768 lines
20 KiB
C
768 lines
20 KiB
C
/*-
|
|
* Copyright (C) 2010, Romain Tartiere.
|
|
*
|
|
* This program is free software: you can redistribute it and/or modify it
|
|
* under the terms of the GNU Lesser General Public License as published by the
|
|
* Free Software Foundation, either version 3 of the License, or (at your
|
|
* option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful, but WITHOUT
|
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
|
|
* more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public License
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>
|
|
*
|
|
* $Id$
|
|
*/
|
|
|
|
/*
|
|
* This implementation was written based on information provided by the
|
|
* following documents:
|
|
*
|
|
* NIST Special Publication 800-38B
|
|
* Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication
|
|
* May 2005
|
|
*/
|
|
|
|
#include "config.h"
|
|
|
|
#if defined(HAVE_SYS_TYPES_H)
|
|
# include <sys/types.h>
|
|
#endif
|
|
|
|
#if defined(HAVE_SYS_ENDIAN_H)
|
|
# include <sys/endian.h>
|
|
#endif
|
|
|
|
#if defined(HAVE_ENDIAN_H)
|
|
# include <endian.h>
|
|
#endif
|
|
|
|
#if defined(HAVE_COREFOUNDATION_COREFOUNDATION_H)
|
|
# include <CoreFoundation/CoreFoundation.h>
|
|
#endif
|
|
|
|
#if defined(HAVE_BYTESWAP_H)
|
|
# include <byteswap.h>
|
|
#endif
|
|
|
|
|
|
#if defined(HAVE_SYS_TYPES_H)
|
|
# include <sys/types.h>
|
|
#endif
|
|
|
|
#include <openssl/aes.h>
|
|
#include <openssl/des.h>
|
|
|
|
#include <err.h>
|
|
#include <string.h>
|
|
#include <strings.h>
|
|
|
|
#ifdef WITH_DEBUG
|
|
# include <libutil.h>
|
|
#endif
|
|
|
|
#include <freefare.h>
|
|
#include "freefare_internal.h"
|
|
|
|
#define MAC_LENGTH 4
|
|
#define CMAC_LENGTH 8
|
|
|
|
static void xor (const uint8_t *ivect, uint8_t *data, const size_t len);
|
|
static void desfire_crc32_byte (uint32_t *crc, const uint8_t value);
|
|
static size_t key_macing_length (MifareDESFireKey key);
|
|
|
|
static void
|
|
xor (const uint8_t *ivect, uint8_t *data, const size_t len)
|
|
{
|
|
for (size_t i = 0; i < len; i++) {
|
|
data[i] ^= ivect[i];
|
|
}
|
|
}
|
|
|
|
void
|
|
rol (uint8_t *data, const size_t len)
|
|
{
|
|
uint8_t first = data[0];
|
|
for (size_t i = 0; i < len-1; i++) {
|
|
data[i] = data[i+1];
|
|
}
|
|
data[len-1] = first;
|
|
}
|
|
|
|
void
|
|
lsl (uint8_t *data, size_t len)
|
|
{
|
|
for (size_t n = 0; n < len - 1; n++) {
|
|
data[n] = (data[n] << 1) | (data[n+1] >> 7);
|
|
}
|
|
data[len - 1] <<= 1;
|
|
}
|
|
|
|
void
|
|
cmac_generate_subkeys (MifareDESFireKey key)
|
|
{
|
|
int kbs = key_block_size (key);
|
|
const uint8_t R = (kbs == 8) ? 0x1B : 0x87;
|
|
|
|
uint8_t l[kbs];
|
|
memset (l, 0, kbs);
|
|
|
|
uint8_t ivect[kbs];
|
|
memset (ivect, 0, kbs);
|
|
|
|
