armsrc/hitag2_crypto.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
   3 //
   4 // This program is free software: you can redistribute it and/or modify
   5 // it under the terms of the GNU General Public License as published by
   6 // the Free Software Foundation, either version 3 of the License, or
   7 // (at your option) any later version.
   8 //
   9 // This program is distributed in the hope that it will be useful,
  10 // but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 // GNU General Public License for more details.
  13 //
  14 // See LICENSE.txt for the text of the license.
  15 //-----------------------------------------------------------------------------
  16 // Hitag2 Crypto
  17 //-----------------------------------------------------------------------------
  18 #include "hitag2_crypto.h"
  19
  20 #include "util.h"
  21 #include "string.h"
  22
  23 /* Following is a modified version of cryptolib.com/ciphers/hitag2/ */
  24 // Software optimized 48-bit Philips/NXP Mifare Hitag2 PCF7936/46/47/52 stream cipher algorithm by I.C. Wiener 2006-2007.
  25 // For educational purposes only.
  26 // No warranties or guarantees of any kind.
  27 // This code is released into the public domain by its author.
  28
  29 // Single bit Hitag2 functions:
  30 #ifndef i4
  31 #define i4(x,a,b,c,d)    ((uint32_t)((((x)>>(a))&1)+(((x)>>(b))&1)*2+(((x)>>(c))&1)*4+(((x)>>(d))&1)*8))
  32 #endif
  33
  34 static const uint32_t ht2_f4a = 0x2C79;     // 0010 1100 0111 1001
  35 static const uint32_t ht2_f4b = 0x6671;     // 0110 0110 0111 0001
  36 static const uint32_t ht2_f5c = 0x7907287B; // 0111 1001 0000 0111 0010 1000 0111 1011
  37
  38 uint32_t _f20(const uint64_t x) {
  39     uint32_t i5;
  40
  41     i5 = ((ht2_f4a >> i4(x, 1, 2, 4, 5)) & 1) * 1
  42          + ((ht2_f4b >> i4(x, 7, 11, 13, 14)) & 1) * 2
  43          + ((ht2_f4b >> i4(x, 16, 20, 22, 25)) & 1) * 4
  44          + ((ht2_f4b >> i4(x, 27, 28, 30, 32)) & 1) * 8
  45          + ((ht2_f4a >> i4(x, 33, 42, 43, 45)) & 1) * 16;
  46
  47     return (ht2_f5c >> i5) & 1;
  48 }
  49
  50 uint64_t _hitag2_init(const uint64_t key, const uint32_t serial, const uint32_t IV) {
  51     uint32_t i;
  52     uint64_t x = ((key & 0xFFFF) << 32) + serial;
  53
  54     for (i = 0; i < 32; i++) {
  55         x >>= 1;
  56         x += (uint64_t)(_f20(x) ^ (((IV >> i) ^ (key >> (i + 16))) & 1)) << 47;
  57     }
  58     return x;
  59 }
  60
  61 uint64_t _hitag2_round(uint64_t *state) {
  62     uint64_t x = *state;
  63
  64     x = (x >>  1) +
  65         ((((x >>  0) ^ (x >>  2) ^ (x >>  3) ^ (x >>  6)
  66            ^ (x >>  7) ^ (x >>  8) ^ (x >> 16) ^ (x >> 22)
  67            ^ (x >> 23) ^ (x >> 26) ^ (x >> 30) ^ (x >> 41)
  68            ^ (x >> 42) ^ (x >> 43) ^ (x >> 46) ^ (x >> 47)) & 1) << 47);
  69
  70     *state = x;
  71     return _f20(x);
  72 }
  73
  74 // "MIKRON"             =  O  N  M  I  K  R
  75 // Key                  = 4F 4E 4D 49 4B 52             - Secret 48-bit key
  76 // Serial               = 49 43 57 69                   - Serial number of the tag, transmitted in clear
  77 // Random               = 65 6E 45 72                   - Random IV, transmitted in clear
  78 //~28~DC~80~31  = D7 23 7F CE                   - Authenticator value = inverted first 4 bytes of the keystream
  79
  80 // The code below must print out "D7 23 7F CE 8C D0 37 A9 57 49 C1 E6 48 00 8A B6".
  81 // The inverse of the first 4 bytes is sent to the tag to authenticate.
  82 // The rest is encrypted by XORing it with the subsequent keystream.
  83
  84 uint32_t _hitag2_byte(uint64_t *x) {
  85     uint32_t i, c;
  86     for (i = 0, c = 0; i < 8; i++) {
  87         c += (uint32_t) _hitag2_round(x) << (i ^ 7);
  88     }
  89     return c;
  90 }
  91
  92 void hitag2_cipher_reset(struct hitag2_tag *tag, const uint8_t *iv) {
  93     uint64_t key = ((uint64_t)tag->sectors[2][2]) |
  94                    ((uint64_t)tag->sectors[2][3] << 8) |
  95                    ((uint64_t)tag->sectors[1][0] << 16) |
  96                    ((uint64_t)tag->sectors[1][1] << 24) |
  97                    ((uint64_t)tag->sectors[1][2] << 32) |
  98                    ((uint64_t)tag->sectors[1][3] << 40);
  99     uint32_t uid = ((uint32_t)tag->sectors[0][0]) |
 100                    ((uint32_t)tag->sectors[0][1] << 8) |
 101                    ((uint32_t)tag->sectors[0][2] << 16) |
 102                    ((uint32_t)tag->sectors[0][3] << 24);
 103     uint32_t iv_ = (((uint32_t)(iv[0]))) |
 104                    (((uint32_t)(iv[1])) << 8) |
 105                    (((uint32_t)(iv[2])) << 16) |
 106                    (((uint32_t)(iv[3])) << 24);
 107     tag->cs = _hitag2_init(REV64(key), REV32(uid), REV32(iv_));
 108 }
 109
 110 int hitag2_cipher_authenticate(uint64_t *cs, const uint8_t *authenticator_is) {
 111     uint8_t authenticator_should[4];
 112     authenticator_should[0] = ~_hitag2_byte(cs);
 113     authenticator_should[1] = ~_hitag2_byte(cs);
 114     authenticator_should[2] = ~_hitag2_byte(cs);
 115     authenticator_should[3] = ~_hitag2_byte(cs);
 116     return (memcmp(authenticator_should, authenticator_is, 4) == 0);
 117 }
 118
 119 int hitag2_cipher_transcrypt(uint64_t *cs, uint8_t *data, uint16_t bytes, uint16_t bits) {
 120     int i;
 121     for (i = 0; i < bytes; i++) data[i] ^= _hitag2_byte(cs);
 122     for (i = 0; i < bits; i++) data[bytes] ^= _hitag2_round(cs) << (7 - i);
 123     return 0;
 124 }
 125