Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 1 | /* |
| 2 | * TLS 1.3 key schedule |
| 3 | * |
| 4 | * Copyright The Mbed TLS Contributors |
| 5 | * SPDX-License-Identifier: Apache-2.0 |
| 6 | * |
| 7 | * Licensed under the Apache License, Version 2.0 ( the "License" ); you may |
| 8 | * not use this file except in compliance with the License. |
| 9 | * You may obtain a copy of the License at |
| 10 | * |
| 11 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 12 | * |
| 13 | * Unless required by applicable law or agreed to in writing, software |
| 14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 16 | * See the License for the specific language governing permissions and |
| 17 | * limitations under the License. |
| 18 | */ |
| 19 | |
Hanno Becker | 58c5cea | 2020-09-08 10:31:33 +0100 | [diff] [blame] | 20 | #include "common.h" |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 21 | |
Ronald Cron | 6f135e1 | 2021-12-08 16:57:54 +0100 | [diff] [blame] | 22 | #if defined(MBEDTLS_SSL_PROTO_TLS1_3) |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 23 | |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 24 | #include <stdint.h> |
| 25 | #include <string.h> |
| 26 | |
Jerry Yu | e3131ef | 2021-09-16 13:14:15 +0800 | [diff] [blame] | 27 | #include "mbedtls/hkdf.h" |
| 28 | #include "mbedtls/debug.h" |
| 29 | #include "mbedtls/error.h" |
Jerry Yu | e110d25 | 2022-05-05 10:19:22 +0800 | [diff] [blame] | 30 | #include "mbedtls/platform.h" |
Jerry Yu | e3131ef | 2021-09-16 13:14:15 +0800 | [diff] [blame] | 31 | |
| 32 | #include "ssl_misc.h" |
| 33 | #include "ssl_tls13_keys.h" |
Gabor Mezei | a3eecd2 | 2022-02-09 16:57:26 +0100 | [diff] [blame] | 34 | #include "ssl_tls13_invasive.h" |
| 35 | |
| 36 | #include "psa/crypto.h" |
Jerry Yu | e3131ef | 2021-09-16 13:14:15 +0800 | [diff] [blame] | 37 | |
Hanno Becker | 1413bd8 | 2020-09-09 12:46:09 +0100 | [diff] [blame] | 38 | #define MBEDTLS_SSL_TLS1_3_LABEL( name, string ) \ |
Hanno Becker | e4435ea | 2020-09-08 10:43:52 +0100 | [diff] [blame] | 39 | .name = string, |
| 40 | |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 41 | struct mbedtls_ssl_tls13_labels_struct const mbedtls_ssl_tls13_labels = |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 42 | { |
| 43 | /* This seems to work in C, despite the string literal being one |
| 44 | * character too long due to the 0-termination. */ |
Hanno Becker | e4435ea | 2020-09-08 10:43:52 +0100 | [diff] [blame] | 45 | MBEDTLS_SSL_TLS1_3_LABEL_LIST |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 46 | }; |
| 47 | |
Hanno Becker | a3a5a4e | 2020-09-08 11:33:48 +0100 | [diff] [blame] | 48 | #undef MBEDTLS_SSL_TLS1_3_LABEL |
Hanno Becker | e4435ea | 2020-09-08 10:43:52 +0100 | [diff] [blame] | 49 | |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 50 | /* |
| 51 | * This function creates a HkdfLabel structure used in the TLS 1.3 key schedule. |
| 52 | * |
| 53 | * The HkdfLabel is specified in RFC 8446 as follows: |
| 54 | * |
| 55 | * struct HkdfLabel { |
| 56 | * uint16 length; // Length of expanded key material |
| 57 | * opaque label<7..255>; // Always prefixed by "tls13 " |
| 58 | * opaque context<0..255>; // Usually a communication transcript hash |
| 59 | * }; |
| 60 | * |
| 61 | * Parameters: |
| 62 | * - desired_length: Length of expanded key material |
| 63 | * Even though the standard allows expansion to up to |
| 64 | * 2**16 Bytes, TLS 1.3 never uses expansion to more than |
| 65 | * 255 Bytes, so we require `desired_length` to be at most |
| 66 | * 255. This allows us to save a few Bytes of code by |
| 67 | * hardcoding the writing of the high bytes. |
Xiaofei Bai | feecbbb | 2021-11-23 07:24:58 +0000 | [diff] [blame] | 68 | * - (label, label_len): label + label length, without "tls13 " prefix |
| 69 | * The label length MUST be less than or equal to |
| 70 | * MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_LABEL_LEN |
| 71 | * It is the caller's responsibility to ensure this. |
| 72 | * All (label, label length) pairs used in TLS 1.3 |
| 73 | * can be obtained via MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(). |
| 74 | * - (ctx, ctx_len): context + context length |
| 75 | * The context length MUST be less than or equal to |
| 76 | * MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_CONTEXT_LEN |
| 77 | * It is the caller's responsibility to ensure this. |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 78 | * - dst: Target buffer for HkdfLabel structure, |
| 79 | * This MUST be a writable buffer of size |
| 80 | * at least SSL_TLS1_3_KEY_SCHEDULE_MAX_HKDF_LABEL_LEN Bytes. |
Xiaofei Bai | feecbbb | 2021-11-23 07:24:58 +0000 | [diff] [blame] | 81 | * - dst_len: Pointer at which to store the actual length of |
| 82 | * the HkdfLabel structure on success. |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 83 | */ |
| 84 | |
Xiaofei Bai | d25fab6 | 2021-12-02 06:36:27 +0000 | [diff] [blame] | 85 | static const char tls13_label_prefix[6] = "tls13 "; |
Hanno Becker | 2dfe132 | 2020-09-10 09:23:12 +0100 | [diff] [blame] | 86 | |
Hanno Becker | 9cb0a14 | 2020-09-08 10:48:14 +0100 | [diff] [blame] | 87 | #define SSL_TLS1_3_KEY_SCHEDULE_HKDF_LABEL_LEN( label_len, context_len ) \ |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 88 | ( 2 /* expansion length */ \ |
| 89 | + 1 /* label length */ \ |
Hanno Becker | 9cb0a14 | 2020-09-08 10:48:14 +0100 | [diff] [blame] | 90 | + label_len \ |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 91 | + 1 /* context length */ \ |
Hanno Becker | 9cb0a14 | 2020-09-08 10:48:14 +0100 | [diff] [blame] | 92 | + context_len ) |
| 93 | |
| 94 | #define SSL_TLS1_3_KEY_SCHEDULE_MAX_HKDF_LABEL_LEN \ |
| 95 | SSL_TLS1_3_KEY_SCHEDULE_HKDF_LABEL_LEN( \ |
Xiaofei Bai | d25fab6 | 2021-12-02 06:36:27 +0000 | [diff] [blame] | 96 | sizeof(tls13_label_prefix) + \ |
Hanno Becker | 9cb0a14 | 2020-09-08 10:48:14 +0100 | [diff] [blame] | 97 | MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_LABEL_LEN, \ |
| 98 | MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_CONTEXT_LEN ) |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 99 | |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 100 | static void ssl_tls13_hkdf_encode_label( |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 101 | size_t desired_length, |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 102 | const unsigned char *label, size_t label_len, |
| 103 | const unsigned char *ctx, size_t ctx_len, |
| 104 | unsigned char *dst, size_t *dst_len ) |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 105 | { |
Hanno Becker | 2dfe132 | 2020-09-10 09:23:12 +0100 | [diff] [blame] | 106 | size_t total_label_len = |
Xiaofei Bai | d25fab6 | 2021-12-02 06:36:27 +0000 | [diff] [blame] | 107 | sizeof(tls13_label_prefix) + label_len; |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 108 | size_t total_hkdf_lbl_len = |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 109 | SSL_TLS1_3_KEY_SCHEDULE_HKDF_LABEL_LEN( total_label_len, ctx_len ); |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 110 | |
| 111 | unsigned char *p = dst; |
| 112 | |
Hanno Becker | 531fe30 | 2020-09-16 09:45:27 +0100 | [diff] [blame] | 113 | /* Add the size of the expanded key material. |
| 114 | * We're hardcoding the high byte to 0 here assuming that we never use |
| 115 | * TLS 1.3 HKDF key expansion to more than 255 Bytes. */ |
| 116 | #if MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_EXPANSION_LEN > 255 |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 117 | #error "The implementation of ssl_tls13_hkdf_encode_label() is not fit for the \ |
Hanno Becker | 531fe30 | 2020-09-16 09:45:27 +0100 | [diff] [blame] | 118 | value of MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_EXPANSION_LEN" |
| 119 | #endif |
| 120 | |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 121 | *p++ = 0; |
Joe Subbiani | 2194dc4 | 2021-07-14 12:31:31 +0100 | [diff] [blame] | 122 | *p++ = MBEDTLS_BYTE_0( desired_length ); |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 123 | |
| 124 | /* Add label incl. prefix */ |
Joe Subbiani | 2194dc4 | 2021-07-14 12:31:31 +0100 | [diff] [blame] | 125 | *p++ = MBEDTLS_BYTE_0( total_label_len ); |
Xiaofei Bai | d25fab6 | 2021-12-02 06:36:27 +0000 | [diff] [blame] | 126 | memcpy( p, tls13_label_prefix, sizeof(tls13_label_prefix) ); |
| 127 | p += sizeof(tls13_label_prefix); |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 128 | memcpy( p, label, label_len ); |
| 129 | p += label_len; |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 130 | |
| 131 | /* Add context value */ |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 132 | *p++ = MBEDTLS_BYTE_0( ctx_len ); |
| 133 | if( ctx_len != 0 ) |
| 134 | memcpy( p, ctx, ctx_len ); |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 135 | |
| 136 | /* Return total length to the caller. */ |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 137 | *dst_len = total_hkdf_lbl_len; |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 138 | } |
| 139 | |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 140 | int mbedtls_ssl_tls13_hkdf_expand_label( |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 141 | psa_algorithm_t hash_alg, |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 142 | const unsigned char *secret, size_t secret_len, |
| 143 | const unsigned char *label, size_t label_len, |
| 144 | const unsigned char *ctx, size_t ctx_len, |
| 145 | unsigned char *buf, size_t buf_len ) |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 146 | { |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 147 | unsigned char hkdf_label[ SSL_TLS1_3_KEY_SCHEDULE_MAX_HKDF_LABEL_LEN ]; |
Przemek Stekiel | 1b0ebdf | 2022-06-23 09:22:49 +0200 | [diff] [blame] | 148 | size_t hkdf_label_len = 0; |
Przemek Stekiel | 38ab400 | 2022-06-23 09:05:40 +0200 | [diff] [blame] | 149 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 150 | psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED; |
Przemek Stekiel | d5ae365 | 2022-05-13 12:10:08 +0200 | [diff] [blame] | 151 | psa_key_derivation_operation_t operation = |