mifare_cypher_blocks_chained (NULL, key, ivect, l, kbs, MCD_RECEIVE, MCO_ENCYPHER);
|
|
|
|
bool xor = false;
|
|
|
|
// Used to compute CMAC on complete blocks
|
|
memcpy (key->cmac_sk1, l, kbs);
|
|
xor = l[0] & 0x80;
|
|
lsl (key->cmac_sk1, kbs);
|
|
if (xor)
|
|
key->cmac_sk1[kbs-1] ^= R;
|
|
|
|
// Used to compute CMAC on the last block if non-complete
|
|
memcpy (key->cmac_sk2, key->cmac_sk1, kbs);
|
|
xor = key->cmac_sk1[0] & 0x80;
|
|
lsl (key->cmac_sk2, kbs);
|
|
if (xor)
|
|
key->cmac_sk2[kbs-1] ^= R;
|
|
}
|
|
|
|
void
|
|
cmac (const MifareDESFireKey key, uint8_t *ivect, const uint8_t *data, size_t len, uint8_t *cmac)
|
|
{
|
|
int kbs = key_block_size (key);
|
|
uint8_t *buffer = malloc (padded_data_length (len, kbs));
|
|
|
|
if (!buffer)
|
|
abort();
|
|
|
|
memcpy (buffer, data, len);
|
|
|
|
if ((!len) || (len % kbs)) {
|
|
buffer[len++] = 0x80;
|
|
while (len % kbs) {
|
|
buffer[len++] = 0x00;
|
|
}
|
|
xor (key->cmac_sk2, buffer + len - kbs, kbs);
|
|
} else {
|
|
xor (key->cmac_sk1, buffer + len - kbs, kbs);
|
|
}
|
|
|
|
mifare_cypher_blocks_chained (NULL, key, ivect, buffer, len, MCD_SEND, MCO_ENCYPHER);
|
|
|
|
memcpy (cmac, ivect, kbs);
|
|
|
|
free (buffer);
|
|
}
|
|
|
|
#define CRC32_PRESET 0xFFFFFFFF
|
|
|
|
static void
|
|
desfire_crc32_byte (uint32_t *crc, const uint8_t value)
|
|
{
|
|
/* x32 + x26 + x23 + x22 + x16 + x12 + x11 + x10 + x8 + x7 + x5 + x4 + x2 + x + 1 */
|
|
const uint32_t poly = 0xEDB88320;
|
|
|
|
*crc ^= value;
|
|
for (int current_bit = 7; current_bit >= 0; current_bit--) {
|
|
int bit_out = (*crc) & 0x00000001;
|
|
*crc >>= 1;
|
|
if (bit_out)
|
|
*crc ^= poly;
|
|
}
|
|
}
|
|
|
|
void
|
|
desfire_crc32 (const uint8_t *data, const size_t len, uint8_t *crc)
|
|
{
|
|
uint32_t desfire_crc = CRC32_PRESET;
|
|
for (size_t i = 0; i < len; i++) {
|
|
desfire_crc32_byte (&desfire_crc, data[i]);
|
|
}
|
|
|
|
*((uint32_t *)(crc)) = htole32 (desfire_crc);
|
|
}
|
|
|
|
void
|
|
desfire_crc32_append (uint8_t *data, const size_t len)
|
|
{
|
|
desfire_crc32 (data, len, data + len);
|
|
}
|
|
|
|
size_t
|
|
key_block_size (const MifareDESFireKey key)
|
|
{
|
|
size_t block_size;
|
|
|
|
switch (key->type) {
|
|
case T_DES:
|
|
case T_3DES:
|
|
case T_3K3DES:
|
|
block_size = 8;
|
|
break;
|
|
case T_AES:
|
|
block_size = 16;
|
|
break;
|
|
}
|
|
|
|
return block_size;
|
|
}
|
|
|
|
/*
|
|
* Size of MACing produced with the key.
|
|
*/
|
|
static size_t
|
|
key_macing_length (const MifareDESFireKey key)
|
|
{
|
|
size_t mac_length;
|
|
|
|
switch (key->type) {
|
|
case T_DES:
|
|
case T_3DES:
|
|
mac_length = MAC_LENGTH;
|
|
break;
|
|
case T_3K3DES:
|
|
case T_AES:
|
|
mac_length = CMAC_LENGTH;
|
|
break;
|
|
}
|
|
|
|
return mac_length;
|
|
}
|
|
|
|
/*
|
|
* Size required to store nbytes of data in a buffer of size n*block_size.
