src/eap_server/eap_server_pwd.c

   1 /*
   2  * hostapd / EAP-pwd (RFC 5931) server
   3  * Copyright (c) 2010, Dan Harkins <dharkins@lounge.org>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the BSD license.
   7  *
   8  * Alternatively, this software may be distributed under the terms of the
   9  * GNU General Public License version 2 as published by the Free Software
  10  * Foundation.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "eap_server/eap_i.h"
  19 #include "eap_common/eap_pwd_common.h"
  20
  21
  22 struct eap_pwd_data {
  23         enum {
  24                 PWD_ID_Req, PWD_Commit_Req, PWD_Confirm_Req, SUCCESS, FAILURE
  25         } state;
  26         u8 *id_peer;
  27         size_t id_peer_len;
  28         u8 *id_server;
  29         size_t id_server_len;
  30         u8 *password;
  31         size_t password_len;
  32         u32 token;
  33         u16 group_num;
  34         EAP_PWD_group *grp;
  35
  36         BIGNUM *k;
  37         BIGNUM *private_value;
  38         BIGNUM *peer_scalar;
  39         BIGNUM *my_scalar;
  40         EC_POINT *my_element;
  41         EC_POINT *peer_element;
  42
  43         u8 my_confirm[SHA256_DIGEST_LENGTH];
  44
  45         u8 msk[EAP_MSK_LEN];
  46         u8 emsk[EAP_EMSK_LEN];
  47
  48         BN_CTX *bnctx;
  49 };
  50
  51
  52 static const char * eap_pwd_state_txt(int state)
  53 {
  54         switch (state) {
  55         case PWD_ID_Req:
  56                 return "PWD-ID-Req";
  57         case PWD_Commit_Req:
  58                 return "PWD-Commit-Req";
  59         case PWD_Confirm_Req:
  60                 return "PWD-Confirm-Req";
  61         case SUCCESS:
  62                 return "SUCCESS";
  63         case FAILURE:
  64                 return "FAILURE";
  65         default:
  66                 return "PWD-Unk";
  67         }
  68 }
  69
  70
  71 static void eap_pwd_state(struct eap_pwd_data *data, int state)
  72 {
  73         wpa_printf(MSG_DEBUG, "EAP-pwd: %s -> %s",
  74                    eap_pwd_state_txt(data->state), eap_pwd_state_txt(state));
  75         data->state = state;
  76 }
  77
  78
  79 static void * eap_pwd_init(struct eap_sm *sm)
  80 {
  81         struct eap_pwd_data *data;
  82
  83         if (sm->user == NULL || sm->user->password == NULL ||
  84             sm->user->password_len == 0) {
  85                 wpa_printf(MSG_INFO, "EAP-PWD (server): Password is not "
  86                            "configured");
  87                 return NULL;
  88         }
  89
  90         data = os_zalloc(sizeof(*data));
  91         if (data == NULL)
  92                 return NULL;
  93
  94         data->group_num = sm->pwd_group;
  95         wpa_printf(MSG_DEBUG, "EAP-pwd: Selected group number %d",
  96                    data->group_num);
  97         data->state = PWD_ID_Req;
  98
  99         data->id_server = (u8 *) os_strdup("server");
 100         if (data->id_server)
 101                 data->id_server_len = os_strlen((char *) data->id_server);
 102
 103         data->password = os_malloc(sm->user->password_len);
 104         if (data->password == NULL) {
 105                 wpa_printf(MSG_INFO, "EAP-PWD: Memory allocation password "
 106                            "fail");
 107                 os_free(data->id_server);
 108                 os_free(data);
 109                 return NULL;
 110         }
 111         data->password_len = sm->user->password_len;
 112         os_memcpy(data->password, sm->user->password, data->password_len);
 113
 114         data->bnctx = BN_CTX_new();
 115         if (data->bnctx == NULL) {
 116                 wpa_printf(MSG_INFO, "EAP-PWD: bn context allocation fail");
 117                 os_free(data->password);
 118                 os_free(data->id_server);
 119                 os_free(data);
 120                 return NULL;
 121         }
 122
 123         return data;
 124 }
 125
 126
 127 static void eap_pwd_reset(struct eap_sm *sm, void *priv)
 128 {
 129         struct eap_pwd_data *data = priv;
 130
 131         BN_free(data->private_value);
 132         BN_free(data->peer_scalar);
 133         BN_free(data->my_scalar);
 134         BN_free(data->k);
 135         BN_CTX_free(data->bnctx);
 136         EC_POINT_free(data->my_element);
 137         EC_POINT_free(data->peer_element);
 138         os_free(data->id_peer);
 139         os_free(data->id_server);
 140         os_free(data->password);
