAILURE);
 401
 402         return req;
 403 }
 404
 405
 406 static struct wpabuf *
 407 eap_pwd_build_req(struct eap_sm *sm, void *priv, u8 id)
 408 {
 409         struct eap_pwd_data *data = priv;
 410
 411         switch (data->state) {
 412         case PWD_ID_Req:
 413                 return eap_pwd_build_id_req(sm, data, id);
 414         case PWD_Commit_Req:
 415                 return eap_pwd_build_commit_req(sm, data, id);
 416         case PWD_Confirm_Req:
 417                 return eap_pwd_build_confirm_req(sm, data, id);
 418         default:
 419                 wpa_printf(MSG_INFO, "EAP-pwd: Unknown state %d in build_req",
 420                            data->state);
 421                 break;
 422         }
 423
 424         return NULL;
 425 }
 426
 427
 428 static Boolean eap_pwd_check(struct eap_sm *sm, void *priv,
 429                              struct wpabuf *respData)
 430 {
 431         struct eap_pwd_data *data = priv;
 432         const u8 *pos;
 433         size_t len;
 434
 435         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_PWD, respData, &len);
 436         if (pos == NULL || len < 1) {
 437                 wpa_printf(MSG_INFO, "EAP-pwd: Invalid frame");
 438                 return TRUE;
 439         }
 440
 441         wpa_printf(MSG_DEBUG, "EAP-pwd: Received frame: opcode=%d", *pos);
 442
 443         if (data->state == PWD_ID_Req && *pos == EAP_PWD_OPCODE_ID_EXCH)
 444                 return FALSE;
 445
 446         if (data->state == PWD_Commit_Req &&
 447             *pos == EAP_PWD_OPCODE_COMMIT_EXCH)
 448                 return FALSE;
 449
 450         if (data->state == PWD_Confirm_Req &&
 451             *pos == EAP_PWD_OPCODE_CONFIRM_EXCH)
 452                 return FALSE;
 453
 454         wpa_printf(MSG_INFO, "EAP-pwd: Unexpected opcode=%d in state=%d",
 455                    *pos, data->state);
 456
 457         return TRUE;
 458 }
 459
 460
 461 static void eap_pwd_process_id_resp(struct eap_sm *sm,
 462                                     struct eap_pwd_data *data,
 463                                     const u8 *payload, size_t payload_len)
 464 {
 465         struct eap_pwd_id *id;
 466
 467         if (payload_len < sizeof(struct eap_pwd_id)) {
 468                 wpa_printf(MSG_INFO, "EAP-pwd: Invalid ID response");
 469                 return;
 470         }
 471
 472         id = (struct eap_pwd_id *) payload;
 473         if ((data->group_num != be_to_host16(id->group_num)) ||
 474             (id->random_function != EAP_PWD_DEFAULT_RAND_FUNC) ||
 475             (os_memcmp(id->token, (u8 *)&data->token, sizeof(data->token))) ||
 476             (id->prf != EAP_PWD_DEFAULT_PRF)) {
 477                 wpa_printf(MSG_INFO, "EAP-pwd: peer changed parameters");
 478                 eap_pwd_state(data, FAILURE);
 479                 return;
 480         }
 481         data->id_peer = os_malloc(payload_len - sizeof(struct eap_pwd_id));
 482         if (data->id_peer == NULL) {
 483                 wpa_printf(MSG_INFO, "EAP-PWD: memory allocation id fail");
 484                 return;
 485         }
 486         data->id_peer_len = payload_len - sizeof(struct eap_pwd_id);
 487         os_memcpy(data->id_peer, id->identity, data->id_peer_len);
 488         wpa_hexdump_ascii(MSG_DEBUG, "EAP-PWD (server): peer sent id of",
 489                           data->id_peer, data->id_peer_len);
 490
 491         if ((data->grp = os_malloc(sizeof(EAP_PWD_group))) == NULL) {
 492                 wpa_printf(MSG_INFO, "EAP-PWD: failed to allocate memory for "
 493                            "group");
 494                 return;
 495         }
 496         if (compute_password_element(data->grp, data->group_num,
 497                                      data->password, data->password_len,
 498                                      data->id_server, data->id_server_len,
 499                                      data->id_peer, data->id_peer_len,
 500                                      (u8 *) &data->token)) {
 501                 wpa_printf(MSG_INFO, "EAP-PWD (server): unable to compute "
 502                            "PWE");
 503                 return;
 504         }
 505         wpa_printf(MSG_DEBUG, "EAP-PWD (server): computed %d bit PWE...",
 506                    BN_num_bits(data->grp->prime));
 507
 508         eap_pwd_state(data, PWD_Commit_Req);
