ims-volte-vowifi
/
strongswan
9
0
Fork 0
Code Pull Requests Releases Activity
strongswan/src/libtls/tls_hkdf.c

744 lines
17 KiB
C
Raw Blame History

/*
* Copyright (C) 2020 Tobias Brunner
* Copyright (C) 2020 Pascal Knecht
* Copyright (C) 2020 Méline Sieber
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "tls_hkdf.h"
#include <bio/bio_writer.h>
#include <crypto/prf_plus.h>
typedef struct private_tls_hkdf_t private_tls_hkdf_t;
typedef struct cached_secrets_t {
chunk_t client;
chunk_t server;
} cached_secrets_t;
typedef enum hkdf_phase {
HKDF_PHASE_0,
HKDF_PHASE_1,
HKDF_PHASE_2,
HKDF_PHASE_3,
} hkdf_phase;
struct private_tls_hkdf_t {
/**
* Public tls_hkdf_t interface.
*/
struct tls_hkdf_t public;
/**
* Phase we are in.
*/
hkdf_phase phase;
/**
* Pseudorandom function used.
*/
prf_t *prf;
/**
* Hasher used.
*/
hasher_t *hasher;
/**
* (EC)DHE as IKM to switch from phase 1 to phase 2
*/
chunk_t shared_secret;
/**
* PSK used.
*/
chunk_t psk;
/**
* PRK used.
*/
chunk_t prk;
/**
* Handshake traffic secrets.
*/
cached_secrets_t handshake_traffic_secrets;
/**
* Current traffic secrets.
*/
cached_secrets_t traffic_secrets;
};
static char *hkdf_labels[] = {
"ext binder",
"res binder",
"c e traffic",
"e exp master",
"c hs traffic",
"s hs traffic",
"c ap traffic",
"s ap traffic",
"exp master",
"res master",
};
/**
* Step 1: Extract, as defined in RFC 5869, section 2.2:
* HKDF-Extract(salt, IKM) -> PRK
*/
static bool extract(private_tls_hkdf_t *this, chunk_t salt, chunk_t ikm,
chunk_t *prk)
{
if (!this->prf->set_key(this->prf, salt))
{
DBG1(DBG_TLS, "unable to set PRF secret to salt");
return FALSE;
}
chunk_clear(prk);
if(!this->prf->allocate_bytes(this->prf, ikm, prk))
{
DBG1(DBG_TLS, "unable to allocate PRF result");
return FALSE;
}
DBG4(DBG_TLS, "PRK: %B", prk);
return TRUE;
}
/**
* Step 2: Expand as defined in RFC 5869, section 2.3:
* HKDF-Expand(PRK, info, L) -> OKM
*/
static bool expand(private_tls_hkdf_t *this, chunk_t prk, chunk_t info,
size_t length, chunk_t *okm)
{
prf_plus_t *prf_plus;
if (!this->prf->set_key(this->prf, prk))
{
DBG1(DBG_TLS, "unable to set PRF secret to PRK");
return FALSE;
}
prf_plus = prf_plus_create(this->prf, TRUE, info);
if (!prf_plus || !prf_plus->allocate_bytes(prf_plus, length, okm))
{
DBG1(DBG_TLS, "unable to allocate PRF+ result");
DESTROY_IF(prf_plus);
return FALSE;
}
prf_plus->destroy(prf_plus);
DBG4(DBG_TLS, "OKM: %B", okm);
return TRUE;
}
/**
* Expand-Label as defined in RFC 8446, section 7.1:
* HKDF-Expand-Label(Secret, Label, Context, Length) -> OKM
*/
static bool expand_label(private_tls_hkdf_t *this, chunk_t secret,
chunk_t label, chunk_t context, uint16_t length,
chunk_t *key)
{
bool success;
if (!label.len || label.len > 249 || context.len > 255)
{
return FALSE;
}
/* HKDFLabel as defined in RFC 8446, section 7.1 */
bio_writer_t *writer = bio_writer_create(0);
writer->write_uint16(writer, length);
label = chunk_cata("cc", chunk_from_str("tls13 "), label);
writer->write_data8(writer, label);
writer->write_data8(writer, context);
success = expand(this, secret, writer->get_buf(writer), length, key);
writer->destroy(writer);
return success;
}
/**
* Derive-Secret as defined in RFC 8446, section 7.1:
* Derive-Secret(Secret, Label, Message) -> OKM
*/
static bool derive_secret(private_tls_hkdf_t *this, chunk_t secret,
chunk_t label, chunk_t messages, chunk_t *okm)
{
chunk_t context;
bool success;
if (!this->hasher->allocate_hash(this->hasher, messages, &context))
{
return FALSE;
}
success = expand_label(this, secret, label, context,
this->hasher->get_hash_size(this->hasher), okm);
chunk_free(&context);
return success;
}
/**
* Move to phase 1 (Early Secret)
*
* 0
* |
* v
* PSK -> HKDF-Extract = Early Secret
* |
* +-----> Derive-Secret(., "ext binder" | "res binder", "")
* | = binder_key
* |
* +-----> Derive-Secret(., "c e traffic", ClientHello)
* | = client_early_traffic_secret
* |
* +-----> Derive-Secret(., "e exp master", ClientHello)
* | = early_exporter_master_secret
* v
*/
static bool move_to_phase_1(private_tls_hkdf_t *this)
{
chunk_t salt_zero, psk = this->psk;
switch (this->phase)
{
case HKDF_PHASE_0:
salt_zero = chunk_alloca(this->hasher->get_hash_size(this->hasher));
chunk_copy_pad(salt_zero, chunk_empty, 0);
if (!psk.ptr)
{
psk = salt_zero;
}
if (!extract(this, salt_zero, psk, &this->prk))
{
DBG1(DBG_TLS, "unable to extract PRK");
return FALSE;
}
this->phase = HKDF_PHASE_1;
return TRUE;
case HKDF_PHASE_1:
return TRUE;
default:
DBG1(DBG_TLS, "invalid HKDF phase");
return FALSE;
}
}
/**
* Move to phase 2 (Handshake Secret)
*
* Derive-Secret(., "derived", "")
* |
* v
* (EC)DHE -> HKDF-Extract = Handshake Secret
* |
* +-----> Derive-Secret(., "c hs traffic",
* | ClientHello...ServerHello)
* | = client_handshake_traffic_secret
* |
* +-----> Derive-Secret(., "s hs traffic",
* | ClientHello...ServerHello)
* | = server_handshake_traffic_secret
* v
*/
static bool move_to_phase_2(private_tls_hkdf_t *this)
{
chunk_t okm;
switch (this->phase)
{
case HKDF_PHASE_0:
if (!move_to_phase_1(this))
{
DBG1(DBG_TLS, "unable to move to phase 1");
return FALSE;
}
/* fall-through */
case HKDF_PHASE_1:
if (!derive_secret(this, this->prk, chunk_from_str("derived"),
chunk_empty, &okm))
{
DBG1(DBG_TLS, "unable to derive secret");
return FALSE;
}
if (!this->shared_secret.ptr)
{
DBG1(DBG_TLS, "no shared secret set");
chunk_clear(&okm);
return FALSE;
}
if (!extract(this, okm, this->shared_secret, &this->prk))
{
DBG1(DBG_TLS, "unable extract PRK");
chunk_clear(&okm);
return FALSE;
}
chunk_clear(&okm);
this->phase = HKDF_PHASE_2;
return TRUE;
case HKDF_PHASE_2:
return TRUE;
default:
DBG1(DBG_TLS, "invalid HKDF phase");
return FALSE;
}
}
/**
* Move to phase 3 (Master Secret)
*
* Derive-Secret(., "derived", "")
* |
* v
* 0 -> HKDF-Extract = Master Secret
* |
* +-----> Derive-Secret(., "c ap traffic",
* | ClientHello...server Finished)
* | = client_application_traffic_secret_0
* |
* +-----> Derive-Secret(., "s ap traffic",
* | ClientHello...server Finished)
* | = server_application_traffic_secret_0
* |
* +-----> Derive-Secret(., "exp master",
* | ClientHello...server Finished)
* | = exporter_master_secret
* |
* +-----> Derive-Secret(., "res master",
* ClientHello...client Finished)
* = resumption_master_secret
*/
static bool move_to_phase_3(private_tls_hkdf_t *this)
{
chunk_t okm, ikm_zero;
switch (this->phase)
{
