commit 040a9517b59971479cbde82e4718121aa83cecfa
author Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> Mon May 06 12:05:58 2019 +0200
committer Jarno Lamsa <jarno.lamsa@arm.com> Fri Aug 23 12:45:33 2019 +0300
tree 459da61083f7ff60e125567df09381dd70397d8f
parent de718b99b5181570af5a8f5cc78366ee7223670d

Move handling of randbytes to derive_keys()

library/ssl_tls.c

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 877fee8..3e23b67 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -989,7 +989,6 @@
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
     int psa_fallthrough;
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
-    unsigned char tmp[64];
     unsigned char keyblk[256];
     unsigned char *key1;
     unsigned char *key2;
@@ -1006,8 +1005,6 @@
     mbedtls_ssl_transform *transform = ssl->transform_negotiate;
     mbedtls_ssl_handshake_params *handshake = ssl->handshake;
 
-    MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
-
 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \
     defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
     transform->encrypt_then_mac = session->encrypt_then_mac;
@@ -1052,14 +1049,6 @@
 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
 
     /*
-     * Swap the client and server random values.
-     */
-    memcpy( tmp, handshake->randbytes, 64 );
-    memcpy( handshake->randbytes, tmp + 32, 32 );
-    memcpy( handshake->randbytes + 32, tmp, 32 );
-    mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
-
-    /*
      *  SSLv3:
      *    key block =
      *      MD5( master + SHA1( 'A'    + master + randbytes ) ) +
@@ -1505,11 +1494,8 @@
     }
 #endif /* MBEDTLS_ZLIB_SUPPORT */
 
-    MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
 end:
     mbedtls_platform_zeroize( keyblk, sizeof( keyblk ) );
-    mbedtls_platform_zeroize( handshake->randbytes,
-                              sizeof( handshake->randbytes ) );
     return( ret );
 }
 
@@ -1726,6 +1712,9 @@
     const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
         ssl->handshake->ciphersuite_info;
 
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
+
+    /* Set PRF, calc_verify and calc_finished function pointers */
     ret = ssl_set_handshake_prfs( ssl->handshake,
                                   ssl->minor_ver,
                                   ciphersuite_info->mac );
@@ -1735,6 +1724,7 @@
         return( ret );
     }
 
+    /* Compute master secret if needed */
     ret = ssl_compute_master( ssl->handshake,
                               ssl->session_negotiate->master,
                               ssl );
@@ -1744,7 +1734,32 @@
         return( ret );
     }
 
-    return( ssl_populate_transform( ssl ) );
+    /* Swap the client and server random values:
+     * - MS derivation wanted client+server (RFC 5246 8.1)
+     * - key derivation wants server+client (RFC 5246 6.3) */
+    {
+        unsigned char tmp[64];
+        memcpy( tmp, ssl->handshake->randbytes, 64 );
+        memcpy( ssl->handshake->randbytes, tmp + 32, 32 );
+        memcpy( ssl->handshake->randbytes + 32, tmp, 32 );
+        mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
+    }
+
+    /* Populate transform structure */
+    ret = ssl_populate_transform( ssl );
+    if( ret != 0 )
+    {
+        MBEDTLS_SSL_DEBUG_RET( 1, "ssl_populate_transform", ret );
+        return( ret );
+    }
+
+    /* We no longer need Server/ClientHello.random values */
+    mbedtls_platform_zeroize( ssl->handshake->randbytes,
+                      sizeof( ssl->handshake->randbytes ) );
+
+    MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
+
+    return( 0 );
 }
 
 #if defined(MBEDTLS_SSL_PROTO_SSL3)