]> cvs.zerfleddert.de Git - proxmark3-svn/blame - client/loclass/ikeys.c
Reverted to original malicious CSNs from paper, it appears legit readers does not...
[proxmark3-svn] / client / loclass / ikeys.c
CommitLineData
a66fca86
AD
1/*****************************************************************************
2 * This file is part of iClassCipher. It is a reconstructon of the cipher engine
3 * used in iClass, and RFID techology.
4 *
5 * The implementation is based on the work performed by
6 * Flavio D. Garcia, Gerhard de Koning Gans, Roel Verdult and
7 * Milosch Meriac in the paper "Dismantling IClass".
8 *
3ad48540
MHS
9 * This is a reference implementation of iclass key diversification. I'm sure it can be
10 * optimized heavily. It is written for ease of understanding and correctness, please take it
11 * and tweak it and make a super fast version instead, using this for testing and verification.
12
a66fca86
AD
13 * Copyright (C) 2014 Martin Holst Swende
14 *
15 * This is free software: you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License version 2 as published
17 * by the Free Software Foundation.
18 *
19 * This file is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
23 *
24 * You should have received a copy of the GNU General Public License
25 * along with IClassCipher. If not, see <http://www.gnu.org/licenses/>.
26 ****************************************************************************/
27/**
3ad48540
MHS
28
29
a66fca86
AD
30From "Dismantling iclass":
31 This section describes in detail the built-in key diversification algorithm of iClass.
32 Besides the obvious purpose of deriving a card key from a master key, this
33 algorithm intends to circumvent weaknesses in the cipher by preventing the
34 usage of certain ‘weak’ keys. In order to compute a diversified key, the iClass
35 reader first encrypts the card identity id with the master key K, using single
36 DES. The resulting ciphertext is then input to a function called hash0 which
37 outputs the diversified key k.
38
39 k = hash0(DES enc (id, K))
40
41 Here the DES encryption of id with master key K outputs a cryptogram c
42 of 64 bits. These 64 bits are divided as c = x, y, z [0] , . . . , z [7] ∈ F 82 × F 82 × (F 62 ) 8
43 which is used as input to the hash0 function. This function introduces some
44 obfuscation by performing a number of permutations, complement and modulo
45 operations, see Figure 2.5. Besides that, it checks for and removes patterns like
46 similar key bytes, which could produce a strong bias in the cipher. Finally, the
47 output of hash0 is the diversified card key k = k [0] , . . . , k [7] ∈ (F 82 ) 8 .
48
49
50**/
51
52
53#include <stdint.h>
54#include <stdbool.h>
55#include <string.h>
a66fca86 56#include <stdio.h>
a66fca86 57#include <inttypes.h>
3ad48540
MHS
58#include "fileutils.h"
59#include "cipherutils.h"
60#include "des.h"
a66fca86
AD
61
62uint8_t pi[35] = {0x0F,0x17,0x1B,0x1D,0x1E,0x27,0x2B,0x2D,0x2E,0x33,0x35,0x39,0x36,0x3A,0x3C,0x47,0x4B,0x4D,0x4E,0x53,0x55,0x56,0x59,0x5A,0x5C,0x63,0x65,0x66,0x69,0x6A,0x6C,0x71,0x72,0x74,0x78};
63
64static des_context ctx_enc = {DES_ENCRYPT,{0}};
65static des_context ctx_dec = {DES_DECRYPT,{0}};
66
3ad48540 67static int debug_print = 0;
a66fca86
AD
68
69/**
70 * @brief The key diversification algorithm uses 6-bit bytes.
71 * This implementation uses 64 bit uint to pack seven of them into one
72 * variable. When they are there, they are placed as follows:
73 * XXXX XXXX N0 .... N7, occupying the lsat 48 bits.
74 *
75 * This function picks out one from such a collection
76 * @param all
77 * @param n bitnumber
78 * @return
79 */
80uint8_t getSixBitByte(uint64_t c, int n)
81{
82 return (c >> (42-6*n)) & 0x3F;
a66fca86
AD
83}
84
85/**
86 * @brief Puts back a six-bit 'byte' into a uint64_t.
87 * @param c buffer
88 * @param z the value to place there
89 * @param n bitnumber.
90 */
91void pushbackSixBitByte(uint64_t *c, uint8_t z, int n)
92{
93 //0x XXXX YYYY ZZZZ ZZZZ ZZZZ
94 // ^z0 ^z7
95 //z0: 1111 1100 0000 0000
96
97 uint64_t masked = z & 0x3F;
98 uint64_t eraser = 0x3F;
99 masked <<= 42-6*n;
100 eraser <<= 42-6*n;
101
102 //masked <<= 6*n;
103 //eraser <<= 6*n;
104
105 eraser = ~eraser;
106 (*c) &= eraser;
107 (*c) |= masked;
108
109}
3ad48540
MHS
110/**
111 * @brief Swaps the z-values.
