]>
cvs.zerfleddert.de Git - proxmark3-svn/blob - client/nonce2key/nonce2key.c
1 //-----------------------------------------------------------------------------
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
9 //-----------------------------------------------------------------------------
10 // MIFARE Darkside hack
11 //-----------------------------------------------------------------------------
12 #include "nonce2key.h"
14 int nonce2key(uint32_t uid
, uint32_t nt
, uint32_t nr
, uint64_t par_info
, uint64_t ks_info
, uint64_t * key
) {
15 struct Crypto1State
*state
;
16 uint32_t i
, pos
, rr
= 0, nr_diff
;
17 byte_t bt
, ks3x
[8], par
[8][8];
19 // Reset the last three significant bits of the reader nonce
22 PrintAndLog("uid(%08x) nt(%08x) par(%016"llx
") ks(%016"llx
") nr(%08x)", uid
, nt
, par_info
, ks_info
, nr
);
24 for ( pos
= 0; pos
< 8; pos
++ ) {
25 ks3x
[7-pos
] = (ks_info
>> (pos
*8)) & 0x0f;
26 bt
= (par_info
>> (pos
*8)) & 0xff;
28 for ( i
= 0; i
< 8; i
++) {
29 par
[7-pos
][i
] = (bt
>> i
) & 0x01;
33 PrintAndLog("+----+--------+---+-----+---------------+");
34 PrintAndLog("|diff|{nr} |ks3|ks3^5|parity |");
35 PrintAndLog("+----+--------+---+-----+---------------+");
36 for ( i
= 0; i
< 8; i
++) {
37 nr_diff
= nr
| i
<< 5;
39 PrintAndLog("| %02x |%08x| %01x | %01x |%01x,%01x,%01x,%01x,%01x,%01x,%01x,%01x|",
40 i
<< 5, nr_diff
, ks3x
[i
], ks3x
[i
]^5,
41 par
[i
][0], par
[i
][1], par
[i
][2], par
[i
][3],
42 par
[i
][4], par
[i
][5], par
[i
][6], par
[i
][7]);
45 PrintAndLog("+----+--------+---+-----+---------------+");
49 state
= lfsr_common_prefix(nr
, rr
, ks3x
, par
);
50 lfsr_rollback_word(state
, uid
^ nt
, 0);
51 crypto1_get_lfsr(state
, key
);
52 crypto1_destroy(state
);
55 if ( t1
> 0 ) PrintAndLog("Time in nonce2key: %.0f ticks", (float)t1
);
59 int compar_intA(const void * a
, const void * b
) {
60 if (*(int64_t*)b
== *(int64_t*)a
) return 0;
61 if (*(int64_t*)b
> *(int64_t*)a
) return 1;
65 // call when PAR == 0, special attack? It seems to need two calls. with same uid, block, keytype
66 int nonce2key_ex(uint8_t blockno
, uint8_t keytype
, uint32_t uid
, uint32_t nt
, uint32_t nr
, uint64_t ks_info
, uint64_t * key
) {
68 struct Crypto1State
*state
;
69 uint32_t i
, pos
, key_count
;
71 uint64_t key_recovered
;
73 static uint8_t last_blockno
;
74 static uint8_t last_keytype
;
75 static uint32_t last_uid
;
76 static int64_t *last_keylist
;
78 if (last_uid
!= uid
&&
79 last_blockno
!= blockno
&&
80 last_keytype
!= keytype
&&
87 last_blockno
= blockno
;
88 last_keytype
= keytype
;
90 // Reset the last three significant bits of the reader nonce
93 // split keystream into array
94 for (pos
=0; pos
<8; pos
++) {
95 ks3x
[7-pos
] = (ks_info
>> (pos
*8)) & 0x0f;
98 // find possible states for this keystream
99 state
= lfsr_common_prefix_ex(nr
, ks3x
);
102 PrintAndLog("Failed getting states");
106 state_s
= (int64_t*)state
;
108 uint32_t xored
= uid
^ nt
;
110 for (i
= 0; (state
) && ((state
+ i
)->odd
!= -1); i
++) {
111 lfsr_rollback_word(state
+ i
, xored
, 0);
112 crypto1_get_lfsr(state
+ i
, &key_recovered
);
113 *(state_s
+ i
) = key_recovered
;
116 qsort(state_s
, i
, sizeof(int64_t), compar_intA
);
119 // first call to this function. clear all other stuff and set new found states.
