PinLin/holycard-cracker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add craptev1-v1.1 and crapto1-v3.3

Browse Source
This commit is contained in:
Pin Lin
2023-04-16 03:06:44 +08:00
parent d4a6fd023e
commit c2669df89e
12 changed files with 11358 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.gitignore vendored
View File

@ -1,4 +0,0 @@
craptev1-v1.1.tar.xz
craptev1-v1.1/*
crapto1-v3.3.tar.xz
crapto1-v3.3/*

16
Makefile
View File

@ -13,8 +13,8 @@ LDFLAGS= -Wl,--allow-multiple-definition
all: solve_bs solve_piwi_bs solve_piwi libnfc_crypto1_crack
CRAPTEV1 = craptev1-v1.1/craptev1.c -I craptev1-v1.1/
CRAPTO1 = crapto1-v3.3/crapto1.c crapto1-v3.3/crypto1.c -I crapto1-v3.3/
CRYPTO1_BS = crypto1_bs.c crypto1_bs_crack.c
CRAPTO1 = crapto1-v3.3/crapto1.c crapto1-v3.3/crypto1.c -I crapto1-v3.3/
CRYPTO1_BS = crypto1_bs.c crypto1_bs_crack.c
solve_bs:
$(CC) $(CFLAGS) $@.c $(CRYPTO1_BS) $(CRAPTO1) ${CRAPTEV1} -o $@ -lpthread -lm $(LDFLAGS)
@ -31,17 +31,6 @@ libnfc_crypto1_crack:
clean:
rm -f solve.so solve_bs solve_piwi_bs solve_piwi libnfc_crypto1_crack
get_craptev1:
echo 'Stop being lazy, find your own file!'
wget http://crapto1.netgarage.org/craptev1-v1.1.tar.xz
tar Jxvf craptev1-v1.1.tar.xz
get_crapto1:
echo 'Stop being lazy, find your own file!'
wget http://crapto1.netgarage.org/crapto1-v3.3.tar.xz
mkdir crapto1-v3.3
tar Jxvf crapto1-v3.3.tar.xz -C crapto1-v3.3
# Windows cross compilation
MINGW32 = i686-w64-mingw32-gcc
MINGW64 = x86_64-w64-mingw32-gcc
@ -68,4 +57,3 @@ solve_piwi32.exe:
solve_piwi64.exe:
$(MINGW64) $(CFLAGS) solve_piwi.c $(CRYPTO1_BS) $(CRAPTO1) ${CRAPTEV1} -static -o $@ -lpthread

10000
craptev1-v1.1/0xcafec0de.txt Normal file
View File

File diff suppressed because it is too large Load Diff

2
craptev1-v1.1/Makefile Normal file
View File

@ -0,0 +1,2 @@
all: solve.c craptev1.c craptev1.h
gcc -O3 -mpopcnt solve.c craptev1.c -o solve

