Hi,
I have got a problem with the TLS-PRF function for key derivation in
wpa_supplicant.
With version 2.5 the TLS-PRF-SHA256 for TLS1.2 was added to the source
code, but by default it's using the OpenSSL Implementation.
I have implemented a Radius Server thats using the same function, when
commenting out the OpenSSL call wpa_supplicant derives the same key as
my application, therefore the connection works.
If the OpenSSL implementation is used the keys differ.
I have added additional logging here are the necessary infos for the key
derivation:
2016-03-03 17:26:43.782 SSL Client Random: <Buffer 9d
02 f1 6c 68 ee a7 cf 10 80 c9 50 91 1e 4f 1a b1 39 72 79 b8 07 db a0 38
69 31 f7 eb 63 24 c8>
2016-03-03 17:26:43.786 SSL Server Random: <Buffer 55
cd ad 71 23 c4 f6 f0 e8 19 e1 8f 19 13 38 9a b2 31 78 09 f0 81 92 ee 4b
63 63 78 69 7b ed 95>
2016-03-03 17:26:43.883 SSL SSL Version: 771 771 TLS
1.2
2016-03-03 17:26:43.883 SSL SSL v1.0 <Buffer 6a d9 5f
88 04 c1 2c 43 05 35 16 3b e0 5e 78 c8 8d 3f 70 1f 08 f2 00 77 3f 26 84
2c 58 06 13 38 e3 ca b7 b6 90 67 e2 6e 1c 90 2c 07 d8 1e 4b a4 bc 3f ...
>
2016-03-03 17:26:43.884 SSL SSL v1.2 <Buffer 39 9e 3c
8f 30 aa 5a 96 11 cb 8e 54 e1 84 5e a4 79 4e c9 bb 38 c7 e2 9d ae c5 aa
42 59 f5 00 b3 f2 ea 77 5e 6f 5d 94 9b 45 a9 58 13 36 c2 92 d3 93 60 ...
>
2016-03-03 17:26:43.884 SSL Master Key: <Buffer 5b ef
6c ba f7 e4 29 9e 16 09 d8 fa 76 02 eb 8b d7 b5 ed 5f 8a c5 ea 35 f1 a3
9d 37 cb 74 ad ff 61 6a 01 f9 f4 a4 be 7a 66 85 af 07 ed 67 b0 1f>
2016-03-03 17:26:43.884 SSL Key Material: <Buffer 39
9e 3c 8f 30 aa 5a 96 11 cb 8e 54 e1 84 5e a4 79 4e c9 bb 38 c7 e2 9d ae
c5 aa 42 59 f5 00 b3 f2 ea 77 5e 6f 5d 94 9b 45 a9 58 13 36 c2 92 d3 93
60 ... >
2016-03-03 17:26:43.884 SSL MSK: <Buffer 39 9e 3c 8f
30 aa 5a 96 11 cb 8e 54 e1 84 5e a4 79 4e c9 bb 38 c7 e2 9d ae c5 aa 42
59 f5 00 b3 f2 ea 77 5e 6f 5d 94 9b 45 a9 58 13 36 c2 92 d3 93 60 ... >
64
2016-03-03 17:26:43.885 SSL EMSK: <Buffer 6a f4 69 0b
c2 ab c6 de e8 11 ef fc 39 73 54 85 9e d8 91 67 fb 2a 2d 92 69 70 87 37
0f 00 9a ca d0 81 9b e3 b3 1c 92 8f b8 67 3e c7 cb 7c e1 c8 ac c7 ... >
The derived keys in wpa_supplicant:
First here the key OpenSSL is trying to tell us:
1459351603.922696: OpenSSL - Derived - hexdump(len=64): 6a 41 ed ab 85
dd f8 99 75 2d 6c 3b e4 0e d9 04 07 9a 63 9c 8f 65 b4 37 7c 39 71 a2 f4
1e a1 26 66 a8 23 08 f1 d2 ee 13 5f 99 76 f8 a5 01 12 b8 6b a4 f1 21 1d
7f 87 a6 ef 19 51 21 1b 30 65 90
here is the key the wpa_supplicant implementation returns:
1459351603.922707: Derived - hexdump(len=32): 9d 02 f1 6c 68 ee a7 cf 10
80 c9 50 91 1e 4f 1a b1 39 72 79 b8 07 db a0 38 69 31 f7 eb 63 24 c8
1459351603.922711: Derived - hexdump(len=32): 55 cd ad 71 23 c4 f6 f0 e8
19 e1 8f 19 13 38 9a b2 31 78 09 f0 81 92 ee 4b 63 63 78 69 7b ed 95
1459351603.922715: Derived - sha256 TLS1.2
1459351603.922739: EAP-PEAP: Derived key 3333 - hexdump(len=64): 39 9e
3c 8f 30 aa 5a 96 11 cb 8e 54 e1 84 5e a4 79 4e c9 bb 38 c7 e2 9d ae c5
aa 42 59 f5 00 b3 f2 ea 77 5e 6f 5d 94 9b 45 a9 58 13 36 c2 92 d3 93 60
02 b2 a9 c2 88 8d 80 a1 ac fd f0 f5 24 ce
1459351603.922751: EAP-PEAP: Derived Session-Id 3333 - hexdump(len=65):
19 9d 02 f1 6c 68 ee a7 cf 10 80 c9 50 91 1e 4f 1a b1 39 72 79 b8 07 db
a0 38 69 31 f7 eb 63 24 c8 55 cd ad 71 23 c4 f6 f0 e8 19 e1 8f 19 13 38
9a b2 31 78 09 f0 81 92 ee 4b 63 63 78 69 7b ed 95
I added those logs, so don't search for them ;)
As you can see the wpa_supplicant implementation returns the same MSK as
my implementation. Either BOTH of them are defective or OpenSSL is doing
something shady.
Does someone have insight into the OpenSSL implementation and why it's
returning "a wrong" key?
BR
Thomas
_______________________________________________
Hostap mailing list
Hostap@xxxxxxxxxxxxxxxxxxx
http://lists.infradead.org/mailman/listinfo/hostap