 141         if (data->grp) {
 142                 EC_GROUP_free(data->grp->group);
 143                 EC_POINT_free(data->grp->pwe);
 144                 BN_free(data->grp->order);
 145                 BN_free(data->grp->prime);
 146                 os_free(data->grp);
 147         }
 148         os_free(data);
 149 }
 150
 151
 152 static struct wpabuf *
 153 eap_pwd_build_id_req(struct eap_sm *sm, struct eap_pwd_data *data, u8 id)
 154 {
 155         struct wpabuf *req;
 156
 157         wpa_printf(MSG_DEBUG, "EAP-pwd: ID/Request");
 158         req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
 159                             sizeof(struct eap_pwd_hdr) +
 160                             sizeof(struct eap_pwd_id) + data->id_server_len,
 161                             EAP_CODE_REQUEST, id);
 162         if (req == NULL) {
 163                 eap_pwd_state(data, FAILURE);
 164                 return NULL;
 165         }
 166
 167         /* an lfsr is good enough to generate unpredictable tokens */
 168         data->token = os_random();
 169         wpabuf_put_u8(req, EAP_PWD_OPCODE_ID_EXCH);
 170         wpabuf_put_be16(req, data->group_num);
 171         wpabuf_put_u8(req, EAP_PWD_DEFAULT_RAND_FUNC);
 172         wpabuf_put_u8(req, EAP_PWD_DEFAULT_PRF);
 173         wpabuf_put_data(req, &data->token, sizeof(data->token));
 174         wpabuf_put_u8(req, EAP_PWD_PREP_NONE);
 175         wpabuf_put_data(req, data->id_server, data->id_server_len);
 176
 177         return req;
 178 }
 179
 180
 181 static struct wpabuf *
 182 eap_pwd_build_commit_req(struct eap_sm *sm, struct eap_pwd_data *data, u8 id)
 183 {
 184         struct wpabuf *req = NULL;
 185         BIGNUM *mask = NULL, *x = NULL, *y = NULL;
 186         u8 *scalar = NULL, *element = NULL;
 187         u16 offset;
 188
 189         wpa_printf(MSG_DEBUG, "EAP-pwd: Commit/Request");
 190
 191         if (((data->private_value = BN_new()) == NULL) ||
 192             ((data->my_element = EC_POINT_new(data->grp->group)) == NULL) ||
 193             ((data->my_scalar = BN_new()) == NULL) ||
 194             ((mask = BN_new()) == NULL)) {
 195                 wpa_printf(MSG_INFO, "EAP-PWD (server): scalar allocation "
 196                            "fail");
 197                 goto fin;
 198         }
 199
 200         BN_rand_range(data->private_value, data->grp->order);
 201         BN_rand_range(mask, data->grp->order);
 202         BN_add(data->my_scalar, data->private_value, mask);
 203         BN_mod(data->my_scalar, data->my_scalar, data->grp->order,
 204                data->bnctx);
 205
 206         if (!EC_POINT_mul(data->grp->group, data->my_element, NULL,
 207                           data->grp->pwe, mask, data->bnctx)) {
 208                 wpa_printf(MSG_INFO, "EAP-PWD (server): element allocation "
 209                            "fail");
 210                 eap_pwd_state(data, FAILURE);
 211                 goto fin;
 212         }
 213
 214         if (!EC_POINT_invert(data->grp->group, data->my_element, data->bnctx))
 215         {
 216                 wpa_printf(MSG_INFO, "EAP-PWD (server): element inversion "
 217                            "fail");
 218                 goto fin;
 219         }
 220         BN_free(mask);
 221
 222         if (((x = BN_new()) == NULL) ||
 223             ((y = BN_new()) == NULL)) {
 224                 wpa_printf(MSG_INFO, "EAP-PWD (server): point allocation "
 225                            "fail");
 226                 goto fin;
 227         }
 228         if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
 229                                                  data->my_element, x, y,
 230                                                  data->bnctx)) {
 231                 wpa_printf(MSG_INFO, "EAP-PWD (server): point assignment "
 232                            "fail");
 233                 goto fin;
 234         }
 235
 236         if (((scalar = os_malloc(BN_num_bytes(data->grp->order))) == NULL) ||
 237             ((element = os_malloc(BN_num_bytes(data->grp->prime) * 2)) ==
 238              NULL)) {
 239                 wpa_printf(MSG_INFO, "EAP-PWD (server): data allocation fail");
 240                 goto fin;
 241         }
 242
 243         /*
 244          * bignums occupy as little memory as possible so one that is
 245          * sufficiently smaller than the prime or order might need pre-pending
 246          * with zeros.
