Mbed-TLS/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-08-13 22:57:51 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
archive/dev/mstarzyk-mobica/code_style_v2
mbedtls/library/ssl_tls13_keys.c
T
Mateusz Starzyk c0eabdc636 Apply clang formatting. 
Executed with:
`find . -regextype posix-egrep -regex ".*\.([hc]|fmt|function)" | xargs -L1 clang-format-12 -i`

Signed-off-by: Mateusz Starzyk <[email protected]>
2021-08-11 16:58:05 +02:00

659 lines
23 KiB
C
Raw Permalink Blame History

/*
* TLS 1.3 key schedule
*
* Copyright The Mbed TLS Contributors
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 ( the "License" ); you may
* not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include "common.h"
#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
# include "mbedtls/hkdf.h"
# include "ssl_misc.h"
# include "ssl_tls13_keys.h"
# include "mbedtls/debug.h"
# include <stdint.h>
# include <string.h>
# define MBEDTLS_SSL_TLS1_3_LABEL(name, string) .name = string,
struct mbedtls_ssl_tls1_3_labels_struct const mbedtls_ssl_tls1_3_labels = {
/* This seems to work in C, despite the string literal being one
* character too long due to the 0-termination. */
MBEDTLS_SSL_TLS1_3_LABEL_LIST
};
# undef MBEDTLS_SSL_TLS1_3_LABEL
/*
* This function creates a HkdfLabel structure used in the TLS 1.3 key schedule.
*
* The HkdfLabel is specified in RFC 8446 as follows:
*
* struct HkdfLabel {
* uint16 length; // Length of expanded key material
* opaque label<7..255>; // Always prefixed by "tls13 "
* opaque context<0..255>; // Usually a communication transcript hash
* };
*
* Parameters:
* - desired_length: Length of expanded key material
* Even though the standard allows expansion to up to
* 2**16 Bytes, TLS 1.3 never uses expansion to more than
* 255 Bytes, so we require `desired_length` to be at most
* 255. This allows us to save a few Bytes of code by
* hardcoding the writing of the high bytes.
* - (label, llen): label + label length, without "tls13 " prefix
* The label length MUST be less than or equal to
* MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_LABEL_LEN
* It is the caller's responsibility to ensure this.
* All (label, label length) pairs used in TLS 1.3
* can be obtained via MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN().
* - (ctx, clen): context + context length
* The context length MUST be less than or equal to
* MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_CONTEXT_LEN
* It is the caller's responsibility to ensure this.
* - dst: Target buffer for HkdfLabel structure,
* This MUST be a writable buffer of size
* at least SSL_TLS1_3_KEY_SCHEDULE_MAX_HKDF_LABEL_LEN Bytes.
* - dlen: Pointer at which to store the actual length of
* the HkdfLabel structure on success.
*/
static const char tls1_3_label_prefix[6] = "tls13 ";
# define SSL_TLS1_3_KEY_SCHEDULE_HKDF_LABEL_LEN(label_len, context_len) \
(2 /* expansion length */ \
+ 1 /* label length */ \
+ label_len + 1 /* context length */ \
+ context_len)
# define SSL_TLS1_3_KEY_SCHEDULE_MAX_HKDF_LABEL_LEN \
SSL_TLS1_3_KEY_SCHEDULE_HKDF_LABEL_LEN( \
sizeof(tls1_3_label_prefix) + \
MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_LABEL_LEN, \
MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_CONTEXT_LEN)
static void ssl_tls1_3_hkdf_encode_label(size_t desired_length,
const unsigned char *label,
size_t llen,
const unsigned char *ctx,
size_t clen,
unsigned char *dst,
size_t *dlen)
{
size_t total_label_len = sizeof(tls1_3_label_prefix) + llen;
size_t total_hkdf_lbl_len =
SSL_TLS1_3_KEY_SCHEDULE_HKDF_LABEL_LEN(total_label_len, clen);
unsigned char *p = dst;
/* Add the size of the expanded key material.
