]>
Commit | Line | Data |
---|---|---|
f89c7050 M |
1 | //----------------------------------------------------------------------------- |
2 | // Merlok - June 2011 | |
3 | // Roel - Dec 2009 | |
4 | // Unknown author | |
5 | // | |
6 | // This code is licensed to you under the terms of the GNU GPL, version 2 or, | |
7 | // at your option, any later version. See the LICENSE.txt file for the text of | |
8 | // the license. | |
9 | //----------------------------------------------------------------------------- | |
10 | // MIFARE Darkside hack | |
11 | //----------------------------------------------------------------------------- | |
f89c7050 | 12 | #include "nonce2key.h" |
f89c7050 | 13 | |
1c611bbd | 14 | int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_t ks_info, uint64_t * key) { |
0de8e387 | 15 | struct Crypto1State *state; |
a0f33b66 | 16 | uint32_t i, pos, rr = 0, nr_diff; |
0de8e387 | 17 | byte_t bt, ks3x[8], par[8][8]; |
b19bd5d6 | 18 | |
0de8e387 | 19 | // Reset the last three significant bits of the reader nonce |
20 | nr &= 0xffffff1f; | |
f89c7050 | 21 | |
22635d61 | 22 | PrintAndLog("uid(%08x) nt(%08x) par(%016"llx") ks(%016"llx") nr(%08x)\n", uid, nt, par_info, ks_info, nr); |
0de8e387 | 23 | |
738eeccd | 24 | for ( pos = 0; pos < 8; pos++ ) { |
0de8e387 | 25 | ks3x[7-pos] = (ks_info >> (pos*8)) & 0x0f; |
26 | bt = (par_info >> (pos*8)) & 0xff; | |
738eeccd | 27 | |
28 | for ( i = 0; i < 8; i++) { | |
0de8e387 | 29 | par[7-pos][i] = (bt >> i) & 0x01; |
30 | } | |
31 | } | |
f89c7050 | 32 | |
cd91e41c | 33 | printf("+----+--------+---+-----+---------------+\n"); |
0de8e387 | 34 | printf("|diff|{nr} |ks3|ks3^5|parity |\n"); |
35 | printf("+----+--------+---+-----+---------------+\n"); | |
738eeccd | 36 | for ( i = 0; i < 8; i++) { |
0de8e387 | 37 | nr_diff = nr | i << 5; |
5fdf8672 | 38 | printf("| %02x |%08x| %01x | %01x |", i << 5, nr_diff, ks3x[i], ks3x[i]^5); |
39 | ||
a0f33b66 | 40 | for (pos = 0; pos < 7; pos++) printf("%01x,", par[i][pos]); |
0de8e387 | 41 | printf("%01x|\n", par[i][7]); |
42 | } | |
43 | printf("+----+--------+---+-----+---------------+\n"); | |
f89c7050 | 44 | |
5fdf8672 | 45 | clock_t t1 = clock(); |
46 | ||
a0f33b66 | 47 | state = lfsr_common_prefix(nr, rr, ks3x, par); |
59e933fc | 48 | lfsr_rollback_word(state, uid ^ nt, 0); |
a0f33b66 | 49 | crypto1_get_lfsr(state, key); |
50 | crypto1_destroy(state); | |
5fdf8672 | 51 | |
52 | t1 = clock() - t1; | |
53 | if ( t1 > 0 ) PrintAndLog("Time in nonce2key: %.0f ticks \n", (float)t1); | |
a0f33b66 | 54 | return 0; |
f89c7050 | 55 | } |
46cd801c | 56 | |
59e933fc | 57 | // call when PAR == 0, special attack? It seems to need two calls. with same uid, block, keytype |
58 | int nonce2key_ex(uint8_t blockno, uint8_t keytype, uint32_t uid, uint32_t nt, uint32_t nr, uint64_t ks_info, uint64_t * key) { | |
59 | ||
cd91e41c | 60 | struct Crypto1State *state; |
61 | uint32_t i, pos, key_count; | |
62 | byte_t ks3x[8]; | |
63 | ||
64 | uint64_t key_recovered; | |
59e933fc | 65 | |
cd91e41c | 66 | int64_t *state_s; |
59e933fc | 67 | static uint8_t last_blockno; |
68 | static uint8_t last_keytype; | |
cd91e41c | 69 | static uint32_t last_uid; |
70 | static int64_t *last_keylist; | |