112 * If the input value has format XYZ0Z1...Z7, the output will have the format
113 * XYZ7Z6...Z0 instead
114 * @param c
115 * @return
116 */
a66fca86
AD
117uint64_t swapZvalues(uint64_t c)
118{
119 uint64_t newz = 0;
120 pushbackSixBitByte(&newz, getSixBitByte(c,0),7);
121 pushbackSixBitByte(&newz, getSixBitByte(c,1),6);
122 pushbackSixBitByte(&newz, getSixBitByte(c,2),5);
123 pushbackSixBitByte(&newz, getSixBitByte(c,3),4);
124 pushbackSixBitByte(&newz, getSixBitByte(c,4),3);
125 pushbackSixBitByte(&newz, getSixBitByte(c,5),2);
126 pushbackSixBitByte(&newz, getSixBitByte(c,6),1);
127 pushbackSixBitByte(&newz, getSixBitByte(c,7),0);
128 newz |= (c & 0xFFFF000000000000);
129 return newz;
130}
131
132/**
133* @return 4 six-bit bytes chunked into a uint64_t,as 00..00a0a1a2a3
134*/
135uint64_t ck(int i, int j, uint64_t z)
136{
137
a66fca86
AD
138 if(i == 1 && j == -1)
139 {
140 // ck(1, −1, z [0] . . . z [3] ) = z [0] . . . z [3]
141 return z;
142
143 }else if( j == -1)
144 {
145 // ck(i, −1, z [0] . . . z [3] ) = ck(i − 1, i − 2, z [0] . . . z [3] )
146 return ck(i-1,i-2, z);
147 }
148
149 if(getSixBitByte(z,i) == getSixBitByte(z,j))
150 {
3ad48540 151
a66fca86
AD
152 //ck(i, j − 1, z [0] . . . z [i] ← j . . . z [3] )
153 uint64_t newz = 0;
154 int c;
a66fca86
AD
155 for(c = 0; c < 4 ;c++)
156 {
157 uint8_t val = getSixBitByte(z,c);
158 if(c == i)
159 {
a66fca86
AD
160 pushbackSixBitByte(&newz, j, c);
161 }else
162 {
163 pushbackSixBitByte(&newz, val, c);
164 }
165 }
166 return ck(i,j-1,newz);
167 }else
168 {
169 return ck(i,j-1,z);
170 }
a66fca86
AD
171}
172/**
173
174 Definition 8.
175 Let the function check : (F 62 ) 8 → (F 62 ) 8 be defined as
176 check(z [0] . . . z [7] ) = ck(3, 2, z [0] . . . z [3] ) · ck(3, 2, z [4] . . . z [7] )
177
178 where ck : N × N × (F 62 ) 4 → (F 62 ) 4 is defined as
179
180 ck(1, −1, z [0] . . . z [3] ) = z [0] . . . z [3]
181 ck(i, −1, z [0] . . . z [3] ) = ck(i − 1, i − 2, z [0] . . . z [3] )
182 ck(i, j, z [0] . . . z [3] ) =
183 ck(i, j − 1, z [0] . . . z [i] ← j . . . z [3] ), if z [i] = z [j] ;
184 ck(i, j − 1, z [0] . . . z [3] ), otherwise
185
186 otherwise.
187**/
188
189uint64_t check(uint64_t z)
190{
191 //These 64 bits are divided as c = x, y, z [0] , . . . , z [7]
192
193 // ck(3, 2, z [0] . . . z [3] )
194 uint64_t ck1 = ck(3,2, z );
195
196 // ck(3, 2, z [4] . . . z [7] )
197 uint64_t ck2 = ck(3,2, z << 24);
3ad48540
MHS
198
199 //The ck function will place the values
200 // in the middle of z.
a66fca86
AD
201 ck1 &= 0x00000000FFFFFF000000;
202 ck2 &= 0x00000000FFFFFF000000;
203
204 return ck1 | ck2 >> 24;
205
206}
207
208void permute(BitstreamIn *p_in, uint64_t z,int l,int r, BitstreamOut* out)
209{
210 if(bitsLeft(p_in) == 0)
211 {
212 return;
213 }
214 bool pn = tailBit(p_in);
215 if( pn ) // pn = 1
216 {
217 uint8_t zl = getSixBitByte(z,l);
3ad48540 218
a66fca86
AD
219 push6bits(out, zl+1);
220 permute(p_in, z, l+1,r, out);
221 }else // otherwise
222 {
223 uint8_t zr = getSixBitByte(z,r);
3ad48540 224
a66fca86
AD
225 push6bits(out, zr);
226 permute(p_in,z,l,r+1,out);
227 }
228}
a66fca86
AD
229void printbegin()
230{
3ad48540
MHS
231 if(debug_print <2)
232 return ;
a66fca86 233
3ad48540 234 prnlog(" | x| y|z0|z1|z2|z3|z4|z5|z6|z7|");
a66fca86
AD
235}
236
3ad48540 237void printState(char* desc, uint64_t c)
a66fca86 238{
3ad48540
MHS
239 if(debug_print < 2)
240 return ;
a66fca86
AD
241
242 printf("%s : ", desc);
3ad48540
MHS
243 uint8_t x = (c & 0xFF00000000000000 ) >> 56;
244 uint8_t y = (c & 0x00FF000000000000 ) >> 48;
a66fca86
AD
245 printf(" %02x %02x", x,y);
246 int i ;
247 for(i =0 ; i < 8 ; i++)
248 {
249 printf(" %02x", getSixBitByte(c,i));
250 }
251 printf("\n");
252}
253
254/**
255 * @brief
256 *Definition 11. Let the function hash0 : F 82 × F 82 × (F 62 ) 8 → (F 82 ) 8 be defined as
257 * hash0(x, y, z [0] . . . z [7] ) = k [0] . . . k [7] where
