RfidResearchGroup/proxmark3
1
1
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2024-09-22 00:06:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

fido U2F auth command works

Browse source
This commit is contained in:
merlokk 2021-05-28 15:19:49 +03:00
parent 08809f0c0d
commit 6ab2d98644
1 changed files with 36 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

63
client/src/cmdhffido.c
View file

@ -129,9 +129,10 @@ static int CmdHFFidoRegister(const char *cmd) {
"challenge parameter (32b) and application parameter (32b).\n"
"The output template filename is `hf-fido2-params.json`\n"
"\n",
"hf fido reg -> execute command with 2 parameters, filled 0x00\n"
"hf fido reg -> execute command with 2 parameters, filled 0x00\n"
"hf fido reg --cp s0 --ap s1 -> execute command with plain parameters\n"
"hf fido reg --cpx 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f --apx 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f\n"
"hf fido reg -f fido2-params -> execute command with custom config file\n"
);
void *argtable[] = {
@ -402,30 +403,28 @@ static int CmdHFFidoAuthenticate(const char *cmd) {
arg_param_begin,
arg_lit0("a", "apdu", "show APDU reqests and responses"),
arg_lit0("v", "verbose", "show technical data"),
arg_lit0("p", "plain", "send plain ASCII to challenge and application parameters instead of HEX"),
arg_rem("default mode:", "dont-enforce-user-presence-and-sign"),
arg_lit0("u", "user", "mode: enforce-user-presence-and-sign"),
arg_lit0("c", "check", "mode: check-only"),
arg_str0("f", "file", "<fn>", "JSON input file name for parameters"),
arg_str0("k", "key", "<hex>", "public key to verify signature"),
arg_str0(NULL, "kh", "<hex>", "key handle (var 0..255b)"),
arg_str0(NULL, "cp", "<ascii>", "challenge parameter (1..16 chars)"),
arg_str0(NULL, "ap", "<ascii>", "application parameter (1..16 chars)"),
arg_str0(NULL, "cpx", "<hex>", "challenge parameter (32 bytes hex)"),
arg_str0(NULL, "apx", "<hex>", "application parameter (32 bytes hex)"),
arg_str0(NULL, "cp", "<ascii>", "challenge parameter (1..16 chars)"),
arg_str0(NULL, "ap", "<ascii>", "application parameter (1..16 chars)"),
arg_str0(NULL, "cpx", "<hex>", "challenge parameter (32 bytes hex)"),
arg_str0(NULL, "apx", "<hex>", "application parameter (32 bytes hex)"),
arg_param_end
};
CLIExecWithReturn(ctx, cmd, argtable, true);
bool APDULogging = arg_get_lit(ctx, 1);
bool verbose = arg_get_lit(ctx, 2);
bool paramsPlain = arg_get_lit(ctx, 3);
uint8_t controlByte = 0x08;
if (arg_get_lit(ctx, 5))
if (arg_get_lit(ctx, 4))
controlByte = 0x03;
if (arg_get_lit(ctx, 6))
if (arg_get_lit(ctx, 5))
controlByte = 0x07;
uint8_t data[512] = {0};
@ -437,7 +436,7 @@ static int CmdHFFidoAuthenticate(const char *cmd) {
int fnlen = 0;
char filename[FILE_PATH_SIZE] = {0};
CLIParamStrToBuf(arg_get_str(ctx, 7), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
CLIParamStrToBuf(arg_get_str(ctx, 6), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen);
// deafault name
if (fnlen == 0) {
@ -462,7 +461,7 @@ static int CmdHFFidoAuthenticate(const char *cmd) {
public_key_loaded = (jlen > 0);
// public key
CLIGetHexWithReturn(ctx, 8, hdata, &hdatalen);
CLIGetHexWithReturn(ctx, 7, hdata, &hdatalen);
if (hdatalen && hdatalen != 65) {
PrintAndLogEx(ERR, "ERROR: public key length must be 65 bytes only.");
