1 /* 2 * IKEv2 common routines for initiator and responder 3 * Copyright (c) 2007, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #include "common.h" 12 #include "crypto/crypto.h" 13 #include "crypto/md5.h" 14 #include "crypto/sha1.h" 15 #include "crypto/random.h" 16 #include "ikev2_common.h" 17 18 19 static const struct ikev2_integ_alg ikev2_integ_algs[] = { 20 { AUTH_HMAC_SHA1_96, 20, 12 }, 21 { AUTH_HMAC_MD5_96, 16, 12 } 22 }; 23 24 #define NUM_INTEG_ALGS ARRAY_SIZE(ikev2_integ_algs) 25 26 27 static const struct ikev2_prf_alg ikev2_prf_algs[] = { 28 { PRF_HMAC_SHA1, 20, 20 }, 29 { PRF_HMAC_MD5, 16, 16 } 30 }; 31 32 #define NUM_PRF_ALGS ARRAY_SIZE(ikev2_prf_algs) 33 34 35 static const struct ikev2_encr_alg ikev2_encr_algs[] = { 36 { ENCR_AES_CBC, 16, 16 }, /* only 128-bit keys supported for now */ 37 { ENCR_3DES, 24, 8 } 38 }; 39 40 #define NUM_ENCR_ALGS ARRAY_SIZE(ikev2_encr_algs) 41 42 ikev2_get_integ(int id)43 const struct ikev2_integ_alg * ikev2_get_integ(int id) 44 { 45 size_t i; 46 47 for (i = 0; i < NUM_INTEG_ALGS; i++) { 48 if (ikev2_integ_algs[i].id == id) 49 return &ikev2_integ_algs[i]; 50 } 51 52 return NULL; 53 } 54 55 ikev2_integ_hash(int alg,const u8 * key,size_t key_len,const u8 * data,size_t data_len,u8 * hash)56 int ikev2_integ_hash(int alg, const u8 *key, size_t key_len, const u8 *data, 57 size_t data_len, u8 *hash) 58 { 59 u8 tmphash[IKEV2_MAX_HASH_LEN]; 60 61 switch (alg) { 62 case AUTH_HMAC_SHA1_96: 63 if (key_len != 20) 64 return -1; 65 if (hmac_sha1(key, key_len, data, data_len, tmphash) < 0) 66 return -1; 67 os_memcpy(hash, tmphash, 12); 68 break; 69 case AUTH_HMAC_MD5_96: 70 if (key_len != 16) 71 return -1; 72 if (hmac_md5(key, key_len, data, data_len, tmphash) < 0) 73 return -1; 74 os_memcpy(hash, tmphash, 12); 75 break; 76 default: 77 return -1; 78 } 79 80 return 0; 81 } 82 83 ikev2_get_prf(int id)84 const struct ikev2_prf_alg * ikev2_get_prf(int id) 85 { 86 size_t i; 87 88 for (i = 0; i < NUM_PRF_ALGS; i++) { 89 if (ikev2_prf_algs[i].id == id) 90 return &ikev2_prf_algs[i]; 91 } 92 93 return NULL; 94 } 95 96 ikev2_prf_hash(int alg,const u8 * key,size_t key_len,size_t num_elem,const u8 * addr[],const size_t * len,u8 * hash)97 int ikev2_prf_hash(int alg, const u8 *key, size_t key_len, 98 size_t num_elem, const u8 *addr[], const size_t *len, 99 u8 *hash) 100 { 101 switch (alg) { 102 case PRF_HMAC_SHA1: 103 return hmac_sha1_vector(key, key_len, num_elem, addr, len, 104 hash); 105 case PRF_HMAC_MD5: 106 return hmac_md5_vector(key, key_len, num_elem, addr, len, hash); 107 default: 108 return -1; 109 } 110 } 111 112 ikev2_prf_plus(int alg,const u8 * key,size_t key_len,const u8 * data,size_t data_len,u8 * out,size_t out_len)113 int ikev2_prf_plus(int alg, const u8 *key, size_t key_len, 114 const u8 *data, size_t data_len, 115 u8 *out, size_t out_len) 116 { 117 u8 hash[IKEV2_MAX_HASH_LEN]; 118 size_t hash_len; 119 u8 iter, *pos, *end; 120 const u8 *addr[3]; 121 size_t