|
|
*/
|
|
size_t
|
|
padded_data_length (const size_t nbytes, const size_t block_size)
|
|
{
|
|
if ((!nbytes) || (nbytes % block_size))
|
|
return ((nbytes / block_size) + 1) * block_size;
|
|
else
|
|
return nbytes;
|
|
}
|
|
|
|
/*
|
|
* Buffer size required to MAC nbytes of data
|
|
*/
|
|
size_t
|
|
maced_data_length (const MifareDESFireKey key, const size_t nbytes)
|
|
{
|
|
return nbytes + key_macing_length (key);
|
|
}
|
|
/*
|
|
* Buffer size required to encipher nbytes of data and a two bytes CRC.
|
|
*/
|
|
size_t
|
|
enciphered_data_length (const MifareTag tag, const size_t nbytes, int communication_settings)
|
|
{
|
|
size_t crc_length = 0;
|
|
if (!(communication_settings & NO_CRC)) {
|
|
switch (MIFARE_DESFIRE (tag)->authentication_scheme) {
|
|
case AS_LEGACY:
|
|
crc_length = 2;
|
|
break;
|
|
case AS_NEW:
|
|
crc_length = 4;
|
|
break;
|
|
}
|
|
}
|
|
|
|
size_t block_size = key_block_size (MIFARE_DESFIRE (tag)->session_key);
|
|
|
|
return padded_data_length (nbytes + crc_length, block_size);
|
|
}
|
|
|
|
|
|
/*
|
|
* Ensure that tag's crypto buffer is large enough to store nbytes of data.
|
|
*/
|
|
void *
|
|
assert_crypto_buffer_size (MifareTag tag, size_t nbytes)
|
|
{
|
|
void *res = MIFARE_DESFIRE (tag)->crypto_buffer;
|
|
if (MIFARE_DESFIRE (tag)->crypto_buffer_size < nbytes) {
|
|
if ((res = realloc (MIFARE_DESFIRE (tag)->crypto_buffer, nbytes))) {
|
|
MIFARE_DESFIRE (tag)->crypto_buffer = res;
|
|
MIFARE_DESFIRE (tag)->crypto_buffer_size = nbytes;
|
|
}
|
|
}
|
|
return res;
|
|
}
|
|
|
|
void *
|
|
mifare_cryto_preprocess_data (MifareTag tag, void *data, size_t *nbytes, off_t offset, int communication_settings)
|
|
{
|
|
uint8_t *res = data;
|
|
uint8_t mac[4];
|
|
size_t edl, mdl;
|
|
bool append_mac = true;
|
|
MifareDESFireKey key = MIFARE_DESFIRE (tag)->session_key;
|
|
|
|
if (!key)
|
|
return data;
|
|
|
|
switch (communication_settings & MDCM_MASK) {
|
|
case MDCM_PLAIN:
|
|
if (AS_LEGACY == MIFARE_DESFIRE (tag)->authentication_scheme)
|
|
break;
|
|
|
|
/*
|
|
* When using new authentication methods, PLAIN data transmission from
|
|
* the PICC to the PCD are CMACed, so we have to maintain the
|
|
* cruptographic initialisation vector up-to-date to chaeck data
|
|
* integrity later.
|
|
*
|
|
* The only difference with CMACed data transmission is that the CMAC
|
|
* is not addpended to the data send byt the PCD to the PICC.
|
|
*/
|
|
|
|
append_mac = false;
|
|
|
|
/* pass through */
|
|
case MDCM_MACED:
|
|
switch (MIFARE_DESFIRE (tag)->authentication_scheme) {
|
|
case AS_LEGACY:
|
|
if (!(communication_settings & MAC_COMMAND))
|
|
break;
|
|
|
|
/* pass through */
|
|
edl = padded_data_length (*nbytes - offset, key_block_size (MIFARE_DESFIRE (tag)->session_key)) + offset;
|
|
if (!(res = assert_crypto_buffer_size (tag, edl)))
|
|
abort();
|
|
|
|
// Fill in the crypto buffer with data ...
