xref: /netbsd-src/external/bsd/wpa/dist/src/eap_server/eap_server_pwd.c (revision ba65fde2d7fefa7d39838fa5fa855e62bd606b5e)
1 /*
2  * hostapd / EAP-pwd (RFC 5931) server
3  * Copyright (c) 2010, Dan Harkins <dharkins@lounge.org>
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms of the BSD license.
7  *
8  * Alternatively, this software may be distributed under the terms of the
9  * GNU General Public License version 2 as published by the Free Software
10  * Foundation.
11  *
12  * See README and COPYING for more details.
13  */
14 
15 #include "includes.h"
16 
17 #include "common.h"
18 #include "eap_server/eap_i.h"
19 #include "eap_common/eap_pwd_common.h"
20 
21 
22 struct eap_pwd_data {
23 	enum {
24 		PWD_ID_Req, PWD_Commit_Req, PWD_Confirm_Req, SUCCESS, FAILURE
25 	} state;
26 	u8 *id_peer;
27 	size_t id_peer_len;
28 	u8 *id_server;
29 	size_t id_server_len;
30 	u8 *password;
31 	size_t password_len;
32 	u32 token;
33 	u16 group_num;
34 	EAP_PWD_group *grp;
35 
36 	BIGNUM *k;
37 	BIGNUM *private_value;
38 	BIGNUM *peer_scalar;
39 	BIGNUM *my_scalar;
40 	EC_POINT *my_element;
41 	EC_POINT *peer_element;
42 
43 	u8 my_confirm[SHA256_DIGEST_LENGTH];
44 
45 	u8 msk[EAP_MSK_LEN];
46 	u8 emsk[EAP_EMSK_LEN];
47 
48 	BN_CTX *bnctx;
49 };
50 
51 
52 static const char * eap_pwd_state_txt(int state)
53 {
54 	switch (state) {
55         case PWD_ID_Req:
56 		return "PWD-ID-Req";
57         case PWD_Commit_Req:
58 		return "PWD-Commit-Req";
59         case PWD_Confirm_Req:
60 		return "PWD-Confirm-Req";
61         case SUCCESS:
62 		return "SUCCESS";
63         case FAILURE:
64 		return "FAILURE";
65         default:
66 		return "PWD-Unk";
67 	}
68 }
69 
70 
71 static void eap_pwd_state(struct eap_pwd_data *data, int state)
72 {
73 	wpa_printf(MSG_DEBUG, "EAP-pwd: %s -> %s",
74 		   eap_pwd_state_txt(data->state), eap_pwd_state_txt(state));
75 	data->state = state;
76 }
77 
78 
79 static void * eap_pwd_init(struct eap_sm *sm)
80 {
81 	struct eap_pwd_data *data;
82 
83 	if (sm->user == NULL || sm->user->password == NULL ||
84 	    sm->user->password_len == 0) {
85 		wpa_printf(MSG_INFO, "EAP-PWD (server): Password is not "
86 			   "configured");
87 		return NULL;
88 	}
89 
90 	data = os_zalloc(sizeof(*data));
91 	if (data == NULL)
92 		return NULL;
93 
94 	data->group_num = sm->pwd_group;
95 	wpa_printf(MSG_DEBUG, "EAP-pwd: Selected group number %d",
96 		   data->group_num);
97 	data->state = PWD_ID_Req;
98 
99 	data->id_server = (u8 *) os_strdup("server");
100 	if (data->id_server)
101 		data->id_server_len = os_strlen((char *) data->id_server);
102 
103 	data->password = os_malloc(sm->user->password_len);
104 	if (data->password == NULL) {
105 		wpa_printf(MSG_INFO, "EAP-PWD: Memory allocation password "
106 			   "fail");
107 		os_free(data->id_server);
108 		os_free(data);
109 		return NULL;
110 	}
111 	data->password_len = sm->user->password_len;
112 	os_memcpy(data->password, sm->user->password, data->password_len);
113 
114 	data->bnctx = BN_CTX_new();
115 	if (data->bnctx == NULL) {
116 		wpa_printf(MSG_INFO, "EAP-PWD: bn context allocation fail");
117 		os_free(data->password);
118 		os_free(data->id_server);
119 		os_free(data);
120 		return NULL;
121 	}
122 
123 	return data;
124 }
125 
126 
127 static void eap_pwd_reset(struct eap_sm *sm, void *priv)
128 {
129 	struct eap_pwd_data *data = priv;
130 
131 	BN_free(data->private_value);
132 	BN_free(data->peer_scalar);
133 	BN_free(data->my_scalar);
134 	BN_free(data->k);
135 	BN_CTX_free(data->bnctx);
136 	EC_POINT_free(data->my_element);
