]> git.zerfleddert.de Git - proxmark3-svn/blob - client/nonce2key/nonce2key.c
chg: removed a useless clearing of key_count. From @matrix https://github.com/matrix...
[proxmark3-svn] / client / nonce2key / nonce2key.c
1 //-----------------------------------------------------------------------------
2 // Merlok - June 2011
3 // Roel - Dec 2009
4 // Unknown author
5 //
6 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
7 // at your option, any later version. See the LICENSE.txt file for the text of
8 // the license.
9 //-----------------------------------------------------------------------------
10 // MIFARE Darkside hack
11 //-----------------------------------------------------------------------------
12 #include "nonce2key.h"
13
14 int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_t ks_info, uint64_t * key) {
15 struct Crypto1State *state;
16 uint32_t i, pos, rr = 0, nr_diff;
17 byte_t bt, ks3x[8], par[8][8];
18
19 // Reset the last three significant bits of the reader nonce
20 nr &= 0xffffff1f;
21
22 PrintAndLog("uid(%08x) nt(%08x) par(%016"llx") ks(%016"llx") nr(%08x)\n", uid, nt, par_info, ks_info, nr);
23
24 for ( pos = 0; pos < 8; pos++ ) {
25 ks3x[7-pos] = (ks_info >> (pos*8)) & 0x0f;
26 bt = (par_info >> (pos*8)) & 0xff;
27
28 for ( i = 0; i < 8; i++) {
29 par[7-pos][i] = (bt >> i) & 0x01;
30 }
31 }
32
33 printf("+----+--------+---+-----+---------------+\n");
34 printf("|diff|{nr} |ks3|ks3^5|parity |\n");
35 printf("+----+--------+---+-----+---------------+\n");
36 for ( i = 0; i < 8; i++) {
37 nr_diff = nr | i << 5;
38 printf("| %02x |%08x| %01x | %01x |", i << 5, nr_diff, ks3x[i], ks3x[i]^5);
39
40 for (pos = 0; pos < 7; pos++) printf("%01x,", par[i][pos]);
41 printf("%01x|\n", par[i][7]);
42 }
43 printf("+----+--------+---+-----+---------------+\n");
44
45 clock_t t1 = clock();
46
47 state = lfsr_common_prefix(nr, rr, ks3x, par);
48 lfsr_rollback_word(state, uid ^ nt, 0);
49 crypto1_get_lfsr(state, key);
50 crypto1_destroy(state);
51
52 t1 = clock() - t1;
53 if ( t1 > 0 ) PrintAndLog("Time in nonce2key: %.0f ticks \n", (float)t1);
54 return 0;
55 }
56
57 int compar_intA(const void * a, const void * b) {
58 if (*(int64_t*)b == *(int64_t*)a) return 0;
59 if (*(int64_t*)b > *(int64_t*)a) return 1;
60 return -1;
61 }
62
63 // call when PAR == 0, special attack? It seems to need two calls. with same uid, block, keytype
64 int nonce2key_ex(uint8_t blockno, uint8_t keytype, uint32_t uid, uint32_t nt, uint32_t nr, uint64_t ks_info, uint64_t * key) {
65
66 struct Crypto1State *state;
67 uint32_t i, pos, key_count;
68 uint8_t ks3x[8];
69 uint64_t key_recovered;
70 int64_t *state_s;
71 static uint8_t last_blockno;
72 static uint8_t last_keytype;
73 static uint32_t last_uid;
74 static int64_t *last_keylist;
75
76 if (last_uid != uid &&
77 last_blockno != blockno &&
78 last_keytype != keytype &&
79 last_keylist != NULL)
80 {
81 free(last_keylist);
82 last_keylist = NULL;
83 }
84 last_uid = uid;
85 last_blockno = blockno;
86 last_keytype = keytype;
87
88 // Reset the last three significant bits of the reader nonce
89 nr &= 0xffffff1f;
90
91 // split keystream into array
92 for (pos=0; pos<8; pos++) {
93 ks3x[7-pos] = (ks_info >> (pos*8)) & 0x0f;
94 }
95
96 // find possible states for this keystream
97 state = lfsr_common_prefix_ex(nr, ks3x);
98
99 if (!state) {
100 PrintAndLog("Failed getting states");
101 return 1;
102 }
103
104 state_s = (int64_t*)state;
105
106 uint32_t xored = uid ^ nt;
107
108 for (i = 0; (state) && ((state + i)->odd != -1); i++) {
109 lfsr_rollback_word(state + i, xored, 0);
110 crypto1_get_lfsr(state + i, &key_recovered);
111 *(state_s + i) = key_recovered;
112 }
113
114 qsort(state_s, i, sizeof(int64_t), compar_intA);
115 *(state_s + i) = -1;
116
117 // first call to this function. clear all other stuff and set new found states.