|
|
memcpy (res, data, *nbytes);
|
|
// ... and 0 padding
|
|
memset (res + *nbytes, 0, edl - *nbytes);
|
|
|
|
mifare_cypher_blocks_chained (tag, NULL, NULL, res + offset, edl - offset, MCD_SEND, MCO_ENCYPHER);
|
|
|
|
memcpy (mac, res + edl - 8, 4);
|
|
|
|
// Copy again provided data (was overwritten by mifare_cypher_blocks_chained)
|
|
memcpy (res, data, *nbytes);
|
|
|
|
if (!(communication_settings & MAC_COMMAND))
|
|
break;
|
|
// Append MAC
|
|
mdl = maced_data_length (MIFARE_DESFIRE (tag)->session_key, *nbytes - offset) + offset;
|
|
if (!(res = assert_crypto_buffer_size (tag, mdl)))
|
|
abort();
|
|
|
|
memcpy (res + *nbytes, mac, 4);
|
|
|
|
*nbytes += 4;
|
|
break;
|
|
case AS_NEW:
|
|
if (!(communication_settings & CMAC_COMMAND))
|
|
break;
|
|
cmac (key, MIFARE_DESFIRE (tag)->ivect, res, *nbytes, MIFARE_DESFIRE (tag)->cmac);
|
|
|
|
if (append_mac) {
|
|
mdl = maced_data_length (key, *nbytes);
|
|
if (!(res = assert_crypto_buffer_size (tag, mdl)))
|
|
abort();
|
|
|
|
memcpy (res, data, *nbytes);
|
|
memcpy (res + *nbytes, MIFARE_DESFIRE (tag)->cmac, CMAC_LENGTH);
|
|
*nbytes += CMAC_LENGTH;
|
|
}
|
|
break;
|
|
}
|
|
|
|
break;
|
|
case MDCM_ENCIPHERED:
|
|
/* |<-------------- data -------------->|
|
|
* |<--- offset -->| |
|
|
* +---------------+--------------------+-----+---------+
|
|
* | CMD + HEADERS | DATA TO BE SECURED | CRC | PADDING |
|
|
* +---------------+--------------------+-----+---------+ ----------------
|
|
* | |<~~~~v~~~~~~~~~~~~~>| ^ | | (DES / 3DES)
|
|
* | | `---- crc16() ----' | |
|
|
* | | | ^ | | ----- *or* -----
|
|
* |<~~~~~~~~~~~~~~~~~~~~v~~~~~~~~~~~~~>| ^ | | (3K3DES / AES)
|
|
* | `---- crc32() ----' | |
|
|
* | | ---- *then* ----
|
|
* |<---------------------------------->|
|
|
* encypher()/decypher()
|
|
*/
|
|
|
|
if (!(communication_settings & ENC_COMMAND))
|
|
break;
|
|
edl = enciphered_data_length (tag, *nbytes - offset, communication_settings) + offset;
|
|
if (!(res = assert_crypto_buffer_size (tag, edl)))
|
|
abort();
|
|
|
|
// Fill in the crypto buffer with data ...
|
|
memcpy (res, data, *nbytes);
|
|
if (!(communication_settings & NO_CRC)) {
|
|
// ... CRC ...
