mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2024-12-27 10:34:08 +08:00
CHG: Syncronized so all different parts uses the same implementation of Crapto1 v3.3
This commit is contained in:
iceman1001
parent
1a4b67382a
commit
8130eba4d1
11 changed files with 41 additions and 48 deletions
|
|
@ -15,7 +15,7 @@
|
|||
Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||
Boston, MA 02110-1301, US$
|
||||
|
||||
Copyright (C) 2008-2008 bla <blapost@gmail.com>
|
||||
Copyright (C) 2008-2014 bla <blapost@gmail.com>
|
||||
*/
|
||||
#include "crapto1.h"
|
||||
#include <stdlib.h>
|
||||
|
|
@ -85,7 +85,8 @@ update_contribution(uint32_t *item, const uint32_t mask1, const uint32_t mask2)
|
|||
/** extend_table
|
||||
* using a bit of the keystream extend the table of possible lfsr states
|
||||
*/
|
||||
static inline void extend_table(uint32_t *tbl, uint32_t **end, int bit, int m1, int m2, uint32_t in)
|
||||
static inline void
|
||||
extend_table(uint32_t *tbl, uint32_t **end, int bit, int m1, int m2, uint32_t in)
|
||||
{
|
||||
in <<= 24;
|
||||
for(*tbl <<= 1; tbl <= *end; *++tbl <<= 1)
|
||||
|
|
@ -183,6 +184,7 @@ struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in)
|
|||
uint32_t *even_head = 0, *even_tail = 0, eks = 0;
|
||||
int i;
|
||||
|
||||
// split the keystream into an odd and even part
|
||||
for(i = 31; i >= 0; i -= 2)
|
||||
oks = oks << 1 | BEBIT(ks2, i);
|
||||
for(i = 30; i >= 0; i -= 2)
|
||||
|
|
@ -199,6 +201,7 @@ struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in)
|
|||
|
||||
statelist->odd = statelist->even = 0;
|
||||
|
||||
// initialize statelists: add all possible states which would result into the rightmost 2 bits of the keystream
|
||||
for(i = 1 << 20; i >= 0; --i) {
|
||||
if(filter(i) == (oks & 1))
|
||||
*++odd_tail = i;
|
||||
|
|
@ -206,11 +209,15 @@ struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in)
|
|||
*++even_tail = i;
|
||||
}
|
||||
|
||||
// extend the statelists. Look at the next 8 Bits of the keystream (4 Bit each odd and even):
|
||||
for(i = 0; i < 4; i++) {
|
||||
extend_table_simple(odd_head, &odd_tail, (oks >>= 1) & 1);
|
||||
extend_table_simple(even_head, &even_tail, (eks >>= 1) & 1);
|
||||
}
|
||||
|
||||
// the statelists now contain all states which could have generated the last 10 Bits of the keystream.
|
||||
// 22 bits to go to recover 32 bits in total. From now on, we need to take the "in"
|
||||
// parameter into account.
|
||||
in = (in >> 16 & 0xff) | (in << 16) | (in & 0xff00);
|
||||
recover(odd_head, odd_tail, oks,
|
||||
even_head, even_tail, eks, 11, statelist, in << 1);
|
||||
|
|
@ -439,16 +446,14 @@ static uint32_t fastfwd[2][8] = {
|
|||
* encrypt the NACK which is observed when varying only the 3 last bits of Nr
|
||||
* only correct iff [NR_3] ^ NR_3 does not depend on Nr_3
|
||||
*/
|
||||
// TO VERIFY
|
||||
uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd)
|
||||
{
|
||||
uint32_t *candidates = malloc(4 << 10);
|
||||
if(!candidates) return 0;
|
||||
|
||||
uint32_t c, entry;
|
||||
int size = 0, i, good;
|
||||
|
||||
if(!candidates)
|
||||
return 0;
|
||||
|
||||
for(i = 0; i < 1 << 21; ++i) {
|
||||
for(c = 0, good = 1; good && c < 8; ++c) {
|
||||
entry = i ^ fastfwd[isodd][c];
|
||||
|
|
@ -467,9 +472,7 @@ uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd)
|
|||
/** check_pfx_parity
|
||||
* helper function which eliminates possible secret states using parity bits
|
||||
*/
|
||||
static struct Crypto1State*
|
||||
check_pfx_parity(uint32_t prefix, uint32_t rresp, uint8_t parities[8][8],
|
||||
uint32_t odd, uint32_t even, struct Crypto1State* sl)
|
||||
static struct Crypto1State* check_pfx_parity(uint32_t prefix, uint32_t rresp, uint8_t parities[8][8], uint32_t odd, uint32_t even, struct Crypto1State* sl)
|
||||
{
|
||||
uint32_t ks1, nr, ks2, rr, ks3, c, good = 1;
|
||||
|
||||
|
|
@ -497,7 +500,6 @@ check_pfx_parity(uint32_t prefix, uint32_t rresp, uint8_t parities[8][8],
|
|||
return sl + good;
|
||||
}
|
||||
|
||||
|
||||
/** lfsr_common_prefix
|
||||
* Implentation of the common prefix attack.