472
craptev1-v1.1/craptev1.c Normal file
View File

@ -0,0 +1,472 @@
/**
* CraptEV1
* Copyright (c) 2015-2016 blapost@gmail.com
*
* This software is provided 'as-is', without any express or implied
* warranty. In no event will the authors be held liable for any damages
* arising from the use of this software.
*
* Permission is granted for non-commercial use only.
*
* No redistribution. No modifications.
*/
#include "craptev1.h"
static uint8_t halfsum[2][1 << 20];
static uint8_t filterflip[1 << 20];
static uint8_t filterlut[1 << 20];
static uint32_t hsum_off[2][0x89];
static double prob[257];
void __attribute__((constructor)) craptev1_init() {
uint32_t i, j, s, t, p, q;
uint32_t esum, osum;
uint64_t ocnt[9] = {0}, ecnt[9] = {0};
if(**halfsum)
return;
for(i = 0; i < 1 << 20; i++) {
osum = esum = 0;
for(j = 0; j < 1 << 4; j++) {
s = i << 4 | j;
t = filter(s) ^ filter(s >> 1) ^ filter(s >> 2) ^ filter(s >> 3);
osum += t ^ filter(i);
esum += t;
}
halfsum[0][i] = esum >> 1;
halfsum[1][i] = osum >> 1;
ecnt[esum >> 1]++;
ocnt[osum >> 1]++;
filterflip[i] = filter(i) ^ filter(i ^ 1);
filterlut[i] = filter(i);
}
for(p = 0; p < 9; ++p)
for(q = 0; q < 9; ++q)
prob[8 * (4 * p + 4 * q - p * q)] += ecnt[p] * ocnt[q];
for(i = 0; i < 257; ++i)
prob[i] /= 1ull << 40;
for(j = 0; j < 1 << 4; ++j)
for(i = 0; i < 1 << 20; ++i) {
hsum_off[0][halfsum[0][j << 16 | i >> 4] << 4 | halfsum[0][i]]++;
hsum_off[1][halfsum[1][j << 16 | i >> 4] << 4 | halfsum[1][i]]++;
}
}
#define filter(x) (filterlut[(x) & 0xfffff])
#define LF_POLY (0x8708040029CE5C)
#define ROR(x, n) ((x) >> (n) | (x) << (32 - (n)))
#define DIVIDE(s, p) ROR((unsigned)(((int)(s - (p) * 32)) / (int)(4 - (p))), 3)
#define FACTOR(s, p) ((s & 1) || ((p) == 4 ? s == 128 : DIVIDE(s, (p)) < 9))
/** getsum0
* Calculate the sum property at time zero
*/
uint32_t getsum0(uint64_t *nonce) {
uint32_t unique[256] = {0};
uint32_t i, numfound = 0 , sum = 0;
for(i = 0; nonce[i] != -1 && numfound < 256; ++i)
if(!unique[0xff & nonce[i]]) {
sum += parity(0xff & nonce[i]) ^ BIT(nonce[i], 32);
unique[0xff & nonce[i]] = 1;
numfound++;
}
return numfound == 256 ? sum : -1;
}
/** eliminate
* build initial sorted candidate list based on sumproperties
*/
uint32_t* eliminate(uint32_t sum0, uint32_t sum8, uint32_t isodd) {
uint32_t y, yy, *set, p, r, *wrt[0x89] = {0}, *w, irr8 = sum8 >> 1 == 64;
uint8_t *hsum = halfsum[isodd], i, irr0 = sum0 >> 1 == 64;
set = w = malloc((sizeof(uint32_t) << 24) + 4);
for(p = 0; p != 4 && !irr0; p = (p + 1) * 2 % 11)
for(r = 0; r != 4; r = (r + 1) * 2 % 11)
if(FACTOR(sum0, p) && FACTOR(sum8, r))
w = (wrt[p << 4 | r] = w) + hsum_off[isodd][p << 4 | r];
for(r = 0; r != 4 && irr0; r = (r + 1) * 2 % 11)
for(p = 0; p != 4; p = (p + 1) * 2 % 11)
if(FACTOR(sum0, p) && FACTOR(sum8, r))
w = (wrt[p << 4 | r] = w) + hsum_off[isodd][p << 4 | r];
for(p = 0; p != 4; p = (p + 1) * 2 % 11)
if(FACTOR(sum0, p) && FACTOR(sum8, 4))
w = (wrt[p << 4 | 4] = w) + hsum_off[isodd][p << 4 | 4];
for(p = 0; p < 9; p = (p + 1) * 2 % 11)
if(FACTOR(sum0, 4) && FACTOR(sum8, p))
w = (wrt[64 | p] = w) + hsum_off[isodd][64 | p];
for(y = 0; y < 1 << 20; ++y)
for(yy = 0; yy < 1 << 4; ++yy)
if(wrt[i = (p = hsum[yy << 16 | y >> 4]) << 4 | (r = hsum[y])]) {
*wrt[i] = (irr0 ? p == 4 : p) << 28 | (irr8 ? r == 4 : r) << 24;
*wrt[i]++ |= yy << 20 | y;
}
return *w = -1, set;
}
/** differential
* prune more states using filter flips and differential analysis
*/
uint32_t differential(uint32_t *list, uint32_t isodd, uint8_t byte,
uint8_t bbyte, uint16_t bsum8, uint32_t flip) {
uint32_t j, possible, k, invariant, i;
uint32_t y, yprime, lsb, jdiv;
uint32_t *read, *write, bit;
uint8_t *hsum = halfsum[isodd];
if(!flip && (bsum8 & 1)) return 0;
for(i = 0; i < 8 && BIT(byte, i) == BIT(bbyte, i); ++i);
k = (8 - i + !!isodd) >> 1;
for(write = read = list; *read != -1; ++read){
y = *read;
yprime = *read & ~((1 << k) - 1);
for(j = i, jdiv = k; j < 7 + !!isodd; ++j) {
invariant = BIT(byte, j) ^ BIT(bbyte, j);
invariant ^= BIT(y, 2 + jdiv) ^ BIT(yprime, 2 + jdiv);
invariant ^= filter(y >> jdiv) ^ filter(yprime >> jdiv);
if((j & 1) != !!isodd && invariant != 0) break;
j += (j & 1) != !!isodd;
jdiv--;
bit = BIT(y, jdiv);
bit ^= BIT(byte, j) ^ BIT(bbyte, j);