|
|
switch (MIFARE_DESFIRE (tag)->authentication_scheme) {
|
|
case AS_LEGACY:
|
|
iso14443a_crc_append (res + offset, *nbytes - offset);
|
|
*nbytes += 2;
|
|
break;
|
|
case AS_NEW:
|
|
desfire_crc32_append (res, *nbytes);
|
|
*nbytes += 4;
|
|
break;
|
|
}
|
|
}
|
|
// ... and padding
|
|
memset (res + *nbytes, 0, edl - *nbytes);
|
|
|
|
*nbytes = edl;
|
|
|
|
mifare_cypher_blocks_chained (tag, NULL, NULL, res + offset, *nbytes - offset, MCD_SEND, (AS_NEW == MIFARE_DESFIRE (tag)->authentication_scheme) ? MCO_ENCYPHER : MCO_DECYPHER);
|
|
break;
|
|
default:
|
|
warnx ("Unknown communication settings");
|
|
#if WITH_DEBUG
|
|
abort ();
|
|
#endif
|
|
*nbytes = -1;
|
|
res = NULL;
|
|
break;
|
|
}
|
|
|
|
return res;
|
|
}
|
|
|
|
void *
|
|
mifare_cryto_postprocess_data (MifareTag tag, void *data, ssize_t *nbytes, int communication_settings)
|
|
{
|
|
void *res = data;
|
|
size_t edl;
|
|
void *edata = NULL;
|
|
uint8_t first_cmac_byte;
|
|
|
|
MifareDESFireKey key = MIFARE_DESFIRE (tag)->session_key;
|
|
|
|
if (!key)
|
|
return data;
|
|
|
|
// Return directly if we just have a status code.
|
|
if (1 == *nbytes)
|
|
return res;
|
|
|
|
switch (communication_settings & MDCM_MASK) {
|
|
case MDCM_PLAIN:
|
|
|
|
if (AS_LEGACY == MIFARE_DESFIRE (tag)->authentication_scheme)
|
|
break;
|
|
|
|
/* pass through */
|
|
case MDCM_MACED:
|
|
switch (MIFARE_DESFIRE (tag)->authentication_scheme) {
|
|
case AS_LEGACY:
|
|
if (communication_settings & MAC_VERIFY) {
|
|
*nbytes -= key_macing_length (key);
|
|
|
|
edl = enciphered_data_length (tag, *nbytes - 1, communication_settings);
|
|
edata = malloc (edl);
|
|
|
|
memcpy (edata, data, *nbytes - 1);
|
|
memset ((uint8_t *)edata + *nbytes - 1, 0, edl - *nbytes + 1);
|
|
|
|
mifare_cypher_blocks_chained (tag, NULL, NULL, edata, edl, MCD_SEND, MCO_ENCYPHER);
|
|
|
|
if (0 != memcmp ((uint8_t *)data + *nbytes - 1, (uint8_t *)edata + edl - 8, 4)) {
|
|
#if WITH_DEBUG
|
|
warnx ("MACing not verified");
|
|
hexdump ((uint8_t *)data + *nbytes - 1, key_macing_length (key), "Expect ", 0);
|
|
hexdump ((uint8_t *)edata + edl - 8, key_macing_length (key), "Actual ", 0);
|
|
#endif
|
|
MIFARE_DESFIRE (tag)->last_pcd_error = CRYPTO_ERROR;
|
|
*nbytes = -1;
|
|
res = NULL;
|
|
}
|
|
}
|
|
break;
|
|
case AS_NEW:
|
|
if (!(communication_settings & CMAC_COMMAND))
|
|
break;
|
|
if (communication_settings & CMAC_VERIFY) {
|
|
if (*nbytes < 9) {
|
|
// XXX: Can't we avoid abort() -ing?