137 	EC_POINT_free(data->peer_element);
138 	os_free(data->id_peer);
139 	os_free(data->id_server);
140 	os_free(data->password);
141 	if (data->grp) {
142 		EC_GROUP_free(data->grp->group);
143 		EC_POINT_free(data->grp->pwe);
144 		BN_free(data->grp->order);
145 		BN_free(data->grp->prime);
146 		os_free(data->grp);
147 	}
148 	os_free(data);
149 }
150 
151 
152 static struct wpabuf *
153 eap_pwd_build_id_req(struct eap_sm *sm, struct eap_pwd_data *data, u8 id)
154 {
155 	struct wpabuf *req;
156 
157 	wpa_printf(MSG_DEBUG, "EAP-pwd: ID/Request");
158 	req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
159 			    sizeof(struct eap_pwd_hdr) +
160 			    sizeof(struct eap_pwd_id) + data->id_server_len,
161 			    EAP_CODE_REQUEST, id);
162 	if (req == NULL) {
163 		eap_pwd_state(data, FAILURE);
164 		return NULL;
165 	}
166 
167 	/* an lfsr is good enough to generate unpredictable tokens */
168 	data->token = os_random();
169 	wpabuf_put_u8(req, EAP_PWD_OPCODE_ID_EXCH);
170 	wpabuf_put_be16(req, data->group_num);
171 	wpabuf_put_u8(req, EAP_PWD_DEFAULT_RAND_FUNC);
172 	wpabuf_put_u8(req, EAP_PWD_DEFAULT_PRF);
173 	wpabuf_put_data(req, &data->token, sizeof(data->token));
174 	wpabuf_put_u8(req, EAP_PWD_PREP_NONE);
175 	wpabuf_put_data(req, data->id_server, data->id_server_len);
176 
177 	return req;
178 }
179 
180 
181 static struct wpabuf *
182 eap_pwd_build_commit_req(struct eap_sm *sm, struct eap_pwd_data *data, u8 id)
183 {
184 	struct wpabuf *req = NULL;
185 	BIGNUM *mask = NULL, *x = NULL, *y = NULL;
186 	u8 *scalar = NULL, *element = NULL;
187 	u16 offset;
188 
189 	wpa_printf(MSG_DEBUG, "EAP-pwd: Commit/Request");
190 
191 	if (((data->private_value = BN_new()) == NULL) ||
192 	    ((data->my_element = EC_POINT_new(data->grp->group)) == NULL) ||
193 	    ((data->my_scalar = BN_new()) == NULL) ||
194 	    ((mask = BN_new()) == NULL)) {
195 		wpa_printf(MSG_INFO, "EAP-PWD (server): scalar allocation "
196 			   "fail");
197 		goto fin;
198 	}
199 
200 	BN_rand_range(data->private_value, data->grp->order);
201 	BN_rand_range(mask, data->grp->order);
202 	BN_add(data->my_scalar, data->private_value, mask);
203 	BN_mod(data->my_scalar, data->my_scalar, data->grp->order,
204 	       data->bnctx);
205 
206 	if (!EC_POINT_mul(data->grp->group, data->my_element, NULL,
207 			  data->grp->pwe, mask, data->bnctx)) {
208 		wpa_printf(MSG_INFO, "EAP-PWD (server): element allocation "
209 			   "fail");
210 		eap_pwd_state(data, FAILURE);
211 		goto fin;
212 	}
213 
214 	if (!EC_POINT_invert(data->grp->group, data->my_element, data->bnctx))
215 	{
216 		wpa_printf(MSG_INFO, "EAP-PWD (server): element inversion "
217 			   "fail");
218 		goto fin;
219 	}
220 	BN_free(mask);
221 
222 	if (((x = BN_new()) == NULL) ||
223 	    ((y = BN_new()) == NULL)) {
224 		wpa_printf(MSG_INFO, "EAP-PWD (server): point allocation "
225 			   "fail");
226 		goto fin;
227 	}
228 	if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
229 						 data->my_element, x, y,
230 						 data->bnctx)) {
231 		wpa_printf(MSG_INFO, "EAP-PWD (server): point assignment "
232 			   "fail");
233 		goto fin;
234 	}
235 
236 	if (((scalar = os_malloc(BN_num_bytes(data->grp->order))) == NULL) ||
237 	    ((element = os_malloc(BN_num_bytes(data->grp->prime) * 2)) ==
238 	     NULL)) {
239 		wpa_printf(MSG_INFO, "EAP-PWD (server): data allocation fail");
240 		goto fin;
241 	}
242 
243 	/*
244 	 * bignums occupy as little memory as possible so one that is
245 	 * sufficiently smaller than the prime or order might need pre-pending
246 	 * with zeros.