120 if (last_keylist
== NULL
) {
122 last_keylist
= state_s
;
123 PrintAndLog("parity is all zero, testing special attack. First call, this attack needs at least two calls. Hold on...");
124 PrintAndLog("uid(%08x) nt(%08x) ks(%016"llx
") nr(%08x)", uid
, nt
, ks_info
, nr
);
128 PrintAndLog("uid(%08x) nt(%08x) ks(%016"llx
") nr(%08x)", uid
, nt
, ks_info
, nr
);
130 //Create the intersection:
131 int64_t *p1
, *p2
, *p3
;
132 p1
= p3
= last_keylist
;
135 while ( *p1
!= -1 && *p2
!= -1 ) {
136 if (compar_intA(p1
, p2
) == 0) {
137 PrintAndLog("p1:%"llx
" p2:%"llx
" p3:%"llx
" key:%012"llx
,(uint64_t)(p1
-last_keylist
),(uint64_t)(p2
-state_s
),(uint64_t)(p3
-last_keylist
),*p1
);
142 while (compar_intA(p1
, p2
) == -1) ++p1
;
143 while (compar_intA(p1
, p2
) == 1) ++p2
;
146 key_count
= p3
- last_keylist
;
147 PrintAndLog("key_count: %d", key_count
);
148 if ( key_count
== 0 ){
155 // Validate all key candidates with testing each of them with mfCheckKeys
156 uint8_t keyBlock
[6] = {0,0,0,0,0,0};
158 for (i
= 0; i
< key_count
; i
++) {
159 key64
= *(last_keylist
+ i
);
160 num_to_bytes(key64
, 6, keyBlock
);
162 if (!mfCheckKeys(blockno
, keytype
, false, 1, keyBlock
, &key64
)) {
177 // 32 bit recover key from 2 nonces
178 bool tryMfk32(nonces_t data
, uint64_t *outputkey
, bool verbose
) {
179 struct Crypto1State
*s
,*t
;
181 uint64_t key
=0; // recovered key
182 uint32_t uid
= data
.cuid
;
183 uint32_t nt
= data
.nonce
; // first tag challenge (nonce)
184 uint32_t nr0_enc
= data
.nr
; // first encrypted reader challenge
185 uint32_t ar0_enc
= data
.ar
; // first encrypted reader response
186 uint32_t nr1_enc
= data
.nr2
; // second encrypted reader challenge
187 uint32_t ar1_enc
= data
.ar2
; // second encrypted reader response
188 bool isSuccess
= FALSE
;
191 clock_t t1
= clock();
192 uint32_t p64
= prng_successor(nt
, 64);
195 PrintAndLog("Recovering key for:");
196 PrintAndLog(" uid: %08x",uid
);
197 PrintAndLog(" nt: %08x",nt
);
198 PrintAndLog(" {nr_0}: %08x",nr0_enc
);
199 PrintAndLog(" {ar_0}: %08x",ar0_enc
);
200 PrintAndLog(" {nr_1}: %08x",nr1_enc
);
201 PrintAndLog(" {ar_1}: %08x",ar1_enc
);
202 PrintAndLog("\nLFSR succesors of the tag challenge:");
203 PrintAndLog(" nt': %08x", p64
);
204 PrintAndLog(" nt'': %08x", prng_successor(p64
, 32));
207 s
= lfsr_recovery32(ar0_enc
^ p64
, 0);
209 for(t
= s
; t
->odd
| t
->even
; ++t
) {
210 lfsr_rollback_word(t
, 0, 0);
211 lfsr_rollback_word(t
, nr0_enc
, 1);
212 lfsr_rollback_word(t
, uid
^ nt
, 0);
213 crypto1_get_lfsr(t
, &key
);
214 crypto1_word(t
, uid
^ nt
, 0);
215 crypto1_word(t
, nr1_enc
, 1);
216 if (ar1_enc
== (crypto1_word(t
, 0, 0) ^ p64
)) {
219 if (counter
==20) break;
222 isSuccess
= (counter
> 0);
224 if ( t1
> 0 ) PrintAndLog("Time in mfkey32: %.0f ticks - possible keys %d", (float)t1
, counter
);
226 *outputkey
= ( isSuccess
) ? outkey
: 0;
231 bool tryMfk32_moebius(nonces_t data
, uint64_t *outputkey
, bool verbose
) {
232 struct Crypto1State
*s
, *t
;
234 uint64_t key
= 0; // recovered key
235 uint32_t uid
