james/yubikey.rs
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

move authenticate to library as ykpiv_authenticate()

Browse Source
This commit is contained in:
Klas Lindfors
2014-06-17 09:33:46 +02:00
parent 6dcb6798e6
commit cb60c782f5
5 changed files with 96 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/error.c
+2
View File
@@ -46,6 +46,8 @@ static const err_t errors[] = {
ERR (YKPIV_PCSC_ERROR, "Error in PCSC call"),
ERR (YKPIV_SIZE_ERROR, "Wrong buffer size"),
ERR (YKPIV_APPLET_ERROR, "No PIV applet found"),
ERR (YKPIV_AUTHENTICATION_ERROR, "Error during authentication"),
ERR (YKPIV_RANDOMNESS_ERROR, "Error getting randomness"),
};
/**
lib/ykpiv.c
+89
View File
@@ -32,6 +32,9 @@
#include <stdio.h>
#include <stdint.h>
#include <openssl/des.h>
#include <openssl/rand.h>
#include "internal.h"
#include "ykpiv.h"
@@ -270,3 +273,89 @@ ykpiv_rc ykpiv_send_data(ykpiv_state *state, unsigned char *apdu,
}
return YKPIV_OK;
}
ykpiv_rc ykpiv_authenticate(ykpiv_state *state, unsigned const char *key) {
APDU apdu;
unsigned char data[0xff];
DES_cblock challenge;
unsigned long recv_len = sizeof(data);
int sw;
ykpiv_rc res;
DES_key_schedule ks1, ks2, ks3;
/* set up our key */
{
const_DES_cblock key_tmp;
memcpy(key_tmp, key, 8);
DES_set_key_unchecked(&key_tmp, &ks1);
memcpy(key_tmp, key + 8, 8);
DES_set_key_unchecked(&key_tmp, &ks2);
memcpy(key_tmp, key + 16, 8);
DES_set_key_unchecked(&key_tmp, &ks3);
}
/* get a challenge from the card */
{
memset(apdu.raw, 0, sizeof(apdu));
apdu.st.ins = 0x87;
apdu.st.p1 = 0x03; /* triple des */
apdu.st.p2 = 0x9b; /* management key */
apdu.st.lc = 0x04;
apdu.st.data[0] = 0x7c;
apdu.st.data[1] = 0x02;
apdu.st.data[2] = 0x80;
if((res = ykpiv_send_data(state, apdu.raw, data, &recv_len, &sw)) != YKPIV_OK) {
return res;
} else if(sw != 0x9000) {
return YKPIV_AUTHENTICATION_ERROR;
}
memcpy(challenge, data + 4, 8);
}
/* send a response to the cards challenge and a challenge of our own. */
{
unsigned char *dataptr = apdu.st.data;
DES_cblock response;
DES_ecb3_encrypt(&challenge, &response, &ks1, &ks2, &ks3, 0);
recv_len = 0xff;
memset(apdu.raw, 0, sizeof(apdu));
apdu.st.ins = 0x87;
apdu.st.p1 = 0x03; /* triple des */
apdu.st.p2 = 0x9b; /* management key */
*dataptr++ = 0x7c;
*dataptr++ = 20; /* 2 + 8 + 2 +8 */
*dataptr++ = 0x80;
*dataptr++ = 8;
memcpy(dataptr, response, 8);
dataptr += 8;
*dataptr++ = 0x81;
*dataptr++ = 8;
if(RAND_pseudo_bytes(dataptr, 8) == -1) {
if(state->verbose) {
fprintf(stderr, "Failed getting randomness for authentication.\n");
}
return YKPIV_RANDOMNESS_ERROR;
}
memcpy(challenge, dataptr, 8);
dataptr += 8;
apdu.st.lc = dataptr - apdu.st.data;
if((res = ykpiv_send_data(state, apdu.raw, data, &recv_len, &sw)) != YKPIV_OK) {
return res;
} else if(sw != 0x9000) {
return YKPIV_AUTHENTICATION_ERROR;
}
}
/* compare the response from the card with our challenge */
{
DES_cblock response;
DES_ecb3_encrypt(&challenge, &response, &ks1, &ks2, &ks3, 1);
if(memcmp(response, data + 4, 8) == 0) {
return YKPIV_OK;
} else {
return YKPIV_AUTHENTICATION_ERROR;
}
}
}
lib/ykpiv.h
+3
View File
@@ -45,6 +45,8 @@ extern "C"
YKPIV_PCSC_ERROR = -2,