bit ^= BIT(y, 3 + jdiv) ^ BIT(yprime, 3 + jdiv);
bit ^= BIT(y, 4 + jdiv) ^ BIT(yprime, 4 + jdiv);
yprime |= bit << jdiv;
}
for(lsb = possible = 0; lsb < 1 << jdiv; ++lsb){
if(FACTOR(bsum8, hsum[0xfffff & (yprime | lsb)]))
if((flip & 1) == 0 || filterflip[0xfffff & (yprime | lsb)])
if((flip & 2) == 0 || filterflip[0xfffff & (yprime | lsb) >> 1])
if((flip & 4) == 0 || filterflip[0xfffff & (yprime | lsb) >> 2])
if((flip & 16) == 0 || !filterflip[0xfffff & (yprime | lsb)])
if((flip & 32) == 0 || !filterflip[0xfffff & (yprime | lsb) >> 1])
if((flip & 64) == 0 || !filterflip[0xfffff & (yprime | lsb) >> 2])
possible = 1;
}
if(possible) *write++ = y;
}
*write = -1;
return (uint32_t)(read - write);
}
/** binom
* calculate the binomial coefficient
*/
static double binom(uint32_t n, uint32_t k) {
double num = 1.0;
uint32_t i, t = (n - k > k) ? n - k : k;
if(k > n)
return 0;
for(i = t + 1; i <= n; ++i)
num *= i;
for(i = 2; i <= n - t; ++i)
num /= i;
return num;
}
/** predictsum
* passable prediction logic based on hypergeometric distribution
*/
static uint32_t predictsum(uint64_t *nonces, uint8_t byte, uint32_t *conf) {
uint32_t k, K, n, N = 256, bestK = 0, i;
uint8_t seen[256] = {0}, nonceb1, nonceb2;
double num, sum = 0.0, max = 0.0;
for(i = k = n = 0; nonces[i] != -1; ++i){
nonceb1 = nonces[i];
nonceb2 = nonces[i] >> 8;
if(nonceb1 == byte && !seen[nonceb2]) {
seen[nonceb2] = 1;
++n;
k += parity(nonceb2) ^ BIT(nonces[i], 40);
}
}
for(K = 0; K <= 256; K += 1) {
num = binom(K, k) * (binom(N - K, n - k) / binom(N, n));
sum += num * prob[K];
max = (num > max) ? bestK = K, num : max;
}
*conf = 100.0 * max * prob[bestK] / sum + 0.5;
return bestK;
}
/** getpredictions
* guess the sumproperty at time 8 for all possible first 8 bits
*/
uint32_t getpredictions(uint64_t *nonces, int tresh, uint32_t *pred) {
uint32_t i, none = 1, conf, sum8;
for(i = 0; i < 256; ++i){
sum8 = predictsum(nonces, i, &conf);
none &= pred[i] = (conf >= tresh) ? sum8 | conf << 16 : 129;
}
return !none;
}
/** bestb
* poor heuristic to find reasonable base for differential analysis
*/
uint8_t bestb(uint32_t *pred) {
uint32_t i, j, h, k;
uint32_t max = 0;
for(i = 0; i < 256; ++i) {
if(pred[i] & 1) continue;
for(j = 0, h = i; j < 256; ++j) {
if(i == j || (pred[j] & 1)) continue;
for(k = 0; k < 8 && BIT(i, k) == BIT(j, k); ++k);
h += k << 8;
}
max = (h > max) ? h : max;
}
return max;
}
/** findflips
* Detect some filter flip conditions
*/
uint32_t findflips(uint64_t *nonces, uint32_t *flips) {
uint32_t parities[256] = {0};
uint32_t i, status = 0;
for(i = 0; nonces[i] != -1; ++i)
parities[nonces[i] & 0xff] = BIT(nonces[i], 32);
for(i = 0; i < 0x100; ++i){
flips[i] = 0;
flips[i] |= (parities[i] == parities[i ^ 0x80]) << 0;
flips[i] |= (parities[i] == parities[i ^ 0x20]) << 1;
flips[i] |= (parities[i] == parities[i ^ 0x08]) << 2;
flips[i] |= (parities[i] == parities[i ^ 0x40]) << 8;
flips[i] |= (parities[i] == parities[i ^ 0x10]) << 9;
flips[i] |= (parities[i] == parities[i ^ 0x04]) << 10;
status |= flips[i];
}
for(i = 0; i < 0x30; ++i) {
flips[i] |= ((~flips[i] & 0x001) == 0x001) << 4;
flips[i] |= ((~flips[i] & 0x101) == 0x101) << 12;
flips[i] |= ((~flips[i] & 0x103) == 0x103) << 5;
flips[i] |= ((~flips[i] & 0x303) == 0x303) << 13;
flips[i] |= ((~flips[i] & 0x307) == 0x307) << 6;
flips[i] |= ((~flips[i] & 0x707) == 0x707) << 14;
}
for(i = 0; i < 0x100; ++i){
if(status & 1 << 0) flips[i] &= ~0x6066;
if(status & 1 << 1) flips[i] &= ~0x4044;
if(status & 1 << 8) flips[i] &= ~0x6640;
if(status & 1 << 9) flips[i] &= ~0x4400;
if((status & 7) == 7) flips[i] &= ~0x400;
}
return status;
}
static void __lfsr_rollback(uint64_t *s, uint32_t in) {
uint32_t bit, i;
uint64_t state = *s;
for(i = 0; i < 8; ++i) {
bit = state & 1;
state = state >> 32 | (state & 0xffffff) << 31;
bit ^= parity64(LF_POLY & state);
bit ^= in >> (7 - i);
bit ^= filter(state);
state |= (uint64_t)bit << 55;
}
*s = state;
}
static uint8_t inline paritycheck(uint64_t *s, uint32_t in) {
uint32_t feedin, i;
uint8_t ret = in >> 8;
for(i = 0; i < 8; ++i) {
ret ^= feedin = filter(*s);
feedin ^= parity64(LF_POLY & *s) ^ in >> i;
*s = *s << 32 | (uint32_t)(*s >> 31);
*s &= ~1ull;
*s |= feedin & 1;
}
return ret ^ filter(*s);
}
#define FOR_EACH_BYTE(X) (X) && (X) && (X) && (X)
