|
 |
52ecbf |
From: Antonio Torres <antorres@redhat.com>
|
|
|
52ecbf |
Date: Fri, 09 Dec 2022
|
|
|
52ecbf |
Subject: Fix information leakage in EAP-PWD
|
|
|
52ecbf |
|
|
|
52ecbf |
The EAP-PWD function compute_password_element() leaks information about the
|
|
|
52ecbf |
password which allows an attacker to substantially reduce the size of an
|
|
|
52ecbf |
offline dictionary attack.
|
|
|
52ecbf |
|
|
|
52ecbf |
Patch adapted from: https://github.com/FreeRADIUS/freeradius-server/commit/9e5e8f2f
|
|
|
52ecbf |
|
|
|
52ecbf |
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2151702
|
|
|
52ecbf |
Signed-off-by: Antonio Torres <antorres@redhat.com>
|
|
|
52ecbf |
---
|
|
|
52ecbf |
diff --git a/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c b/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c
|
|
|
52ecbf |
index d94851c3aa..9f86b62114 100644
|
|
|
52ecbf |
--- a/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c
|
|
|
52ecbf |
+++ b/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c
|
|
|
52ecbf |
@@ -39,6 +39,8 @@ USES_APPLE_DEPRECATED_API /* OpenSSL API has been deprecated by Apple */
|
|
|
52ecbf |
#include <freeradius-devel/radiusd.h>
|
|
|
52ecbf |
#include <freeradius-devel/modules.h>
|
|
|
52ecbf |
|
|
|
52ecbf |
+static uint8_t allzero[SHA256_DIGEST_LENGTH] = { 0x00 };
|
|
|
52ecbf |
+
|
|
|
52ecbf |
/* The random function H(x) = HMAC-SHA256(0^32, x) */
|
|
|
52ecbf |
static void H_Init(HMAC_CTX *ctx)
|
|
|
52ecbf |
{
|
|
|
52ecbf |
@@ -114,15 +116,13 @@ int compute_password_element (pwd_session_t *session, uint16_t grp_num,
|
|
|
52ecbf |
uint32_t *token)
|
|
|
52ecbf |
{
|
|
|
52ecbf |
BIGNUM *x_candidate = NULL, *rnd = NULL, *cofactor = NULL;
|
|
|
52ecbf |
- HMAC_CTX *ctx = NULL;
|
|
|
52ecbf |
+ EVP_MD_CTX *hmac_ctx;
|
|
|
52ecbf |
+ EVP_PKEY *hmac_pkey;
|
|
|
52ecbf |
uint8_t pwe_digest[SHA256_DIGEST_LENGTH], *prfbuf = NULL, ctr;
|
|
|
52ecbf |
int nid, is_odd, primebitlen, primebytelen, ret = 0;
|
|
|
52ecbf |
|
|
|
52ecbf |
- ctx = HMAC_CTX_new();
|
|
|
52ecbf |
- if (ctx == NULL) {
|
|
|
52ecbf |
- DEBUG("failed allocating HMAC context");
|
|
|
52ecbf |
- goto fail;
|
|
|
52ecbf |
- }
|
|
|
52ecbf |
+ MEM(hmac_ctx = EVP_MD_CTX_new());
|
|
|
52ecbf |
+ MEM(hmac_pkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, allzero, sizeof(allzero)));
|
|
|
52ecbf |
|
|
|
52ecbf |
switch (grp_num) { /* from IANA registry for IKE D-H groups */
|
|
|
52ecbf |
case 19:
|
|
|
52ecbf |
@@ -203,13 +203,12 @@ int compute_password_element (pwd_session_t *session, uint16_t grp_num,
|
|
|
52ecbf |
* pwd-seed = H(token | peer-id | server-id | password |
|
|
|
52ecbf |
* counter)
|
|
|
52ecbf |
*/
|
|
|
52ecbf |
- H_Init(ctx);
|
|
|
52ecbf |
- H_Update(ctx, (uint8_t *)token, sizeof(*token));
|
|
|
52ecbf |
- H_Update(ctx, (uint8_t const *)id_peer, id_peer_len);
|
|
|
52ecbf |
- H_Update(ctx, (uint8_t const *)id_server, id_server_len);
|
|
|
52ecbf |
- H_Update(ctx, (uint8_t const *)password, password_len);
|
|
|
52ecbf |
- H_Update(ctx, (uint8_t *)&ctr, sizeof(ctr));
|
|
|
52ecbf |
- H_Final(ctx, pwe_digest);
|
|
|
52ecbf |
+ EVP_DigestSignInit(hmac_ctx, NULL, EVP_sha256(), NULL, hmac_pkey);
|
|
|
52ecbf |
+ EVP_DigestSignUpdate(hmac_ctx, (uint8_t *)token, sizeof(*token));
|
|
|
52ecbf |
+ EVP_DigestSignUpdate(hmac_ctx, (uint8_t const *)id_peer, id_peer_len);
|
|
|
52ecbf |
+ EVP_DigestSignUpdate(hmac_ctx, (uint8_t const *)id_server, id_server_len);
|
|
|
52ecbf |
+ EVP_DigestSignUpdate(hmac_ctx, (uint8_t const *)password, password_len);
|
|
|
52ecbf |
+ EVP_DigestSignUpdate(hmac_ctx, (uint8_t *)&ctr, sizeof(ctr));
|
|
|
52ecbf |
|
|
|
52ecbf |
BN_bin2bn(pwe_digest, SHA256_DIGEST_LENGTH, rnd);
|
|
|
52ecbf |
if (eap_pwd_kdf(pwe_digest, SHA256_DIGEST_LENGTH, "EAP-pwd Hunting And Pecking",
|
|
|
52ecbf |
@@ -282,7 +281,8 @@ int compute_password_element (pwd_session_t *session, uint16_t grp_num,
|
|
|
52ecbf |
BN_clear_free(x_candidate);
|
|
|
52ecbf |
BN_clear_free(rnd);
|
|
|
52ecbf |
talloc_free(prfbuf);
|
|
|
52ecbf |
- HMAC_CTX_free(ctx);
|
|
|
52ecbf |
+ EVP_MD_CTX_free(hmac_ctx);
|
|
|
52ecbf |
+ EVP_PKEY_free(hmac_pkey);
|
|
|
52ecbf |
|
|
|
52ecbf |
return ret;
|
|
|
52ecbf |
}
|