258 * z'[i] = (z[i] mod (63-i)) + i i = 0...3
259 * z'[i+4] = (z[i+4] mod (64-i)) + i i = 0...3
260 * ẑ = check(z');
261 * @param c
262 * @param k this is where the diversified key is put (should be 8 bytes)
263 * @return
264 */
3ad48540 265void hash0(uint64_t c, uint8_t k[8])
a66fca86 266{
3ad48540
MHS
267 c = swapZvalues(c);
268
a66fca86 269 printbegin();
3ad48540 270 printState("origin",c);
a66fca86
AD
271 //These 64 bits are divided as c = x, y, z [0] , . . . , z [7]
272 // x = 8 bits
273 // y = 8 bits
274 // z0-z7 6 bits each : 48 bits
275 uint8_t x = (c & 0xFF00000000000000 ) >> 56;
276 uint8_t y = (c & 0x00FF000000000000 ) >> 48;
a66fca86
AD
277 int n;
278 uint8_t zn, zn4, _zn, _zn4;
279 uint64_t zP = 0;
280
281 for(n = 0; n < 4 ; n++)
282 {
283 zn = getSixBitByte(c,n);
3ad48540 284
a66fca86
AD
285 zn4 = getSixBitByte(c,n+4);
286
287 _zn = (zn % (63-n)) + n;
288 _zn4 = (zn4 % (64-n)) + n;
289
3ad48540 290
a66fca86
AD
291 pushbackSixBitByte(&zP, _zn,n);
292 pushbackSixBitByte(&zP, _zn4,n+4);
293
294 }
3ad48540 295 printState("0|0|z'",zP);
a66fca86
AD
296
297 uint64_t zCaret = check(zP);
3ad48540 298 printState("0|0|z^",zP);
a66fca86
AD
299
300
301 uint8_t p = pi[x % 35];
302
303 if(x & 1) //Check if x7 is 1
304 {
305 p = ~p;
306 }
3ad48540
MHS
307
308 if(debug_print >= 2) prnlog("p:%02x", p);
a66fca86
AD
309
310 BitstreamIn p_in = { &p, 8,0 };
311 uint8_t outbuffer[] = {0,0,0,0,0,0,0,0};
312 BitstreamOut out = {outbuffer,0,0};
313 permute(&p_in,zCaret,0,4,&out);//returns 48 bits? or 6 8-bytes
314
315 //Out is now a buffer containing six-bit bytes, should be 48 bits
316 // if all went well
a66fca86
AD
317 //Shift z-values down onto the lower segment
318
3ad48540 319 uint64_t zTilde = x_bytes_to_num(outbuffer,8);
a66fca86 320
a66fca86 321 zTilde >>= 16;
3ad48540
MHS
322
323 printState("0|0|z~", zTilde);
a66fca86
AD
324
325 int i;
326 int zerocounter =0 ;
327 for(i =0 ; i < 8 ; i++)
328 {
329
330 // the key on index i is first a bit from y
331 // then six bits from z,
332 // then a bit from p
333
334 // Init with zeroes
335 k[i] = 0;
336 // First, place yi leftmost in k
337 //k[i] |= (y << i) & 0x80 ;
338
339 // First, place y(7-i) leftmost in k
340 k[i] |= (y << (7-i)) & 0x80 ;
341
3ad48540 342
a66fca86
AD
343
344 uint8_t zTilde_i = getSixBitByte(zTilde, i);
a66fca86
AD
345 // zTildeI is now on the form 00XXXXXX
346 // with one leftshift, it'll be
347 // 0XXXXXX0
348 // So after leftshift, we can OR it into k
349 // However, when doing complement, we need to
350 // again MASK 0XXXXXX0 (0x7E)
351 zTilde_i <<= 1;
352
353 //Finally, add bit from p or p-mod
354 //Shift bit i into rightmost location (mask only after complement)
355 uint8_t p_i = p >> i & 0x1;
356
357 if( k[i] )// yi = 1
358 {
359 //printf("k[%d] +1\n", i);
360 k[i] |= ~zTilde_i & 0x7E;
361 k[i] |= p_i & 1;
362 k[i] += 1;
363
364 }else // otherwise
365 {
366 k[i] |= zTilde_i & 0x7E;
367 k[i] |= (~p_i) & 1;
368 }
369 if((k[i] & 1 )== 0)
370 {
371 zerocounter ++;
372 }
373 }
3ad48540
MHS
374}
375/**
376 * @brief Performs Elite-class key diversification
377 * @param csn
378 * @param key
379 * @param div_key
380 */
381void diversifyKey(uint8_t csn[8], uint8_t key[8], uint8_t div_key[8])
382{
383
384 // Prepare the DES key
385 des_setkey_enc( &ctx_enc, key);
386
387 uint8_t crypted_csn[8] = {0};
a66fca86 388
3ad48540
MHS
389 // Calculate DES(CSN, KEY)
390 des_crypt_ecb(&ctx_enc,csn, crypted_csn);
391
392 //Calculate HASH0(DES))
9b82de75
MHS
393 uint64_t crypt_csn = x_bytes_to_num(crypted_csn, 8);
394 //uint64_t crypted_csn_swapped = swapZvalues(crypt_csn);
3ad48540
MHS
395
396 hash0(crypt_csn,div_key);
a66fca86
AD
397}
398
3ad48540
MHS
399
400
401
402
403void testPermute()
a66fca86 404{
3ad48540
MHS
405
406 uint64_t x = 0;
407 pushbackSixBitByte(&x,0x00,0);
408 pushbackSixBitByte(&x,0x01,1);
409 pushbackSixBitByte(&x,0x02,2);
410 pushbackSixBitByte(&x,0x03,3);