|
||||
* Requires the 28 bit constant prefix used as reader nonce (pfx)
|
||||
|
|
@ -507,8 +509,8 @@ check_pfx_parity(uint32_t prefix, uint32_t rresp, uint8_t parities[8][8],
|
|||
* It returns a zero terminated list of possible cipher states after the
|
||||
* tag nonce was fed in
|
||||
*/
|
||||
struct Crypto1State*
|
||||
lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8])
|
||||
|
||||
struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8])
|
||||
{
|
||||
struct Crypto1State *statelist, *s;
|
||||
uint32_t *odd, *even, *o, *e, top;
|
||||
|
|
@ -516,7 +518,7 @@ lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8])
|
|||
odd = lfsr_prefix_ks(ks, 1);
|
||||
even = lfsr_prefix_ks(ks, 0);
|
||||
|
||||
s = statelist = malloc((sizeof *statelist) << 20);
|
||||
s = statelist = malloc((sizeof *statelist) << 21);
|
||||
if(!s || !odd || !even) {
|
||||
free(statelist);
|
||||
free(odd);
|
||||
|
|
@ -536,6 +538,5 @@ lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8])
|
|||
|
||||
free(odd);
|
||||
free(even);
|
||||
|
||||
return statelist;
|
||||
}
|
||||
}
|
||||
|
|
@ -36,8 +36,7 @@ uint32_t prng_successor(uint32_t x, uint32_t n);
|
|||
struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in);
|
||||
struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3);
|
||||
uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd);
|
||||
struct Crypto1State*
|
||||
lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8]);
|
||||
struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8]);
|
||||
|
||||
uint8_t lfsr_rollback_bit(struct Crypto1State* s, uint32_t in, int fb);
|
||||
uint8_t lfsr_rollback_byte(struct Crypto1State* s, uint32_t in, int fb);
|
||||
|
|
@ -69,7 +68,7 @@ static inline int parity(uint32_t x)
|
|||
x ^= x >> 4;
|
||||
return BIT(0x6996, x & 0xf);
|
||||
#else
|
||||
asm( "movl %1, %%eax\n"
|
||||
__asm__( "movl %1, %%eax\n"
|
||||
"mov %%ax, %%cx\n"
|
||||
"shrl $0x10, %%eax\n"
|
||||
"xor %%ax, %%cx\n"
|
||||
|
|
|
|||
|
|
@ -520,7 +520,7 @@ struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8]
|
|||
odd = lfsr_prefix_ks(ks, 1);
|
||||
even = lfsr_prefix_ks(ks, 0);
|
||||
|
||||
s = statelist = malloc((sizeof *statelist) << 20);
|
||||
s = statelist = malloc((sizeof *statelist) << 21);
|
||||
if(!s || !odd || !even) {
|
||||
free(statelist);
|
||||
free(odd);
|
||||
|
|
|
|||
|
|
@ -37,7 +37,6 @@ struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in);
|
|||
struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3);
|
||||
uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd);
|
||||
struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8]);
|
||||
