X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/bc7846f4376472abdc9ced23436dfe3b6dd20e7f..deba67ab57d820d7201d05e9b57905b91256bc94:/client/nonce2key/nonce2key.c?ds=inline diff --git a/client/nonce2key/nonce2key.c b/client/nonce2key/nonce2key.c index aeaecbe6..3d3d1e37 100644 --- a/client/nonce2key/nonce2key.c +++ b/client/nonce2key/nonce2key.c @@ -54,15 +54,19 @@ int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_ return 0; } +int compar_intA(const void * a, const void * b) { + if (*(int64_t*)b == *(int64_t*)a) return 0; + if (*(int64_t*)b > *(int64_t*)a) return 1; + return -1; +} + // call when PAR == 0, special attack? It seems to need two calls. with same uid, block, keytype int nonce2key_ex(uint8_t blockno, uint8_t keytype, uint32_t uid, uint32_t nt, uint32_t nr, uint64_t ks_info, uint64_t * key) { struct Crypto1State *state; uint32_t i, pos, key_count; - byte_t ks3x[8]; - + uint8_t ks3x[8]; uint64_t key_recovered; - int64_t *state_s; static uint8_t last_blockno; static uint8_t last_keytype; @@ -83,58 +87,70 @@ int nonce2key_ex(uint8_t blockno, uint8_t keytype, uint32_t uid, uint32_t nt, ui // Reset the last three significant bits of the reader nonce nr &= 0xffffff1f; - - PrintAndLog("uid(%08x) nt(%08x) ks(%016"llx") nr(%08x)\n", uid, nt, ks_info, nr); + // split keystream into array for (pos=0; pos<8; pos++) { ks3x[7-pos] = (ks_info >> (pos*8)) & 0x0f; } - - PrintAndLog("parity is all zero, try special attack. Just wait for few more seconds..."); - + + // find possible states for this keystream state = lfsr_common_prefix_ex(nr, ks3x); + + if (!state) { + PrintAndLog("Failed getting states"); + return 1; + } + state_s = (int64_t*)state; + uint32_t xored = uid ^ nt; + for (i = 0; (state) && ((state + i)->odd != -1); i++) { - lfsr_rollback_word(state + i, uid ^ nt, 0); + lfsr_rollback_word(state + i, xored, 0); crypto1_get_lfsr(state + i, &key_recovered); *(state_s + i) = key_recovered; } - - if(!state) - return 1; - - qsort(state_s, i, sizeof(*state_s), compar_int); + + qsort(state_s, i, sizeof(int64_t), compar_intA); *(state_s + i) = -1; - //Create the intersection: - if ( last_keylist != NULL) { + // first call to this function. clear all other stuff and set new found states. + if (last_keylist == NULL) { + free(last_keylist); + last_keylist = state_s; + PrintAndLog("parity is all zero, testing special attack. First call, this attack needs at least two calls. Hold on..."); + PrintAndLog("uid(%08x) nt(%08x) ks(%016"llx") nr(%08x)\n", uid, nt, ks_info, nr); + return 1; + } - int64_t *p1, *p2, *p3; - p1 = p3 = last_keylist; - p2 = state_s; + PrintAndLog("uid(%08x) nt(%08x) ks(%016"llx") nr(%08x)\n", uid, nt, ks_info, nr); + + //Create the intersection: + int64_t *p1, *p2, *p3; + p1 = p3 = last_keylist; + p2 = state_s; - while ( *p1 != -1 && *p2 != -1 ) { - if (compar_int(p1, p2) == 0) { - printf("p1:%"llx" p2:%"llx" p3:%"llx" key:%012"llx"\n",(uint64_t)(p1-last_keylist),(uint64_t)(p2-state_s),(uint64_t)(p3-last_keylist),*p1); - *p3++ = *p1++; - p2++; - } - else { - while (compar_int(p1, p2) == -1) ++p1; - while (compar_int(p1, p2) == 1) ++p2; - } + while ( *p1 != -1 && *p2 != -1 ) { + if (compar_intA(p1, p2) == 0) { + printf("p1:%"llx" p2:%"llx" p3:%"llx" key:%012"llx"\n",(uint64_t)(p1-last_keylist),(uint64_t)(p2-state_s),(uint64_t)(p3-last_keylist),*p1); + *p3++ = *p1++; + p2++; + } + else { + while (compar_intA(p1, p2) == -1) ++p1; + while (compar_intA(p1, p2) == 1) ++p2; } - key_count = p3 - last_keylist; - PrintAndLog("one A"); - } else { - key_count = 0; - PrintAndLog("one B"); } - - printf("key_count:%d\n", key_count); + key_count = p3 - last_keylist; + printf("key_count: %d\n", key_count); + if ( key_count == 0 ){ + free(state); + state = NULL; + return 0; + } - // The list may still contain several key candidates. Test each of them with mfCheckKeys + uint8_t retval = 1; + // Validate all