David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 1 | /* Copyright (c) 2016, Google Inc. |
| 2 | * |
| 3 | * Permission to use, copy, modify, and/or distribute this software for any |
| 4 | * purpose with or without fee is hereby granted, provided that the above |
| 5 | * copyright notice and this permission notice appear in all copies. |
| 6 | * |
| 7 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| 8 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| 9 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY |
| 10 | * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| 11 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION |
| 12 | * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN |
| 13 | * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ |
| 14 | |
| 15 | #include <openssl/ssl.h> |
| 16 | |
| 17 | #include <assert.h> |
| 18 | #include <string.h> |
| 19 | |
| 20 | #include <openssl/aead.h> |
| 21 | #include <openssl/bytestring.h> |
| 22 | #include <openssl/digest.h> |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 23 | #include <openssl/hkdf.h> |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 24 | #include <openssl/hmac.h> |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 25 | #include <openssl/mem.h> |
| 26 | |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 27 | #include "../crypto/internal.h" |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 28 | #include "internal.h" |
| 29 | |
| 30 | |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 31 | static int init_key_schedule(SSL_HANDSHAKE *hs, uint16_t version, |
| 32 | int algorithm_prf) { |
| 33 | if (!SSL_TRANSCRIPT_init_hash(&hs->transcript, version, algorithm_prf)) { |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 34 | return 0; |
| 35 | } |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 36 | |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 37 | hs->hash_len = SSL_TRANSCRIPT_digest_len(&hs->transcript); |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 38 | |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 39 | /* Initialize the secret to the zero key. */ |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 40 | OPENSSL_memset(hs->secret, 0, hs->hash_len); |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 41 | |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 42 | return 1; |
| 43 | } |
| 44 | |
| 45 | int tls13_init_key_schedule(SSL_HANDSHAKE *hs) { |
| 46 | if (!init_key_schedule(hs, ssl3_protocol_version(hs->ssl), |
| 47 | hs->new_cipher->algorithm_prf)) { |
| 48 | return 0; |
| 49 | } |
| 50 | |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 51 | SSL_TRANSCRIPT_free_buffer(&hs->transcript); |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 52 | return 1; |
| 53 | } |
| 54 | |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 55 | int tls13_init_early_key_schedule(SSL_HANDSHAKE *hs) { |
| 56 | SSL *const ssl = hs->ssl; |
| 57 | uint16_t session_version; |
| 58 | if (!ssl->method->version_from_wire(&session_version, |
| 59 | ssl->session->ssl_version) || |
| 60 | !init_key_schedule(hs, session_version, |
| 61 | ssl->session->cipher->algorithm_prf)) { |
| 62 | return 0; |
| 63 | } |
| 64 | |
| 65 | return 1; |
| 66 | } |
| 67 | |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 68 | int tls13_advance_key_schedule(SSL_HANDSHAKE *hs, const uint8_t *in, |
| 69 | size_t len) { |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 70 | return HKDF_extract(hs->secret, &hs->hash_len, |
| 71 | SSL_TRANSCRIPT_md(&hs->transcript), in, len, hs->secret, |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 72 | hs->hash_len); |
| 73 | } |
| 74 | |
| 75 | static int hkdf_expand_label(uint8_t *out, const EVP_MD *digest, |
| 76 | const uint8_t *secret, size_t secret_len, |
| 77 | const uint8_t *label, size_t label_len, |
| 78 | const uint8_t *hash, size_t hash_len, size_t len) { |
| 79 | static const char kTLS13LabelVersion[] = "TLS 1.3, "; |
| 80 | |
| 81 | CBB cbb, child; |
| 82 | uint8_t *hkdf_label; |
| 83 | size_t hkdf_label_len; |
| 84 | if (!CBB_init(&cbb, 2 + 1 + strlen(kTLS13LabelVersion) + label_len + 1 + |
| 85 | hash_len) || |
| 86 | !CBB_add_u16(&cbb, len) || |
| 87 | !CBB_add_u8_length_prefixed(&cbb, &child) || |