uint64_t brute(uint32_t **task) {
uint32_t *oe = task[2], *p, i;
uint64_t *e, *eb, *ee, savestate, state, o, key;
eb = ee = malloc((1 << 20) + sizeof(uint64_t) * (task[4] - task[3]));
for(p = task[3]; p < task[4]; ++p) {
*ee = (uint64_t)*p << 32;
__lfsr_rollback(ee++, **task);
}
for(; task[1] < oe; ++task[1]) {
o = *task[1];
__lfsr_rollback(&o, 0);
for(e = eb; e < ee; ++e) {
state = savestate = o ^ *e;
i = 0;
p = task[0] + 10;
while(FOR_EACH_BYTE(!paritycheck(&state, *p++))) {
state = savestate;
if(++i == 100) goto out;
}
}
}
free(eb);
return -1;
out:
free(eb);
for(key = 0, i = 23; i < 24; --i)
key = key << 2 | BIT(state, i ^ 3) << 1 | BIT(state, 32 | (i ^ 3));
return key;
}
/** sumsplit
* Split sorted list of candidates into ranges. Based on msb.
*/
void sumsplit(uint32_t *list, uint32_t **ranges, uint32_t sum0, uint32_t sum8) {
uint32_t *last, p, i;
ranges[*list >> 24] = list;
for(last = list; *last != -1; ++last)
if(!ranges[*last >> 24]) {
ranges[*last >> 24] = last;
ranges[256 | *(last - 1) >> 24] = last;
}
ranges[256 | *(last - 1) >> 24] = last;
for(i = 0, p = 1; i < 16 && sum0 >> 1 == 64; i += p ^= 1)
ranges[p << 8 | 0x20 | i] = ranges[p << 8 | 0x10 | i];
for(i = 0; i < 32 && sum8 >> 1 == 64; ++i)
ranges[i << 4 | 2] = ranges[i << 4 | 1];
for(i = 0; i < 32 && (sum8 & 1); ++i)
ranges[i << 4 | 3] = ranges[i << 4];
}
/** mkspace
* split candidate lists into list of lists by matching halfsums
*/
uint32_t **mkspace(uint32_t *o, uint32_t *e, uint32_t sum0, uint32_t sum8) {
uint32_t *ohead[512] = {0}, **otail = ohead + 256, p, q, r, s;
uint32_t *ehead[512] = {0}, **etail = ehead + 256, **jobs, **j;
sumsplit(o, ohead, sum0, sum8);
sumsplit(e, ehead, sum0, sum8);
j = 1024 + (jobs = malloc(sizeof(uint32_t*) << 14));
*j++ = o;
*j++ = e;
for(p = 0; p != 4; p = (p + 1) * 2 % 11) {
for(r = 0; r != 4; r = (r + 1) * 2 % 11) {
q = (sum0 >> 1 == 64) ? !(p & 1) : DIVIDE(sum0, p);
s = (sum8 >> 1 == 64) ? !(r & 1) : DIVIDE(sum8, r);
if(q < 9 && s < 9 && ohead[p << 4 | r] && ehead[q << 4 | s]) {
*j++ = (uint32_t*)jobs;
*j++ = ohead[p << 4 | r];
*j++ = otail[p << 4 | r];
*j++ = ehead[q << 4 | s];
*j++ = etail[q << 4 | s];
}
}
}
return *j = 0, jobs;
}
/** craptev1_get_space
* Derive reduced search space from list of nested nonces.
* - returns a zero terminated list of partitions (5 pointers each)
* add 5 to the return value to get a pointer to the second partition.
* - uid is stored for use by search functions, it can be omitted.
*/
uint32_t** craptev1_get_space(uint64_t *nonces, uint32_t tresh, uint32_t uid) {
uint32_t sum0, sum8, pred[256], haspred, flips[256];
uint32_t *olist, *elist, i, **space, byte, *pre, b;
uint64_t t;
sum0 = getsum0(nonces);
if(sum0 == -1) return 0;
haspred = getpredictions(nonces, tresh, pred);
byte = haspred ? bestb(pred): 0xa5;
sum8 = pred[byte] & 0xffff;
findflips(nonces, flips);
olist = eliminate(sum0, sum8, 1);
elist = eliminate(sum0, sum8, 0);
for(i = 0; i < 256; ++i) {
differential(olist, 1, byte, i, pred[i], flips[i] & 255);
differential(elist, 0, byte, i, pred[i], flips[i] >> 8);
}
space = mkspace(olist, elist, sum0, sum8);
pre = (uint32_t*)space;
pre[0] = byte ^ uid >> 24;
pre[1] = uid;
for(i = 0, pre += 10; i < 400;)
for(b = 24, t = *nonces++; b < 32; b -= 8, t >>= 8, ++i)
pre[i] = parity((t ^ t >> 32) & 255) << 8 | ((t ^ uid >> b) & 255);
return space + 1026;
}
/** craptev1_sizeof_space
* Calculate the size of the search space
*/
uint64_t craptev1_sizeof_space(uint32_t **space) {
uint64_t i, c = 0, o, e;
for(i = 0; space[i]; i += 5) {
o = space[i + 2] - space[i + 1];
e = space[i + 4] - space[i + 3];
c += o * e;
}
return c;
}
/** craptev1_destroy_space
* Free all memory associated with a search space.
*/
void craptev1_destroy_space(uint32_t **space) {
free(*--space);
free(*--space);
free(space - 1024);
}
/** craptev1_search_partition
* Search one partition of the search space. Return key if found.
*/
uint64_t craptev1_search_partition(uint32_t **partition) {
return brute(partition);
}
/** craptev1_search_space
* Search entire search space.Return key if found.
*/
uint64_t craptev1_search_space(uint32_t **space) {
uint64_t i, key = -1;
for(i = 0; space[i] && key == -1; i += 5)
key = brute(space + i);
return key;
}

