espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-07-31 19:24:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

wpa_supplicant: Update security patches from upstream

Browse Source 
1. Adding security patch for SAE side channel attacks
2. Adding confirm message validation in error cases
3. Adding y coordinate for PWE in SAE
This commit is contained in:
gauri patankar
2022-10-10 15:34:50 +05:30
parent a01a64f02c
commit 929a1f8549
3 changed files with 230 additions and 239 deletions
Download Patch File Download Diff File Expand all files Collapse all files

429
components/wpa_supplicant/src/common/sae.c
View File

@@ -17,6 +17,7 @@
#include "crypto/dh_groups.h" #include "crypto/dh_groups.h"
#include "ieee802_11_defs.h" #include "ieee802_11_defs.h"
#include "sae.h" #include "sae.h"
#include "dragonfly.h"
#include "esp_wifi_crypto_types.h" #include "esp_wifi_crypto_types.h"
int sae_set_group(struct sae_data *sae, int group) int sae_set_group(struct sae_data *sae, int group)
@@ -176,106 +177,14 @@ static void sae_pwd_seed_key(const u8 *addr1, const u8 *addr2, u8 *key)
} }
} }
static struct crypto_bignum *
get_rand_1_to_p_1(const u8 *prime, size_t prime_len, size_t prime_bits,
int *r_odd)
{
for (;;) {
struct crypto_bignum *r;
u8 tmp[SAE_MAX_ECC_PRIME_LEN];
if (random_get_bytes(tmp, prime_len) < 0)
break;
if (prime_bits % 8)
buf_shift_right(tmp, prime_len, 8 - prime_bits % 8);
if (os_memcmp(tmp, prime, prime_len) >= 0)
continue;
r = crypto_bignum_init_set(tmp, prime_len);
if (!r)
break;
if (crypto_bignum_is_zero(r)) {
crypto_bignum_deinit(r, 0);
continue;
}
*r_odd = tmp[prime_len - 1] & 0x01;
return r;
}
return NULL;
}
static int is_quadratic_residue_blind(struct sae_data *sae,
const u8 *prime, size_t bits,
const struct crypto_bignum *qr,
const struct crypto_bignum *qnr,
const struct crypto_bignum *y_sqr)
{
struct crypto_bignum *r, *num;
int r_odd, check, res = -1;
/*
* Use the blinding technique to mask y_sqr while determining
* whether it is a quadratic residue modulo p to avoid leaking
* timing information while determining the Legendre symbol.
*
* v = y_sqr
* r = a random number between 1 and p-1, inclusive
* num = (v * r * r) modulo p
*/
r = get_rand_1_to_p_1(prime, sae->tmp->prime_len, bits, &r_odd);
if (!r)
return ESP_FAIL;
num = crypto_bignum_init();
if (!num ||
crypto_bignum_mulmod(y_sqr, r, sae->tmp->prime, num) < 0 ||
crypto_bignum_mulmod(num, r, sae->tmp->prime, num) < 0)
goto fail;
if (r_odd) {
/*
* num = (num * qr) module p
* LGR(num, p) = 1 ==> quadratic residue
*/
if (crypto_bignum_mulmod(num, qr, sae->tmp->prime, num) < 0)
goto fail;
check = 1;
} else {
/*
* num = (num * qnr) module p
* LGR(num, p) = -1 ==> quadratic residue
*/
if (crypto_bignum_mulmod(num, qnr, sae->tmp->prime, num) < 0)
goto fail;
check = -1;
}
res = crypto_bignum_legendre(num, sae->tmp->prime);
if (res == -2) {
res = -1;
goto fail;
}
res = res == check;
