X-Git-Url: https://git.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/blobdiff_plain/d433698311f055d0f804c4009936e7d325ae5815..1772cf8bdd474f64c8d3c4d306150c2bebbf757e:/client/nonce2key/nonce2key.c
diff --git a/client/nonce2key/nonce2key.c b/client/nonce2key/nonce2key.c
index aeaecbe6..3d3d1e37 100644
--- a/client/nonce2key/nonce2key.c
+++ b/client/nonce2key/nonce2key.c
@@ -54,15 +54,19 @@ int nonce2key(uint32_t uid, uint32_t nt, uint32_t nr, uint64_t par_info, uint64_
return 0;
}
+int compar_intA(const void * a, const void * b) {
+ if (*(int64_t*)b == *(int64_t*)a) return 0;
+ if (*(int64_t*)b > *(int64_t*)a) return 1;
+ return -1;
+}
+
// call when PAR == 0, special attack? It seems to need two calls. with same uid, block, keytype
int nonce2key_ex(uint8_t blockno, uint8_t keytype, uint32_t uid, uint32_t nt, uint32_t nr, uint64_t ks_info, uint64_t * key) {
struct Crypto1State *state;
uint32_t i, pos, key_count;
- byte_t ks3x[8];
-
+ uint8_t ks3x[8];
uint64_t key_recovered;
-
int64_t *state_s;
static uint8_t last_blockno;
static uint8_t last_keytype;
@@ -83,58 +87,70 @@ int nonce2key_ex(uint8_t blockno, uint8_t keytype, uint32_t uid, uint32_t nt, ui
// Reset the last three significant bits of the reader nonce
nr &= 0xffffff1f;
-
- PrintAndLog("uid(%08x) nt(%08x) ks(%016"llx") nr(%08x)\n", uid, nt, ks_info, nr);
+ // split keystream into array
for (pos=0; pos<8; pos++) {
ks3x[7-pos] = (ks_info >> (pos*8)) & 0x0f;
}
-
- PrintAndLog("parity is all zero, try special attack. Just wait for few more seconds...");
-
+
+ // find possible states for this keystream
state = lfsr_common_prefix_ex(nr, ks3x);
+
+ if (!state) {
+ PrintAndLog("Failed getting states");
+ return 1;
+ }
+
state_s = (int64_t*)state;
+ uint32_t xored = uid ^ nt;
+
for (i = 0; (state) && ((state + i)->odd != -1); i++) {
- lfsr_rollback_word(state + i, uid ^ nt, 0);
+ lfsr_rollback_word(state + i, xored, 0);
crypto1_get_lfsr(state + i, &key_recovered);
*(state_s + i) = key_recovered;
}
-
- if(!state)
- return 1;
-
- qsort(state_s, i, sizeof(*state_s), compar_int);
+
+ qsort(state_s, i, sizeof(int64_t), compar_intA);
*(state_s + i) = -1;
- //Create the intersection:
- if ( last_keylist != NULL) {
+ // first call to this function. clear all other stuff and set new found states.
+ if (last_keylist == NULL) {
+ free(last_keylist);
+ last_keylist = state_s;
+ PrintAndLog("parity is all zero, testing special attack. First call, this attack needs at least two calls. Hold on...");
+ PrintAndLog("uid(%08x) nt(%08x) ks(%016"llx") nr(%08x)\n", uid, nt, ks_info, nr);
+ return 1;
+ }
- int64_t *p1, *p2, *p3;
- p1 = p3 = last_keylist;
- p2 = state_s;
+ PrintAndLog("uid(%08x) nt(%08x) ks(%016"llx") nr(%08x)\n", uid, nt, ks_info, nr);
+
+ //Create the intersection:
+ int64_t *p1, *p2, *p3;
+ p1 = p3 = last_keylist;
+ p2 = state_s;
- while ( *p1 != -1 && *p2 != -1 ) {
- if (compar_int(p1, p2) == 0) {
- printf("p1:%"llx" p2:%"llx" p3:%"llx" key:%012"llx"\n",(uint64_t)(p1-last_keylist),(uint64_t)(p2-state_s),(uint64_t)(p3-last_keylist),*p1);
- *p3++ = *p1++;
- p2++;
- }
- else {
- while (compar_int(p1, p2) == -1) ++p1;
- while (compar_int(p1, p2) == 1) ++p2;
- }
+ while ( *p1 != -1 && *p2 != -1 ) {
+ if (compar_intA(p1, p2) == 0) {
+ printf("p1:%"llx" p2:%"llx" p3:%"llx" key:%012"llx"\n",(uint64_t)(p1-last_keylist),(uint64_t)(p2-state_s),(uint64_t)(p3-last_keylist),*p1);
+ *p3++ = *p1++;
+ p2++;
+ }
+ else {
+ while (compar_intA(p1, p2) == -1) ++p1;
+ while (compar_intA(p1, p2) == 1) ++p2;
}
- key_count = p3 - last_keylist;
- PrintAndLog("one A");
- } else {
- key_count = 0;
- PrintAndLog("one B");
}
-
- printf("key_count:%d\n", key_count);
+ key_count = p3 - last_keylist;
+ printf("key_count: %d\n", key_count);
+ if ( key_count == 0 ){
+ free(state);
+ state = NULL;
+ return 0;
+ }
- // The list may still contain several key candidates. Test each of them with mfCheckKeys
+ uint8_t retval = 1;