 247          */
 248         os_memset(scalar, 0, BN_num_bytes(data->grp->order));
 249         os_memset(element, 0, BN_num_bytes(data->grp->prime) * 2);
 250         offset = BN_num_bytes(data->grp->order) -
 251                 BN_num_bytes(data->my_scalar);
 252         BN_bn2bin(data->my_scalar, scalar + offset);
 253
 254         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x);
 255         BN_bn2bin(x, element + offset);
 256         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y);
 257         BN_bn2bin(y, element + BN_num_bytes(data->grp->prime) + offset);
 258
 259         req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
 260                             sizeof(struct eap_pwd_hdr) +
 261                             (2 * BN_num_bytes(data->grp->prime)) +
 262                             BN_num_bytes(data->grp->order),
 263                             EAP_CODE_REQUEST, id);
 264         if (req == NULL)
 265                 goto fin;
 266         wpabuf_put_u8(req, EAP_PWD_OPCODE_COMMIT_EXCH);
 267
 268         /* We send the element as (x,y) followed by the scalar */
 269         wpabuf_put_data(req, element, (2 * BN_num_bytes(data->grp->prime)));
 270         wpabuf_put_data(req, scalar, BN_num_bytes(data->grp->order));
 271
 272 fin:
 273         os_free(scalar);
 274         os_free(element);
 275         BN_free(x);
 276         BN_free(y);
 277         if (req == NULL)
 278                 eap_pwd_state(data, FAILURE);
 279
 280         return req;
 281 }
 282
 283
 284 static struct wpabuf *
 285 eap_pwd_build_confirm_req(struct eap_sm *sm, struct eap_pwd_data *data, u8 id)
 286 {
 287         struct wpabuf *req = NULL;
 288         BIGNUM *x = NULL, *y = NULL;
 289         HMAC_CTX ctx;
 290         u8 conf[SHA256_DIGEST_LENGTH], *cruft = NULL, *ptr;
 291         u16 grp;
 292         int offset;
 293
 294         wpa_printf(MSG_DEBUG, "EAP-pwd: Confirm/Request");
 295
 296         /* Each component of the cruft will be at most as big as the prime */
 297         if (((cruft = os_malloc(BN_num_bytes(data->grp->prime))) == NULL) ||
 298             ((x = BN_new()) == NULL) || ((y = BN_new()) == NULL)) {
 299                 wpa_printf(MSG_INFO, "EAP-PWD (server): debug allocation "
 300                            "fail");
 301                 goto fin;
 302         }
 303
 304         /*
 305          * commit is H(k | server_element | server_scalar | peer_element |
 306          *             peer_scalar | ciphersuite)
 307          */
 308         H_Init(&ctx);
 309
 310         /*
 311          * Zero the memory each time because this is mod prime math and some
 312          * value may start with a few zeros and the previous one did not.