411 pushbackSixBitByte(&x,0x04,4);
412 pushbackSixBitByte(&x,0x05,5);
413 pushbackSixBitByte(&x,0x06,6);
414 pushbackSixBitByte(&x,0x07,7);
415
416 uint8_t mres[8] = { getSixBitByte(x, 0),
417 getSixBitByte(x, 1),
418 getSixBitByte(x, 2),
419 getSixBitByte(x, 3),
420 getSixBitByte(x, 4),
421 getSixBitByte(x, 5),
422 getSixBitByte(x, 6),
423 getSixBitByte(x, 7)};
424 printarr("input_perm", mres,8);
425
426 uint8_t p = ~pi[0];
427 BitstreamIn p_in = { &p, 8,0 };
428 uint8_t outbuffer[] = {0,0,0,0,0,0,0,0};
429 BitstreamOut out = {outbuffer,0,0};
430
431 permute(&p_in, x,0,4, &out);
432
433 uint64_t permuted = x_bytes_to_num(outbuffer,8);
434 //printf("zTilde 0x%"PRIX64"\n", zTilde);
435 permuted >>= 16;
436
437 uint8_t res[8] = { getSixBitByte(permuted, 0),
438 getSixBitByte(permuted, 1),
439 getSixBitByte(permuted, 2),
440 getSixBitByte(permuted, 3),
441 getSixBitByte(permuted, 4),
442 getSixBitByte(permuted, 5),
443 getSixBitByte(permuted, 6),
444 getSixBitByte(permuted, 7)};
445 printarr("permuted", res, 8);
a66fca86
AD
446}
447
3ad48540
MHS
448//These testcases are
449//{ UID , TEMP_KEY, DIV_KEY} using the specific key
450typedef struct
451{
452 uint8_t uid[8];
453 uint8_t t_key[8];
454 uint8_t div_key[8];
455} Testcase;
456
457
458int testDES(Testcase testcase, des_context ctx_enc, des_context ctx_dec)
459{
460 uint8_t des_encrypted_csn[8] = {0};
461 uint8_t decrypted[8] = {0};
462 uint8_t div_key[8] = {0};
463 int retval = des_crypt_ecb(&ctx_enc,testcase.uid,des_encrypted_csn);
464 retval |= des_crypt_ecb(&ctx_dec,des_encrypted_csn,decrypted);
465
466 if(memcmp(testcase.uid,decrypted,8) != 0)
467 {
468 //Decryption fail
469 prnlog("Encryption <-> Decryption FAIL");
470 printarr("Input", testcase.uid, 8);
471 printarr("Decrypted", decrypted, 8);
472 retval = 1;
473 }
474
475 if(memcmp(des_encrypted_csn,testcase.t_key,8) != 0)
476 {
477 //Encryption fail
478 prnlog("Encryption != Expected result");
479 printarr("Output", des_encrypted_csn, 8);
480 printarr("Expected", testcase.t_key, 8);
481 retval = 1;
482 }
483 uint64_t crypted_csn = x_bytes_to_num(des_encrypted_csn,8);
484 hash0(crypted_csn, div_key);
a66fca86 485
3ad48540
MHS
486 if(memcmp(div_key, testcase.div_key ,8) != 0)
487 {
488 //Key diversification fail
489 prnlog("Div key != expected result");
490 printarr(" csn ", testcase.uid,8);
491 printarr("{csn} ", des_encrypted_csn,8);
492 printarr("hash0 ", div_key, 8);
493 printarr("Expected", testcase.div_key, 8);
494 retval = 1;
495
496 }
497 return retval;
498}
a66fca86
AD
499bool des_getParityBitFromKey(uint8_t key)
500{//The top 7 bits is used
501 bool parity = ((key & 0x80) >> 7)
502 ^ ((key & 0x40) >> 6) ^ ((key & 0x20) >> 5)
503 ^ ((key & 0x10) >> 4) ^ ((key & 0x08) >> 3)
504 ^ ((key & 0x04) >> 2) ^ ((key & 0x02) >> 1);
505 return !parity;
506}
3ad48540
MHS
507
508
a66fca86
AD
509void des_checkParity(uint8_t* key)
510{
511 int i;
512 int fails =0;
513 for(i =0 ; i < 8 ; i++)
514 {
515 bool parity = des_getParityBitFromKey(key[i]);
516 if(parity != (key[i] & 0x1))
517 {
518 fails++;
3ad48540 519 prnlog("[+] parity1 fail, byte %d [%02x] was %d, should be %d",i,key[i],(key[i] & 0x1),parity);
a66fca86
AD
520 }
521 }
522 if(fails)
523 {
3ad48540 524 prnlog("[+] parity fails: %d", fails);
a66fca86
AD
525 }else
526 {
3ad48540 527 prnlog("[+] Key syntax is with parity bits inside each byte");
a66fca86
AD
528 }
529}
530
3ad48540
MHS
531Testcase testcases[] ={
532
533 {{0x8B,0xAC,0x60,0x1F,0x53,0xB8,0xED,0x11},{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x03,0x05,0x07}},
534 {{0xAE,0x51,0xE5,0x62,0xE7,0x9A,0x99,0x39},{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01},{0x04,0x02,0x06,0x08,0x01,0x03,0x05,0x07}},
535 {{0x9B,0x21,0xE4,0x31,0x6A,0x00,0x29,0x62},{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x02},{0x06,0x04,0x02,0x08,0x01,0x03,0x05,0x07}},