| 152 | PSA_KEY_DERIVATION_OPERATION_INIT; |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 153 | |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 154 | if( label_len > MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_LABEL_LEN ) |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 155 | { |
| 156 | /* Should never happen since this is an internal |
| 157 | * function, and we know statically which labels |
| 158 | * are allowed. */ |
| 159 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
| 160 | } |
| 161 | |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 162 | if( ctx_len > MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_CONTEXT_LEN ) |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 163 | { |
| 164 | /* Should not happen, as above. */ |
| 165 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
| 166 | } |
| 167 | |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 168 | if( buf_len > MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_EXPANSION_LEN ) |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 169 | { |
| 170 | /* Should not happen, as above. */ |
| 171 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
| 172 | } |
| 173 | |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 174 | if( ! PSA_ALG_IS_HASH( hash_alg ) ) |
Gabor Mezei | 58db653 | 2022-03-21 12:12:37 +0100 | [diff] [blame] | 175 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
| 176 | |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 177 | ssl_tls13_hkdf_encode_label( buf_len, |
| 178 | label, label_len, |
| 179 | ctx, ctx_len, |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 180 | hkdf_label, |
| 181 | &hkdf_label_len ); |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 182 | |
Przemek Stekiel | d5ae365 | 2022-05-13 12:10:08 +0200 | [diff] [blame] | 183 | status = psa_key_derivation_setup( &operation, PSA_ALG_HKDF_EXPAND( hash_alg ) ); |
Przemek Stekiel | d5ae365 | 2022-05-13 12:10:08 +0200 | [diff] [blame] | 184 | |
Przemek Stekiel | 38ab400 | 2022-06-23 09:05:40 +0200 | [diff] [blame] | 185 | if( status != PSA_SUCCESS ) |
| 186 | goto cleanup; |
| 187 | |
| 188 | status = psa_key_derivation_input_bytes( &operation, |
| 189 | PSA_KEY_DERIVATION_INPUT_SECRET, |
| 190 | secret, |
| 191 | secret_len ); |
| 192 | |
| 193 | if( status != PSA_SUCCESS ) |
| 194 | goto cleanup; |
| 195 | |
| 196 | status = psa_key_derivation_input_bytes( &operation, |
| 197 | PSA_KEY_DERIVATION_INPUT_INFO, |
| 198 | hkdf_label, |
| 199 | hkdf_label_len ); |
| 200 | |
| 201 | if( status != PSA_SUCCESS ) |
| 202 | goto cleanup; |
| 203 | |
| 204 | status = psa_key_derivation_output_bytes( &operation, |
| 205 | buf, |
| 206 | buf_len ); |
| 207 | |
| 208 | if( status != PSA_SUCCESS ) |
| 209 | goto cleanup; |
| 210 | |
| 211 | cleanup: |
| 212 | abort_status = psa_key_derivation_abort( &operation ); |
| 213 | status = ( status == PSA_SUCCESS ? abort_status : status ); |
Przemek Stekiel | 1b0ebdf | 2022-06-23 09:22:49 +0200 | [diff] [blame] | 214 | mbedtls_platform_zeroize( hkdf_label, hkdf_label_len ); |
Przemek Stekiel | d5ae365 | 2022-05-13 12:10:08 +0200 | [diff] [blame] | 215 | return( psa_ssl_status_to_mbedtls ( status ) ); |
Hanno Becker | be9d664 | 2020-08-21 13:20:06 +0100 | [diff] [blame] | 216 | } |
| 217 | |
Jerry Yu | a5db6c0 | 2022-11-23 18:08:04 +0800 | [diff] [blame] | 218 | MBEDTLS_CHECK_RETURN_CRITICAL |
Jerry Yu | a877183 | 2022-11-21 23:16:54 +0800 | [diff] [blame] | 219 | static int ssl_tls13_make_traffic_key( |
| 220 | psa_algorithm_t hash_alg, |
| 221 | const unsigned char *secret, size_t secret_len, |
| 222 | unsigned char *key, size_t key_len, |
| 223 | unsigned char *iv, size_t iv_len ) |
| 224 | { |
| 225 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 226 | |
| 227 | ret = mbedtls_ssl_tls13_hkdf_expand_label( hash_alg, |
| 228 | secret, secret_len, |
| 229 | MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( key ), |
| 230 | NULL, 0, |
| 231 | key, key_len ); |
| 232 | if( ret != 0 ) |
| 233 | return( ret ); |
| 234 | |
| 235 | ret = mbedtls_ssl_tls13_hkdf_expand_label( hash_alg, |
| 236 | secret, secret_len, |
| 237 | MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( iv ), |
| 238 | NULL, 0, |
| 239 | iv, iv_len ); |
| 240 | return( ret ); |
| 241 | } |
| 242 | |
Hanno Becker | 3385a4d | 2020-08-21 13:03:34 +0100 | [diff] [blame] | 243 | /* |
| 244 | * The traffic keying material is generated from the following inputs: |
| 245 | * |
| 246 | * - One secret value per sender. |
| 247 | * - A purpose value indicating the specific value being generated |
| 248 | * - The desired lengths of key and IV. |
| 249 | * |
| 250 | * The expansion itself is based on HKDF: |
| 251 | * |
| 252 | * [sender]_write_key = HKDF-Expand-Label( Secret, "key", "", key_length ) |
| 253 | * [sender]_write_iv = HKDF-Expand-Label( Secret, "iv" , "", iv_length ) |
| 254 | * |
| 255 | * [sender] denotes the sending side and the Secret value is provided |
| 256 | * by the function caller. Note that we generate server and client side |
| 257 | * keys in a single function call. |
| 258 | */ |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 259 | int mbedtls_ssl_tls13_make_traffic_keys( |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 260 | psa_algorithm_t hash_alg, |
Hanno Becker | 3385a4d | 2020-08-21 13:03:34 +0100 | [diff] [blame] | 261 | const unsigned char *client_secret, |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 262 | const unsigned char *server_secret, size_t secret_len, |
| 263 | size_t key_len, size_t iv_len, |
Hanno Becker | 3385a4d | 2020-08-21 13:03:34 +0100 | [diff] [blame] | 264 | mbedtls_ssl_key_set *keys ) |
| 265 | { |
| 266 | int ret = 0; |
| 267 | |
Jerry Yu | a877183 | 2022-11-21 23:16:54 +0800 | [diff] [blame] | 268 | ret = ssl_tls13_make_traffic_key( |
| 269 | hash_alg, client_secret, secret_len, |
| 270 | keys->client_write_key, key_len, |
| 271 | keys->client_write_iv, iv_len ); |
Hanno Becker | 3385a4d | 2020-08-21 13:03:34 +0100 | [diff] [blame] | 272 | if( ret != 0 ) |
| 273 | return( ret ); |
| 274 | |
Jerry Yu | a877183 | 2022-11-21 23:16:54 +0800 | [diff] [blame] | 275 | ret = ssl_tls13_make_traffic_key( |
| 276 | hash_alg, server_secret, secret_len, |
| 277 | keys->server_write_key, key_len, |
| 278 | keys->server_write_iv, iv_len ); |
Hanno Becker | 3385a4d | 2020-08-21 13:03:34 +0100 | [diff] [blame] | 279 | if( ret != 0 ) |
| 280 | return( ret ); |
| 281 | |
Hanno Becker | 493ea7f | 2020-09-08 11:01:00 +0100 | [diff] [blame] | 282 | keys->key_len = key_len; |
| 283 | keys->iv_len = iv_len; |
Hanno Becker | 3385a4d | 2020-08-21 13:03:34 +0100 | [diff] [blame] | 284 | |
| 285 | return( 0 ); |
| 286 | } |
| 287 | |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 288 | int mbedtls_ssl_tls13_derive_secret( |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 289 | psa_algorithm_t hash_alg, |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 290 | const unsigned char *secret, size_t secret_len, |
| 291 | const unsigned char *label, size_t label_len, |
| 292 | const unsigned char *ctx, size_t ctx_len, |
Hanno Becker | 0c42fd9 | 2020-09-09 12:58:29 +0100 | [diff] [blame] | 293 | int ctx_hashed, |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 294 | unsigned char *dstbuf, size_t dstbuf_len ) |
Hanno Becker | b35d522 | 2020-08-21 13:27:44 +0100 | [diff] [blame] | 295 | { |
| 296 | int ret; |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 297 | unsigned char hashed_context[ PSA_HASH_MAX_SIZE ]; |
Hanno Becker | 0c42fd9 | 2020-09-09 12:58:29 +0100 | [diff] [blame] | 298 | if( ctx_hashed == MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED ) |
Hanno Becker | b35d522 | 2020-08-21 13:27:44 +0100 | [diff] [blame] | 299 | { |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 300 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 301 | |
| 302 | status = psa_hash_compute( hash_alg, ctx, ctx_len, hashed_context, |
| 303 | PSA_HASH_LENGTH( hash_alg ), &ctx_len ); |
| 304 | if( status != PSA_SUCCESS ) |
| 305 | { |
| 306 | ret = psa_ssl_status_to_mbedtls( status ); |
| 307 | return ret; |
| 308 | } |
Hanno Becker | b35d522 | 2020-08-21 13:27:44 +0100 | [diff] [blame] | 309 | } |
| 310 | else |
| 311 | { |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 312 | if( ctx_len > sizeof(hashed_context) ) |
Hanno Becker | 97a2156 | 2020-09-09 12:57:16 +0100 | [diff] [blame] | 313 | { |
| 314 | /* This should never happen since this function is internal |
Hanno Becker | 0c42fd9 | 2020-09-09 12:58:29 +0100 | [diff] [blame] | 315 | * and the code sets `ctx_hashed` correctly. |
Hanno Becker | 97a2156 | 2020-09-09 12:57:16 +0100 | [diff] [blame] | 316 | * Let's double-check nonetheless to not run at the risk |
| 317 | * of getting a stack overflow. */ |
Hanno Becker | b35d522 | 2020-08-21 13:27:44 +0100 | [diff] [blame] | 318 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Hanno Becker | 97a2156 | 2020-09-09 12:57:16 +0100 | [diff] [blame] | 319 | } |
Hanno Becker | b35d522 | 2020-08-21 13:27:44 +0100 | [diff] [blame] | 320 | |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 321 | memcpy( hashed_context, ctx, ctx_len ); |
Hanno Becker | b35d522 | 2020-08-21 13:27:44 +0100 | [diff] [blame] | 322 | } |
| 323 | |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 324 | return( mbedtls_ssl_tls13_hkdf_expand_label( hash_alg, |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 325 | secret, secret_len, |
| 326 | label, label_len, |
| 327 | hashed_context, ctx_len, |
| 328 | dstbuf, dstbuf_len ) ); |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 329 | |
Hanno Becker | b35d522 | 2020-08-21 13:27:44 +0100 | [diff] [blame] | 330 | } |
| 331 | |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 332 | int mbedtls_ssl_tls13_evolve_secret( |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 333 | psa_algorithm_t hash_alg, |
Hanno Becker | e9cccb4 | 2020-08-20 13:42:46 +0100 | [diff] [blame] | 334 | const unsigned char *secret_old, |
| 335 | const unsigned char *input, size_t input_len, |
| 336 | unsigned char *secret_new ) |
| 337 | { |
| 338 | int ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; |