247 	 */
248 	os_memset(scalar, 0, BN_num_bytes(data->grp->order));
249 	os_memset(element, 0, BN_num_bytes(data->grp->prime) * 2);
250 	offset = BN_num_bytes(data->grp->order) -
251 		BN_num_bytes(data->my_scalar);
252 	BN_bn2bin(data->my_scalar, scalar + offset);
253 
254 	offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x);
255 	BN_bn2bin(x, element + offset);
256 	offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y);
257 	BN_bn2bin(y, element + BN_num_bytes(data->grp->prime) + offset);
258 
259 	req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
260 			    sizeof(struct eap_pwd_hdr) +
261 			    (2 * BN_num_bytes(data->grp->prime)) +
262 			    BN_num_bytes(data->grp->order),
263 			    EAP_CODE_REQUEST, id);
264 	if (req == NULL)
265 		goto fin;
266 	wpabuf_put_u8(req, EAP_PWD_OPCODE_COMMIT_EXCH);
267 
268 	/* We send the element as (x,y) followed by the scalar */
269 	wpabuf_put_data(req, element, (2 * BN_num_bytes(data->grp->prime)));
270 	wpabuf_put_data(req, scalar, BN_num_bytes(data->grp->order));
271 
272 fin:
273 	os_free(scalar);
274 	os_free(element);
275 	BN_free(x);
276 	BN_free(y);
277 	if (req == NULL)
278 		eap_pwd_state(data, FAILURE);
279 
280 	return req;
281 }
282 
283 
284 static struct wpabuf *
285 eap_pwd_build_confirm_req(struct eap_sm *sm, struct eap_pwd_data *data, u8 id)
286 {
287 	struct wpabuf *req = NULL;
288 	BIGNUM *x = NULL, *y = NULL;
289 	HMAC_CTX ctx;
290 	u8 conf[SHA256_DIGEST_LENGTH], *cruft = NULL, *ptr;
291 	u16 grp;
292 	int offset;
293 
294 	wpa_printf(MSG_DEBUG, "EAP-pwd: Confirm/Request");
295 
296 	/* Each component of the cruft will be at most as big as the prime */
297 	if (((cruft = os_malloc(BN_num_bytes(data->grp->prime))) == NULL) ||
298 	    ((x = BN_new()) == NULL) || ((y = BN_new()) == NULL)) {
299 		wpa_printf(MSG_INFO, "EAP-PWD (server): debug allocation "
300 			   "fail");
301 		goto fin;
302 	}
303 
304 	/*
305 	 * commit is H(k | server_element | server_scalar | peer_element |
306 	 *	       peer_scalar | ciphersuite)
307 	 */
308 	H_Init(&ctx);
309 
310 	/*
311 	 * Zero the memory each time because this is mod prime math and some
312 	 * value may start with a few zeros and the previous one did not.