536 {{0x65,0x24,0x0C,0x41,0x4F,0xC2,0x21,0x93},{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x04},{0x0A,0x04,0x06,0x08,0x01,0x03,0x05,0x07}},
537 {{0x7F,0xEB,0xAE,0x93,0xE5,0x30,0x08,0xBD},{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x08},{0x12,0x04,0x06,0x08,0x01,0x03,0x05,0x07}},
538 {{0x49,0x7B,0x70,0x74,0x9B,0x35,0x1B,0x83},{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x10},{0x22,0x04,0x06,0x08,0x01,0x03,0x05,0x07}},
539 {{0x02,0x3C,0x15,0x6B,0xED,0xA5,0x64,0x6C},{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20},{0x42,0x04,0x06,0x08,0x01,0x03,0x05,0x07}},
540 {{0xE8,0x37,0xE0,0xE2,0xC6,0x45,0x24,0xF3},{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40},{0x02,0x06,0x04,0x08,0x01,0x03,0x05,0x07}},
541 {{0xAB,0xBD,0x30,0x05,0x29,0xC8,0xF7,0x12},{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x80},{0x02,0x08,0x06,0x04,0x01,0x03,0x05,0x07}},
542 {{0x17,0xE8,0x97,0xF0,0x99,0xB6,0x79,0x31},{0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00},{0x02,0x0C,0x06,0x08,0x01,0x03,0x05,0x07}},
543 {{0x49,0xA4,0xF0,0x8F,0x5F,0x96,0x83,0x16},{0x00,0x00,0x00,0x00,0x00,0x00,0x02,0x00},{0x02,0x14,0x06,0x08,0x01,0x03,0x05,0x07}},
544 {{0x60,0xF5,0x7E,0x54,0xAA,0x41,0x83,0xD4},{0x00,0x00,0x00,0x00,0x00,0x00,0x04,0x00},{0x02,0x24,0x06,0x08,0x01,0x03,0x05,0x07}},
545 {{0x1D,0xF6,0x3B,0x6B,0x85,0x55,0xF0,0x4B},{0x00,0x00,0x00,0x00,0x00,0x00,0x08,0x00},{0x02,0x44,0x06,0x08,0x01,0x03,0x05,0x07}},
546 {{0x1F,0xDC,0x95,0x1A,0xEA,0x6B,0x4B,0xB4},{0x00,0x00,0x00,0x00,0x00,0x00,0x10,0x00},{0x02,0x04,0x08,0x06,0x01,0x03,0x05,0x07}},
547 {{0xEC,0x93,0x72,0xF0,0x3B,0xA9,0xF5,0x0B},{0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00},{0x02,0x04,0x0A,0x08,0x01,0x03,0x05,0x07}},
548 {{0xDE,0x57,0x5C,0xBE,0x2D,0x55,0x03,0x12},{0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00},{0x02,0x04,0x0E,0x08,0x01,0x03,0x05,0x07}},
549 {{0x1E,0xD2,0xB5,0xCE,0x90,0xC9,0xC1,0xCC},{0x00,0x00,0x00,0x00,0x00,0x00,0x80,0x00},{0x02,0x04,0x16,0x08,0x01,0x03,0x05,0x07}},
550 {{0xD8,0x65,0x96,0x4E,0xE7,0x74,0x99,0xB8},{0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00},{0x02,0x04,0x26,0x08,0x01,0x03,0x05,0x07}},
551 {{0xE3,0x7A,0x29,0x83,0x31,0xD5,0x3A,0x54},{0x00,0x00,0x00,0x00,0x00,0x02,0x00,0x00},{0x02,0x04,0x46,0x08,0x01,0x03,0x05,0x07}},
552 {{0x3A,0xB5,0x1A,0x34,0x34,0x25,0x12,0xF0},{0x00,0x00,0x00,0x00,0x00,0x04,0x00,0x00},{0x02,0x04,0x06,0x0A,0x01,0x03,0x05,0x07}},
553 {{0xF2,0x88,0xEE,0x6F,0x70,0x6F,0xC2,0x52},{0x00,0x00,0x00,0x00,0x00,0x08,0x00,0x00},{0x02,0x04,0x06,0x0C,0x01,0x03,0x05,0x07}},
554 {{0x76,0xEF,0xEB,0x80,0x52,0x43,0x83,0x57},{0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00},{0x02,0x04,0x06,0x10,0x01,0x03,0x05,0x07}},
555 {{0x1C,0x09,0x8E,0x3B,0x23,0x23,0x52,0xB5},{0x00,0x00,0x00,0x00,0x00,0x20,0x00,0x00},{0x02,0x04,0x06,0x18,0x01,0x03,0x05,0x07}},
556 {{0xA9,0x13,0xA2,0xBE,0xCF,0x1A,0xC4,0x9A},{0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00},{0x02,0x04,0x06,0x28,0x01,0x03,0x05,0x07}},
557 {{0x25,0x56,0x4B,0xB0,0xC8,0x2A,0xD4,0x27},{0x00,0x00,0x00,0x00,0x00,0x80,0x00,0x00},{0x02,0x04,0x06,0x48,0x01,0x03,0x05,0x07}},
558 {{0xB1,0x04,0x57,0x3F,0xA7,0x16,0x62,0xD4},{0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x03,0x01,0x05,0x07}},
559 {{0x45,0x46,0xED,0xCC,0xE7,0xD3,0x8E,0xA3},{0x00,0x00,0x00,0x00,0x02,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x05,0x03,0x01,0x07}},
560 {{0x22,0x6D,0xB5,0x35,0xE0,0x5A,0xE0,0x90},{0x00,0x00,0x00,0x00,0x04,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x09,0x03,0x05,0x07}},
561 {{0xB8,0xF5,0xE5,0x44,0xC5,0x98,0x4A,0xBD},{0x00,0x00,0x00,0x00,0x08,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x11,0x03,0x05,0x07}},
562 {{0xAC,0x78,0x0A,0x23,0x9E,0xF6,0xBC,0xA0},{0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x21,0x03,0x05,0x07}},
563 {{0x46,0x6B,0x2D,0x70,0x41,0x17,0xBF,0x3D},{0x00,0x00,0x00,0x00,0x20,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x41,0x03,0x05,0x07}},