len[3]; 122 const struct ikev2_prf_alg *prf; 123 int res; 124 125 prf = ikev2_get_prf(alg); 126 if (prf == NULL) 127 return -1; 128 hash_len = prf->hash_len; 129 130 addr[0] = hash; 131 len[0] = hash_len; 132 addr[1] = data; 133 len[1] = data_len; 134 addr[2] = &iter; 135 len[2] = 1; 136 137 pos = out; 138 end = out + out_len; 139 iter = 1; 140 while (pos < end) { 141 size_t clen; 142 if (iter == 1) 143 res = ikev2_prf_hash(alg, key, key_len, 2, &addr[1], 144 &len[1], hash); 145 else 146 res = ikev2_prf_hash(alg, key, key_len, 3, addr, len, 147 hash); 148 if (res < 0) 149 return -1; 150 clen = hash_len; 151 if ((int) clen > end - pos) 152 clen = end - pos; 153 os_memcpy(pos, hash, clen); 154 pos += clen; 155 iter++; 156 } 157 158 return 0; 159 } 160 161 ikev2_get_encr(int id)162 const struct ikev2_encr_alg * ikev2_get_encr(int id) 163 { 164 size_t i; 165 166 for (i = 0; i < NUM_ENCR_ALGS; i++) { 167 if (ikev2_encr_algs[i].id == id) 168 return &ikev2_encr_algs[i]; 169 } 170 171 return NULL; 172 } 173 174 ikev2_encr_encrypt(int alg,const u8 * key,size_t key_len,const u8 * iv,const u8 * plain,u8 * crypt,size_t len)175 int ikev2_encr_encrypt(int alg, const u8 *key, size_t key_len, const u8 *iv, 176 const u8 *plain, u8 *crypt, size_t len) 177 { 178 struct crypto_cipher *cipher; 179 int encr_alg; 180 181 switch (alg) { 182 case ENCR_3DES: 183 encr_alg = CRYPTO_CIPHER_ALG_3DES; 184 break; 185 case ENCR_AES_CBC: 186 encr_alg = CRYPTO_CIPHER_ALG_AES; 187 break; 188 default: 189 wpa_printf(MSG_DEBUG, "IKEV2: Unsupported encr alg %d", alg); 190 return -1; 191 } 192 193 cipher = crypto_cipher_init(encr_alg, iv, key, key_len); 194 if (cipher == NULL) { 195 wpa_printf(MSG_INFO, "IKEV2: Failed to initialize cipher"); 196 return -1; 197 } 198 199 if (crypto_cipher_encrypt(cipher, plain, crypt, len) < 0) { 200 wpa_printf(MSG_INFO, "IKEV2: Encryption failed"); 201 crypto_cipher_deinit(cipher); 202 return -1; 203 } 204 crypto_cipher_deinit(cipher); 205 206 return 0; 207 } 208 209 ikev2_encr_decrypt(int alg,const u8 * key,size_t key_len,const u8 * iv,const u8 * crypt,u8 * plain,size_t len)210 int ikev2_encr_decrypt(int alg, const u8 *key, size_t key_len, const u8 *iv, 211 const u8 *crypt, u8 *plain, size_t len) 212 { 213 struct crypto_cipher *cipher; 214 int encr_alg; 215 216 switch (alg) { 217 case ENCR_3DES: 218 encr_alg = CRYPTO_CIPHER_ALG_3DES; 219 break; 220 case ENCR_AES_CBC: 221 encr_alg = CRYPTO_CIPHER_ALG_AES; 222 break; 223 default: 224 wpa_printf(MSG_DEBUG, "IKEV2: Unsupported encr alg %d", alg); 225 return -1; 226 } 227 228 cipher = crypto_cipher_init(encr_alg, iv, key, key_len); 229 if (cipher == NULL) { 230 wpa_printf(MSG_INFO, "IKEV2: Failed to initialize cipher"); 231 return -1; 232 } 233 234 if (crypto_cipher_decrypt(cipher, crypt, plain, len) < 0) { 235 wpa_printf(MSG_INFO, "IKEV2: Decryption failed"); 236 crypto_cipher_deinit(cipher); 237 return -1; 238 } 239 crypto_cipher_deinit(cipher); 