313 	 *
314 	 * First is k
315 	 */
316 	os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
317 	offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(data->k);
318 	BN_bn2bin(data->k, cruft + offset);
319 	H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
320 
321 	/* server element: x, y */
322 	if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
323 						 data->my_element, x, y,
324 						 data->bnctx)) {
325 		wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
326 			   "assignment fail");
327 		goto fin;
328 	}
329 
330 	os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
331 	offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x);
332 	BN_bn2bin(x, cruft + offset);
333 	H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
334 	os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
335 	offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y);
336 	BN_bn2bin(y, cruft + offset);
337 	H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
338 
339 	/* server scalar */
340 	os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
341 	offset = BN_num_bytes(data->grp->order) -
342 		BN_num_bytes(data->my_scalar);
343 	BN_bn2bin(data->my_scalar, cruft + offset);
344 	H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
345 
346 	/* peer element: x, y */
347 	if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
348 						 data->peer_element, x, y,
349 						 data->bnctx)) {
350 		wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
351 			   "assignment fail");
352 		goto fin;
353 	}
354 
355 	os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
356 	offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x);
357 	BN_bn2bin(x, cruft + offset);
358 	H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
359 	os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
360 	offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y);
361 	BN_bn2bin(y, cruft + offset);
362 	H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
363 
364 	/* peer scalar */
365 	os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
366 	offset = BN_num_bytes(data->grp->order) -
367 		BN_num_bytes(data->peer_scalar);
368 	BN_bn2bin(data->peer_scalar, cruft + offset);
369 	H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
370 
371 	/* ciphersuite */
372 	grp = htons(data->group_num);
373 	os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
374 	ptr = cruft;
375 	os_memcpy(ptr, &grp, sizeof(u16));
376 	ptr += sizeof(u16);
377 	*ptr = EAP_PWD_DEFAULT_RAND_FUNC;
378 	ptr += sizeof(u8);
379 	*ptr = EAP_PWD_DEFAULT_PRF;
380 	ptr += sizeof(u8);
381 	H_Update(&ctx, cruft, ptr-cruft);
382 
383 	/* all done with the random function */
384 	H_Final(&ctx, conf);
385 	os_memcpy(data->my_confirm, conf, SHA256_DIGEST_LENGTH);
386 
387 	req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
388 			    sizeof(struct eap_pwd_hdr) + SHA256_DIGEST_LENGTH,
389 			    EAP_CODE_REQUEST, id);
390 	if (req == NULL)
391 		goto fin;
392 
393 	wpabuf_put_u8(req, EAP_PWD_OPCODE_CONFIRM_EXCH);
394 	wpabuf_put_data(req, conf, SHA256_DIGEST_LENGTH);
395 
396 fin:
397 	os_free(cruft);
398 	BN_free(x);
399 	BN_free(y);
400 	if (req == NULL)
401 		eap_pwd_state(data, FAILURE);
402 
403 	return req;
404 }
405 
406 
407 static struct wpabuf *