564 {{0x64,0x44,0x24,0x71,0xA2,0x56,0xDF,0xB5},{0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x05,0x03,0x07}},
565 {{0xC4,0x00,0x52,0x24,0xA2,0xD6,0x16,0x7A},{0x00,0x00,0x00,0x00,0x80,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x07,0x05,0x03}},
566 {{0xD8,0x4A,0x80,0x1E,0x95,0x5B,0x70,0xC4},{0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x0B,0x05,0x07}},
567 {{0x08,0x56,0x6E,0xB5,0x64,0xD6,0x47,0x4E},{0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x13,0x05,0x07}},
568 {{0x41,0x6F,0xBA,0xA4,0xEB,0xAE,0xA0,0x55},{0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x23,0x05,0x07}},
569 {{0x62,0x9D,0xDE,0x72,0x84,0x4A,0x53,0xD5},{0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x43,0x05,0x07}},
570 {{0x39,0xD3,0x2B,0x66,0xB8,0x08,0x40,0x2E},{0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x03,0x07,0x05}},
571 {{0xAF,0x67,0xA9,0x18,0x57,0x21,0xAF,0x8D},{0x00,0x00,0x00,0x20,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x03,0x09,0x07}},
572 {{0x34,0xBC,0x9D,0xBC,0xC4,0xC2,0x3B,0xC8},{0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x03,0x0D,0x07}},
573 {{0xB6,0x50,0xF9,0x81,0xF6,0xBF,0x90,0x3C},{0x00,0x00,0x00,0x80,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x03,0x15,0x07}},
574 {{0x71,0x41,0x93,0xA1,0x59,0x81,0xA5,0x52},{0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x03,0x25,0x07}},
575 {{0x6B,0x00,0xBD,0x74,0x1C,0x3C,0xE0,0x1A},{0x00,0x00,0x02,0x00,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x03,0x45,0x07}},
576 {{0x76,0xFD,0x0B,0xD0,0x41,0xD2,0x82,0x5D},{0x00,0x00,0x04,0x00,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x03,0x05,0x09}},
577 {{0xC6,0x3A,0x1C,0x25,0x63,0x5A,0x2F,0x0E},{0x00,0x00,0x08,0x00,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x03,0x05,0x0B}},
578 {{0xD9,0x0E,0xD7,0x30,0xE2,0xAD,0xA9,0x87},{0x00,0x00,0x10,0x00,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x03,0x05,0x0F}},
579 {{0x6B,0x81,0xC6,0xD1,0x05,0x09,0x87,0x1E},{0x00,0x00,0x20,0x00,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x03,0x05,0x17}},
580 {{0xB4,0xA7,0x1E,0x02,0x54,0x37,0x43,0x35},{0x00,0x00,0x40,0x00,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x03,0x05,0x27}},
581 {{0x45,0x14,0x7C,0x7F,0xE0,0xDE,0x09,0x65},{0x00,0x00,0x80,0x00,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x03,0x05,0x47}},
582 {{0x78,0xB0,0xF5,0x20,0x8B,0x7D,0xF3,0xDD},{0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00},{0xFE,0x04,0x06,0x08,0x01,0x03,0x05,0x07}},
583 {{0x88,0xB3,0x3C,0xE1,0xF7,0x87,0x42,0xA1},{0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x00},{0x02,0xFC,0x06,0x08,0x01,0x03,0x05,0x07}},
584 {{0x11,0x2F,0xB2,0xF7,0xE2,0xB2,0x4F,0x6E},{0x00,0x04,0x00,0x00,0x00,0x00,0x00,0x00},{0x02,0x04,0xFA,0x08,0x01,0x03,0x05,0x07}},
585 {{0x25,0x56,0x4E,0xC6,0xEB,0x2D,0x74,0x5B},{0x00,0x08,0x00,0x00,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0xF8,0x01,0x03,0x05,0x07}},
586 {{0x7E,0x98,0x37,0xF9,0x80,0x8F,0x09,0x82},{0x00,0x10,0x00,0x00,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0xFF,0x03,0x05,0x07}},
587 {{0xF9,0xB5,0x62,0x3B,0xD8,0x7B,0x3C,0x3F},{0x00,0x20,0x00,0x00,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0xFD,0x05,0x07}},
588 {{0x29,0xC5,0x2B,0xFA,0xD1,0xFC,0x5C,0xC7},{0x00,0x40,0x00,0x00,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x03,0xFB,0x07}},
589 {{0xC1,0xA3,0x09,0x71,0xBD,0x8E,0xAF,0x2F},{0x00,0x80,0x00,0x00,0x00,0x00,0x00,0x00},{0x02,0x04,0x06,0x08,0x01,0x03,0x05,0xF9}},
590 {{0xB6,0xDD,0xD1,0xAD,0xAA,0x15,0x6F,0x29},{0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00},{0x01,0x03,0x05,0x02,0x07,0x04,0x06,0x08}},
591 {{0x65,0x34,0x03,0x19,0x17,0xB3,0xA3,0x96},{0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00},{0x02,0x04,0x01,0x06,0x08,0x03,0x05,0x07}},