 509 }
 510
 511
 512 static void
 513 eap_pwd_process_commit_resp(struct eap_sm *sm, struct eap_pwd_data *data,
 514                             const u8 *payload, size_t payload_len)
 515 {
 516         u8 *ptr;
 517         BIGNUM *x = NULL, *y = NULL, *cofactor = NULL;
 518         EC_POINT *K = NULL, *point = NULL;
 519         int res = 0;
 520
 521         wpa_printf(MSG_DEBUG, "EAP-pwd: Received commit response");
 522
 523         if (((data->peer_scalar = BN_new()) == NULL) ||
 524             ((data->k = BN_new()) == NULL) ||
 525             ((cofactor = BN_new()) == NULL) ||
 526             ((x = BN_new()) == NULL) ||
 527             ((y = BN_new()) == NULL) ||
 528             ((point = EC_POINT_new(data->grp->group)) == NULL) ||
 529             ((K = EC_POINT_new(data->grp->group)) == NULL) ||
 530             ((data->peer_element = EC_POINT_new(data->grp->group)) == NULL)) {
 531                 wpa_printf(MSG_INFO, "EAP-PWD (server): peer data allocation "
 532                            "fail");
 533                 goto fin;
 534         }
 535
 536         if (!EC_GROUP_get_cofactor(data->grp->group, cofactor, NULL)) {
 537                 wpa_printf(MSG_INFO, "EAP-PWD (server): unable to get "
 538                            "cofactor for curve");
 539                 goto fin;
 540         }
 541
 542         /* element, x then y, followed by scalar */
 543         ptr = (u8 *) payload;
 544         BN_bin2bn(ptr, BN_num_bytes(data->grp->prime), x);
 545         ptr += BN_num_bytes(data->grp->prime);
 546         BN_bin2bn(ptr, BN_num_bytes(data->grp->prime), y);
 547         ptr += BN_num_bytes(data->grp->prime);
 548         BN_bin2bn(ptr, BN_num_bytes(data->grp->order), data->peer_scalar);
 549         if (!EC_POINT_set_affine_coordinates_GFp(data->grp->group,
 550                                                  data->peer_element, x, y,
 551                                                  data->bnctx)) {
 552                 wpa_printf(MSG_INFO, "EAP-PWD (server): setting peer element "
 553                            "fail");
 554                 goto fin;
 555         }
 556
 557         /* check to ensure peer's element is not in a small sub-group */
 558         if (BN_cmp(cofactor, BN_value_one())) {
 559                 if (!EC_POINT_mul(data->grp->group, point, NULL,
 560                                   data->peer_element, cofactor, NULL)) {
 561                         wpa_printf(MSG_INFO, "EAP-PWD (server): cannot "
 562                                    "multiply peer element by order");
 563                         goto fin;
 564                 }
 565                 if (EC_POINT_is_at_infinity(data->grp->group, point)) {
 566                         wpa_printf(MSG_INFO, "EAP-PWD (server): peer element "
 567                                    "is at infinity!\n");
 568                         goto fin;
 569                 }
 570         }
 571
 572         /* compute the shared key, k */
 573         if ((!EC_POINT_mul(data->grp->group, K, NULL, data->grp->pwe,
 574                            data->peer_scalar, data->bnctx)) ||
 575             (!EC_POINT_add(data->grp->group, K, K, data->peer_element,
 576                            data->bnctx)) ||
 577             (!EC_POINT_mul(data->grp->group, K, NULL, K, data->private_value,
 578                            data->bnctx))) {
 579                 wpa_printf(MSG_INFO, "EAP-PWD (server): computing shared key "
 580                            "fail");
 581                 goto fin;
 582         }
 583
 584         /* ensure that the shared key isn't in a small sub-group */
 585         if (BN_cmp(cofactor, BN_value_one())) {
 586                 if (!EC_POINT_mul(data->grp->group, K, NULL, K, cofactor,
 587                                   NULL)) {
 588                         wpa_printf(MSG_INFO, "EAP-PWD (server): cannot "
 589                                    "multiply shared key point by order!\n");
 590                         goto fin;
 591                 }
 592         }
 593
 594         /*
 595          * This check is strictly speaking just for the case above where
 596          * co-factor > 1 but it was suggested that even though this is probably
 597          * never going to happen it is a simple and safe check "just to be
 598          * sure" so let's be safe.