408 eap_pwd_build_req(struct eap_sm *sm, void *priv, u8 id)
409 {
410 	struct eap_pwd_data *data = priv;
411 
412 	switch (data->state) {
413         case PWD_ID_Req:
414 		return eap_pwd_build_id_req(sm, data, id);
415         case PWD_Commit_Req:
416 		return eap_pwd_build_commit_req(sm, data, id);
417         case PWD_Confirm_Req:
418 		return eap_pwd_build_confirm_req(sm, data, id);
419         default:
420 		wpa_printf(MSG_INFO, "EAP-pwd: Unknown state %d in build_req",
421 			   data->state);
422 		break;
423 	}
424 
425 	return NULL;
426 }
427 
428 
429 static Boolean eap_pwd_check(struct eap_sm *sm, void *priv,
430 			     struct wpabuf *respData)
431 {
432 	struct eap_pwd_data *data = priv;
433 	const u8 *pos;
434 	size_t len;
435 
436 	pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_PWD, respData, &len);
437 	if (pos == NULL || len < 1) {
438 		wpa_printf(MSG_INFO, "EAP-pwd: Invalid frame");
439 		return TRUE;
440 	}
441 
442 	wpa_printf(MSG_DEBUG, "EAP-pwd: Received frame: opcode=%d", *pos);
443 
444 	if (data->state == PWD_ID_Req && *pos == EAP_PWD_OPCODE_ID_EXCH)
445 		return FALSE;
446 
447 	if (data->state == PWD_Commit_Req &&
448 	    *pos == EAP_PWD_OPCODE_COMMIT_EXCH)
449 		return FALSE;
450 
451 	if (data->state == PWD_Confirm_Req &&
452 	    *pos == EAP_PWD_OPCODE_CONFIRM_EXCH)
453 		return FALSE;
454 
455 	wpa_printf(MSG_INFO, "EAP-pwd: Unexpected opcode=%d in state=%d",
456 		   *pos, data->state);
457 
458 	return TRUE;
459 }
460 
461 
462 static void eap_pwd_process_id_resp(struct eap_sm *sm,
463 				    struct eap_pwd_data *data,
464 				    const u8 *payload, size_t payload_len)
465 {
466 	struct eap_pwd_id *id;
467 
468 	if (payload_len < sizeof(struct eap_pwd_id)) {
469 		wpa_printf(MSG_INFO, "EAP-pwd: Invalid ID response");
470 		return;
471 	}
472 
473 	id = (struct eap_pwd_id *) payload;
474 	if ((data->group_num != be_to_host16(id->group_num)) ||
475 	    (id->random_function != EAP_PWD_DEFAULT_RAND_FUNC) ||
476 	    (os_memcmp(id->token, (u8 *)&data->token, sizeof(data->token))) ||
477 	    (id->prf != EAP_PWD_DEFAULT_PRF)) {
478 		wpa_printf(MSG_INFO, "EAP-pwd: peer changed parameters");
479 		eap_pwd_state(data, FAILURE);
480 		return;
481 	}
482 	data->id_peer = os_malloc(payload_len - sizeof(struct eap_pwd_id));
483 	if (data->id_peer == NULL) {
484 		wpa_printf(MSG_INFO, "EAP-PWD: memory allocation id fail");
485 		return;
486 	}
487 	data->id_peer_len = payload_len - sizeof(struct eap_pwd_id);
488 	os_memcpy(data->id_peer, id->identity, data->id_peer_len);
489 	wpa_hexdump_ascii(MSG_DEBUG, "EAP-PWD (server): peer sent id of",
490 			  data->id_peer, data->id_peer_len);
491 
492 	if ((data->grp = os_malloc(sizeof(EAP_PWD_group))) == NULL) {
493 		wpa_printf(MSG_INFO, "EAP-PWD: failed to allocate memory for "
494 			   "group");
495 		return;
496 	}
497 	if (compute_password_element(data->grp, data->group_num,
498 				     data->password, data->password_len,
499 				     data->id_server, data->id_server_len,
500 				     data->id_peer, data->id_peer_len,
501 				     (u8 *) &data->token)) {
502 		wpa_printf(MSG_INFO, "EAP-PWD (server): unable to compute "
503 			   "PWE");
504 		return;
505 	}
506 	wpa_printf(MSG_DEBUG, "EAP-PWD (server): computed %d bit PWE...",
507 		   BN_num_bits(data->grp->prime));
508 
