ikev2: Wipe (optional) shared secret during CHILD_SA key derivation
[strongswan.git] / src / libcharon / sa / ikev2 / keymat_v2.c
1 /*
2 * Copyright (C) 2008 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "keymat_v2.h"
17
18 #include <daemon.h>
19 #include <crypto/prf_plus.h>
20
21 typedef struct private_keymat_v2_t private_keymat_v2_t;
22
23 /**
24 * Private data of an keymat_t object.
25 */
26 struct private_keymat_v2_t {
27
28 /**
29 * Public keymat_v2_t interface.
30 */
31 keymat_v2_t public;
32
33 /**
34 * IKE_SA Role, initiator or responder
35 */
36 bool initiator;
37
38 /**
39 * inbound AEAD
40 */
41 aead_t *aead_in;
42
43 /**
44 * outbound AEAD
45 */
46 aead_t *aead_out;
47
48 /**
49 * General purpose PRF
50 */
51 prf_t *prf;
52
53 /**
54 * Negotiated PRF algorithm
55 */
56 pseudo_random_function_t prf_alg;
57
58 /**
59 * Key to derive key material from for CHILD_SAs, rekeying
60 */
61 chunk_t skd;
62
63 /**
64 * Key to build outging authentication data (SKp)
65 */
66 chunk_t skp_build;
67
68 /**
69 * Key to verify incoming authentication data (SKp)
70 */
71 chunk_t skp_verify;
72 };
73
74 METHOD(keymat_t, get_version, ike_version_t,
75 private_keymat_v2_t *this)
76 {
77 return IKEV2;
78 }
79
80 METHOD(keymat_t, create_dh, diffie_hellman_t*,
81 private_keymat_v2_t *this, diffie_hellman_group_t group)
82 {
83 return lib->crypto->create_dh(lib->crypto, group);
84 }
85
86 METHOD(keymat_t, create_nonce_gen, nonce_gen_t*,
87 private_keymat_v2_t *this)
88 {
89 return lib->crypto->create_nonce_gen(lib->crypto);
90 }
91
92 /**
93 * Derive IKE keys for a combined AEAD algorithm
94 */
95 static bool derive_ike_aead(private_keymat_v2_t *this, u_int16_t alg,
96 u_int16_t key_size, prf_plus_t *prf_plus)
97 {
98 aead_t *aead_i, *aead_r;
99 chunk_t key = chunk_empty;
100
101 /* SK_ei/SK_er used for encryption */
102 aead_i = lib->crypto->create_aead(lib->crypto, alg, key_size / 8);
103 aead_r = lib->crypto->create_aead(lib->crypto, alg, key_size / 8);
104 if (aead_i == NULL || aead_r == NULL)
105 {
106 DBG1(DBG_IKE, "%N %N (key size %d) not supported!",
107 transform_type_names, ENCRYPTION_ALGORITHM,
108 encryption_algorithm_names, alg, key_size);
109 goto failure;
110 }
111 key_size = aead_i->get_key_size(aead_i);
112 if (key_size != aead_r->get_key_size(aead_r))
113 {
114 goto failure;
115 }
116 if (!prf_plus->allocate_bytes(prf_plus, key_size, &key))
117 {
118 goto failure;
119 }
120 DBG4(DBG_IKE, "Sk_ei secret %B", &key);
121 if (!aead_i->set_key(aead_i, key))
122 {
123 goto failure;
124 }
125 chunk_clear(&key);
126
127 if (!prf_plus->allocate_bytes(prf_plus, key_size, &key))
128 {
129 goto failure;
130 }
131 DBG4(DBG_IKE, "Sk_er secret %B", &key);
132 if (!aead_r->set_key(aead_r, key))
133 {
134 goto failure;
135 }
136
137 if (this->initiator)
138 {
139 this->aead_in = aead_r;
140 this->aead_out = aead_i;
141 }
142 else
143 {
144 this->aead_in = aead_i;
145 this->aead_out = aead_r;
146 }
147 aead_i = aead_r = NULL;
148
149 failure:
150 DESTROY_IF(aead_i);
151 DESTROY_IF(aead_r);
152 chunk_clear(&key);
153 return this->aead_in && this->aead_out;
154 }
155
156 /**
157 * Derive IKE keys for traditional encryption and MAC algorithms