59e933fc | 71 | |
72 | if (last_uid != uid && | |
73 | last_blockno != blockno && | |
74 | last_keytype != keytype && | |
75 | last_keylist != NULL) | |
76 | { | |
cd91e41c | 77 | free(last_keylist); |
78 | last_keylist = NULL; | |
79 | } | |
80 | last_uid = uid; | |
59e933fc | 81 | last_blockno = blockno; |
82 | last_keytype = keytype; | |
cd91e41c | 83 | |
84 | // Reset the last three significant bits of the reader nonce | |
85 | nr &= 0xffffff1f; | |
86 | ||
22635d61 | 87 | PrintAndLog("uid(%08x) nt(%08x) ks(%016"llx") nr(%08x)\n", uid, nt, ks_info, nr); |
cd91e41c | 88 | |
89 | for (pos=0; pos<8; pos++) { | |
90 | ks3x[7-pos] = (ks_info >> (pos*8)) & 0x0f; | |
91 | } | |
92 | ||
59e933fc | 93 | PrintAndLog("parity is all zero, try special attack. Just wait for few more seconds..."); |
cd91e41c | 94 | |
95 | state = lfsr_common_prefix_ex(nr, ks3x); | |
96 | state_s = (int64_t*)state; | |
97 | ||
cd91e41c | 98 | for (i = 0; (state) && ((state + i)->odd != -1); i++) { |
59e933fc | 99 | lfsr_rollback_word(state + i, uid ^ nt, 0); |
cd91e41c | 100 | crypto1_get_lfsr(state + i, &key_recovered); |
101 | *(state_s + i) = key_recovered; | |
cd91e41c | 102 | } |
cd91e41c | 103 | |
104 | if(!state) | |
105 | return 1; | |
106 | ||
107 | qsort(state_s, i, sizeof(*state_s), compar_int); | |
108 | *(state_s + i) = -1; | |
109 | ||
110 | //Create the intersection: | |
111 | if ( last_keylist != NULL) { | |
59e933fc | 112 | |
cd91e41c | 113 | int64_t *p1, *p2, *p3; |
114 | p1 = p3 = last_keylist; | |
115 | p2 = state_s; | |
59e933fc | 116 | |
cd91e41c | 117 | while ( *p1 != -1 && *p2 != -1 ) { |
118 | if (compar_int(p1, p2) == 0) { | |
119 | printf("p1:%"llx" p2:%"llx" p3:%"llx" key:%012"llx"\n",(uint64_t)(p1-last_keylist),(uint64_t)(p2-state_s),(uint64_t)(p3-last_keylist),*p1); | |
120 | *p3++ = *p1++; | |
121 | p2++; | |
122 | } | |
123 | else { | |
124 | while (compar_int(p1, p2) == -1) ++p1; | |
125 | while (compar_int(p1, p2) == 1) ++p2; | |
126 | } | |
127 | } | |
31cf8048 | 128 | key_count = p3 - last_keylist; |
129 | PrintAndLog("one A"); | |
cd91e41c | 130 | } else { |
131 | key_count = 0; | |
31cf8048 | 132 | PrintAndLog("one B"); |
cd91e41c | 133 | } |
134 | ||
135 | printf("key_count:%d\n", key_count); | |
136 | ||
137 | // The list may still contain several key candidates. Test each of them with mfCheckKeys | |
59e933fc | 138 | uint8_t keyBlock[6] = {0,0,0,0,0,0}; |
cd91e41c | 139 | uint64_t key64; |
140 | for (i = 0; i < key_count; i++) { | |
141 | key64 = *(last_keylist + i); | |
142 | num_to_bytes(key64, 6, keyBlock); | |
143 | key64 = 0; | |
59e933fc | 144 | if (!mfCheckKeys(blockno, keytype, false, 1, keyBlock, &key64)) { |
cd91e41c | 145 | *key = key64; |
146 | free(last_keylist); | |
147 | last_keylist = NULL; | |
148 | free(state); | |
149 | return 0; | |
150 | } | |
59e933fc | 151 | } |
152 | ||
cd91e41c | 153 | free(last_keylist); |
154 | last_keylist = state_s; | |
155 | return 1; | |
156 | } | |
46cd801c | 157 | |
f0e183ec | 158 | // 32 bit recover key from 2 nonces |
ba39db37 | 159 | bool tryMfk32(nonces_t data, uint64_t *outputkey, bool verbose) { |
46cd801c | 160 | struct Crypto1State *s,*t; |
f0e183ec | 161 | uint64_t outkey = 0; |
162 | uint64_t key=0; // recovered key | |