case HKDF_PHASE_0:
case HKDF_PHASE_1:
if (!move_to_phase_2(this))
{
DBG1(DBG_TLS, "unable to move to phase 2");
return FALSE;
}
/* fall-through */
case HKDF_PHASE_2:
/* prepare okm for next extract */
if (!derive_secret(this, this->prk, chunk_from_str("derived"),
chunk_empty, &okm))
{
DBG1(DBG_TLS, "unable to derive secret");
return FALSE;
}
ikm_zero = chunk_alloca(this->hasher->get_hash_size(this->hasher));
chunk_copy_pad(ikm_zero, chunk_empty, 0);
if (!extract(this, okm, ikm_zero, &this->prk))
{
DBG1(DBG_TLS, "unable extract PRK");
chunk_clear(&okm);
return FALSE;
}
chunk_clear(&okm);
this->phase = HKDF_PHASE_3;
return TRUE;
case HKDF_PHASE_3:
return TRUE;
default:
DBG1(DBG_TLS, "invalid HKDF phase");
return FALSE;
}
}
METHOD(tls_hkdf_t, set_shared_secret, void,
private_tls_hkdf_t *this, chunk_t shared_secret)
{
this->shared_secret = chunk_clone(shared_secret);
}
METHOD(tls_hkdf_t, generate_secret, bool,
private_tls_hkdf_t *this, tls_hkdf_label_t label, chunk_t messages,
chunk_t *secret)
{
chunk_t okm;
switch (label)
{
case TLS_HKDF_EXT_BINDER:
case TLS_HKDF_RES_BINDER:
case TLS_HKDF_C_E_TRAFFIC:
case TLS_HKDF_E_EXP_MASTER:
if (!move_to_phase_1(this))
{
DBG1(DBG_TLS, "unable to move to phase 1");
return FALSE;
}
break;
case TLS_HKDF_C_HS_TRAFFIC:
case TLS_HKDF_S_HS_TRAFFIC:
if (!move_to_phase_2(this))
{
DBG1(DBG_TLS, "unable to move to phase 2");
return FALSE;
}
break;
case TLS_HKDF_C_AP_TRAFFIC:
case TLS_HKDF_S_AP_TRAFFIC:
case TLS_HKDF_EXP_MASTER:
case TLS_HKDF_RES_MASTER:
if (!move_to_phase_3(this))
{
DBG1(DBG_TLS, "unable to move to phase 3");
return FALSE;
}
break;
case TLS_HKDF_UPD_C_TRAFFIC:
case TLS_HKDF_UPD_S_TRAFFIC:
if (this->phase != HKDF_PHASE_3)
{
DBG1(DBG_TLS, "unable to update traffic keys");
return FALSE;
}
break;
default:
DBG1(DBG_TLS, "invalid HKDF label");
return FALSE;
}
if (label == TLS_HKDF_UPD_C_TRAFFIC || label == TLS_HKDF_UPD_S_TRAFFIC)
{
chunk_t previous = this->traffic_secrets.client;
if (label == TLS_HKDF_UPD_S_TRAFFIC)
{
previous = this->traffic_secrets.server;
}
if (!expand_label(this, previous, chunk_from_str("traffic upd"),
chunk_empty, this->hasher->get_hash_size(this->hasher),
&okm))
{
DBG1(DBG_TLS, "unable to update secret");
return FALSE;
}
}
else
{
if (!derive_secret(this, this->prk, chunk_from_str(hkdf_labels[label]),
messages, &okm))
{
DBG1(DBG_TLS, "unable to derive secret");
return FALSE;
}
}
switch (label)
{
case TLS_HKDF_C_HS_TRAFFIC:
chunk_clear(&this->handshake_traffic_secrets.client);
this->handshake_traffic_secrets.client = chunk_clone(okm);
/* fall-through */
case TLS_HKDF_C_AP_TRAFFIC:
case TLS_HKDF_UPD_C_TRAFFIC:
chunk_clear(&this->traffic_secrets.client);
this->traffic_secrets.client = chunk_clone(okm);
break;
case TLS_HKDF_S_HS_TRAFFIC:
chunk_clear(&this->handshake_traffic_secrets.server);
this->handshake_traffic_secrets.server = chunk_clone(okm);
/* fall-through */
case TLS_HKDF_S_AP_TRAFFIC:
case TLS_HKDF_UPD_S_TRAFFIC:
chunk_clear(&this->traffic_secrets.server);
this->traffic_secrets.server = chunk_clone(okm);
break;
default:
break;
}
if (secret)
{
*secret = okm;
}
else
{
chunk_clear(&okm);
}
return TRUE;
}
/**
* Derive keys/IVs from the current traffic secrets.