Przemek Stekiel | 38ab400 | 2022-06-23 09:05:40 +0200 | [diff] [blame] | 339 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 340 | psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED; |
Ronald Cron | 831fee6 | 2022-10-05 16:22:59 +0200 | [diff] [blame] | 341 | size_t hlen; |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 342 | unsigned char tmp_secret[ PSA_MAC_MAX_SIZE ] = { 0 }; |
Ronald Cron | 831fee6 | 2022-10-05 16:22:59 +0200 | [diff] [blame] | 343 | const unsigned char all_zeroes_input[ MBEDTLS_TLS1_3_MD_MAX_SIZE ] = { 0 }; |
| 344 | const unsigned char *l_input = NULL; |
| 345 | size_t l_input_len; |
| 346 | |
Przemek Stekiel | d5ae365 | 2022-05-13 12:10:08 +0200 | [diff] [blame] | 347 | psa_key_derivation_operation_t operation = |
| 348 | PSA_KEY_DERIVATION_OPERATION_INIT; |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 349 | |
| 350 | if( ! PSA_ALG_IS_HASH( hash_alg ) ) |
Gabor Mezei | 58db653 | 2022-03-21 12:12:37 +0100 | [diff] [blame] | 351 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
| 352 | |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 353 | hlen = PSA_HASH_LENGTH( hash_alg ); |
Hanno Becker | e9cccb4 | 2020-08-20 13:42:46 +0100 | [diff] [blame] | 354 | |
| 355 | /* For non-initial runs, call Derive-Secret( ., "derived", "") |
Hanno Becker | 61baae7 | 2020-09-16 09:24:14 +0100 | [diff] [blame] | 356 | * on the old secret. */ |
Hanno Becker | e9cccb4 | 2020-08-20 13:42:46 +0100 | [diff] [blame] | 357 | if( secret_old != NULL ) |
| 358 | { |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 359 | ret = mbedtls_ssl_tls13_derive_secret( |
Hanno Becker | e9cccb4 | 2020-08-20 13:42:46 +0100 | [diff] [blame] | 360 | hash_alg, |
| 361 | secret_old, hlen, |
| 362 | MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( derived ), |
| 363 | NULL, 0, /* context */ |
| 364 | MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED, |
Hanno Becker | 59b50a1 | 2020-09-09 10:56:56 +0100 | [diff] [blame] | 365 | tmp_secret, hlen ); |
Hanno Becker | e9cccb4 | 2020-08-20 13:42:46 +0100 | [diff] [blame] | 366 | if( ret != 0 ) |
| 367 | goto cleanup; |
| 368 | } |
| 369 | |
Przemek Stekiel | 38ab400 | 2022-06-23 09:05:40 +0200 | [diff] [blame] | 370 | ret = 0; |
| 371 | |
Jerry Yu | 6cf6b47 | 2022-08-16 14:50:28 +0800 | [diff] [blame] | 372 | if( input != NULL && input_len != 0 ) |
Hanno Becker | e9cccb4 | 2020-08-20 13:42:46 +0100 | [diff] [blame] | 373 | { |
Ronald Cron | 831fee6 | 2022-10-05 16:22:59 +0200 | [diff] [blame] | 374 | l_input = input; |
| 375 | l_input_len = input_len; |
Hanno Becker | e9cccb4 | 2020-08-20 13:42:46 +0100 | [diff] [blame] | 376 | } |
| 377 | else |
| 378 | { |
Ronald Cron | 831fee6 | 2022-10-05 16:22:59 +0200 | [diff] [blame] | 379 | l_input = all_zeroes_input; |
| 380 | l_input_len = hlen; |
Hanno Becker | e9cccb4 | 2020-08-20 13:42:46 +0100 | [diff] [blame] | 381 | } |
| 382 | |
Przemek Stekiel | d5ae365 | 2022-05-13 12:10:08 +0200 | [diff] [blame] | 383 | status = psa_key_derivation_setup( &operation, |
| 384 | PSA_ALG_HKDF_EXTRACT( hash_alg ) ); |
Hanno Becker | e9cccb4 | 2020-08-20 13:42:46 +0100 | [diff] [blame] | 385 | |
Przemek Stekiel | 38ab400 | 2022-06-23 09:05:40 +0200 | [diff] [blame] | 386 | if( status != PSA_SUCCESS ) |
| 387 | goto cleanup; |
| 388 | |
| 389 | status = psa_key_derivation_input_bytes( &operation, |
| 390 | PSA_KEY_DERIVATION_INPUT_SALT, |
| 391 | tmp_secret, |
| 392 | hlen ); |
| 393 | |
| 394 | if( status != PSA_SUCCESS ) |
| 395 | goto cleanup; |
| 396 | |
| 397 | status = psa_key_derivation_input_bytes( &operation, |
| 398 | PSA_KEY_DERIVATION_INPUT_SECRET, |
Ronald Cron | 831fee6 | 2022-10-05 16:22:59 +0200 | [diff] [blame] | 399 | l_input, l_input_len ); |
Przemek Stekiel | 38ab400 | 2022-06-23 09:05:40 +0200 | [diff] [blame] | 400 | |
| 401 | if( status != PSA_SUCCESS ) |
| 402 | goto cleanup; |
| 403 | |
| 404 | status = psa_key_derivation_output_bytes( &operation, |
| 405 | secret_new, |
| 406 | PSA_HASH_LENGTH( hash_alg ) ); |
| 407 | |
| 408 | if( status != PSA_SUCCESS ) |
| 409 | goto cleanup; |
| 410 | |
Hanno Becker | e9cccb4 | 2020-08-20 13:42:46 +0100 | [diff] [blame] | 411 | cleanup: |
Przemek Stekiel | 38ab400 | 2022-06-23 09:05:40 +0200 | [diff] [blame] | 412 | abort_status = psa_key_derivation_abort( &operation ); |
| 413 | status = ( status == PSA_SUCCESS ? abort_status : status ); |
| 414 | ret = ( ret == 0 ? psa_ssl_status_to_mbedtls ( status ) : ret ); |
Hanno Becker | 59b50a1 | 2020-09-09 10:56:56 +0100 | [diff] [blame] | 415 | mbedtls_platform_zeroize( tmp_secret, sizeof(tmp_secret) ); |
Hanno Becker | e9cccb4 | 2020-08-20 13:42:46 +0100 | [diff] [blame] | 416 | return( ret ); |
| 417 | } |
| 418 | |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 419 | int mbedtls_ssl_tls13_derive_early_secrets( |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 420 | psa_algorithm_t hash_alg, |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 421 | unsigned char const *early_secret, |
| 422 | unsigned char const *transcript, size_t transcript_len, |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 423 | mbedtls_ssl_tls13_early_secrets *derived ) |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 424 | { |
| 425 | int ret; |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 426 | size_t const hash_len = PSA_HASH_LENGTH( hash_alg ); |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 427 | |
| 428 | /* We should never call this function with an unknown hash, |
| 429 | * but add an assertion anyway. */ |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 430 | if( ! PSA_ALG_IS_HASH( hash_alg ) ) |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 431 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
| 432 | |
| 433 | /* |
| 434 | * 0 |
| 435 | * | |
| 436 | * v |
| 437 | * PSK -> HKDF-Extract = Early Secret |
| 438 | * | |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 439 | * +-----> Derive-Secret(., "c e traffic", ClientHello) |
| 440 | * | = client_early_traffic_secret |
| 441 | * | |
| 442 | * +-----> Derive-Secret(., "e exp master", ClientHello) |
| 443 | * | = early_exporter_master_secret |
| 444 | * v |
| 445 | */ |
| 446 | |
| 447 | /* Create client_early_traffic_secret */ |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 448 | ret = mbedtls_ssl_tls13_derive_secret( hash_alg, |
| 449 | early_secret, hash_len, |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 450 | MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( c_e_traffic ), |
| 451 | transcript, transcript_len, |
| 452 | MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, |
| 453 | derived->client_early_traffic_secret, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 454 | hash_len ); |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 455 | if( ret != 0 ) |
| 456 | return( ret ); |
| 457 | |
| 458 | /* Create early exporter */ |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 459 | ret = mbedtls_ssl_tls13_derive_secret( hash_alg, |
| 460 | early_secret, hash_len, |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 461 | MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( e_exp_master ), |
| 462 | transcript, transcript_len, |
| 463 | MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, |
| 464 | derived->early_exporter_master_secret, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 465 | hash_len ); |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 466 | if( ret != 0 ) |
| 467 | return( ret ); |
| 468 | |
| 469 | return( 0 ); |
| 470 | } |
| 471 | |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 472 | int mbedtls_ssl_tls13_derive_handshake_secrets( |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 473 | psa_algorithm_t hash_alg, |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 474 | unsigned char const *handshake_secret, |
| 475 | unsigned char const *transcript, size_t transcript_len, |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 476 | mbedtls_ssl_tls13_handshake_secrets *derived ) |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 477 | { |
| 478 | int ret; |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 479 | size_t const hash_len = PSA_HASH_LENGTH( hash_alg ); |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 480 | |
| 481 | /* We should never call this function with an unknown hash, |
| 482 | * but add an assertion anyway. */ |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 483 | if( ! PSA_ALG_IS_HASH( hash_alg ) ) |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 484 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
| 485 | |
| 486 | /* |
| 487 | * |
| 488 | * Handshake Secret |
| 489 | * | |
| 490 | * +-----> Derive-Secret( ., "c hs traffic", |
| 491 | * | ClientHello...ServerHello ) |
| 492 | * | = client_handshake_traffic_secret |
| 493 | * | |
| 494 | * +-----> Derive-Secret( ., "s hs traffic", |
| 495 | * | ClientHello...ServerHello ) |
| 496 | * | = server_handshake_traffic_secret |
| 497 | * |
| 498 | */ |
| 499 | |
| 500 | /* |
| 501 | * Compute client_handshake_traffic_secret with |
| 502 | * Derive-Secret( ., "c hs traffic", ClientHello...ServerHello ) |
| 503 | */ |
| 504 | |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 505 | ret = mbedtls_ssl_tls13_derive_secret( hash_alg, |
| 506 | handshake_secret, hash_len, |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 507 | MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( c_hs_traffic ), |
| 508 | transcript, transcript_len, |
| 509 | MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, |
| 510 | derived->client_handshake_traffic_secret, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 511 | hash_len ); |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 512 | if( ret != 0 ) |
| 513 | return( ret ); |
| 514 | |
| 515 | /* |
| 516 | * Compute server_handshake_traffic_secret with |
| 517 | * Derive-Secret( ., "s hs traffic", ClientHello...ServerHello ) |
| 518 | */ |
| 519 | |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 520 | ret = mbedtls_ssl_tls13_derive_secret( hash_alg, |
| 521 | handshake_secret, hash_len, |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 522 | MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( s_hs_traffic ), |
| 523 | transcript, transcript_len, |