118 if (last_keylist == NULL) {
119 free(last_keylist);
120 last_keylist = state_s;
121 PrintAndLog("parity is all zero, testing special attack. First call, this attack needs at least two calls. Hold on...");
122 PrintAndLog("uid(%08x) nt(%08x) ks(%016"llx") nr(%08x)\n", uid, nt, ks_info, nr);
123 return 1;
124 }
125
126 PrintAndLog("uid(%08x) nt(%08x) ks(%016"llx") nr(%08x)\n", uid, nt, ks_info, nr);
127
128 //Create the intersection:
129 int64_t *p1, *p2, *p3;
130 p1 = p3 = last_keylist;
131 p2 = state_s;
132
133 while ( *p1 != -1 && *p2 != -1 ) {
134 if (compar_intA(p1, p2) == 0) {
135 printf("p1:%"llx" p2:%"llx" p3:%"llx" key:%012"llx"\n",(uint64_t)(p1-last_keylist),(uint64_t)(p2-state_s),(uint64_t)(p3-last_keylist),*p1);
136 *p3++ = *p1++;
137 p2++;
138 }
139 else {
140 while (compar_intA(p1, p2) == -1) ++p1;
141 while (compar_intA(p1, p2) == 1) ++p2;
142 }
143 }
144 key_count = p3 - last_keylist;
145 printf("key_count: %d\n", key_count);
146 if ( key_count == 0 ){
147 free(state);
148 state = NULL;
149 return 0;
150 }
151
152 uint8_t retval = 1;
153 // Validate all key candidates with testing each of them with mfCheckKeys
154 uint8_t keyBlock[6] = {0,0,0,0,0,0};
155 uint64_t key64;
156 for (i = 0; i < key_count; i++) {
157 key64 = *(last_keylist + i);
158 num_to_bytes(key64, 6, keyBlock);
159 key64 = 0;
160 if (!mfCheckKeys(blockno, keytype, false, 1, keyBlock, &key64)) {
161 *key = key64;
162 retval = 0;
163 goto out;
164 }
165 }
166
167 out:
168 free(last_keylist);
169 last_keylist = NULL;
170 free(state);
171 state = NULL;
172 return retval;
173 }
174
175 // 32 bit recover key from 2 nonces
176 bool tryMfk32(nonces_t data, uint64_t *outputkey, bool verbose) {
177 struct Crypto1State *s,*t;
178 uint64_t outkey = 0;
179 uint64_t key=0; // recovered key
180 uint32_t uid = data.cuid;
181 uint32_t nt = data.nonce; // first tag challenge (nonce)
182 uint32_t nr0_enc = data.nr; // first encrypted reader challenge
183 uint32_t ar0_enc = data.ar; // first encrypted reader response
184 uint32_t nr1_enc = data.nr2; // second encrypted reader challenge
185 uint32_t ar1_enc = data.ar2; // second encrypted reader response
186 bool isSuccess = FALSE;
187 uint8_t counter = 0;
188
189 clock_t t1 = clock();
190 uint32_t p64 = prng_successor(nt, 64);
191
192 if ( verbose ) {
193 printf("Recovering key for:\n");
194 printf(" uid: %08x\n",uid);
195 printf(" nt: %08x\n",nt);
196 printf(" {nr_0}: %08x\n",nr0_enc);
197 printf(" {ar_0}: %08x\n",ar0_enc);
198 printf(" {nr_1}: %08x\n",nr1_enc);
199 printf(" {ar_1}: %08x\n",ar1_enc);
200 printf("\nLFSR succesors of the tag challenge:\n");
201 printf(" nt': %08x\n", p64);
202 printf(" nt'': %08x\n", prng_successor(p64, 32));
203 }
204
205 s = lfsr_recovery32(ar0_enc ^ p64, 0);
206
207 for(t = s; t->odd | t->even; ++t) {
208 lfsr_rollback_word(t, 0, 0);
209 lfsr_rollback_word(t, nr0_enc, 1);
210 lfsr_rollback_word(t, uid ^ nt, 0);
211 crypto1_get_lfsr(t, &key);
212 crypto1_word(t, uid ^ nt, 0);
213 crypto1_word(t, nr1_enc, 1);
214 if (ar1_enc == (crypto1_word(t, 0, 0) ^ p64)) {
215 outkey = key;
216 ++counter;
217 if (counter==20) break;
218 }
219 }
220 isSuccess = (counter > 0);
221 t1 = clock() - t1;
222 if ( t1 > 0 ) PrintAndLog("Time in mfkey32: %.0f ticks - possible keys %d\n", (float)t1, counter);
223
224 *outputkey = ( isSuccess ) ? outkey : 0;
225 crypto1_destroy(s);
226 return isSuccess;
227 }
228
