3 This program is free software; you can redistribute it and/or
4 modify it under the terms of the GNU General Public License
5 as published by the Free Software Foundation; either version 2
6 of the License, or (at your option) any later version.
8 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
13 You should have received a copy of the GNU General Public License
14 along with this program; if not, write to the Free Software
15 Foundation, Inc., 51 Franklin Street, Fifth Floor,
16 Boston, MA 02110-1301, US$
18 Copyright (C) 2008-2014 bla <blapost@gmail.com>
25 #if !defined LOWMEM && defined __GNUC__
26 static uint8_t filterlut
[1 << 20];
27 static void __attribute__((constructor
)) fill_lut()
30 for(i
= 0; i
< 1 << 20; ++i
)
31 filterlut
[i
] = filter(i
);
33 #define filter(x) (filterlut[(x) & 0xfffff])
38 typedef struct bucket
{
43 typedef bucket_t bucket_array_t
[2][0x100];
45 typedef struct bucket_info
{
47 uint32_t *head
, *tail
;
48 } bucket_info
[2][0x100];
53 static void bucket_sort_intersect(uint32_t* const estart
, uint32_t* const estop
,
54 uint32_t* const ostart
, uint32_t* const ostop
,
55 bucket_info_t
*bucket_info
, bucket_array_t bucket
)
66 // init buckets to be empty
67 for (uint32_t i
= 0; i
< 2; i
++) {
68 for (uint32_t j
= 0x00; j
<= 0xff; j
++) {
69 bucket
[i
][j
].bp
= bucket
[i
][j
].head
;
73 // sort the lists into the buckets based on the MSB (contribution bits)
74 for (uint32_t i
= 0; i
< 2; i
++) {
75 for (p1
= start
[i
]; p1
<= stop
[i
]; p1
++) {
76 uint32_t bucket_index
= (*p1
& 0xff000000) >> 24;
77 *(bucket
[i
][bucket_index
].bp
++) = *p1
;
82 // write back intersecting buckets as sorted list.
83 // fill in bucket_info with head and tail of the bucket contents in the list and number of non-empty buckets.
84 uint32_t nonempty_bucket
;
85 for (uint32_t i
= 0; i
< 2; i
++) {
88 for (uint32_t j
= 0x00; j
<= 0xff; j
++) {
89 if (bucket
[0][j
].bp
!= bucket
[0][j
].head
&& bucket
[1][j
].bp
!= bucket
[1][j
].head
) { // non-empty intersecting buckets only
90 bucket_info
->bucket_info
[i
][nonempty_bucket
].head
= p1
;
91 for (p2
= bucket
[i
][j
].head
; p2
< bucket
[i
][j
].bp
; *p1
++ = *p2
++);
92 bucket_info
->bucket_info
[i
][nonempty_bucket
].tail
= p1
- 1;
96 bucket_info
->numbuckets
= nonempty_bucket
;
100 * Binary search for the first occurence of *stop's MSB in sorted [start,stop]
102 /* static inline uint32_t* binsearch(uint32_t *start, uint32_t *stop)
104 uint32_t mid, val = *stop & 0xff000000;
106 if(start[mid = (stop - start) >> 1] > val)
114 /** update_contribution
115 * helper, calculates the partial linear feedback contributions and puts in MSB
118 update_contribution(uint32_t *item
, const uint32_t mask1
, const uint32_t mask2
)
120 uint32_t p
= *item
>> 25;
122 p
= p
<< 1 | evenparity32(*item