| 88 | !CBB_add_bytes(&child, (const uint8_t *)kTLS13LabelVersion, |
| 89 | strlen(kTLS13LabelVersion)) || |
| 90 | !CBB_add_bytes(&child, label, label_len) || |
| 91 | !CBB_add_u8_length_prefixed(&cbb, &child) || |
| 92 | !CBB_add_bytes(&child, hash, hash_len) || |
| 93 | !CBB_finish(&cbb, &hkdf_label, &hkdf_label_len)) { |
| 94 | CBB_cleanup(&cbb); |
| 95 | return 0; |
| 96 | } |
| 97 | |
| 98 | int ret = HKDF_expand(out, len, digest, secret, secret_len, hkdf_label, |
| 99 | hkdf_label_len); |
| 100 | OPENSSL_free(hkdf_label); |
| 101 | return ret; |
| 102 | } |
| 103 | |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 104 | /* derive_secret derives a secret of length |len| and writes the result in |out| |
| 105 | * with the given label and the current base secret and most recently-saved |
| 106 | * handshake context. It returns one on success and zero on error. */ |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 107 | static int derive_secret(SSL_HANDSHAKE *hs, uint8_t *out, size_t len, |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 108 | const uint8_t *label, size_t label_len) { |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 109 | uint8_t context_hash[EVP_MAX_MD_SIZE]; |
| 110 | size_t context_hash_len; |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 111 | if (!SSL_TRANSCRIPT_get_hash(&hs->transcript, context_hash, |
| 112 | &context_hash_len)) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 113 | return 0; |
| 114 | } |
| 115 | |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 116 | return hkdf_expand_label(out, SSL_TRANSCRIPT_md(&hs->transcript), hs->secret, |
| 117 | hs->hash_len, label, label_len, context_hash, |
| 118 | context_hash_len, len); |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 119 | } |
| 120 | |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 121 | int tls13_set_traffic_key(SSL *ssl, enum evp_aead_direction_t direction, |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 122 | const uint8_t *traffic_secret, |
| 123 | size_t traffic_secret_len) { |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 124 | const SSL_SESSION *session = SSL_get_session(ssl); |
| 125 | uint16_t version; |
| 126 | if (!ssl->method->version_from_wire(&version, session->ssl_version)) { |
| 127 | OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| 128 | return 0; |
| 129 | } |
| 130 | |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 131 | if (traffic_secret_len > 0xff) { |
| 132 | OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW); |
| 133 | return 0; |
| 134 | } |
| 135 | |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 136 | /* Look up cipher suite properties. */ |
| 137 | const EVP_AEAD *aead; |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 138 | size_t discard; |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 139 | if (!ssl_cipher_get_evp_aead(&aead, &discard, &discard, session->cipher, |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 140 | version, SSL_is_dtls(ssl))) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 141 | return 0; |
| 142 | } |
| 143 | |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 144 | const EVP_MD *digest = ssl_get_handshake_digest( |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 145 | session->cipher->algorithm_prf, version); |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 146 | |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 147 | /* Derive the key. */ |
| 148 | size_t key_len = EVP_AEAD_key_length(aead); |
| 149 | uint8_t key[EVP_AEAD_MAX_KEY_LENGTH]; |
David Benjamin | 95add82 | 2016-10-19 01:09:12 -0400 | [diff] [blame] | 150 | if (!hkdf_expand_label(key, digest, traffic_secret, traffic_secret_len, |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 151 | (const uint8_t *)"key", 3, NULL, 0, key_len)) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 152 | return 0; |
| 153 | } |
| 154 | |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 155 | /* Derive the IV. */ |
| 156 | size_t iv_len = EVP_AEAD_nonce_length(aead); |
| 157 | uint8_t iv[EVP_AEAD_MAX_NONCE_LENGTH]; |