240 241 return 0; 242 } 243 244 ikev2_parse_payloads(struct ikev2_payloads * payloads,u8 next_payload,const u8 * pos,const u8 * end)245 int ikev2_parse_payloads(struct ikev2_payloads *payloads, 246 u8 next_payload, const u8 *pos, const u8 *end) 247 { 248 const struct ikev2_payload_hdr *phdr; 249 250 os_memset(payloads, 0, sizeof(*payloads)); 251 252 while (next_payload != IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) { 253 unsigned int plen, pdatalen, left; 254 const u8 *pdata; 255 wpa_printf(MSG_DEBUG, "IKEV2: Processing payload %u", 256 next_payload); 257 if (end < pos) 258 return -1; 259 left = end - pos; 260 if (left < sizeof(*phdr)) { 261 wpa_printf(MSG_INFO, "IKEV2: Too short message for " 262 "payload header (left=%ld)", 263 (long) (end - pos)); 264 return -1; 265 } 266 phdr = (const struct ikev2_payload_hdr *) pos; 267 plen = WPA_GET_BE16(phdr->payload_length); 268 if (plen < sizeof(*phdr) || plen > left) { 269 wpa_printf(MSG_INFO, "IKEV2: Invalid payload header " 270 "length %d", plen); 271 return -1; 272 } 273 274 wpa_printf(MSG_DEBUG, "IKEV2: Next Payload: %u Flags: 0x%x" 275 " Payload Length: %u", 276 phdr->next_payload, phdr->flags, plen); 277 278 pdata = (const u8 *) (phdr + 1); 279 pdatalen = plen - sizeof(*phdr); 280 281 switch (next_payload) { 282 case IKEV2_PAYLOAD_SA: 283 wpa_printf(MSG_DEBUG, "IKEV2: Payload: Security " 284 "Association"); 285 payloads->sa = pdata; 286 payloads->sa_len = pdatalen; 287 break; 288 case IKEV2_PAYLOAD_KEY_EXCHANGE: 289 wpa_printf(MSG_DEBUG, "IKEV2: Payload: Key " 290 "Exchange"); 291 payloads->ke = pdata; 292 payloads->ke_len = pdatalen; 293 break; 294 case IKEV2_PAYLOAD_IDi: 295 wpa_printf(MSG_DEBUG, "IKEV2: Payload: IDi"); 296 payloads->idi = pdata; 297 payloads->idi_len = pdatalen; 298 break; 299 case IKEV2_PAYLOAD_IDr: 300 wpa_printf(MSG_DEBUG, "IKEV2: Payload: IDr"); 301 payloads->idr = pdata; 302 payloads->idr_len = pdatalen; 303 break; 304 case IKEV2_PAYLOAD_CERTIFICATE: 305 wpa_printf(MSG_DEBUG, "IKEV2: Payload: Certificate"); 306 payloads->cert = pdata; 307 payloads->cert_len = pdatalen; 308 break; 309 case IKEV2_PAYLOAD_AUTHENTICATION: 310 wpa_printf(MSG_DEBUG, "IKEV2: Payload: " 311 "Authentication"); 312 payloads->auth = pdata; 313 payloads->auth_len = pdatalen; 314 break; 315 case IKEV2_PAYLOAD_NONCE: 316 wpa_printf(MSG_DEBUG, "IKEV2: Payload: Nonce"); 317 payloads->nonce = pdata; 318 payloads->nonce_len = pdatalen; 319 break; 320 case IKEV2_PAYLOAD_ENCRYPTED: 321 wpa_printf(MSG_DEBUG, "IKEV2: Payload: Encrypted"); 322 payloads->encrypted = pdata; 323 payloads->encrypted_len = pdatalen; 324 break; 325 case IKEV2_PAYLOAD_NOTIFICATION: 326 wpa_printf(MSG_DEBUG, "IKEV2: Payload: " 327 "Notification"); 328 payloads->notification = pdata; 329 payloads->notification_len = pdatalen; 330 break; 331 default: 332 if (phdr->flags & IKEV2_PAYLOAD_FLAGS_CRITICAL) { 333 wpa_printf(MSG_INFO, "IKEV2: Unsupported " 334 "critical payload %u - reject the " 335 "entire message", next_payload); 336 return -1; 337 } else { 338 wpa_printf(MSG_DEBUG, "IKEV2: Skipped " 339 "unsupported payload %u", 340 next_payload); 341 } 342 } 343 344 if (next_payload == IKEV2_PAYLOAD_ENCRYPTED && 345 pos + plen == end) { 346 /* 347 * Next Payload in the case of Encrypted Payload is 348 * actually the payload type for the first embedded 349 * payload. 