= data
.cuid
;
236 uint32_t nt0
= data
.nonce
; // first tag challenge (nonce)
237 uint32_t nr0_enc
= data
.nr
; // first encrypted reader challenge
238 uint32_t ar0_enc
= data
.ar
; // first encrypted reader response
239 //uint32_t uid1 = le32toh(data+16);
240 uint32_t nt1
= data
.nonce2
; // second tag challenge (nonce)
241 uint32_t nr1_enc
= data
.nr2
; // second encrypted reader challenge
242 uint32_t ar1_enc
= data
.ar2
; // second encrypted reader response
243 bool isSuccess
= FALSE
;
246 clock_t t1
= clock();
248 uint32_t p640
= prng_successor(nt0
, 64);
249 uint32_t p641
= prng_successor(nt1
, 64);
252 PrintAndLog("Recovering key for:");
253 PrintAndLog(" uid: %08x", uid
);
254 PrintAndLog(" nt_0: %08x", nt0
);
255 PrintAndLog(" {nr_0}: %08x", nr0_enc
);
256 PrintAndLog(" {ar_0}: %08x", ar0_enc
);
257 PrintAndLog(" nt_1: %08x", nt1
);
258 PrintAndLog(" {nr_1}: %08x", nr1_enc
);
259 PrintAndLog(" {ar_1}: %08x", ar1_enc
);
260 PrintAndLog("\nLFSR succesors of the tag challenge:");
261 PrintAndLog(" nt': %08x", p640
);
262 PrintAndLog(" nt'': %08x", prng_successor(p640
, 32));
265 s
= lfsr_recovery32(ar0_enc
^ p640
, 0);
267 for(t
= s
; t
->odd
| t
->even
; ++t
) {
268 lfsr_rollback_word(t
, 0, 0);
269 lfsr_rollback_word(t
, nr0_enc
, 1);
270 lfsr_rollback_word(t
, uid
^ nt0
, 0);
271 crypto1_get_lfsr(t
, &key
);
273 crypto1_word(t
, uid
^ nt1
, 0);
274 crypto1_word(t
, nr1_enc
, 1);
275 if (ar1_enc
== (crypto1_word(t
, 0, 0) ^ p641
)) {
278 if (counter
==20) break;
281 isSuccess
= (counter
> 0);
284 if ( t1
> 0 ) PrintAndLog("Time in mfkey32_moebius: %.0f ticks - possible keys %d", (float)t1
, counter
);
286 *outputkey
= ( isSuccess
) ? outkey
: 0;
291 int tryMfk64_ex(uint8_t *data
, uint64_t *outputkey
){
292 uint32_t uid
= le32toh(data
);
293 uint32_t nt
= le32toh(data
+4); // tag challenge
294 uint32_t nr_enc
= le32toh(data
+8); // encrypted reader challenge
295 uint32_t ar_enc
= le32toh(data
+12); // encrypted reader response
296 uint32_t at_enc
= le32toh(data
+16); // encrypted tag response
297 return tryMfk64(uid
, nt
, nr_enc
, ar_enc
, at_enc
, outputkey
);
300 int tryMfk64(uint32_t uid
, uint32_t nt
, uint32_t nr_enc
, uint32_t ar_enc
, uint32_t at_enc
, uint64_t *outputkey
){
301 uint64_t key
= 0; // recovered key
302 uint32_t ks2
; // keystream used to encrypt reader response
303 uint32_t ks3
; // keystream used to encrypt tag response
304 struct Crypto1State
*revstate
;
306 PrintAndLog("Enter mfkey64");
307 clock_t t1
= clock();
309 // Extract the keystream from the messages
310 ks2
= ar_enc
^ prng_successor(nt
, 64);
311 ks3
= at_enc
^ prng_successor(nt
, 96);
312 revstate
= lfsr_recovery64(ks2
, ks3
);
313 lfsr_rollback_word(revstate
, 0, 0);
314 lfsr_rollback_word(revstate
, 0, 0);
315 lfsr_rollback_word(revstate
, nr_enc
, 1);
316 lfsr_rollback_word(revstate
, uid
^ nt
, 0);
317 crypto1_get_lfsr(revstate
, &key
);
319 PrintAndLog("Found Key: [%012"llx
"]", key
);
321 if ( t1
> 0 ) PrintAndLog("Time in mfkey64: %.0f ticks", (float)t1
);
324 crypto1_destroy(revstate
);