| 524 | MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, |
| 525 | derived->server_handshake_traffic_secret, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 526 | hash_len ); |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 527 | if( ret != 0 ) |
| 528 | return( ret ); |
| 529 | |
| 530 | return( 0 ); |
| 531 | } |
| 532 | |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 533 | int mbedtls_ssl_tls13_derive_application_secrets( |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 534 | psa_algorithm_t hash_alg, |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 535 | unsigned char const *application_secret, |
| 536 | unsigned char const *transcript, size_t transcript_len, |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 537 | mbedtls_ssl_tls13_application_secrets *derived ) |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 538 | { |
| 539 | int ret; |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 540 | size_t const hash_len = PSA_HASH_LENGTH( hash_alg ); |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 541 | |
| 542 | /* We should never call this function with an unknown hash, |
| 543 | * but add an assertion anyway. */ |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 544 | if( ! PSA_ALG_IS_HASH( hash_alg ) ) |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 545 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
| 546 | |
| 547 | /* Generate {client,server}_application_traffic_secret_0 |
| 548 | * |
| 549 | * Master Secret |
| 550 | * | |
| 551 | * +-----> Derive-Secret( ., "c ap traffic", |
| 552 | * | ClientHello...server Finished ) |
| 553 | * | = client_application_traffic_secret_0 |
| 554 | * | |
| 555 | * +-----> Derive-Secret( ., "s ap traffic", |
| 556 | * | ClientHello...Server Finished ) |
| 557 | * | = server_application_traffic_secret_0 |
| 558 | * | |
| 559 | * +-----> Derive-Secret( ., "exp master", |
| 560 | * | ClientHello...server Finished) |
| 561 | * | = exporter_master_secret |
| 562 | * |
| 563 | */ |
| 564 | |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 565 | ret = mbedtls_ssl_tls13_derive_secret( hash_alg, |
| 566 | application_secret, hash_len, |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 567 | MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( c_ap_traffic ), |
| 568 | transcript, transcript_len, |
| 569 | MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, |
| 570 | derived->client_application_traffic_secret_N, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 571 | hash_len ); |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 572 | if( ret != 0 ) |
| 573 | return( ret ); |
| 574 | |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 575 | ret = mbedtls_ssl_tls13_derive_secret( hash_alg, |
| 576 | application_secret, hash_len, |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 577 | MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( s_ap_traffic ), |
| 578 | transcript, transcript_len, |
| 579 | MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, |
| 580 | derived->server_application_traffic_secret_N, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 581 | hash_len ); |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 582 | if( ret != 0 ) |
| 583 | return( ret ); |
| 584 | |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 585 | ret = mbedtls_ssl_tls13_derive_secret( hash_alg, |
| 586 | application_secret, hash_len, |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 587 | MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( exp_master ), |
| 588 | transcript, transcript_len, |
| 589 | MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, |
| 590 | derived->exporter_master_secret, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 591 | hash_len ); |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 592 | if( ret != 0 ) |
| 593 | return( ret ); |
| 594 | |
| 595 | return( 0 ); |
| 596 | } |
| 597 | |
| 598 | /* Generate resumption_master_secret for use with the ticket exchange. |
| 599 | * |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 600 | * This is not integrated with mbedtls_ssl_tls13_derive_application_secrets() |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 601 | * because it uses the transcript hash up to and including ClientFinished. */ |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 602 | int mbedtls_ssl_tls13_derive_resumption_master_secret( |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 603 | psa_algorithm_t hash_alg, |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 604 | unsigned char const *application_secret, |
| 605 | unsigned char const *transcript, size_t transcript_len, |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 606 | mbedtls_ssl_tls13_application_secrets *derived ) |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 607 | { |
| 608 | int ret; |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 609 | size_t const hash_len = PSA_HASH_LENGTH( hash_alg ); |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 610 | |
| 611 | /* We should never call this function with an unknown hash, |
| 612 | * but add an assertion anyway. */ |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 613 | if( ! PSA_ALG_IS_HASH( hash_alg ) ) |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 614 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
| 615 | |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 616 | ret = mbedtls_ssl_tls13_derive_secret( hash_alg, |
| 617 | application_secret, hash_len, |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 618 | MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( res_master ), |
| 619 | transcript, transcript_len, |
| 620 | MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, |
| 621 | derived->resumption_master_secret, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 622 | hash_len ); |
Hanno Becker | ef5235b | 2021-05-24 06:39:41 +0100 | [diff] [blame] | 623 | |
| 624 | if( ret != 0 ) |
| 625 | return( ret ); |
| 626 | |
| 627 | return( 0 ); |
| 628 | } |
| 629 | |
XiaokangQian | a4c99f2 | 2021-11-11 06:46:35 +0000 | [diff] [blame] | 630 | int mbedtls_ssl_tls13_key_schedule_stage_application( mbedtls_ssl_context *ssl ) |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 631 | { |
XiaokangQian | 61bdbbc | 2021-10-28 08:03:38 +0000 | [diff] [blame] | 632 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
XiaokangQian | 3306284 | 2021-11-11 03:37:45 +0000 | [diff] [blame] | 633 | mbedtls_ssl_handshake_params *handshake = ssl->handshake; |
Manuel Pégourié-Gonnard | abac037 | 2022-07-18 13:41:11 +0200 | [diff] [blame] | 634 | psa_algorithm_t const hash_alg = mbedtls_hash_info_psa_from_md( |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 635 | handshake->ciphersuite_info->mac ); |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 636 | |
| 637 | /* |
| 638 | * Compute MasterSecret |
| 639 | */ |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 640 | ret = mbedtls_ssl_tls13_evolve_secret( hash_alg, |
Xiaofei Bai | d25fab6 | 2021-12-02 06:36:27 +0000 | [diff] [blame] | 641 | handshake->tls13_master_secrets.handshake, |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 642 | NULL, 0, |
Xiaofei Bai | d25fab6 | 2021-12-02 06:36:27 +0000 | [diff] [blame] | 643 | handshake->tls13_master_secrets.app ); |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 644 | if( ret != 0 ) |
| 645 | { |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 646 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_evolve_secret", ret ); |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 647 | return( ret ); |
| 648 | } |
| 649 | |
| 650 | MBEDTLS_SSL_DEBUG_BUF( 4, "Master secret", |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 651 | handshake->tls13_master_secrets.app, PSA_HASH_LENGTH( hash_alg ) ); |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 652 | |
| 653 | return( 0 ); |
| 654 | } |
| 655 | |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 656 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 657 | static int ssl_tls13_calc_finished_core( psa_algorithm_t hash_alg, |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 658 | unsigned char const *base_key, |
| 659 | unsigned char const *transcript, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 660 | unsigned char *dst, |
| 661 | size_t *dst_len ) |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 662 | { |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 663 | mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT; |
| 664 | psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; |
| 665 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 666 | size_t hash_len = PSA_HASH_LENGTH( hash_alg ); |
| 667 | unsigned char finished_key[PSA_MAC_MAX_SIZE]; |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 668 | int ret; |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 669 | psa_algorithm_t alg; |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 670 | |
| 671 | /* We should never call this function with an unknown hash, |
| 672 | * but add an assertion anyway. */ |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 673 | if( ! PSA_ALG_IS_HASH( hash_alg ) ) |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 674 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
| 675 | |
| 676 | /* TLS 1.3 Finished message |
| 677 | * |
| 678 | * struct { |
| 679 | * opaque verify_data[Hash.length]; |
| 680 | * } Finished; |
| 681 | * |
| 682 | * verify_data = |
| 683 | * HMAC( finished_key, |
| 684 | * Hash( Handshake Context + |
| 685 | * Certificate* + |
| 686 | * CertificateVerify* ) |
| 687 | * ) |
| 688 | * |
| 689 | * finished_key = |
| 690 | * HKDF-Expand-Label( BaseKey, "finished", "", Hash.length ) |
| 691 | */ |
| 692 | |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 693 | ret = mbedtls_ssl_tls13_hkdf_expand_label( |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 694 | hash_alg, base_key, hash_len, |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 695 | MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( finished ), |
| 696 | NULL, 0, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 697 | finished_key, hash_len ); |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 698 | if( ret != 0 ) |