fail:
crypto_bignum_deinit(num, 1);
crypto_bignum_deinit(r, 1);
return res;
}
static int sae_test_pwd_seed_ecc(struct sae_data *sae, const u8 *pwd_seed, static int sae_test_pwd_seed_ecc(struct sae_data *sae, const u8 *pwd_seed,
const u8 *prime, const u8 *prime, const u8 *qr, const u8 *qnr,
const struct crypto_bignum *qr, u8 *pwd_value)
const struct crypto_bignum *qnr,
struct crypto_bignum **ret_x_cand)
{ {
u8 pwd_value[SAE_MAX_ECC_PRIME_LEN];
struct crypto_bignum *y_sqr, *x_cand; struct crypto_bignum *y_sqr, *x_cand;
int res; int res;
size_t bits; size_t bits;
*ret_x_cand = NULL;
wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-seed", pwd_seed, SHA256_MAC_LEN); wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-seed", pwd_seed, SHA256_MAC_LEN);
/* pwd-value = KDF-z(pwd-seed, "SAE Hunting and Pecking", p) */ /* pwd-value = KDF-z(pwd-seed, "SAE Hunting and Pecking", p) */
@@ -284,7 +193,7 @@ static int sae_test_pwd_seed_ecc(struct sae_data *sae, const u8 *pwd_seed,
prime, sae->tmp->prime_len, pwd_value, bits) < 0) prime, sae->tmp->prime_len, pwd_value, bits) < 0)
return ESP_FAIL; return ESP_FAIL;
if (bits % 8) if (bits % 8)
buf_shift_right(pwd_value, sizeof(pwd_value), 8 - bits % 8); buf_shift_right(pwd_value, sae->tmp->prime_len, 8 - bits % 8);
wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value", wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value",
pwd_value, sae->tmp->prime_len); pwd_value, sae->tmp->prime_len);
@@ -295,30 +204,28 @@ static int sae_test_pwd_seed_ecc(struct sae_data *sae, const u8 *pwd_seed,
if (!x_cand) if (!x_cand)
return ESP_FAIL; return ESP_FAIL;
y_sqr = crypto_ec_point_compute_y_sqr(sae->tmp->ec, x_cand); y_sqr = crypto_ec_point_compute_y_sqr(sae->tmp->ec, x_cand);
if (!y_sqr) {
crypto_bignum_deinit(x_cand, 1); crypto_bignum_deinit(x_cand, 1);
if (!y_sqr)
return ESP_FAIL; return ESP_FAIL;
}
res = is_quadratic_residue_blind(sae, prime, bits, qr, qnr, y_sqr); res = dragonfly_is_quadratic_residue_blind(sae->tmp->ec, qr, qnr,
y_sqr);
crypto_bignum_deinit(y_sqr, 1); crypto_bignum_deinit(y_sqr, 1);
if (res <= 0) {
crypto_bignum_deinit(x_cand, 1);
return res; return res;
} }
*ret_x_cand = x_cand; /* Returns -1 on fatal failure, 0 if PWE cannot be derived from the provided
return 1; * pwd-seed, or 1 if a valid PWE was derived from pwd-seed. */
}
static int sae_test_pwd_seed_ffc(struct sae_data *sae, const u8 *pwd_seed, static int sae_test_pwd_seed_ffc(struct sae_data *sae, const u8 *pwd_seed,
struct crypto_bignum *pwe) struct crypto_bignum *pwe)
{ {
u8 pwd_value[SAE_MAX_PRIME_LEN]; u8 pwd_value[SAE_MAX_PRIME_LEN];
size_t bits = sae->tmp->prime_len * 8; size_t bits = sae->tmp->prime_len * 8;
u8 exp[1]; u8 exp[1];
struct crypto_bignum *a, *b; struct crypto_bignum *a, *b = NULL;
int res; int res, is_val;
u8 pwd_value_valid;
wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-seed", pwd_seed, SHA256_MAC_LEN); wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-seed", pwd_seed, SHA256_MAC_LEN);
@@ -330,16 +237,30 @@ static int sae_test_pwd_seed_ffc(struct sae_data *sae, const u8 *pwd_seed,
wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value", pwd_value, wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value", pwd_value,
sae->tmp->prime_len); sae->tmp->prime_len);
if (os_memcmp(pwd_value, sae->tmp->dh->prime, sae->tmp->prime_len) >= 0) /* Check whether pwd-value < p */
{ res = const_time_memcmp(pwd_value, sae->tmp->dh->prime,
wpa_printf(MSG_DEBUG, "SAE: pwd-value >= p"); sae->tmp->prime_len);
return ESP_OK; /* pwd-value >= p is invalid, so res is < 0 for the valid cases and
} * the negative sign can be used to fill the mask for constant time
* selection */
pwd_value_valid = const_time_fill_msb(res);
/* If pwd-value >= p, force pwd-value to be < p and perform the
* calculations anyway to hide timing difference. The derived PWE will
* be ignored in that case. */
pwd_value[0] = const_time_select_u8(pwd_value_valid, pwd_value[0], 0);
/* PWE = pwd-value^((p-1)/r) modulo p */ /* PWE = pwd-value^((p-1)/r) modulo p */
res = -1;
a = crypto_bignum_init_set(pwd_value, sae->tmp->prime_len); a = crypto_bignum_init_set(pwd_value, sae->tmp->prime_len);
if (!a)
goto fail;
/* This is an optimization based on the used group that does not depend
* on the password in any way, so it is fine to use separate branches
* for this step without constant time operations. */
if (sae->tmp->dh->safe_prime) { if (sae->tmp->dh->safe_prime) {
/* /*
* r = (p-1)/2 for the group used here, so this becomes: * r = (p-1)/2 for the group used here, so this becomes:
@@ -353,68 +274,34 @@ static int sae_test_pwd_seed_ffc(struct sae_data *sae, const u8 *pwd_seed,
b = crypto_bignum_init_set(exp, sizeof(exp)); b = crypto_bignum_init_set(exp, sizeof(exp));
if (b == NULL || if (b == NULL ||
crypto_bignum_sub(sae->tmp->prime, b, b) < 0 || crypto_bignum_sub(sae->tmp->prime, b, b) < 0 ||
crypto_bignum_div(b, sae->tmp->order, b) < 0) { crypto_bignum_div(b, sae->tmp->order, b) < 0)
crypto_bignum_deinit(b, 0); goto fail;
b = NULL;
}
} }
if (a == NULL || b == NULL)
res = -1; if (!b)
else goto fail;
res = crypto_bignum_exptmod(a, b, sae->tmp->prime, pwe); res = crypto_bignum_exptmod(a, b, sae->tmp->prime, pwe);
if (res < 0)
goto fail;
crypto_bignum_deinit(a, 0); /* There were no fatal errors in calculations, so determine the return
crypto_bignum_deinit(b, 0); * value using constant time operations. We get here for number of
* invalid cases which are cleared here after having performed all the
if (res < 0) { * computation. PWE is valid if pwd-value was less than prime and
wpa_printf(MSG_DEBUG, "SAE: Failed to calculate PWE"); * PWE > 1. Start with pwd-value check first and then use constant time
return ESP_FAIL; * operations to clear res to 0 if PWE is 0 or 1.