 313          *
 314          * First is k
 315          */
 316         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 317         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(data->k);
 318         BN_bn2bin(data->k, cruft + offset);
 319         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 320
 321         /* server element: x, y */
 322         if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
 323                                                  data->my_element, x, y,
 324                                                  data->bnctx)) {
 325                 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
 326                            "assignment fail");
 327                 goto fin;
 328         }
 329
 330         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 331         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x);
 332         BN_bn2bin(x, cruft + offset);
 333         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 334         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 335         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y);
 336         BN_bn2bin(y, cruft + offset);
 337         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 338
 339         /* server scalar */
 340         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 341         offset = BN_num_bytes(data->grp->order) -
 342                 BN_num_bytes(data->my_scalar);
 343         BN_bn2bin(data->my_scalar, cruft + offset);
 344         H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
 345
 346         /* peer element: x, y */
 347         if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
 348                                                  data->peer_element, x, y,
 349                                                  data->bnctx)) {
 350                 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
 351                            "assignment fail");
 352                 goto fin;
 353         }
 354
 355         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 356         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x);
 357         BN_bn2bin(x, cruft + offset);
 358         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 359         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 360         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y);
 361         BN_bn2bin(y, cruft + offset);
 362         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 363
 364         /* peer scalar */
 365         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 366         offset = BN_num_bytes(data->grp->order) -
 367                 BN_num_bytes(data->peer_scalar);
 368         BN_bn2bin(data->peer_scalar, cruft + offset);
 369         H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
 370
 371         /* ciphersuite */
 372         grp = htons(data->group_num);
 373         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 374         ptr = cruft;
 375         os_memcpy(ptr, &grp, sizeof(u16));
 376         ptr += sizeof(u16);
 377         *ptr = EAP_PWD_DEFAULT_RAND_FUNC;
 378         ptr += sizeof(u8);
 379         *ptr = EAP_PWD_DEFAULT_PRF;
 380         ptr += sizeof(u8);
 381         H_Update(&ctx, cruft, ptr-cruft);
 382
 383         /* all done with the random function */
 384         H_Final(&ctx, conf);
 385         os_memcpy(data->my_confirm, conf, SHA256_DIGEST_LENGTH);
 386
 387         req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
 388                             sizeof(struct eap_pwd_hdr) + SHA256_DIGEST_LENGTH,
 389                             EAP_CODE_REQUEST, id);
 390         if (req == NULL)
 391                 goto fin;
 392
 393         wpabuf_put_u8(req, EAP_PWD_OPCODE_CONFIRM_EXCH);
 394         wpabuf_put_data(req, conf, SHA256_DIGEST_LENGTH);
 395
 396 fin:
 397         os_free(cruft);
 398         BN_free(x);
 399         BN_free(y);
 400         if (req == NULL)
 401                 eap_pwd_state(data, FAILURE);
 402
 403         return req;
 404 }
 405
 406
 407 static struct wpabuf *
 408 eap_pwd_build_req(struct eap_sm *sm, void *priv, u8 id)
 409 {
 410         struct eap_pwd_data *data = priv;
 411
 412         switch (data->state) {