| 699 | goto exit; |
| 700 | |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 701 | alg = PSA_ALG_HMAC( hash_alg ); |
| 702 | psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_MESSAGE ); |
| 703 | psa_set_key_algorithm( &attributes, alg ); |
| 704 | psa_set_key_type( &attributes, PSA_KEY_TYPE_HMAC ); |
| 705 | |
| 706 | status = psa_import_key( &attributes, finished_key, hash_len, &key ); |
| 707 | if( status != PSA_SUCCESS ) |
| 708 | { |
| 709 | ret = psa_ssl_status_to_mbedtls( status ); |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 710 | goto exit; |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 711 | } |
| 712 | |
| 713 | status = psa_mac_compute( key, alg, transcript, hash_len, |
| 714 | dst, hash_len, dst_len ); |
| 715 | ret = psa_ssl_status_to_mbedtls( status ); |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 716 | |
| 717 | exit: |
| 718 | |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 719 | status = psa_destroy_key( key ); |
| 720 | if( ret == 0 ) |
| 721 | ret = psa_ssl_status_to_mbedtls( status ); |
| 722 | |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 723 | mbedtls_platform_zeroize( finished_key, sizeof( finished_key ) ); |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 724 | |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 725 | return( ret ); |
| 726 | } |
| 727 | |
XiaokangQian | c5c39d5 | 2021-11-09 11:55:10 +0000 | [diff] [blame] | 728 | int mbedtls_ssl_tls13_calculate_verify_data( mbedtls_ssl_context* ssl, |
XiaokangQian | aaa0e19 | 2021-11-10 03:07:04 +0000 | [diff] [blame] | 729 | unsigned char* dst, |
| 730 | size_t dst_len, |
| 731 | size_t *actual_len, |
| 732 | int from ) |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 733 | { |
XiaokangQian | a763498 | 2021-10-22 06:32:32 +0000 | [diff] [blame] | 734 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 735 | |
XiaokangQian | aaa0e19 | 2021-11-10 03:07:04 +0000 | [diff] [blame] | 736 | unsigned char transcript[MBEDTLS_TLS1_3_MD_MAX_SIZE]; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 737 | size_t transcript_len; |
| 738 | |
Jerry Yu | 4a2fa5d | 2021-12-10 10:19:34 +0800 | [diff] [blame] | 739 | unsigned char *base_key = NULL; |
Jerry Yu | b737f6a | 2021-12-10 17:55:23 +0800 | [diff] [blame] | 740 | size_t base_key_len = 0; |
Jerry Yu | 9c07473 | 2021-12-10 17:12:43 +0800 | [diff] [blame] | 741 | mbedtls_ssl_tls13_handshake_secrets *tls13_hs_secrets = |
| 742 | &ssl->handshake->tls13_hs_secrets; |
Jerry Yu | a5563f6 | 2021-12-10 18:14:36 +0800 | [diff] [blame] | 743 | |
| 744 | mbedtls_md_type_t const md_type = ssl->handshake->ciphersuite_info->mac; |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 745 | |
Manuel Pégourié-Gonnard | abac037 | 2022-07-18 13:41:11 +0200 | [diff] [blame] | 746 | psa_algorithm_t hash_alg = mbedtls_hash_info_psa_from_md( |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 747 | ssl->handshake->ciphersuite_info->mac ); |
Gabor Mezei | 29e7ca8 | 2022-03-29 17:08:49 +0200 | [diff] [blame] | 748 | size_t const hash_len = PSA_HASH_LENGTH( hash_alg ); |
Jerry Yu | a5563f6 | 2021-12-10 18:14:36 +0800 | [diff] [blame] | 749 | |
| 750 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_tls13_calculate_verify_data" ) ); |
| 751 | |
Jerry Yu | b737f6a | 2021-12-10 17:55:23 +0800 | [diff] [blame] | 752 | if( from == MBEDTLS_SSL_IS_CLIENT ) |
| 753 | { |
| 754 | base_key = tls13_hs_secrets->client_handshake_traffic_secret; |
| 755 | base_key_len = sizeof( tls13_hs_secrets->client_handshake_traffic_secret ); |
| 756 | } |
| 757 | else |
| 758 | { |
| 759 | base_key = tls13_hs_secrets->server_handshake_traffic_secret; |
| 760 | base_key_len = sizeof( tls13_hs_secrets->server_handshake_traffic_secret ); |
| 761 | } |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 762 | |
Gabor Mezei | 29e7ca8 | 2022-03-29 17:08:49 +0200 | [diff] [blame] | 763 | if( dst_len < hash_len ) |
Jerry Yu | 9c07473 | 2021-12-10 17:12:43 +0800 | [diff] [blame] | 764 | { |
| 765 | ret = MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL; |
| 766 | goto exit; |
| 767 | } |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 768 | |
| 769 | ret = mbedtls_ssl_get_handshake_transcript( ssl, md_type, |
| 770 | transcript, sizeof( transcript ), |
| 771 | &transcript_len ); |
| 772 | if( ret != 0 ) |
| 773 | { |
| 774 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_get_handshake_transcript", ret ); |
XiaokangQian | 61bdbbc | 2021-10-28 08:03:38 +0000 | [diff] [blame] | 775 | goto exit; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 776 | } |
| 777 | MBEDTLS_SSL_DEBUG_BUF( 4, "handshake hash", transcript, transcript_len ); |
| 778 | |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 779 | ret = ssl_tls13_calc_finished_core( hash_alg, base_key, transcript, dst, actual_len ); |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 780 | if( ret != 0 ) |
XiaokangQian | 61bdbbc | 2021-10-28 08:03:38 +0000 | [diff] [blame] | 781 | goto exit; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 782 | |
Gabor Mezei | 29e7ca8 | 2022-03-29 17:08:49 +0200 | [diff] [blame] | 783 | MBEDTLS_SSL_DEBUG_BUF( 3, "verify_data for finished message", dst, hash_len ); |
XiaokangQian | c5c39d5 | 2021-11-09 11:55:10 +0000 | [diff] [blame] | 784 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_tls13_calculate_verify_data" ) ); |
XiaokangQian | 61bdbbc | 2021-10-28 08:03:38 +0000 | [diff] [blame] | 785 | |
| 786 | exit: |
Jerry Yu | 4a2fa5d | 2021-12-10 10:19:34 +0800 | [diff] [blame] | 787 | /* Erase handshake secrets */ |
Jerry Yu | b737f6a | 2021-12-10 17:55:23 +0800 | [diff] [blame] | 788 | mbedtls_platform_zeroize( base_key, base_key_len ); |
XiaokangQian | 3306284 | 2021-11-11 03:37:45 +0000 | [diff] [blame] | 789 | mbedtls_platform_zeroize( transcript, sizeof( transcript ) ); |
XiaokangQian | 61bdbbc | 2021-10-28 08:03:38 +0000 | [diff] [blame] | 790 | return( ret ); |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 791 | } |
| 792 | |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 793 | int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 794 | const psa_algorithm_t hash_alg, |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 795 | unsigned char const *psk, size_t psk_len, |
| 796 | int psk_type, |
| 797 | unsigned char const *transcript, |
| 798 | unsigned char *result ) |
| 799 | { |
| 800 | int ret = 0; |
Gabor Mezei | ed6d658 | 2022-03-26 17:28:06 +0100 | [diff] [blame] | 801 | unsigned char binder_key[PSA_MAC_MAX_SIZE]; |
| 802 | unsigned char early_secret[PSA_MAC_MAX_SIZE]; |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 803 | size_t const hash_len = PSA_HASH_LENGTH( hash_alg ); |
| 804 | size_t actual_len; |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 805 | |
Hanno Becker | 28e5f1e | 2021-05-26 09:29:49 +0100 | [diff] [blame] | 806 | #if !defined(MBEDTLS_DEBUG_C) |
| 807 | ssl = NULL; /* make sure we don't use it except for debug */ |
| 808 | ((void) ssl); |
| 809 | #endif |
| 810 | |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 811 | /* We should never call this function with an unknown hash, |
| 812 | * but add an assertion anyway. */ |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 813 | if( ! PSA_ALG_IS_HASH( hash_alg ) ) |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 814 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
| 815 | |
| 816 | /* |
| 817 | * 0 |
| 818 | * | |
| 819 | * v |
| 820 | * PSK -> HKDF-Extract = Early Secret |
| 821 | * | |
| 822 | * +-----> Derive-Secret(., "ext binder" | "res binder", "") |
| 823 | * | = binder_key |
| 824 | * v |
| 825 | */ |
| 826 | |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 827 | ret = mbedtls_ssl_tls13_evolve_secret( hash_alg, |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 828 | NULL, /* Old secret */ |
| 829 | psk, psk_len, /* Input */ |
| 830 | early_secret ); |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 831 | if( ret != 0 ) |
| 832 | { |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 833 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_evolve_secret", ret ); |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 834 | goto exit; |
| 835 | } |
| 836 | |
Ronald Cron | 295d93e | 2022-07-19 08:21:29 +0200 | [diff] [blame] | 837 | MBEDTLS_SSL_DEBUG_BUF( 4, "mbedtls_ssl_tls13_create_psk_binder", |
| 838 | early_secret, hash_len ) ; |
| 839 | |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 840 | if( psk_type == MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION ) |
| 841 | { |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 842 | ret = mbedtls_ssl_tls13_derive_secret( hash_alg, |
| 843 | early_secret, hash_len, |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 844 | MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( res_binder ), |
| 845 | NULL, 0, MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 846 | binder_key, hash_len ); |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 847 | MBEDTLS_SSL_DEBUG_MSG( 4, ( "Derive Early Secret with 'res binder'" ) ); |
| 848 | } |
| 849 | else |
| 850 | { |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 851 | ret = mbedtls_ssl_tls13_derive_secret( hash_alg, |
| 852 | early_secret, hash_len, |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 853 | MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( ext_binder ), |
| 854 | NULL, 0, MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 855 | binder_key, hash_len ); |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 856 | MBEDTLS_SSL_DEBUG_MSG( 4, ( "Derive Early Secret with 'ext binder'" ) ); |
| 857 | } |
| 858 | |
| 859 | if( ret != 0 ) |
| 860 | { |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 861 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_derive_secret", ret ); |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 862 | goto exit; |
| 863 | } |
| 864 | |
| 865 | /* |
| 866 | * The binding_value is computed in the same way as the Finished message |
| 867 | * but with the BaseKey being the binder_key. |
| 868 | */ |