} */
res = const_time_select_u8(pwd_value_valid, 1, 0);
/* if (PWE > 1) --> found */ is_val = crypto_bignum_is_zero(pwe);
if (crypto_bignum_is_zero(pwe) || crypto_bignum_is_one(pwe)) { res = const_time_select_u8(const_time_is_zero(is_val), res, 0);
wpa_printf(MSG_DEBUG, "SAE: PWE <= 1"); is_val = crypto_bignum_is_one(pwe);
return ESP_OK; res = const_time_select_u8(const_time_is_zero(is_val), res, 0);
} fail:
crypto_bignum_deinit(a, 1);
wpa_printf(MSG_DEBUG, "SAE: PWE found"); crypto_bignum_deinit(b, 1);
return 1; return res;
}
static int get_random_qr_qnr(const u8 *prime, size_t prime_len,
const struct crypto_bignum *prime_bn,
size_t prime_bits, struct crypto_bignum **qr,
struct crypto_bignum **qnr)
{
*qr = NULL;
*qnr = NULL;
while (!(*qr) || !(*qnr)) {
u8 tmp[SAE_MAX_ECC_PRIME_LEN];
struct crypto_bignum *q;
int res;
if (random_get_bytes(tmp, prime_len) < 0)
break;
if (prime_bits % 8)
buf_shift_right(tmp, prime_len, 8 - prime_bits % 8);
if (os_memcmp(tmp, prime, prime_len) >= 0)
continue;
q = crypto_bignum_init_set(tmp, prime_len);
if (!q)
break;
res = crypto_bignum_legendre(q, prime_bn);
if (res == 1 && !(*qr))
*qr = q;
else if (res == -1 && !(*qnr))
*qnr = q;
else
crypto_bignum_deinit(q, 0);
}
return (*qr && *qnr) ? 0 : -1;
} }
static int sae_derive_pwe_ecc(struct sae_data *sae, const u8 *addr1, static int sae_derive_pwe_ecc(struct sae_data *sae, const u8 *addr1,
@@ -425,34 +312,42 @@ static int sae_derive_pwe_ecc(struct sae_data *sae, const u8 *addr1,
u8 addrs[2 * ETH_ALEN]; u8 addrs[2 * ETH_ALEN];
const u8 *addr[3]; const u8 *addr[3];
size_t len[3]; size_t len[3];
u8 dummy_password[32]; u8 *dummy_password, *tmp_password;
size_t dummy_password_len;
int pwd_seed_odd = 0; int pwd_seed_odd = 0;
u8 prime[SAE_MAX_ECC_PRIME_LEN]; u8 prime[SAE_MAX_ECC_PRIME_LEN];
size_t prime_len; size_t prime_len;
struct crypto_bignum *x = NULL, *qr, *qnr; struct crypto_bignum *x = NULL, *y = NULL, *qr = NULL, *qnr = NULL;
size_t bits; u8 x_bin[SAE_MAX_ECC_PRIME_LEN];
int res; u8 x_cand_bin[SAE_MAX_ECC_PRIME_LEN];
u8 qr_bin[SAE_MAX_ECC_PRIME_LEN];
u8 qnr_bin[SAE_MAX_ECC_PRIME_LEN];
u8 x_y[2 * SAE_MAX_ECC_PRIME_LEN];
int res = -1;
u8 found = 0; /* 0 (false) or 0xff (true) to be used as const_time_*
* mask */
unsigned int is_eq;
dummy_password_len = password_len; os_memset(x_bin, 0, sizeof(x_bin));
if (dummy_password_len > sizeof(dummy_password))
dummy_password_len = sizeof(dummy_password); dummy_password = os_malloc(password_len);
if (random_get_bytes(dummy_password, dummy_password_len) < 0) tmp_password = os_malloc(password_len);
return ESP_FAIL; if (!dummy_password || !tmp_password ||
random_get_bytes(dummy_password, password_len) < 0)
goto fail;
prime_len = sae->tmp->prime_len; prime_len = sae->tmp->prime_len;
if (crypto_bignum_to_bin(sae->tmp->prime, prime, sizeof(prime), if (crypto_bignum_to_bin(sae->tmp->prime, prime, sizeof(prime),
prime_len) < 0) prime_len) < 0)
return ESP_FAIL; goto fail;
bits = crypto_ec_prime_len_bits(sae->tmp->ec);
/* /*
* Create a random quadratic residue (qr) and quadratic non-residue * Create a random quadratic residue (qr) and quadratic non-residue
* (qnr) modulo p for blinding purposes during the loop. * (qnr) modulo p for blinding purposes during the loop.