YKPIV_SIZE_ERROR = -3,
YKPIV_APPLET_ERROR = -4,
YKPIV_AUTHENTICATION_ERROR = -5,
YKPIV_RANDOMNESS_ERROR = -6,
} ykpiv_rc;
const char *ykpiv_strerror(ykpiv_rc err);
@@ -58,6 +60,7 @@ extern "C"
unsigned char *out_data, unsigned long *out_len, int *sw);
ykpiv_rc ykpiv_send_data(ykpiv_state *state, unsigned char *apdu,
unsigned char *data, unsigned long *recv_len, int *sw);
ykpiv_rc ykpiv_authenticate(ykpiv_state *state, const unsigned char *key);
#ifdef __cplusplus
}
lib/ykpiv.map
+1
View File
@@ -35,6 +35,7 @@ global:
ykpiv_connect;
ykpiv_send_data;
ykpiv_transfer_data;
ykpiv_authenticate;
local:
*;
tool/yubico-piv-tool.c
+1 -84
View File
@@ -90,89 +90,6 @@ static bool sign_data(ykpiv_state*, unsigned char*, int, unsigned char, unsigned
ASN1_BIT_STRING*);
static int get_object_id(enum enum_slot slot);
static bool authenticate(ykpiv_state *state, unsigned const char *key) {
APDU apdu;
unsigned char data[0xff];
DES_cblock challenge;
unsigned long recv_len = sizeof(data);
int sw;
DES_key_schedule ks1, ks2, ks3;
/* set up our key */
{
const_DES_cblock key_tmp;
memcpy(key_tmp, key, 8);
DES_set_key_unchecked(&key_tmp, &ks1);
memcpy(key_tmp, key + 8, 8);
DES_set_key_unchecked(&key_tmp, &ks2);
memcpy(key_tmp, key + 16, 8);
DES_set_key_unchecked(&key_tmp, &ks3);
}
/* get a challenge from the card */
{
memset(apdu.raw, 0, sizeof(apdu));
apdu.st.ins = 0x87;
apdu.st.p1 = 0x03; /* triple des */
apdu.st.p2 = 0x9b; /* management key */
apdu.st.lc = 0x04;
apdu.st.data[0] = 0x7c;
apdu.st.data[1] = 0x02;
apdu.st.data[2] = 0x80;
if(ykpiv_send_data(state, apdu.raw, data, &recv_len, &sw) != YKPIV_OK) {
return false;
} else if(sw != 0x9000) {
return false;
}
memcpy(challenge, data + 4, 8);
}
/* send a response to the cards challenge and a challenge of our own. */
{
unsigned char *dataptr = apdu.st.data;
DES_cblock response;
DES_ecb3_encrypt(&challenge, &response, &ks1, &ks2, &ks3, 0);
recv_len = 0xff;
memset(apdu.raw, 0, sizeof(apdu));
apdu.st.ins = 0x87;
apdu.st.p1 = 0x03; /* triple des */
apdu.st.p2 = 0x9b; /* management key */
*dataptr++ = 0x7c;
*dataptr++ = 20; /* 2 + 8 + 2 +8 */
*dataptr++ = 0x80;
*dataptr++ = 8;
memcpy(dataptr, response, 8);
dataptr += 8;
*dataptr++ = 0x81;
*dataptr++ = 8;
if(RAND_pseudo_bytes(dataptr, 8) == -1) {
fprintf(stderr, "Failed getting randomness for authentication.\n");
return false;
}
memcpy(challenge, dataptr, 8);
dataptr += 8;
apdu.st.lc = dataptr - apdu.st.data;
if(ykpiv_send_data(state, apdu.raw, data, &recv_len, &sw) != YKPIV_OK) {
return false;
} else if(sw != 0x9000) {
return false;
}
}
/* compare the response from the card with our challenge */
{
DES_cblock response;
DES_ecb3_encrypt(&challenge, &response, &ks1, &ks2, &ks3, 1);
if(memcmp(response, data + 4, 8) == 0) {
return true;
} else {
return false;
}
}
}
static void print_version(ykpiv_state *state) {
APDU apdu;
unsigned char data[0xff];
@@ -1288,7 +1205,7 @@ int main(int argc, char *argv[]) {
return EXIT_FAILURE;
}
if(authenticate(state, key) == false) {
if(ykpiv_authenticate(state, key) != YKPIV_OK) {
fprintf(stderr, "Failed authentication with the applet.\n");
return EXIT_FAILURE;
}