| 869 | |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 870 | ret = ssl_tls13_calc_finished_core( hash_alg, binder_key, transcript, |
| 871 | result, &actual_len ); |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 872 | if( ret != 0 ) |
| 873 | goto exit; |
| 874 | |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 875 | MBEDTLS_SSL_DEBUG_BUF( 3, "psk binder", result, actual_len ); |
Hanno Becker | b7d9bad | 2021-05-24 06:44:14 +0100 | [diff] [blame] | 876 | |
| 877 | exit: |
| 878 | |
| 879 | mbedtls_platform_zeroize( early_secret, sizeof( early_secret ) ); |
| 880 | mbedtls_platform_zeroize( binder_key, sizeof( binder_key ) ); |
| 881 | return( ret ); |
| 882 | } |
| 883 | |
Hanno Becker | c94060c | 2021-03-22 07:50:44 +0000 | [diff] [blame] | 884 | int mbedtls_ssl_tls13_populate_transform( mbedtls_ssl_transform *transform, |
| 885 | int endpoint, |
| 886 | int ciphersuite, |
| 887 | mbedtls_ssl_key_set const *traffic_keys, |
| 888 | mbedtls_ssl_context *ssl /* DEBUG ONLY */ ) |
| 889 | { |
Przemyslaw Stekiel | 6be9cf5 | 2022-01-19 16:00:22 +0100 | [diff] [blame] | 890 | #if !defined(MBEDTLS_USE_PSA_CRYPTO) |
Hanno Becker | c94060c | 2021-03-22 07:50:44 +0000 | [diff] [blame] | 891 | int ret; |
| 892 | mbedtls_cipher_info_t const *cipher_info; |
Neil Armstrong | a8093f5 | 2022-05-04 17:44:05 +0200 | [diff] [blame] | 893 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Hanno Becker | c94060c | 2021-03-22 07:50:44 +0000 | [diff] [blame] | 894 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info; |
| 895 | unsigned char const *key_enc; |
| 896 | unsigned char const *iv_enc; |
| 897 | unsigned char const *key_dec; |
| 898 | unsigned char const *iv_dec; |
| 899 | |
Przemyslaw Stekiel | ae77b0a | 2022-01-12 10:29:03 +0100 | [diff] [blame] | 900 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 901 | psa_key_type_t key_type; |
| 902 | psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; |
| 903 | psa_algorithm_t alg; |
| 904 | size_t key_bits; |
| 905 | psa_status_t status = PSA_SUCCESS; |
| 906 | #endif |
| 907 | |
Hanno Becker | c94060c | 2021-03-22 07:50:44 +0000 | [diff] [blame] | 908 | #if !defined(MBEDTLS_DEBUG_C) |
| 909 | ssl = NULL; /* make sure we don't use it except for those cases */ |
| 910 | (void) ssl; |
| 911 | #endif |
| 912 | |
| 913 | ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite ); |
Hanno Becker | 7887a77 | 2021-04-20 05:27:57 +0100 | [diff] [blame] | 914 | if( ciphersuite_info == NULL ) |
| 915 | { |
| 916 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %d not found", |
| 917 | ciphersuite ) ); |
| 918 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
| 919 | } |
Hanno Becker | c94060c | 2021-03-22 07:50:44 +0000 | [diff] [blame] | 920 | |
Neil Armstrong | a8093f5 | 2022-05-04 17:44:05 +0200 | [diff] [blame] | 921 | #if !defined(MBEDTLS_USE_PSA_CRYPTO) |
Hanno Becker | c94060c | 2021-03-22 07:50:44 +0000 | [diff] [blame] | 922 | cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher ); |
| 923 | if( cipher_info == NULL ) |
| 924 | { |
Hanno Becker | 7887a77 | 2021-04-20 05:27:57 +0100 | [diff] [blame] | 925 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher info for %u not found", |
| 926 | ciphersuite_info->cipher ) ); |
Hanno Becker | f62a730 | 2021-04-21 05:21:28 +0100 | [diff] [blame] | 927 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
Hanno Becker | c94060c | 2021-03-22 07:50:44 +0000 | [diff] [blame] | 928 | } |
| 929 | |
| 930 | /* |
| 931 | * Setup cipher contexts in target transform |
| 932 | */ |
Hanno Becker | c94060c | 2021-03-22 07:50:44 +0000 | [diff] [blame] | 933 | if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_enc, |
| 934 | cipher_info ) ) != 0 ) |
| 935 | { |
| 936 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret ); |
| 937 | return( ret ); |
| 938 | } |
| 939 | |
| 940 | if( ( ret = mbedtls_cipher_setup( &transform->cipher_ctx_dec, |
| 941 | cipher_info ) ) != 0 ) |
| 942 | { |
| 943 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setup", ret ); |
| 944 | return( ret ); |
| 945 | } |
Przemyslaw Stekiel | 6be9cf5 | 2022-01-19 16:00:22 +0100 | [diff] [blame] | 946 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Hanno Becker | c94060c | 2021-03-22 07:50:44 +0000 | [diff] [blame] | 947 | |
| 948 | #if defined(MBEDTLS_SSL_SRV_C) |
| 949 | if( endpoint == MBEDTLS_SSL_IS_SERVER ) |
| 950 | { |
| 951 | key_enc = traffic_keys->server_write_key; |
| 952 | key_dec = traffic_keys->client_write_key; |
| 953 | iv_enc = traffic_keys->server_write_iv; |
| 954 | iv_dec = traffic_keys->client_write_iv; |
| 955 | } |
| 956 | else |
| 957 | #endif /* MBEDTLS_SSL_SRV_C */ |
| 958 | #if defined(MBEDTLS_SSL_CLI_C) |
| 959 | if( endpoint == MBEDTLS_SSL_IS_CLIENT ) |
| 960 | { |
| 961 | key_enc = traffic_keys->client_write_key; |
| 962 | key_dec = traffic_keys->server_write_key; |
| 963 | iv_enc = traffic_keys->client_write_iv; |
| 964 | iv_dec = traffic_keys->server_write_iv; |
| 965 | } |
| 966 | else |
| 967 | #endif /* MBEDTLS_SSL_CLI_C */ |
| 968 | { |
| 969 | /* should not happen */ |
| 970 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
| 971 | } |
| 972 | |
| 973 | memcpy( transform->iv_enc, iv_enc, traffic_keys->iv_len ); |
| 974 | memcpy( transform->iv_dec, iv_dec, traffic_keys->iv_len ); |
| 975 | |
Przemyslaw Stekiel | 6be9cf5 | 2022-01-19 16:00:22 +0100 | [diff] [blame] | 976 | #if !defined(MBEDTLS_USE_PSA_CRYPTO) |
Hanno Becker | c94060c | 2021-03-22 07:50:44 +0000 | [diff] [blame] | 977 | if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_enc, |
| 978 | key_enc, cipher_info->key_bitlen, |
| 979 | MBEDTLS_ENCRYPT ) ) != 0 ) |
| 980 | { |
| 981 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret ); |
| 982 | return( ret ); |
| 983 | } |
| 984 | |
| 985 | if( ( ret = mbedtls_cipher_setkey( &transform->cipher_ctx_dec, |
| 986 | key_dec, cipher_info->key_bitlen, |
| 987 | MBEDTLS_DECRYPT ) ) != 0 ) |
| 988 | { |
| 989 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_cipher_setkey", ret ); |
| 990 | return( ret ); |
| 991 | } |
Przemyslaw Stekiel | 6be9cf5 | 2022-01-19 16:00:22 +0100 | [diff] [blame] | 992 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Hanno Becker | c94060c | 2021-03-22 07:50:44 +0000 | [diff] [blame] | 993 | |
Przemyslaw Stekiel | dd7b501 | 2022-01-17 15:28:57 +0100 | [diff] [blame] | 994 | /* |
| 995 | * Setup other fields in SSL transform |
| 996 | */ |
| 997 | |
| 998 | if( ( ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ) != 0 ) |
| 999 | transform->taglen = 8; |
| 1000 | else |
| 1001 | transform->taglen = 16; |
| 1002 | |
| 1003 | transform->ivlen = traffic_keys->iv_len; |
| 1004 | transform->maclen = 0; |
| 1005 | transform->fixed_ivlen = transform->ivlen; |
Glenn Strauss | 07c6416 | 2022-03-14 12:34:51 -0400 | [diff] [blame] | 1006 | transform->tls_version = MBEDTLS_SSL_VERSION_TLS1_3; |
Przemyslaw Stekiel | dd7b501 | 2022-01-17 15:28:57 +0100 | [diff] [blame] | 1007 | |
| 1008 | /* We add the true record content type (1 Byte) to the plaintext and |
Shaun Case | 8b0ecbc | 2021-12-20 21:14:10 -0800 | [diff] [blame] | 1009 | * then pad to the configured granularity. The minimum length of the |
Przemyslaw Stekiel | dd7b501 | 2022-01-17 15:28:57 +0100 | [diff] [blame] | 1010 | * type-extended and padded plaintext is therefore the padding |
| 1011 | * granularity. */ |
| 1012 | transform->minlen = |
| 1013 | transform->taglen + MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY; |
| 1014 | |
Przemyslaw Stekiel | ae77b0a | 2022-01-12 10:29:03 +0100 | [diff] [blame] | 1015 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Przemyslaw Stekiel | 6be9cf5 | 2022-01-19 16:00:22 +0100 | [diff] [blame] | 1016 | /* |
| 1017 | * Setup psa keys and alg |
| 1018 | */ |
Neil Armstrong | a8093f5 | 2022-05-04 17:44:05 +0200 | [diff] [blame] | 1019 | if( ( status = mbedtls_ssl_cipher_to_psa( ciphersuite_info->cipher, |
Przemyslaw Stekiel | ae77b0a | 2022-01-12 10:29:03 +0100 | [diff] [blame] | 1020 | transform->taglen, |
| 1021 | &alg, |
| 1022 | &key_type, |
| 1023 | &key_bits ) ) != PSA_SUCCESS ) |
| 1024 | { |
Przemyslaw Stekiel | 77aec8d | 2022-01-31 20:22:53 +0100 | [diff] [blame] | 1025 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_cipher_to_psa", psa_ssl_status_to_mbedtls( status ) ); |
| 1026 | return( psa_ssl_status_to_mbedtls( status ) ); |
Przemyslaw Stekiel | ae77b0a | 2022-01-12 10:29:03 +0100 | [diff] [blame] | 1027 | } |
| 1028 | |
Przemyslaw Stekiel | ae77b0a | 2022-01-12 10:29:03 +0100 | [diff] [blame] | 1029 | transform->psa_alg = alg; |
| 1030 | |
Przemyslaw Stekiel | f9cd608 | 2022-02-01 11:25:55 +0100 | [diff] [blame] | 1031 | if ( alg != MBEDTLS_SSL_NULL_CIPHER ) |
Przemyslaw Stekiel | ae77b0a | 2022-01-12 10:29:03 +0100 | [diff] [blame] | 1032 | { |
Przemyslaw Stekiel | f9cd608 | 2022-02-01 11:25:55 +0100 | [diff] [blame] | 1033 | psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT ); |
| 1034 | psa_set_key_algorithm( &attributes, alg ); |
| 1035 | psa_set_key_type( &attributes, key_type ); |
Przemyslaw Stekiel | fe7397d | 2022-01-17 15:47:07 +0100 | [diff] [blame] | 1036 | |
Przemyslaw Stekiel | f9cd608 | 2022-02-01 11:25:55 +0100 | [diff] [blame] | 1037 | if( ( status = psa_import_key( &attributes, |
| 1038 | key_enc, |
| 1039 | PSA_BITS_TO_BYTES( key_bits ), |
| 1040 | &transform->psa_key_enc ) ) != PSA_SUCCESS ) |
| 1041 | { |
| 1042 | MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_key", psa_ssl_status_to_mbedtls( status ) ); |
| 1043 | return( psa_ssl_status_to_mbedtls( status ) ); |
| 1044 | } |
Przemyslaw Stekiel | fe7397d | 2022-01-17 15:47:07 +0100 | [diff] [blame] | 1045 | |
Przemyslaw Stekiel | f9cd608 | 2022-02-01 11:25:55 +0100 | [diff] [blame] | 1046 | psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT ); |
| 1047 | |
| 1048 | if( ( status = psa_import_key( &attributes, |
| 1049 | key_dec, |
| 1050 | PSA_BITS_TO_BYTES( key_bits ), |
| 1051 | &transform->psa_key_dec ) ) != PSA_SUCCESS ) |
| 1052 | { |
| 1053 | MBEDTLS_SSL_DEBUG_RET( 1, "psa_import_key", psa_ssl_status_to_mbedtls( status ) ); |
| 1054 | return( psa_ssl_status_to_mbedtls( status ) ); |
| 1055 | } |
Przemyslaw Stekiel | ae77b0a | 2022-01-12 10:29:03 +0100 | [diff] [blame] | 1056 | } |