*/ */
if (get_random_qr_qnr(prime, prime_len, sae->tmp->prime, bits, if (dragonfly_get_random_qr_qnr(sae->tmp->prime, &qr, &qnr) < 0 ||
&qr, &qnr) < 0) crypto_bignum_to_bin(qr, qr_bin, sizeof(qr_bin), prime_len) < 0 ||
return ESP_FAIL; crypto_bignum_to_bin(qnr, qnr_bin, sizeof(qnr_bin), prime_len) < 0)
goto fail;
wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password", wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password",
password, password_len); password, password_len);
@@ -465,7 +360,7 @@ static int sae_derive_pwe_ecc(struct sae_data *sae, const u8 *addr1,
*/ */
sae_pwd_seed_key(addr1, addr2, addrs); sae_pwd_seed_key(addr1, addr2, addrs);
addr[0] = password; addr[0] = tmp_password;
len[0] = password_len; len[0] = password_len;
addr[1] = &counter; addr[1] = &counter;
len[1] = sizeof(counter); len[1] = sizeof(counter);
@@ -475,9 +370,8 @@ static int sae_derive_pwe_ecc(struct sae_data *sae, const u8 *addr1,
* attacks that attempt to determine the number of iterations required * attacks that attempt to determine the number of iterations required
* in the loop. * in the loop.
*/ */
for (counter = 1; counter <= k || !x; counter++) { for (counter = 1; counter <= k || !found; counter++) {
u8 pwd_seed[SHA256_MAC_LEN]; u8 pwd_seed[SHA256_MAC_LEN];
struct crypto_bignum *x_cand;
if (counter > 200) { if (counter > 200) {
/* This should not happen in practice */ /* This should not happen in practice */
@@ -485,79 +379,119 @@ static int sae_derive_pwe_ecc(struct sae_data *sae, const u8 *addr1,
break; break;
} }
wpa_printf(MSG_DEBUG, "SAE: counter = %u", counter); wpa_printf(MSG_DEBUG, "SAE: counter = %03u", counter);
const_time_select_bin(found, dummy_password, password,
password_len, tmp_password);
if (hmac_sha256_vector(addrs, sizeof(addrs), 2, if (hmac_sha256_vector(addrs, sizeof(addrs), 2,
addr, len, pwd_seed) < 0) addr, len, pwd_seed) < 0)
break; break;
res = sae_test_pwd_seed_ecc(sae, pwd_seed, res = sae_test_pwd_seed_ecc(sae, pwd_seed,
prime, qr, qnr, &x_cand); prime, qr_bin, qnr_bin, x_cand_bin);
const_time_select_bin(found, x_bin, x_cand_bin, prime_len,
x_bin);
pwd_seed_odd = const_time_select_u8(
found, pwd_seed_odd,
pwd_seed[SHA256_MAC_LEN - 1] & 0x01);
os_memset(pwd_seed, 0, sizeof(pwd_seed));
if (res < 0) if (res < 0)
goto fail; goto fail;
if (res > 0 && !x) { /* Need to minimize differences in handling res == 0 and 1 here
wpa_printf(MSG_DEBUG, * to avoid differences in timing and instruction cache access,
"SAE: Selected pwd-seed with counter %u", * so use const_time_select_*() to make local copies of the
counter); * values based on whether this loop iteration was the one that
x = x_cand; * found the pwd-seed/x. */
pwd_seed_odd = pwd_seed[SHA256_MAC_LEN - 1] & 0x01;
os_memset(pwd_seed, 0, sizeof(pwd_seed));
/* /* found is 0 or 0xff here and res is 0 or 1. Bitwise OR of them
* Use a dummy password for the following rounds, if * (with res converted to 0/0xff) handles this in constant time.
* any.