158 */
159 static bool derive_ike_traditional(private_keymat_v2_t *this, u_int16_t enc_alg,
160 u_int16_t enc_size, u_int16_t int_alg, prf_plus_t *prf_plus)
161 {
162 crypter_t *crypter_i = NULL, *crypter_r = NULL;
163 signer_t *signer_i, *signer_r;
164 size_t key_size;
165 chunk_t key = chunk_empty;
166
167 signer_i = lib->crypto->create_signer(lib->crypto, int_alg);
168 signer_r = lib->crypto->create_signer(lib->crypto, int_alg);
169 crypter_i = lib->crypto->create_crypter(lib->crypto, enc_alg, enc_size / 8);
170 crypter_r = lib->crypto->create_crypter(lib->crypto, enc_alg, enc_size / 8);
171 if (signer_i == NULL || signer_r == NULL)
172 {
173 DBG1(DBG_IKE, "%N %N not supported!",
174 transform_type_names, INTEGRITY_ALGORITHM,
175 integrity_algorithm_names, int_alg);
176 goto failure;
177 }
178 if (crypter_i == NULL || crypter_r == NULL)
179 {
180 DBG1(DBG_IKE, "%N %N (key size %d) not supported!",
181 transform_type_names, ENCRYPTION_ALGORITHM,
182 encryption_algorithm_names, enc_alg, enc_size);
183 goto failure;
184 }
185
186 /* SK_ai/SK_ar used for integrity protection */
187 key_size = signer_i->get_key_size(signer_i);
188
189 if (!prf_plus->allocate_bytes(prf_plus, key_size, &key))
190 {
191 goto failure;
192 }
193 DBG4(DBG_IKE, "Sk_ai secret %B", &key);
194 if (!signer_i->set_key(signer_i, key))
195 {
196 goto failure;
197 }
198 chunk_clear(&key);
199
200 if (!prf_plus->allocate_bytes(prf_plus, key_size, &key))
201 {
202 goto failure;
203 }
204 DBG4(DBG_IKE, "Sk_ar secret %B", &key);
205 if (!signer_r->set_key(signer_r, key))
206 {
207 goto failure;
208 }
209 chunk_clear(&key);
210
211 /* SK_ei/SK_er used for encryption */
212 key_size = crypter_i->get_key_size(crypter_i);
213
214 if (!prf_plus->allocate_bytes(prf_plus, key_size, &key))
215 {
216 goto failure;
217 }
218 DBG4(DBG_IKE, "Sk_ei secret %B", &key);
219 if (!crypter_i->set_key(crypter_i, key))
220 {
221 goto failure;
222 }
223 chunk_clear(&key);
224
225 if (!prf_plus->allocate_bytes(prf_plus, key_size, &key))
226 {
227 goto failure;
228 }
229 DBG4(DBG_IKE, "Sk_er secret %B", &key);
230 if (!crypter_r->set_key(crypter_r, key))
231 {
232 goto failure;
233 }
234
235 if (this->initiator)
236 {
237 this->aead_in = aead_create(crypter_r, signer_r);
238 this->aead_out = aead_create(crypter_i, signer_i);
239 }
240 else
241 {
242 this->aead_in = aead_create(crypter_i, signer_i);
243 this->aead_out = aead_create(crypter_r, signer_r);
244 }
245 signer_i = signer_r = NULL;
246 crypter_i = crypter_r = NULL;
247
248 failure:
249 chunk_clear(&key);
250 DESTROY_IF(signer_i);
251 DESTROY_IF(signer_r);
252 DESTROY_IF(crypter_i);
253 DESTROY_IF(crypter_r);
254 return this->aead_in && this->aead_out;
255 }
256
257 METHOD(keymat_v2_t, derive_ike_keys, bool,
258 private_keymat_v2_t *this, proposal_t *proposal, diffie_hellman_t *dh,
259 chunk_t nonce_i, chunk_t nonce_r, ike_sa_id_t *id,
260 pseudo_random_function_t rekey_function, chunk_t rekey_skd)
261 {
262 chunk_t skeyseed, key, secret, full_nonce, fixed_nonce, prf_plus_seed;
263 chunk_t spi_i, spi_r;
264 prf_plus_t *prf_plus = NULL;
265 u_int16_t alg, key_size, int_alg;
266 prf_t *rekey_prf = NULL;