163 | uint32_t uid = data.cuid; | |
164 | uint32_t nt = data.nonce; // first tag challenge (nonce) | |
165 | uint32_t nr0_enc = data.nr; // first encrypted reader challenge | |
166 | uint32_t ar0_enc = data.ar; // first encrypted reader response | |
167 | uint32_t nr1_enc = data.nr2; // second encrypted reader challenge | |
168 | uint32_t ar1_enc = data.ar2; // second encrypted reader response | |
46cd801c | 169 | bool isSuccess = FALSE; |
f0e183ec | 170 | uint8_t counter = 0; |
ba39db37 | 171 | |
172 | clock_t t1 = clock(); | |
02d5a583 | 173 | uint32_t p64 = prng_successor(nt, 64); |
ba39db37 | 174 | |
175 | if ( verbose ) { | |
176 | printf("Recovering key for:\n"); | |
177 | printf(" uid: %08x\n",uid); | |
178 | printf(" nt: %08x\n",nt); | |
179 | printf(" {nr_0}: %08x\n",nr0_enc); | |
180 | printf(" {ar_0}: %08x\n",ar0_enc); | |
181 | printf(" {nr_1}: %08x\n",nr1_enc); | |
182 | printf(" {ar_1}: %08x\n",ar1_enc); | |
183 | printf("\nLFSR succesors of the tag challenge:\n"); | |
184 | printf(" nt': %08x\n", p64); | |
185 | printf(" nt'': %08x\n", prng_successor(p64, 32)); | |
186 | } | |
02d5a583 | 187 | |
188 | s = lfsr_recovery32(ar0_enc ^ p64, 0); | |
46cd801c | 189 | |
190 | for(t = s; t->odd | t->even; ++t) { | |
191 | lfsr_rollback_word(t, 0, 0); | |
192 | lfsr_rollback_word(t, nr0_enc, 1); | |
193 | lfsr_rollback_word(t, uid ^ nt, 0); | |
194 | crypto1_get_lfsr(t, &key); | |
195 | crypto1_word(t, uid ^ nt, 0); | |
196 | crypto1_word(t, nr1_enc, 1); | |
02d5a583 | 197 | if (ar1_enc == (crypto1_word(t, 0, 0) ^ p64)) { |
f0e183ec | 198 | outkey = key; |
46cd801c | 199 | ++counter; |
f0e183ec | 200 | if (counter==20) break; |
46cd801c | 201 | } |
202 | } | |
f0e183ec | 203 | isSuccess = (counter > 0); |
cd91e41c | 204 | t1 = clock() - t1; |
f0e183ec | 205 | if ( t1 > 0 ) PrintAndLog("Time in mfkey32: %.0f ticks - possible keys %d\n", (float)t1, counter); |
02d5a583 | 206 | |
207 | *outputkey = ( isSuccess ) ? outkey : 0; | |
cd91e41c | 208 | crypto1_destroy(s); |
46cd801c | 209 | return isSuccess; |
210 | } | |
211 | ||
ba39db37 | 212 | bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool verbose) { |
738eeccd | 213 | struct Crypto1State *s, *t; |
f0e183ec | 214 | uint64_t outkey = 0; |
cd91e41c | 215 | uint64_t key = 0; // recovered key |
f0e183ec | 216 | uint32_t uid = data.cuid; |
217 | uint32_t nt0 = data.nonce; // first tag challenge (nonce) | |
218 | uint32_t nr0_enc = data.nr; // first encrypted reader challenge | |
219 | uint32_t ar0_enc = data.ar; // first encrypted reader response | |
cd91e41c | 220 | //uint32_t uid1 = le32toh(data+16); |
f0e183ec | 221 | uint32_t nt1 = data.nonce2; // second tag challenge (nonce) |
222 | uint32_t nr1_enc = data.nr2; // second encrypted reader challenge | |
223 | uint32_t ar1_enc = data.ar2; // second encrypted reader response | |
d8af608f | 224 | bool isSuccess = FALSE; |
225 | int counter = 0; | |
ba39db37 | 226 | |
227 | clock_t t1 = clock(); | |
228 | ||
229 | uint32_t p640 = prng_successor(nt0, 64); | |
230 | uint32_t p641 = prng_successor(nt1, 64); | |
d8af608f | 231 | |
ba39db37 | 232 | if (verbose) { |
dfdbfa07 MF |
233 | printf("Recovering key for:\n"); |
234 | printf(" uid: %08x\n", uid); | |