& mask1
);
123 p
= p
<< 1 | evenparity32(*item
& mask2
);
124 *item
= p
<< 24 | (*item
& 0xffffff);
128 * using a bit of the keystream extend the table of possible lfsr states
131 extend_table(uint32_t *tbl
, uint32_t **end
, int bit
, int m1
, int m2
, uint32_t in
)
134 for(*tbl
<<= 1; tbl
<= *end
; *++tbl
<<= 1)
135 if(filter(*tbl
) ^ filter(*tbl
| 1)) {
136 *tbl
|= filter(*tbl
) ^ bit
;
137 update_contribution(tbl
, m1
, m2
);
139 } else if(filter(*tbl
) == bit
) {
142 update_contribution(tbl
, m1
, m2
);
144 update_contribution(tbl
, m1
, m2
);
149 /** extend_table_simple
150 * using a bit of the keystream extend the table of possible lfsr states
152 static inline void extend_table_simple(uint32_t *tbl
, uint32_t **end
, int bit
)
154 for(*tbl
<<= 1; tbl
<= *end
; *++tbl
<<= 1)
155 if(filter(*tbl
) ^ filter(*tbl
| 1))
156 *tbl
|= filter(*tbl
) ^ bit
;
157 else if(filter(*tbl
) == bit
) {
167 * recursively narrow down the search space, 4 bits of keystream at a time
169 static struct Crypto1State
*
170 recover(uint32_t *o_head
, uint32_t *o_tail
, uint32_t oks
,
171 uint32_t *e_head
, uint32_t *e_tail
, uint32_t eks
, int rem
,
172 struct Crypto1State
*sl
, uint32_t in
, bucket_array_t bucket
)
175 bucket_info_t bucket_info
;
178 for(e
= e_head
; e
<= e_tail
; ++e
) {
179 *e
= *e
<< 1 ^ evenparity32(*e
& LF_POLY_EVEN
) ^ !!(in
& 4);
180 for(o
= o_head
; o
<= o_tail
; ++o
, ++sl
) {
182 sl
->odd
= *e
^ evenparity32(*o
& LF_POLY_ODD
);
183 sl
[1].odd
= sl
[1].even
= 0;
189 for(i
= 0; i
< 4 && rem
--; i
++) {
193 extend_table(o_head
, &o_tail
, oks
& 1, LF_POLY_EVEN
<< 1 | 1,
194 LF_POLY_ODD
<< 1, 0);
198 extend_table(e_head
, &e_tail
, eks
& 1, LF_POLY_ODD
,
199 LF_POLY_EVEN
<< 1 | 1, in
& 3);
203 bucket_sort_intersect(e_head
, e_tail
, o_head
, o_tail
, &bucket_info
, bucket
);
205 for (int i
= bucket_info
.numbuckets
- 1; i
>= 0; i
--) {
206 sl
= recover(bucket_info
.bucket_info
[1][i
].head
, bucket_info
.bucket_info
[1][i
].tail
, oks
,
207 bucket_info
.bucket_info
[0][i
].head
, bucket_info
.bucket_info
[0][i
].tail
, eks
,
208 rem
, sl
, in
, bucket
);
214 * recover the state of the lfsr given 32 bits of the keystream
215 * additionally you can use the in parameter to specify the value
216 * that was fed into the lfsr at the time the keystream was generated
218 struct Crypto1State
* lfsr_recovery32(uint32_t ks2
, uint32_t in
)
220 struct Crypto1State
*statelist
;
221 uint32_t *odd_head
= 0, *odd_tail
= 0, oks
= 0;
222 uint32_t *even_head
= 0, *even_tail
= 0, eks
= 0;
225 for(i
= 31; i
>= 0; i
-= 2)
226 oks
= oks
<< 1 | BEBIT(ks2
, i
);
227 for(i
= 30; i
>= 0; i
-= 2)
228 eks
= eks
<< 1 | BEBIT(ks2
, i
);
230 odd_head
= odd_tail
= malloc(sizeof(uint32_t) << 21);
231 even_head
= even_tail
= malloc(sizeof(uint32_t) << 21);