David Benjamin | 95add82 | 2016-10-19 01:09:12 -0400 | [diff] [blame] | 158 | if (!hkdf_expand_label(iv, digest, traffic_secret, traffic_secret_len, |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 159 | (const uint8_t *)"iv", 2, NULL, 0, iv_len)) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 160 | return 0; |
| 161 | } |
| 162 | |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame^] | 163 | SSL_AEAD_CTX *traffic_aead = |
| 164 | SSL_AEAD_CTX_new(direction, version, SSL_is_dtls(ssl), session->cipher, |
| 165 | key, key_len, NULL, 0, iv, iv_len); |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 166 | if (traffic_aead == NULL) { |
| 167 | return 0; |
| 168 | } |
| 169 | |
| 170 | if (direction == evp_aead_open) { |
| 171 | if (!ssl->method->set_read_state(ssl, traffic_aead)) { |
| 172 | return 0; |
| 173 | } |
| 174 | } else { |
| 175 | if (!ssl->method->set_write_state(ssl, traffic_aead)) { |
| 176 | return 0; |
| 177 | } |
| 178 | } |
| 179 | |
| 180 | /* Save the traffic secret. */ |
| 181 | if (direction == evp_aead_open) { |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 182 | OPENSSL_memmove(ssl->s3->read_traffic_secret, traffic_secret, |
| 183 | traffic_secret_len); |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 184 | ssl->s3->read_traffic_secret_len = traffic_secret_len; |
| 185 | } else { |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 186 | OPENSSL_memmove(ssl->s3->write_traffic_secret, traffic_secret, |
| 187 | traffic_secret_len); |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 188 | ssl->s3->write_traffic_secret_len = traffic_secret_len; |
| 189 | } |
| 190 | |
| 191 | return 1; |
| 192 | } |
| 193 | |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 194 | static const char kTLS13LabelExporter[] = "exporter master secret"; |
| 195 | static const char kTLS13LabelEarlyExporter[] = "early exporter master secret"; |
| 196 | |
| 197 | static const char kTLS13LabelClientEarlyTraffic[] = |
| 198 | "client early traffic secret"; |
David Benjamin | 95add82 | 2016-10-19 01:09:12 -0400 | [diff] [blame] | 199 | static const char kTLS13LabelClientHandshakeTraffic[] = |
| 200 | "client handshake traffic secret"; |
| 201 | static const char kTLS13LabelServerHandshakeTraffic[] = |
| 202 | "server handshake traffic secret"; |
| 203 | static const char kTLS13LabelClientApplicationTraffic[] = |
| 204 | "client application traffic secret"; |
| 205 | static const char kTLS13LabelServerApplicationTraffic[] = |
| 206 | "server application traffic secret"; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 207 | |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 208 | int tls13_derive_early_secrets(SSL_HANDSHAKE *hs) { |
| 209 | SSL *const ssl = hs->ssl; |
| 210 | return derive_secret(hs, hs->early_traffic_secret, hs->hash_len, |
| 211 | (const uint8_t *)kTLS13LabelClientEarlyTraffic, |
| 212 | strlen(kTLS13LabelClientEarlyTraffic)) && |
| 213 | ssl_log_secret(ssl, "CLIENT_EARLY_TRAFFIC_SECRET", |
| 214 | hs->early_traffic_secret, hs->hash_len) && |
| 215 | derive_secret(hs, ssl->s3->early_exporter_secret, hs->hash_len, |
| 216 | (const uint8_t *)kTLS13LabelEarlyExporter, |
| 217 | strlen(kTLS13LabelEarlyExporter)); |
| 218 | } |
| 219 | |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 220 | int tls13_derive_handshake_secrets(SSL_HANDSHAKE *hs) { |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 221 | SSL *const ssl = hs->ssl; |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 222 | return derive_secret(hs, hs->client_handshake_secret, hs->hash_len, |
| 223 | (const uint8_t *)kTLS13LabelClientHandshakeTraffic, |
| 224 | strlen(kTLS13LabelClientHandshakeTraffic)) && |
| 225 | ssl_log_secret(ssl, "CLIENT_HANDSHAKE_TRAFFIC_SECRET", |
| 226 | hs->client_handshake_secret, hs->hash_len) && |
| 227 | derive_secret(hs, hs->server_handshake_secret, hs->hash_len, |
| 228 | (const uint8_t *)kTLS13LabelServerHandshakeTraffic, |
| 229 | strlen(kTLS13LabelServerHandshakeTraffic)) && |
| 230 | ssl_log_secret(ssl, "SERVER_HANDSHAKE_TRAFFIC_SECRET", |
| 231 | hs->server_handshake_secret, hs->hash_len); |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 232 | } |
| 233 | |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 234 | int tls13_derive_application_secrets(SSL_HANDSHAKE *hs) { |
