/*
- * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
#include <openssl/evp.h>
#include <openssl/kdf.h>
-#define TLS13_MAX_LABEL_LEN 246
+/*
+ * RFC 8446, 7.1 Key Schedule, says:
+ * Note: With common hash functions, any label longer than 12 characters
+ * requires an additional iteration of the hash function to compute.
+ * The labels in this specification have all been chosen to fit within
+ * this limit.
+ */
+#define TLS13_MAX_LABEL_LEN 12
/* Always filled with zeros */
static const unsigned char default_zeros[EVP_MAX_MD_SIZE];
const unsigned char *data, size_t datalen,
unsigned char *out, size_t outlen)
{
- const unsigned char label_prefix[] = "tls13 ";
+ static const unsigned char label_prefix[] = "tls13 ";
EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
int ret;
size_t hkdflabellen;
size_t hashlen;
/*
- * 2 bytes for length of whole HkdfLabel + 1 byte for length of combined
- * prefix and label + bytes for the label itself + bytes for the hash
+ * 2 bytes for length of derived secret + 1 byte for length of combined
+ * prefix and label + bytes for the label itself + 1 byte length of hash
+ * + bytes for the hash itself
*/
unsigned char hkdflabel[sizeof(uint16_t) + sizeof(uint8_t) +
+ sizeof(label_prefix) + TLS13_MAX_LABEL_LEN
unsigned char *outsecret)
{
size_t mdlen, prevsecretlen;
+ int mdleni;
int ret;
EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
static const char derived_secret_label[] = "derived";
return 0;
}
- mdlen = EVP_MD_size(md);
+ mdleni = EVP_MD_size(md);
+ /* Ensure cast to size_t is safe */
+ if (!ossl_assert(mdleni >= 0)) {
+ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS13_GENERATE_SECRET,
+ ERR_R_INTERNAL_ERROR);
+ return 0;
+ }
+ mdlen = (size_t)mdleni;
if (insecret == NULL) {
insecret = default_zeros;
goto err;
}
- if (str == s->method->ssl3_enc->server_finished_label)
- key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL,
- s->server_finished_secret, hashlen);
- else
- key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL,
- s->client_finished_secret, hashlen);
+ if (str == s->method->ssl3_enc->server_finished_label) {
+ key = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL,
+ s->server_finished_secret, hashlen);
+ } else if (SSL_IS_FIRST_HANDSHAKE(s)) {
+ key = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL,
+ s->client_finished_secret, hashlen);
+ } else {
+ unsigned char finsecret[EVP_MAX_MD_SIZE];
+
+ if (!tls13_derive_finishedkey(s, ssl_handshake_md(s),
+ s->client_app_traffic_secret,
+ finsecret, hashlen))
+ goto err;
+
+ key = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL, finsecret,
+ hashlen);
+ OPENSSL_cleanse(finsecret, sizeof(finsecret));
+ }
if (key == NULL
|| ctx == NULL
{
unsigned char key[EVP_MAX_KEY_LENGTH];
size_t ivlen, keylen, taglen;
- size_t hashlen = EVP_MD_size(md);
+ int hashleni = EVP_MD_size(md);
+ size_t hashlen;
+
+ /* Ensure cast to size_t is safe */
+ if (!ossl_assert(hashleni >= 0)) {
+ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DERIVE_SECRET_KEY_AND_IV,
+ ERR_R_EVP_LIB);
+ goto err;
+ }
+ hashlen = (size_t)hashleni;
if (!tls13_hkdf_expand(s, md, insecret, label, labellen, hash, hashlen,
secret, hashlen)) {
static const unsigned char server_application_traffic[] = "s ap traffic";
static const unsigned char exporter_master_secret[] = "exp master";
static const unsigned char resumption_master_secret[] = "res master";
+ static const unsigned char early_exporter_master_secret[] = "e exp master";
unsigned char *iv;
unsigned char secret[EVP_MAX_MD_SIZE];
unsigned char hashval[EVP_MAX_MD_SIZE];
RECORD_LAYER_reset_read_sequence(&s->rlayer);
} else {
+ s->statem.enc_write_state = ENC_WRITE_STATE_INVALID;
if (s->enc_write_ctx != NULL) {
EVP_CIPHER_CTX_reset(s->enc_write_ctx);
} else {
}
hashlen = hashlenui;
EVP_MD_CTX_free(mdctx);
+
+ if (!tls13_hkdf_expand(s, md, insecret,
+ early_exporter_master_secret,
+ sizeof(early_exporter_master_secret) - 1,
+ hashval, hashlen,
+ s->early_exporter_master_secret, hashlen)) {
+ SSLfatal(s, SSL_AD_INTERNAL_ERROR,
+ SSL_F_TLS13_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
+ goto err;
+ }
+
+ if (!ssl_log_secret(s, EARLY_EXPORTER_SECRET_LABEL,
+ s->early_exporter_master_secret, hashlen)) {
+ /* SSLfatal() already called */
+ goto err;
+ }
} else if (which & SSL3_CC_HANDSHAKE) {
insecret = s->handshake_secret;
finsecret = s->client_finished_secret;