49
craptev1-v1.1/craptev1.h Normal file
View File

@ -0,0 +1,49 @@
/**
* CraptEV1
* Copyright (c) 2015-2016 blapost@gmail.com
*
* This software is provided 'as-is', without any express or implied
* warranty. In no event will the authors be held liable for any damages
* arising from the use of this software.
*
* Permission is granted for non-commercial use only.
*
* No redistribution. No modifications.
*/
#ifndef CRAPTEV1_INCLUDED
#define CRAPTEV1_INCLUDED
#include <stdlib.h>
#include <inttypes.h>
#ifdef __cplusplus
extern "C" {
#endif
void craptev1_init();
uint32_t** craptev1_get_space(uint64_t *nonces, uint32_t tresh, uint32_t uid);
uint64_t craptev1_sizeof_space(uint32_t **space);
void craptev1_destroy_space(uint32_t **space);
uint64_t craptev1_search_partition(uint32_t **partition);
uint64_t craptev1_search_space(uint32_t **space);
#define parity(n) (__builtin_popcountl(n) & 1)
#define parity64(n) __builtin_popcountll(n)
#define BIT(x, n) ((x) >> (n) & 1)
static inline int filter(uint32_t const x) {
uint32_t f;
f = 0xf22c0 >> (x & 0xf) & 16;
f |= 0x6c9c0 >> (x >> 4 & 0xf) & 8;
f |= 0x3c8b0 >> (x >> 8 & 0xf) & 4;
f |= 0x1e458 >> (x >> 12 & 0xf) & 2;
f |= 0x0d938 >> (x >> 16 & 0xf) & 1;
return BIT(0xEC57E80A, f);
}
#ifdef __cplusplus
}
#endif
#endif

19
craptev1-v1.1/readme Normal file
View File

@ -0,0 +1,19 @@
CRAPTEV1
--------
Partial implementation of attacks detailed in:
Ciphertext-only Cryptanalysis on Hardened Mifare Classic Cards
URL: http://www.cs.ru.nl/~rverdult/Ciphertext-only_Cryptanalysis_on_Hardened_Mifare_Classic_Cards-CCS_2015.pdf
Carlo Meijer(The Kerckhoffs Institute), Roel Verdult (Radboud University)
carlo@youcontent.nl, rverdult@cs.ru.nl
Authors of the paper are not authors of the code.
contents
--------
craptev1.c : main implementation library
craptev1.h : defines interface, and parity functions
solve.c : a demo linux x86_64 client
bla,
blapost@gmail.com

122
craptev1-v1.1/solve.c Normal file
View File

@ -0,0 +1,122 @@
/**
* CraptEV1
* Copyright (c) 2015-2016 blapost@gmail.com
*
* This software is provided 'as-is', without any express or implied
* warranty. In no event will the authors be held liable for any damages
* arising from the use of this software.
*
* Permission is granted for non-commercial use only.
*
* No redistribution. No modifications.
*/
#define _GNU_SOURCE
#include "craptev1.h"
#include <stdio.h>
#include <unistd.h>
#include <sched.h>
#include <signal.h>
#include <sys/mman.h>
#include <linux/futex.h>
#include <sys/syscall.h>
#include <sys/sysinfo.h>
uint32_t **job;
uint64_t origsize;
void progress(int sig){
uint64_t left = craptev1_sizeof_space(job);
double p = (origsize - left) * 100.0 / origsize;
printf("\x1b[2K\x1b[G""%.2f%% done", p);
fflush(stdout);
alarm(1);
}
void progress_init(uint32_t **space){
origsize = craptev1_sizeof_space(job = space);
signal(SIGALRM, progress);
alarm(1);
}
int active;
int tmain(void *task){
uint64_t key = craptev1_search_partition(task);
if(key != -1) {
alarm(0);
printf("\nFOUND: %"PRIx64"\n", key);
exit(1);
}
__sync_sub_and_fetch(&active, 1);
syscall(__NR_futex, &active, FUTEX_WAKE, 1);
syscall(__NR_exit, 0);
return 0;
}
#define CLONE_FLAGS (CLONE_SIGHAND | CLONE_FS | CLONE_VM | CLONE_FILES | CLONE_THREAD | CLONE_SYSVSEM)
void multithread(uint32_t **space, int maxthread) {
char *stack;
int j;
for(j = 0; space[j * 5]; ++j) {
__sync_add_and_fetch(&active, 1);
stack = mmap(0, 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
clone(tmain, stack + 4092, CLONE_FLAGS, space + j * 5);
syscall(__NR_futex, &active, FUTEX_WAIT, maxthread, 0);
}
while((j = active))
syscall(__NR_futex, &active, FUTEX_WAIT, j, 0);
}
uint64_t *readnonces(char* fname) {
int i, j, r;
FILE *f = fopen(fname, "r");
uint64_t *nonces = malloc(sizeof (uint64_t) << 24);
uint32_t byte;
char parities;
for(i = 0; !feof(f); ++i) {
for(j = nonces[i] = 0; j < 4; ++j) {
r = fscanf(f, "%02x%c ", &byte, &parities);
if(r != 2) {
fprintf(stderr, "Input parse error pos:%ld\n", ftell(f));
fflush(stderr);
abort();
}
parities = (parities == '!') ^ parity(byte);
nonces[i] |= byte << 8 * j;
nonces[i] |= ((uint64_t)parities) << (32 + j * 8);
}
}
nonces[i] = -1;
fclose(f);
return nonces;
}
void usage(char *exename) {
printf("Usage:\n\t%s -f [filename] -u [uid] [-t treshold] [-n threads]\n\n", exename);
_exit(0);
}
int main(int argc, char**argv) {
uint64_t *nonces = 0, c;
uint32_t **space, uid = 0, tresh = 95;
int option, max_thread = get_nprocs_conf();
while((option = getopt(argc, argv, "f:u:n:t:")) != -1 )
switch(option) {
case 'f': nonces = readnonces(optarg); break;
case 'u': uid = strtoul(optarg, 0, 16); break;
case 'n': max_thread = atoi(optarg); break;
case 't': tresh = atoi(optarg); break;
default: usage(argv[0]);
}
if(optind != argc || nonces == 0)
usage(*argv);
space = craptev1_get_space(nonces, tresh, uid);
c = craptev1_sizeof_space(space);
printf("Leftover complexity: %"PRIx64"\n", c);
progress_init(space);
multithread(space, max_thread);
craptev1_destroy_space(space);
return 0;
}