* We're hardcoding the high byte to 0 here assuming that we never use
* TLS 1.3 HKDF key expansion to more than 255 Bytes. */
# if MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_EXPANSION_LEN > 255
# error \
"The implementation of ssl_tls1_3_hkdf_encode_label() is not fit for the \
value of MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_EXPANSION_LEN"
# endif
*p++ = 0;
*p++ = (unsigned char)((desired_length >> 0) & 0xFF);
/* Add label incl. prefix */
*p++ = (unsigned char)(total_label_len & 0xFF);
memcpy(p, tls1_3_label_prefix, sizeof(tls1_3_label_prefix));
p += sizeof(tls1_3_label_prefix);
memcpy(p, label, llen);
p += llen;
/* Add context value */
*p++ = (unsigned char)(clen & 0xFF);
if (clen != 0)
memcpy(p, ctx, clen);
/* Return total length to the caller. */
*dlen = total_hkdf_lbl_len;
}
int mbedtls_ssl_tls1_3_hkdf_expand_label(mbedtls_md_type_t hash_alg,
const unsigned char *secret,
size_t slen,
const unsigned char *label,
size_t llen,
const unsigned char *ctx,
size_t clen,
unsigned char *buf,
size_t blen)
{
const mbedtls_md_info_t *md;
unsigned char hkdf_label[SSL_TLS1_3_KEY_SCHEDULE_MAX_HKDF_LABEL_LEN];
size_t hkdf_label_len;
if (llen > MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_LABEL_LEN) {
/* Should never happen since this is an internal
* function, and we know statically which labels
* are allowed. */
return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
}
if (clen > MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_CONTEXT_LEN) {
/* Should not happen, as above. */
return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
}
if (blen > MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_EXPANSION_LEN) {
/* Should not happen, as above. */
return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
}
md = mbedtls_md_info_from_type(hash_alg);
if (md == NULL)
return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
ssl_tls1_3_hkdf_encode_label(blen, label, llen, ctx, clen, hkdf_label,
&hkdf_label_len);
return (mbedtls_hkdf_expand(md, secret, slen, hkdf_label, hkdf_label_len,
buf, blen));
}
/*
* The traffic keying material is generated from the following inputs:
*
* - One secret value per sender.
* - A purpose value indicating the specific value being generated
* - The desired lengths of key and IV.
*
* The expansion itself is based on HKDF:
*
* [sender]_write_key = HKDF-Expand-Label( Secret, "key", "", key_length )
* [sender]_write_iv = HKDF-Expand-Label( Secret, "iv" , "", iv_length )
*
* [sender] denotes the sending side and the Secret value is provided
* by the function caller. Note that we generate server and client side
* keys in a single function call.
*/
int mbedtls_ssl_tls1_3_make_traffic_keys(mbedtls_md_type_t hash_alg,
const unsigned char *client_secret,
const unsigned char *server_secret,
size_t slen,
size_t key_len,
size_t iv_len,
mbedtls_ssl_key_set *keys)
{
int ret = 0;
ret = mbedtls_ssl_tls1_3_hkdf_expand_label(
hash_alg, client_secret, slen, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(key),
NULL, 0, keys->client_write_key, key_len);
if (ret != 0)
return ret;
ret = mbedtls_ssl_tls1_3_hkdf_expand_label(
hash_alg, server_secret, slen, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(key),
NULL, 0, keys->server_write_key, key_len);
if (ret != 0)
return ret;
ret = mbedtls_ssl_tls1_3_hkdf_expand_label(
hash_alg, client_secret, slen, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(iv),
NULL, 0, keys->client_write_iv, iv_len);
if (ret != 0)
return ret;
ret = mbedtls_ssl_tls1_3_hkdf_expand_label(
hash_alg, server_secret, slen, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(iv),
NULL, 0, keys->server_write_iv, iv_len);
if (ret != 0)
return ret;
keys->key_len = key_len;
keys->iv_len = iv_len;
return 0;
}
int mbedtls_ssl_tls1_3_derive_secret(mbedtls_md_type_t hash_alg,
const unsigned char *secret,
size_t slen,
const unsigned char *label,
size_t llen,
const unsigned char *ctx,
size_t clen,
int ctx_hashed,
unsigned char *dstbuf,
size_t buflen)
{
int ret;
unsigned char hashed_context[MBEDTLS_MD_MAX_SIZE];
const mbedtls_md_info_t *md;
md = mbedtls_md_info_from_type(hash_alg);
if (md == NULL)
return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
if (ctx_hashed == MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED) {
ret = mbedtls_md(md, ctx, clen, hashed_context);
if (ret != 0)
return ret;
clen = mbedtls_md_get_size(md);
} else {
if (clen > sizeof(hashed_context)) {
/* This should never happen since this function is internal
* and the code sets `ctx_hashed` correctly.
