[PATCH 0/2] EAP-PEAP: Fix TLS 1.3 cryptobinding and expose policy

[github at singe.za.net]

From: Dominic White <singe-github at singe.za.net>

This pair addresses two PEAPv0 cryptobinding issues.

1 - hostapd generates wrong crypto binding TK when using TLS 1.3
2 - there is no way to have hostapd's EAP server require cryptobinding


Patch 1 addresses a problem in hostapd's eap server PEAP mode when using
cryptobinding and TLS 1.3. In TLS 1.2's TLS-Exporter generating bytes of length
X and truncating to X-n were identical to generating X-n bytes. However, in TLS
1.3 the PRF changed to make the TLS-Exporter depend on the length passed to it
(RFC 9427 Section 2.1 Para 4) and so the supplicant and authenticator need to
generate the same length of bytes before truncation.

Currently, hostapd requests 64 bytes (EAP_TLS_KEY_LEN), then truncates them to
60 for the TK, and this works for TLS 1.2. However, in TLS 1.3 128 bytes
(EAP_TLS_KEY_LEN + EAP_EMSK_LEN) should be requested before truncation (RFC9427
Section 2.1 Para 5), and by requesting only 64 bytes will generate different
bytes to those generated on the supplicant. wpa_supplicant does this correctly.
The different TK values then produce different IPMK/CMK values and a failed
Compound_MAC check.

Patch 1 makes the authenticator request the same amount of key material as the
peer and extends the TLS 1.3 hwsim test to require cryptobinding. This could be
split into a separate test, but this would exercise the full code path.

I also switched free'ing the TK from using os_free() to bin_clear_free().

Patch 2 adds the BSS option eap_peap_crypto_binding=0|1|2 for off, optional,
and required server policy. The current default is to set optional, with no way
to change it. Its hwsim test covers the policy combinations using the
integrated EAP server.

Tested on an hwsim host:

  ./run-tests.py ap_wpa2_eap_peap_13 \
      ap_wpa2_eap_peap_crypto_binding_config \
      ap_wpa2_eap_peap_crypto_binding

The hwsim tests passed.

Dominic White (2):
  EAP-PEAP: Fix TLS 1.3 cryptobinding key derivation
  hostapd: Add configurable PEAP cryptobinding policy

 eap_example/eap_example_server.c |  1 +
 hostapd/config_file.c            | 11 ++++++++++
 hostapd/hostapd.conf             |  6 ++++++
 src/ap/ap_config.c               |  1 +
 src/ap/ap_config.h               |  1 +
 src/ap/authsrv.c                 |  1 +
 src/eap_server/eap.h             |  1 +
 src/eap_server/eap_server_peap.c | 25 ++++++++++++++++------
 tests/hwsim/test_ap_eap.py       | 46 +++++++++++++++++++++++++++++++++++++++-
 9 files changed, 86 insertions(+), 7 deletions(-)

-- 
2.54.0 (Apple Git-157)