|
@@ -1,6 +1,6 @@
|
|
/*
|
|
/*
|
|
* Simultaneous authentication of equals
|
|
* Simultaneous authentication of equals
|
|
- * Copyright (c) 2012-2015, Jouni Malinen <j@w1.fi>
|
|
|
|
|
|
+ * Copyright (c) 2012-2016, Jouni Malinen <j@w1.fi>
|
|
*
|
|
*
|
|
* This software may be distributed under the terms of the BSD license.
|
|
* This software may be distributed under the terms of the BSD license.
|
|
* See README for more details.
|
|
* See README for more details.
|
|
@@ -275,8 +275,9 @@ static int sae_test_pwd_seed_ecc(struct sae_data *sae, const u8 *pwd_seed,
|
|
|
|
|
|
/* pwd-value = KDF-z(pwd-seed, "SAE Hunting and Pecking", p) */
|
|
/* pwd-value = KDF-z(pwd-seed, "SAE Hunting and Pecking", p) */
|
|
bits = crypto_ec_prime_len_bits(sae->tmp->ec);
|
|
bits = crypto_ec_prime_len_bits(sae->tmp->ec);
|
|
- sha256_prf_bits(pwd_seed, SHA256_MAC_LEN, "SAE Hunting and Pecking",
|
|
|
|
- prime, sae->tmp->prime_len, pwd_value, bits);
|
|
|
|
|
|
+ if (sha256_prf_bits(pwd_seed, SHA256_MAC_LEN, "SAE Hunting and Pecking",
|
|
|
|
+ prime, sae->tmp->prime_len, pwd_value, bits) < 0)
|
|
|
|
+ return -1;
|
|
if (bits % 8)
|
|
if (bits % 8)
|
|
buf_shift_right(pwd_value, sizeof(pwd_value), 8 - bits % 8);
|
|
buf_shift_right(pwd_value, sizeof(pwd_value), 8 - bits % 8);
|
|
wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value",
|
|
wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value",
|
|
@@ -318,9 +319,10 @@ static int sae_test_pwd_seed_ffc(struct sae_data *sae, const u8 *pwd_seed,
|
|
wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-seed", pwd_seed, SHA256_MAC_LEN);
|
|
wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-seed", pwd_seed, SHA256_MAC_LEN);
|
|
|
|
|
|
/* pwd-value = KDF-z(pwd-seed, "SAE Hunting and Pecking", p) */
|
|
/* pwd-value = KDF-z(pwd-seed, "SAE Hunting and Pecking", p) */
|
|
- sha256_prf_bits(pwd_seed, SHA256_MAC_LEN, "SAE Hunting and Pecking",
|
|
|
|
- sae->tmp->dh->prime, sae->tmp->prime_len, pwd_value,
|
|
|
|
- bits);
|
|
|
|
|
|
+ if (sha256_prf_bits(pwd_seed, SHA256_MAC_LEN, "SAE Hunting and Pecking",
|
|
|
|
+ sae->tmp->dh->prime, sae->tmp->prime_len, pwd_value,
|
|
|
|
+ bits) < 0)
|
|
|
|
+ return -1;
|
|
wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value", pwd_value,
|
|
wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value", pwd_value,
|
|
sae->tmp->prime_len);
|
|
sae->tmp->prime_len);
|
|
|
|
|
|
@@ -809,8 +811,9 @@ static int sae_derive_keys(struct sae_data *sae, const u8 *k)
|
|
crypto_bignum_mod(tmp, sae->tmp->order, tmp);
|
|
crypto_bignum_mod(tmp, sae->tmp->order, tmp);
|
|
crypto_bignum_to_bin(tmp, val, sizeof(val), sae->tmp->prime_len);
|
|
crypto_bignum_to_bin(tmp, val, sizeof(val), sae->tmp->prime_len);
|
|
wpa_hexdump(MSG_DEBUG, "SAE: PMKID", val, SAE_PMKID_LEN);
|
|
wpa_hexdump(MSG_DEBUG, "SAE: PMKID", val, SAE_PMKID_LEN);
|
|
- sha256_prf(keyseed, sizeof(keyseed), "SAE KCK and PMK",
|
|
|
|
- val, sae->tmp->prime_len, keys, sizeof(keys));
|
|
|
|
|
|
+ if (sha256_prf(keyseed, sizeof(keyseed), "SAE KCK and PMK",
|
|
|
|
+ val, sae->tmp->prime_len, keys, sizeof(keys)) < 0)
|
|
|
|
+ goto fail;
|
|
os_memset(keyseed, 0, sizeof(keyseed));
|
|
os_memset(keyseed, 0, sizeof(keyseed));
|
|
os_memcpy(sae->tmp->kck, keys, SAE_KCK_LEN);
|
|
os_memcpy(sae->tmp->kck, keys, SAE_KCK_LEN);
|
|
os_memcpy(sae->pmk, keys + SAE_KCK_LEN, SAE_PMK_LEN);
|
|
os_memcpy(sae->pmk, keys + SAE_KCK_LEN, SAE_PMK_LEN);
|