Unverified Commit aa8ff592 authored by pwpiwi's avatar pwpiwi Committed by GitHub

add a specific check function for static nonces (used in 'hf mf nested') (#911)

* add a specific check function for static nonces in 'hf mf nested'
* uses a fixed nr_enc and does all the crypto operations on client
* for all possible keys calculate par_enc and ar_enc and send them to device
* CHANGELOG update
parent bedae776
......@@ -17,6 +17,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
- `hf mf chk t` save to emulator memory now works as expected (mwalker)
- Fix `hf mf sim` - wrong access rights to write key B in trailer (@McEloff)
- allow files > 512Bytes in 'hf iclass eload' (@Sherhannn79)
- `hf mf nested` now works with fixed nonce tags too (uzlonewolf, piwi)
### Added
- Added to `hf 14a apdu` print apdu and compose apdu (@merlokk)
......
......@@ -640,8 +640,7 @@ int valid_nonce(uint32_t Nt, uint32_t NtEnc, uint32_t Ks1, uint8_t *parity) {
// Mifare Classic Cards" in Proceedings of the 22nd ACM SIGSAC Conference on
// Computer and Communications Security, 2015
//-----------------------------------------------------------------------------
void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain)
{
void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags, uint8_t *datain) {
uint64_t ui64Key = 0;
uint8_t uid[10];
uint32_t cuid;
......@@ -666,7 +665,6 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags,
bool field_off = flags & 0x0004;
LED_A_ON();
LED_C_OFF();
if (initialize) {
iso14443a_setup(FPGA_HF_ISO14443A_READER_LISTEN);
......@@ -674,8 +672,6 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags,
set_tracing(true);
}
LED_C_ON();
uint16_t num_nonces = 0;
bool have_uid = false;
for (uint16_t i = 0; i <= USB_CMD_DATA_SIZE - 9; ) {
......@@ -747,21 +743,18 @@ void MifareAcquireEncryptedNonces(uint32_t arg0, uint32_t arg1, uint32_t flags,
}
LED_C_OFF();
crypto1_destroy(pcs);
if (field_off) {
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LEDsoff();
LED_D_OFF();
}
LED_B_ON();
cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));
LED_B_OFF();
if (MF_DBGLEVEL >= 3) DbpString("AcquireEncryptedNonces finished");
cmd_send(CMD_ACK, isOK, cuid, num_nonces, buf, sizeof(buf));
LED_A_OFF();
}
......@@ -783,9 +776,10 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
uint16_t davg;
static uint16_t dmin, dmax;
uint8_t uid[10];
uint32_t cuid, nt1, nt2, nttmp, nttest, ks1;
uint32_t cuid, nt1, nt2_enc, nttmp, nttest, ks1;
uint8_t par[1];
uint32_t target_nt[2], target_ks[2];
uint32_t fixed_nt = 0;
uint8_t target_nt_duplicate_count = 0;
uint8_t par_array[4];
......@@ -812,7 +806,6 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
#define NESTED_MAX_TRIES 12
uint16_t unsuccessfull_tries = 0;
if (calibrate) { // for first call only. Otherwise reuse previous calibration
LED_B_ON();
WDT_HIT();
davg = dmax = 0;
......@@ -846,13 +839,14 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
rtr--;
continue;
};
fixed_nt = nt1;
if (delta_time) {
auth2_time = auth1_time + delta_time;
} else {
auth2_time = 0;
}
if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2, &auth2_time, NULL)) {
if (mifare_classic_authex(pcs, cuid, blockNo, keyType, ui64Key, AUTH_NESTED, &nt2_enc, &auth2_time, NULL)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Auth2 error");
rtr--;
continue;
......@@ -861,7 +855,7 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
nttmp = prng_successor(nt1, 100); //NXP Mifare is typical around 840,but for some unlicensed/compatible mifare card this can be 160
for (i = 101; i < 1200; i++) {
nttmp = prng_successor(nttmp, 1);
if (nttmp == nt2) break;
if (nttmp == nt2_enc) break;
}
if (i != 1200) {
......@@ -889,21 +883,17 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
dmin = davg - 2;
dmax = davg + 2;
LED_B_OFF();
}
// -------------------------------------------------------------------------------------------------
LED_C_ON();
// get crypted nonces for target sector
for (i=0; i < 2 && !isOK; i++) { // look for exactly two different nonces
for (i = 0; i < 2 && !isOK; i++) { // look for exactly two different nonces
target_nt[i] = 0;
while (target_nt[i] == 0 && !isOK) { // continue until we have an unambiguous nonce
// prepare next select. No need to power down the card.
