| /* |
| * Copyright (C) 2019 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| package com.android.internal.net.ipsec.ike.crypto; |
| |
| import android.net.ipsec.ike.SaProposal; |
| |
| import com.android.internal.net.crypto.KeyGenerationUtils; |
| import com.android.internal.net.ipsec.ike.message.IkeSaPayload.PrfTransform; |
| |
| import java.nio.ByteBuffer; |
| import java.util.Arrays; |
| |
| import javax.crypto.Cipher; |
| import javax.crypto.Mac; |
| |
| /** |
| * IkeMacPrf represents a negotiated pseudorandom function. |
| * |
| * <p>Pseudorandom function is usually used for IKE SA authentication and generating keying |
| * materials. |
| * |
| * <p>For pseudorandom functions based on integrity algorithms, all operations will be done by a |
| * {@link Mac}. For pseudorandom functions based on encryption algorithms, all operations will be |
| * done by a {@link Cipher}. |
| * |
| * @see <a href="https://tools.ietf.org/html/rfc7296#section-3.3.2">RFC 7296, Internet Key Exchange |
| * Protocol Version 2 (IKEv2)</a> |
| */ |
| public class IkeMacPrf extends IkeMac { |
| // STOPSHIP: b/130190639 Catch unchecked exceptions, notify users and close the IKE session. |
| private static final int PSEUDORANDOM_FUNCTION_AES128_XCBC_KEY_LEN = 16; |
| |
| private IkeMacPrf( |
| @SaProposal.PseudorandomFunction int algorithmId, |
| int keyLength, |
| String algorithmName, |
| boolean isEncryptAlgo) { |
| super(algorithmId, keyLength, algorithmName, isEncryptAlgo); |
| } |
| |
| /** |
| * Construct an instance of IkeMacPrf. |
| * |
| * @param prfTransform the valid negotiated PrfTransform. |
| * @return an instance of IkeMacPrf. |
| */ |
| public static IkeMacPrf create(PrfTransform prfTransform) { |
| int algorithmId = prfTransform.id; |
| |
| int keyLength = 0; |
| String algorithmName = ""; |
| boolean isEncryptAlgo = false; |
| |
| switch (algorithmId) { |
| case SaProposal.PSEUDORANDOM_FUNCTION_HMAC_SHA1: |
| keyLength = 20; |
| algorithmName = "HmacSHA1"; |
| break; |
| case SaProposal.PSEUDORANDOM_FUNCTION_AES128_XCBC: |
| keyLength = 16; |
| isEncryptAlgo = true; |
| algorithmName = "AES_128/CBC/NoPadding"; |
| break; |
| case SaProposal.PSEUDORANDOM_FUNCTION_SHA2_256: |
| keyLength = 32; |
| algorithmName = "HmacSHA256"; |
| break; |
| case SaProposal.PSEUDORANDOM_FUNCTION_SHA2_384: |
| keyLength = 48; |
| algorithmName = "HmacSHA384"; |
| break; |
| case SaProposal.PSEUDORANDOM_FUNCTION_SHA2_512: |
| keyLength = 64; |
| algorithmName = "HmacSHA512"; |
| break; |
| default: |
| throw new IllegalArgumentException("Unrecognized PRF ID: " + algorithmId); |
| } |
| |
| return new IkeMacPrf(algorithmId, keyLength, algorithmName, isEncryptAlgo); |
| } |
| |
| /** |
| * Generates SKEYSEED based on the nonces and shared DH secret. |
| * |
| * @param nonceInit the IKE initiator nonce. |
| * @param nonceResp the IKE responder nonce. |
| * @param sharedDhKey the DH shared key. |
| * @return the byte array of SKEYSEED. |
| */ |
| public byte[] generateSKeySeed(byte[] nonceInit, byte[] nonceResp, byte[] sharedDhKey) { |
| ByteBuffer keyBuffer = null; |
| if (getAlgorithmId() == SaProposal.PSEUDORANDOM_FUNCTION_AES128_XCBC) { |
| keyBuffer = ByteBuffer.allocate(PSEUDORANDOM_FUNCTION_AES128_XCBC_KEY_LEN); |
| // Use 8 bytes each from initiator and responder nonces as per RFC 7296 |
| keyBuffer |
| .put(Arrays.copyOfRange(nonceInit, 0, 8)) |
| .put(Arrays.copyOfRange(nonceResp, 0, 8)); |
| } else { |
| keyBuffer = ByteBuffer.allocate(nonceInit.length + nonceResp.length); |
| keyBuffer.put(nonceInit).put(nonceResp); |
| } |
| |
| return signBytes(keyBuffer.array(), sharedDhKey); |
| } |
| |
| /** |
| * Generates a rekey SKEYSEED based on the nonces and shared DH secret. |
| * |
| * @param skD the secret for deriving new keys |
| * @param nonceInit the IKE initiator nonce. |
| * @param nonceResp the IKE responder nonce. |
| * @param sharedDhKey the DH shared key. |
| * @return the byte array of SKEYSEED. |
| */ |
| public byte[] generateRekeyedSKeySeed( |
| byte[] skD, byte[] nonceInit, byte[] nonceResp, byte[] sharedDhKey) { |
| ByteBuffer dataToSign = null; |
| if (getAlgorithmId() == SaProposal.PSEUDORANDOM_FUNCTION_AES128_XCBC) { |
| dataToSign = |
| ByteBuffer.allocate( |
| sharedDhKey.length + PSEUDORANDOM_FUNCTION_AES128_XCBC_KEY_LEN); |
| // Use 8 bytes each from initiator and responder nonces as per RFC 7296 |
| dataToSign |
| .put(sharedDhKey) |
| .put(Arrays.copyOfRange(nonceInit, 0, 8)) |
| .put(Arrays.copyOfRange(nonceResp, 0, 8)); |
| } else { |
| dataToSign = |
| ByteBuffer.allocate(sharedDhKey.length + nonceInit.length + nonceResp.length); |
| dataToSign.put(sharedDhKey).put(nonceInit).put(nonceResp); |
| } |
| |
| return signBytes(skD, dataToSign.array()); |
| } |
| |
| /** |
| * Derives keying materials from IKE/Child SA negotiation. |
| * |
| * <p>prf+(K, S) outputs a pseudorandom stream by using negotiated PRF iteratively. In this way |
| * it can generate long enough keying material containing all the keys for this IKE/Child SA. |
| * |
| * @see <a href="https://tools.ietf.org/html/rfc7296#section-2.13">RFC 7296 Internet Key |
| * Exchange Protocol Version 2 (IKEv2) 2.13. Generating Keying Material </a> |
| * @param keyBytes the key to sign data. SKEYSEED is used for generating KEYMAT for IKE SA. SK_d |
| * is used for generating KEYMAT for Child SA. |
| * @param dataToSign the data to be signed. |
| * @param keyMaterialLen the length of keying materials. |
| * @return the byte array of keying materials |
| */ |
| public byte[] generateKeyMat(byte[] keyBytes, byte[] dataToSign, int keyMaterialLen) { |
| return KeyGenerationUtils.prfPlus(this, keyBytes, dataToSign, keyMaterialLen); |
| } |
| |
| /** |
| * Returns algorithm type as a String. |
| * |
| * @return the algorithm type as a String. |
| */ |
| @Override |
| public String getTypeString() { |
| return "Pseudorandom Function"; |
| } |
| } |