|
|
warnx ("No room for CMAC!");
|
|
abort ();
|
|
}
|
|
first_cmac_byte = ((uint8_t *)data)[*nbytes - 9];
|
|
((uint8_t *)data)[*nbytes - 9] = ((uint8_t *)data)[*nbytes-1];
|
|
}
|
|
|
|
int n = (communication_settings & CMAC_VERIFY) ? 8 : 0;
|
|
cmac (key, MIFARE_DESFIRE (tag)->ivect, ((uint8_t *)data), *nbytes - n, MIFARE_DESFIRE (tag)->cmac);
|
|
|
|
if (communication_settings & CMAC_VERIFY) {
|
|
((uint8_t *)data)[*nbytes - 9] = first_cmac_byte;
|
|
if (0 != memcmp (MIFARE_DESFIRE (tag)->cmac, (uint8_t *)data + *nbytes - 9, 8)) {
|
|
#if WITH_DEBUG
|
|
warnx ("CMAC NOT verified :-(");
|
|
hexdump ((uint8_t *)data + *nbytes - 9, 8, "Expect ", 0);
|
|
hexdump (MIFARE_DESFIRE (tag)->cmac, 8, "Actual ", 0);
|
|
#endif
|
|
MIFARE_DESFIRE (tag)->last_pcd_error = CRYPTO_ERROR;
|
|
*nbytes = -1;
|
|
res = NULL;
|
|
} else {
|
|
*nbytes -= 8;
|
|
}
|
|
}
|
|
break;
|
|
}
|
|
|
|
free (edata);
|
|
|
|
break;
|
|
case MDCM_ENCIPHERED:
|
|
(*nbytes)--;
|
|
bool verified = false;
|
|
int crc_pos;
|
|
int end_crc_pos;
|
|
uint8_t x;
|
|
|
|
/*
|
|
* AS_LEGACY:
|
|
* ,-----------------+-------------------------------+--------+
|
|
* \ BLOCK n-1 | BLOCK n | STATUS |
|
|
* / PAYLOAD | CRC0 | CRC1 | 0x80? | 0x000000000000 | 0x9100 |
|
|
* `-----------------+-------------------------------+--------+
|
|
*
|
|
* <------------ DATA ------------>
|
|
* FRAME = PAYLOAD + CRC(PAYLOAD) + PADDING
|
|
*
|
|
* AS_NEW:
|
|
* ,-------------------------------+-----------------------------------------------+--------+
|
|
* \ BLOCK n-1 | BLOCK n | STATUS |
|
|
* / PAYLOAD | CRC0 | CRC1 | CRC2 | CRC3 | 0x80? | 0x0000000000000000000000000000 | 0x9100 |
|
|
* `-------------------------------+-----------------------------------------------+--------+
|
|
* <----------------------------------- DATA ------------------------------------->|
|
|
*
|
|
* <----------------- DATA ---------------->
|
|
* FRAME = PAYLOAD + CRC(PAYLOAD + STATUS) + PADDING + STATUS
|
|
* `------------------'
|
|
*/
|
|
|
|
mifare_cypher_blocks_chained (tag, NULL, NULL, res, *nbytes, MCD_RECEIVE, MCO_DECYPHER);
|
|
|
|
/*
|
|
* Look for the CRC and ensure it is followed by NULL padding. We
|
|
* can't start by the end because the CRC is supposed to be 0 when
|
|
* verified, and accumulating 0's in it should not change it.
|
|
*/
|
|
switch (MIFARE_DESFIRE (tag)->authentication_scheme) {
|
|
case AS_LEGACY:
|
|
crc_pos = *nbytes - 8 - 1; // The CRC can be over two blocks
|
|
break;
|
|
case AS_NEW:
|
|
/* Move status between payload and CRC */
|
|
res = assert_crypto_buffer_size (tag, (*nbytes) + 1);
|
|
memcpy (res, data, *nbytes);
|
|
|
|
crc_pos = (*nbytes) - 16 - 3;
|
|
if (crc_pos < 0) {
|
|
/* Single block */
|
|
crc_pos = 0;
|
|
}
|
|
memmove (res + crc_pos + 1, res + crc_pos, *nbytes - crc_pos);
|
|
((uint8_t *)res)[crc_pos] = 0x00;