479
crapto1-v3.3/crapto1.c Executable file
View File

@ -0,0 +1,479 @@
/* crapto1.c
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor,
Boston, MA 02110-1301, US$
Copyright (C) 2008-2014 bla <blapost@gmail.com>
*/
#include "crapto1.h"
#include <stdlib.h>
#if !defined LOWMEM && defined __GNUC__
static uint8_t filterlut[1 << 20];
static void __attribute__((constructor)) fill_lut()
{
uint32_t i;
for(i = 0; i < 1 << 20; ++i)
filterlut[i] = filter(i);
}
#define filter(x) (filterlut[(x) & 0xfffff])
#endif
static void quicksort(uint32_t* const start, uint32_t* const stop)
{
uint32_t *it = start + 1, *rit = stop, t;
if(it > rit)
return;
while(it < rit)
if(*it <= *start)
++it;
else if(*rit > *start)
--rit;
else
t = *it, *it = *rit, *rit = t;
if(*rit >= *start)
--rit;
if(rit != start)
t = *rit, *rit = *start, *start = t;
quicksort(start, rit - 1);
quicksort(rit + 1, stop);
}
/** binsearch
* Binary search for the first occurence of *stop's MSB in sorted [start,stop]
*/
static inline uint32_t* binsearch(uint32_t *start, uint32_t *stop)
{
uint32_t mid, val = *stop & 0xff000000;
while(start != stop)
if(start[mid = (stop - start) >> 1] > val)
stop = &start[mid];
else
start += mid + 1;
return start;
}
/** update_contribution
* helper, calculates the partial linear feedback contributions and puts in MSB
*/
static inline void
update_contribution(uint32_t *item, const uint32_t mask1, const uint32_t mask2)
{
uint32_t p = *item >> 25;
p = p << 1 | parity(*item & mask1);
p = p << 1 | parity(*item & mask2);
*item = p << 24 | (*item & 0xffffff);
}
/** extend_table
* using a bit of the keystream extend the table of possible lfsr states
*/
static inline void
extend_table(uint32_t *tbl, uint32_t **end, int bit, int m1, int m2, uint32_t in)
{
in <<= 24;
for(*tbl <<= 1; tbl <= *end; *++tbl <<= 1)
if(filter(*tbl) ^ filter(*tbl | 1)) {
*tbl |= filter(*tbl) ^ bit;
update_contribution(tbl, m1, m2);
*tbl ^= in;
} else if(filter(*tbl) == bit) {
*++*end = tbl[1];
tbl[1] = tbl[0] | 1;
update_contribution(tbl, m1, m2);
*tbl++ ^= in;
update_contribution(tbl, m1, m2);
*tbl ^= in;
} else
*tbl-- = *(*end)--;
}
/** extend_table_simple
* using a bit of the keystream extend the table of possible lfsr states
*/
static inline void extend_table_simple(uint32_t *tbl, uint32_t **end, int bit)
{
for(*tbl <<= 1; tbl <= *end; *++tbl <<= 1)
if(filter(*tbl) ^ filter(*tbl | 1))
*tbl |= filter(*tbl) ^ bit;
else if(filter(*tbl) == bit) {
*++*end = *++tbl;
*tbl = tbl[-1] | 1;
} else
*tbl-- = *(*end)--;
}
/** recover
* recursively narrow down the search space, 4 bits of keystream at a time
*/
static struct Crypto1State*
recover(uint32_t *o_head, uint32_t *o_tail, uint32_t oks,
uint32_t *e_head, uint32_t *e_tail, uint32_t eks, int rem,
struct Crypto1State *sl, uint32_t in)
{
uint32_t *o, *e, i;
if(rem == -1) {
for(e = e_head; e <= e_tail; ++e) {
*e = *e << 1 ^ parity(*e & LF_POLY_EVEN) ^ !!(in & 4);
for(o = o_head; o <= o_tail; ++o, ++sl) {
sl->even = *o;
sl->odd = *e ^ parity(*o & LF_POLY_ODD);
sl[1].odd = sl[1].even = 0;
}
}
return sl;
}
for(i = 0; i < 4 && rem--; i++) {
oks >>= 1;
eks >>= 1;
in >>= 2;
extend_table(o_head, &o_tail, oks & 1, LF_POLY_EVEN << 1 | 1,
LF_POLY_ODD << 1, 0);
if(o_head > o_tail)
return sl;
extend_table(e_head, &e_tail, eks & 1, LF_POLY_ODD,
LF_POLY_EVEN << 1 | 1, in & 3);
if(e_head > e_tail)
return sl;
}
quicksort(o_head, o_tail);
quicksort(e_head, e_tail);
while(o_tail >= o_head && e_tail >= e_head)
if(((*o_tail ^ *e_tail) >> 24) == 0) {
o_tail = binsearch(o_head, o = o_tail);
e_tail = binsearch(e_head, e = e_tail);
sl = recover(o_tail--, o, oks,
e_tail--, e, eks, rem, sl, in);
}
else if(*o_tail > *e_tail)
o_tail = binsearch(o_head, o_tail) - 1;
else
e_tail = binsearch(e_head, e_tail) - 1;
return sl;
}
/** lfsr_recovery
* recover the state of the lfsr given 32 bits of the keystream
* additionally you can use the in parameter to specify the value
* that was fed into the lfsr at the time the keystream was generated
*/
struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in)
{
struct Crypto1State *statelist;
uint32_t *odd_head = 0, *odd_tail = 0, oks = 0;
uint32_t *even_head = 0, *even_tail = 0, eks = 0;
int i;
for(i = 31; i >= 0; i -= 2)
oks = oks << 1 | BEBIT(ks2, i);
for(i = 30; i >= 0; i -= 2)
eks = eks << 1 | BEBIT(ks2, i);
odd_head = odd_tail = malloc(sizeof(uint32_t) << 21);
even_head = even_tail = malloc(sizeof(uint32_t) << 21);
statelist = malloc(sizeof(struct Crypto1State) << 18);
if(!odd_tail-- || !even_tail-- || !statelist) {
free(statelist);
statelist = 0;
goto out;
}
statelist->odd = statelist->even = 0;
for(i = 1 << 20; i >= 0; --i) {
if(filter(i) == (oks & 1))
*++odd_tail = i;
if(filter(i) == (eks & 1))
*++even_tail = i;
}
for(i = 0; i < 4; i++) {
extend_table_simple(odd_head, &odd_tail, (oks >>= 1) & 1);
extend_table_simple(even_head, &even_tail, (eks >>= 1) & 1);
}
in = (in >> 16 & 0xff) | (in << 16) | (in & 0xff00);
recover(odd_head, odd_tail, oks,
even_head, even_tail, eks, 11, statelist, in << 1);
out:
free(odd_head);
free(even_head);
return statelist;
}
static const uint32_t S1[] = { 0x62141, 0x310A0, 0x18850, 0x0C428, 0x06214,
0x0310A, 0x85E30, 0xC69AD, 0x634D6, 0xB5CDE, 0xDE8DA, 0x6F46D, 0xB3C83,
0x59E41, 0xA8995, 0xD027F, 0x6813F, 0x3409F, 0x9E6FA};
static const uint32_t S2[] = { 0x3A557B00, 0x5D2ABD80, 0x2E955EC0, 0x174AAF60,
0x0BA557B0, 0x05D2ABD8, 0x0449DE68, 0x048464B0, 0x42423258, 0x278192A8,
0x156042D0, 0x0AB02168, 0x43F89B30, 0x61FC4D98, 0x765EAD48, 0x7D8FDD20,
0x7EC7EE90, 0x7F63F748, 0x79117020};
static const uint32_t T1[] = {
0x4F37D, 0x279BE, 0x97A6A, 0x4BD35, 0x25E9A, 0x12F4D, 0x097A6, 0x80D66,
0xC4006, 0x62003, 0xB56B4, 0x5AB5A, 0xA9318, 0xD0F39, 0x6879C, 0xB057B,
0x582BD, 0x2C15E, 0x160AF, 0x8F6E2, 0xC3DC4, 0xE5857, 0x72C2B, 0x39615,
0x98DBF, 0xC806A, 0xE0680, 0x70340, 0x381A0, 0x98665, 0x4C332, 0xA272C};
static const uint32_t T2[] = { 0x3C88B810, 0x5E445C08, 0x2982A580, 0x14C152C0,
0x4A60A960, 0x253054B0, 0x52982A58, 0x2FEC9EA8, 0x1156C4D0, 0x08AB6268,