struct Crypto1State* lfsr_common_prefix_ex(uint32_t pfx, uint8_t ks[8], uint8_t par[8][8]);
|
||||
|
||||
uint8_t lfsr_rollback_bit(struct Crypto1State* s, uint32_t in, int fb);
|
||||
uint8_t lfsr_rollback_byte(struct Crypto1State* s, uint32_t in, int fb);
|
||||
|
|
@ -69,7 +68,7 @@ static inline int parity(uint32_t x)
|
|||
x ^= x >> 4;
|
||||
return BIT(0x6996, x & 0xf);
|
||||
#else
|
||||
__asm__( "movl %1, %%eax\n"
|
||||
__asm__( "movl %1, %%eax\n"
|
||||
"mov %%ax, %%cx\n"
|
||||
"shrl $0x10, %%eax\n"
|
||||
"xor %%ax, %%cx\n"
|
||||
|
|
|
|||
|
|
@ -59,6 +59,7 @@ int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_
|
|||
state = lfsr_common_prefix(nr, rr, ks3x, par);
|
||||
lfsr_rollback_word(state, uid^nt, 0);
|
||||
crypto1_get_lfsr(state, key);
|
||||
printf("\nkey recovered: %012"llx"\n\n",key);
|
||||
crypto1_destroy(state);
|
||||
return 0;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -349,7 +349,7 @@ uint8_t lfsr_rollback_byte(struct Crypto1State *s, uint32_t in, int fb)
|
|||
for (i = 7; i >= 0; --i)
|
||||
ret |= lfsr_rollback_bit(s, BIT(in, i), fb) << i;
|
||||
*/
|
||||
|
||||
// unfold loop 20160112
|
||||
uint8_t ret = 0;
|
||||
ret |= lfsr_rollback_bit(s, BIT(in, 7), fb) << 7;
|
||||
ret |= lfsr_rollback_bit(s, BIT(in, 6), fb) << 6;
|
||||
|
|
@ -372,7 +372,7 @@ uint32_t lfsr_rollback_word(struct Crypto1State *s, uint32_t in, int fb)
|
|||
for (i = 31; i >= 0; --i)
|
||||
ret |= lfsr_rollback_bit(s, BEBIT(in, i), fb) << (i ^ 24);
|
||||
*/
|
||||
|
||||
// unfold loop 20160112
|
||||
uint32_t ret = 0;
|
||||
ret |= lfsr_rollback_bit(s, BEBIT(in, 31), fb) << (31 ^ 24);
|
||||
ret |= lfsr_rollback_bit(s, BEBIT(in, 30), fb) << (30 ^ 24);
|
||||
|
|
@ -409,7 +409,6 @@ uint32_t lfsr_rollback_word(struct Crypto1State *s, uint32_t in, int fb)
|
|||
ret |= lfsr_rollback_bit(s, BEBIT(in, 2), fb) << (2 ^ 24);
|
||||
ret |= lfsr_rollback_bit(s, BEBIT(in, 1), fb) << (1 ^ 24);
|
||||
ret |= lfsr_rollback_bit(s, BEBIT(in, 0), fb) << (0 ^ 24);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
|
@ -450,12 +449,11 @@ static uint32_t fastfwd[2][8] = {
|
|||
uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd)
|
||||
{
|
||||
uint32_t *candidates = malloc(4 << 10);
|
||||
if(!candidates) return 0;
|
||||
|
||||
uint32_t c, entry;
|
||||
int size = 0, i, good;
|
||||
|
||||
if(!candidates)
|
||||
return 0;
|
||||
|
||||
for(i = 0; i < 1 << 21; ++i) {
|
||||
for(c = 0, good = 1; good && c < 8; ++c) {
|
||||
entry = i ^ fastfwd[isodd][c];
|
||||
|
|
@ -502,7 +500,6 @@ static struct Crypto1State* check_pfx_parity(uint32_t prefix, uint32_t rresp, ui
|
|||
return sl + good;
|
||||
}
|
||||
|
||||
|
||||
/** lfsr_common_prefix
|
||||
* Implentation of the common prefix attack.
