mirror of
https://github.com/pineappleEA/pineapple-src.git
synced 2024-12-13 08:58:24 -05:00
384 lines
11 KiB
C
Executable File
384 lines
11 KiB
C
Executable File
/* $OpenBSD: tls13_key_schedule.c,v 1.14 2021/01/05 18:36:22 tb Exp $ */
|
|
/*
|
|
* Copyright (c) 2018, Bob Beck <beck@openbsd.org>
|
|
*
|
|
* Permission to use, copy, modify, and/or distribute this software for any
|
|
* purpose with or without fee is hereby granted, provided that the above
|
|
* copyright notice and this permission notice appear in all copies.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
|
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
|
|
* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
|
|
* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
|
|
* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
*/
|
|
|
|
#include <string.h>
|
|
#include <stdlib.h>
|
|
|
|
#include <openssl/hkdf.h>
|
|
|
|
#include "bytestring.h"
|
|
#include "tls13_internal.h"
|
|
|
|
int
|
|
tls13_secret_init(struct tls13_secret *secret, size_t len)
|
|
{
|
|
if (secret->data != NULL)
|
|
return 0;
|
|
|
|
if ((secret->data = calloc(1, len)) == NULL)
|
|
return 0;
|
|
secret->len = len;
|
|
|
|
return 1;
|
|
}
|
|
|
|
void
|
|
tls13_secret_cleanup(struct tls13_secret *secret)
|
|
{
|
|
freezero(secret->data, secret->len);
|
|
secret->data = NULL;
|
|
secret->len = 0;
|
|
}
|
|
|
|
/*
|
|
* Allocate a set of secrets for a key schedule using
|
|
* a size of hash_length from RFC 8446 section 7.1.
|
|
*/
|
|
struct tls13_secrets *
|
|
tls13_secrets_create(const EVP_MD *digest, int resumption)
|
|
{
|
|
struct tls13_secrets *secrets = NULL;
|
|
EVP_MD_CTX *mdctx = NULL;
|
|
unsigned int mdlen;
|
|
size_t hash_length;
|
|
|
|
hash_length = EVP_MD_size(digest);
|
|
|
|
if ((secrets = calloc(1, sizeof(struct tls13_secrets))) == NULL)
|
|
goto err;
|
|
|
|
if (!tls13_secret_init(&secrets->zeros, hash_length))
|
|
goto err;
|
|
if (!tls13_secret_init(&secrets->empty_hash, hash_length))
|
|
goto err;
|
|
|
|
if (!tls13_secret_init(&secrets->extracted_early, hash_length))
|
|
goto err;
|
|
if (!tls13_secret_init(&secrets->binder_key, hash_length))
|
|
goto err;
|
|
if (!tls13_secret_init(&secrets->client_early_traffic, hash_length))
|
|
goto err;
|
|
if (!tls13_secret_init(&secrets->early_exporter_master, hash_length))
|
|
goto err;
|
|
if (!tls13_secret_init(&secrets->derived_early, hash_length))
|
|
goto err;
|
|
if (!tls13_secret_init(&secrets->extracted_handshake, hash_length))
|
|
goto err;
|
|
if (!tls13_secret_init(&secrets->client_handshake_traffic, hash_length))
|
|
goto err;
|
|
if (!tls13_secret_init(&secrets->server_handshake_traffic, hash_length))
|
|
goto err;
|
|
if (!tls13_secret_init(&secrets->derived_handshake, hash_length))
|
|
goto err;
|
|
if (!tls13_secret_init(&secrets->extracted_master, hash_length))
|
|
goto err;
|
|
if (!tls13_secret_init(&secrets->client_application_traffic, hash_length))
|
|
goto err;
|
|
if (!tls13_secret_init(&secrets->server_application_traffic, hash_length))
|
|
goto err;
|
|
if (!tls13_secret_init(&secrets->exporter_master, hash_length))
|
|
goto err;
|
|
if (!tls13_secret_init(&secrets->resumption_master, hash_length))
|
|
goto err;
|
|
|
|
/*
|
|
* Calculate the hash of a zero-length string - this is needed during
|
|
* the "derived" step for key extraction.