 413         case PWD_ID_Req:
 414                 return eap_pwd_build_id_req(sm, data, id);
 415         case PWD_Commit_Req:
 416                 return eap_pwd_build_commit_req(sm, data, id);
 417         case PWD_Confirm_Req:
 418                 return eap_pwd_build_confirm_req(sm, data, id);
 419         default:
 420                 wpa_printf(MSG_INFO, "EAP-pwd: Unknown state %d in build_req",
 421                            data->state);
 422                 break;
 423         }
 424
 425         return NULL;
 426 }
 427
 428
 429 static Boolean eap_pwd_check(struct eap_sm *sm, void *priv,
 430                              struct wpabuf *respData)
 431 {
 432         struct eap_pwd_data *data = priv;
 433         const u8 *pos;
 434         size_t len;
 435
 436         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_PWD, respData, &len);
 437         if (pos == NULL || len < 1) {
 438                 wpa_printf(MSG_INFO, "EAP-pwd: Invalid frame");
 439                 return TRUE;
 440         }
 441
 442         wpa_printf(MSG_DEBUG, "EAP-pwd: Received frame: opcode=%d", *pos);
 443
 444         if (data->state == PWD_ID_Req && *pos == EAP_PWD_OPCODE_ID_EXCH)
 445                 return FALSE;
 446
 447         if (data->state == PWD_Commit_Req &&
 448             *pos == EAP_PWD_OPCODE_COMMIT_EXCH)
 449                 return FALSE;
 450
 451         if (data->state == PWD_Confirm_Req &&
 452             *pos == EAP_PWD_OPCODE_CONFIRM_EXCH)
 453                 return FALSE;
 454
 455         wpa_printf(MSG_INFO, "EAP-pwd: Unexpected opcode=%d in state=%d",
 456                    *pos, data->state);
 457
 458         return TRUE;
 459 }
 460
 461
 462 static void eap_pwd_process_id_resp(struct eap_sm *sm,
 463                                     struct eap_pwd_data *data,
 464                                     const u8 *payload, size_t payload_len)
 465 {
 466         struct eap_pwd_id *id;
 467
 468         if (payload_len < sizeof(struct eap_pwd_id)) {
 469                 wpa_printf(MSG_INFO, "EAP-pwd: Invalid ID response");
 470                 return;
 471         }
 472
 473         id = (struct eap_pwd_id *) payload;
 474         if ((data->group_num != be_to_host16(id->group_num)) ||
 475             (id->random_function != EAP_PWD_DEFAULT_RAND_FUNC) ||
 476             (os_memcmp(id->token, (u8 *)&data->token, sizeof(data->token))) ||
 477             (id->prf != EAP_PWD_DEFAULT_PRF)) {
 478                 wpa_printf(MSG_INFO, "EAP-pwd: peer changed parameters");
 479                 eap_pwd_state(data, FAILURE);
 480                 return;
 481         }
 482         data->id_peer = os_malloc(payload_len - sizeof(struct eap_pwd_id));
 483         if (data->id_peer == NULL) {
 484                 wpa_printf(MSG_INFO, "EAP-PWD: memory allocation id fail");
 485                 return;
 486         }
 487         data->id_peer_len = payload_len - sizeof(struct eap_pwd_id);
 488         os_memcpy(data->id_peer, id->identity, data->id_peer_len);
 489         wpa_hexdump_ascii(MSG_DEBUG, "EAP-PWD (server): peer sent id of",
 490                           data->id_peer, data->id_peer_len);
 491
 492         if ((data->grp = os_malloc(sizeof(EAP_PWD_group))) == NULL) {
 493                 wpa_printf(MSG_INFO, "EAP-PWD: failed to allocate memory for "
 494                            "group");
 495                 return;
 496         }
 497         if (compute_password_element(data->grp, data->group_num,
 498                                      data->password, data->password_len,
 499                                      data->id_server, data->id_server_len,
 500                                      data->id_peer, data->id_peer_len,
 501                                      (u8 *) &data->token)) {
 502                 wpa_printf(MSG_INFO, "EAP-PWD (server): unable to compute "
 503                            "PWE");
 504                 return;
 505         }
 506         wpa_printf(MSG_DEBUG, "EAP-PWD (server): computed %d bit PWE...",
 507                    BN_num_bits(data->grp->prime));
 508
 509         eap_pwd_state(data, PWD_Commit_Req);
 510 }
 511
 512
 513 static void
 514 eap_pwd_process_commit_resp(struct eap_sm *sm, struct eap_pwd_data *data,