592 {{0xF9,0x38,0x43,0x56,0x52,0xE5,0xB1,0xA9},{0x04,0x00,0x00,0x00,0x00,0x00,0x00,0x00},{0x01,0x02,0x04,0x06,0x08,0x03,0x05,0x07}},
593
594 {{0xA4,0xA0,0xAF,0xDA,0x48,0xB0,0xA1,0x10},{0x08,0x00,0x00,0x00,0x00,0x00,0x00,0x00},{0x01,0x02,0x04,0x06,0x03,0x08,0x05,0x07}},
595 {{0x55,0x15,0x8A,0x0D,0x48,0x29,0x01,0xD8},{0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00},{0x02,0x04,0x01,0x06,0x03,0x05,0x08,0x07}},
596 {{0xC4,0x81,0x96,0x7D,0xA3,0xB7,0x73,0x50},{0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00},{0x01,0x02,0x03,0x05,0x04,0x06,0x08,0x07}},
597 {{0x36,0x73,0xDF,0xC1,0x1B,0x98,0xA8,0x1D},{0x40,0x00,0x00,0x00,0x00,0x00,0x00,0x00},{0x01,0x02,0x03,0x04,0x05,0x06,0x08,0x07}},
598 {{0xCE,0xE0,0xB3,0x1B,0x41,0xEB,0x15,0x12},{0x80,0x00,0x00,0x00,0x00,0x00,0x00,0x00},{0x01,0x02,0x03,0x04,0x06,0x05,0x08,0x07}},
599 {{0},{0},{0}}
600};
601
602
603int testKeyDiversificationWithMasterkeyTestcases()
a66fca86 604{
3ad48540
MHS
605
606 int error = 0;
607 int i;
608
609 uint8_t empty[8]={0};
610 prnlog("[+} Testing encryption/decryption");
611
612 for (i = 0; memcmp(testcases+i,empty,8) ; i++) {
613 error += testDES(testcases[i],ctx_enc, ctx_dec);
614 }
615 if(error)
a66fca86 616 {
3ad48540
MHS
617 prnlog("[+] %d errors occurred (%d testcases)", error, i);
618 }else
619 {
620 prnlog("[+] Hashing seems to work (%d testcases)", i);
a66fca86 621 }
3ad48540
MHS
622 return error;
623}
624
625
626void print64bits(char*name, uint64_t val)
627{
628 printf("%s%08x%08x\n",name,(uint32_t) (val >> 32) ,(uint32_t) (val & 0xFFFFFFFF));
629}
630
631uint64_t testCryptedCSN(uint64_t crypted_csn, uint64_t expected)
632{
633 int retval = 0;
634 uint8_t result[8] = {0};
635 if(debug_print) prnlog("debug_print %d", debug_print);
636 if(debug_print) print64bits(" {csn} ", crypted_csn );
637
638 uint64_t crypted_csn_swapped = swapZvalues(crypted_csn);
639
640 if(debug_print) print64bits(" {csn-revz} ", crypted_csn_swapped);
641
642 hash0(crypted_csn, result);
643 uint64_t resultbyte = x_bytes_to_num(result,8 );
644 if(debug_print) print64bits(" hash0 " , resultbyte );
645
646 if(resultbyte != expected )
647 {
648
649 if(debug_print) {
650 prnlog("\n[+] FAIL!");
651 print64bits(" expected " , expected );
652 }
653 retval = 1;
654
655 }else
656 {
657 if(debug_print) prnlog(" [OK]");
658 }
659 return retval;
660}
661
662int testDES2(uint64_t csn, uint64_t expected)
663{
664 uint8_t result[8] = {0};
665 uint8_t input[8] = {0};
666
667 print64bits(" csn ", csn);
668 x_num_to_bytes(csn, 8,input);
669
670 des_crypt_ecb(&ctx_enc,input, result);
671
672 uint64_t crypt_csn = x_bytes_to_num(result, 8);
673 print64bits(" {csn} ", crypt_csn );
674 print64bits(" expected ", expected );
675
676 if( expected == crypt_csn )
677 {
678 prnlog("[+] OK");
679 return 0;
680 }else
681 {
682 return 1;
683 }
684}
685
686/**
687 * These testcases come from http://www.proxmark.org/forum/viewtopic.php?pid=10977#p10977
688 * @brief doTestsWithKnownInputs
689 * @return
690 */
691int doTestsWithKnownInputs()
692{
693
694 // KSel from http://www.proxmark.org/forum/viewtopic.php?pid=10977#p10977
695 int errors = 0;
696 prnlog("[+] Testing DES encryption");
697// uint8_t key[8] = {0x6c,0x8d,0x44,0xf9,0x2a,0x2d,0x01,0xbf};
698 prnlog("[+] Testing foo");
699 uint8_t key[8] = {0x6c,0x8d,0x44,0xf9,0x2a,0x2d,0x01,0xbf};
700
701 des_setkey_enc( &ctx_enc, key);
702 testDES2(0xbbbbaaaabbbbeeee,0xd6ad3ca619659e6b);
703
704 prnlog("[+] Testing hashing algorithm");
705
706 errors += testCryptedCSN(0x0102030405060708,0x0bdd6512073c460a);
707 errors += testCryptedCSN(0x1020304050607080,0x0208211405f3381f);
708 errors += testCryptedCSN(0x1122334455667788,0x2bee256d40ac1f3a);
709 errors += testCryptedCSN(0xabcdabcdabcdabcd,0xa91c9ec66f7da592);
710 errors += testCryptedCSN(0xbcdabcdabcdabcda,0x79ca5796a474e19b);
711 errors += testCryptedCSN(0xcdabcdabcdabcdab,0xa8901b9f7ec76da4);
712 errors += testCryptedCSN(0xdabcdabcdabcdabc,0x357aa8e0979a5b8d);