* Let's double-check nonetheless to not run at the risk
* of getting a stack overflow. */
return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
}
memcpy(hashed_context, ctx, clen);
}
return (mbedtls_ssl_tls1_3_hkdf_expand_label(hash_alg, secret, slen, label,
llen, hashed_context, clen,
dstbuf, buflen));
}
int mbedtls_ssl_tls1_3_evolve_secret(mbedtls_md_type_t hash_alg,
const unsigned char *secret_old,
const unsigned char *input,
size_t input_len,
unsigned char *secret_new)
{
int ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
size_t hlen, ilen;
unsigned char tmp_secret[MBEDTLS_MD_MAX_SIZE] = { 0 };
unsigned char tmp_input[MBEDTLS_MD_MAX_SIZE] = { 0 };
const mbedtls_md_info_t *md;
md = mbedtls_md_info_from_type(hash_alg);
if (md == NULL)
return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
hlen = mbedtls_md_get_size(md);
/* For non-initial runs, call Derive-Secret( ., "derived", "")
* on the old secret. */
if (secret_old != NULL) {
ret = mbedtls_ssl_tls1_3_derive_secret(
hash_alg, secret_old, hlen,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(derived), NULL, 0, /* context */
MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED, tmp_secret, hlen);
if (ret != 0)
goto cleanup;
}
if (input != NULL) {
memcpy(tmp_input, input, input_len);
ilen = input_len;
} else {
ilen = hlen;
}
/* HKDF-Extract takes a salt and input key material.
* The salt is the old secret, and the input key material
* is the input secret (PSK / ECDHE). */
ret =
mbedtls_hkdf_extract(md, tmp_secret, hlen, tmp_input, ilen, secret_new);
if (ret != 0)
goto cleanup;
ret = 0;
cleanup:
mbedtls_platform_zeroize(tmp_secret, sizeof(tmp_secret));
mbedtls_platform_zeroize(tmp_input, sizeof(tmp_input));
return ret;
}
int mbedtls_ssl_tls1_3_derive_early_secrets(
mbedtls_md_type_t md_type,
unsigned char const *early_secret,
unsigned char const *transcript,
size_t transcript_len,
mbedtls_ssl_tls1_3_early_secrets *derived)
{
int ret;
mbedtls_md_info_t const *const md_info = mbedtls_md_info_from_type(md_type);
size_t const md_size = mbedtls_md_get_size(md_info);
/* We should never call this function with an unknown hash,
* but add an assertion anyway. */
if (md_info == 0)
return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
/*
* 0
* |
* v
* PSK -> HKDF-Extract = Early Secret
* |
* +-----> Derive-Secret(., "c e traffic", ClientHello)
* | = client_early_traffic_secret
* |
* +-----> Derive-Secret(., "e exp master", ClientHello)
* | = early_exporter_master_secret
* v
*/
/* Create client_early_traffic_secret */
ret = mbedtls_ssl_tls1_3_derive_secret(
md_type, early_secret, md_size,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(c_e_traffic), transcript,
transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
derived->client_early_traffic_secret, md_size);
if (ret != 0)
return ret;
/* Create early exporter */
ret = mbedtls_ssl_tls1_3_derive_secret(
md_type, early_secret, md_size,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(e_exp_master), transcript,
transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
derived->early_exporter_master_secret, md_size);
if (ret != 0)
return ret;
return 0;
}
int mbedtls_ssl_tls1_3_derive_handshake_secrets(
mbedtls_md_type_t md_type,
unsigned char const *handshake_secret,
unsigned char const *transcript,
size_t transcript_len,
mbedtls_ssl_tls1_3_handshake_secrets *derived)
{