 515                             const u8 *payload, size_t payload_len)
 516 {
 517         u8 *ptr;
 518         BIGNUM *x = NULL, *y = NULL, *cofactor = NULL;
 519         EC_POINT *K = NULL, *point = NULL;
 520         int res = 0;
 521
 522         wpa_printf(MSG_DEBUG, "EAP-pwd: Received commit response");
 523
 524         if (((data->peer_scalar = BN_new()) == NULL) ||
 525             ((data->k = BN_new()) == NULL) ||
 526             ((cofactor = BN_new()) == NULL) ||
 527             ((x = BN_new()) == NULL) ||
 528             ((y = BN_new()) == NULL) ||
 529             ((point = EC_POINT_new(data->grp->group)) == NULL) ||
 530             ((K = EC_POINT_new(data->grp->group)) == NULL) ||
 531             ((data->peer_element = EC_POINT_new(data->grp->group)) == NULL)) {
 532                 wpa_printf(MSG_INFO, "EAP-PWD (server): peer data allocation "
 533                            "fail");
 534                 goto fin;
 535         }
 536
 537         if (!EC_GROUP_get_cofactor(data->grp->group, cofactor, NULL)) {
 538                 wpa_printf(MSG_INFO, "EAP-PWD (server): unable to get "
 539                            "cofactor for curve");
 540                 goto fin;
 541         }
 542
 543         /* element, x then y, followed by scalar */
 544         ptr = (u8 *) payload;
 545         BN_bin2bn(ptr, BN_num_bytes(data->grp->prime), x);
 546         ptr += BN_num_bytes(data->grp->prime);
 547         BN_bin2bn(ptr, BN_num_bytes(data->grp->prime), y);
 548         ptr += BN_num_bytes(data->grp->prime);
 549         BN_bin2bn(ptr, BN_num_bytes(data->grp->order), data->peer_scalar);
 550         if (!EC_POINT_set_affine_coordinates_GFp(data->grp->group,
 551                                                  data->peer_element, x, y,
 552                                                  data->bnctx)) {
 553                 wpa_printf(MSG_INFO, "EAP-PWD (server): setting peer element "
 554                            "fail");
 555                 goto fin;
 556         }
 557
 558         /* check to ensure peer's element is not in a small sub-group */
 559         if (BN_cmp(cofactor, BN_value_one())) {
 560                 if (!EC_POINT_mul(data->grp->group, point, NULL,
 561                                   data->peer_element, cofactor, NULL)) {
 562                         wpa_printf(MSG_INFO, "EAP-PWD (server): cannot "
 563                                    "multiply peer element by order");
 564                         goto fin;
 565                 }
 566                 if (EC_POINT_is_at_infinity(data->grp->group, point)) {
 567                         wpa_printf(MSG_INFO, "EAP-PWD (server): peer element "
 568                                    "is at infinity!\n");
 569                         goto fin;
 570                 }
 571         }
 572
 573         /* compute the shared key, k */
 574         if ((!EC_POINT_mul(data->grp->group, K, NULL, data->grp->pwe,
 575                            data->peer_scalar, data->bnctx)) ||
 576             (!EC_POINT_add(data->grp->group, K, K, data->peer_element,
 577                            data->bnctx)) ||
 578             (!EC_POINT_mul(data->grp->group, K, NULL, K, data->private_value,
 579                            data->bnctx))) {
 580                 wpa_printf(MSG_INFO, "EAP-PWD (server): computing shared key "
 581                            "fail");
 582                 goto fin;
 583         }
 584
 585         /* ensure that the shared key isn't in a small sub-group */
 586         if (BN_cmp(cofactor, BN_value_one())) {
 587                 if (!EC_POINT_mul(data->grp->group, K, NULL, K, cofactor,
 588                                   NULL)) {
 589                         wpa_printf(MSG_INFO, "EAP-PWD (server): cannot "
 590                                    "multiply shared key point by order!\n");
 591                         goto fin;
 592                 }
 593         }
 594
 595         /*
 596          * This check is strictly speaking just for the case above where
 597          * co-factor > 1 but it was suggested that even though this is probably
 598          * never going to happen it is a simple and safe check "just to be
 599          * sure" so let's be safe.