267
268 spi_i = chunk_alloca(sizeof(u_int64_t));
269 spi_r = chunk_alloca(sizeof(u_int64_t));
270
271 if (dh->get_shared_secret(dh, &secret) != SUCCESS)
272 {
273 return FALSE;
274 }
275
276 /* Create SAs general purpose PRF first, we may use it here */
277 if (!proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &alg, NULL))
278 {
279 DBG1(DBG_IKE, "no %N selected",
280 transform_type_names, PSEUDO_RANDOM_FUNCTION);
281 chunk_clear(&secret);
282 return FALSE;
283 }
284 this->prf_alg = alg;
285 this->prf = lib->crypto->create_prf(lib->crypto, alg);
286 if (this->prf == NULL)
287 {
288 DBG1(DBG_IKE, "%N %N not supported!",
289 transform_type_names, PSEUDO_RANDOM_FUNCTION,
290 pseudo_random_function_names, alg);
291 chunk_clear(&secret);
292 return FALSE;
293 }
294 DBG4(DBG_IKE, "shared Diffie Hellman secret %B", &secret);
295 /* full nonce is used as seed for PRF+ ... */
296 full_nonce = chunk_cat("cc", nonce_i, nonce_r);
297 /* but the PRF may need a fixed key which only uses the first bytes of
298 * the nonces. */
299 switch (alg)
300 {
301 case PRF_AES128_XCBC:
302 /* while rfc4434 defines variable keys for AES-XCBC, rfc3664 does
303 * not and therefore fixed key semantics apply to XCBC for key
304 * derivation. */
305 case PRF_CAMELLIA128_XCBC:
306 /* draft-kanno-ipsecme-camellia-xcbc refers to rfc 4434, we
307 * assume fixed key length. */
308 key_size = this->prf->get_key_size(this->prf)/2;
309 nonce_i.len = min(nonce_i.len, key_size);
310 nonce_r.len = min(nonce_r.len, key_size);
311 break;
312 default:
313 /* all other algorithms use variable key length, full nonce */
314 break;
315 }
316 fixed_nonce = chunk_cat("cc", nonce_i, nonce_r);
317 *((u_int64_t*)spi_i.ptr) = id->get_initiator_spi(id);
318 *((u_int64_t*)spi_r.ptr) = id->get_responder_spi(id);
319 prf_plus_seed = chunk_cat("ccc", full_nonce, spi_i, spi_r);
320
321 /* KEYMAT = prf+ (SKEYSEED, Ni | Nr | SPIi | SPIr)
322 *
323 * if we are rekeying, SKEYSEED is built on another way
324 */
325 if (rekey_function == PRF_UNDEFINED) /* not rekeying */
326 {
327 /* SKEYSEED = prf(Ni | Nr, g^ir) */
328 if (this->prf->set_key(this->prf, fixed_nonce) &&
329 this->prf->allocate_bytes(this->prf, secret, &skeyseed) &&
330 this->prf->set_key(this->prf, skeyseed))
331 {
332 prf_plus = prf_plus_create(this->prf, TRUE, prf_plus_seed);
333 }
334 }
335 else
336 {
337 /* SKEYSEED = prf(SK_d (old), [g^ir (new)] | Ni | Nr)
338 * use OLD SAs PRF functions for both prf_plus and prf */
339 rekey_prf = lib->crypto->create_prf(lib->crypto, rekey_function);
340 if (!rekey_prf)
341 {
342 DBG1(DBG_IKE, "PRF of old SA %N not supported!",
343 pseudo_random_function_names, rekey_function);
344 chunk_clear(&secret);
345 chunk_free(&full_nonce);
346 chunk_free(&fixed_nonce);
347 chunk_clear(&prf_plus_seed);
348 return FALSE;
349 }
350 secret = chunk_cat("mc", secret, full_nonce);
351 if (rekey_prf->set_key(rekey_prf, rekey_skd) &&
352 rekey_prf->allocate_bytes(rekey_prf, secret, &skeyseed) &&
353 rekey_prf->set_key(rekey_prf, skeyseed))
354 {
355 prf_plus = prf_plus_create(rekey_prf, TRUE, prf_plus_seed);
356 }
357 }
358 DBG4(DBG_IKE, "SKEYSEED %B", &skeyseed);
359
360 chunk_clear(&skeyseed);