509 	eap_pwd_state(data, PWD_Commit_Req);
510 }
511 
512 
513 static void
514 eap_pwd_process_commit_resp(struct eap_sm *sm, struct eap_pwd_data *data,
515 			    const u8 *payload, size_t payload_len)
516 {
517 	u8 *ptr;
518 	BIGNUM *x = NULL, *y = NULL, *cofactor = NULL;
519 	EC_POINT *K = NULL, *point = NULL;
520 	int res = 0;
521 
522 	wpa_printf(MSG_DEBUG, "EAP-pwd: Received commit response");
523 
524 	if (((data->peer_scalar = BN_new()) == NULL) ||
525 	    ((data->k = BN_new()) == NULL) ||
526 	    ((cofactor = BN_new()) == NULL) ||
527 	    ((x = BN_new()) == NULL) ||
528 	    ((y = BN_new()) == NULL) ||
529 	    ((point = EC_POINT_new(data->grp->group)) == NULL) ||
530 	    ((K = EC_POINT_new(data->grp->group)) == NULL) ||
531 	    ((data->peer_element = EC_POINT_new(data->grp->group)) == NULL)) {
532 		wpa_printf(MSG_INFO, "EAP-PWD (server): peer data allocation "
533 			   "fail");
534 		goto fin;
535 	}
536 
537 	if (!EC_GROUP_get_cofactor(data->grp->group, cofactor, NULL)) {
538 		wpa_printf(MSG_INFO, "EAP-PWD (server): unable to get "
539 			   "cofactor for curve");
540 		goto fin;
541 	}
542 
543 	/* element, x then y, followed by scalar */
544 	ptr = (u8 *) payload;
545 	BN_bin2bn(ptr, BN_num_bytes(data->grp->prime), x);
546 	ptr += BN_num_bytes(data->grp->prime);
547 	BN_bin2bn(ptr, BN_num_bytes(data->grp->prime), y);
548 	ptr += BN_num_bytes(data->grp->prime);
549 	BN_bin2bn(ptr, BN_num_bytes(data->grp->order), data->peer_scalar);
550 	if (!EC_POINT_set_affine_coordinates_GFp(data->grp->group,
551 						 data->peer_element, x, y,
552 						 data->bnctx)) {
553 		wpa_printf(MSG_INFO, "EAP-PWD (server): setting peer element "
554 			   "fail");
555 		goto fin;
556 	}
557 
558 	/* check to ensure peer's element is not in a small sub-group */
559 	if (BN_cmp(cofactor, BN_value_one())) {
560 		if (!EC_POINT_mul(data->grp->group, point, NULL,
561 				  data->peer_element, cofactor, NULL)) {
562 			wpa_printf(MSG_INFO, "EAP-PWD (server): cannot "
563 				   "multiply peer element by order");
564 			goto fin;
565 		}
566 		if (EC_POINT_is_at_infinity(data->grp->group, point)) {
567 			wpa_printf(MSG_INFO, "EAP-PWD (server): peer element "
568 				   "is at infinity!\n");
569 			goto fin;
570 		}
571 	}
572 
573 	/* compute the shared key, k */
574 	if ((!EC_POINT_mul(data->grp->group, K, NULL, data->grp->pwe,
575 			   data->peer_scalar, data->bnctx)) ||
576 	    (!EC_POINT_add(data->grp->group, K, K, data->peer_element,
577 			   data->bnctx)) ||
578 	    (!EC_POINT_mul(data->grp->group, K, NULL, K, data->private_value,
579 			   data->bnctx))) {
580 		wpa_printf(MSG_INFO, "EAP-PWD (server): computing shared key "
581 			   "fail");
582 		goto fin;
583 	}
584 
585 	/* ensure that the shared key isn't in a small sub-group */
586 	if (BN_cmp(cofactor, BN_value_one())) {
587 		if (!EC_POINT_mul(data->grp->group, K, NULL, K, cofactor,
588 				  NULL)) {
589 			wpa_printf(MSG_INFO, "EAP-PWD (server): cannot "
590 				   "multiply shared key point by order!\n");
591 			goto fin;
592 		}
593 	}
594 
595 	/*
596 	 * This check is strictly speaking just for the case above where
597 	 * co-factor > 1 but it was suggested that even though this is probably
598 	 * never going to happen it is a simple and safe check "just to be
599 	 * sure" so let's be safe.