if (!tls13_hkdf_expand(s, ssl_handshake_md(s), insecret,
resumption_master_secret,
sizeof(resumption_master_secret) - 1,
- hashval, hashlen, s->session->master_key,
+ hashval, hashlen, s->resumption_master_secret,
hashlen)) {
/* SSLfatal() already called */
goto err;
}
- s->session->master_key_length = hashlen;
+ }
+ if (!derive_secret_key_and_iv(s, which & SSL3_CC_WRITE, md, cipher,
+ insecret, hash, label, labellen, secret, iv,
+ ciph_ctx)) {
+ /* SSLfatal() already called */
+ goto err;
+ }
+
+ if (label == server_application_traffic) {
+ memcpy(s->server_app_traffic_secret, secret, hashlen);
/* Now we create the exporter master secret */
if (!tls13_hkdf_expand(s, ssl_handshake_md(s), insecret,
exporter_master_secret,
/* SSLfatal() already called */
goto err;
}
- }
- if (!derive_secret_key_and_iv(s, which & SSL3_CC_WRITE, md, cipher,
- insecret, hash, label, labellen, secret, iv,
- ciph_ctx)) {
- /* SSLfatal() already called */
- goto err;
- }
-
- if (label == server_application_traffic)
- memcpy(s->server_app_traffic_secret, secret, hashlen);
- else if (label == client_application_traffic)
+ if (!ssl_log_secret(s, EXPORTER_SECRET_LABEL, s->exporter_master_secret,
+ hashlen)) {
+ /* SSLfatal() already called */
+ goto err;
+ }
+ } else if (label == client_application_traffic)
memcpy(s->client_app_traffic_secret, secret, hashlen);
if (!ssl_log_secret(s, log_label, secret, hashlen)) {
goto err;
}
+ if (!s->server && label == client_early_traffic)
+ s->statem.enc_write_state = ENC_WRITE_STATE_WRITE_PLAIN_ALERTS;
+ else
+ s->statem.enc_write_state = ENC_WRITE_STATE_VALID;
ret = 1;
err:
OPENSSL_cleanse(secret, sizeof(secret));
insecret = s->client_app_traffic_secret;
if (sending) {
+ s->statem.enc_write_state = ENC_WRITE_STATE_INVALID;
iv = s->write_iv;
ciph_ctx = s->enc_write_ctx;
RECORD_LAYER_reset_write_sequence(&s->rlayer);
memcpy(insecret, secret, hashlen);
+ s->statem.enc_write_state = ENC_WRITE_STATE_VALID;
ret = 1;
err:
OPENSSL_cleanse(secret, sizeof(secret));
int tls13_alert_code(int code)
{
- if (code == SSL_AD_MISSING_EXTENSION)
+ /* There are 2 additional alerts in TLSv1.3 compared to TLSv1.2 */
+ if (code == SSL_AD_MISSING_EXTENSION || code == SSL_AD_CERTIFICATE_REQUIRED)
return code;
return tls1_alert_code(code);
unsigned int hashsize, datalen;
int ret = 0;
- if (ctx == NULL || !SSL_is_init_finished(s))
+ if (ctx == NULL || !ossl_statem_export_allowed(s))
goto err;
if (!use_context)
EVP_MD_CTX_free(ctx);
return ret;
}
+
+int tls13_export_keying_material_early(SSL *s, unsigned char *out, size_t olen,
+ const char *label, size_t llen,
+ const unsigned char *context,
+ size_t contextlen)
+{
+ static const unsigned char exporterlabel[] = "exporter";
+ unsigned char exportsecret[EVP_MAX_MD_SIZE];
+ unsigned char hash[EVP_MAX_MD_SIZE], data[EVP_MAX_MD_SIZE];
+ const EVP_MD *md;
+ EVP_MD_CTX *ctx = EVP_MD_CTX_new();
+ unsigned int hashsize, datalen;
+ int ret = 0;
+ const SSL_CIPHER *sslcipher;
+
+ if (ctx == NULL || !ossl_statem_export_early_allowed(s))
+ goto err;
+
+ if (!s->server && s->max_early_data > 0
+ && s->session->ext.max_early_data == 0)
+ sslcipher = SSL_SESSION_get0_cipher(s->psksession);
+ else
+ sslcipher = SSL_SESSION_get0_cipher(s->session);
+
+ md = ssl_md(sslcipher->algorithm2);
+
+ /*
+ * Calculate the hash value and store it in |data|. The reason why
+ * the empty string is used is that the definition of TLS-Exporter
+ * is like so:
+ *
+ * TLS-Exporter(label, context_value, key_length) =
+ * HKDF-Expand-Label(Derive-Secret(Secret, label, ""),
+ * "exporter", Hash(context_value), key_length)
+ *
+ * Derive-Secret(Secret, Label, Messages) =
+ * HKDF-Expand-Label(Secret, Label,
+ * Transcript-Hash(Messages), Hash.length)
+ *
+ * Here Transcript-Hash is the cipher suite hash algorithm.
+ */
+ if (EVP_DigestInit_ex(ctx, md, NULL) <= 0
+ || EVP_DigestUpdate(ctx, context, contextlen) <= 0
+ || EVP_DigestFinal_ex(ctx, hash, &hashsize) <= 0
+ || EVP_DigestInit_ex(ctx, md, NULL) <= 0
+ || EVP_DigestFinal_ex(ctx, data, &datalen) <= 0
+ || !tls13_hkdf_expand(s, md, s->early_exporter_master_secret,
+ (const unsigned char *)label, llen,
+ data, datalen, exportsecret, hashsize)
+ || !tls13_hkdf_expand(s, md, exportsecret, exporterlabel,
+ sizeof(exporterlabel) - 1, hash, hashsize,
+ out, olen))
+ goto err;
+
+ ret = 1;
+ err:
+ EVP_MD_CTX_free(ctx);
+ return ret;
+}