229 bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool verbose) {
230 struct Crypto1State *s, *t;
231 uint64_t outkey = 0;
232 uint64_t key = 0; // recovered key
233 uint32_t uid = data.cuid;
234 uint32_t nt0 = data.nonce; // first tag challenge (nonce)
235 uint32_t nr0_enc = data.nr; // first encrypted reader challenge
236 uint32_t ar0_enc = data.ar; // first encrypted reader response
237 //uint32_t uid1 = le32toh(data+16);
238 uint32_t nt1 = data.nonce2; // second tag challenge (nonce)
239 uint32_t nr1_enc = data.nr2; // second encrypted reader challenge
240 uint32_t ar1_enc = data.ar2; // second encrypted reader response
241 bool isSuccess = FALSE;
242 int counter = 0;
243
244 clock_t t1 = clock();
245
246 uint32_t p640 = prng_successor(nt0, 64);
247 uint32_t p641 = prng_successor(nt1, 64);
248
249 if (verbose) {
250 printf("Recovering key for:\n");
251 printf(" uid: %08x\n", uid);
252 printf(" nt_0: %08x\n", nt0);
253 printf(" {nr_0}: %08x\n", nr0_enc);
254 printf(" {ar_0}: %08x\n", ar0_enc);
255 printf(" nt_1: %08x\n", nt1);
256 printf(" {nr_1}: %08x\n", nr1_enc);
257 printf(" {ar_1}: %08x\n", ar1_enc);
258 printf("\nLFSR succesors of the tag challenge:\n");
259 printf(" nt': %08x\n", p640);
260 printf(" nt'': %08x\n", prng_successor(p640, 32));
261 }
262
263 s = lfsr_recovery32(ar0_enc ^ p640, 0);
264
265 for(t = s; t->odd | t->even; ++t) {
266 lfsr_rollback_word(t, 0, 0);
267 lfsr_rollback_word(t, nr0_enc, 1);
268 lfsr_rollback_word(t, uid ^ nt0, 0);
269 crypto1_get_lfsr(t, &key);
270
271 crypto1_word(t, uid ^ nt1, 0);
272 crypto1_word(t, nr1_enc, 1);
273 if (ar1_enc == (crypto1_word(t, 0, 0) ^ p641)) {
274 outkey=key;
275 ++counter;
276 if (counter==20) break;
277 }
278 }
279 isSuccess = (counter > 0);
280 t1 = clock() - t1;
281 if ( t1 > 0 ) PrintAndLog("Time in mfkey32_moebius: %.0f ticks - possible keys %d\n", (float)t1, counter);
282
283 *outputkey = ( isSuccess ) ? outkey : 0;
284 crypto1_destroy(s);
285 return isSuccess;
286 }
287
288 int tryMfk64_ex(uint8_t *data, uint64_t *outputkey){
289 uint32_t uid = le32toh(data);
290 uint32_t nt = le32toh(data+4); // tag challenge
291 uint32_t nr_enc = le32toh(data+8); // encrypted reader challenge
292 uint32_t ar_enc = le32toh(data+12); // encrypted reader response
293 uint32_t at_enc = le32toh(data+16); // encrypted tag response
294 return tryMfk64(uid, nt, nr_enc, ar_enc, at_enc, outputkey);
295 }
296
297 int tryMfk64(uint32_t uid, uint32_t nt, uint32_t nr_enc, uint32_t ar_enc, uint32_t at_enc, uint64_t *outputkey){
298 uint64_t key = 0; // recovered key
299 uint32_t ks2; // keystream used to encrypt reader response
300 uint32_t ks3; // keystream used to encrypt tag response
301 struct Crypto1State *revstate;
302
303 PrintAndLog("Enter mfkey64");
304 clock_t t1 = clock();
305
306 // Extract the keystream from the messages
307 ks2 = ar_enc ^ prng_successor(nt, 64);
308 ks3 = at_enc ^ prng_successor(nt, 96);
309 revstate = lfsr_recovery64(ks2, ks3);
310 lfsr_rollback_word(revstate, 0, 0);
311 lfsr_rollback_word(revstate, 0, 0);
312 lfsr_rollback_word(revstate, nr_enc, 1);
313 lfsr_rollback_word(revstate, uid ^ nt, 0);
314 crypto1_get_lfsr(revstate, &key);
315
316 PrintAndLog("Found Key: [%012"llx"]", key);
317 t1 = clock() - t1;
318 if ( t1 > 0 ) PrintAndLog("Time in mfkey64: %.0f ticks \n", (float)t1);
319
320 *outputkey = key;
321 crypto1_destroy(revstate);
322 return 0;
323 }
Impressum, Datenschutz