713 errors += testCryptedCSN(0x21ba6565071f9299,0x34e80f88d5cf39ea);
714 errors += testCryptedCSN(0x14e2adfc5bb7e134,0x6ac90c6508bd9ea3);
715
716 if(errors)
717 {
718 prnlog("[+] %d errors occurred (9 testcases)", errors);
719 }else
720 {
721 prnlog("[+] Hashing seems to work (9 testcases)" );
722 }
723 return errors;
724}
725
726int readKeyFile(uint8_t key[8])
727{
728
729 FILE *f;
97d582a6 730 int retval = 1;
3ad48540
MHS
731 f = fopen("iclass_key.bin", "rb");
732 if (f)
733 {
97d582a6
MHS
734 if(fread(key, sizeof(uint8_t), 8, f) == 1)
735 {
736 retval = 0;
737 }
738 fclose(f);
3ad48540 739 }
97d582a6 740 return retval;
3ad48540
MHS
741
742}
743
744
745int doKeyTests(uint8_t debuglevel)
746{
747 debug_print = debuglevel;
748
749 prnlog("[+] Checking if the master key is present (iclass_key.bin)...");
750 uint8_t key[8] = {0};
751 if(readKeyFile(key))
752 {
753 prnlog("[+] Master key not present, will not be able to do all testcases");
754 }else
755 {
756
757 //Test if it's the right key...
758 uint8_t i;
759 uint8_t j = 0;
760 for(i =0 ; i < sizeof(key) ; i++)
761 j += key[i];
762
763 if(j != 185)
764 {
765 prnlog("[+] A key was loaded, but it does not seem to be the correct one. Aborting these tests");
766 }else
767 {
768 prnlog("[+] Key present");
769
770 prnlog("[+] Checking key parity...");
771 des_checkParity(key);
772 des_setkey_enc( &ctx_enc, key);
773 des_setkey_dec( &ctx_dec, key);
774 // Test hashing functions
775 prnlog("[+] The following tests require the correct 8-byte master key");
776 testKeyDiversificationWithMasterkeyTestcases();
777 }
778 }
779 prnlog("[+] Testing key diversification with non-sensitive keys...");
780 doTestsWithKnownInputs();
781 return 0;
a66fca86 782}
3ad48540
MHS
783
784/**
785
786void checkParity2(uint8_t* key)
787{
788
789 uint8_t stored_parity = key[7];
790 printf("Parity byte: 0x%02x\n", stored_parity);
791 int i;
792 int byte;
793 int fails =0;
794 BitstreamIn bits = {key, 56, 0};
795
796 bool parity = 0;
797
798 for(i =0 ; i < 56; i++)
799 {
800
801 if ( i > 0 && i % 7 == 0)
802 {
803 parity = !parity;
804 bool pbit = stored_parity & (0x80 >> (byte));
805 if(parity != pbit)
806 {
807 printf("parity2 fail byte %d, should be %d, was %d\n", (i / 7), parity, pbit);
808 fails++;
809 }
810 parity =0 ;
811 byte = i / 7;
812 }
813 parity = parity ^ headBit(&bits);
814 }
815 if(fails)
816 {
817 printf("parity2 fails: %d\n", fails);
818 }else
819 {
820 printf("Key syntax is with parity bits grouped in the last byte!\n");
821 }
822}
823void modifyKey_put_parity_last(uint8_t * key, uint8_t* output)
824{
825 uint8_t paritybits = 0;
826 bool parity =0;
827 BitstreamOut out = { output, 0,0};
828 unsigned int bbyte, bbit;
829 for(bbyte=0; bbyte <8 ; bbyte++ )
830 {
831 for(bbit =0 ; bbit< 7 ; bbit++)
832 {
833 bool bit = *(key+bbyte) & (1 << (7-bbit));
834 pushBit(&out,bit);
835 parity ^= bit;
836 }
837 bool paritybit = *(key+bbyte) & 1;
838 paritybits |= paritybit << (7-bbyte);
839 parity = 0;
840
841 }
842 output[7] = paritybits;
843 printf("Parity byte: %02x\n", paritybits);
844}
845
846 * @brief Modifies a key with parity bits last, so that it is formed with parity
847 * bits inside each byte
848 * @param key
849 * @param output
850
851void modifyKey_put_parity_allover(uint8_t * key, uint8_t* output)
852{
853 bool parity =0;
854 BitstreamOut out = { output, 0,0};
855 BitstreamIn in = {key, 0,0};
856 unsigned int bbyte, bbit;
857 for(bbit =0 ; bbit < 56 ; bbit++)
858 {
859
860 if( bbit > 0 && bbit % 7 == 0)
861 {
862 pushBit(&out,!parity);
863 parity = 0;
864 }
865 bool bit = headBit(&in);
866 pushBit(&out,bit );
867 parity ^= bit;
868
869 }
870 pushBit(&out, !parity);
871
872
873 if( des_key_check_key_parity(output))
874 {
875 printf("modifyKey_put_parity_allover fail, DES key invalid parity!");
876 }
877
878}
879
880*/
881
882
Impressum, Datenschutz