*/
static bool get_shared_label_keys(private_tls_hkdf_t *this, chunk_t label,
cached_secrets_t *secrets,
bool server, size_t length, chunk_t *key)
{
chunk_t result = chunk_empty, secret;
secret = server ? secrets->server : secrets->client;
if (!expand_label(this, secret, label, chunk_empty, length, &result))
{
DBG1(DBG_TLS, "unable to derive labeled secret");
chunk_clear(&result);
return FALSE;
}
if (key)
{
*key = result;
}
else
{
chunk_clear(&result);
}
return TRUE;
}
METHOD(tls_hkdf_t, derive_key, bool,
private_tls_hkdf_t *this, bool is_server, size_t length, chunk_t *key)
{
return get_shared_label_keys(this, chunk_from_str("key"),
&this->traffic_secrets, is_server, length, key);
}
METHOD(tls_hkdf_t, derive_iv, bool,
private_tls_hkdf_t *this, bool is_server, size_t length, chunk_t *iv)
{
return get_shared_label_keys(this, chunk_from_str("iv"),
&this->traffic_secrets, is_server, length, iv);
}
METHOD(tls_hkdf_t, derive_finished, bool,
private_tls_hkdf_t *this, bool server, chunk_t *finished)
{
return get_shared_label_keys(this, chunk_from_str("finished"),
&this->handshake_traffic_secrets, server,
this->hasher->get_hash_size(this->hasher),
finished);
}
METHOD(tls_hkdf_t, export, bool,
private_tls_hkdf_t *this, char *label, chunk_t context,
chunk_t messages, size_t length, chunk_t *key)
{
chunk_t exporter_master, exporter, hash = chunk_empty;
if (this->phase != HKDF_PHASE_3)
{
DBG1(DBG_TLS, "unable to export key material");
return FALSE;
}
/**
* Export key material according to RFC 8446, section 7.5:
*
* TLS-Exporter(label, context_value, key_length) =
* HKDF-Expand-Label(Derive-Secret(Secret, label, ""),
* "exporter", Hash(context_value), key_length)
*/
if (!generate_secret(this, TLS_HKDF_EXP_MASTER, messages, &exporter_master))
{
DBG1(DBG_TLS, "unable to derive exporter master secret");
return FALSE;
}
if (!derive_secret(this, exporter_master, chunk_from_str(label),
chunk_empty, &exporter))
{
DBG1(DBG_TLS, "unable to derive exporter secret");
chunk_clear(&exporter_master);
return FALSE;
}
chunk_clear(&exporter_master);
if (!this->hasher->allocate_hash(this->hasher, context, &hash) ||
!expand_label(this, exporter, chunk_from_str("exporter"), hash,
length, key))
{
DBG1(DBG_TLS, "unable to expand key material");
chunk_clear(&exporter);
chunk_free(&hash);
return FALSE;
}
chunk_clear(&exporter);
chunk_free(&hash);
return TRUE;
}
METHOD(tls_hkdf_t, resume, bool,
private_tls_hkdf_t *this, chunk_t messages, chunk_t nonce, chunk_t *key)
{
chunk_t resumption_master;
if (this->phase != HKDF_PHASE_3)
{
DBG1(DBG_TLS, "unable to generate resumption key material");
return FALSE;
}
if (!nonce.len)
{
DBG1(DBG_TLS, "no nonce provided");
return FALSE;
}
/**
* PSK associated with the ticket according to RFC 8446, section 4.6.1
*
* HKDF-Expand-Label(resumption_master_secret,
* "resumption", ticket_nonce, Hash.length)
*/
if (!generate_secret(this, TLS_HKDF_RES_MASTER, messages,
&resumption_master))
