2 * Copyright 2002-2004, Instant802 Networks, Inc.
3 * Copyright 2005, Devicescape Software, Inc.
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
10 #ifdef CONFIG_TKIP_DEBUG
11 #include <linux/config.h>
12 #include <linux/version.h>
13 #include <linux/module.h>
14 #include <linux/kernel.h>
15 #include <linux/skbuff.h>
16 #endif /* CONFIG_TKIP_DEBUG */
18 #include <linux/types.h>
19 #include <linux/netdevice.h>
21 #include <net/ieee80211.h>
22 #include "ieee80211_key.h"
23 #ifdef CONFIG_TKIP_DEBUG
24 #include "ieee80211_i.h"
25 #endif /* CONFIG_TKIP_DEBUG */
28 /* Dummy prototypes for structures used in wep.h, but not really needed for
30 struct ieee80211_local;
35 /* TKIP key mixing functions */
38 #define PHASE1_LOOP_COUNT 8
41 /* 2-byte by 2-byte subset of the full AES S-box table; second part of this
42 * table is identical to first part but byte-swapped */
43 static const u16 tkip_sbox[256] =
45 0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154,
46 0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A,
47 0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B,
48 0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B,
49 0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F,
50 0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F,
51 0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5,
52 0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F,
53 0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB,
54 0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397,
55 0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED,
56 0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A,
57 0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194,
58 0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3,
59 0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104,
60 0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D,
61 0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39,
62 0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695,
63 0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83,
64 0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76,
65 0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4,
66 0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B,
67 0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0,
68 0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018,
69 0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751,
70 0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85,
71 0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12,
72 0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9,
73 0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7,
74 0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A,
75 0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8,
76 0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A,
80 static inline u16 Mk16(u8 x, u8 y)
82 return ((u16) x << 8) | (u16) y;
86 static inline u8 Hi8(u16 v)
92 static inline u8 Lo8(u16 v)
98 static inline u16 Hi16(u32 v)
104 static inline u16 Lo16(u32 v)