if(mifare_classic_halt(pcs, cuid)) {
if (mifare_classic_halt(pcs, cuid)) {
if (MF_DBGLEVEL >= 1) Dbprintf("Nested: Halt error");
continue;
}
......@@ -934,8 +924,8 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
continue;
}
nt2 = bytes_to_num(receivedAnswer, 4);
if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2, par[0]);
nt2_enc = bytes_to_num(receivedAnswer, 4);
if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: Testing nt1=%08x nt2enc=%08x nt2par=%02x", i+1, nt1, nt2_enc, par[0]);
// Parity validity check
for (j = 0; j < 4; j++) {
......@@ -946,9 +936,9 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
nttest = prng_successor(nt1, dmin - 1);
for (j = dmin; j < dmax + 1; j++) {
nttest = prng_successor(nttest, 1);
ks1 = nt2 ^ nttest;
ks1 = nt2_enc ^ nttest;
if (valid_nonce(nttest, nt2, ks1, par_array)){
if (valid_nonce(nttest, nt2_enc, ks1, par_array)){
if (ncount > 0) { // we are only interested in disambiguous nonces, try again
if (MF_DBGLEVEL >= 3) Dbprintf("Nonce#%d: dismissed (ambigous), ntdist=%d", i+1, j);
target_nt[i] = 0;
......@@ -974,28 +964,25 @@ void MifareNested(uint32_t arg0, uint32_t arg1, uint32_t calibrate, uint8_t *dat
}
}
LED_C_OFF();
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
LED_D_OFF();
// ----------------------------- crypto1 destroy
crypto1_destroy(pcs);
uint8_t buf[4 + 4 * 4 + 4];
uint8_t buf[4 + 4 * 4 + 4 + 4];
memcpy(buf, &cuid, 4);
memcpy(buf+4, &target_nt[0], 4);
memcpy(buf+8, &target_ks[0], 4);
memcpy(buf+12, &target_nt[1], 4);
memcpy(buf+16, &target_ks[1], 4);
memcpy(buf+20, &authentication_timeout, 4);
FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF);
memcpy(buf+24, &fixed_nt, 4);
if (MF_DBGLEVEL >= 3) DbpString("NESTED FINISHED");
LED_B_ON();
cmd_send(CMD_ACK, isOK, 0, targetBlockNo + (targetKeyType * 0x100), buf, sizeof(buf));
LED_B_OFF();
LEDsoff();
LED_A_OFF();
}
......@@ -1011,6 +998,7 @@ void MifareChkKeys(uint16_t arg0, uint32_t arg1, uint8_t arg2, uint8_t *datain)
bool multisectorCheck = arg1 & 0x02;
bool init = arg1 & 0x04;
bool drop_field = arg1 & 0x08;
bool fixed_nonce = arg1 & 0x10;
uint32_t auth_timeout = arg1 >> 16;
uint8_t keyCount = arg2;
......@@ -1039,7 +1027,14 @@ void MifareChkKeys(uint16_t arg0, uint32_t arg1, uint8_t arg2, uint8_t *datain)
} else {
cmd_send(CMD_ACK, 0, res, 0, NULL, 0);
}
} else {
} else if (fixed_nonce) {
res = MifareChkBlockKeysFixedNonce(datain, keyCount, blockNo, keyType, &auth_timeout, OLD_MF_DBGLEVEL);
if (res > 0) {
cmd_send(CMD_ACK, 1, res, 0, NULL, 0); // key found
} else {
cmd_send(CMD_ACK, 0, res, 0, NULL, 0); // no key found or aborted
}
} else {
res = MifareChkBlockKeys(datain, keyCount, blockNo, keyType, &auth_timeout, OLD_MF_DBGLEVEL);
if (res > 0) {
cmd_send(CMD_ACK, 1, res, 0, datain + (res - 1) * 6, 6);
......