600 	 */
601 	if (EC_POINT_is_at_infinity(data->grp->group, K)) {
602 		wpa_printf(MSG_INFO, "EAP-PWD (server): shared key point is "
603 			   "at infinity");
604 		goto fin;
605 	}
606 	if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group, K, data->k,
607 						 NULL, data->bnctx)) {
608 		wpa_printf(MSG_INFO, "EAP-PWD (server): unable to extract "
609 			   "shared secret from secret point");
610 		goto fin;
611 	}
612 	res = 1;
613 
614 fin:
615 	EC_POINT_free(K);
616 	EC_POINT_free(point);
617 	BN_free(cofactor);
618 	BN_free(x);
619 	BN_free(y);
620 
621 	if (res)
622 		eap_pwd_state(data, PWD_Confirm_Req);
623 	else
624 		eap_pwd_state(data, FAILURE);
625 }
626 
627 
628 static void
629 eap_pwd_process_confirm_resp(struct eap_sm *sm, struct eap_pwd_data *data,
630 			     const u8 *payload, size_t payload_len)
631 {
632 	BIGNUM *x = NULL, *y = NULL;
633 	HMAC_CTX ctx;
634 	u32 cs;
635 	u16 grp;
636 	u8 conf[SHA256_DIGEST_LENGTH], *cruft = NULL, *ptr;
637 	int offset;
638 
639 	/* build up the ciphersuite: group | random_function | prf */
640 	grp = htons(data->group_num);
641 	ptr = (u8 *) &cs;
642 	os_memcpy(ptr, &grp, sizeof(u16));
643 	ptr += sizeof(u16);
644 	*ptr = EAP_PWD_DEFAULT_RAND_FUNC;
645 	ptr += sizeof(u8);
646 	*ptr = EAP_PWD_DEFAULT_PRF;
647 
648 	/* each component of the cruft will be at most as big as the prime */
649 	if (((cruft = os_malloc(BN_num_bytes(data->grp->prime))) == NULL) ||
650 	    ((x = BN_new()) == NULL) || ((y = BN_new()) == NULL)) {
651 		wpa_printf(MSG_INFO, "EAP-PWD (peer): allocation fail");
652 		goto fin;
653 	}
654 
655 	/*
656 	 * commit is H(k | peer_element | peer_scalar | server_element |
657 	 *	       server_scalar | ciphersuite)
658 	 */
659 	H_Init(&ctx);
660 
661 	/* k */
662 	os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
663 	offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(data->k);
664 	BN_bn2bin(data->k, cruft + offset);
665 	H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
666 
667 	/* peer element: x, y */
668 	if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
669 						 data->peer_element, x, y,
670 						 data->bnctx)) {
671 		wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
672 			   "assignment fail");
673 		goto fin;
674 	}
675 	os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
676 	offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x);
677 	BN_bn2bin(x, cruft + offset);
678 	H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
679 	os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
680 	offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y);
681 	BN_bn2bin(y, cruft + offset);
682 	H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
683 
684 	/* peer scalar */
685 	os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
686 	offset = BN_num_bytes(data->grp->order) -
687 		BN_num_bytes(data->peer_scalar);
688 	BN_bn2bin(data->peer_scalar, cruft + offset);
689 	H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
690 
691 	/* server element: x, y */
692 	if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
693 						 data->my_element, x, y,
694 						 data->bnctx)) {
695 		wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
696 			   "assignment fail");
697 		goto fin;
698 	}
699 
700 	os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
701 	offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x);
702 	BN_bn2bin(x, cruft + offset);
703 	H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
704 	os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
705 	offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y);
706 	BN_bn2bin(y, cruft + offset);
707 	H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
708 
709 	/* server scalar */
710 	os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
711 	offset = BN_num_bytes(data->grp->order) -
712 		BN_num_bytes(data->my_scalar);