|
|
crc_pos++;
|
|
*nbytes += 1;
|
|
break;
|
|
}
|
|
|
|
do {
|
|
uint16_t crc16;
|
|
uint32_t crc;
|
|
switch (MIFARE_DESFIRE (tag)->authentication_scheme) {
|
|
case AS_LEGACY:
|
|
end_crc_pos = crc_pos + 2;
|
|
iso14443a_crc (res, end_crc_pos, (uint8_t *)&crc16);
|
|
crc = crc16;
|
|
break;
|
|
case AS_NEW:
|
|
end_crc_pos = crc_pos + 4;
|
|
desfire_crc32 (res, end_crc_pos, (uint8_t *)&crc);
|
|
break;
|
|
}
|
|
if (!crc) {
|
|
verified = true;
|
|
for (int n = end_crc_pos; n < *nbytes - 1; n++) {
|
|
uint8_t byte = ((uint8_t *)res)[n];
|
|
if (!( (0x00 == byte) || ((0x80 == byte) && (n == end_crc_pos)) ))
|
|
verified = false;
|
|
}
|
|
}
|
|
if (verified) {
|
|
*nbytes = crc_pos;
|
|
switch (MIFARE_DESFIRE (tag)->authentication_scheme) {
|
|
case AS_LEGACY:
|
|
((uint8_t *)data)[(*nbytes)++] = 0x00;
|
|
break;
|
|
case AS_NEW:
|
|
/* The status byte was already before the CRC */
|
|
break;
|
|
}
|
|
} else {
|
|
switch (MIFARE_DESFIRE (tag)->authentication_scheme) {
|
|
case AS_LEGACY:
|
|
break;
|
|
case AS_NEW:
|
|
x = ((uint8_t *)res)[crc_pos - 1];
|
|
((uint8_t *)res)[crc_pos - 1] = ((uint8_t *)res)[crc_pos];
|
|
((uint8_t *)res)[crc_pos] = x;
|
|
break;
|
|
}
|
|
crc_pos++;
|
|
}
|
|
} while (!verified && (end_crc_pos < *nbytes));
|
|
|
|
if (!verified) {
|
|
#if WITH_DEBUG
|
|
/* FIXME In some configurations, the file is transmitted PLAIN */
|
|
warnx ("CRC not verified in decyphered stream");
|
|
#endif
|
|
MIFARE_DESFIRE (tag)->last_pcd_error = CRYPTO_ERROR;
|
|
*nbytes = -1;
|
|
res = NULL;
|
|
}
|
|
|
|
break;
|
|
default:
|
|
warnx ("Unknown communication settings");
|
|
#if WITH_DEBUG
|
|
abort ();
|
|
#endif
|
|
*nbytes = -1;
|
|
res = NULL;
|
|
break;
|
|
|
|
}
|
|
return res;
|
|
}
|
|
|
|
void
|
|
mifare_cypher_single_block (MifareDESFireKey key, uint8_t *data, uint8_t *ivect, MifareCryptoDirection direction, MifareCryptoOperation operation, size_t block_size)
|
|
{
|
|
AES_KEY k;
|
|
uint8_t ovect[MAX_CRYPTO_BLOCK_SIZE];
|
|
|
|
if (direction == MCD_SEND) {
|
|
xor (ivect, data, block_size);
|
|
} else {
|
|
memcpy (ovect, data, block_size);
|
|
}
|
|
|
|
uint8_t edata[MAX_CRYPTO_BLOCK_SIZE];
|
|
|
|
switch (key->type) {
|
|
case T_DES:
|
|
switch (operation) {
|
|
case MCO_ENCYPHER:
|
|
DES_ecb_encrypt ((DES_cblock *) data, (DES_cblock *) edata, &(key->ks1), DES_ENCRYPT);
|
|
break;
|
|
case MCO_DECYPHER:
|
|
DES_ecb_encrypt ((DES_cblock *) data, (DES_cblock *) edata, &(key->ks1), DES_DECRYPT);
|
|
break;
|
|
}
|
|
break;
|
|
case T_3DES:
|
|
switch (operation) {
|
|
case MCO_ENCYPHER:
|
|
DES_ecb_encrypt ((DES_cblock *) data, (DES_cblock *) edata, &(key->ks1), DES_ENCRYPT);
|
|
DES_ecb_encrypt ((DES_cblock *) edata, (DES_cblock *) data, &(key->ks2), DES_DECRYPT);
|
|
DES_ecb_encrypt ((DES_cblock *) data, (DES_cblock *) edata, &(key->ks1), DES_ENCRYPT);
