diff options
| author | Dan Harkins <dharkins@lounge.org> | 2011-11-19 16:47:25 +0200 |
|---|---|---|
| committer | Jouni Malinen <j@w1.fi> | 2011-11-19 16:47:25 +0200 |
| commit | e547e071e1f4042d202cfaba4aded8558ec37173 (patch) | |
| tree | c8555888653f91118aecf75a1c0929a6a8c4154a /src/eap_common/eap_pwd_common.c | |
| parent | 18f5f3de030da1c646585425e95de0f8a2a7432b (diff) | |
| download | external_wpa_supplicant_8_ti-e547e071e1f4042d202cfaba4aded8558ec37173.zip external_wpa_supplicant_8_ti-e547e071e1f4042d202cfaba4aded8558ec37173.tar.gz external_wpa_supplicant_8_ti-e547e071e1f4042d202cfaba4aded8558ec37173.tar.bz2 | |
EAP-pwd: Fix zero-padding of input to H()
Another niceness of OpenSSL is that if the high-order bit of a 521-bit
big num is not set then BN_bn2bin() will just return 65 bytes instead of
66 bytes with the 1st (big endian, after all) being all zero. When this
happens the wrong number of octets are mixed into function H(). So
there's a whole bunch of "offset" computations and BN_bn2bin() dumps the
big number into a buffer + offset. That should be obvious in the patch
too.
Diffstat (limited to 'src/eap_common/eap_pwd_common.c')
| -rw-r--r-- | src/eap_common/eap_pwd_common.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/src/eap_common/eap_pwd_common.c b/src/eap_common/eap_pwd_common.c index 5836cba..0dbdff2 100644 --- a/src/eap_common/eap_pwd_common.c +++ b/src/eap_common/eap_pwd_common.c @@ -284,6 +284,7 @@ int compute_keys(EAP_PWD_group *grp, BN_CTX *bnctx, BIGNUM *k, u8 mk[SHA256_DIGEST_LENGTH], *cruft; u8 session_id[SHA256_DIGEST_LENGTH + 1]; u8 msk_emsk[EAP_MSK_LEN + EAP_EMSK_LEN]; + int offset; if ((cruft = os_malloc(BN_num_bytes(grp->prime))) == NULL) return -1; @@ -295,16 +296,21 @@ int compute_keys(EAP_PWD_group *grp, BN_CTX *bnctx, BIGNUM *k, session_id[0] = EAP_TYPE_PWD; H_Init(&ctx); H_Update(&ctx, (u8 *)ciphersuite, sizeof(u32)); - BN_bn2bin(peer_scalar, cruft); + offset = BN_num_bytes(grp->order) - BN_num_bytes(peer_scalar); + os_memset(cruft, 0, BN_num_bytes(grp->prime)); + BN_bn2bin(peer_scalar, cruft + offset); H_Update(&ctx, cruft, BN_num_bytes(grp->order)); - BN_bn2bin(server_scalar, cruft); + offset = BN_num_bytes(grp->order) - BN_num_bytes(server_scalar); + os_memset(cruft, 0, BN_num_bytes(grp->prime)); + BN_bn2bin(server_scalar, cruft + offset); H_Update(&ctx, cruft, BN_num_bytes(grp->order)); H_Final(&ctx, &session_id[1]); /* then compute MK = H(k | commit-peer | commit-server) */ H_Init(&ctx); + offset = BN_num_bytes(grp->prime) - BN_num_bytes(k); os_memset(cruft, 0, BN_num_bytes(grp->prime)); - BN_bn2bin(k, cruft); + BN_bn2bin(k, cruft + offset); H_Update(&ctx, cruft, BN_num_bytes(grp->prime)); H_Update(&ctx, commit_peer, SHA256_DIGEST_LENGTH); H_Update(&ctx, commit_server, SHA256_DIGEST_LENGTH); |