//----------------------------------------------------------------------------- // Borrowed initially from https://github.com/holiman/loclass // Copyright (C) 2014 Martin Holst Swende // Copyright (C) Proxmark3 contributors. See AUTHORS.md for details. // // This program is free software: you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by // the Free Software Foundation, either version 3 of the License, or // (at your option) any later version. // // This program is distributed in the hope that it will be useful, // but WITHOUT ANY WARRANTY; without even the implied warranty of // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the // GNU General Public License for more details. // // See LICENSE.txt for the text of the license. //----------------------------------------------------------------------------- // WARNING // // THIS CODE IS CREATED FOR EXPERIMENTATION AND EDUCATIONAL USE ONLY. // // USAGE OF THIS CODE IN OTHER WAYS MAY INFRINGE UPON THE INTELLECTUAL // PROPERTY OF OTHER PARTIES, SUCH AS INSIDE SECURE AND HID GLOBAL, // AND MAY EXPOSE YOU TO AN INFRINGEMENT ACTION FROM THOSE PARTIES. // // THIS CODE SHOULD NEVER BE USED TO INFRINGE PATENTS OR INTELLECTUAL PROPERTY RIGHTS. //----------------------------------------------------------------------------- // It is a reconstruction of the cipher engine used in iClass, and RFID techology. // // The implementation is based on the work performed by // Flavio D. Garcia, Gerhard de Koning Gans, Roel Verdult and // Milosch Meriac in the paper "Dismantling IClass". //----------------------------------------------------------------------------- /** From "Dismantling iclass": This section describes in detail the built-in key diversification algorithm of iClass. Besides the obvious purpose of deriving a card key from a master key, this algorithm intends to circumvent weaknesses in the cipher by preventing the usage of certain ‘weak’ keys. In order to compute a diversified key, the iClass reader first encrypts the card identity id with the master key K, using single DES. The resulting ciphertext is then input to a function called loclass_hash0 which outputs the diversified key k. k = loclass_hash0(DES enc (id, K)) Here the DES encryption of id with master key K outputs a cryptogram c of 64 bits. These 64 bits are divided as c = x, y, z [0] , . . . , z [7] ∈ F 82 × F 82 × (F 62 ) 8 which is used as input to the loclass_hash0 function. This function introduces some obfuscation by performing a number of permutations, complement and modulo operations, see Figure 2.5. Besides that, it checks for and removes patterns like similar key bytes, which could produce a strong bias in the cipher. Finally, the output of loclass_hash0 is the diversified card key k = k [0] , . . . , k [7] ∈ (F 82 ) 8 . **/ #include "optimized_ikeys.h" #include #include #include #include #include "optimized_cipherutils.h" static const uint8_t loclass_pi[35] = { 0x0F, 0x17, 0x1B, 0x1D, 0x1E, 0x27, 0x2B, 0x2D, 0x2E, 0x33, 0x35, 0x39, 0x36, 0x3A, 0x3C, 0x47, 0x4B, 0x4D, 0x4E, 0x53, 0x55, 0x56, 0x59, 0x5A, 0x5C, 0x63, 0x65, 0x66, 0x69, 0x6A, 0x6C, 0x71, 0x72, 0x74, 0x78 }; /** * @brief The key diversification algorithm uses 6-bit bytes. * This implementation uses 64 bit uint to pack seven of them into one * variable. When they are there, they