/*
- * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
EVP_PKEY *key = NULL;
EVP_MD_CTX *ctx = EVP_MD_CTX_new();
- if (!ssl_handshake_hash(s, hash, sizeof(hash), &hashlen))
+ if (!ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) {
+ /* SSLfatal() already called */
goto err;
+ }
if (str == s->method->ssl3_enc->server_finished_label)
- key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL,
- s->server_finished_secret, hashlen);
+ key = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL,
+ s->server_finished_secret, hashlen);
else
- key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL,
- s->client_finished_secret, hashlen);
+ key = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL,
+ s->client_finished_secret, hashlen);
if (key == NULL
|| ctx == NULL
|| EVP_DigestSignInit(ctx, NULL, md, NULL, key) <= 0
|| EVP_DigestSignUpdate(ctx, hash, hashlen) <= 0
- || EVP_DigestSignFinal(ctx, out, &hashlen) <= 0)
+ || EVP_DigestSignFinal(ctx, out, &hashlen) <= 0) {
+ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS13_FINAL_FINISH_MAC,
+ ERR_R_INTERNAL_ERROR);
goto err;
+ }
ret = hashlen;
err:
static const unsigned char server_application_traffic[] = "s ap traffic";
static const unsigned char exporter_master_secret[] = "exp master";
static const unsigned char resumption_master_secret[] = "res master";
+ static const unsigned char early_exporter_master_secret[] = "e exp master";
unsigned char *iv;
unsigned char secret[EVP_MAX_MD_SIZE];
unsigned char hashval[EVP_MAX_MD_SIZE];
SSL_F_TLS13_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE);
goto err;
}
+ EVP_CIPHER_CTX_ctrl(s->enc_write_ctx, EVP_CTRL_SET_DRBG, 0, s->drbg);
}
ciph_ctx = s->enc_write_ctx;
iv = s->write_iv;
}
hashlen = hashlenui;
EVP_MD_CTX_free(mdctx);
+
+ if (!tls13_hkdf_expand(s, md, insecret,
+ early_exporter_master_secret,
+ sizeof(early_exporter_master_secret) - 1,
+ hashval, hashlen,
+ s->early_exporter_master_secret, hashlen)) {
+ SSLfatal(s, SSL_AD_INTERNAL_ERROR,
+ SSL_F_TLS13_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
+ goto err;
+ }
} else if (which & SSL3_CC_HANDSHAKE) {
insecret = s->handshake_secret;
finsecret = s->client_finished_secret;
goto err;
}
s->session->master_key_length = hashlen;
-
- /* Now we create the exporter master secret */
- if (!tls13_hkdf_expand(s, ssl_handshake_md(s), insecret,
- exporter_master_secret,
- sizeof(exporter_master_secret) - 1,
- hash, hashlen, s->exporter_master_secret,
- hashlen)) {
- /* SSLfatal() already called */
- goto err;
- }
}
if (!derive_secret_key_and_iv(s, which & SSL3_CC_WRITE, md, cipher,
goto err;
}
- if (label == server_application_traffic)
+ if (label == server_application_traffic) {
memcpy(s->server_app_traffic_secret, secret, hashlen);
- else if (label == client_application_traffic)
+ /* Now we create the exporter master secret */
+ if (!tls13_hkdf_expand(s, ssl_handshake_md(s), insecret,
+ exporter_master_secret,
+ sizeof(exporter_master_secret) - 1,
+ hash, hashlen, s->exporter_master_secret,
+ hashlen)) {
+ /* SSLfatal() already called */
+ goto err;
+ }
+ } else if (label == client_application_traffic)
memcpy(s->client_app_traffic_secret, secret, hashlen);
if (!ssl_log_secret(s, log_label, secret, hashlen)) {
unsigned int hashsize, datalen;
int ret = 0;
- if (ctx == NULL || !SSL_is_init_finished(s))
+ if (ctx == NULL || !ossl_statem_export_allowed(s))
goto err;
if (!use_context)
EVP_MD_CTX_free(ctx);
return ret;
}
+
+int tls13_export_keying_material_early(SSL *s, unsigned char *out, size_t olen,
+ const char *label, size_t llen,
+ const unsigned char *context,
+ size_t contextlen)
+{
+ static const unsigned char exporterlabel[] = "exporter";
+ unsigned char exportsecret[EVP_MAX_MD_SIZE];
+ unsigned char hash[EVP_MAX_MD_SIZE], data[EVP_MAX_MD_SIZE];
+ const EVP_MD *md;
+ EVP_MD_CTX *ctx = EVP_MD_CTX_new();
+ unsigned int hashsize, datalen;
+ int ret = 0;
+ const SSL_CIPHER *sslcipher;
+
+ if (ctx == NULL || !ossl_statem_export_early_allowed(s))
+ goto err;
+
+ if (!s->server && s->max_early_data > 0
+ && s->session->ext.max_early_data == 0)
+ sslcipher = SSL_SESSION_get0_cipher(s->psksession);
+ else
+ sslcipher = SSL_SESSION_get0_cipher(s->session);
+
+ md = ssl_md(sslcipher->algorithm2);
+
+ /*
+ * Calculate the hash value and store it in |data|. The reason why
+ * the empty string is used is that the definition of TLS-Exporter
+ * is like so:
+ *
+ * TLS-Exporter(label, context_value, key_length) =
+ * HKDF-Expand-Label(Derive-Secret(Secret, label, ""),
+ * "exporter", Hash(context_value), key_length)
+ *
+ * Derive-Secret(Secret, Label, Messages) =
+ * HKDF-Expand-Label(Secret, Label,
+ * Transcript-Hash(Messages), Hash.length)
+ *
+ * Here Transcript-Hash is the cipher suite hash algorithm.
+ */
+ if (EVP_DigestInit_ex(ctx, md, NULL) <= 0
+ || EVP_DigestUpdate(ctx, context, contextlen) <= 0
+ || EVP_DigestFinal_ex(ctx, hash, &hashsize) <= 0
+ || EVP_DigestInit_ex(ctx, md, NULL) <= 0
+ || EVP_DigestFinal_ex(ctx, data, &datalen) <= 0
+ || !tls13_hkdf_expand(s, md, s->early_exporter_master_secret,
+ (const unsigned char *)label, llen,
+ data, datalen, exportsecret, hashsize)
+ || !tls13_hkdf_expand(s, md, exportsecret, exporterlabel,
+ sizeof(exporterlabel) - 1, hash, hashsize,
+ out, olen))
+ goto err;
+
+ ret = 1;
+ err:
+ EVP_MD_CTX_free(ctx);
+ return ret;
+}