|
|
*/
|
|
if ((mdctx = EVP_MD_CTX_new()) == NULL)
|
|
goto err;
|
|
if (!EVP_DigestInit_ex(mdctx, digest, NULL))
|
|
goto err;
|
|
if (!EVP_DigestUpdate(mdctx, secrets->zeros.data, 0))
|
|
goto err;
|
|
if (!EVP_DigestFinal_ex(mdctx, secrets->empty_hash.data, &mdlen))
|
|
goto err;
|
|
EVP_MD_CTX_free(mdctx);
|
|
mdctx = NULL;
|
|
|
|
if (secrets->empty_hash.len != mdlen)
|
|
goto err;
|
|
|
|
secrets->digest = digest;
|
|
secrets->resumption = resumption;
|
|
secrets->init_done = 1;
|
|
|
|
return secrets;
|
|
|
|
err:
|
|
tls13_secrets_destroy(secrets);
|
|
EVP_MD_CTX_free(mdctx);
|
|
|
|
return NULL;
|
|
}
|
|
|
|
void
|
|
tls13_secrets_destroy(struct tls13_secrets *secrets)
|
|
{
|
|
if (secrets == NULL)
|
|
return;
|
|
|
|
/* you can never be too sure :) */
|
|
tls13_secret_cleanup(&secrets->zeros);
|
|
tls13_secret_cleanup(&secrets->empty_hash);
|
|
|
|
tls13_secret_cleanup(&secrets->extracted_early);
|
|
tls13_secret_cleanup(&secrets->binder_key);
|
|
tls13_secret_cleanup(&secrets->client_early_traffic);
|
|
tls13_secret_cleanup(&secrets->early_exporter_master);
|
|
tls13_secret_cleanup(&secrets->derived_early);
|
|
tls13_secret_cleanup(&secrets->extracted_handshake);
|
|
tls13_secret_cleanup(&secrets->client_handshake_traffic);
|
|
tls13_secret_cleanup(&secrets->server_handshake_traffic);
|
|
tls13_secret_cleanup(&secrets->derived_handshake);
|
|
tls13_secret_cleanup(&secrets->extracted_master);
|
|
tls13_secret_cleanup(&secrets->client_application_traffic);
|
|
tls13_secret_cleanup(&secrets->server_application_traffic);
|
|
tls13_secret_cleanup(&secrets->exporter_master);
|
|
tls13_secret_cleanup(&secrets->resumption_master);
|
|
|
|
freezero(secrets, sizeof(struct tls13_secrets));
|
|
}
|
|
|
|
int
|
|
tls13_hkdf_expand_label(struct tls13_secret *out, const EVP_MD *digest,
|
|
const struct tls13_secret *secret, const char *label,
|
|
const struct tls13_secret *context)
|
|
{
|
|
return tls13_hkdf_expand_label_with_length(out, digest, secret, label,
|
|
strlen(label), context);
|
|
}
|
|
|
|
int
|
|
tls13_hkdf_expand_label_with_length(struct tls13_secret *out,
|
|
const EVP_MD *digest, const struct tls13_secret *secret,
|
|
const uint8_t *label, size_t label_len, const struct tls13_secret *context)
|
|
{
|
|
const char tls13_plabel[] = "tls13 ";
|
|
uint8_t *hkdf_label;
|
|
size_t hkdf_label_len;
|
|
CBB cbb, child;
|
|
int ret;
|
|
|
|
if (!CBB_init(&cbb, 256))
|
|
return 0;
|
|
if (!CBB_add_u16(&cbb, out->len))
|
|
goto err;
|
|
if (!CBB_add_u8_length_prefixed(&cbb, &child))
|
|
goto err;
|
|
if (!CBB_add_bytes(&child, tls13_plabel, strlen(tls13_plabel)))
|
|
goto err;
|
|
if (!CBB_add_bytes(&child, label, label_len))
|
|
goto err;
|
|
if (!CBB_add_u8_length_prefixed(&cbb, &child))
|
|
goto err;
|
|
if (!CBB_add_bytes(&child, context->data, context->len))
|
|
goto err;
|
|
if (!CBB_finish(&cbb, &hkdf_label, &hkdf_label_len))
|
|
goto err;
|
|
|
|
ret = HKDF_expand(out->data, out->len, digest, secret->data,