*/ */
addr[0] = dummy_password; found |= res * 0xff;
len[0] = dummy_password_len; wpa_printf(MSG_DEBUG, "SAE: pwd-seed result %d found=0x%02x",
} else if (res > 0) { res, found);
crypto_bignum_deinit(x_cand, 1);
} }
} if (!found) {
if (!x) {
wpa_printf(MSG_DEBUG, "SAE: Could not generate PWE"); wpa_printf(MSG_DEBUG, "SAE: Could not generate PWE");
res = -1; res = -1;
goto fail; goto fail;
} }
x = crypto_bignum_init_set(x_bin, prime_len);
if (!sae->tmp->pwe_ecc) if (!x) {
sae->tmp->pwe_ecc = crypto_ec_point_init(sae->tmp->ec);
if (!sae->tmp->pwe_ecc)
res = -1; res = -1;
else goto fail;
res = crypto_ec_point_solve_y_coord(sae->tmp->ec, }
sae->tmp->pwe_ecc, x, /* y = sqrt(x^3 + ax + b) mod p
pwd_seed_odd); * if LSB(save) == LSB(y): PWE = (x, y)
crypto_bignum_deinit(x, 1); * else: PWE = (x, p - y)
if (res < 0) { *
/* * Calculate y and the two possible values for PWE and after that,
* This should not happen since we already checked that there * use constant time selection to copy the correct alternative.
* is a result.
*/ */
y = crypto_ec_point_compute_y_sqr(sae->tmp->ec, x);
if (!y ||
dragonfly_sqrt(sae->tmp->ec, y, y) < 0 ||
crypto_bignum_to_bin(y, x_y, SAE_MAX_ECC_PRIME_LEN,
prime_len) < 0 ||
crypto_bignum_sub(sae->tmp->prime, y, y) < 0 ||
crypto_bignum_to_bin(y, x_y + SAE_MAX_ECC_PRIME_LEN,
SAE_MAX_ECC_PRIME_LEN, prime_len) < 0) {
wpa_printf(MSG_DEBUG, "SAE: Could not solve y"); wpa_printf(MSG_DEBUG, "SAE: Could not solve y");
goto fail;
}
is_eq = const_time_eq(pwd_seed_odd, x_y[prime_len - 1] & 0x01);
const_time_select_bin(is_eq, x_y, x_y + SAE_MAX_ECC_PRIME_LEN,
prime_len, x_y + prime_len);
os_memcpy(x_y, x_bin, prime_len);
wpa_hexdump_key(MSG_DEBUG, "SAE: PWE", x_y, 2 * prime_len);
crypto_ec_point_deinit(sae->tmp->pwe_ecc, 1);
sae->tmp->pwe_ecc = crypto_ec_point_from_bin(sae->tmp->ec, x_y);
if (!sae->tmp->pwe_ecc) {
wpa_printf(MSG_DEBUG, "SAE: Could not generate PWE");
res = -1;
} }
fail: fail:
forced_memzero(x_y, sizeof(x_y));
crypto_bignum_deinit(qr, 0); crypto_bignum_deinit(qr, 0);
crypto_bignum_deinit(qnr, 0); crypto_bignum_deinit(qnr, 0);
crypto_bignum_deinit(y, 1);
os_free(dummy_password);
bin_clear_free(tmp_password, password_len);
crypto_bignum_deinit(x, 1);
os_memset(x_bin, 0, sizeof(x_bin));
os_memset(x_cand_bin, 0, sizeof(x_cand_bin));
return res; return res;
} }
static int sae_modp_group_require_masking(int group)
{
/* Groups for which pwd-value is likely to be >= p frequently */
return group == 22 || group == 23 || group == 24;
}
static int sae_derive_pwe_ffc(struct sae_data *sae, const u8 *addr1, static int sae_derive_pwe_ffc(struct sae_data *sae, const u8 *addr1,
const u8 *addr2, const u8 *password, const u8 *addr2, const u8 *password,
size_t password_len) size_t password_len)
{ {
u8 counter; u8 counter, k, sel_counter = 0;
u8 addrs[2 * ETH_ALEN]; u8 addrs[2 * ETH_ALEN];
const u8 *addr[3]; const u8 *addr[3];
size_t len[3]; size_t len[3];
int found = 0; u8 found = 0; /* 0 (false) or 0xff (true) to be used as const_time_*
* mask */
u8 mask;
struct crypto_bignum *pwe;