 600          */
 601         if (EC_POINT_is_at_infinity(data->grp->group, K)) {
 602                 wpa_printf(MSG_INFO, "EAP-PWD (server): shared key point is "
 603                            "at infinity");
 604                 goto fin;
 605         }
 606         if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group, K, data->k,
 607                                                  NULL, data->bnctx)) {
 608                 wpa_printf(MSG_INFO, "EAP-PWD (server): unable to extract "
 609                            "shared secret from secret point");
 610                 goto fin;
 611         }
 612         res = 1;
 613
 614 fin:
 615         EC_POINT_free(K);
 616         EC_POINT_free(point);
 617         BN_free(cofactor);
 618         BN_free(x);
 619         BN_free(y);
 620
 621         if (res)
 622                 eap_pwd_state(data, PWD_Confirm_Req);
 623         else
 624                 eap_pwd_state(data, FAILURE);
 625 }
 626
 627
 628 static void
 629 eap_pwd_process_confirm_resp(struct eap_sm *sm, struct eap_pwd_data *data,
 630                              const u8 *payload, size_t payload_len)
 631 {
 632         BIGNUM *x = NULL, *y = NULL;
 633         HMAC_CTX ctx;
 634         u32 cs;
 635         u16 grp;
 636         u8 conf[SHA256_DIGEST_LENGTH], *cruft = NULL, *ptr;
 637         int offset;
 638
 639         /* build up the ciphersuite: group | random_function | prf */
 640         grp = htons(data->group_num);
 641         ptr = (u8 *) &cs;
 642         os_memcpy(ptr, &grp, sizeof(u16));
 643         ptr += sizeof(u16);
 644         *ptr = EAP_PWD_DEFAULT_RAND_FUNC;
 645         ptr += sizeof(u8);
 646         *ptr = EAP_PWD_DEFAULT_PRF;
 647
 648         /* each component of the cruft will be at most as big as the prime */
 649         if (((cruft = os_malloc(BN_num_bytes(data->grp->prime))) == NULL) ||
 650             ((x = BN_new()) == NULL) || ((y = BN_new()) == NULL)) {
 651                 wpa_printf(MSG_INFO, "EAP-PWD (peer): allocation fail");
 652                 goto fin;
 653         }
 654
 655         /*
 656          * commit is H(k | peer_element | peer_scalar | server_element |
 657          *             server_scalar | ciphersuite)
 658          */
 659         H_Init(&ctx);
 660
 661         /* k */
 662         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 663         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(data->k);
 664         BN_bn2bin(data->k, cruft + offset);
 665         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 666
 667         /* peer element: x, y */
 668         if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
 669                                                  data->peer_element, x, y,
 670                                                  data->bnctx)) {
 671                 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
 672                            "assignment fail");
 673                 goto fin;
 674         }
 675         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 676         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x);
 677         BN_bn2bin(x, cruft + offset);
 678         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 679         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 680         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y);
 681         BN_bn2bin(y, cruft + offset);
 682         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 683
 684         /* peer scalar */
 685         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 686         offset = BN_num_bytes(data->grp->order) -
 687                 BN_num_bytes(data->peer_scalar);
 688         BN_bn2bin(data->peer_scalar, cruft + offset);
 689         H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
 690
 691         /* server element: x, y */
 692         if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
 693                                                  data->my_element, x, y,
 694                                                  data->bnctx)) {
 695                 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
 696                            "assignment fail");
 697                 goto fin;
 698         }
 699
 700         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 701         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x);
 702         BN_bn2bin(x, cruft + offset);
 703         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 704         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 705         offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y);
 706         BN_bn2bin(y, cruft + offset);
 707         H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
 708
 709         /* server scalar */
 710         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 711         offset = BN_num_bytes(data->grp->order) -
 712                 BN_num_bytes(data->my_scalar);