are placed as follows: * XXXX XXXX N0 .... N7, occupying the last 48 bits. * * This function picks out one from such a collection * @param all * @param n bitnumber * @return */ static uint8_t loclass_getSixBitByte(uint64_t c, int n) { return (c >> (42 - 6 * n)) & 0x3F; } /** * @brief Puts back a six-bit 'byte' into a uint64_t. * @param c buffer * @param z the value to place there * @param n bitnumber. */ static void loclass_pushbackSixBitByte(uint64_t *c, uint8_t z, int n) { //0x XXXX YYYY ZZZZ ZZZZ ZZZZ // ^z0 ^z7 //z0: 1111 1100 0000 0000 uint64_t masked = z & 0x3F; uint64_t eraser = 0x3F; masked <<= 42 - 6 * n; eraser <<= 42 - 6 * n; //masked <<= 6*n; //eraser <<= 6*n; eraser = ~eraser; (*c) &= eraser; (*c) |= masked; } /** * @brief Swaps the z-values. * If the input value has format XYZ0Z1...Z7, the output will have the format * XYZ7Z6...Z0 instead * @param c * @return */ static uint64_t loclass_swapZvalues(uint64_t c) { uint64_t newz = 0; loclass_pushbackSixBitByte(&newz, loclass_getSixBitByte(c, 0), 7); loclass_pushbackSixBitByte(&newz, loclass_getSixBitByte(c, 1), 6); loclass_pushbackSixBitByte(&newz, loclass_getSixBitByte(c, 2), 5); loclass_pushbackSixBitByte(&newz, loclass_getSixBitByte(c, 3), 4); loclass_pushbackSixBitByte(&newz, loclass_getSixBitByte(c, 4), 3); loclass_pushbackSixBitByte(&newz, loclass_getSixBitByte(c, 5), 2); loclass_pushbackSixBitByte(&newz, loclass_getSixBitByte(c, 6), 1); loclass_pushbackSixBitByte(&newz, loclass_getSixBitByte(c, 7), 0); newz |= (c & 0xFFFF000000000000); return newz; } /** * @return 4 six-bit bytes chunked into a uint64_t,as 00..00a0a1a2a3 */ static uint64_t loclass_ck(int i, int j, uint64_t z) { if (i == 1 && j == -1) { // loclass_ck(1, −1, z [0] . . . z [3] ) = z [0] . . . z [3] return z; } else if (j == -1) { // loclass_ck(i, −1, z [0] . . . z [3] ) = loclass_ck(i − 1, i − 2, z [0] . . . z [3] ) return loclass_ck(i - 1, i - 2, z); } if (loclass_getSixBitByte(z, i) == loclass_getSixBitByte(z, j)) { //loclass_ck(i, j − 1, z [0] . . . z [i] ← j . . . z [3] ) uint64_t newz = 0; int c; for (c = 0; c < 4; c++) { uint8_t val = loclass_getSixBitByte(z, c); if (c == i) loclass_pushbackSixBitByte(&newz, j, c); else loclass_pushbackSixBitByte(&newz, val, c); } return loclass_ck(i, j - 1, newz); } else { return loclass_ck(i, j - 1, z); } } /** Definition 8. Let the function check : (F 62 ) 8 → (F 62 ) 8 be defined as check(z [0] . . . z [7] ) = loclass_ck(3, 2, z [0] . . . z [3] ) · loclass_ck(3, 2, z [4] . . . z [7] ) where loclass_ck : N × N × (F 62 ) 4 → (F 62 ) 4 is defined as loclass_ck(1, −1, z [0] . . . z [3] ) = z [0] . . . z [3] loclass_ck(i, −1, z [0] . . . z [3] ) = loclass_ck(i − 1, i − 2, z [0] . . . z [3] ) loclass_ck(i, j, z [0] . . . z [3] ) = loclass_ck(i, j − 1, z [0] . . . z [i] ← j . . . z [3] ), if z [i] = z [j] ; loclass_ck(i, j − 1, z [0] . . . z [3] ), otherwise otherwise. **/ static uint64_t loclass_check(uint64_t z) { //These 64 bits are divided as c = x, y, z [0] , . . . , z [7] // loclass_ck(3, 2, z [0] . . . z [3] ) uint64_t ck1 = loclass_ck(3, 2, z); // loclass_ck(3, 2, z [4] . . . z [7] ) uint64_t ck2 = loclass_ck(3, 2, z << 24); //The loclass_ck function will place the values // in the middle of z. ck1 &= 0x00000000FFFFFF000000; ck2 &= 0x00000000FFFFFF000000; return ck1 | ck2 >> 24; } static