0x42F53AB0, 0x217A9D58, 0x161DC528, 0x0DAE6910, 0x46D73488, 0x25CB11C0,
0x52E588E0, 0x6972C470, 0x34B96238, 0x5CFC3A98, 0x28DE96C8, 0x12CFC0E0,
0x4967E070, 0x64B3F038, 0x74F97398, 0x7CDC3248, 0x38CE92A0, 0x1C674950,
0x0E33A4A8, 0x01B959D0, 0x40DCACE8, 0x26CEDDF0};
static const uint32_t C1[] = { 0x846B5, 0x4235A, 0x211AD};
static const uint32_t C2[] = { 0x1A822E0, 0x21A822E0, 0x21A822E0};
/** Reverse 64 bits of keystream into possible cipher states
* Variation mentioned in the paper. Somewhat optimized version
*/
struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3)
{
struct Crypto1State *statelist, *sl;
uint8_t oks[32], eks[32], hi[32];
uint32_t low = 0, win = 0;
uint32_t *tail, table[1 << 16];
int i, j;
sl = statelist = malloc(sizeof(struct Crypto1State) << 4);
if(!sl)
return 0;
sl->odd = sl->even = 0;
for(i = 30; i >= 0; i -= 2) {
oks[i >> 1] = BEBIT(ks2, i);
oks[16 + (i >> 1)] = BEBIT(ks3, i);
}
for(i = 31; i >= 0; i -= 2) {
eks[i >> 1] = BEBIT(ks2, i);
eks[16 + (i >> 1)] = BEBIT(ks3, i);
}
for(i = 0xfffff; i >= 0; --i) {
if (filter(i) != oks[0])
continue;
*(tail = table) = i;
for(j = 1; tail >= table && j < 29; ++j)
extend_table_simple(table, &tail, oks[j]);
if(tail < table)
continue;
for(j = 0; j < 19; ++j)
low = low << 1 | parity(i & S1[j]);
for(j = 0; j < 32; ++j)
hi[j] = parity(i & T1[j]);
for(; tail >= table; --tail) {
for(j = 0; j < 3; ++j) {
*tail = *tail << 1;
*tail |= parity((i & C1[j]) ^ (*tail & C2[j]));
if(filter(*tail) != oks[29 + j])
goto continue2;
}
for(j = 0; j < 19; ++j)
win = win << 1 | parity(*tail & S2[j]);
win ^= low;
for(j = 0; j < 32; ++j) {
win = win << 1 ^ hi[j] ^ parity(*tail & T2[j]);
if(filter(win) != eks[j])
goto continue2;
}
*tail = *tail << 1 | parity(LF_POLY_EVEN & *tail);
sl->odd = *tail ^ parity(LF_POLY_ODD & win);
sl->even = win;
++sl;
sl->odd = sl->even = 0;
continue2:;
}
}
return statelist;
}
/** lfsr_rollback_bit
* Rollback the shift register in order to get previous states
*/
uint8_t lfsr_rollback_bit(struct Crypto1State *s, uint32_t in, int fb)
{
int out;
uint8_t ret;
uint32_t t;
s->odd &= 0xffffff;
t = s->odd, s->odd = s->even, s->even = t;
out = s->even & 1;
out ^= LF_POLY_EVEN & (s->even >>= 1);
out ^= LF_POLY_ODD & s->odd;
out ^= !!in;
out ^= (ret = filter(s->odd)) & !!fb;
s->even |= parity(out) << 23;
return ret;
}
/** lfsr_rollback_byte
* Rollback the shift register in order to get previous states
*/
uint8_t lfsr_rollback_byte(struct Crypto1State *s, uint32_t in, int fb)
{
int i, ret = 0;
for (i = 7; i >= 0; --i)
ret |= lfsr_rollback_bit(s, BIT(in, i), fb) << i;
return ret;
}
/** lfsr_rollback_word
* Rollback the shift register in order to get previous states
*/
uint32_t lfsr_rollback_word(struct Crypto1State *s, uint32_t in, int fb)
{
int i;
uint32_t ret = 0;
for (i = 31; i >= 0; --i)
ret |= lfsr_rollback_bit(s, BEBIT(in, i), fb) << (i ^ 24);
return ret;
}
/** nonce_distance
* x,y valid tag nonces, then prng_successor(x, nonce_distance(x, y)) = y
*/
static uint16_t *dist = 0;
int nonce_distance(uint32_t from, uint32_t to)
{
uint16_t x, i;
if(!dist) {
dist = malloc(2 << 16);
if(!dist)
return -1;
for (x = i = 1; i; ++i) {
dist[(x & 0xff) << 8 | x >> 8] = i;
x = x >> 1 | (x ^ x >> 2 ^ x >> 3 ^ x >> 5) << 15;
}
}
return (65535 + dist[to >> 16] - dist[from >> 16]) % 65535;
}
static uint32_t fastfwd[2][8] = {
{ 0, 0x4BC53, 0xECB1, 0x450E2, 0x25E29, 0x6E27A, 0x2B298, 0x60ECB},
{ 0, 0x1D962, 0x4BC53, 0x56531, 0xECB1, 0x135D3, 0x450E2, 0x58980}};
/** lfsr_prefix_ks
*
* Is an exported helper function from the common prefix attack
* Described in the "dark side" paper. It returns an -1 terminated array
* of possible partial(21 bit) secret state.
* The required keystream(ks) needs to contain the keystream that was used to
* encrypt the NACK which is observed when varying only the 3 last bits of Nr
* only correct iff [NR_3] ^ NR_3 does not depend on Nr_3
*/
uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd)
{
uint32_t c, entry, *candidates = malloc(4 << 10);
int i, size = 0, good;
if(!candidates)
return 0;
for(i = 0; i < 1 << 21; ++i) {
for(c = 0, good = 1; good && c < 8; ++c) {
entry = i ^ fastfwd[isodd][c];
good &= (BIT(ks[c], isodd) == filter(entry >> 1));
good &= (BIT(ks[c], isodd + 2) == filter(entry));
}
if(good)
candidates[size++] = i;
}
candidates[size] = -1;
return candidates;
}
/** check_pfx_parity
* helper function which eliminates possible secret states using parity bits
*/
static struct Crypto1State*
check_pfx_parity(uint32_t prefix, uint32_t rresp, uint8_t parities[8][8],
uint32_t odd, uint32_t even, struct Crypto1State* sl)
{
uint32_t ks1, nr, ks2, rr, ks3, c, good = 1;
for(c = 0; good && c < 8; ++c) {
sl->odd = odd ^ fastfwd[1][c];
sl->even = even ^ fastfwd[0][c];
lfsr_rollback_bit(sl, 0, 0);
lfsr_rollback_bit(sl, 0, 0);
ks3 = lfsr_rollback_bit(sl, 0, 0);
ks2 = lfsr_rollback_word(sl, 0, 0);
ks1 = lfsr_rollback_word(sl, prefix | c << 5, 1);
nr = ks1 ^ (prefix | c << 5);
rr = ks2 ^ rresp;
good &= parity(nr & 0x000000ff) ^ parities[c][3] ^ BIT(ks2, 24);
good &= parity(rr & 0xff000000) ^ parities[c][4] ^ BIT(ks2, 16);
good &= parity(rr & 0x00ff0000) ^ parities[c][5] ^ BIT(ks2, 8);
good &= parity(rr & 0x0000ff00) ^ parities[c][6] ^ BIT(ks2, 0);
good &= parity(rr & 0x000000ff) ^ parities[c][7] ^ ks3;
}
return sl + good;
}
/** lfsr_common_prefix
* Implentation of the common prefix attack.
*/
struct Crypto1State*
lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8])
{
struct Crypto1State *statelist, *s;
uint32_t *odd, *even, *o, *e, top;
odd = lfsr_prefix_ks(ks, 1);
even = lfsr_prefix_ks(ks, 0);
s = statelist = malloc((sizeof *statelist) << 20);
if(!s || !odd || !even) {
free(statelist);
statelist = 0;
goto out;
}
for(o = odd; *o + 1; ++o)
for(e = even; *e + 1; ++e)
for(top = 0; top < 64; ++top) {
*o += 1 << 21;
*e += (!(top & 7) + 1) << 21;
s = check_pfx_parity(pfx, rr, par, *o, *e, s);
}
s->odd = s->even = 0;
out:
free(odd);
free(even);
return statelist;
}