{
DBG1(DBG_TLS, "unable to derive resumption master secret");
return FALSE;
}
if (!expand_label(this, resumption_master, chunk_from_str("resumption"),
nonce, this->hasher->get_hash_size(this->hasher), key))
{
chunk_clear(&resumption_master);
DBG1(DBG_TLS, "unable to expand key material");
return FALSE;
}
chunk_clear(&resumption_master);
return TRUE;
}
METHOD(tls_hkdf_t, binder, bool,
private_tls_hkdf_t *this, chunk_t seed, chunk_t *out)
{
chunk_t binder_key, finished_key;
if (!generate_secret(this, TLS_HKDF_RES_BINDER, chunk_empty, &binder_key))
{
DBG1(DBG_TLS, "unable to derive binder key");
return FALSE;
}
if (!expand_label(this, binder_key, chunk_from_str("finished"), chunk_empty,
this->hasher->get_hash_size(this->hasher), &finished_key))
{
chunk_clear(&binder_key);
return FALSE;
}
chunk_clear(&binder_key);
if (!this->prf->set_key(this->prf, finished_key) ||
!this->prf->allocate_bytes(this->prf, seed, out))
{
chunk_clear(&finished_key);
return FALSE;
}
chunk_clear(&finished_key);
return TRUE;
}
METHOD(tls_hkdf_t, allocate_bytes, bool,
private_tls_hkdf_t *this, chunk_t key, chunk_t seed,
chunk_t *out)
{
return this->prf->set_key(this->prf, key) &&
this->prf->allocate_bytes(this->prf, seed, out);
}
/**
* Clean up secrets
*/
static void destroy_secrets(cached_secrets_t *secrets)
{
chunk_clear(&secrets->client);
chunk_clear(&secrets->server);
}
METHOD(tls_hkdf_t, destroy, void,
private_tls_hkdf_t *this)
{
chunk_clear(&this->psk);
chunk_clear(&this->prk);
chunk_clear(&this->shared_secret);
destroy_secrets(&this->handshake_traffic_secrets);
destroy_secrets(&this->traffic_secrets);
DESTROY_IF(this->prf);
DESTROY_IF(this->hasher);
free(this);
}
tls_hkdf_t *tls_hkdf_create(hash_algorithm_t hash_algorithm, chunk_t psk)
{
private_tls_hkdf_t *this;
pseudo_random_function_t prf_algorithm;
switch (hash_algorithm)
{
case HASH_SHA256:
prf_algorithm = PRF_HMAC_SHA2_256;
break;
case HASH_SHA384:
prf_algorithm = PRF_HMAC_SHA2_384;
break;
default:
DBG1(DBG_TLS, "unsupported hash algorithm %N", hash_algorithm_names,
hash_algorithm);
return NULL;
}
INIT(this,
.public = {
.set_shared_secret = _set_shared_secret,
.generate_secret = _generate_secret,
.derive_key = _derive_key,
.derive_iv = _derive_iv,
.derive_finished = _derive_finished,
.export = _export,
.resume = _resume,
.binder = _binder,
.allocate_bytes = _allocate_bytes,
.destroy = _destroy,
},
.phase = HKDF_PHASE_0,
.psk = psk.ptr ? chunk_clone(psk) : chunk_empty,
.prf = lib->crypto->create_prf(lib->crypto, prf_algorithm),
.hasher = lib->crypto->create_hasher(lib->crypto, hash_algorithm),
);
if (!this->prf || !this->hasher)
{
if (!this->prf)
{
DBG1(DBG_TLS, "%N not supported", pseudo_random_function_names,
prf_algorithm);
}
if (!this->hasher)
{
DBG1(DBG_TLS, "%N not supported", hash_algorithm_names,
hash_algorithm);
}
DBG1(DBG_TLS, "unable to initialize HKDF");
destroy(this);
return NULL;
}
return &this->public;
}
View Git Blame Copy Permalink