From 39274bee9bd7bc0c96d89fd0bcb06a47050e8cd8 Mon Sep 17 00:00:00 2001 From: z4yx Date: Sun, 6 Aug 2023 22:51:37 +0800 Subject: [PATCH] correct hmac-secret processing with Pin Protocol V2 --- applets/ctap/ctap.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/applets/ctap/ctap.c b/applets/ctap/ctap.c index 0ee17d5f..103f37ec 100644 --- a/applets/ctap/ctap.c +++ b/applets/ctap/ctap.c @@ -923,27 +923,35 @@ static uint8_t ctap_get_assertion(CborEncoder *encoder, uint8_t *params, size_t if (ga.parsed_params & PARAM_HMAC_SECRET) { uint8_t iv[16] = {0}; block_cipher_config cfg = {.block_size = 16, .mode = CBC, .iv = iv, .encrypt = aes256_enc, .decrypt = aes256_dec}; + uint8_t *hmac_enc_key = ga.ext_hmac_secret_pin_protocol == 2 ? + ga.ext_hmac_secret_key_agreement + SHARED_SECRET_SIZE : + ga.ext_hmac_secret_key_agreement; if (credential_counter == 0) { ret = cp_decapsulate(ga.ext_hmac_secret_key_agreement, ga.ext_hmac_secret_pin_protocol); CHECK_PARSER_RET(ret); + DBG_MSG("ext_hmac_secret_key_agreement: "); + PRINT_HEX(ga.ext_hmac_secret_key_agreement, ga.ext_hmac_secret_pin_protocol == 2 ? 64 : 32); uint8_t hmac_buf[SHA256_DIGEST_LENGTH]; hmac_sha256(ga.ext_hmac_secret_key_agreement, SHARED_SECRET_SIZE, ga.ext_hmac_secret_salt_enc, ga.ext_hmac_secret_salt_len, hmac_buf); if (memcmp(hmac_buf, ga.ext_hmac_secret_salt_auth, HMAC_SECRET_SALT_AUTH_SIZE) != 0) return CTAP2_ERR_EXTENSION_FIRST; - cfg.key = ga.ext_hmac_secret_key_agreement; + cfg.key = hmac_enc_key; cfg.in_size = ga.ext_hmac_secret_salt_len; cfg.in = ga.ext_hmac_secret_salt_enc; cfg.out = ga.ext_hmac_secret_salt_enc; block_cipher_dec(&cfg); } + // TODO: when credential_counter != 0 + DBG_MSG("hmac-secret-salt: "); + PRINT_HEX(ga.ext_hmac_secret_salt_enc, ga.ext_hmac_secret_salt_len); ret = make_hmac_secret_output(dc.credential_id.nonce, ga.ext_hmac_secret_salt_enc, ga.ext_hmac_secret_salt_len, ga.ext_hmac_secret_salt_enc, uv); CHECK_PARSER_RET(ret); DBG_MSG("hmac-secret (plain): "); PRINT_HEX(ga.ext_hmac_secret_salt_enc, ga.ext_hmac_secret_salt_len); - cfg.key = ga.ext_hmac_secret_key_agreement; + cfg.key = hmac_enc_key; cfg.in_size = ga.ext_hmac_secret_salt_len; cfg.in = ga.ext_hmac_secret_salt_enc; cfg.out = ga.ext_hmac_secret_salt_enc;