The introduced SHA1_NOFINAL hasher was not sufficient for EAP-AKA,

as it requires to XOR the key into the hashers state.
A new SHA1 based keyed hash function, implemented as PRF, enables EAP-AKA
and the FIPS-PRF function to properly use the existing SHA1 implementation.

src/libstrongswan/crypto/hashers/hasher.c

@@ -27,7 +27,6 @@ ENUM(hash_algorithm_names, HASH_UNKNOWN, HASH_SHA512,
 	"HASH_MD2",
 	"HASH_MD5",
 	"HASH_SHA1",
-	"HASH_SHA1_NOFINAL",
 	"HASH_SHA256",
 	"HASH_SHA384",
 	"HASH_SHA512"

src/libstrongswan/crypto/hashers/hasher.h

@@ -41,11 +41,9 @@ enum hash_algorithm_t {
 	HASH_MD2 			= 2,
 	HASH_MD5 			= 3,
 	HASH_SHA1 			= 4,
-	/** special SHA1 which does not run SHA1Final, but copies the state */
-	HASH_SHA1_NOFINAL	= 5,
-	HASH_SHA256 		= 6,
-	HASH_SHA384 		= 7,
-	HASH_SHA512 		= 8,
+	HASH_SHA256 		= 5,
+	HASH_SHA384 		= 6,
+	HASH_SHA512 		= 7,
 };
 
 #define HASH_SIZE_MD2		16

src/libstrongswan/crypto/prfs/prf.c

@@ -18,11 +18,12 @@
 
 #include "prf.h"
 
-ENUM_BEGIN(pseudo_random_function_names, PRF_UNDEFINED, PRF_FIPS_DES,
+ENUM_BEGIN(pseudo_random_function_names, PRF_UNDEFINED, PRF_KEYED_SHA1,
 	"PRF_UNDEFINED",
 	"PRF_FIPS_SHA1_160",
-	"PRF_FIPS_DES");
-ENUM_NEXT(pseudo_random_function_names, PRF_HMAC_MD5, PRF_HMAC_SHA2_512, PRF_FIPS_DES,
+	"PRF_FIPS_DES",
+	"PRF_KEYED_SHA1");
+ENUM_NEXT(pseudo_random_function_names, PRF_HMAC_MD5, PRF_HMAC_SHA2_512, PRF_KEYED_SHA1,
 	"PRF_HMAC_MD5",
 	"PRF_HMAC_SHA1",
 	"PRF_HMAC_TIGER",

src/libstrongswan/crypto/prfs/prf.h

@@ -53,6 +53,11 @@ enum pseudo_random_function_t {
 	PRF_FIPS_SHA1_160 = 1025,
 	/** Could be implemented via fips_prf_t, uses fixed output size of 160bit */
 	PRF_FIPS_DES = 1026,
+	/** 
+	 * Keyed hash algorithm using SHA1, used in EAP-AKA:
+	 * This PRF uses SHA1, but XORs the key into the IV. No "Final()" operation
+	 * is applied to the SHA1 state. */
+	PRF_KEYED_SHA1 = 1027,
 };
 
 /**