93
crapto1-v3.3/crapto1.h Executable file
View File

@ -0,0 +1,93 @@
/* crapto1.h
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
MA 02110-1301, US$
Copyright (C) 2008-2014 bla <blapost@gmail.com>
*/
#ifndef CRAPTO1_INCLUDED
#define CRAPTO1_INCLUDED
#include <stdint.h>
#ifdef __cplusplus
extern "C" {
#endif
struct Crypto1State {uint32_t odd, even;};
struct Crypto1State* crypto1_create(uint64_t);
void crypto1_destroy(struct Crypto1State*);
void crypto1_get_lfsr(struct Crypto1State*, uint64_t*);
uint8_t crypto1_bit(struct Crypto1State*, uint8_t, int);
uint8_t crypto1_byte(struct Crypto1State*, uint8_t, int);
uint32_t crypto1_word(struct Crypto1State*, uint32_t, int);
uint32_t prng_successor(uint32_t x, uint32_t n);
struct Crypto1State* lfsr_recovery32(uint32_t ks2, uint32_t in);
struct Crypto1State* lfsr_recovery64(uint32_t ks2, uint32_t ks3);
uint32_t *lfsr_prefix_ks(uint8_t ks[8], int isodd);
struct Crypto1State*
lfsr_common_prefix(uint32_t pfx, uint32_t rr, uint8_t ks[8], uint8_t par[8][8]);
uint8_t lfsr_rollback_bit(struct Crypto1State* s, uint32_t in, int fb);
uint8_t lfsr_rollback_byte(struct Crypto1State* s, uint32_t in, int fb);
uint32_t lfsr_rollback_word(struct Crypto1State* s, uint32_t in, int fb);
int nonce_distance(uint32_t from, uint32_t to);
#define FOREACH_VALID_NONCE(N, FILTER, FSIZE)\
uint32_t __n = 0,__M = 0, N = 0;\
int __i;\
for(; __n < 1 << 16; N = prng_successor(__M = ++__n, 16))\
for(__i = FSIZE - 1; __i >= 0; __i--)\
if(BIT(FILTER, __i) ^ parity(__M & 0xFF01))\
break;\
else if(__i)\
__M = prng_successor(__M, (__i == 7) ? 48 : 8);\
else
#define LF_POLY_ODD (0x29CE5C)
#define LF_POLY_EVEN (0x870804)
#define BIT(x, n) ((x) >> (n) & 1)
#define BEBIT(x, n) BIT(x, (n) ^ 24)
static inline int parity(uint32_t x)
{
#if !defined __i386__ || !defined __GNUC__
x ^= x >> 16;
x ^= x >> 8;
x ^= x >> 4;
return BIT(0x6996, x & 0xf);
#else
asm( "movl %1, %%eax\n"
"mov %%ax, %%cx\n"
"shrl $0x10, %%eax\n"
"xor %%ax, %%cx\n"
"xor %%ch, %%cl\n"
"setpo %%al\n"
"movzx %%al, %0\n": "=r"(x) : "r"(x): "eax","ecx");
return x;
#endif
}
static inline int filter(uint32_t const x)
{
uint32_t f;
f = 0xf22c0 >> (x & 0xf) & 16;
f |= 0x6c9c0 >> (x >> 4 & 0xf) & 8;
f |= 0x3c8b0 >> (x >> 8 & 0xf) & 4;
f |= 0x1e458 >> (x >> 12 & 0xf) & 2;
f |= 0x0d938 >> (x >> 16 & 0xf) & 1;
return BIT(0xEC57E80A, f);
}
#ifdef __cplusplus
}
#endif
#endif

93
crapto1-v3.3/crypto1.c Executable file
View File

@ -0,0 +1,93 @@
/* crypto1.c
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
MA 02110-1301, US
Copyright (C) 2008-2008 bla <blapost@gmail.com>
*/
#include "crapto1.h"
#include <stdlib.h>
#define SWAPENDIAN(x)\
(x = (x >> 8 & 0xff00ff) | (x & 0xff00ff) << 8, x = x >> 16 | x << 16)
struct Crypto1State * crypto1_create(uint64_t key)
{
struct Crypto1State *s = malloc(sizeof(*s));
int i;
for(i = 47;s && i > 0; i -= 2) {
s->odd = s->odd << 1 | BIT(key, (i - 1) ^ 7);
s->even = s->even << 1 | BIT(key, i ^ 7);
}
return s;
}
void crypto1_destroy(struct Crypto1State *state)
{
free(state);
}
void crypto1_get_lfsr(struct Crypto1State *state, uint64_t *lfsr)
{
int i;
for(*lfsr = 0, i = 23; i >= 0; --i) {
*lfsr = *lfsr << 1 | BIT(state->odd, i ^ 3);
*lfsr = *lfsr << 1 | BIT(state->even, i ^ 3);
}
}
uint8_t crypto1_bit(struct Crypto1State *s, uint8_t in, int is_encrypted)
{
uint32_t feedin;
uint8_t ret = filter(s->odd);
feedin = ret & !!is_encrypted;
feedin ^= !!in;
feedin ^= LF_POLY_ODD & s->odd;
feedin ^= LF_POLY_EVEN & s->even;
s->even = s->even << 1 | parity(feedin);
s->odd ^= (s->odd ^= s->even, s->even ^= s->odd);
return ret;
}
uint8_t crypto1_byte(struct Crypto1State *s, uint8_t in, int is_encrypted)
{
uint8_t i, ret = 0;
for (i = 0; i < 8; ++i)
ret |= crypto1_bit(s, BIT(in, i), is_encrypted) << i;
return ret;
}
uint32_t crypto1_word(struct Crypto1State *s, uint32_t in, int is_encrypted)
{
uint32_t i, ret = 0;
for (i = 0; i < 32; ++i)
ret |= crypto1_bit(s, BEBIT(in, i), is_encrypted) << (i ^ 24);
return ret;
}
/* prng_successor
* helper used to obscure the keystream during authentication
*/
uint32_t prng_successor(uint32_t x, uint32_t n)
{
SWAPENDIAN(x);
while(n--)
x = x >> 1 | (x >> 16 ^ x >> 18 ^ x >> 19 ^ x >> 21) << 31;
return SWAPENDIAN(x);
}

27
crapto1-v3.3/readme Executable file
View File

@ -0,0 +1,27 @@
CRAPTO1
-------
Provides a set of library functions which aid the verification
of crypto1 weaknesses.
In short a partial implementation of:
Dismantling MIFARE Classic
URL: http://www.sos.cs.ru.nl/applications/rfid/2008-esorics.pdf
Flavio D. Garcia, Gerhard de Koning Gans, Ruben Muijrers,
Peter van Rossum, Roel Verdult, Ronny Wichers Schreur, Bart Jacobs
Institute for Computing and Information Sciences,
Radboud University Nijmegen, The Netherlands
{{flaviog,petervr,ronny,bart}@cs, {gkoningg,rmuijrer,rverdult}@sci}.ru.nl
and
Wirelessly Pickpocketing a Mifare Classic Card
URL: http://www.cs.ru.nl/~flaviog/publications/Pickpocketing.Mifare.pdf
Flavio D. Garcia, Peter van Rossum, Roel Verdult, Ronny Wichers Schreur
Radboud University Nijmegen, The Netherlands
{flaviog,petervr,rverdult,ronny}@cs.ru.nl
and
THE DARK SIDE OF SECURITY BY OBSCURITY
URL: http://eprint.iacr.org/2009/137
and Cloning MiFare Classic Rail and Building Passes, Anywhere, Anytime
Nicolas T. Courtois
University College London, Computer Science,
Gower street, WC1E 6BT, London, UK