int ret;
mbedtls_md_info_t const *const md_info = mbedtls_md_info_from_type(md_type);
size_t const md_size = mbedtls_md_get_size(md_info);
/* We should never call this function with an unknown hash,
* but add an assertion anyway. */
if (md_info == 0)
return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
/*
*
* Handshake Secret
* |
* +-----> Derive-Secret( ., "c hs traffic",
* | ClientHello...ServerHello )
* | = client_handshake_traffic_secret
* |
* +-----> Derive-Secret( ., "s hs traffic",
* | ClientHello...ServerHello )
* | = server_handshake_traffic_secret
*
*/
/*
* Compute client_handshake_traffic_secret with
* Derive-Secret( ., "c hs traffic", ClientHello...ServerHello )
*/
ret = mbedtls_ssl_tls1_3_derive_secret(
md_type, handshake_secret, md_size,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(c_hs_traffic), transcript,
transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
derived->client_handshake_traffic_secret, md_size);
if (ret != 0)
return ret;
/*
* Compute server_handshake_traffic_secret with
* Derive-Secret( ., "s hs traffic", ClientHello...ServerHello )
*/
ret = mbedtls_ssl_tls1_3_derive_secret(
md_type, handshake_secret, md_size,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(s_hs_traffic), transcript,
transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
derived->server_handshake_traffic_secret, md_size);
if (ret != 0)
return ret;
return 0;
}
int mbedtls_ssl_tls1_3_derive_application_secrets(
mbedtls_md_type_t md_type,
unsigned char const *application_secret,
unsigned char const *transcript,
size_t transcript_len,
mbedtls_ssl_tls1_3_application_secrets *derived)
{
int ret;
mbedtls_md_info_t const *const md_info = mbedtls_md_info_from_type(md_type);
size_t const md_size = mbedtls_md_get_size(md_info);
/* We should never call this function with an unknown hash,
* but add an assertion anyway. */
if (md_info == 0)
return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
/* Generate {client,server}_application_traffic_secret_0
*
* Master Secret
* |
* +-----> Derive-Secret( ., "c ap traffic",
* | ClientHello...server Finished )
* | = client_application_traffic_secret_0
* |
* +-----> Derive-Secret( ., "s ap traffic",
* | ClientHello...Server Finished )
* | = server_application_traffic_secret_0
* |
* +-----> Derive-Secret( ., "exp master",
* | ClientHello...server Finished)
* | = exporter_master_secret
*
*/
ret = mbedtls_ssl_tls1_3_derive_secret(
md_type, application_secret, md_size,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(c_ap_traffic), transcript,
transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
derived->client_application_traffic_secret_N, md_size);
if (ret != 0)
return ret;
ret = mbedtls_ssl_tls1_3_derive_secret(
md_type, application_secret, md_size,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(s_ap_traffic), transcript,
transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
derived->server_application_traffic_secret_N, md_size);
if (ret != 0)
return ret;
ret = mbedtls_ssl_tls1_3_derive_secret(
md_type, application_secret, md_size,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(exp_master), transcript, transcript_len,
MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, derived->exporter_master_secret,
md_size);
if (ret != 0)
return ret;
return 0;
}
/* Generate resumption_master_secret for use with the ticket exchange.