110 static inline u16 RotR1(u16 v)
112 return (v >> 1) | ((v & 0x0001) << 15);
116 static inline u16 tkip_S(u16 val)
118 u16 a = tkip_sbox[Hi8(val)];
120 return tkip_sbox[Lo8(val)] ^ Hi8(a) ^ (Lo8(a) << 8);
125 /* P1K := Phase1(TA, TK, TSC)
126 * TA = transmitter address (48 bits)
127 * TK = dot11DefaultKeyValue or dot11KeyMappingValue (128 bits)
128 * TSC = TKIP sequence counter (48 bits, only 32 msb bits used)
131 static void tkip_mixing_phase1(const u8 *ta, const u8 *tk, u32 tsc_IV32,
136 p1k[0] = Lo16(tsc_IV32);
137 p1k[1] = Hi16(tsc_IV32);
138 p1k[2] = Mk16(ta[1], ta[0]);
139 p1k[3] = Mk16(ta[3], ta[2]);
140 p1k[4] = Mk16(ta[5], ta[4]);
142 for (i = 0; i < PHASE1_LOOP_COUNT; i++) {
144 p1k[0] += tkip_S(p1k[4] ^ Mk16(tk[ 1 + j], tk[ 0 + j]));
145 p1k[1] += tkip_S(p1k[0] ^ Mk16(tk[ 5 + j], tk[ 4 + j]));
146 p1k[2] += tkip_S(p1k[1] ^ Mk16(tk[ 9 + j], tk[ 8 + j]));
147 p1k[3] += tkip_S(p1k[2] ^ Mk16(tk[13 + j], tk[12 + j]));
148 p1k[4] += tkip_S(p1k[3] ^ Mk16(tk[ 1 + j], tk[ 0 + j])) + i;
153 static void tkip_mixing_phase2(const u16 *p1k, const u8 *tk, u16 tsc_IV16,
164 ppk[5] = p1k[4] + tsc_IV16;
166 ppk[0] += tkip_S(ppk[5] ^ Mk16(tk[ 1], tk[ 0]));
167 ppk[1] += tkip_S(ppk[0] ^ Mk16(tk[ 3], tk[ 2]));
168 ppk[2] += tkip_S(ppk[1] ^ Mk16(tk[ 5], tk[ 4]));
169 ppk[3] += tkip_S(ppk[2] ^ Mk16(tk[ 7], tk[ 6]));
170 ppk[4] += tkip_S(ppk[3] ^ Mk16(tk[ 9], tk[ 8]));
171 ppk[5] += tkip_S(ppk[4] ^ Mk16(tk[11], tk[10]));
172 ppk[0] += RotR1(ppk[5] ^ Mk16(tk[13], tk[12]));
173 ppk[1] += RotR1(ppk[0] ^ Mk16(tk[15], tk[14]));
174 ppk[2] += RotR1(ppk[1]);
175 ppk[3] += RotR1(ppk[2]);
176 ppk[4] += RotR1(ppk[3]);
177 ppk[5] += RotR1(ppk[4]);
179 rc4key[0] = Hi8(tsc_IV16);
180 rc4key[1] = (Hi8(tsc_IV16) | 0x20) & 0x7f;
181 rc4key[2] = Lo8(tsc_IV16);
182 rc4key[3] = Lo8((ppk[5] ^ Mk16(tk[1], tk[0])) >> 1);
184 for (i = 0; i < 6; i++) {
185 rc4key[4 + 2 * i] = Lo8(ppk[i]);
186 rc4key[5 + 2 * i] = Hi8(ppk[i]);
191 /* Add TKIP IV and Ext. IV at @pos. @iv0, @iv1, and @iv2 are the first octets
192 * of the IV. Returns pointer to the octet following IVs (i.e., beginning of
193 * the packet payload). */
194 u8 * ieee80211_tkip_add_iv(u8 *pos, struct ieee80211_key *key,
195 u8 iv0, u8 iv1, u8 iv2)
200 *pos++ = (key->keyidx << 6) | (1 << 5) /* Ext IV */;
201 *pos++ = key->u.tkip.iv32 & 0xff;
202 *pos++ = (key->u.tkip.iv32 >> 8) & 0xff;
203 *pos++ = (key->u.tkip.iv32 >> 16) & 0xff;
204 *pos++ = (key->u.tkip.iv32 >> 24) & 0xff;
209 /* Encrypt packet payload with TKIP using @key. @pos is a pointer to the
210 * beginning of the buffer containing payload. This payload must include
211 * headroom of eight octets for IV and Ext. IV and taildroom of four octets
212 * for ICV. @payload_len is the length of payload (_not_ including extra
213 * headroom and tailroom). @ta is the transmitter addresses. */
214 void ieee80211_tkip_encrypt_data(struct ieee80211_key *key, u8 *pos,
215 size_t payload_len, u8 *ta)
219 /* Calculate per-packet key */
220 if (key->u.tkip.iv16 == 0 || !key->u.tkip.tx_initialized) {
221 /* IV16 wrapped around - perform TKIP phase 1 */