......@@ -78,8 +78,7 @@ uint8_t mf_crypto1_encrypt4bit(struct Crypto1State *pcs, uint8_t data) {
}
// send X byte basic commands
int mifare_sendcmd(uint8_t cmd, uint8_t* data, uint8_t data_size, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing)
{
int mifare_sendcmd(uint8_t cmd, uint8_t* data, uint8_t data_size, uint8_t* answer, uint8_t *answer_parity, uint32_t *timing) {
uint8_t dcmd[data_size+3];
dcmd[0] = cmd;
memcpy(dcmd+1,data,data_size);
......@@ -95,8 +94,7 @@ int mifare_sendcmd(uint8_t cmd, uint8_t* data, uint8_t data_size, uint8_t* answe
}
// send 2 byte commands
int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing)
{
int mifare_sendcmd_short(struct Crypto1State *pcs, uint8_t crypted, uint8_t cmd, uint8_t data, uint8_t *answer, uint8_t *answer_parity, uint32_t *timing) {
uint8_t dcmd[4], ecmd[4];
uint16_t pos, res;
uint8_t par[1]; // 1 Byte parity is enough here
......@@ -211,7 +209,7 @@ int mifare_classic_authex(struct Crypto1State *pcs, uint32_t uid, uint8_t blockN
// ar+parity
for (pos = 4; pos < 8; pos++) {
nt = prng_successor(nt,8);
mf_nr_ar[pos] = crypto1_byte(pcs,0x00,0) ^ (nt & 0xff);
mf_nr_ar[pos] = crypto1_byte(pcs, 0x00, 0) ^ (nt & 0xff);
par[0] |= (((filter(pcs->odd) ^ oddparity8(nt)) & 0x01) << (7-pos));
}
......@@ -814,18 +812,17 @@ int mifare_desfire_des_auth2(uint32_t uid, uint8_t *key, uint8_t *blockData){
//
//-----------------------------------------------------------------------------
// one key check
int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel) {
static int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint8_t *key, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel, bool fixed_nonce) {
struct Crypto1State mpcs = {0, 0};
struct Crypto1State *pcs;
pcs = &mpcs;
// Iceman: use piwi's faster nonce collecting part in hardnested.
if (*cascade_levels == 0) { // need a full select cycle to get the uid first
iso14a_card_select_t card_info;
if (!iso14443a_select_card(uid, &card_info, cuid, true, 0, true)) {
if (debugLevel >= 1) Dbprintf("ChkKeys: Can't select card");
return 1;
return -1;
}
switch (card_info.uidlen) {
case 4 : *cascade_levels = 1; break;
......@@ -836,63 +833,85 @@ int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uin
} else { // no need for anticollision. We can directly select the card
if (!iso14443a_select_card(uid, NULL, NULL, false, *cascade_levels, true)) {
if (debugLevel >= 1) Dbprintf("ChkKeys: Can't select card (UID) lvl=%d", *cascade_levels);
return 1;
return -1;
}
}
if (mifare_classic_auth(pcs, *cuid, blockNo, keyType, ui64Key, AUTH_FIRST, auth_timeout)) { // authentication failed
return 2;
if (!fixed_nonce) {
uint64_t ui64Key = bytes_to_num(key, 6);
if (mifare_classic_auth(pcs, *cuid, blockNo, keyType, ui64Key, AUTH_FIRST, auth_timeout)) { // authentication failed
return -2;
} else {
mifare_classic_halt(pcs, *cuid);
}
} else {
mifare_classic_halt(pcs, *cuid);
uint8_t receivedAnswer[MAX_MIFARE_FRAME_SIZE];
uint8_t receivedAnswerPar[MAX_MIFARE_PARITY_SIZE];
// Transmit MIFARE_CLASSIC_AUTH
int len = mifare_sendcmd_short(pcs, false, keyType & 0x01 ? MIFARE_AUTH_KEYB : MIFARE_AUTH_KEYA, blockNo, receivedAnswer, receivedAnswerPar, NULL);
if (len != 4) return -2;
// Transmit encrypted reader nonce and reader answer
uint8_t mf_nr_ar[8] = NESTED_FIXED_NR_ENC;
memcpy(mf_nr_ar + 4, key, 4);
ReaderTransmitPar(mf_nr_ar, sizeof(mf_nr_ar), key + 4, NULL);
uint32_t save_timeout = iso14a_get_timeout(); // save standard timeout
iso14a_set_timeout(*auth_timeout); // set timeout for authentication response
len = ReaderReceive(receivedAnswer, receivedAnswerPar);
iso14a_set_timeout(save_timeout); // restore standard timeout