232 statelist
= malloc(sizeof(struct Crypto1State
) << 18);
233 if(!odd_tail
-- || !even_tail
-- || !statelist
) {
238 statelist
->odd
= statelist
->even
= 0;
240 // allocate memory for out of place bucket_sort
241 bucket_array_t bucket
;
242 for (uint32_t i
= 0; i
< 2; i
++)
243 for (uint32_t j
= 0; j
<= 0xff; j
++) {
244 bucket
[i
][j
].head
= malloc(sizeof(uint32_t)<<14);
245 if (!bucket
[i
][j
].head
) {
251 for(i
= 1 << 20; i
>= 0; --i
) {
252 if(filter(i
) == (oks
& 1))
254 if(filter(i
) == (eks
& 1))
258 for(i
= 0; i
< 4; i
++) {
259 extend_table_simple(odd_head
, &odd_tail
, (oks
>>= 1) & 1);
260 extend_table_simple(even_head
, &even_tail
, (eks
>>= 1) & 1);
263 in
= (in
>> 16 & 0xff) | (in
<< 16) | (in
& 0xff00);
264 recover(odd_head
, odd_tail
, oks
,
265 even_head
, even_tail
, eks
, 11, statelist
, in
<< 1, bucket
);
270 for (uint32_t i
= 0; i
< 2; i
++)
271 for (uint32_t j
= 0; j
<= 0xff; j
++)
272 free(bucket
[i
][j
].head
);
277 static const uint32_t S1
[] = { 0x62141, 0x310A0, 0x18850, 0x0C428, 0x06214,
278 0x0310A, 0x85E30, 0xC69AD, 0x634D6, 0xB5CDE, 0xDE8DA, 0x6F46D, 0xB3C83,
279 0x59E41, 0xA8995, 0xD027F, 0x6813F, 0x3409F, 0x9E6FA};
280 static const uint32_t S2
[] = { 0x3A557B00, 0x5D2ABD80, 0x2E955EC0, 0x174AAF60,
281 0x0BA557B0, 0x05D2ABD8, 0x0449DE68, 0x048464B0, 0x42423258, 0x278192A8,
282 0x156042D0, 0x0AB02168, 0x43F89B30, 0x61FC4D98, 0x765EAD48, 0x7D8FDD20,
283 0x7EC7EE90, 0x7F63F748, 0x79117020};
284 static const uint32_t T1
[] = {
285 0x4F37D, 0x279BE, 0x97A6A, 0x4BD35, 0x25E9A, 0x12F4D, 0x097A6, 0x80D66,
286 0xC4006, 0x62003, 0xB56B4, 0x5AB5A, 0xA9318, 0xD0F39, 0x6879C, 0xB057B,
287 0x582BD, 0x2C15E, 0x160AF, 0x8F6E2, 0xC3DC4, 0xE5857, 0x72C2B, 0x39615,
288 0x98DBF, 0xC806A, 0xE0680, 0x70340, 0x381A0, 0x98665, 0x4C332, 0xA272C};
289 static const uint32_t T2
[] = { 0x3C88B810, 0x5E445C08, 0x2982A580, 0x14C152C0,
290 0x4A60A960, 0x253054B0, 0x52982A58, 0x2FEC9EA8, 0x1156C4D0, 0x08AB6268,
291 0x42F53AB0, 0x217A9D58, 0x161DC528, 0x0DAE6910, 0x46D73488, 0x25CB11C0,
292 0x52E588E0, 0x6972C470, 0x34B96238, 0x5CFC3A98, 0x28DE96C8, 0x12CFC0E0,
293 0x4967E070, 0x64B3F038, 0x74F97398, 0x7CDC3248, 0x38CE92A0, 0x1C674950,
294 0x0E33A4A8, 0x01B959D0, 0x40DCACE8, 0x26CEDDF0};
295 static const uint32_t C1
[] = { 0x846B5, 0x4235A, 0x211AD};
296 static const uint32_t C2
[] = { 0x1A822E0, 0x21A822E0, 0x21A822E0};
297 /** Reverse 64 bits of keystream into possible cipher states
298 * Variation mentioned in the paper. Somewhat optimized version
300 struct Crypto1State
* lfsr_recovery64(uint32_t ks2
, uint32_t ks3
)
302 struct Crypto1State
*statelist
, *sl
;
303 uint8_t oks
[32], eks
[32], hi
[32];
304 uint32_t low
= 0, win
= 0;
305 uint32_t *tail
, table
[1 << 16];
308 sl
= statelist
= malloc(sizeof(struct Crypto1State