CLIParserFree(ctx);
@ -475,33 +474,41 @@ static int CmdHFFidoAuthenticate(const char *cmd) {
public_key_loaded = true;
}
CLIGetHexWithReturn(ctx, 9, hdata, &hdatalen);
CLIGetHexWithReturn(ctx, 8, hdata, &hdatalen);
if (hdatalen > 255) {
PrintAndLogEx(ERR, "ERROR: application parameter length must be less than 255.");
PrintAndLogEx(ERR, "ERROR: key handle length must be less than 255.");
CLIParserFree(ctx);
json_decref(root);
return PM3_EINVARG;
}
printf("-- hlen=%d\n", hdatalen);
if (hdatalen) {
keyHandleLen = hdatalen;
data[64] = keyHandleLen;
memmove(&data[65], hdata, keyHandleLen);
hdatalen = 0;
}
if (paramsPlain) {
bool cpplain = arg_get_str_len(ctx, 9);
bool applain = arg_get_str_len(ctx, 10);
bool cphex = arg_get_str_len(ctx, 11);
bool aphex = arg_get_str_len(ctx, 12);
if (cpplain) {
memset(hdata, 0x00, 32);
hdatalen = sizeof(hdata);
CLIGetStrWithReturn(ctx, 10, hdata, &hdatalen);
CLIGetStrWithReturn(ctx, 9, hdata, &hdatalen);
if (hdatalen > 16) {
PrintAndLogEx(ERR, "ERROR: challenge parameter length in ASCII mode must be less than 16 chars instead of: %d", hdatalen);
CLIParserFree(ctx);
json_decref(root);
return PM3_EINVARG;
}
} else {
}
if (cphex && cpplain == false) {
hdatalen = sizeof(hdata);
CLIGetHexWithReturn(ctx, 12, hdata, &hdatalen);
CLIGetHexWithReturn(ctx, 11, hdata, &hdatalen);
if (hdatalen && hdatalen != 32) {
PrintAndLogEx(ERR, "ERROR: challenge parameter length must be 32 bytes only.");
CLIParserFree(ctx);
@ -509,23 +516,25 @@ static int CmdHFFidoAuthenticate(const char *cmd) {
return PM3_EINVARG;
}
}
if (hdatalen)
if (hdatalen) {
memmove(data, hdata, 32);
hdatalen = 0;
}
if (paramsPlain) {
if (applain) {
memset(hdata, 0x00, 32);
hdatalen = sizeof(hdata);
CLIGetStrWithReturn(ctx, 11, hdata, &hdatalen);
CLIGetStrWithReturn(ctx, 10, hdata, &hdatalen);
if (hdatalen > 16) {
PrintAndLogEx(ERR, "ERROR: application parameter length in ASCII mode must be less than 16 chars instead of: %d", hdatalen);
CLIParserFree(ctx);
json_decref(root);
return PM3_EINVARG;
}
} else {
}
if (aphex && applain == false) {
hdatalen = sizeof(hdata);
CLIGetHexWithReturn(ctx, 13, hdata, &hdatalen);
CLIGetHexWithReturn(ctx, 12, hdata, &hdatalen);
if (hdatalen && hdatalen != 32) {
PrintAndLogEx(ERR, "ERROR: application parameter length must be 32 bytes only.");
CLIParserFree(ctx);
@ -533,9 +542,10 @@ static int CmdHFFidoAuthenticate(const char *cmd) {
return PM3_EINVARG;
}
}
if (hdatalen)
if (hdatalen) {
memmove(&data[32], hdata, 32);
hdatalen = 0;
}
CLIParserFree(ctx);
@ -612,7 +622,7 @@ static int CmdHFFidoAuthenticate(const char *cmd) {
res = ecdsa_signature_verify(MBEDTLS_ECP_DP_SECP256R1, public_key, xbuf, xbuflen, &buf[5], len - 5, true);
if (res) {
if (res == MBEDTLS_ERR_ECP_VERIFY_FAILED) {
PrintAndLogEx(WARNING, "Signature is" _RED_("NOT VALID."));
PrintAndLogEx(WARNING, "Signature is ( " _RED_("not valid") " )");
} else {
PrintAndLogEx(WARNING, "Other signature check error: %x %s", (res < 0) ? -res : res, ecdsa_get_error(res));
}
@ -633,7 +643,6 @@ static int CmdHFFidoAuthenticate(const char *cmd) {
JsonSaveBufAsHexCompact(root, "KeyHandle", &data[65], keyHandleLen);
JsonSaveInt(root, "Counter", cntr);
sprintf(filename, "hf-fido2-params");
res = saveFileJSONrootEx(filename, root, JSON_INDENT(2), verbose, true);
(void)res;
}