|
|
secret->len, hkdf_label, hkdf_label_len);
|
|
|
|
free(hkdf_label);
|
|
return(ret);
|
|
err:
|
|
CBB_cleanup(&cbb);
|
|
return(0);
|
|
}
|
|
|
|
int
|
|
tls13_derive_secret(struct tls13_secret *out, const EVP_MD *digest,
|
|
const struct tls13_secret *secret, const char *label,
|
|
const struct tls13_secret *context)
|
|
{
|
|
return tls13_hkdf_expand_label(out, digest, secret, label, context);
|
|
}
|
|
|
|
int
|
|
tls13_derive_secret_with_label_length(struct tls13_secret *out,
|
|
const EVP_MD *digest, const struct tls13_secret *secret, const uint8_t *label,
|
|
size_t label_len, const struct tls13_secret *context)
|
|
{
|
|
return tls13_hkdf_expand_label_with_length(out, digest, secret, label,
|
|
label_len, context);
|
|
}
|
|
|
|
int
|
|
tls13_derive_early_secrets(struct tls13_secrets *secrets,
|
|
uint8_t *psk, size_t psk_len, const struct tls13_secret *context)
|
|
{
|
|
if (!secrets->init_done || secrets->early_done)
|
|
return 0;
|
|
|
|
if (!HKDF_extract(secrets->extracted_early.data,
|
|
&secrets->extracted_early.len, secrets->digest, psk, psk_len,
|
|
secrets->zeros.data, secrets->zeros.len))
|
|
return 0;
|
|
|
|
if (secrets->extracted_early.len != secrets->zeros.len)
|
|
return 0;
|
|
|
|
if (!tls13_derive_secret(&secrets->binder_key, secrets->digest,
|
|
&secrets->extracted_early,
|
|
secrets->resumption ? "res binder" : "ext binder",
|
|
&secrets->empty_hash))
|
|
return 0;
|
|
if (!tls13_derive_secret(&secrets->client_early_traffic,
|
|
secrets->digest, &secrets->extracted_early, "c e traffic",
|
|
context))
|
|
return 0;
|
|
if (!tls13_derive_secret(&secrets->early_exporter_master,
|
|
secrets->digest, &secrets->extracted_early, "e exp master",
|
|
context))
|
|
return 0;
|
|
if (!tls13_derive_secret(&secrets->derived_early,
|
|
secrets->digest, &secrets->extracted_early, "derived",
|
|
&secrets->empty_hash))
|
|
return 0;
|
|
|
|
/* RFC 8446 recommends */
|
|
if (!secrets->insecure)
|
|
explicit_bzero(secrets->extracted_early.data,
|
|
secrets->extracted_early.len);
|
|
secrets->early_done = 1;
|
|
return 1;
|
|
}
|
|
|
|
int
|
|
tls13_derive_handshake_secrets(struct tls13_secrets *secrets,
|
|
const uint8_t *ecdhe, size_t ecdhe_len,
|
|
const struct tls13_secret *context)
|
|
{
|
|
if (!secrets->init_done || !secrets->early_done ||
|
|
secrets->handshake_done)
|
|
return 0;
|
|
|
|
if (!HKDF_extract(secrets->extracted_handshake.data,
|
|
&secrets->extracted_handshake.len, secrets->digest,
|
|
ecdhe, ecdhe_len, secrets->derived_early.data,
|
|
secrets->derived_early.len))
|
|
return 0;
|
|
|
|
if (secrets->extracted_handshake.len != secrets->zeros.len)
|
|
return 0;
|
|
|
|
/* XXX */
|
|
if (!secrets->insecure)
|
|
explicit_bzero(secrets->derived_early.data,
|
|
secrets->derived_early.len);
|
|
|
|
if (!tls13_derive_secret(&secrets->client_handshake_traffic,
|
|
secrets->digest, &secrets->extracted_handshake, "c hs traffic",
|
|
context))
|
|
return 0;
|
|