| 235 | SSL *const ssl = hs->ssl; |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 236 | ssl->s3->exporter_secret_len = hs->hash_len; |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 237 | return derive_secret(hs, hs->client_traffic_secret_0, hs->hash_len, |
David Benjamin | 95add82 | 2016-10-19 01:09:12 -0400 | [diff] [blame] | 238 | (const uint8_t *)kTLS13LabelClientApplicationTraffic, |
| 239 | strlen(kTLS13LabelClientApplicationTraffic)) && |
| 240 | ssl_log_secret(ssl, "CLIENT_TRAFFIC_SECRET_0", |
| 241 | hs->client_traffic_secret_0, hs->hash_len) && |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 242 | derive_secret(hs, hs->server_traffic_secret_0, hs->hash_len, |
David Benjamin | 95add82 | 2016-10-19 01:09:12 -0400 | [diff] [blame] | 243 | (const uint8_t *)kTLS13LabelServerApplicationTraffic, |
| 244 | strlen(kTLS13LabelServerApplicationTraffic)) && |
| 245 | ssl_log_secret(ssl, "SERVER_TRAFFIC_SECRET_0", |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 246 | hs->server_traffic_secret_0, hs->hash_len) && |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 247 | derive_secret(hs, ssl->s3->exporter_secret, hs->hash_len, |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 248 | (const uint8_t *)kTLS13LabelExporter, |
| 249 | strlen(kTLS13LabelExporter)); |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 250 | } |
| 251 | |
David Benjamin | 95add82 | 2016-10-19 01:09:12 -0400 | [diff] [blame] | 252 | static const char kTLS13LabelApplicationTraffic[] = |
| 253 | "application traffic secret"; |
| 254 | |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 255 | int tls13_rotate_traffic_key(SSL *ssl, enum evp_aead_direction_t direction) { |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 256 | const EVP_MD *digest = ssl_get_handshake_digest( |
| 257 | SSL_get_session(ssl)->cipher->algorithm_prf, ssl3_protocol_version(ssl)); |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 258 | |
| 259 | uint8_t *secret; |
| 260 | size_t secret_len; |
| 261 | if (direction == evp_aead_open) { |
| 262 | secret = ssl->s3->read_traffic_secret; |
| 263 | secret_len = ssl->s3->read_traffic_secret_len; |
| 264 | } else { |
| 265 | secret = ssl->s3->write_traffic_secret; |
| 266 | secret_len = ssl->s3->write_traffic_secret_len; |
| 267 | } |
| 268 | |
| 269 | if (!hkdf_expand_label(secret, digest, secret, secret_len, |
| 270 | (const uint8_t *)kTLS13LabelApplicationTraffic, |
| 271 | strlen(kTLS13LabelApplicationTraffic), NULL, 0, |
| 272 | secret_len)) { |
| 273 | return 0; |
| 274 | } |
| 275 | |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 276 | return tls13_set_traffic_key(ssl, direction, secret, secret_len); |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 277 | } |
| 278 | |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 279 | static const char kTLS13LabelResumption[] = "resumption master secret"; |
| 280 | |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 281 | int tls13_derive_resumption_secret(SSL_HANDSHAKE *hs) { |
Robert Sloan | a94fe05 | 2017-02-21 08:49:28 -0800 | [diff] [blame] | 282 | if (hs->hash_len > SSL_MAX_MASTER_KEY_LENGTH) { |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 283 | OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| 284 | return 0; |
| 285 | } |
| 286 | |
Robert Sloan | a94fe05 | 2017-02-21 08:49:28 -0800 | [diff] [blame] | 287 | hs->new_session->master_key_length = hs->hash_len; |
| 288 | return derive_secret( |
| 289 | hs, hs->new_session->master_key, hs->new_session->master_key_length, |
| 290 | (const uint8_t *)kTLS13LabelResumption, strlen(kTLS13LabelResumption)); |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 291 | } |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 292 | |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 293 | static const char kTLS13LabelFinished[] = "finished"; |
| 294 | |
| 295 | /* tls13_verify_data sets |out| to be the HMAC of |context| using a derived |
| 296 | * Finished key for both Finished messages and the PSK binder. */ |
| 297 | static int tls13_verify_data(const EVP_MD *digest, uint8_t *out, |
| 298 | size_t *out_len, const uint8_t *secret, |
| 299 | size_t hash_len, uint8_t *context, |
| 300 | size_t context_len) { |
| 301 | uint8_t key[EVP_MAX_MD_SIZE]; |
| 302 | unsigned len; |