361 chunk_clear(&secret);
362 chunk_free(&full_nonce);
363 chunk_free(&fixed_nonce);
364 chunk_clear(&prf_plus_seed);
365
366 if (!prf_plus)
367 {
368 goto failure;
369 }
370
371 /* KEYMAT = SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr */
372
373 /* SK_d is used for generating CHILD_SA key mat => store for later use */
374 key_size = this->prf->get_key_size(this->prf);
375 if (!prf_plus->allocate_bytes(prf_plus, key_size, &this->skd))
376 {
377 goto failure;
378 }
379 DBG4(DBG_IKE, "Sk_d secret %B", &this->skd);
380
381 if (!proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &alg, &key_size))
382 {
383 DBG1(DBG_IKE, "no %N selected",
384 transform_type_names, ENCRYPTION_ALGORITHM);
385 goto failure;
386 }
387
388 if (encryption_algorithm_is_aead(alg))
389 {
390 if (!derive_ike_aead(this, alg, key_size, prf_plus))
391 {
392 goto failure;
393 }
394 }
395 else
396 {
397 if (!proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM,
398 &int_alg, NULL))
399 {
400 DBG1(DBG_IKE, "no %N selected",
401 transform_type_names, INTEGRITY_ALGORITHM);
402 goto failure;
403 }
404 if (!derive_ike_traditional(this, alg, key_size, int_alg, prf_plus))
405 {
406 goto failure;
407 }
408 }
409
410 /* SK_pi/SK_pr used for authentication => stored for later */
411 key_size = this->prf->get_key_size(this->prf);
412 if (!prf_plus->allocate_bytes(prf_plus, key_size, &key))
413 {
414 goto failure;
415 }
416 DBG4(DBG_IKE, "Sk_pi secret %B", &key);
417 if (this->initiator)
418 {
419 this->skp_build = key;
420 }
421 else
422 {
423 this->skp_verify = key;
424 }
425 if (!prf_plus->allocate_bytes(prf_plus, key_size, &key))
426 {
427 goto failure;
428 }
429 DBG4(DBG_IKE, "Sk_pr secret %B", &key);
430 if (this->initiator)
431 {
432 this->skp_verify = key;
433 }
434 else
435 {
436 this->skp_build = key;
437 }
438
439 /* all done, prf_plus not needed anymore */
440 failure:
441 DESTROY_IF(prf_plus);
442 DESTROY_IF(rekey_prf);
443
444 return this->skp_build.len && this->skp_verify.len;
445 }
446
447 METHOD(keymat_v2_t, derive_child_keys, bool,
448 private_keymat_v2_t *this, proposal_t *proposal, diffie_hellman_t *dh,
449 chunk_t nonce_i, chunk_t nonce_r, chunk_t *encr_i, chunk_t *integ_i,
450 chunk_t *encr_r, chunk_t *integ_r)
451 {
452 u_int16_t enc_alg, int_alg, enc_size = 0, int_size = 0;
453 chunk_t seed, secret = chunk_empty;
454 prf_plus_t *prf_plus;
455
456 if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM,
457 &enc_alg, &enc_size))
458 {
459 DBG2(DBG_CHD, " using %N for encryption",
460 encryption_algorithm_names, enc_alg);
461
462 if (!enc_size)
463 {
464 enc_size = keymat_get_keylen_encr(enc_alg);
465 }
466 if (enc_alg != ENCR_NULL && !enc_size)
467 {
468 DBG1(DBG_CHD, "no keylength defined for %N",
469 encryption_algorithm_names, enc_alg);
470 return FALSE;
471 }
472 /* to bytes */
473 enc_size /= 8;
474
475 /* CCM/GCM/CTR/GMAC needs additional bytes */
476 switch (enc_alg)
477 {
478 case ENCR_AES_CCM_ICV8:
479 case ENCR_AES_CCM_ICV12:
480 case ENCR_AES_CCM_ICV16:
481 case ENCR_CAMELLIA_CCM_ICV8:
482 case ENCR_CAMELLIA_CCM_ICV12:
483 case ENCR_CAMELLIA_CCM_ICV16:
484 enc_size += 3;
485 break;
486 case ENCR_AES_GCM_ICV8:
487 case ENCR_AES_GCM_ICV12:
488 case ENCR_AES_GCM_ICV16:
489 case ENCR_AES_CTR:
490 case ENCR_NULL_AUTH_AES_GMAC:
491 enc_size += 4;
492 break;
493 default:
494 break;
495 }
496 }
497
498 if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM,
499 &int_alg, &int_size))
500 {
501 DBG2(DBG_CHD, " using %N for integrity",
502 integrity_algorithm_names, int_alg);
503
504 if (!int_size)
505 {
506 int_size = keymat_get_keylen_integ(int_alg);
507 }
508 if (!int_size)
509 {
510 DBG1(DBG_CHD, "no keylength defined for %N",
511 integrity_algorithm_names, int_alg);
512 return FALSE;
513 }
514 /* to bytes */
515 int_size /= 8;
516 }
517
518 if (!this->prf->set_key(this->prf, this->skd))
519 {
520 return FALSE;
521 }
522
523 if (dh)
524 {
525 if (dh->get_shared_secret(dh, &secret) != SUCCESS)
526 {
527 return FALSE;
528 }
529 DBG4(DBG_CHD, "DH secret %B", &secret);
530 }
531 seed = chunk_cata("scc", secret, nonce_i, nonce_r);
532 DBG4(DBG_CHD, "seed %B", &seed);
533
534 prf_plus = prf_plus_create(this->prf, TRUE, seed);
535 memwipe(seed.ptr, seed.len);
536
537 if (!prf_plus)
538 {
539 return FALSE;
540 }
541
542 *encr_i = *integ_i = *encr_r = *integ_r = chunk_empty;
543 if (!prf_plus->allocate_bytes(prf_plus, enc_size, encr_i) ||
544 !prf_plus->allocate_bytes(prf_plus, int_size, integ_i) ||
545 !prf_plus->allocate_bytes(prf_plus, enc_size, encr_r) ||
546 !prf_plus->allocate_bytes(prf_plus, int_size, integ_r))
547 {
548 chunk_free(encr_i);
549 chunk_free(integ_i);
550 chunk_free(encr_r);
551 chunk_free(integ_r);
552 prf_plus->destroy(prf_plus);
553 return FALSE;
554 }
555
556 prf_plus->destroy(prf_plus);
557
558 if (enc_size)
559 {
560 DBG4(DBG_CHD, "encryption initiator key %B", encr_i);
561 DBG4(DBG_CHD, "encryption responder key %B", encr_r);
562 }
563 if (int_size)
564 {
565 DBG4(DBG_CHD, "integrity initiator key %B", integ_i);
566 DBG4(DBG_CHD, "integrity responder key %B", integ_r);
567 }
568 return TRUE;
569 }
570
571 METHOD(keymat_v2_t, get_skd, pseudo_random_function_t,
572 private_keymat_v2_t *this, chunk_t *skd)
573 {
574 *skd = this->skd;
575 return this->prf_alg;
576 }
577
578 METHOD(keymat_t, get_aead, aead_t*,
579 private_keymat_v2_t *this, bool in)
580 {
581 return in ? this->aead_in : this->aead_out;
582 }
583
584 METHOD(keymat_v2_t, get_auth_octets, bool,
585 private_keymat_v2_t *this, bool verify, chunk_t ike_sa_init,
586 chunk_t nonce, identification_t *id, char reserved[3], chunk_t *octets)
587 {
588 chunk_t chunk, idx;
589 chunk_t skp;
590
591 skp = verify ? this->skp_verify : this->skp_build;
592
593 chunk = chunk_alloca(4);
594 chunk.ptr[0] = id->get_type(id);
595 memcpy(chunk.ptr + 1, reserved, 3);
596 idx = chunk_cata("cc", chunk, id->get_encoding(id));
597
598 DBG3(DBG_IKE, "IDx' %B", &idx);
599 DBG4(DBG_IKE, "SK_p %B", &skp);
600 if (!this->prf->set_key(this->prf, skp) ||
601 !this->prf->allocate_bytes(this->prf, idx, &chunk))
602 {
603 return FALSE;
604 }
605 *octets = chunk_cat("ccm", ike_sa_init, nonce, chunk);
606 DBG3(DBG_IKE, "octets = message + nonce + prf(Sk_px, IDx') %B", octets);
607 return TRUE;
608 }
609
610 /**
611 * Key pad for the AUTH method SHARED_KEY_MESSAGE_INTEGRITY_CODE.
