From 7a215e568e6aef872e61187f792c9088328de0a0 Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Mon, 29 Jun 2026 15:26:17 +0200
Subject: [PATCH] eap-aka-3gpp2: Log potentially sensitive material on level 4

Leave stuff that's exchanged publicly (e.g. RAND, AUTN) at level 3.
---
 .../plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c     |  4 ++--
 .../eap_aka_3gpp2/eap_aka_3gpp2_functions.c        | 14 +++++++-------
 .../plugins/eap_aka_3gpp2/eap_aka_3gpp2_provider.c |  2 +-
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/src/libcharon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c b/src/libcharon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c
index f87383c24..1e88f373a 100644
--- a/src/libcharon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c
+++ b/src/libcharon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c
@@ -68,7 +68,7 @@ METHOD(simaka_card_t, get_quintuplet, status_t,
 
 	/* AUTN = SQN xor AK | AMF | MAC */
 	DBG3(DBG_IKE, "received autn %b", autn, AKA_AUTN_LEN);
-	DBG3(DBG_IKE, "using K %b", k, AKA_K_LEN);
+	DBG4(DBG_IKE, "using K %b", k, AKA_K_LEN);
 	DBG3(DBG_IKE, "using rand %b", rand, AKA_RAND_LEN);
 	memcpy(sqn, autn, AKA_SQN_LEN);
 	amf = autn + AKA_SQN_LEN;
@@ -79,7 +79,7 @@ METHOD(simaka_card_t, get_quintuplet, status_t,
 	{
 		return FAILED;
 	}
-	DBG3(DBG_IKE, "using ak %b", ak, AKA_AK_LEN);
+	DBG4(DBG_IKE, "using ak %b", ak, AKA_AK_LEN);
 	memxor(sqn, ak, AKA_SQN_LEN);
 	DBG3(DBG_IKE, "using sqn %b", sqn, AKA_SQN_LEN);
 
diff --git a/src/libcharon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_functions.c b/src/libcharon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_functions.c
index f34c5ca01..92403f361 100644
--- a/src/libcharon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_functions.c
+++ b/src/libcharon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_functions.c
@@ -304,7 +304,7 @@ METHOD(eap_aka_3gpp2_functions_t, f1, bool,
 {
 	if (f1x(this->prf, F1, k, rand, sqn, amf, mac))
 	{
-		DBG3(DBG_IKE, "MAC %b", mac, AKA_MAC_LEN);
+		DBG4(DBG_IKE, "MAC %b", mac, AKA_MAC_LEN);
 		return TRUE;
 	}
 	return FALSE;
@@ -320,7 +320,7 @@ METHOD(eap_aka_3gpp2_functions_t, f1star, bool,
 {
 	if (f1x(this->prf, F1STAR, k, rand, sqn, amf, macs))
 	{
-		DBG3(DBG_IKE, "MACS %b", macs, AKA_MAC_LEN);
+		DBG4(DBG_IKE, "MACS %b", macs, AKA_MAC_LEN);
 		return TRUE;
 	}
 	return FALSE;
@@ -335,7 +335,7 @@ METHOD(eap_aka_3gpp2_functions_t, f2, bool,
 {
 	if (fx(this->prf, F2, k, rand, res))
 	{
-		DBG3(DBG_IKE, "RES %b", res, AKA_RES_MAX);
+		DBG4(DBG_IKE, "RES %b", res, AKA_RES_MAX);
 		return TRUE;
 	}
 	return FALSE;
@@ -350,7 +350,7 @@ METHOD(eap_aka_3gpp2_functions_t, f3, bool,
 {
 	if (fx(this->prf, F3, k, rand, ck))
 	{
-		DBG3(DBG_IKE, "CK %b", ck, AKA_CK_LEN);
+		DBG4(DBG_IKE, "CK %b", ck, AKA_CK_LEN);
 		return TRUE;
 	}
 	return FALSE;
@@ -365,7 +365,7 @@ METHOD(eap_aka_3gpp2_functions_t, f4, bool,
 {
 	if (fx(this->prf, F4, k, rand, ik))
 	{
-		DBG3(DBG_IKE, "IK %b", ik, AKA_IK_LEN);
+		DBG4(DBG_IKE, "IK %b", ik, AKA_IK_LEN);
 		return TRUE;
 	}
 	return FALSE;
@@ -380,7 +380,7 @@ METHOD(eap_aka_3gpp2_functions_t, f5, bool,
 {
 	if (f5x(this->prf, F5, k, rand, ak))
 	{
-		DBG3(DBG_IKE, "AK %b", ak, AKA_AK_LEN);
+		DBG4(DBG_IKE, "AK %b", ak, AKA_AK_LEN);
 		return TRUE;
 	}
 	return FALSE;
@@ -395,7 +395,7 @@ METHOD(eap_aka_3gpp2_functions_t, f5star, bool,
 {
 	if (f5x(this->prf, F5STAR, k, rand, aks))
 	{
-		DBG3(DBG_IKE, "AKS %b", aks, AKA_AK_LEN);
+		DBG4(DBG_IKE, "AKS %b", aks, AKA_AK_LEN);
 		return TRUE;
 	}
 	return FALSE;
diff --git a/src/libcharon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_provider.c b/src/libcharon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_provider.c
index 61c35d4b5..660de59c9 100644
--- a/src/libcharon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_provider.c
+++ b/src/libcharon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_provider.c
@@ -107,7 +107,7 @@ METHOD(simaka_provider_t, get_quintuplet, bool,
 	}
 
 	DBG3(DBG_IKE, "generated rand %b", rand, AKA_RAND_LEN);
-	DBG3(DBG_IKE, "using K %b", k, AKA_K_LEN);
+	DBG4(DBG_IKE, "using K %b", k, AKA_K_LEN);
 
 	/* MAC, AK, XRES as expected from client */
 	if (!this->f->f1(this->f, k, rand, this->sqn, amf_def, mac) ||