 599          */
 600         if (EC_POINT_is_at_infinity(data->grp->group, K)) {
 601                 wpa_printf(MSG_INFO, "EAP-PWD (server): shared key point is "
 602                            "at infinity");
 603                 goto fin;
 604         }
 605         if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group, K, data->k,
 606                                                  NULL, data->bnctx)) {
 607                 wpa_printf(MSG_INFO, "EAP-PWD (server): unable to extract "
 608                            "shared secret from secret point");
 609                 goto fin;
 610         }
 611         res = 1;
 612
 613 fin:
 614         EC_POINT_free(K);
 615         EC_POINT_free(point);
 616         BN_free(cofactor);
 617         BN_free(x);
 618         BN_free(y);
 619
 620         if (res)
 621                 eap_pwd_state(data, PWD_Confirm_Req);
 622         else
 623                 eap_pwd_state(data, FAILURE);
 624 }
 625
 626
 627 static void
 628 eap_pwd_process_confirm_resp(struct eap_sm *sm, struct eap_pwd_data *data,
 629                              const u8 *payload, size_t payload_len)
 630 {
 631         BIGNUM *x = NULL, *y = NULL;
 632         HMAC_CTX ctx;
 633         u32 cs;
 634         u16 grp;
 635         u8 conf[SHA256_DIGEST_LENGTH], *cruft = NULL, *ptr;
 636         int offset;
 637
 638         /* build up the ciphersuite: group | random_function | prf */
 639         grp = htons(data->group_num);
 640         ptr = (u8 *) &cs;
 641         os_memcpy(ptr, &grp, sizeof(u16));
 642         ptr += sizeof(u16);
 643         *ptr = EAP_PWD_DEFAULT_RAND_FUNC;
 644         ptr += sizeof(u8);
 645         *ptr = EAP_PWD_DEFAULT_PRF;
 646
 647         /* each component of the cruft will be at most as big as the prime */
 648         if (((cruft = os_malloc(BN_num_bytes(data->grp->prime))) == NULL) ||
 649             ((x = BN_new()) == NULL) || ((y = BN_new()) == NULL)) {
 650                 wpa_printf(MSG_INFO, "EAP-PWD (peer): allocation fail");
 651                 goto fin;
 652         }
 653
 654         /*
 655          * commit is H(k | peer_element | peer_scalar | server_element |
 656          *             server_scalar | ciphersuite)
 657          */
 658         H_Init(&ctx);
 659
 660         /* k */
 661         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 662         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(data->k);
 663         BN_bn2bin(data->k, cruft + offset);
 664         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 665
 666         /* peer element: x, y */
 667         if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
 668                                                  data->peer_element, x, y,
 669                                                  data->bnctx)) {
 670                 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
 671                            "assignment fail");
 672                 goto fin;
 673         }
 674         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 675         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x);
 676         BN_bn2bin(x, cruft + offset);
 677         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 678         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 679         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y);
 680         BN_bn2bin(y, cruft + offset);
 681         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 682
 683         /* peer scalar */
 684         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 685         offset = BN_num_bytes(data->grp->order) -
 686                 BN_num_bytes(data->peer_scalar);
 687         BN_bn2bin(data->peer_scalar, cruft + offset);
 688         H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
 689
 690         /* server element: x, y */
 691         if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
 692                                                  data->my_element, x, y,
 693                                                  data->bnctx)) {
 694                 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
 695                            "assignment fail");
 696                 goto fin;
 697         }
 698
 699         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 700         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x);
 701         BN_bn2bin(x, cruft + offset);
 702         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 703         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 704         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y);
 705         BN_bn2bin(y, cruft + offset);
 706         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 707
 708         /* server scalar */
 709         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 710         offset = BN_num_bytes(data->grp->order) -
 711                 BN_num_bytes(data->my_scalar);