+ // Validate all key candidates with testing each of them with mfCheckKeys
uint8_t keyBlock[6] = {0,0,0,0,0,0};
uint64_t key64;
for (i = 0; i < key_count; i++) {
@@ -143,20 +159,21 @@ int nonce2key_ex(uint8_t blockno, uint8_t keytype, uint32_t uid, uint32_t nt, ui
key64 = 0;
if (!mfCheckKeys(blockno, keytype, false, 1, keyBlock, &key64)) {
*key = key64;
- free(last_keylist);
- last_keylist = NULL;
- free(state);
- return 0;
+ retval = 0;
+ goto out;
}
- }
+ }
+out:
free(last_keylist);
- last_keylist = state_s;
- return 1;
+ last_keylist = NULL;
+ free(state);
+ state = NULL;
+ return retval;
}
// 32 bit recover key from 2 nonces
-bool tryMfk32(nonces_t data, uint64_t *outputkey) {
+bool tryMfk32(nonces_t data, uint64_t *outputkey, bool verbose) {
struct Crypto1State *s,*t;
uint64_t outkey = 0;
uint64_t key=0; // recovered key
@@ -166,22 +183,24 @@ bool tryMfk32(nonces_t data, uint64_t *outputkey) {
uint32_t ar0_enc = data.ar; // first encrypted reader response
uint32_t nr1_enc = data.nr2; // second encrypted reader challenge
uint32_t ar1_enc = data.ar2; // second encrypted reader response
- clock_t t1 = clock();
bool isSuccess = FALSE;
uint8_t counter = 0;
-
- printf("Recovering key for:\n");
- printf(" uid: %08x\n",uid);
- printf(" nt: %08x\n",nt);
- printf(" {nr_0}: %08x\n",nr0_enc);
- printf(" {ar_0}: %08x\n",ar0_enc);
- printf(" {nr_1}: %08x\n",nr1_enc);
- printf(" {ar_1}: %08x\n",ar1_enc);
-
- printf("\nLFSR succesors of the tag challenge:\n");
+
+ clock_t t1 = clock();
uint32_t p64 = prng_successor(nt, 64);
- printf(" nt': %08x\n", p64);
- printf(" nt'': %08x\n", prng_successor(p64, 32));
+
+ if ( verbose ) {
+ printf("Recovering key for:\n");
+ printf(" uid: %08x\n",uid);
+ printf(" nt: %08x\n",nt);
+ printf(" {nr_0}: %08x\n",nr0_enc);
+ printf(" {ar_0}: %08x\n",ar0_enc);
+ printf(" {nr_1}: %08x\n",nr1_enc);
+ printf(" {ar_1}: %08x\n",ar1_enc);
+ printf("\nLFSR succesors of the tag challenge:\n");
+ printf(" nt': %08x\n", p64);
+ printf(" nt'': %08x\n", prng_successor(p64, 32));
+ }
s = lfsr_recovery32(ar0_enc ^ p64, 0);
@@ -193,7 +212,6 @@ bool tryMfk32(nonces_t data, uint64_t *outputkey) {
crypto1_word(t, uid ^ nt, 0);
crypto1_word(t, nr1_enc, 1);
if (ar1_enc == (crypto1_word(t, 0, 0) ^ p64)) {
- //PrintAndLog("Found Key: [%012"llx"]", key);
outkey = key;
++counter;
if (counter==20) break;
@@ -208,7 +226,7 @@ bool tryMfk32(nonces_t data, uint64_t *outputkey) {
return isSuccess;
}
-bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool showMaths) {
+bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool verbose) {
struct Crypto1State *s, *t;
uint64_t outkey = 0;
uint64_t key = 0; // recovered key
@@ -222,8 +240,13 @@ bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool showMaths) {
uint32_t ar1_enc = data.ar2; // second encrypted reader response
bool isSuccess = FALSE;
int counter = 0;
+
+ clock_t t1 = clock();
+
+ uint32_t p640 = prng_successor(nt0, 64);
+ uint32_t p641 = prng_successor(nt1, 64);
- if (showMaths) {
+ if (verbose) {
printf("Recovering key for:\n");
printf(" uid: %08x\n", uid);
printf(" nt_0: %08x\n", nt0);
@@ -232,15 +255,6 @@ bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool showMaths) {
printf(" nt_1: %08x\n", nt1);
printf(" {nr_1}: %08x\n", nr1_enc);
printf(" {ar_1}: %08x\n", ar1_enc);
- }
-
- //PrintAndLog("Enter mfkey32_moebius");
- clock_t t1 = clock();
-
- uint32_t p640 = prng_successor(nt0, 64);
- uint32_t p641 = prng_successor(nt1, 64);
-
- if (showMaths) {
printf("\nLFSR succesors of the tag challenge:\n");
printf(" nt': %08x\n", p640);
printf(" nt'': %08x\n", prng_successor(p640, 32));
@@ -257,7 +271,6 @@ bool tryMfk32_moebius(nonces_t data, uint64_t *outputkey, bool showMaths) {
crypto1_word(t, uid ^ nt1, 0);
crypto1_word(t, nr1_enc, 1);
if (ar1_enc == (crypto1_word(t, 0, 0) ^ p641)) {
- //PrintAndLog("Found Key: [%012"llx"]",key);
outkey=key;
++counter;
if (counter==20) break;