if (!len) return -2;
}
return 0;
return 0; // success
}
// multi key check
int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel) {
static int MifareChkBlockKeysEx(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel, bool fixed_nonce) {
uint8_t uid[10];
uint32_t cuid = 0;
uint8_t cascade_levels = 0;
uint64_t ui64Key = 0;
int retryCount = 0;
for (uint8_t i = 0; i < keyCount; i++) {
ui64Key = bytes_to_num(keys + i * 6, 6);
int res = MifareChkBlockKey(uid, &cuid, &cascade_levels, ui64Key, blockNo, keyType, auth_timeout, debugLevel);
// can't select
if (res == 1) {
uint8_t bytes_per_key = fixed_nonce ? 5 : 6;
int res = MifareChkBlockKey(uid, &cuid, &cascade_levels, keys + i*bytes_per_key, blockNo, keyType, auth_timeout, debugLevel, fixed_nonce);
if (res == -1) { // couldn't select
retryCount++;
if (retryCount >= 5) {
Dbprintf("ChkKeys: block=%d key=%d. Can't select. Exit...", blockNo, keyType);
Dbprintf("ChkKeys: block=%d key=%d. Couldn't select. Exit...", blockNo, keyType);
return -1;
} else {
--i; // try the same key once again
SpinDelay(20);
// Dbprintf("ChkKeys: block=%d key=%d. Try the same key once again...", blockNo, keyType);
continue;
}
--i; // try the same key once again
SpinDelay(20);
// Dbprintf("ChkKeys: block=%d key=%d. Try the same key once again...", blockNo, keyType);
continue;
}
// can't authenticate
if (res == 2) {
if (res == -2) { // couldn't authenticate with this key
retryCount = 0;
continue; // can't auth. wrong key.
continue;
}
// successful authentication
return i + 1;
return i + 1; // successful authentication
}
if (BUTTON_PRESS()) {
return -2;
}
return 0;
return 0; // couldn't authenticate with any key
}
int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel) {
return MifareChkBlockKeysEx(keys, keyCount, blockNo, keyType, auth_timeout, debugLevel, false);
}
// fixed nonce check
int MifareChkBlockKeysFixedNonce(uint8_t *ar_par, uint8_t ar_par_cnt, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel) {
return MifareChkBlockKeysEx(ar_par, ar_par_cnt, blockNo, keyType, auth_timeout, debugLevel, true);
}
......
......@@ -87,7 +87,7 @@ int emlCheckValBl(int blockNum);
// mifare check keys
typedef uint8_t TKeyIndex[2][40];
int MifareChkBlockKey(uint8_t *uid, uint32_t *cuid, uint8_t *cascade_levels, uint64_t ui64Key, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel);
int MifareChkBlockKeysFixedNonce(uint8_t *ar_par, uint8_t ar_par_cnt, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel);
int MifareChkBlockKeys(uint8_t *keys, uint8_t keyCount, uint8_t blockNo, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel);
int MifareMultisectorChk(uint8_t *keys, uint8_t keyCount, uint8_t SectorCount, uint8_t keyType, uint32_t *auth_timeout, uint8_t debugLevel, TKeyIndex *keyIndex);
......
......@@ -677,7 +677,7 @@ int CmdHF14AMfNested(const char *Cmd) {
// check if we can authenticate to sector
res = mfCheckKeys(blockNo, keyType, timeout14a, true, 1, key, &key64);
if (res) {
PrintAndLog("Can't authenticate to block:%3d key type:%c key:%s", blockNo, keyType?'B':'A', sprint_hex(key, 6));
PrintAndLog("Can't authenticate to block %d, key type %c, key %s", blockNo, keyType?'B':'A', sprint_hex(key, 6));
return 3;
}
......
This diff is collapsed.
......@@ -19,6 +19,9 @@
#define MF_MAD1_SECTOR 0x00
#define MF_MAD2_SECTOR 0x10
// Fixed encrypted nonce used for nested attack with fixed nonce tags
#define NESTED_FIXED_NR_ENC {0x70, 0x69, 0x77, 0x69}
//-----------------------------------------------------------------------------
// ISO 14443A
//-----------------------------------------------------------------------------
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment