You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

sha1extra.c 5.3KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167
  1. /*
  2. * Copyright (c) 2009 Joshua Oreman <oremanj@rwcr.net>.
  3. *
  4. * This program is free software; you can redistribute it and/or
  5. * modify it under the terms of the GNU General Public License as
  6. * published by the Free Software Foundation; either version 2 of the
  7. * License, or any later version.
  8. *
  9. * This program is distributed in the hope that it will be useful, but
  10. * WITHOUT ANY WARRANTY; without even the implied warranty of
  11. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  12. * General Public License for more details.
  13. *
  14. * You should have received a copy of the GNU General Public License
  15. * along with this program; if not, write to the Free Software
  16. * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  17. */
  18. FILE_LICENCE ( GPL2_OR_LATER );
  19. #include <string.h>
  20. #include <ipxe/crypto.h>
  21. #include <ipxe/sha1.h>
  22. #include <ipxe/hmac.h>
  23. #include <stdint.h>
  24. #include <byteswap.h>
  25. /**
  26. * SHA1 pseudorandom function for creating derived keys
  27. *
  28. * @v key Master key with which this call is associated
  29. * @v key_len Length of key
  30. * @v label NUL-terminated ASCII string describing purpose of PRF data
  31. * @v data Further data that should be included in the PRF
  32. * @v data_len Length of further PRF data
  33. * @v prf_len Bytes of PRF to generate
  34. * @ret prf Pseudorandom function bytes
  35. *
  36. * This is the PRF variant used by 802.11, defined in IEEE 802.11-2007
  37. * 8.5.5.1. EAP-FAST uses a different SHA1-based PRF, and TLS uses an
  38. * MD5-based PRF.
  39. */
  40. void prf_sha1 ( const void *key, size_t key_len, const char *label,
  41. const void *data, size_t data_len, void *prf, size_t prf_len )
  42. {
  43. u32 blk;
  44. u8 keym[key_len]; /* modifiable copy of key */
  45. u8 in[strlen ( label ) + 1 + data_len + 1]; /* message to HMAC */
  46. u8 *in_blknr; /* pointer to last byte of in, block number */
  47. u8 out[SHA1_DIGEST_SIZE]; /* HMAC-SHA1 result */
  48. u8 sha1_ctx[SHA1_CTX_SIZE]; /* SHA1 context */
  49. const size_t label_len = strlen ( label );
  50. /* The HMAC-SHA-1 is calculated using the given key on the
  51. message text `label', followed by a NUL, followed by one
  52. byte indicating the block number (0 for first). */
  53. memcpy ( keym, key, key_len );
  54. memcpy ( in, label, strlen ( label ) + 1 );
  55. memcpy ( in + label_len + 1, data, data_len );
  56. in_blknr = in + label_len + 1 + data_len;
  57. for ( blk = 0 ;; blk++ ) {
  58. *in_blknr = blk;
  59. hmac_init ( &sha1_algorithm, sha1_ctx, keym, &key_len );
  60. hmac_update ( &sha1_algorithm, sha1_ctx, in, sizeof ( in ) );
  61. hmac_final ( &sha1_algorithm, sha1_ctx, keym, &key_len, out );
  62. if ( prf_len <= sizeof ( out ) ) {
  63. memcpy ( prf, out, prf_len );
  64. break;
  65. }
  66. memcpy ( prf, out, sizeof ( out ) );
  67. prf_len -= sizeof ( out );
  68. prf += sizeof ( out );
  69. }
  70. }
  71. /**
  72. * PBKDF2 key derivation function inner block operation
  73. *
  74. * @v passphrase Passphrase from which to derive key
  75. * @v pass_len Length of passphrase
  76. * @v salt Salt to include in key
  77. * @v salt_len Length of salt
  78. * @v iterations Number of iterations of SHA1 to perform
  79. * @v blocknr Index of this block, starting at 1
  80. * @ret block SHA1_SIZE bytes of PBKDF2 data
  81. *
  82. * The operation of this function is described in RFC 2898.
  83. */
  84. static void pbkdf2_sha1_f ( const void *passphrase, size_t pass_len,
  85. const void *salt, size_t salt_len,
  86. int iterations, u32 blocknr, u8 *block )
  87. {
  88. u8 pass[pass_len]; /* modifiable passphrase */
  89. u8 in[salt_len + 4]; /* input buffer to first round */
  90. u8 last[SHA1_DIGEST_SIZE]; /* output of round N, input of N+1 */
  91. u8 sha1_ctx[SHA1_CTX_SIZE];
  92. u8 *next_in = in; /* changed to `last' after first round */
  93. int next_size = sizeof ( in );
  94. int i;
  95. unsigned int j;
  96. blocknr = htonl ( blocknr );
  97. memcpy ( pass, passphrase, pass_len );
  98. memcpy ( in, salt, salt_len );
  99. memcpy ( in + salt_len, &blocknr, 4 );
  100. memset ( block, 0, sizeof ( last ) );
  101. for ( i = 0; i < iterations; i++ ) {
  102. hmac_init ( &sha1_algorithm, sha1_ctx, pass, &pass_len );
  103. hmac_update ( &sha1_algorithm, sha1_ctx, next_in, next_size );
  104. hmac_final ( &sha1_algorithm, sha1_ctx, pass, &pass_len, last );
  105. for ( j = 0; j < sizeof ( last ); j++ ) {
  106. block[j] ^= last[j];
  107. }
  108. next_in = last;
  109. next_size = sizeof ( last );
  110. }
  111. }
  112. /**
  113. * PBKDF2 key derivation function using SHA1
  114. *
  115. * @v passphrase Passphrase from which to derive key
  116. * @v pass_len Length of passphrase
  117. * @v salt Salt to include in key
  118. * @v salt_len Length of salt
  119. * @v iterations Number of iterations of SHA1 to perform
  120. * @v key_len Length of key to generate
  121. * @ret key Generated key bytes
  122. *
  123. * This is used most notably in 802.11 WPA passphrase hashing, in
  124. * which case the salt is the SSID, 4096 iterations are used, and a
  125. * 32-byte key is generated that serves as the Pairwise Master Key for
  126. * EAPOL authentication.
  127. *
  128. * The operation of this function is further described in RFC 2898.
  129. */
  130. void pbkdf2_sha1 ( const void *passphrase, size_t pass_len,
  131. const void *salt, size_t salt_len,
  132. int iterations, void *key, size_t key_len )
  133. {
  134. u32 blocks = ( key_len + SHA1_DIGEST_SIZE - 1 ) / SHA1_DIGEST_SIZE;
  135. u32 blk;
  136. u8 buf[SHA1_DIGEST_SIZE];
  137. for ( blk = 1; blk <= blocks; blk++ ) {
  138. pbkdf2_sha1_f ( passphrase, pass_len, salt, salt_len,
  139. iterations, blk, buf );
  140. if ( key_len <= sizeof ( buf ) ) {
  141. memcpy ( key, buf, key_len );
  142. break;
  143. }
  144. memcpy ( key, buf, sizeof ( buf ) );
  145. key_len -= sizeof ( buf );
  146. key += sizeof ( buf );
  147. }
  148. }