|
||||
* Requires the 28 bit constant prefix used as reader nonce (pfx)
|
||||
|
|
@ -512,6 +509,7 @@ static struct Crypto1State* check_pfx_parity(uint32_t prefix, uint32_t rresp, ui
|
|||
* It returns a zero terminated list of possible cipher states after the
|
||||
* tag nonce was fed in
|
||||
*/
|
||||
|
||||
struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8])
|
||||
{
|
||||
struct Crypto1State *statelist, *s;
|
||||
|
|
@ -520,7 +518,7 @@ struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8]
|
|||
odd = lfsr_prefix_ks(ks, 1);
|
||||
even = lfsr_prefix_ks(ks, 0);
|
||||
|
||||
s = statelist = malloc((sizeof *statelist) << 20);
|
||||
s = statelist = malloc((sizeof *statelist) << 21);
|
||||
if(!s || !odd || !even) {
|
||||
free(statelist);
|
||||
free(odd);
|
||||
|
|
@ -540,6 +538,5 @@ struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8]
|
|||
|
||||
free(odd);
|
||||
free(even);
|
||||
|
||||
return statelist;
|
||||
}
|
||||
}
|
||||
|
|
@ -36,8 +36,7 @@ uint32_t prng_successor(uint32_t x, uint32_t n);
|
|||
struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in);
|
||||
struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3);
|
||||
uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd);
|
||||
struct Crypto1State*
|
||||
lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8]);
|
||||
struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8]);
|
||||
|
||||
uint8_t lfsr_rollback_bit(struct Crypto1State* s, uint32_t in, int fb);
|
||||
uint8_t lfsr_rollback_byte(struct Crypto1State* s, uint32_t in, int fb);
|
||||
|
|
|
|||
|
|
@ -69,7 +69,7 @@ uint8_t crypto1_byte(struct Crypto1State *s, uint8_t in, int is_encrypted)
|
|||
for (i = 0; i < 8; ++i)
|
||||
ret |= crypto1_bit(s, BIT(in, i), is_encrypted) << i;
|
||||
*/
|
||||
// unfold loop
|
||||
// unfold loop 20161012
|
||||
uint8_t ret = 0;
|
||||
ret |= crypto1_bit(s, BIT(in, 0), is_encrypted) << 0;
|
||||
ret |= crypto1_bit(s, BIT(in, 1), is_encrypted) << 1;
|
||||
|
|
@ -89,6 +89,7 @@ uint32_t crypto1_word(struct Crypto1State *s, uint32_t in, int is_encrypted)
|
|||
for (i = 0; i < 32; ++i)
|
||||
ret |= crypto1_bit(s, BEBIT(in, i), is_encrypted) << (i ^ 24);
|
||||
*/
|
||||
//unfold loop 2016012
|
||||
uint32_t ret = 0;
|
||||
ret |= crypto1_bit(s, BEBIT(in, 0), is_encrypted) << (0 ^ 24);
|
||||
ret |= crypto1_bit(s, BEBIT(in, 1), is_encrypted) << (1 ^ 24);
|
||||
|
|
|
|||
|
|
@ -349,7 +349,7 @@ uint8_t lfsr_rollback_byte(struct Crypto1State *s, uint32_t in, int fb)
|
|||
for (i = 7; i >= 0; --i)
|
||||
ret |= lfsr_rollback_bit(s, BIT(in, i), fb) << i;
|
||||
*/
|
||||
|
||||
// unfold loop 20160112
|
||||
uint8_t ret = 0;
|
||||
ret |= lfsr_rollback_bit(s, BIT(in, 7), fb) << 7;
|
||||
ret |= lfsr_rollback_bit(s, BIT(in, 6), fb) << 6;
|
||||
|
|
@ -372,7 +372,7 @@ uint32_t lfsr_rollback_word(struct Crypto1State *s, uint32_t in, int fb)
|
|||
for (i = 31; i >= 0; --i)
|
||||
ret |= lfsr_rollback_bit(s, BEBIT(in, i), fb) << (i ^ 24);
|
||||
*/
|
||||
|
||||
// unfold loop 20160112
|
||||
uint32_t ret = 0;
|
||||
ret |= lfsr_rollback_bit(s, BEBIT(in, 31), fb) << (31 ^ 24);
|
||||
ret |= lfsr_rollback_bit(s, BEBIT(in, 30), fb) << (30 ^ 24);
|
||||
|
|
@ -409,7 +409,6 @@ uint32_t lfsr_rollback_word(struct Crypto1State *s, uint32_t in, int fb)
|
|||
ret |= lfsr_rollback_bit(s, BEBIT(in, 2), fb) << (2 ^ 24);
|
||||
ret |= lfsr_rollback_bit(s, BEBIT(in, 1), fb) << (1 ^ 24);
|
||||
ret |= lfsr_rollback_bit(s, BEBIT(in, 0), fb) << (0 ^ 24);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
|
@ -450,12 +449,11 @@ static uint32_t fastfwd[2][8] = {
|
|||
uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd)
|
||||
{
|
||||
uint32_t *candidates = malloc(4 << 10);
|
||||
if(!candidates) return 0;
|
||||
|
||||
uint32_t c, entry;
|
||||
int size = 0, i, good;
|
||||
|
||||
if(!candidates)
|
||||
return 0;
|
||||
|
||||
for(i = 0; i < 1 << 21; ++i) {
|
||||
for(c = 0, good = 1; good && c < 8; ++c) {
|
||||
entry = i ^ fastfwd[isodd][c];
|
||||
|
|
@ -502,7 +500,6 @@ static struct Crypto1State* check_pfx_parity(uint32_t prefix, uint32_t rresp, ui
|
|||
return sl + good;
|
||||
}
|
||||
|
||||
|
||||
/** lfsr_common_prefix
|
||||
* Implentation of the common prefix attack.