612 */
613 #define IKEV2_KEY_PAD "Key Pad for IKEv2"
614 #define IKEV2_KEY_PAD_LENGTH 17
615
616 METHOD(keymat_v2_t, get_psk_sig, bool,
617 private_keymat_v2_t *this, bool verify, chunk_t ike_sa_init, chunk_t nonce,
618 chunk_t secret, identification_t *id, char reserved[3], chunk_t *sig)
619 {
620 chunk_t key_pad, key, octets;
621
622 if (!secret.len)
623 { /* EAP uses SK_p if no MSK has been established */
624 secret = verify ? this->skp_verify : this->skp_build;
625 }
626 if (!get_auth_octets(this, verify, ike_sa_init, nonce, id, reserved, &octets))
627 {
628 return FALSE;
629 }
630 /* AUTH = prf(prf(Shared Secret,"Key Pad for IKEv2"), <msg octets>) */
631 key_pad = chunk_create(IKEV2_KEY_PAD, IKEV2_KEY_PAD_LENGTH);
632 if (!this->prf->set_key(this->prf, secret) ||
633 !this->prf->allocate_bytes(this->prf, key_pad, &key))
634 {
635 chunk_free(&octets);
636 return FALSE;
637 }
638 if (!this->prf->set_key(this->prf, key) ||
639 !this->prf->allocate_bytes(this->prf, octets, sig))
640 {
641 chunk_free(&key);
642 chunk_free(&octets);
643 return FALSE;
644 }
645 DBG4(DBG_IKE, "secret %B", &secret);
646 DBG4(DBG_IKE, "prf(secret, keypad) %B", &key);
647 DBG3(DBG_IKE, "AUTH = prf(prf(secret, keypad), octets) %B", sig);
648 chunk_free(&octets);
649 chunk_free(&key);
650
651 return TRUE;
652 }
653
654 METHOD(keymat_t, destroy, void,
655 private_keymat_v2_t *this)
656 {
657 DESTROY_IF(this->aead_in);
658 DESTROY_IF(this->aead_out);
659 DESTROY_IF(this->prf);
660 chunk_clear(&this->skd);
661 chunk_clear(&this->skp_verify);
662 chunk_clear(&this->skp_build);
663 free(this);
664 }
665
666 /**
667 * See header
668 */
669 keymat_v2_t *keymat_v2_create(bool initiator)
670 {
671 private_keymat_v2_t *this;
672
673 INIT(this,
674 .public = {
675 .keymat = {
676 .get_version = _get_version,
677 .create_dh = _create_dh,
678 .create_nonce_gen = _create_nonce_gen,
679 .get_aead = _get_aead,
680 .destroy = _destroy,
681 },
682 .derive_ike_keys = _derive_ike_keys,
683 .derive_child_keys = _derive_child_keys,
684 .get_skd = _get_skd,
685 .get_auth_octets = _get_auth_octets,
686 .get_psk_sig = _get_psk_sig,
687 },
688 .initiator = initiator,
689 .prf_alg = PRF_UNDEFINED,
690 );
691
692 return &this->public;
693 }