key candidates with testing each of them with mfCheckKeys uint8_t keyBlock[6] = {0,0,0,0,0,0}; uint64_t key64; for (i = 0; i < key_count; i++) { @@ -143,20 +159,21 @@ int nonce2key_ex(uint8_t blockno, uint8_t keytype, uint32_t uid, uint32_t nt, ui key64 = 0; if (!mfCheckKeys(blockno, keytype, false, 1, keyBlock, &key64)) { *key = key64; - free(last_keylist); - last_keylist = NULL; - free(state); - return 0; + retval = 0; + goto out; } - } + } +out: free(last_keylist); - last_keylist = state_s; - return 1; + last_keylist = NULL; + free(state); + state = NULL; + return retval; } // 32 bit recover key from 2 nonces -bool tryMfk32(nonces_t data, uint64_t *outputkey) { +bool tryMfk32(nonces_t data, uint64_t *outputkey, bool verbose) { struct Crypto1State *s,*t; uint64_t outkey = 0; uint64_t key=0; // recovered key @@ -166,22 +183,24 @@ bool tryMfk32(nonces_t data, uint64_t *outputkey) { uint32_t ar0_enc = data.ar; // first encrypted reader response uint32_t nr1_enc = data.nr2; // second encrypted reader challenge uint32_t ar1_enc = data.ar2; // second encrypted reader response - clock_t t1 = clock(); bool isSuccess = FALSE; uint8_t counter = 0; - - printf("Recovering key for:\n"); - printf(" uid: %08x\n",uid); - printf(" nt: %08x\n",nt); - printf(" {nr_0}: %08x\n",nr0_enc); - printf(" {ar_0}: %08x\n",ar0_enc); - printf(" {nr_1}: %08x\n",nr1_enc); - printf(" {ar_1}: %08x\n",ar1_enc); - - printf("\nLFSR succesors of the tag challenge:\n"); + + clock_t t1 = clock(); uint32_t p64 = prng_successor(nt, 64); - printf(" nt': %08x\n", p64); - printf(" nt'': %08x\n", prng_successor(p64, 32)); + + if ( verbose ) { + printf("Recovering key for:\n"); + printf(" uid: %08x\n",uid); + printf(" nt: %08x\n",nt); + printf(" {nr_0}: %08x\n",nr0_enc); + printf(" {ar_0}: %08x\n",ar0_enc); + printf(" {nr_1}: %08x\n",nr1_enc); + printf(" {ar_1}: %08x\n",ar1_enc); + printf("\nLFSR succesors of the tag challenge:\n"); + printf(" nt': %08x\n", p64); + printf(" nt'': %08x\n", prng_successor(p64, 32)); + } s = lfsr_recovery32(ar0_enc ^ p64, 0); @@ -193,7 +212,6 @@ bool tryMfk32(nonces_t data, uint64_t *outputkey) { crypto1_word(t, uid ^ nt, 0); crypto1_word(t, nr1_enc, 1); if (ar1_enc == (crypto1_word(t, 0, 0) ^ p64)) { - //PrintAndLog("Found Key: [%012"llx"]", key); outkey = key; ++counter; if (counter==20) break; @@ -208,7 +226,7 @@ bool tryMfk32(nonces_t data, uint64_t *outputkey) { return isSuccess; } -bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool showMaths) { +bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool verbose) { struct Crypto1State *s, *t; uint64_t outkey = 0; uint64_t key = 0; // recovered key @@ -222,8 +240,13 @@ bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool showMaths) { uint32_t ar1_enc = data.ar2; // second encrypted reader response bool isSuccess = FALSE; int counter = 0; + + clock_t t1 = clock(); + + uint32_t p640 = prng_successor(nt0, 64); + uint32_t p641 = prng_successor(nt1, 64); - if (showMaths) { + if (verbose) { printf("Recovering key for:\n"); printf(" uid: %08x\n", uid); printf(" nt_0: %08x\n", nt0); @@ -232,15 +255,6 @@ bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool showMaths) { printf(" nt_1: %08x\n", nt1); printf(" {nr_1}: %08x\n", nr1_enc); printf(" {ar_1}: %08x\n", ar1_enc); - } - - //PrintAndLog("Enter mfkey32_moebius"); - clock_t t1 = clock(); - - uint32_t p640 = prng_successor(nt0, 64); - uint32_t p641 = prng_successor(nt1, 64); - - if (showMaths) { printf("\nLFSR succesors of the tag challenge:\n"); printf(" nt': %08x\n", p640); printf(" nt'': %08x\n", prng_successor(p640, 32)); @@ -257,7 +271,6 @@ bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool showMaths) { crypto1_word(t, uid ^ nt1, 0); crypto1_word(t, nr1_enc, 1); if (ar1_enc == (crypto1_word(t, 0, 0) ^ p641)) { - //PrintAndLog("Found Key: [%012"llx"]",key); outkey=key; ++counter; if (counter==20) break;