| 303 | if (!hkdf_expand_label(key, digest, secret, hash_len, |
| 304 | (const uint8_t *)kTLS13LabelFinished, |
| 305 | strlen(kTLS13LabelFinished), NULL, 0, hash_len) || |
| 306 | HMAC(digest, key, hash_len, context, context_len, out, &len) == NULL) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 307 | return 0; |
| 308 | } |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 309 | *out_len = len; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 310 | return 1; |
| 311 | } |
| 312 | |
David Benjamin | 1b24967 | 2016-12-06 18:25:50 -0500 | [diff] [blame] | 313 | int tls13_finished_mac(SSL_HANDSHAKE *hs, uint8_t *out, size_t *out_len, |
| 314 | int is_server) { |
David Benjamin | f0c4a6c | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 315 | const uint8_t *traffic_secret; |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 316 | if (is_server) { |
| 317 | traffic_secret = hs->server_handshake_secret; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 318 | } else { |
Robert Sloan | 6d0d00e | 2017-03-27 07:13:07 -0700 | [diff] [blame] | 319 | traffic_secret = hs->client_handshake_secret; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 320 | } |
| 321 | |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 322 | uint8_t context_hash[EVP_MAX_MD_SIZE]; |
| 323 | size_t context_hash_len; |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 324 | if (!SSL_TRANSCRIPT_get_hash(&hs->transcript, context_hash, |
| 325 | &context_hash_len) || |
| 326 | !tls13_verify_data(SSL_TRANSCRIPT_md(&hs->transcript), out, out_len, |
| 327 | traffic_secret, hs->hash_len, context_hash, |
| 328 | context_hash_len)) { |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 329 | return 0; |
| 330 | } |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 331 | return 1; |
| 332 | } |
| 333 | |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 334 | int tls13_export_keying_material(SSL *ssl, uint8_t *out, size_t out_len, |
| 335 | const char *label, size_t label_len, |
| 336 | const uint8_t *context, size_t context_len, |
| 337 | int use_context) { |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 338 | const EVP_MD *digest = ssl_get_handshake_digest( |
| 339 | SSL_get_session(ssl)->cipher->algorithm_prf, ssl3_protocol_version(ssl)); |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 340 | |
| 341 | const uint8_t *hash = NULL; |
| 342 | size_t hash_len = 0; |
| 343 | if (use_context) { |
| 344 | hash = context; |
| 345 | hash_len = context_len; |
| 346 | } |
| 347 | return hkdf_expand_label(out, digest, ssl->s3->exporter_secret, |
| 348 | ssl->s3->exporter_secret_len, (const uint8_t *)label, |
| 349 | label_len, hash, hash_len, out_len); |
| 350 | } |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 351 | |
| 352 | static const char kTLS13LabelPSKBinder[] = "resumption psk binder key"; |
| 353 | |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 354 | static int tls13_psk_binder(uint8_t *out, const EVP_MD *digest, uint8_t *psk, |
| 355 | size_t psk_len, uint8_t *context, |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 356 | size_t context_len, size_t hash_len) { |
| 357 | uint8_t binder_context[EVP_MAX_MD_SIZE]; |
| 358 | unsigned binder_context_len; |
| 359 | if (!EVP_Digest(NULL, 0, binder_context, &binder_context_len, digest, NULL)) { |
| 360 | return 0; |
| 361 | } |
| 362 | |
| 363 | uint8_t early_secret[EVP_MAX_MD_SIZE] = {0}; |
| 364 | size_t early_secret_len; |
| 365 | if (!HKDF_extract(early_secret, &early_secret_len, digest, psk, hash_len, |
| 366 | NULL, 0)) { |
| 367 | return 0; |
| 368 | } |
| 369 | |
| 370 | uint8_t binder_key[EVP_MAX_MD_SIZE] = {0}; |
| 371 | size_t len; |
| 372 | if (!hkdf_expand_label(binder_key, digest, early_secret, hash_len, |
| 373 | (const uint8_t *)kTLS13LabelPSKBinder, |
| 374 | strlen(kTLS13LabelPSKBinder), binder_context, |
| 375 | binder_context_len, hash_len) || |
| 376 | !tls13_verify_data(digest, out, &len, binder_key, hash_len, context, |
| 377 | context_len)) { |
| 378 | return 0; |
| 379 | } |
| 380 | |
| 381 | return 1; |
| 382 | } |
| 383 | |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 384 | int tls13_write_psk_binder(SSL_HANDSHAKE *hs, uint8_t *msg, size_t len) { |
| 385 | SSL *const ssl = hs->ssl; |