350 */ 351 payloads->encr_next_payload = phdr->next_payload; 352 next_payload = IKEV2_PAYLOAD_NO_NEXT_PAYLOAD; 353 } else 354 next_payload = phdr->next_payload; 355 356 pos += plen; 357 } 358 359 if (pos != end) { 360 wpa_printf(MSG_INFO, "IKEV2: Unexpected extra data after " 361 "payloads"); 362 return -1; 363 } 364 365 return 0; 366 } 367 368 ikev2_derive_auth_data(int prf_alg,const struct wpabuf * sign_msg,const u8 * ID,size_t ID_len,u8 ID_type,struct ikev2_keys * keys,int initiator,const u8 * shared_secret,size_t shared_secret_len,const u8 * nonce,size_t nonce_len,const u8 * key_pad,size_t key_pad_len,u8 * auth_data)369 int ikev2_derive_auth_data(int prf_alg, const struct wpabuf *sign_msg, 370 const u8 *ID, size_t ID_len, u8 ID_type, 371 struct ikev2_keys *keys, int initiator, 372 const u8 *shared_secret, size_t shared_secret_len, 373 const u8 *nonce, size_t nonce_len, 374 const u8 *key_pad, size_t key_pad_len, 375 u8 *auth_data) 376 { 377 size_t sign_len, buf_len; 378 u8 *sign_data, *pos, *buf, hash[IKEV2_MAX_HASH_LEN]; 379 const struct ikev2_prf_alg *prf; 380 const u8 *SK_p = initiator ? keys->SK_pi : keys->SK_pr; 381 382 prf = ikev2_get_prf(prf_alg); 383 if (sign_msg == NULL || ID == NULL || SK_p == NULL || 384 shared_secret == NULL || nonce == NULL || prf == NULL) 385 return -1; 386 387 /* prf(SK_pi/r,IDi/r') */ 388 buf_len = 4 + ID_len; 389 buf = os_zalloc(buf_len); 390 if (buf == NULL) 391 return -1; 392 buf[0] = ID_type; 393 os_memcpy(buf + 4, ID, ID_len); 394 if (ikev2_prf_hash(prf->id, SK_p, keys->SK_prf_len, 395 1, (const u8 **) &buf, &buf_len, hash) < 0) { 396 os_free(buf); 397 return -1; 398 } 399 os_free(buf); 400 401 /* sign_data = msg | Nr/i | prf(SK_pi/r,IDi/r') */ 402 sign_len = wpabuf_len(sign_msg) + nonce_len + prf->hash_len; 403 sign_data = os_malloc(sign_len); 404 if (sign_data == NULL) 405 return -1; 406 pos = sign_data; 407 os_memcpy(pos, wpabuf_head(sign_msg), wpabuf_len(sign_msg)); 408 pos += wpabuf_len(sign_msg); 409 os_memcpy(pos, nonce, nonce_len); 410 pos += nonce_len; 411 os_memcpy(pos, hash, prf->hash_len); 412 413 /* AUTH = prf(prf(Shared Secret, key pad, sign_data) */ 414 if (ikev2_prf_hash(prf->id, shared_secret, shared_secret_len, 1, 415 &key_pad, &key_pad_len, hash) < 0 || 416 ikev2_prf_hash(prf->id, hash, prf->hash_len, 1, 417 (const u8 **) &sign_data, &sign_len, auth_data) < 0) 418 { 419 os_free(sign_data); 420 return -1; 421 } 422 os_free(sign_data); 423 424 return 0; 425 } 426 427 ikev2_decrypt_payload(int encr_id,int integ_id,struct ikev2_keys * keys,int