package/network/services/hostapd/patches/061-0007-SAE-Mask-timing-of-MODP-groups-22-23-24.patch

   1 From 90839597cc4016b33f00055b12d59174c62770a3 Mon Sep 17 00:00:00 2001
   2 From: Jouni Malinen <jouni@codeaurora.org>
   3 Date: Sat, 2 Mar 2019 12:24:09 +0200
   4 Subject: [PATCH 07/14] SAE: Mask timing of MODP groups 22, 23, 24
   5
   6 These groups have significant probability of coming up with pwd-value
   7 that is equal or greater than the prime and as such, need for going
   8 through the PWE derivation loop multiple times. This can result in
   9 sufficient timing different to allow an external observer to determine
  10 how many rounds are needed and that can leak information about the used
  11 password.
  12
  13 Force at least 40 loop rounds for these MODP groups similarly to the ECC
  14 group design to mask timing. This behavior is not described in IEEE Std
  15 802.11-2016 for SAE, but it does not result in different values (i.e.,
  16 only different timing), so such implementation specific countermeasures
  17 can be done without breaking interoperability with other implementation.
  18
  19 Note: These MODP groups 22, 23, and 24 are not considered sufficiently
  20 strong to be used with SAE (or more or less anything else). As such,
  21 they should never be enabled in runtime configuration for any production
  22 use cases. These changes to introduce additional protection to mask
  23 timing is only for completeness of implementation and not an indication
  24 that these groups should be used.
  25
  26 This is related to CVE-2019-9494.
  27
  28 Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
  29 ---
  30  src/common/sae.c | 38 ++++++++++++++++++++++++++++----------
  31  1 file changed, 28 insertions(+), 10 deletions(-)
  32
  33 --- a/src/common/sae.c
  34 +++ b/src/common/sae.c
  35 @@ -578,22 +578,27 @@ fail:
  36  }
  37
  38
  39 +static int sae_modp_group_require_masking(int group)
  40 +{
  41 +       /* Groups for which pwd-value is likely to be >= p frequently */
  42 +       return group == 22 || group == 23 || group == 24;
  43 +}
  44 +
  45 +
  46  static int sae_derive_pwe_ffc(struct sae_data *sae, const u8 *addr1,
  47                               const u8 *addr2, const u8 *password,
  48                               size_t password_len, const char *identifier)
  49  {
  50 -       u8 counter;
  51 +       u8 counter, k;
  52         u8 addrs[2 * ETH_ALEN];
  53         const u8 *addr[3];
  54         size_t len[3];
  55         size_t num_elem;
  56         int found = 0;
  57 +       struct crypto_bignum *pwe = NULL;
  58
  59 -       if (sae->tmp->pwe_ffc == NULL) {
  60 -               sae->tmp->pwe_ffc = crypto_bignum_init();
  61 -               if (sae->tmp->pwe_ffc == NULL)
  62 -                       return -1;
  63 -       }
  64 +       crypto_bignum_deinit(sae->tmp->pwe_ffc, 1);
  65 +       sae->tmp->pwe_ffc = NULL;
  66
  67         wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password",
  68                               password, password_len);
  69 @@ -617,7 +622,9 @@ static int sae_derive_pwe_ffc(struct sae
  70         len[num_elem] = sizeof(counter);
  71         num_elem++;
  72
  73 -       for (counter = 1; !found; counter++) {
  74 +       k = sae_modp_group_require_masking(sae->group) ? 40 : 1;
  75 +
  76 +       for (counter = 1; counter <= k || !found; counter++) {
  77                 u8 pwd_seed[SHA256_MAC_LEN];
  78                 int res;
  79
  80 @@ -627,19 +634,30 @@ static int sae_derive_pwe_ffc(struct sae
  81                         break;
  82                 }
  83
  84 -               wpa_printf(MSG_DEBUG, "SAE: counter = %u", counter);
  85 +               wpa_printf(MSG_DEBUG, "SAE: counter = %02u", counter);
  86                 if (hmac_sha256_vector(addrs, sizeof(addrs), num_elem,
  87                                        addr, len, pwd_seed) < 0)
  88                         break;
  89 -               res = sae_test_pwd_seed_ffc(sae, pwd_seed, sae->tmp->pwe_ffc);
  90 +               if (!pwe) {
  91 +                       pwe = crypto_bignum_init();
  92 +                       if (!pwe)
  93 +                               break;
  94 +               }
  95 +               res = sae_test_pwd_seed_ffc(sae, pwd_seed, pwe);
  96                 if (res < 0)
  97                         break;
  98                 if (res > 0) {
  99 -                       wpa_printf(MSG_DEBUG, "SAE: Use this PWE");
 100                         found = 1;
 101 +                       if (!sae->tmp->pwe_ffc) {
 102 +                               wpa_printf(MSG_DEBUG, "SAE: Use this PWE");
 103 +                               sae->tmp->pwe_ffc = pwe;
 104 +                               pwe = NULL;
 105 +                       }
 106                 }
 107         }
 108
 109 +       crypto_bignum_deinit(pwe, 1);
 110 +
 111         return found ? 0 : -1;
 112  }
 113