| 386 | const EVP_MD *digest = SSL_SESSION_get_digest(ssl->session, ssl); |
| 387 | if (digest == NULL) { |
| 388 | OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| 389 | return 0; |
| 390 | } |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 391 | size_t hash_len = EVP_MD_size(digest); |
| 392 | |
| 393 | if (len < hash_len + 3) { |
| 394 | OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| 395 | return 0; |
| 396 | } |
| 397 | |
| 398 | EVP_MD_CTX ctx; |
| 399 | EVP_MD_CTX_init(&ctx); |
| 400 | uint8_t context[EVP_MAX_MD_SIZE]; |
| 401 | unsigned context_len; |
| 402 | if (!EVP_DigestInit_ex(&ctx, digest, NULL) || |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 403 | !EVP_DigestUpdate(&ctx, hs->transcript.buffer->data, |
| 404 | hs->transcript.buffer->length) || |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 405 | !EVP_DigestUpdate(&ctx, msg, len - hash_len - 3) || |
| 406 | !EVP_DigestFinal_ex(&ctx, context, &context_len)) { |
| 407 | EVP_MD_CTX_cleanup(&ctx); |
| 408 | return 0; |
| 409 | } |
| 410 | |
| 411 | EVP_MD_CTX_cleanup(&ctx); |
| 412 | |
| 413 | uint8_t verify_data[EVP_MAX_MD_SIZE] = {0}; |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 414 | if (!tls13_psk_binder(verify_data, digest, ssl->session->master_key, |
| 415 | ssl->session->master_key_length, context, context_len, |
| 416 | hash_len)) { |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 417 | return 0; |
| 418 | } |
| 419 | |
Robert Sloan | 69939df | 2017-01-09 10:53:07 -0800 | [diff] [blame] | 420 | OPENSSL_memcpy(msg + len - hash_len, verify_data, hash_len); |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 421 | return 1; |
| 422 | } |
| 423 | |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 424 | int tls13_verify_psk_binder(SSL_HANDSHAKE *hs, SSL_SESSION *session, |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 425 | CBS *binders) { |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 426 | size_t hash_len = SSL_TRANSCRIPT_digest_len(&hs->transcript); |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 427 | |
| 428 | /* Get the full ClientHello, including message header. It must be large enough |
| 429 | * to exclude the binders. */ |
| 430 | CBS message; |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 431 | hs->ssl->method->get_current_message(hs->ssl, &message); |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 432 | if (CBS_len(&message) < CBS_len(binders) + 2) { |
| 433 | OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| 434 | return 0; |
| 435 | } |
| 436 | |
| 437 | /* Hash a ClientHello prefix up to the binders. For now, this assumes we only |
| 438 | * ever verify PSK binders on initial ClientHellos. */ |
| 439 | uint8_t context[EVP_MAX_MD_SIZE]; |
| 440 | unsigned context_len; |
| 441 | if (!EVP_Digest(CBS_data(&message), CBS_len(&message) - CBS_len(binders) - 2, |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 442 | context, &context_len, SSL_TRANSCRIPT_md(&hs->transcript), |
| 443 | NULL)) { |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 444 | return 0; |
| 445 | } |
| 446 | |
| 447 | uint8_t verify_data[EVP_MAX_MD_SIZE] = {0}; |
| 448 | CBS binder; |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 449 | if (!tls13_psk_binder(verify_data, SSL_TRANSCRIPT_md(&hs->transcript), |
| 450 | session->master_key, session->master_key_length, |
| 451 | context, context_len, hash_len) || |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 452 | /* We only consider the first PSK, so compare against the first binder. */ |
| 453 | !CBS_get_u8_length_prefixed(binders, &binder)) { |
| 454 | OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| 455 | return 0; |
| 456 | } |
| 457 | |
Robert Sloan | 5d62578 | 2017-02-13 09:55:39 -0800 | [diff] [blame] | 458 | int binder_ok = |
| 459 | CBS_len(&binder) == hash_len && |
| 460 | CRYPTO_memcmp(CBS_data(&binder), verify_data, hash_len) == 0; |
Steven Valdez | 909b19f | 2016-11-21 15:35:44 -0500 | [diff] [blame] | 461 | #if defined(BORINGSSL_UNSAFE_FUZZER_MODE) |
| 462 | binder_ok = 1; |
| 463 | #endif |
| 464 | if (!binder_ok) { |
| 465 | OPENSSL_PUT_ERROR(SSL, SSL_R_DIGEST_CHECK_FAILED); |
| 466 | return 0; |
| 467 | } |
| 468 | |
| 469 | return 1; |
| 470 | } |