|
|
break;
|
|
case MCO_DECYPHER:
|
|
DES_ecb_encrypt ((DES_cblock *) data, (DES_cblock *) edata, &(key->ks1), DES_DECRYPT);
|
|
DES_ecb_encrypt ((DES_cblock *) edata, (DES_cblock *) data, &(key->ks2), DES_ENCRYPT);
|
|
DES_ecb_encrypt ((DES_cblock *) data, (DES_cblock *) edata, &(key->ks1), DES_DECRYPT);
|
|
break;
|
|
}
|
|
break;
|
|
case T_3K3DES:
|
|
switch (operation) {
|
|
case MCO_ENCYPHER:
|
|
DES_ecb_encrypt ((DES_cblock *) data, (DES_cblock *) edata, &(key->ks1), DES_ENCRYPT);
|
|
DES_ecb_encrypt ((DES_cblock *) edata, (DES_cblock *) data, &(key->ks2), DES_DECRYPT);
|
|
DES_ecb_encrypt ((DES_cblock *) data, (DES_cblock *) edata, &(key->ks3), DES_ENCRYPT);
|
|
break;
|
|
case MCO_DECYPHER:
|
|
DES_ecb_encrypt ((DES_cblock *) data, (DES_cblock *) edata, &(key->ks3), DES_DECRYPT);
|
|
DES_ecb_encrypt ((DES_cblock *) edata, (DES_cblock *) data, &(key->ks2), DES_ENCRYPT);
|
|
DES_ecb_encrypt ((DES_cblock *) data, (DES_cblock *) edata, &(key->ks1), DES_DECRYPT);
|
|
break;
|
|
}
|
|
break;
|
|
case T_AES:
|
|
switch (operation) {
|
|
case MCO_ENCYPHER:
|
|
AES_set_encrypt_key (key->data, 8*16, &k);
|
|
AES_encrypt (data, edata, &k);
|
|
break;
|
|
case MCO_DECYPHER:
|
|
AES_set_decrypt_key (key->data, 8*16, &k);
|
|
AES_decrypt (data, edata, &k);
|
|
break;
|
|
}
|
|
break;
|
|
}
|
|
|
|
memcpy (data, edata, block_size);
|
|
|
|
if (direction == MCD_SEND) {
|
|
memcpy (ivect, data, block_size);
|
|
} else {
|
|
xor (ivect, data, block_size);
|
|
memcpy (ivect, ovect, block_size);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* This function performs all CBC cyphering / deciphering.
|
|
*
|
|
* The tag argument may be NULL, in which case both key and ivect shall be set.
|
|
* When using the tag session_key and ivect for processing data, these
|
|
* arguments should be set to NULL.
|
|
*
|
|
* Because the tag may contain additional data, one may need to call this
|
|
* function with tag, key and ivect defined.
|
|
*/
|
|
void
|
|
mifare_cypher_blocks_chained (MifareTag tag, MifareDESFireKey key, uint8_t *ivect, uint8_t *data, size_t data_size, MifareCryptoDirection direction, MifareCryptoOperation operation)
|
|
{
|
|
size_t block_size;
|
|
|
|
if (tag) {
|
|
if (!key)
|
|
key = MIFARE_DESFIRE (tag)->session_key;
|
|
if (!ivect)
|
|
ivect = MIFARE_DESFIRE (tag)->ivect;
|
|
|
|
switch (MIFARE_DESFIRE (tag)->authentication_scheme) {
|
|
case AS_LEGACY:
|
|
memset (ivect, 0, MAX_CRYPTO_BLOCK_SIZE);
|
|
break;
|
|
case AS_NEW:
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (!key || !ivect)
|
|
abort();
|
|
|
|
block_size = key_block_size (key);
|
|
|
|
size_t offset = 0;
|
|
while (offset < data_size) {
|
|
mifare_cypher_single_block (key, data + offset, ivect, direction, operation, block_size);
|
|
offset += block_size;
|
|
}
|
|
}
|