if (!tls13_derive_secret(&secrets->server_handshake_traffic,
|
|
secrets->digest, &secrets->extracted_handshake, "s hs traffic",
|
|
context))
|
|
return 0;
|
|
if (!tls13_derive_secret(&secrets->derived_handshake,
|
|
secrets->digest, &secrets->extracted_handshake, "derived",
|
|
&secrets->empty_hash))
|
|
return 0;
|
|
|
|
/* RFC 8446 recommends */
|
|
if (!secrets->insecure)
|
|
explicit_bzero(secrets->extracted_handshake.data,
|
|
secrets->extracted_handshake.len);
|
|
|
|
secrets->handshake_done = 1;
|
|
|
|
return 1;
|
|
}
|
|
|
|
int
|
|
tls13_derive_application_secrets(struct tls13_secrets *secrets,
|
|
const struct tls13_secret *context)
|
|
{
|
|
if (!secrets->init_done || !secrets->early_done ||
|
|
!secrets->handshake_done || secrets->schedule_done)
|
|
return 0;
|
|
|
|
if (!HKDF_extract(secrets->extracted_master.data,
|
|
&secrets->extracted_master.len, secrets->digest,
|
|
secrets->zeros.data, secrets->zeros.len,
|
|
secrets->derived_handshake.data, secrets->derived_handshake.len))
|
|
return 0;
|
|
|
|
if (secrets->extracted_master.len != secrets->zeros.len)
|
|
return 0;
|
|
|
|
/* XXX */
|
|
if (!secrets->insecure)
|
|
explicit_bzero(secrets->derived_handshake.data,
|
|
secrets->derived_handshake.len);
|
|
|
|
if (!tls13_derive_secret(&secrets->client_application_traffic,
|
|
secrets->digest, &secrets->extracted_master, "c ap traffic",
|
|
context))
|
|
return 0;
|
|
if (!tls13_derive_secret(&secrets->server_application_traffic,
|
|
secrets->digest, &secrets->extracted_master, "s ap traffic",
|
|
context))
|
|
return 0;
|
|
if (!tls13_derive_secret(&secrets->exporter_master,
|
|
secrets->digest, &secrets->extracted_master, "exp master",
|
|
context))
|
|
return 0;
|
|
if (!tls13_derive_secret(&secrets->resumption_master,
|
|
secrets->digest, &secrets->extracted_master, "res master",
|
|
context))
|
|
return 0;
|
|
|
|
/* RFC 8446 recommends */
|
|
if (!secrets->insecure)
|
|
explicit_bzero(secrets->extracted_master.data,
|
|
secrets->extracted_master.len);
|
|
|
|
secrets->schedule_done = 1;
|
|
|
|
return 1;
|
|
}
|
|
|
|
int
|
|
tls13_update_client_traffic_secret(struct tls13_secrets *secrets)
|
|
{
|
|
struct tls13_secret context = { .data = "", .len = 0 };
|
|
|
|
if (!secrets->init_done || !secrets->early_done ||
|
|
!secrets->handshake_done || !secrets->schedule_done)
|
|
return 0;
|
|
|
|
return tls13_hkdf_expand_label(&secrets->client_application_traffic,
|
|
secrets->digest, &secrets->client_application_traffic,
|
|
"traffic upd", &context);
|
|
}
|
|
|
|
int
|
|
tls13_update_server_traffic_secret(struct tls13_secrets *secrets)
|
|
{
|
|
struct tls13_secret context = { .data = "", .len = 0 };
|
|
|
|
if (!secrets->init_done || !secrets->early_done ||
|
|
!secrets->handshake_done || !secrets->schedule_done)
|
|
return 0;
|
|
|
|
return tls13_hkdf_expand_label(&secrets->server_application_traffic,
|
|
secrets->digest, &secrets->server_application_traffic,
|
|
"traffic upd", &context);
|
|
}
|