size_t prime_len = sae->tmp->prime_len * 8;
u8 *pwe_buf;
crypto_bignum_deinit(sae->tmp->pwe_ffc, 1);
sae->tmp->pwe_ffc = NULL;
if (sae->tmp->pwe_ffc == NULL) { /* Allocate a buffer to maintain selected and candidate PWE for constant
sae->tmp->pwe_ffc = crypto_bignum_init(); * time selection. */
if (sae->tmp->pwe_ffc == NULL) pwe_buf = os_zalloc(prime_len * 2);
return ESP_FAIL; pwe = crypto_bignum_init();
} if (!pwe_buf || !pwe)
goto fail;
wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password", wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password",
password, password_len); password, password_len);
@@ -574,7 +508,9 @@ static int sae_derive_pwe_ffc(struct sae_data *sae, const u8 *addr1,
addr[1] = &counter; addr[1] = &counter;
len[1] = sizeof(counter); len[1] = sizeof(counter);
for (counter = 1; !found; counter++) { k = sae_modp_group_require_masking(sae->group) ? 40 : 1;
for (counter = 1; counter <= k || !found; counter++) {
u8 pwd_seed[SHA256_MAC_LEN]; u8 pwd_seed[SHA256_MAC_LEN];
int res; int res;
@@ -584,20 +520,35 @@ static int sae_derive_pwe_ffc(struct sae_data *sae, const u8 *addr1,
break; break;
} }
wpa_printf(MSG_DEBUG, "SAE: counter = %u", counter); wpa_printf(MSG_DEBUG, "SAE: counter = %02u", counter);
if (hmac_sha256_vector(addrs, sizeof(addrs), 2, if (hmac_sha256_vector(addrs, sizeof(addrs), 2,
addr, len, pwd_seed) < 0) addr, len, pwd_seed) < 0)
break; break;
res = sae_test_pwd_seed_ffc(sae, pwd_seed, sae->tmp->pwe_ffc); res = sae_test_pwd_seed_ffc(sae, pwd_seed, pwe);
/* res is -1 for fatal failure, 0 if a valid PWE was not found,
* or 1 if a valid PWE was found. */
if (res < 0) if (res < 0)
break; break;
if (res > 0) { /* Store the candidate PWE into the second half of pwe_buf and
wpa_printf(MSG_DEBUG, "SAE: Use this PWE"); * the selected PWE in the beginning of pwe_buf using constant
found = 1; * time selection. */
if (crypto_bignum_to_bin(pwe, pwe_buf + prime_len, prime_len,
prime_len) < 0)
break;
const_time_select_bin(found, pwe_buf, pwe_buf + prime_len,
prime_len, pwe_buf);
sel_counter = const_time_select_u8(found, sel_counter, counter);
mask = const_time_eq_u8(res, 1);
found = const_time_select_u8(found, found, mask);
} }
} if (!found)
goto fail;
return found ? 0 : -1; wpa_printf(MSG_DEBUG, "SAE: Use PWE from counter = %02u", sel_counter);
sae->tmp->pwe_ffc = crypto_bignum_init_set(pwe_buf, prime_len);
fail:
crypto_bignum_deinit(pwe, 1);
bin_clear_free(pwe_buf, prime_len * 2);
return sae->tmp->pwe_ffc ? 0 : -1;
} }
static int hkdf_extract(size_t hash_len, const u8 *salt, size_t salt_len, static int hkdf_extract(size_t hash_len, const u8 *salt, size_t salt_len,
@@ -2308,6 +2259,9 @@ int sae_check_confirm(struct sae_data *sae, const u8 *data, size_t len)
} }
if (sae->tmp->ec) { if (sae->tmp->ec) {
if (!sae->tmp->peer_commit_element_ecc ||
!sae->tmp->own_commit_element_ecc)
return ESP_FAIL;
if (sae_cn_confirm_ecc(sae, data, sae->peer_commit_scalar, if (sae_cn_confirm_ecc(sae, data, sae->peer_commit_scalar,
sae->tmp->peer_commit_element_ecc, sae->tmp->peer_commit_element_ecc,