235 | printf(" nt_0: %08x\n", nt0); | |
236 | printf(" {nr_0}: %08x\n", nr0_enc); | |
237 | printf(" {ar_0}: %08x\n", ar0_enc); | |
238 | printf(" nt_1: %08x\n", nt1); | |
239 | printf(" {nr_1}: %08x\n", nr1_enc); | |
240 | printf(" {ar_1}: %08x\n", ar1_enc); | |
dfdbfa07 MF |
241 | printf("\nLFSR succesors of the tag challenge:\n"); |
242 | printf(" nt': %08x\n", p640); | |
243 | printf(" nt'': %08x\n", prng_successor(p640, 32)); | |
244 | } | |
b6e05350 | 245 | |
02d5a583 | 246 | s = lfsr_recovery32(ar0_enc ^ p640, 0); |
d8af608f | 247 | |
248 | for(t = s; t->odd | t->even; ++t) { | |
249 | lfsr_rollback_word(t, 0, 0); | |
250 | lfsr_rollback_word(t, nr0_enc, 1); | |
251 | lfsr_rollback_word(t, uid ^ nt0, 0); | |
252 | crypto1_get_lfsr(t, &key); | |
253 | ||
254 | crypto1_word(t, uid ^ nt1, 0); | |
255 | crypto1_word(t, nr1_enc, 1); | |
02d5a583 | 256 | if (ar1_enc == (crypto1_word(t, 0, 0) ^ p641)) { |
f0e183ec | 257 | outkey=key; |
d8af608f | 258 | ++counter; |
f0e183ec | 259 | if (counter==20) break; |
d8af608f | 260 | } |
261 | } | |
f0e183ec | 262 | isSuccess = (counter > 0); |
cd91e41c | 263 | t1 = clock() - t1; |
f0e183ec | 264 | if ( t1 > 0 ) PrintAndLog("Time in mfkey32_moebius: %.0f ticks - possible keys %d\n", (float)t1, counter); |
02d5a583 | 265 | |
f0e183ec | 266 | *outputkey = ( isSuccess ) ? outkey : 0; |
cd91e41c | 267 | crypto1_destroy(s); |
d8af608f | 268 | return isSuccess; |
269 | } | |
270 | ||
cd91e41c | 271 | int tryMfk64_ex(uint8_t *data, uint64_t *outputkey){ |
272 | uint32_t uid = le32toh(data); | |
273 | uint32_t nt = le32toh(data+4); // tag challenge | |
274 | uint32_t nr_enc = le32toh(data+8); // encrypted reader challenge | |
275 | uint32_t ar_enc = le32toh(data+12); // encrypted reader response | |
276 | uint32_t at_enc = le32toh(data+16); // encrypted tag response | |
277 | return tryMfk64(uid, nt, nr_enc, ar_enc, at_enc, outputkey); | |
278 | } | |
46cd801c | 279 | |
cd91e41c | 280 | int tryMfk64(uint32_t uid, uint32_t nt, uint32_t nr_enc, uint32_t ar_enc, uint32_t at_enc, uint64_t *outputkey){ |
02d5a583 | 281 | uint64_t key = 0; // recovered key |
282 | uint32_t ks2; // keystream used to encrypt reader response | |
283 | uint32_t ks3; // keystream used to encrypt tag response | |
46cd801c | 284 | struct Crypto1State *revstate; |
46cd801c | 285 | |
cd91e41c | 286 | PrintAndLog("Enter mfkey64"); |
287 | clock_t t1 = clock(); | |
46cd801c | 288 | |
46cd801c | 289 | // Extract the keystream from the messages |
290 | ks2 = ar_enc ^ prng_successor(nt, 64); | |
291 | ks3 = at_enc ^ prng_successor(nt, 96); | |
46cd801c | 292 | revstate = lfsr_recovery64(ks2, ks3); |
293 | lfsr_rollback_word(revstate, 0, 0); | |
294 | lfsr_rollback_word(revstate, 0, 0); | |
295 | lfsr_rollback_word(revstate, nr_enc, 1); | |
296 | lfsr_rollback_word(revstate, uid ^ nt, 0); | |
297 | crypto1_get_lfsr(revstate, &key); | |
02d5a583 | 298 | |
cd91e41c | 299 | PrintAndLog("Found Key: [%012"llx"]", key); |
cd91e41c | 300 | t1 = clock() - t1; |
301 | if ( t1 > 0 ) PrintAndLog("Time in mfkey64: %.0f ticks \n", (float)t1); | |
02d5a583 | 302 | |
303 | *outputkey = key; | |
304 | crypto1_destroy(revstate); | |
46cd801c | 305 | return 0; |
5fdf8672 | 306 | } |