222 tkip_mixing_phase1(ta, &key->key[ALG_TKIP_TEMP_ENCR_KEY],
223 key->u.tkip.iv32, key->u.tkip.p1k);
224 key->u.tkip.tx_initialized = 1;
227 tkip_mixing_phase2(key->u.tkip.p1k, &key->key[ALG_TKIP_TEMP_ENCR_KEY],
228 key->u.tkip.iv16, rc4key);
230 pos = ieee80211_tkip_add_iv(pos, key, rc4key[0], rc4key[1], rc4key[2]);
231 ieee80211_wep_encrypt_data(rc4key, 16, pos, payload_len);
235 /* Decrypt packet payload with TKIP using @key. @pos is a pointer to the
236 * beginning of the buffer containing IEEE 802.11 header payload, i.e.,
237 * including IV, Ext. IV, real data, Michael MIC, ICV. @payload_len is the
238 * length of payload, including IV, Ext. IV, MIC, ICV. */
239 int ieee80211_tkip_decrypt_data(struct ieee80211_key *key, u8 *payload,
240 size_t payload_len, u8 *ta, int only_iv,
245 u8 rc4key[16], keyid, *pos = payload;
248 if (payload_len < 12)
251 iv16 = (pos[0] << 8) | pos[2];
253 iv32 = pos[4] | (pos[5] << 8) | (pos[6] << 16) | (pos[7] << 24);
255 #ifdef CONFIG_TKIP_DEBUG
258 printk(KERN_DEBUG "TKIP decrypt: data(len=%zd)", payload_len);
259 for (i = 0; i < payload_len; i++)
260 printk(" %02x", payload[i]);
262 printk(KERN_DEBUG "TKIP decrypt: iv16=%04x iv32=%08x\n",
265 #endif /* CONFIG_TKIP_DEBUG */
267 if (!(keyid & (1 << 5)))
268 return TKIP_DECRYPT_NO_EXT_IV;
270 if ((keyid >> 6) != key->keyidx)
271 return TKIP_DECRYPT_INVALID_KEYIDX;
273 if (key->u.tkip.rx_initialized[queue] &&
274 (iv32 < key->u.tkip.iv32_rx[queue] ||
275 (iv32 == key->u.tkip.iv32_rx[queue] &&
276 iv16 <= key->u.tkip.iv16_rx[queue]))) {
277 #ifdef CONFIG_TKIP_DEBUG
278 printk(KERN_DEBUG "TKIP replay detected for RX frame from "
279 MACSTR " (RX IV (%04x,%02x) <= prev. IV (%04x,%02x)\n",
281 iv32, iv16, key->u.tkip.iv32_rx[queue],
282 key->u.tkip.iv16_rx[queue]);
283 #endif /* CONFIG_TKIP_DEBUG */
284 return TKIP_DECRYPT_REPLAY;
288 res = TKIP_DECRYPT_OK;
292 if (!key->u.tkip.rx_initialized[queue] ||
293 key->u.tkip.iv32_rx[queue] != iv32) {
294 key->u.tkip.rx_initialized[queue] = 1;
295 /* IV16 wrapped around - perform TKIP phase 1 */
296 tkip_mixing_phase1(ta, &key->key[ALG_TKIP_TEMP_ENCR_KEY],
297 iv32, key->u.tkip.p1k_rx[queue]);
298 #ifdef CONFIG_TKIP_DEBUG
301 printk(KERN_DEBUG "TKIP decrypt: Phase1 TA=" MACSTR
302 " TK=", MAC2STR(ta));
303 for (i = 0; i < 16; i++)
305 key->key[ALG_TKIP_TEMP_ENCR_KEY + i]);
307 printk(KERN_DEBUG "TKIP decrypt: P1K=");
308 for (i = 0; i < 5; i++)
309 printk("%04x ", key->u.tkip.p1k_rx[queue][i]);
312 #endif /* CONFIG_TKIP_DEBUG */
315 tkip_mixing_phase2(key->u.tkip.p1k_rx[queue],
316 &key->key[ALG_TKIP_TEMP_ENCR_KEY],
318 #ifdef CONFIG_TKIP_DEBUG
321 printk(KERN_DEBUG "TKIP decrypt: Phase2 rc4key=");
322 for (i = 0; i < 16; i++)
323 printk("%02x ", rc4key[i]);
326 #endif /* CONFIG_TKIP_DEBUG */
328 res = ieee80211_wep_decrypt_data(rc4key, 16, pos, payload_len - 12);
330 if (res == TKIP_DECRYPT_OK) {
331 /* FIX: these should be updated only after Michael MIC has been
333 /* Record previously received IV */
334 key->u.tkip.iv32_rx[queue] = iv32;
335 key->u.tkip.iv16_rx[queue] = iv16;