initiator,const struct ikev2_hdr * hdr,const u8 * encrypted,size_t encrypted_len,size_t * res_len)428 u8 * ikev2_decrypt_payload(int encr_id, int integ_id, 429 struct ikev2_keys *keys, int initiator, 430 const struct ikev2_hdr *hdr, 431 const u8 *encrypted, size_t encrypted_len, 432 size_t *res_len) 433 { 434 size_t iv_len; 435 const u8 *pos, *end, *iv, *integ; 436 u8 hash[IKEV2_MAX_HASH_LEN], *decrypted; 437 size_t decrypted_len, pad_len; 438 const struct ikev2_integ_alg *integ_alg; 439 const struct ikev2_encr_alg *encr_alg; 440 const u8 *SK_e = initiator ? keys->SK_ei : keys->SK_er; 441 const u8 *SK_a = initiator ? keys->SK_ai : keys->SK_ar; 442 443 if (encrypted == NULL) { 444 wpa_printf(MSG_INFO, "IKEV2: No Encrypted payload in SA_AUTH"); 445 return NULL; 446 } 447 448 encr_alg = ikev2_get_encr(encr_id); 449 if (encr_alg == NULL) { 450 wpa_printf(MSG_INFO, "IKEV2: Unsupported encryption type"); 451 return NULL; 452 } 453 iv_len = encr_alg->block_size; 454 455 integ_alg = ikev2_get_integ(integ_id); 456 if (integ_alg == NULL) { 457 wpa_printf(MSG_INFO, "IKEV2: Unsupported intergrity type"); 458 return NULL; 459 } 460 461 if (encrypted_len < iv_len + 1 + integ_alg->hash_len) { 462 wpa_printf(MSG_INFO, "IKEV2: No room for IV or Integrity " 463 "Checksum"); 464 return NULL; 465 } 466 467 iv = encrypted; 468 pos = iv + iv_len; 469 end = encrypted + encrypted_len; 470 integ = end - integ_alg->hash_len; 471 472 if (SK_a == NULL) { 473 wpa_printf(MSG_INFO, "IKEV2: No SK_a available"); 474 return NULL; 475 } 476 if (ikev2_integ_hash(integ_id, SK_a, keys->SK_integ_len, 477 (const u8 *) hdr, 478 integ - (const u8 *) hdr, hash) < 0) { 479 wpa_printf(MSG_INFO, "IKEV2: Failed to calculate integrity " 480 "hash"); 481 return NULL; 482 } 483 if (os_memcmp_const(integ, hash, integ_alg->hash_len) != 0) { 484 wpa_printf(MSG_INFO, "IKEV2: Incorrect Integrity Checksum " 485 "Data"); 486 return NULL; 487 } 488 489 if (SK_e == NULL) { 490 wpa_printf(MSG_INFO, "IKEV2: No SK_e available"); 491 return NULL; 492 } 493 494 decrypted_len = integ - pos; 495 decrypted = os_malloc(decrypted_len); 496 if (decrypted == NULL) 497 return NULL; 498 499 if (ikev2_encr_decrypt(encr_alg->id, SK_e, keys->SK_encr_len, iv, pos, 500 decrypted, decrypted_len) < 0) { 501 os_free(decrypted); 502 return NULL; 503 } 504 505 pad_len = decrypted[decrypted_len - 1]; 506 if (decrypted_len < pad_len + 1) { 507 wpa_printf(MSG_INFO, "IKEV2: Invalid padding in encrypted " 508 "payload"); 509 os_free(decrypted); 510 return NULL; 511 } 512 513 decrypted_len -= pad_len + 1; 514 515 *res_len = decrypted_len; 516 return decrypted; 517 } 518 519 ikev2_update_hdr(struct wpabuf * msg)520 void ikev2_update_hdr(struct wpabuf *msg) 521 { 522 struct ikev2_hdr *hdr; 523 524 /* Update lenth field in HDR */ 525 hdr = wpabuf_mhead(msg); 526 WPA_PUT_BE32(hdr->length, wpabuf_len(msg)); 527 } 528 529 ikev2_build_encrypted(int encr_id,int integ_id,struct ikev2_keys * keys,int initiator,struct wpabuf * msg,struct wpabuf * plain,u8 next_payload)530 int ikev2_build_encrypted(int encr_id, int integ_id, struct ikev2_keys *keys, 531 int initiator, struct wpabuf *msg, 532 struct wpabuf *plain, u8 next_payload) 533 { 534 struct ikev2_payload_hdr *phdr; 535 size_t plen; 536 size_t iv_len, pad_len; 537 u8 *icv, *iv; 538 const struct ikev2_integ_alg *integ_alg; 539 const struct ikev2_encr_alg *encr_alg; 540 const u8 *SK_e = initiator ? keys->SK_ei : keys->SK_er; 541 const u8 *SK_a = initiator ? keys->SK_ai : keys->SK_ar; 542 543 wpa_printf(MSG_DEBUG, "IKEV2: Adding Encrypted payload"); 544 545 /* Encr - RFC 4306, Sect. 3.14 */ 546 547 encr_alg = ikev2_get_encr(encr_id); 548 if (encr_alg == NULL) { 549 wpa_printf(MSG_INFO, "IKEV2: Unsupported encryption type"); 550 return -1; 551 } 552 iv_len = encr_alg->block_size; 553 554 integ_alg = ikev2_get_integ(integ_id); 555 if (integ_alg == NULL) { 556 wpa_printf(MSG_INFO, "IKEV2: Unsupported intergrity type"); 557 return -1; 558 } 559 560 if (SK_e == NULL) { 561 wpa_printf(MSG_INFO, "IKEV2: No SK_e available"); 562 return -1; 563 } 564 565 if (SK_a == NULL) { 566 wpa_printf(MSG_INFO, "IKEV2: No SK_a available"); 567 return -1; 568 } 569 570 phdr = wpabuf_put(msg, sizeof(*phdr)); 571 phdr->next_payload = next_payload; 572 phdr->flags = 0; 573 574 iv = wpabuf_put(msg, iv_len); 575 if (random_get_bytes(iv, iv_len)) { 576 wpa_printf(MSG_INFO, "IKEV2: Could not generate IV"); 577 return -1; 578 } 579 580 pad_len = iv_len - (wpabuf_len(plain) + 1) % iv_len; 581 if (pad_len == iv_len) 582 pad_len = 0; 583 wpabuf_put(plain, pad_len); 584 wpabuf_put_u8(plain, pad_len); 585 586 if (ikev2_encr_encrypt(encr_alg->id, SK_e, keys->SK_encr_len, iv, 587 wpabuf_head(plain), wpabuf_mhead(plain), 588 wpabuf_len(plain)) < 0) 589 return -1; 590 591 wpabuf_put_buf(msg, plain); 592 593 /* Need to update all headers (Length fields) prior to hash func */ 594 icv = wpabuf_put(msg, integ_alg->hash_len); 595 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 596 WPA_PUT_BE16(phdr->payload_length, plen); 597 598 ikev2_update_hdr(msg); 599 600 return ikev2_integ_hash(integ_id, SK_a, keys->SK_integ_len, 601 wpabuf_head(msg), 602 wpabuf_len(msg) - integ_alg->hash_len, icv); 603 604 return 0; 605 } 606 607 ikev2_keys_set(struct ikev2_keys * keys)608 int ikev2_keys_set(struct ikev2_keys *keys) 609 { 610 return keys->SK_d && keys->SK_ai && keys->SK_ar && keys->SK_ei && 611 keys->SK_er && keys->SK_pi && keys->SK_pr; 612 } 613 614 ikev2_free_keys(struct ikev2_keys * keys)615 void ikev2_free_keys(struct ikev2_keys *keys) 616 { 617 os_free(keys->SK_d); 618 os_free(keys->SK_ai); 619 os_free(keys->SK_ar); 620 os_free(keys->SK_ei); 621 os_free(keys->SK_er); 622 os_free(keys->SK_pi); 623 os_free(keys->SK_pr); 624 keys->SK_d = keys->SK_ai = keys->SK_ar = keys->SK_ei = keys->SK_er = 625 keys->SK_pi = keys->SK_pr = NULL; 626 } 627 628 ikev2_derive_sk_keys(const struct ikev2_prf_alg * prf,const struct ikev2_integ_alg * integ,const struct ikev2_encr_alg * encr,const u8 * skeyseed,const u8 * data,size_t data_len,struct ikev2_keys * keys)629 int ikev2_derive_sk_keys(const struct ikev2_prf_alg *prf, 630 const struct ikev2_integ_alg *integ, 631 const struct ikev2_encr_alg *encr, 632 const u8 *skeyseed, const u8 *data, size_t data_len, 633 struct ikev2_keys *keys) 634 { 635 u8 *keybuf, *pos; 636 size_t keybuf_len; 637 638 /* 639 * {SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr } = 640 * prf+(SKEYSEED, Ni | Nr | SPIi | SPIr ) 641 */ 642 ikev2_free_keys(keys); 643 keys->SK_d_len = prf->key_len; 644 keys->SK_integ_len = integ->key_len; 645 keys->SK_encr_len = encr->key_len; 646 keys->SK_prf_len = prf->key_len; 647 648 keybuf_len = keys->SK_d_len + 2 * keys->SK_integ_len + 649 2 * keys->SK_encr_len + 2 * keys->SK_prf_len; 650 keybuf = os_malloc(keybuf_len); 651 if (keybuf == NULL) 652 return -1; 653 654 if (ikev2_prf_plus(prf->id, skeyseed, prf->hash_len, 655 data, data_len, keybuf, keybuf_len)) { 656 os_free(keybuf); 657 return -1; 658 } 659 660 pos = keybuf; 661 662 keys->SK_d = os_malloc(keys->SK_d_len); 663 if (keys->SK_d) { 664 os_memcpy(keys->SK_d, pos, keys->SK_d_len); 665 wpa_hexdump_key(MSG_DEBUG, "IKEV2: SK_d", 666 keys->SK_d, keys->SK_d_len); 667 } 668 pos += keys->SK_d_len; 669 670 keys->SK_ai = os_malloc(keys->SK_integ_len); 671 if (keys->SK_ai) { 672 os_memcpy(keys->SK_ai, pos, keys->SK_integ_len); 673 wpa_hexdump_key(MSG_DEBUG, "IKEV2: SK_ai", 674 keys->SK_ai, keys->SK_integ_len); 675 } 676 pos += keys->SK_integ_len; 677 678 keys->SK_ar = os_malloc(keys->SK_integ_len); 679 if (keys->SK_ar) { 680 os_memcpy(keys->SK_ar, pos, keys->SK_integ_len); 681 wpa_hexdump_key(MSG_DEBUG, "IKEV2: SK_ar", 682 keys->SK_ar, keys->SK_integ_len); 683 } 684 pos += keys->SK_integ_len; 685 686 keys->SK_ei = os_malloc(keys->SK_encr_len); 687 if (keys->SK_ei) { 688 os_memcpy(keys->SK_ei, pos, keys->SK_encr_len); 689 wpa_hexdump_key(MSG_DEBUG, "IKEV2: SK_ei", 690 keys->SK_ei, keys->SK_encr_len); 691 } 692 pos += keys->SK_encr_len; 693 694 keys->SK_er = os_malloc(keys->SK_encr_len); 695 if (keys->SK_er) { 696 os_memcpy(keys->SK_er, pos, keys->SK_encr_len); 697 wpa_hexdump_key(MSG_DEBUG, "IKEV2: SK_er", 698 keys->SK_er, keys->SK_encr_len); 699 } 700 pos += keys->SK_encr_len; 701 702 keys->SK_pi = os_malloc(keys->SK_prf_len); 703 if (keys->SK_pi) { 704 os_memcpy(keys->SK_pi, pos, keys->SK_prf_len); 705 wpa_hexdump_key(MSG_DEBUG, "IKEV2: SK_pi", 706 keys->SK_pi, keys->SK_prf_len); 707 } 708 pos += keys->SK_prf_len; 709 710 keys->SK_pr = os_malloc(keys->SK_prf_len); 711 if (keys->SK_pr) { 712 os_memcpy(keys->SK_pr, pos, keys->SK_prf_len); 713 wpa_hexdump_key(MSG_DEBUG, "IKEV2: SK_pr", 714 keys->SK_pr, keys->SK_prf_len); 715 } 716 717 os_free(keybuf); 718 719 if (!ikev2_keys_set(keys)) { 720 ikev2_free_keys(keys); 721 return -1; 722 } 723 724 return 0; 725 } 726