void loclass_permute(LoclassBitstreamIn_t *p_in, uint64_t z, int l, int r, LoclassBitstreamOut_t *out) { if (loclass_bitsLeft(p_in) == 0) return; bool pn = loclass_tailBit(p_in); if (pn) { // pn = 1 uint8_t zl = loclass_getSixBitByte(z, l); loclass_push6bits(out, zl + 1); loclass_permute(p_in, z, l + 1, r, out); } else { // otherwise uint8_t zr = loclass_getSixBitByte(z, r); loclass_push6bits(out, zr); loclass_permute(p_in, z, l, r + 1, out); } } /** * @brief *Definition 11. Let the function loclass_hash0 : F 82 × F 82 × (F 62 ) 8 → (F 82 ) 8 be defined as * loclass_hash0(x, y, z [0] . . . z [7] ) = k [0] . . . k [7] where * z'[i] = (z[i] mod (63-i)) + i i = 0...3 * z'[i+4] = (z[i+4] mod (64-i)) + i i = 0...3 * ẑ = check(z'); * @param c * @param k this is where the diversified key is put (should be 8 bytes) * @return */ void loclass_hash0(uint64_t c, uint8_t k[8]) { c = loclass_swapZvalues(c); //These 64 bits are divided as c = x, y, z [0] , . . . , z [7] // x = 8 bits // y = 8 bits // z0-z7 6 bits each : 48 bits uint8_t x = (c & 0xFF00000000000000) >> 56; uint8_t y = (c & 0x00FF000000000000) >> 48; uint64_t zP = 0; for (int n = 0; n < 4 ; n++) { uint8_t zn = loclass_getSixBitByte(c, n); uint8_t zn4 = loclass_getSixBitByte(c, n + 4); uint8_t _zn = (zn % (63 - n)) + n; uint8_t _zn4 = (zn4 % (64 - n)) + n; loclass_pushbackSixBitByte(&zP, _zn, n); loclass_pushbackSixBitByte(&zP, _zn4, n + 4); } uint64_t zCaret = loclass_check(zP); uint8_t p = loclass_pi[x % 35]; if (x & 1) //Check if x7 is 1 p = ~p; LoclassBitstreamIn_t p_in = { &p, 8, 0 }; uint8_t outbuffer[] = {0, 0, 0, 0, 0, 0, 0, 0}; LoclassBitstreamOut_t out = {outbuffer, 0, 0}; loclass_permute(&p_in, zCaret, 0, 4, &out); //returns 48 bits? or 6 8-bytes //Out is now a buffer containing six-bit bytes, should be 48 bits // if all went well //Shift z-values down onto the lower segment uint64_t zTilde = loclass_x_bytes_to_num(outbuffer, sizeof(outbuffer)); zTilde >>= 16; for (int i = 0; i < 8; i++) { // the key on index i is first a bit from y // then six bits from z, // then a bit from p // Init with zeroes k[i] = 0; // First, place yi leftmost in k //k[i] |= (y << i) & 0x80 ; // First, place y(7-i) leftmost in k k[i] |= (y << (7 - i)) & 0x80 ; uint8_t zTilde_i = loclass_getSixBitByte(zTilde, i); // zTildeI is now on the form 00XXXXXX // with one leftshift, it'll be // 0XXXXXX0 // So after leftshift, we can OR it into k // However, when doing complement, we need to // again MASK 0XXXXXX0 (0x7E) zTilde_i <<= 1; //Finally, add bit from p or p-mod //Shift bit i into rightmost location (mask only after complement) uint8_t p_i = p >> i & 0x1; if (k[i]) { // yi = 1 k[i] |= ~zTilde_i & 0x7E; k[i] |= p_i & 1; k[i] += 1; } else { // otherwise k[i] |= zTilde_i & 0x7E; k[i] |= (~p_i) & 1; } } } /** * @brief Performs Elite-class key diversification * @param csn * @param key * @param div_key */ void loclass_diversifyKey(uint8_t *csn, const uint8_t *key, uint8_t *div_key) { mbedtls_des_context loclass_ctx_enc; // Prepare the DES key mbedtls_des_setkey_enc(&loclass_ctx_enc, key); uint8_t crypted_csn[8] = {0}; // Calculate DES(CSN, KEY) mbedtls_des_crypt_ecb(&loclass_ctx_enc, csn, crypted_csn); //Calculate HASH0(DES)) uint64_t c_csn = loclass_x_bytes_to_num(crypted_csn, sizeof(crypted_csn)); loclass_hash0(c_csn, div_key); }