Neels Hofmeyr | 17518fe | 2017-06-20 04:35:06 +0200 | [diff] [blame] | 1 | /*! \file milenage.c |
| 2 | * 3GPP AKA - Milenage algorithm (3GPP TS 35.205, .206, .207, .208) */ |
Harald Welte | 781bd5d | 2011-12-06 22:23:52 +0100 | [diff] [blame] | 3 | /* |
Harald Welte | 781bd5d | 2011-12-06 22:23:52 +0100 | [diff] [blame] | 4 | * Copyright (c) 2006-2007 <j@w1.fi> |
| 5 | * |
| 6 | * This program is free software; you can redistribute it and/or modify |
| 7 | * it under the terms of the GNU General Public License version 2 as |
| 8 | * published by the Free Software Foundation. |
| 9 | * |
| 10 | * Alternatively, this software may be distributed under the terms of BSD |
| 11 | * license. |
| 12 | * |
| 13 | * See README and COPYING for more details. |
| 14 | * |
Harald Welte | e08da97 | 2017-11-13 01:00:26 +0900 | [diff] [blame] | 15 | * SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause |
| 16 | * |
Harald Welte | 781bd5d | 2011-12-06 22:23:52 +0100 | [diff] [blame] | 17 | * This file implements an example authentication algorithm defined for 3GPP |
| 18 | * AKA. This can be used to implement a simple HLR/AuC into hlr_auc_gw to allow |
| 19 | * EAP-AKA to be tested properly with real USIM cards. |
| 20 | * |
| 21 | * This implementations assumes that the r1..r5 and c1..c5 constants defined in |
| 22 | * TS 35.206 are used, i.e., r1=64, r2=0, r3=32, r4=64, r5=96, c1=00..00, |
| 23 | * c2=00..01, c3=00..02, c4=00..04, c5=00..08. The block cipher is assumed to |
| 24 | * be AES (Rijndael). |
| 25 | */ |
| 26 | |
| 27 | #include "includes.h" |
| 28 | |
| 29 | #include "common.h" |
| 30 | #include "aes_wrap.h" |
| 31 | #include "milenage.h" |
Neels Hofmeyr | aa84b71 | 2017-12-18 03:12:01 +0100 | [diff] [blame] | 32 | #include <osmocom/crypt/auth.h> |
Harald Welte | 781bd5d | 2011-12-06 22:23:52 +0100 | [diff] [blame] | 33 | |
| 34 | /** |
| 35 | * milenage_f1 - Milenage f1 and f1* algorithms |
| 36 | * @opc: OPc = 128-bit value derived from OP and K |
| 37 | * @k: K = 128-bit subscriber key |
| 38 | * @_rand: RAND = 128-bit random challenge |
| 39 | * @sqn: SQN = 48-bit sequence number |
| 40 | * @amf: AMF = 16-bit authentication management field |
| 41 | * @mac_a: Buffer for MAC-A = 64-bit network authentication code, or %NULL |
| 42 | * @mac_s: Buffer for MAC-S = 64-bit resync authentication code, or %NULL |
| 43 | * Returns: 0 on success, -1 on failure |
| 44 | */ |
| 45 | int milenage_f1(const u8 *opc, const u8 *k, const u8 *_rand, |
| 46 | const u8 *sqn, const u8 *amf, u8 *mac_a, u8 *mac_s) |
| 47 | { |
| 48 | u8 tmp1[16], tmp2[16], tmp3[16]; |
| 49 | int i; |
| 50 | |
| 51 | /* tmp1 = TEMP = E_K(RAND XOR OP_C) */ |
| 52 | for (i = 0; i < 16; i++) |
| 53 | tmp1[i] = _rand[i] ^ opc[i]; |
| 54 | if (aes_128_encrypt_block(k, tmp1, tmp1)) |
| 55 | return -1; |
| 56 | |
| 57 | /* tmp2 = IN1 = SQN || AMF || SQN || AMF */ |
| 58 | os_memcpy(tmp2, sqn, 6); |
| 59 | os_memcpy(tmp2 + 6, amf, 2); |
| 60 | os_memcpy(tmp2 + 8, tmp2, 8); |
| 61 | |
| 62 | /* OUT1 = E_K(TEMP XOR rot(IN1 XOR OP_C, r1) XOR c1) XOR OP_C */ |
| 63 | |
| 64 | /* rotate (tmp2 XOR OP_C) by r1 (= 0x40 = 8 bytes) */ |
| 65 | for (i = 0; i < 16; i++) |
| 66 | tmp3[(i + 8) % 16] = tmp2[i] ^ opc[i]; |
| 67 | /* XOR with TEMP = E_K(RAND XOR OP_C) */ |
| 68 | for (i = 0; i < 16; i++) |
| 69 | tmp3[i] ^= tmp1[i]; |
| 70 | /* XOR with c1 (= ..00, i.e., NOP) */ |
| 71 | |
| 72 | /* f1 || f1* = E_K(tmp3) XOR OP_c */ |
| 73 | if (aes_128_encrypt_block(k, tmp3, tmp1)) |
| 74 | return -1; |
| 75 | for (i = 0; i < 16; i++) |
| 76 | tmp1[i] ^= opc[i]; |
| 77 | if (mac_a) |
| 78 | os_memcpy(mac_a, tmp1, 8); /* f1 */ |
| 79 | if (mac_s) |
| 80 | os_memcpy(mac_s, tmp1 + 8, 8); /* f1* */ |
| 81 | return 0; |
| 82 | } |
| 83 | |
| 84 | |
| 85 | /** |
| 86 | * milenage_f2345 - Milenage f2, f3, f4, f5, f5* algorithms |
| 87 | * @opc: OPc = 128-bit value derived from OP and K |
| 88 | * @k: K = 128-bit subscriber key |
| 89 | * @_rand: RAND = 128-bit random challenge |
| 90 | * @res: Buffer for RES = 64-bit signed response (f2), or %NULL |
| 91 | * @ck: Buffer for CK = 128-bit confidentiality key (f3), or %NULL |
| 92 | * @ik: Buffer for IK = 128-bit integrity key (f4), or %NULL |
| 93 | * @ak: Buffer for AK = 48-bit anonymity key (f5), or %NULL |
| 94 | * @akstar: Buffer for AK = 48-bit anonymity key (f5*), or %NULL |
| 95 | * Returns: 0 on success, -1 on failure |
| 96 | */ |
| 97 | int milenage_f2345(const u8 *opc, const u8 *k, const u8 *_rand, |
| 98 | u8 *res, u8 *ck, u8 *ik, u8 *ak, u8 *akstar) |
| 99 | { |
| 100 | u8 tmp1[16], tmp2[16], tmp3[16]; |
| 101 | int i; |
| 102 | |
| 103 | /* tmp2 = TEMP = E_K(RAND XOR OP_C) */ |
| 104 | for (i = 0; i < 16; i++) |
| 105 | tmp1[i] = _rand[i] ^ opc[i]; |
| 106 | if (aes_128_encrypt_block(k, tmp1, tmp2)) |
| 107 | return -1; |
| 108 | |
| 109 | /* OUT2 = E_K(rot(TEMP XOR OP_C, r2) XOR c2) XOR OP_C */ |
| 110 | /* OUT3 = E_K(rot(TEMP XOR OP_C, r3) XOR c3) XOR OP_C */ |
| 111 | /* OUT4 = E_K(rot(TEMP XOR OP_C, r4) XOR c4) XOR OP_C */ |
| 112 | /* OUT5 = E_K(rot(TEMP XOR OP_C, r5) XOR c5) XOR OP_C */ |
| 113 | |
| 114 | /* f2 and f5 */ |
| 115 | /* rotate by r2 (= 0, i.e., NOP) */ |
| 116 | for (i = 0; i < 16; i++) |
| 117 | tmp1[i] = tmp2[i] ^ opc[i]; |
| 118 | tmp1[15] ^= 1; /* XOR c2 (= ..01) */ |
| 119 | /* f5 || f2 = E_K(tmp1) XOR OP_c */ |
| 120 | if (aes_128_encrypt_block(k, tmp1, tmp3)) |
| 121 | return -1; |
| 122 | for (i = 0; i < 16; i++) |
| 123 | tmp3[i] ^= opc[i]; |
| 124 | if (res) |
| 125 | os_memcpy(res, tmp3 + 8, 8); /* f2 */ |
| 126 | if (ak) |
| 127 | os_memcpy(ak, tmp3, 6); /* f5 */ |
| 128 | |
| 129 | /* f3 */ |
| 130 | if (ck) { |
| 131 | /* rotate by r3 = 0x20 = 4 bytes */ |
| 132 | for (i = 0; i < 16; i++) |
| 133 | tmp1[(i + 12) % 16] = tmp2[i] ^ opc[i]; |
| 134 | tmp1[15] ^= 2; /* XOR c3 (= ..02) */ |
| 135 | if (aes_128_encrypt_block(k, tmp1, ck)) |
| 136 | return -1; |
| 137 | for (i = 0; i < 16; i++) |
| 138 | ck[i] ^= opc[i]; |
| 139 | } |
| 140 | |
| 141 | /* f4 */ |
| 142 | if (ik) { |
| 143 | /* rotate by r4 = 0x40 = 8 bytes */ |
| 144 | for (i = 0; i < 16; i++) |
| 145 | tmp1[(i + 8) % 16] = tmp2[i] ^ opc[i]; |
| 146 | tmp1[15] ^= 4; /* XOR c4 (= ..04) */ |
| 147 | if (aes_128_encrypt_block(k, tmp1, ik)) |
| 148 | return -1; |
| 149 | for (i = 0; i < 16; i++) |
| 150 | ik[i] ^= opc[i]; |
| 151 | } |
| 152 | |
| 153 | /* f5* */ |
| 154 | if (akstar) { |
| 155 | /* rotate by r5 = 0x60 = 12 bytes */ |
| 156 | for (i = 0; i < 16; i++) |
| 157 | tmp1[(i + 4) % 16] = tmp2[i] ^ opc[i]; |
| 158 | tmp1[15] ^= 8; /* XOR c5 (= ..08) */ |
| 159 | if (aes_128_encrypt_block(k, tmp1, tmp1)) |
| 160 | return -1; |
| 161 | for (i = 0; i < 6; i++) |
| 162 | akstar[i] = tmp1[i] ^ opc[i]; |
| 163 | } |
| 164 | |
| 165 | return 0; |
| 166 | } |
| 167 | |
| 168 | |
| 169 | /** |
| 170 | * milenage_generate - Generate AKA AUTN,IK,CK,RES |
| 171 | * @opc: OPc = 128-bit operator variant algorithm configuration field (encr.) |
| 172 | * @amf: AMF = 16-bit authentication management field |
| 173 | * @k: K = 128-bit subscriber key |
| 174 | * @sqn: SQN = 48-bit sequence number |
| 175 | * @_rand: RAND = 128-bit random challenge |
| 176 | * @autn: Buffer for AUTN = 128-bit authentication token |
| 177 | * @ik: Buffer for IK = 128-bit integrity key (f4), or %NULL |
| 178 | * @ck: Buffer for CK = 128-bit confidentiality key (f3), or %NULL |
| 179 | * @res: Buffer for RES = 64-bit signed response (f2), or %NULL |
| 180 | * @res_len: Max length for res; set to used length or 0 on failure |
| 181 | */ |
| 182 | void milenage_generate(const u8 *opc, const u8 *amf, const u8 *k, |
| 183 | const u8 *sqn, const u8 *_rand, u8 *autn, u8 *ik, |
| 184 | u8 *ck, u8 *res, size_t *res_len) |
| 185 | { |
| 186 | int i; |
| 187 | u8 mac_a[8], ak[6]; |
| 188 | |
| 189 | if (*res_len < 8) { |
| 190 | *res_len = 0; |
| 191 | return; |
| 192 | } |
| 193 | if (milenage_f1(opc, k, _rand, sqn, amf, mac_a, NULL) || |
| 194 | milenage_f2345(opc, k, _rand, res, ck, ik, ak, NULL)) { |
| 195 | *res_len = 0; |
| 196 | return; |
| 197 | } |
| 198 | *res_len = 8; |
| 199 | |
| 200 | /* AUTN = (SQN ^ AK) || AMF || MAC */ |
| 201 | for (i = 0; i < 6; i++) |
| 202 | autn[i] = sqn[i] ^ ak[i]; |
| 203 | os_memcpy(autn + 6, amf, 2); |
| 204 | os_memcpy(autn + 8, mac_a, 8); |
| 205 | } |
| 206 | |
| 207 | |
| 208 | /** |
| 209 | * milenage_auts - Milenage AUTS validation |
| 210 | * @opc: OPc = 128-bit operator variant algorithm configuration field (encr.) |
| 211 | * @k: K = 128-bit subscriber key |
| 212 | * @_rand: RAND = 128-bit random challenge |
| 213 | * @auts: AUTS = 112-bit authentication token from client |
| 214 | * @sqn: Buffer for SQN = 48-bit sequence number |
| 215 | * Returns: 0 = success (sqn filled), -1 on failure |
| 216 | */ |
| 217 | int milenage_auts(const u8 *opc, const u8 *k, const u8 *_rand, const u8 *auts, |
| 218 | u8 *sqn) |
| 219 | { |
| 220 | u8 amf[2] = { 0x00, 0x00 }; /* TS 33.102 v7.0.0, 6.3.3 */ |
| 221 | u8 ak[6], mac_s[8]; |
| 222 | int i; |
| 223 | |
| 224 | if (milenage_f2345(opc, k, _rand, NULL, NULL, NULL, NULL, ak)) |
| 225 | return -1; |
| 226 | for (i = 0; i < 6; i++) |
| 227 | sqn[i] = auts[i] ^ ak[i]; |
| 228 | if (milenage_f1(opc, k, _rand, sqn, amf, NULL, mac_s) || |
| 229 | memcmp(mac_s, auts + 6, 8) != 0) |
| 230 | return -1; |
| 231 | return 0; |
| 232 | } |
| 233 | |
| 234 | |
| 235 | /** |
| 236 | * gsm_milenage - Generate GSM-Milenage (3GPP TS 55.205) authentication triplet |
| 237 | * @opc: OPc = 128-bit operator variant algorithm configuration field (encr.) |
| 238 | * @k: K = 128-bit subscriber key |
| 239 | * @_rand: RAND = 128-bit random challenge |
| 240 | * @sres: Buffer for SRES = 32-bit SRES |
| 241 | * @kc: Buffer for Kc = 64-bit Kc |
| 242 | * Returns: 0 on success, -1 on failure |
| 243 | */ |
| 244 | int gsm_milenage(const u8 *opc, const u8 *k, const u8 *_rand, u8 *sres, u8 *kc) |
| 245 | { |
| 246 | u8 res[8], ck[16], ik[16]; |
Harald Welte | 781bd5d | 2011-12-06 22:23:52 +0100 | [diff] [blame] | 247 | |
| 248 | if (milenage_f2345(opc, k, _rand, res, ck, ik, NULL, NULL)) |
| 249 | return -1; |
| 250 | |
Neels Hofmeyr | aa84b71 | 2017-12-18 03:12:01 +0100 | [diff] [blame] | 251 | osmo_auth_c3(kc, ck, ik); |
Harald Welte | 76f4c5c | 2023-05-30 15:57:08 +0200 | [diff] [blame] | 252 | osmo_auth_c2(sres, res, sizeof(res), 1); |
Harald Welte | 781bd5d | 2011-12-06 22:23:52 +0100 | [diff] [blame] | 253 | |
Harald Welte | 781bd5d | 2011-12-06 22:23:52 +0100 | [diff] [blame] | 254 | return 0; |
| 255 | } |
| 256 | |
| 257 | |
| 258 | /** |
| 259 | * milenage_generate - Generate AKA AUTN,IK,CK,RES |
| 260 | * @opc: OPc = 128-bit operator variant algorithm configuration field (encr.) |
| 261 | * @k: K = 128-bit subscriber key |
| 262 | * @sqn: SQN = 48-bit sequence number |
| 263 | * @_rand: RAND = 128-bit random challenge |
| 264 | * @autn: AUTN = 128-bit authentication token |
| 265 | * @ik: Buffer for IK = 128-bit integrity key (f4), or %NULL |
| 266 | * @ck: Buffer for CK = 128-bit confidentiality key (f3), or %NULL |
