DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

EAP-PAX: Derive EAP Session-Id

Browse source 
This adds EAP-PAX server and peer method functions for deriving
Session-Id from Method-Id per RFC 4746 and RFC 5247.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2014-12-01 01:45:17 +02:00
parent a7bec9e7b2
commit 92e3c0b14c
4 changed files with 55 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/eap_common/eap_pax_common.c
View file

@ -121,10 +121,11 @@ int eap_pax_mac(u8 mac_id, const u8 *key, size_t key_len,
* @mk: Buffer for the derived Master Key
* @ck: Buffer for the derived Confirmation Key
* @ick: Buffer for the derived Integrity Check Key
* @mid: Buffer for the derived Method ID
* Returns: 0 on success, -1 on failure
*/
int eap_pax_initial_key_derivation(u8 mac_id, const u8 *ak, const u8 *e,
u8 *mk, u8 *ck, u8 *ick)
u8 *mk, u8 *ck, u8 *ick, u8 *mid)
{
wpa_printf(MSG_DEBUG, "EAP-PAX: initial key derivation");
if (eap_pax_kdf(mac_id, ak, EAP_PAX_AK_LEN, "Master Key",
@ -132,13 +133,16 @@ int eap_pax_initial_key_derivation(u8 mac_id, const u8 *ak, const u8 *e,
eap_pax_kdf(mac_id, mk, EAP_PAX_MK_LEN, "Confirmation Key",
e, 2 * EAP_PAX_RAND_LEN, EAP_PAX_CK_LEN, ck) ||
eap_pax_kdf(mac_id, mk, EAP_PAX_MK_LEN, "Integrity Check Key",
e, 2 * EAP_PAX_RAND_LEN, EAP_PAX_ICK_LEN, ick))
e, 2 * EAP_PAX_RAND_LEN, EAP_PAX_ICK_LEN, ick) ||
eap_pax_kdf(mac_id, mk, EAP_PAX_MK_LEN, "Method ID",
e, 2 * EAP_PAX_RAND_LEN, EAP_PAX_MID_LEN, mid))
return -1;
wpa_hexdump_key(MSG_MSGDUMP, "EAP-PAX: AK", ak, EAP_PAX_AK_LEN);
wpa_hexdump_key(MSG_MSGDUMP, "EAP-PAX: MK", mk, EAP_PAX_MK_LEN);
wpa_hexdump_key(MSG_MSGDUMP, "EAP-PAX: CK", ck, EAP_PAX_CK_LEN);
wpa_hexdump_key(MSG_MSGDUMP, "EAP-PAX: ICK", ick, EAP_PAX_ICK_LEN);
wpa_hexdump_key(MSG_MSGDUMP, "EAP-PAX: MID", mid, EAP_PAX_MID_LEN);
return 0;
}

3
src/eap_common/eap_pax_common.h
View file

@ -74,6 +74,7 @@ enum {
#define EAP_PAX_MK_LEN 16
#define EAP_PAX_CK_LEN 16
#define EAP_PAX_ICK_LEN 16
#define EAP_PAX_MID_LEN 16
int eap_pax_kdf(u8 mac_id, const u8 *key, size_t key_len,
@ -86,6 +87,6 @@ int eap_pax_mac(u8 mac_id, const u8 *key, size_t key_len,
const u8 *data3, size_t data3_len,
u8 *mac);
int eap_pax_initial_key_derivation(u8 mac_id, const u8 *ak, const u8 *e,
u8 *mk, u8 *ck, u8 *ick);
u8 *mk, u8 *ck, u8 *ick, u8 *mid);
#endif /* EAP_PAX_COMMON_H */

26
src/eap_peer/eap_pax.c
View file

@ -38,6 +38,7 @@ struct eap_pax_data {
u8 mk[EAP_PAX_MK_LEN];
u8 ck[EAP_PAX_CK_LEN];
u8 ick[EAP_PAX_ICK_LEN];
u8 mid[EAP_PAX_MID_LEN];
};
@ -178,8 +179,8 @@ static struct wpabuf * eap_pax_process_std_1(struct eap_pax_data *data,
data->rand.r.y, EAP_PAX_RAND_LEN);
if (eap_pax_initial_key_derivation(req->mac_id, data->ak, data->rand.e,
data->mk, data->ck, data->ick) < 0)
{
data->mk, data->ck, data->ick,
data->mid) < 0) {
ret->ignore = TRUE;
return NULL;
}
@ -501,6 +502,26 @@ static u8 * eap_pax_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
}
static u8 * eap_pax_get_session_id(struct eap_sm *sm, void *priv, size_t *len)
{
struct eap_pax_data *data = priv;
u8 *sid;
if (data->state != PAX_DONE)
return NULL;
sid = os_malloc(1 + EAP_PAX_MID_LEN);
if (sid == NULL)
return NULL;
*len = 1 + EAP_PAX_MID_LEN;
sid[0] = EAP_TYPE_PAX;
os_memcpy(sid + 1, data->mid, EAP_PAX_MID_LEN);
return sid;
}
int eap_peer_pax_register(void)
{
struct eap_method *eap;
@ -517,6 +538,7 @@ int eap_peer_pax_register(void)
eap->isKeyAvailable = eap_pax_isKeyAvailable;
eap->getKey = eap_pax_getKey;
eap->get_emsk = eap_pax_get_emsk;
eap->getSessionId = eap_pax_get_session_id;
ret = eap_peer_method_register(eap);
if (ret)

24
src/eap_server/eap_server_pax.c
View file

@ -36,6 +36,7 @@ struct eap_pax_data {
u8 mk[EAP_PAX_MK_LEN];
u8 ck[EAP_PAX_CK_LEN];
u8 ick[EAP_PAX_ICK_LEN];
u8 mid[EAP_PAX_MID_LEN];
int keys_set;
char *cid;
size_t cid_len;
@ -387,7 +388,7 @@ static void eap_pax_process_std_2(struct eap_sm *sm,
if (eap_pax_initial_key_derivation(data->mac_id, data->ak,
data->rand.e, data->mk, data->ck,
data->ick) < 0) {
data->ick, data->mid) < 0) {
wpa_printf(MSG_INFO, "EAP-PAX: Failed to complete initial "
"key derivation");
data->state = FAILURE;
@ -541,6 +542,26 @@ static Boolean eap_pax_isSuccess(struct eap_sm *sm, void *priv)
}
static u8 * eap_pax_get_session_id(struct eap_sm *sm, void *priv, size_t *len)
{
struct eap_pax_data *data = priv;
u8 *sid;
if (data->state != SUCCESS)
return NULL;
sid = os_malloc(1 + EAP_PAX_MID_LEN);
if (sid == NULL)
return NULL;
*len = 1 + EAP_PAX_MID_LEN;
sid[0] = EAP_TYPE_PAX;
os_memcpy(sid + 1, data->mid, EAP_PAX_MID_LEN);
return sid;
}
int eap_server_pax_register(void)
{
struct eap_method *eap;
@ -560,6 +581,7 @@ int eap_server_pax_register(void)
eap->getKey = eap_pax_getKey;
eap->isSuccess = eap_pax_isSuccess;
eap->get_emsk = eap_pax_get_emsk;
eap->getSessionId = eap_pax_get_session_id;
ret = eap_server_method_register(eap);
if (ret)