sae->tmp->own_commit_scalar, sae->tmp->own_commit_scalar,
@@ -2317,6 +2271,9 @@ int sae_check_confirm(struct sae_data *sae, const u8 *data, size_t len)
return ESP_FAIL; return ESP_FAIL;
} }
} else { } else {
if (!sae->tmp->peer_commit_element_ffc ||
!sae->tmp->own_commit_element_ffc)
return ESP_FAIL;
if (sae_cn_confirm_ffc(sae, data, sae->peer_commit_scalar, if (sae_cn_confirm_ffc(sae, data, sae->peer_commit_scalar,
sae->tmp->peer_commit_element_ffc, sae->tmp->peer_commit_element_ffc,
sae->tmp->own_commit_scalar, sae->tmp->own_commit_scalar,

19
components/wpa_supplicant/src/crypto/crypto.h
View File

@@ -663,6 +663,18 @@ int crypto_bignum_mulmod(const struct crypto_bignum *a,
int crypto_bignum_sqrmod(const struct crypto_bignum *a, int crypto_bignum_sqrmod(const struct crypto_bignum *a,
const struct crypto_bignum *b, const struct crypto_bignum *b,
struct crypto_bignum *c); struct crypto_bignum *c);
/**
* crypto_bignum_sqrtmod - returns sqrt(a) (mod b)
* @a: Bignum
* @b: Bignum
* @c: Bignum; used to store the result
* Returns: 0 on success, -1 on failure
*/
int crypto_bignum_sqrtmod(const struct crypto_bignum *a,
const struct crypto_bignum *b,
struct crypto_bignum *c);
/** /**
* crypto_bignum_rshift - r = a >> n * crypto_bignum_rshift - r = a >> n
* @a: Bignum * @a: Bignum
@@ -703,6 +715,13 @@ int crypto_bignum_is_zero(const struct crypto_bignum *a);
*/ */
int crypto_bignum_is_one(const struct crypto_bignum *a); int crypto_bignum_is_one(const struct crypto_bignum *a);
/**
* crypto_bignum_is_odd - Is the given bignum odd
* @a: Bignum
* Returns: 1 if @a is odd or 0 if not
*/
int crypto_bignum_is_odd(const struct crypto_bignum *a);
/** /**
* crypto_bignum_legendre - Compute the Legendre symbol (a/p) * crypto_bignum_legendre - Compute the Legendre symbol (a/p)
* @a: Bignum * @a: Bignum

15
components/wpa_supplicant/src/crypto/crypto_mbedtls-bignum.c
View File

@@ -16,6 +16,11 @@
#include "sha256.h" #include "sha256.h"
#include "mbedtls/pk.h" #include "mbedtls/pk.h"
static int crypto_rng_wrapper(void *ctx, unsigned char *buf, size_t len)
{
return random_get_bytes(buf, len);
}
struct crypto_bignum *crypto_bignum_init(void) struct crypto_bignum *crypto_bignum_init(void)
{ {
mbedtls_mpi *bn = os_zalloc(sizeof(mbedtls_mpi)); mbedtls_mpi *bn = os_zalloc(sizeof(mbedtls_mpi));
@@ -235,6 +240,16 @@ int crypto_bignum_is_one(const struct crypto_bignum *a)
return (mbedtls_mpi_cmp_int((const mbedtls_mpi *) a, 1) == 0); return (mbedtls_mpi_cmp_int((const mbedtls_mpi *) a, 1) == 0);
} }
int crypto_bignum_is_odd(const struct crypto_bignum *a)
{
return (mbedtls_mpi_get_bit((const mbedtls_mpi *) a, 0) == 1);
}
int crypto_bignum_rand(struct crypto_bignum *r, const struct crypto_bignum *m)
{
return ((mbedtls_mpi_random((mbedtls_mpi *) r, 0, (const mbedtls_mpi *) m,
crypto_rng_wrapper, NULL) != 0) ? -1 : 0);
}
int crypto_bignum_legendre(const struct crypto_bignum *a, int crypto_bignum_legendre(const struct crypto_bignum *a,
const struct crypto_bignum *p) const struct crypto_bignum *p)