*
* This is not integrated with mbedtls_ssl_tls1_3_derive_application_secrets()
* because it uses the transcript hash up to and including ClientFinished. */
int mbedtls_ssl_tls1_3_derive_resumption_master_secret(
mbedtls_md_type_t md_type,
unsigned char const *application_secret,
unsigned char const *transcript,
size_t transcript_len,
mbedtls_ssl_tls1_3_application_secrets *derived)
{
int ret;
mbedtls_md_info_t const *const md_info = mbedtls_md_info_from_type(md_type);
size_t const md_size = mbedtls_md_get_size(md_info);
/* We should never call this function with an unknown hash,
* but add an assertion anyway. */
if (md_info == 0)
return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
ret = mbedtls_ssl_tls1_3_derive_secret(
md_type, application_secret, md_size,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(res_master), transcript, transcript_len,
MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, derived->resumption_master_secret,
md_size);
if (ret != 0)
return ret;
return 0;
}
static int ssl_tls1_3_calc_finished_core(mbedtls_md_type_t md_type,
unsigned char const *base_key,
unsigned char const *transcript,
unsigned char *dst)
{
const mbedtls_md_info_t *const md_info = mbedtls_md_info_from_type(md_type);
size_t const md_size = mbedtls_md_get_size(md_info);
unsigned char finished_key[MBEDTLS_MD_MAX_SIZE];
int ret;
/* We should never call this function with an unknown hash,
* but add an assertion anyway. */
if (md_info == 0)
return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
/* TLS 1.3 Finished message
*
* struct {
* opaque verify_data[Hash.length];
* } Finished;
*
* verify_data =
* HMAC( finished_key,
* Hash( Handshake Context +
* Certificate* +
* CertificateVerify* )
* )
*
* finished_key =
* HKDF-Expand-Label( BaseKey, "finished", "", Hash.length )
*/
ret = mbedtls_ssl_tls1_3_hkdf_expand_label(
md_type, base_key, md_size, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(finished),
NULL, 0, finished_key, md_size);
if (ret != 0)
goto exit;
ret = mbedtls_md_hmac(md_info, finished_key, md_size, transcript, md_size,
dst);
if (ret != 0)
goto exit;
exit:
mbedtls_platform_zeroize(finished_key, sizeof(finished_key));
return ret;
}
int mbedtls_ssl_tls1_3_create_psk_binder(mbedtls_ssl_context *ssl,
const mbedtls_md_type_t md_type,
unsigned char const *psk,
size_t psk_len,
int psk_type,
unsigned char const *transcript,
unsigned char *result)
{
int ret = 0;
unsigned char binder_key[MBEDTLS_MD_MAX_SIZE];
unsigned char early_secret[MBEDTLS_MD_MAX_SIZE];
mbedtls_md_info_t const *md_info = mbedtls_md_info_from_type(md_type);
size_t const md_size = mbedtls_md_get_size(md_info);
# if !defined(MBEDTLS_DEBUG_C)
ssl = NULL; /* make sure we don't use it except for debug */
((void)ssl);
# endif
/* We should never call this function with an unknown hash,
* but add an assertion anyway. */
if (md_info == 0)
return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
/*
* 0
* |
* v
* PSK -> HKDF-Extract = Early Secret
* |
* +-----> Derive-Secret(., "ext binder" | "res binder", "")
* | = binder_key
* v
*/
ret = mbedtls_ssl_tls1_3_evolve_secret(md_type, NULL, /* Old secret */
psk, psk_len, /* Input */
early_secret);
if (ret != 0) {
MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_tls1_3_evolve_secret", ret);
goto exit;
}
if (psk_type == MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION) {
ret = mbedtls_ssl_tls1_3_derive_secret(
md_type, early_secret, md_size,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(res_binder), NULL, 0,
MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED, binder_key, md_size);
MBEDTLS_SSL_DEBUG_MSG(4, ("Derive Early Secret with 'res binder'"));
} else {
ret = mbedtls_ssl_tls1_3_derive_secret(
md_type, early_secret, md_size,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(ext_binder), NULL, 0,
MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED, binder_key, md_size);
MBEDTLS_SSL_DEBUG_MSG(4, ("Derive Early Secret with 'ext binder'"));
}
if (ret != 0) {
MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_tls1_3_derive_secret", ret);
goto exit;
}
/*
* The binding_value is computed in the same way as the Finished message
* but with the BaseKey being the binder_key.
*/
ret =
ssl_tls1_3_calc_finished_core(md_type, binder_key, transcript, result);
if (ret != 0)
goto exit;
MBEDTLS_SSL_DEBUG_BUF(3, "psk binder", result, md_size);
exit:
mbedtls_platform_zeroize(early_secret, sizeof(early_secret));
mbedtls_platform_zeroize(binder_key, sizeof(binder_key));
return ret;
}
#endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
Reference in New Issue View Git Blame Copy Permalink