) << 4);
311 sl
->odd
= sl
->even
= 0;
313 for(i
= 30; i
>= 0; i
-= 2) {
314 oks
[i
>> 1] = BEBIT(ks2
, i
);
315 oks
[16 + (i
>> 1)] = BEBIT(ks3
, i
);
317 for(i
= 31; i
>= 0; i
-= 2) {
318 eks
[i
>> 1] = BEBIT(ks2
, i
);
319 eks
[16 + (i
>> 1)] = BEBIT(ks3
, i
);
322 for(i
= 0xfffff; i
>= 0; --i
) {
323 if (filter(i
) != oks
[0])
327 for(j
= 1; tail
>= table
&& j
< 29; ++j
)
328 extend_table_simple(table
, &tail
, oks
[j
]);
333 for(j
= 0; j
< 19; ++j
)
334 low
= low
<< 1 | evenparity32(i
& S1
[j
]);
335 for(j
= 0; j
< 32; ++j
)
336 hi
[j
] = evenparity32(i
& T1
[j
]);
338 for(; tail
>= table
; --tail
) {
339 for(j
= 0; j
< 3; ++j
) {
341 *tail
|= evenparity32((i
& C1
[j
]) ^ (*tail
& C2
[j
]));
342 if(filter(*tail
) != oks
[29 + j
])
346 for(j
= 0; j
< 19; ++j
)
347 win
= win
<< 1 | evenparity32(*tail
& S2
[j
]);
350 for(j
= 0; j
< 32; ++j
) {
351 win
= win
<< 1 ^ hi
[j
] ^ evenparity32(*tail
& T2
[j
]);
352 if(filter(win
) != eks
[j
])
356 *tail
= *tail
<< 1 | evenparity32(LF_POLY_EVEN
& *tail
);
357 sl
->odd
= *tail
^ evenparity32(LF_POLY_ODD
& win
);
360 sl
->odd
= sl
->even
= 0;
367 /** lfsr_rollback_bit
368 * Rollback the shift register in order to get previous states
370 uint8_t lfsr_rollback_bit(struct Crypto1State
*s
, uint32_t in
, int fb
)
377 t
= s
->odd
, s
->odd
= s
->even
, s
->even
= t
;
380 out
^= LF_POLY_EVEN
& (s
->even
>>= 1);
381 out
^= LF_POLY_ODD
& s
->odd
;
383 out
^= (ret
= filter(s
->odd
)) & !!fb
;
385 s
->even
|= evenparity32(out
) << 23;
388 /** lfsr_rollback_byte
389 * Rollback the shift register in order to get previous states
391 uint8_t lfsr_rollback_byte(struct Crypto1State
*s
, uint32_t in
, int fb
)
394 for (i
= 7; i
>= 0; --i
)
395 ret
|= lfsr_rollback_bit(s
, BIT(in
, i
), fb
) << i
;
398 /** lfsr_rollback_word
399 * Rollback the shift register in order to get previous states
401 uint32_t lfsr_rollback_word(struct Crypto1State
*s
, uint32_t in
, int fb
)
405 for (i
= 31; i
>= 0; --i
)
406 ret
|= lfsr_rollback_bit(s
, BEBIT(in
, i
), fb
) << (i
^ 24);
411 * x,y valid tag nonces, then prng_successor(x, nonce_distance(x, y)) = y
413 static uint16_t *dist
= 0;
414 int nonce_distance(uint32_t from
, uint32_t to
)
418 dist
= malloc(2 << 16);
421 for (x
= i
= 1; i
; ++i
) {
422 dist
[(x
& 0xff) << 8 | x
>> 8] = i
;
423 x
= x
>> 1 | (x
^ x
>> 2 ^ x
>> 3 ^ x
>> 5) << 15;
426 return (65535 + dist
[to
>> 16] - dist
[from
>> 16]) % 65535;
430 static uint32_t fastfwd
[2][8] = {
431 { 0, 0x4BC53, 0xECB1, 0x450E2, 0x25E29, 0x6E27A, 0x2B298, 0x60ECB},
432 { 0, 0x1D962, 0x4BC53, 0x56531, 0xECB1, 0x135D3, 0x450E2, 0x58980}};
435 * Is an exported helper function from the common prefix attack
436 * Described in the "dark side" paper. It returns an -1 terminated array
437 * of possible partial(21 bit) secret state.