| 1057 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 1058 | |
Hanno Becker | c94060c | 2021-03-22 07:50:44 +0000 | [diff] [blame] | 1059 | return( 0 ); |
| 1060 | } |
| 1061 | |
Jerry Yu | 84a6eda | 2022-11-04 11:17:35 +0800 | [diff] [blame] | 1062 | MBEDTLS_CHECK_RETURN_CRITICAL |
| 1063 | static int ssl_tls13_get_cipher_key_info( |
| 1064 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info, |
| 1065 | size_t *key_len, size_t *iv_len ) |
| 1066 | { |
| 1067 | psa_key_type_t key_type; |
| 1068 | psa_algorithm_t alg; |
| 1069 | size_t taglen; |
| 1070 | size_t key_bits; |
| 1071 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 1072 | |
| 1073 | if( ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ) |
| 1074 | taglen = 8; |
| 1075 | else |
| 1076 | taglen = 16; |
| 1077 | |
| 1078 | status = mbedtls_ssl_cipher_to_psa( ciphersuite_info->cipher, taglen, |
| 1079 | &alg, &key_type, &key_bits ); |
| 1080 | if( status != PSA_SUCCESS ) |
| 1081 | return psa_ssl_status_to_mbedtls( status ); |
| 1082 | |
| 1083 | *key_len = PSA_BITS_TO_BYTES( key_bits ); |
| 1084 | |
| 1085 | /* TLS 1.3 only have AEAD ciphers, IV length is unconditionally 12 bytes */ |
| 1086 | *iv_len = 12; |
| 1087 | |
| 1088 | return 0; |
| 1089 | } |
| 1090 | |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1091 | #if defined(MBEDTLS_SSL_EARLY_DATA) |
Jerry Yu | 3ce61ff | 2022-11-21 22:45:58 +0800 | [diff] [blame] | 1092 | /* |
| 1093 | * ssl_tls13_generate_early_key() generates the key necessary for protecting |
Jerry Yu | e31688b | 2022-11-22 21:55:56 +0800 | [diff] [blame] | 1094 | * the early application data and handshake messages as described in section 7 |
| 1095 | * of RFC 8446. |
Jerry Yu | 3ce61ff | 2022-11-21 22:45:58 +0800 | [diff] [blame] | 1096 | * |
Jerry Yu | e31688b | 2022-11-22 21:55:56 +0800 | [diff] [blame] | 1097 | * NOTE: Only one key is generated, the key for the traffic from the client to |
| 1098 | * the server. The TLS 1.3 specification does not define a secret and thus |
| 1099 | * a key for server early traffic. |
Jerry Yu | 3ce61ff | 2022-11-21 22:45:58 +0800 | [diff] [blame] | 1100 | */ |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1101 | MBEDTLS_CHECK_RETURN_CRITICAL |
Jerry Yu | 3ce61ff | 2022-11-21 22:45:58 +0800 | [diff] [blame] | 1102 | static int ssl_tls13_generate_early_key( mbedtls_ssl_context *ssl, |
| 1103 | mbedtls_ssl_key_set *traffic_keys ) |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1104 | { |
| 1105 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 1106 | |
| 1107 | mbedtls_md_type_t md_type; |
| 1108 | |
| 1109 | psa_algorithm_t hash_alg; |
| 1110 | size_t hash_len; |
| 1111 | |
| 1112 | unsigned char transcript[MBEDTLS_TLS1_3_MD_MAX_SIZE]; |
| 1113 | size_t transcript_len; |
| 1114 | |
| 1115 | size_t key_len, iv_len; |
| 1116 | |
| 1117 | mbedtls_ssl_handshake_params *handshake = ssl->handshake; |
| 1118 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = handshake->ciphersuite_info; |
| 1119 | mbedtls_ssl_tls13_early_secrets *tls13_early_secrets = &handshake->tls13_early_secrets; |
| 1120 | |
Jerry Yu | 3ce61ff | 2022-11-21 22:45:58 +0800 | [diff] [blame] | 1121 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> ssl_tls13_generate_early_key" ) ); |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1122 | |
| 1123 | ret = ssl_tls13_get_cipher_key_info( ciphersuite_info, &key_len, &iv_len ); |
| 1124 | if( ret != 0 ) |
| 1125 | { |
| 1126 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls13_get_cipher_key_info", ret ); |
Jerry Yu | 3d78e08 | 2022-11-23 18:26:20 +0800 | [diff] [blame^] | 1127 | goto cleanup; |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1128 | } |
| 1129 | |
| 1130 | md_type = ciphersuite_info->mac; |
| 1131 | |
| 1132 | hash_alg = mbedtls_hash_info_psa_from_md( ciphersuite_info->mac ); |
| 1133 | hash_len = PSA_HASH_LENGTH( hash_alg ); |
| 1134 | |
| 1135 | ret = mbedtls_ssl_get_handshake_transcript( ssl, md_type, |
| 1136 | transcript, |
| 1137 | sizeof( transcript ), |
| 1138 | &transcript_len ); |
| 1139 | if( ret != 0 ) |
| 1140 | { |
| 1141 | MBEDTLS_SSL_DEBUG_RET( 1, |
| 1142 | "mbedtls_ssl_get_handshake_transcript", |
| 1143 | ret ); |
Jerry Yu | 3d78e08 | 2022-11-23 18:26:20 +0800 | [diff] [blame^] | 1144 | goto cleanup; |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1145 | } |
| 1146 | |
Jerry Yu | b094e12 | 2022-11-21 13:03:47 +0800 | [diff] [blame] | 1147 | ret = mbedtls_ssl_tls13_derive_early_secrets( |
| 1148 | hash_alg, handshake->tls13_master_secrets.early, |
| 1149 | transcript, transcript_len, tls13_early_secrets ); |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1150 | if( ret != 0 ) |
| 1151 | { |
| 1152 | MBEDTLS_SSL_DEBUG_RET( |
| 1153 | 1, "mbedtls_ssl_tls13_derive_early_secrets", ret ); |
Jerry Yu | 3d78e08 | 2022-11-23 18:26:20 +0800 | [diff] [blame^] | 1154 | goto cleanup; |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1155 | } |
| 1156 | |
| 1157 | MBEDTLS_SSL_DEBUG_BUF( |
| 1158 | 4, "Client early traffic secret", |
Jerry Yu | b094e12 | 2022-11-21 13:03:47 +0800 | [diff] [blame] | 1159 | tls13_early_secrets->client_early_traffic_secret, hash_len ); |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1160 | |
| 1161 | /* |
| 1162 | * Export client handshake traffic secret |
| 1163 | */ |
| 1164 | if( ssl->f_export_keys != NULL ) |
| 1165 | { |
Jerry Yu | b094e12 | 2022-11-21 13:03:47 +0800 | [diff] [blame] | 1166 | ssl->f_export_keys( |
| 1167 | ssl->p_export_keys, |
| 1168 | MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_EARLY_SECRET, |
| 1169 | tls13_early_secrets->client_early_traffic_secret, |
| 1170 | hash_len, |
| 1171 | handshake->randbytes, |
| 1172 | handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN, |
| 1173 | MBEDTLS_SSL_TLS_PRF_NONE /* TODO: FIX! */ ); |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1174 | } |
| 1175 | |
Jerry Yu | a877183 | 2022-11-21 23:16:54 +0800 | [diff] [blame] | 1176 | ret = ssl_tls13_make_traffic_key( |
Jerry Yu | b094e12 | 2022-11-21 13:03:47 +0800 | [diff] [blame] | 1177 | hash_alg, |
| 1178 | tls13_early_secrets->client_early_traffic_secret, |
Jerry Yu | a877183 | 2022-11-21 23:16:54 +0800 | [diff] [blame] | 1179 | hash_len, traffic_keys->client_write_key, key_len, |
| 1180 | traffic_keys->client_write_iv, iv_len ); |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1181 | if( ret != 0 ) |
| 1182 | { |
Jerry Yu | a5db6c0 | 2022-11-23 18:08:04 +0800 | [diff] [blame] | 1183 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls13_make_traffic_key", ret ); |
Jerry Yu | 3d78e08 | 2022-11-23 18:26:20 +0800 | [diff] [blame^] | 1184 | goto cleanup; |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1185 | } |
Jerry Yu | a877183 | 2022-11-21 23:16:54 +0800 | [diff] [blame] | 1186 | traffic_keys->key_len = key_len; |
| 1187 | traffic_keys->iv_len = iv_len; |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1188 | |
Jerry Yu | 3ce61ff | 2022-11-21 22:45:58 +0800 | [diff] [blame] | 1189 | MBEDTLS_SSL_DEBUG_BUF( 4, "client early write_key", |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1190 | traffic_keys->client_write_key, |
| 1191 | traffic_keys->key_len); |
| 1192 | |
Jerry Yu | 3ce61ff | 2022-11-21 22:45:58 +0800 | [diff] [blame] | 1193 | MBEDTLS_SSL_DEBUG_BUF( 4, "client early write_iv", |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1194 | traffic_keys->client_write_iv, |
| 1195 | traffic_keys->iv_len); |
| 1196 | |
Jerry Yu | 3ce61ff | 2022-11-21 22:45:58 +0800 | [diff] [blame] | 1197 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= ssl_tls13_generate_early_key" ) ); |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1198 | |
Jerry Yu | 3d78e08 | 2022-11-23 18:26:20 +0800 | [diff] [blame^] | 1199 | cleanup: |
| 1200 | /* Erase secret and transcript */ |
| 1201 | mbedtls_platform_zeroize( |
| 1202 | tls13_early_secrets, sizeof( mbedtls_ssl_tls13_early_secrets ) ); |
| 1203 | mbedtls_platform_zeroize( transcript, sizeof( transcript ) ); |
| 1204 | return( ret ); |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1205 | } |
| 1206 | |
| 1207 | int mbedtls_ssl_tls13_compute_early_transform( mbedtls_ssl_context *ssl ) |
| 1208 | { |
| 1209 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 1210 | mbedtls_ssl_key_set traffic_keys; |
| 1211 | mbedtls_ssl_transform *transform_earlydata = NULL; |
| 1212 | mbedtls_ssl_handshake_params *handshake = ssl->handshake; |
| 1213 | |
| 1214 | /* Next evolution in key schedule: Establish early_data secret and |
| 1215 | * key material. */ |
Jerry Yu | 3ce61ff | 2022-11-21 22:45:58 +0800 | [diff] [blame] | 1216 | ret = ssl_tls13_generate_early_key( ssl, &traffic_keys ); |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1217 | if( ret != 0 ) |
| 1218 | { |
Jerry Yu | 3ce61ff | 2022-11-21 22:45:58 +0800 | [diff] [blame] | 1219 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls13_generate_early_key", |
Jerry Yu | 91b560f | 2022-11-04 14:10:34 +0800 | [diff] [blame] | 1220 | ret ); |
| 1221 | goto cleanup; |
| 1222 | } |
| 1223 | |
| 1224 | transform_earlydata = mbedtls_calloc( 1, sizeof( mbedtls_ssl_transform ) ); |
| 1225 | if( transform_earlydata == NULL ) |
| 1226 | { |
| 1227 | ret = MBEDTLS_ERR_SSL_ALLOC_FAILED; |
| 1228 | goto cleanup; |
| 1229 | } |
| 1230 | |
| 1231 | ret = mbedtls_ssl_tls13_populate_transform( |
| 1232 | transform_earlydata, |
| 1233 | ssl->conf->endpoint, |
| 1234 | ssl->session_negotiate->ciphersuite, |
| 1235 | &traffic_keys, |
| 1236 | ssl ); |
| 1237 | if( ret != 0 ) |
| 1238 | { |
| 1239 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_populate_transform", ret ); |
| 1240 | goto cleanup; |
| 1241 | } |
| 1242 | handshake->transform_earlydata = transform_earlydata; |
| 1243 | |
| 1244 | cleanup: |
| 1245 | mbedtls_platform_zeroize( &traffic_keys, sizeof( traffic_keys ) ); |
| 1246 | if( ret != 0 ) |
| 1247 | mbedtls_free( transform_earlydata ); |
| 1248 | |
| 1249 | return( ret ); |
| 1250 | } |
| 1251 | #endif /* MBEDTLS_SSL_EARLY_DATA */ |
| 1252 | |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 1253 | int mbedtls_ssl_tls13_key_schedule_stage_early( mbedtls_ssl_context *ssl ) |