 713         BN_bn2bin(data->my_scalar, cruft + offset);
 714         H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
 715
 716         /* ciphersuite */
 717         os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
 718         H_Update(&ctx, (u8 *)&cs, sizeof(u32));
 719
 720         /* all done */
 721         H_Final(&ctx, conf);
 722
 723         ptr = (u8 *) payload;
 724         if (os_memcmp(conf, ptr, SHA256_DIGEST_LENGTH)) {
 725                 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm did not "
 726                            "verify");
 727                 goto fin;
 728         }
 729
 730         wpa_printf(MSG_DEBUG, "EAP-pwd (server): confirm verified");
 731         if (compute_keys(data->grp, data->bnctx, data->k,
 732                          data->peer_scalar, data->my_scalar, conf,
 733                          data->my_confirm, &cs, data->msk, data->emsk) < 0)
 734                 eap_pwd_state(data, FAILURE);
 735         else
 736                 eap_pwd_state(data, SUCCESS);
 737
 738 fin:
 739         os_free(cruft);
 740         BN_free(x);
 741         BN_free(y);
 742 }
 743
 744
 745 static void eap_pwd_process(struct eap_sm *sm, void *priv,
 746                             struct wpabuf *respData)
 747 {
 748         struct eap_pwd_data *data = priv;
 749         const u8 *pos;
 750         size_t len;
 751         u8 exch;
 752
 753         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_PWD, respData, &len);
 754         if ((pos == NULL) || (len < 1)) {
 755                 wpa_printf(MSG_INFO, "Bad EAP header! pos %s and len = %d",
 756                            (pos == NULL) ? "is NULL" : "is not NULL",
 757                            (int) len);
 758                 return;
 759         }
 760
 761         exch = *pos & 0x3f;
 762         switch (exch) {
 763         case EAP_PWD_OPCODE_ID_EXCH:
 764                 eap_pwd_process_id_resp(sm, data, pos + 1, len - 1);
 765                 break;
 766         case EAP_PWD_OPCODE_COMMIT_EXCH:
 767                 eap_pwd_process_commit_resp(sm, data, pos + 1, len - 1);
 768                 break;
 769         case EAP_PWD_OPCODE_CONFIRM_EXCH:
 770                 eap_pwd_process_confirm_resp(sm, data, pos + 1, len - 1);
 771                 break;
 772         }
 773 }
 774
 775
 776 static u8 * eap_pwd_getkey(struct eap_sm *sm, void *priv, size_t *len)
 777 {
 778         struct eap_pwd_data *data = priv;
 779         u8 *key;
 780
 781         if (data->state != SUCCESS)
 782                 return NULL;
 783
 784         key = os_malloc(EAP_MSK_LEN);
 785         if (key == NULL)
 786                 return NULL;
 787
 788         os_memcpy(key, data->msk, EAP_MSK_LEN);
 789         *len = EAP_MSK_LEN;
 790
 791         return key;
 792 }
 793
 794
 795 static u8 * eap_pwd_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
 796 {
 797         struct eap_pwd_data *data = priv;
 798         u8 *key;
 799
 800         if (data->state != SUCCESS)
 801                 return NULL;
 802
 803         key = os_malloc(EAP_EMSK_LEN);
 804         if (key == NULL)
 805                 return NULL;
 806
 807         os_memcpy(key, data->emsk, EAP_EMSK_LEN);
 808         *len = EAP_EMSK_LEN;
 809
 810         return key;
 811 }
 812
 813
 814 static Boolean eap_pwd_is_success(struct eap_sm *sm, void *priv)
 815 {
 816         struct eap_pwd_data *data = priv;
 817         return data->state == SUCCESS;
 818 }
 819
 820
 821 static Boolean eap_pwd_is_done(struct eap_sm *sm, void *priv)
 822 {
 823         struct eap_pwd_data *data = priv;
 824         return (data->state == SUCCESS) || (data->state == FAILURE);
 825 }
 826
 827
 828 int eap_server_pwd_register(void)
 829 {
 830         struct eap_method *eap;
 831         int ret;
 832         struct timeval tp;
 833         struct timezone tz;
 834         u32 sr;
 835
 836         EVP_add_digest(EVP_sha256());
 837
 838         sr = 0xdeaddada;
 839         (void) gettimeofday(&tp, &tz);
 840         sr ^= (tp.tv_sec ^ tp.tv_usec);
 841         srandom(sr);
 842
 843         eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION,
 844                                       EAP_VENDOR_IETF, EAP_TYPE_PWD,
 845                                       "PWD");
 846         if (eap == NULL)
 847                 return -1;
 848
 849         eap->init = eap_pwd_init;
 850         eap->reset = eap_pwd_reset;
 851         eap->buildReq = eap_pwd_build_req;
 852         eap->check = eap_pwd_check;
 853         eap->process = eap_pwd_process;
 854         eap->isDone = eap_pwd_is_done;
 855         eap->getKey = eap_pwd_getkey;
 856         eap->get_emsk = eap_pwd_get_emsk;
 857         eap->isSuccess = eap_pwd_is_success;
 858
 859         ret = eap_server_method_register(eap);
 860         if (ret)
 861                 eap_server_method_free(eap);
 862         return ret;
 863 }
 864