 712         BN_bn2bin(data->my_scalar, cruft + offset);
 713         H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
 714
 715         /* ciphersuite */
 716         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 717         H_Update(&ctx, (u8 *)&cs, sizeof(u32));
 718
 719         /* all done */
 720         H_Final(&ctx, conf);
 721
 722         ptr = (u8 *) payload;
 723         if (os_memcmp(conf, ptr, SHA256_DIGEST_LENGTH)) {
 724                 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm did not "
 725                            "verify");
 726                 goto fin;
 727         }
 728
 729         wpa_printf(MSG_DEBUG, "EAP-pwd (server): confirm verified");
 730         if (compute_keys(data->grp, data->bnctx, data->k,
 731                          data->peer_scalar, data->my_scalar, conf,
 732                          data->my_confirm, &cs, data->msk, data->emsk) < 0)
 733                 eap_pwd_state(data, FAILURE);
 734         else
 735                 eap_pwd_state(data, SUCCESS);
 736
 737 fin:
 738         os_free(cruft);
 739         BN_free(x);
 740         BN_free(y);
 741 }
 742
 743
 744 static void eap_pwd_process(struct eap_sm *sm, void *priv,
 745                             struct wpabuf *respData)
 746 {
 747         struct eap_pwd_data *data = priv;
 748         const u8 *pos;
 749         size_t len;
 750         u8 exch;
 751
 752         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_PWD, respData, &len);
 753         if ((pos == NULL) || (len < 1)) {
 754                 wpa_printf(MSG_INFO, "Bad EAP header! pos %s and len = %d",
 755                            (pos == NULL) ? "is NULL" : "is not NULL",
 756                            (int) len);
 757                 return;
 758         }
 759
 760         exch = *pos & 0x3f;
 761         switch (exch) {
 762         case EAP_PWD_OPCODE_ID_EXCH:
 763                 eap_pwd_process_id_resp(sm, data, pos + 1, len - 1);
 764                 break;
 765         case EAP_PWD_OPCODE_COMMIT_EXCH:
 766                 eap_pwd_process_commit_resp(sm, data, pos + 1, len - 1);
 767                 break;
 768         case EAP_PWD_OPCODE_CONFIRM_EXCH:
 769                 eap_pwd_process_confirm_resp(sm, data, pos + 1, len - 1);
 770                 break;
 771         }
 772 }
 773
 774
 775 static u8 * eap_pwd_getkey(struct eap_sm *sm, void *priv, size_t *len)
 776 {
 777         struct eap_pwd_data *data = priv;
 778         u8 *key;
 779
 780         if (data->state != SUCCESS)
 781                 return NULL;
 782
 783         key = os_malloc(EAP_MSK_LEN);
 784         if (key == NULL)
 785                 return NULL;
 786
 787         os_memcpy(key, data->msk, EAP_MSK_LEN);
 788         *len = EAP_MSK_LEN;
 789
 790         return key;
 791 }
 792
 793
 794 static u8 * eap_pwd_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
 795 {
 796         struct eap_pwd_data *data = priv;
 797         u8 *key;
 798
 799         if (data->state != SUCCESS)
 800                 return NULL;
 801
 802         key = os_malloc(EAP_EMSK_LEN);
 803         if (key == NULL)
 804                 return NULL;
 805
 806         os_memcpy(key, data->emsk, EAP_EMSK_LEN);
 807         *len = EAP_EMSK_LEN;
 808
 809         return key;
 810 }
 811
 812
 813 static Boolean eap_pwd_is_success(struct eap_sm *sm, void *priv)
 814 {
 815         struct eap_pwd_data *data = priv;
 816         return data->state == SUCCESS;
 817 }
 818
 819
 820 static Boolean eap_pwd_is_done(struct eap_sm *sm, void *priv)
 821 {
 822         struct eap_pwd_data *data = priv;
 823         return (data->state == SUCCESS) || (data->state == FAILURE);
 824 }
 825
 826
 827 int eap_server_pwd_register(void)
 828 {
 829         struct eap_method *eap;
 830         int ret;
 831         struct timeval tp;
 832         struct timezone tz;
 833         u32 sr;
 834
 835         EVP_add_digest(EVP_sha256());
 836
 837         sr = 0xdeaddada;
 838         (void) gettimeofday(&tp, &tz);
 839         sr ^= (tp.tv_sec ^ tp.tv_usec);
 840         srandom(sr);
 841
 842         eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION,
 843                                       EAP_VENDOR_IETF, EAP_TYPE_PWD,
 844                                       "PWD");
 845         if (eap == NULL)
 846                 return -1;
 847
 848         eap->init = eap_pwd_init;
 849         eap->reset = eap_pwd_reset;
 850         eap->buildReq = eap_pwd_build_req;
 851         eap->check = eap_pwd_check;
 852         eap->process = eap_pwd_process;
 853         eap->isDone = eap_pwd_is_done;
 854         eap->getKey = eap_pwd_getkey;
 855         eap->get_emsk = eap_pwd_get_emsk;
 856         eap->isSuccess = eap_pwd_is_success;
 857
 858         ret = eap_server_method_register(eap);
 859         if (ret)
 860                 eap_server_method_free(eap);
 861         return ret;
 862 }
 863