DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

EAP-SIM/AKA: Separate identity for MK derivation

Browse source 
This allows a separate configuration parameter (imsi_identity) to be
used in EAP-SIM/AKA/AKA' profiles to override the identity used in MK
derivation for the case where the identity is expected to be from the
last AT_IDENTITY attribute (or EAP-Response/Identity if AT_IDENTITY was
not used). This may be needed to avoid sending out an unprotected
permanent identity information over-the-air and if the EAP-SIM/AKA
server ends up using a value based on the real IMSI during the internal
key derivation operation (that does not expose the data to others).

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Jouni Malinen 2017-12-08 17:05:40 +02:00 • committed by Jouni Malinen
parent b6b5e3554a
commit 9e834fc648
6 changed files with 29 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/eap_peer/eap_aka.c
View file

@ -1025,8 +1025,17 @@ static struct wpabuf * eap_aka_process_challenge(struct eap_sm *sm,
} else if (data->pseudonym) {
identity = data->pseudonym;
identity_len = data->pseudonym_len;
} else
identity = eap_get_config_identity(sm, &identity_len);
} else {
struct eap_peer_config *config;
config = eap_get_config(sm);
if (config && config->imsi_identity) {
identity = config->imsi_identity;
identity_len = config->imsi_identity_len;
} else {
identity = eap_get_config_identity(sm, &identity_len);
}
}
wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Selected identity for MK "
"derivation", identity, identity_len);
if (data->eap_method == EAP_TYPE_AKA_PRIME) {

3
src/eap_peer/eap_config.h
View file

@ -46,6 +46,9 @@ struct eap_peer_config {
*/
size_t anonymous_identity_len;
u8 *imsi_identity;
size_t imsi_identity_len;
/**
* password - Password string for EAP
*

13
src/eap_peer/eap_sim.c
View file

@ -767,8 +767,17 @@ static struct wpabuf * eap_sim_process_challenge(struct eap_sm *sm,
} else if (data->pseudonym) {
identity = data->pseudonym;
identity_len = data->pseudonym_len;
} else
identity = eap_get_config_identity(sm, &identity_len);
} else {
struct eap_peer_config *config;
config = eap_get_config(sm);
if (config && config->imsi_identity) {
identity = config->imsi_identity;
identity_len = config->imsi_identity_len;
} else {
identity = eap_get_config_identity(sm, &identity_len);
}
}
wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM: Selected identity for MK "
"derivation", identity, identity_len);
eap_sim_derive_mk(identity, identity_len, data->nonce_mt,