|
||||
* Requires the 28 bit constant prefix used as reader nonce (pfx)
|
||||
|
|
@ -512,6 +509,7 @@ static struct Crypto1State* check_pfx_parity(uint32_t prefix, uint32_t rresp, ui
|
|||
* It returns a zero terminated list of possible cipher states after the
|
||||
* tag nonce was fed in
|
||||
*/
|
||||
|
||||
struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8])
|
||||
{
|
||||
struct Crypto1State *statelist, *s;
|
||||
|
|
@ -520,7 +518,7 @@ struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8]
|
|||
odd = lfsr_prefix_ks(ks, 1);
|
||||
even = lfsr_prefix_ks(ks, 0);
|
||||
|
||||
s = statelist = malloc((sizeof *statelist) << 20);
|
||||
s = statelist = malloc((sizeof *statelist) << 21);
|
||||
if(!s || !odd || !even) {
|
||||
free(statelist);
|
||||
free(odd);
|
||||
|
|
@ -540,6 +538,5 @@ struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8]
|
|||
|
||||
free(odd);
|
||||
free(even);
|
||||
|
||||
return statelist;
|
||||
}
|
||||
}
|
||||
|
|
@ -37,8 +37,6 @@ struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in);
|
|||
struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3);
|
||||
uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd);
|
||||
struct Crypto1State* lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8]);
|
||||
struct Crypto1State* lfsr_common_prefix_ex(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8]);
|
||||
|
||||
|
||||
uint8_t lfsr_rollback_bit(struct Crypto1State* s, uint32_t in, int fb);
|
||||
uint8_t lfsr_rollback_byte(struct Crypto1State* s, uint32_t in, int fb);
|
||||
|
|
@ -70,7 +68,7 @@ static inline int parity(uint32_t x)
|
|||
x ^= x >> 4;
|
||||
return BIT(0x6996, x & 0xf);
|
||||
#else
|
||||
__asm__( "movl %1, %%eax\n"
|
||||
__asm__( "movl %1, %%eax\n"
|
||||
"mov %%ax, %%cx\n"
|
||||
"shrl $0x10, %%eax\n"
|
||||
"xor %%ax, %%cx\n"
|
||||
|
|
|
|||
|
|
@ -69,7 +69,7 @@ uint8_t crypto1_byte(struct Crypto1State *s, uint8_t in, int is_encrypted)
|
|||
for (i = 0; i < 8; ++i)
|
||||
ret |= crypto1_bit(s, BIT(in, i), is_encrypted) << i;
|
||||
*/
|
||||
// unfold loop
|
||||
// unfold loop 20161012
|
||||
uint8_t ret = 0;
|
||||
ret |= crypto1_bit(s, BIT(in, 0), is_encrypted) << 0;
|
||||
ret |= crypto1_bit(s, BIT(in, 1), is_encrypted) << 1;
|
||||
|
|
@ -89,6 +89,7 @@ uint32_t crypto1_word(struct Crypto1State *s, uint32_t in, int is_encrypted)
|
|||
for (i = 0; i < 32; ++i)
|
||||
ret |= crypto1_bit(s, BEBIT(in, i), is_encrypted) << (i ^ 24);
|
||||
*/
|
||||
//unfold loop 2016012
|
||||
uint32_t ret = 0;
|
||||
ret |= crypto1_bit(s, BEBIT(in, 0), is_encrypted) << (0 ^ 24);
|
||||
ret |= crypto1_bit(s, BEBIT(in, 1), is_encrypted) << (1 ^ 24);
|
||||
|
|
|
|||
Loading…
Reference in a new issue