| 267 | * @res: Buffer for RES = 64-bit signed response (f2), or %NULL |
| 268 | * @res_len: Variable that will be set to RES length |
| 269 | * @auts: 112-bit buffer for AUTS |
| 270 | * Returns: 0 on success, -1 on failure, or -2 on synchronization failure |
| 271 | */ |
| 272 | int milenage_check(const u8 *opc, const u8 *k, const u8 *sqn, const u8 *_rand, |
| 273 | const u8 *autn, u8 *ik, u8 *ck, u8 *res, size_t *res_len, |
| 274 | u8 *auts) |
| 275 | { |
| 276 | int i; |
| 277 | u8 mac_a[8], ak[6], rx_sqn[6]; |
| 278 | const u8 *amf; |
| 279 | |
| 280 | wpa_hexdump(MSG_DEBUG, "Milenage: AUTN", autn, 16); |
| 281 | wpa_hexdump(MSG_DEBUG, "Milenage: RAND", _rand, 16); |
| 282 | |
| 283 | if (milenage_f2345(opc, k, _rand, res, ck, ik, ak, NULL)) |
| 284 | return -1; |
| 285 | |
| 286 | *res_len = 8; |
| 287 | wpa_hexdump_key(MSG_DEBUG, "Milenage: RES", res, *res_len); |
| 288 | wpa_hexdump_key(MSG_DEBUG, "Milenage: CK", ck, 16); |
| 289 | wpa_hexdump_key(MSG_DEBUG, "Milenage: IK", ik, 16); |
| 290 | wpa_hexdump_key(MSG_DEBUG, "Milenage: AK", ak, 6); |
| 291 | |
| 292 | /* AUTN = (SQN ^ AK) || AMF || MAC */ |
| 293 | for (i = 0; i < 6; i++) |
| 294 | rx_sqn[i] = autn[i] ^ ak[i]; |
| 295 | wpa_hexdump(MSG_DEBUG, "Milenage: SQN", rx_sqn, 6); |
| 296 | |
| 297 | if (os_memcmp(rx_sqn, sqn, 6) <= 0) { |
| 298 | u8 auts_amf[2] = { 0x00, 0x00 }; /* TS 33.102 v7.0.0, 6.3.3 */ |
| 299 | if (milenage_f2345(opc, k, _rand, NULL, NULL, NULL, NULL, ak)) |
| 300 | return -1; |
| 301 | wpa_hexdump_key(MSG_DEBUG, "Milenage: AK*", ak, 6); |
| 302 | for (i = 0; i < 6; i++) |
| 303 | auts[i] = sqn[i] ^ ak[i]; |
| 304 | if (milenage_f1(opc, k, _rand, sqn, auts_amf, NULL, auts + 6)) |
| 305 | return -1; |
| 306 | wpa_hexdump(MSG_DEBUG, "Milenage: AUTS", auts, 14); |
| 307 | return -2; |
| 308 | } |
| 309 | |
| 310 | amf = autn + 6; |
| 311 | wpa_hexdump(MSG_DEBUG, "Milenage: AMF", amf, 2); |
| 312 | if (milenage_f1(opc, k, _rand, rx_sqn, amf, mac_a, NULL)) |
| 313 | return -1; |
| 314 | |
| 315 | wpa_hexdump(MSG_DEBUG, "Milenage: MAC_A", mac_a, 8); |
| 316 | |
| 317 | if (os_memcmp(mac_a, autn + 8, 8) != 0) { |
| 318 | wpa_printf(MSG_DEBUG, "Milenage: MAC mismatch"); |
| 319 | wpa_hexdump(MSG_DEBUG, "Milenage: Received MAC_A", |
| 320 | autn + 8, 8); |
| 321 | return -1; |
| 322 | } |
| 323 | |
| 324 | return 0; |
| 325 | } |
Harald Welte | 042afe7 | 2012-03-21 08:19:47 +0100 | [diff] [blame] | 326 | |
| 327 | int milenage_opc_gen(u8 *opc, const u8 *k, const u8 *op) |
| 328 | { |
| 329 | int i; |
| 330 | |
| 331 | /* Encrypt OP using K */ |
| 332 | if (aes_128_encrypt_block(k, op, opc)) |
| 333 | return -1; |
| 334 | |
| 335 | /* XOR the resulting Ek(OP) with OP */ |
| 336 | for (i = 0; i < 16; i++) |
| 337 | opc[i] = opc[i] ^ op[i]; |
| 338 | |
| 339 | return 0; |
| 340 | } |