438 * The required keystream(ks) needs to contain the keystream that was used to
439 * encrypt the NACK which is observed when varying only the 3 last bits of Nr
440 * only correct iff [NR_3] ^ NR_3 does not depend on Nr_3
442 uint32_t *lfsr_prefix_ks(uint8_t ks
[8], int isodd
)
444 uint32_t c
, entry
, *candidates
= malloc(4 << 10);
445 int i
, size
= 0, good
;
450 for(i
= 0; i
< 1 << 21; ++i
) {
451 for(c
= 0, good
= 1; good
&& c
< 8; ++c
) {
452 entry
= i
^ fastfwd
[isodd
][c
];
453 good
&= (BIT(ks
[c
], isodd
) == filter(entry
>> 1));
454 good
&= (BIT(ks
[c
], isodd
+ 2) == filter(entry
));
457 candidates
[size
++] = i
;
460 candidates
[size
] = -1;
466 * helper function which eliminates possible secret states using parity bits
468 static struct Crypto1State
*
469 check_pfx_parity(uint32_t prefix
, uint32_t rresp
, uint8_t parities
[8][8],
470 uint32_t odd
, uint32_t even
, struct Crypto1State
* sl
, uint32_t no_par
)
472 uint32_t ks1
, nr
, ks2
, rr
, ks3
, c
, good
= 1;
474 for(c
= 0; good
&& c
< 8; ++c
) {
475 sl
->odd
= odd
^ fastfwd
[1][c
];
476 sl
->even
= even
^ fastfwd
[0][c
];
478 lfsr_rollback_bit(sl
, 0, 0);
479 lfsr_rollback_bit(sl
, 0, 0);
481 ks3
= lfsr_rollback_bit(sl
, 0, 0);
482 ks2
= lfsr_rollback_word(sl
, 0, 0);
483 ks1
= lfsr_rollback_word(sl
, prefix
| c
<< 5, 1);
488 nr
= ks1
^ (prefix
| c
<< 5);
491 good
&= evenparity32(nr
& 0x000000ff) ^ parities
[c
][3] ^ BIT(ks2
, 24);
492 good
&= evenparity32(rr
& 0xff000000) ^ parities
[c
][4] ^ BIT(ks2
, 16);
493 good
&= evenparity32(rr
& 0x00ff0000) ^ parities
[c
][5] ^ BIT(ks2
, 8);
494 good
&= evenparity32(rr
& 0x0000ff00) ^ parities
[c
][6] ^ BIT(ks2
, 0);
495 good
&= evenparity32(rr
& 0x000000ff) ^ parities
[c
][7] ^ ks3
;
502 /** lfsr_common_prefix
503 * Implentation of the common prefix attack.
506 lfsr_common_prefix(uint32_t pfx
, uint32_t rr
, uint8_t ks
[8], uint8_t par
[8][8], uint32_t no_par
)
508 struct Crypto1State
*statelist
, *s
;
509 uint32_t *odd
, *even
, *o
, *e
, top
;
511 odd
= lfsr_prefix_ks(ks
, 1);
512 even
= lfsr_prefix_ks(ks
, 0);
514 s
= statelist
= malloc((sizeof *statelist
) << 22); // was << 20. Need more for no_par special attack. Enough???
515 if(!s
|| !odd
|| !even
) {
521 for(o
= odd
; *o
+ 1; ++o
)
522 for(e
= even
; *e
+ 1; ++e
)
523 for(top
= 0; top
< 64; ++top
) {
525 *e
+= (!(top
& 7) + 1) << 21;
526 s
= check_pfx_parity(pfx
, rr
, par
, *o
, *e
, s
, no_par
);
529 s
->odd
= s
->even
= 0;