713 	BN_bn2bin(data->my_scalar, cruft + offset);
714 	H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
715 
716 	/* ciphersuite */
717 	os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
718 	H_Update(&ctx, (u8 *)&cs, sizeof(u32));
719 
720 	/* all done */
721 	H_Final(&ctx, conf);
722 
723 	ptr = (u8 *) payload;
724 	if (os_memcmp(conf, ptr, SHA256_DIGEST_LENGTH)) {
725 		wpa_printf(MSG_INFO, "EAP-PWD (server): confirm did not "
726 			   "verify");
727 		goto fin;
728 	}
729 
730 	wpa_printf(MSG_DEBUG, "EAP-pwd (server): confirm verified");
731 	if (compute_keys(data->grp, data->bnctx, data->k,
732 			 data->peer_scalar, data->my_scalar, conf,
733 			 data->my_confirm, &cs, data->msk, data->emsk) < 0)
734 		eap_pwd_state(data, FAILURE);
735 	else
736 		eap_pwd_state(data, SUCCESS);
737 
738 fin:
739 	os_free(cruft);
740 	BN_free(x);
741 	BN_free(y);
742 }
743 
744 
745 static void eap_pwd_process(struct eap_sm *sm, void *priv,
746 			    struct wpabuf *respData)
747 {
748 	struct eap_pwd_data *data = priv;
749 	const u8 *pos;
750 	size_t len;
751 	u8 exch;
752 
753 	pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_PWD, respData, &len);
754 	if ((pos == NULL) || (len < 1)) {
755 		wpa_printf(MSG_INFO, "Bad EAP header! pos %s and len = %d",
756 			   (pos == NULL) ? "is NULL" : "is not NULL",
757 			   (int) len);
758 		return;
759 	}
760 
761 	exch = *pos & 0x3f;
762 	switch (exch) {
763 	case EAP_PWD_OPCODE_ID_EXCH:
764 		eap_pwd_process_id_resp(sm, data, pos + 1, len - 1);
765 		break;
766 	case EAP_PWD_OPCODE_COMMIT_EXCH:
767 		eap_pwd_process_commit_resp(sm, data, pos + 1, len - 1);
768 		break;
769         case EAP_PWD_OPCODE_CONFIRM_EXCH:
770 		eap_pwd_process_confirm_resp(sm, data, pos + 1, len - 1);
771 		break;
772 	}
773 }
774 
775 
776 static u8 * eap_pwd_getkey(struct eap_sm *sm, void *priv, size_t *len)
777 {
778 	struct eap_pwd_data *data = priv;
779 	u8 *key;
780 
781 	if (data->state != SUCCESS)
782 		return NULL;
783 
784 	key = os_malloc(EAP_MSK_LEN);
785 	if (key == NULL)
786 		return NULL;
787 
788 	os_memcpy(key, data->msk, EAP_MSK_LEN);
789 	*len = EAP_MSK_LEN;
790 
791 	return key;
792 }
793 
794 
795 static u8 * eap_pwd_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
796 {
797 	struct eap_pwd_data *data = priv;
798 	u8 *key;
799 
800 	if (data->state != SUCCESS)
801 		return NULL;
802 
803 	key = os_malloc(EAP_EMSK_LEN);
804 	if (key == NULL)
805 		return NULL;
806 
807 	os_memcpy(key, data->emsk, EAP_EMSK_LEN);
808 	*len = EAP_EMSK_LEN;
809 
810 	return key;
811 }
812 
813 
814 static Boolean eap_pwd_is_success(struct eap_sm *sm, void *priv)
815 {
816 	struct eap_pwd_data *data = priv;
817 	return data->state == SUCCESS;
818 }
819 
820 
821 static Boolean eap_pwd_is_done(struct eap_sm *sm, void *priv)
822 {
823 	struct eap_pwd_data *data = priv;
824 	return (data->state == SUCCESS) || (data->state == FAILURE);
825 }
826 
827 
828 int eap_server_pwd_register(void)
829 {
830 	struct eap_method *eap;
831 	int ret;
832 	struct timeval tp;
833 	struct timezone tz;
834 	u32 sr;
835 
836 	EVP_add_digest(EVP_sha256());
837 
838 	sr = 0xdeaddada;
839 	(void) gettimeofday(&tp, &tz);
840 	sr ^= (tp.tv_sec ^ tp.tv_usec);
841 	srandom(sr);
842 
843 	eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION,
844 				      EAP_VENDOR_IETF, EAP_TYPE_PWD,
845 				      "PWD");
846 	if (eap == NULL)
847 		return -1;
848 
849 	eap->init = eap_pwd_init;
850 	eap->reset = eap_pwd_reset;
851 	eap->buildReq = eap_pwd_build_req;
852 	eap->check = eap_pwd_check;
853 	eap->process = eap_pwd_process;
854 	eap->isDone = eap_pwd_is_done;
855 	eap->getKey = eap_pwd_getkey;
856 	eap->get_emsk = eap_pwd_get_emsk;
857 	eap->isSuccess = eap_pwd_is_success;
858 
859 	ret = eap_server_method_register(eap);
860 	if (ret)
861 		eap_server_method_free(eap);
862 	return ret;
863 }
864 
865