Jerry Yu | 89ea321 | 2021-09-09 14:31:24 +0800 | [diff] [blame] | 1254 | { |
Jerry Yu | e3131ef | 2021-09-16 13:14:15 +0800 | [diff] [blame] | 1255 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1256 | psa_algorithm_t hash_alg; |
Jerry Yu | 5ccfcd4 | 2021-10-11 16:39:29 +0800 | [diff] [blame] | 1257 | mbedtls_ssl_handshake_params *handshake = ssl->handshake; |
Ronald Cron | 295d93e | 2022-07-19 08:21:29 +0200 | [diff] [blame] | 1258 | unsigned char *psk = NULL; |
| 1259 | size_t psk_len = 0; |
Jerry Yu | 6ca7c7f | 2021-09-28 18:51:40 +0800 | [diff] [blame] | 1260 | |
Jerry Yu | 5ccfcd4 | 2021-10-11 16:39:29 +0800 | [diff] [blame] | 1261 | if( handshake->ciphersuite_info == NULL ) |
Jerry Yu | 89ea321 | 2021-09-09 14:31:24 +0800 | [diff] [blame] | 1262 | { |
| 1263 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "cipher suite info not found" ) ); |
| 1264 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
| 1265 | } |
Jerry Yu | e3131ef | 2021-09-16 13:14:15 +0800 | [diff] [blame] | 1266 | |
Manuel Pégourié-Gonnard | abac037 | 2022-07-18 13:41:11 +0200 | [diff] [blame] | 1267 | hash_alg = mbedtls_hash_info_psa_from_md( handshake->ciphersuite_info->mac ); |
Ronald Cron | 41a443a | 2022-10-04 16:38:25 +0200 | [diff] [blame] | 1268 | #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED) |
Jerry Yu | 5d01c05 | 2022-08-17 10:18:10 +0800 | [diff] [blame] | 1269 | if( mbedtls_ssl_tls13_key_exchange_mode_with_psk( ssl ) ) |
Ronald Cron | 295d93e | 2022-07-19 08:21:29 +0200 | [diff] [blame] | 1270 | { |
Jerry Yu | 5d01c05 | 2022-08-17 10:18:10 +0800 | [diff] [blame] | 1271 | ret = mbedtls_ssl_tls13_export_handshake_psk( ssl, &psk, &psk_len ); |
| 1272 | if( ret != 0 ) |
| 1273 | { |
| 1274 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_export_handshake_psk", |
| 1275 | ret ); |
| 1276 | return( ret ); |
| 1277 | } |
Ronald Cron | 295d93e | 2022-07-19 08:21:29 +0200 | [diff] [blame] | 1278 | } |
Jerry Yu | 5d01c05 | 2022-08-17 10:18:10 +0800 | [diff] [blame] | 1279 | #endif |
Ronald Cron | 295d93e | 2022-07-19 08:21:29 +0200 | [diff] [blame] | 1280 | |
| 1281 | ret = mbedtls_ssl_tls13_evolve_secret( hash_alg, NULL, psk, psk_len, |
Xiaofei Bai | d25fab6 | 2021-12-02 06:36:27 +0000 | [diff] [blame] | 1282 | handshake->tls13_master_secrets.early ); |
Ronald Cron | 295d93e | 2022-07-19 08:21:29 +0200 | [diff] [blame] | 1283 | #if defined(MBEDTLS_USE_PSA_CRYPTO) && \ |
Ronald Cron | 41a443a | 2022-10-04 16:38:25 +0200 | [diff] [blame] | 1284 | defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED) |
Ronald Cron | 295d93e | 2022-07-19 08:21:29 +0200 | [diff] [blame] | 1285 | mbedtls_free( (void*)psk ); |
| 1286 | #endif |
Jerry Yu | 89ea321 | 2021-09-09 14:31:24 +0800 | [diff] [blame] | 1287 | if( ret != 0 ) |
| 1288 | { |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 1289 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_evolve_secret", ret ); |
Jerry Yu | 89ea321 | 2021-09-09 14:31:24 +0800 | [diff] [blame] | 1290 | return( ret ); |
| 1291 | } |
| 1292 | |
Ronald Cron | 295d93e | 2022-07-19 08:21:29 +0200 | [diff] [blame] | 1293 | MBEDTLS_SSL_DEBUG_BUF( 4, "mbedtls_ssl_tls13_key_schedule_stage_early", |
| 1294 | handshake->tls13_master_secrets.early, |
| 1295 | PSA_HASH_LENGTH( hash_alg ) ); |
Jerry Yu | 89ea321 | 2021-09-09 14:31:24 +0800 | [diff] [blame] | 1296 | return( 0 ); |
| 1297 | } |
| 1298 | |
Jerry Yu | c068b66 | 2021-10-11 22:30:19 +0800 | [diff] [blame] | 1299 | /* mbedtls_ssl_tls13_generate_handshake_keys() generates keys necessary for |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 1300 | * protecting the handshake messages, as described in Section 7 of TLS 1.3. */ |
Jerry Yu | c068b66 | 2021-10-11 22:30:19 +0800 | [diff] [blame] | 1301 | int mbedtls_ssl_tls13_generate_handshake_keys( mbedtls_ssl_context *ssl, |
| 1302 | mbedtls_ssl_key_set *traffic_keys ) |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 1303 | { |
| 1304 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 1305 | mbedtls_md_type_t md_type; |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1306 | psa_algorithm_t hash_alg; |
| 1307 | size_t hash_len; |
Jerry Yu | 435208a | 2021-10-13 11:22:16 +0800 | [diff] [blame] | 1308 | unsigned char transcript[MBEDTLS_TLS1_3_MD_MAX_SIZE]; |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 1309 | size_t transcript_len; |
Jerry Yu | b094e12 | 2022-11-21 13:03:47 +0800 | [diff] [blame] | 1310 | size_t key_len; |
| 1311 | size_t iv_len; |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 1312 | |
Jerry Yu | 435208a | 2021-10-13 11:22:16 +0800 | [diff] [blame] | 1313 | mbedtls_ssl_handshake_params *handshake = ssl->handshake; |
| 1314 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = handshake->ciphersuite_info; |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 1315 | mbedtls_ssl_tls13_handshake_secrets *tls13_hs_secrets = &handshake->tls13_hs_secrets; |
Jerry Yu | 435208a | 2021-10-13 11:22:16 +0800 | [diff] [blame] | 1316 | |
Jerry Yu | c068b66 | 2021-10-11 22:30:19 +0800 | [diff] [blame] | 1317 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_tls13_generate_handshake_keys" ) ); |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 1318 | |
Jerry Yu | b094e12 | 2022-11-21 13:03:47 +0800 | [diff] [blame] | 1319 | ret = ssl_tls13_get_cipher_key_info( ciphersuite_info, &key_len, &iv_len ); |
Neil Armstrong | b818e16 | 2022-05-17 09:24:52 +0200 | [diff] [blame] | 1320 | if( ret != 0 ) |
Neil Armstrong | 4f4f271 | 2022-05-05 15:34:39 +0200 | [diff] [blame] | 1321 | { |
Jerry Yu | 84a6eda | 2022-11-04 11:17:35 +0800 | [diff] [blame] | 1322 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls13_get_cipher_key_info", ret ); |
Neil Armstrong | 4f4f271 | 2022-05-05 15:34:39 +0200 | [diff] [blame] | 1323 | return ret; |
| 1324 | } |
| 1325 | |
Jerry Yu | 435208a | 2021-10-13 11:22:16 +0800 | [diff] [blame] | 1326 | md_type = ciphersuite_info->mac; |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1327 | |
Manuel Pégourié-Gonnard | abac037 | 2022-07-18 13:41:11 +0200 | [diff] [blame] | 1328 | hash_alg = mbedtls_hash_info_psa_from_md( ciphersuite_info->mac ); |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1329 | hash_len = PSA_HASH_LENGTH( hash_alg ); |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 1330 | |
| 1331 | ret = mbedtls_ssl_get_handshake_transcript( ssl, md_type, |
| 1332 | transcript, |
| 1333 | sizeof( transcript ), |
| 1334 | &transcript_len ); |
| 1335 | if( ret != 0 ) |
| 1336 | { |
| 1337 | MBEDTLS_SSL_DEBUG_RET( 1, |
| 1338 | "mbedtls_ssl_get_handshake_transcript", |
| 1339 | ret ); |
| 1340 | return( ret ); |
| 1341 | } |
| 1342 | |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1343 | ret = mbedtls_ssl_tls13_derive_handshake_secrets( hash_alg, |
Xiaofei Bai | d25fab6 | 2021-12-02 06:36:27 +0000 | [diff] [blame] | 1344 | handshake->tls13_master_secrets.handshake, |
Jerry Yu | 435208a | 2021-10-13 11:22:16 +0800 | [diff] [blame] | 1345 | transcript, transcript_len, tls13_hs_secrets ); |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 1346 | if( ret != 0 ) |
| 1347 | { |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 1348 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_derive_handshake_secrets", |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 1349 | ret ); |
| 1350 | return( ret ); |
| 1351 | } |
| 1352 | |
| 1353 | MBEDTLS_SSL_DEBUG_BUF( 4, "Client handshake traffic secret", |
Jerry Yu | 435208a | 2021-10-13 11:22:16 +0800 | [diff] [blame] | 1354 | tls13_hs_secrets->client_handshake_traffic_secret, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1355 | hash_len ); |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 1356 | MBEDTLS_SSL_DEBUG_BUF( 4, "Server handshake traffic secret", |
Jerry Yu | 435208a | 2021-10-13 11:22:16 +0800 | [diff] [blame] | 1357 | tls13_hs_secrets->server_handshake_traffic_secret, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1358 | hash_len ); |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 1359 | |
| 1360 | /* |
| 1361 | * Export client handshake traffic secret |
| 1362 | */ |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 1363 | if( ssl->f_export_keys != NULL ) |
| 1364 | { |
| 1365 | ssl->f_export_keys( ssl->p_export_keys, |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 1366 | MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_HANDSHAKE_TRAFFIC_SECRET, |
Jerry Yu | 435208a | 2021-10-13 11:22:16 +0800 | [diff] [blame] | 1367 | tls13_hs_secrets->client_handshake_traffic_secret, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1368 | hash_len, |
Jerry Yu | 435208a | 2021-10-13 11:22:16 +0800 | [diff] [blame] | 1369 | handshake->randbytes, |
lhuang04 | a3890a3 | 2022-01-04 09:47:20 -0800 | [diff] [blame] | 1370 | handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN, |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 1371 | MBEDTLS_SSL_TLS_PRF_NONE /* TODO: FIX! */ ); |
| 1372 | |
| 1373 | ssl->f_export_keys( ssl->p_export_keys, |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 1374 | MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_HANDSHAKE_TRAFFIC_SECRET, |
Jerry Yu | 435208a | 2021-10-13 11:22:16 +0800 | [diff] [blame] | 1375 | tls13_hs_secrets->server_handshake_traffic_secret, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1376 | hash_len, |
Jerry Yu | 435208a | 2021-10-13 11:22:16 +0800 | [diff] [blame] | 1377 | handshake->randbytes, |
lhuang04 | a3890a3 | 2022-01-04 09:47:20 -0800 | [diff] [blame] | 1378 | handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN, |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 1379 | MBEDTLS_SSL_TLS_PRF_NONE /* TODO: FIX! */ ); |
| 1380 | } |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 1381 | |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1382 | ret = mbedtls_ssl_tls13_make_traffic_keys( hash_alg, |
Jerry Yu | 435208a | 2021-10-13 11:22:16 +0800 | [diff] [blame] | 1383 | tls13_hs_secrets->client_handshake_traffic_secret, |
| 1384 | tls13_hs_secrets->server_handshake_traffic_secret, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1385 | hash_len, key_len, iv_len, traffic_keys ); |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 1386 | if( ret != 0 ) |
| 1387 | { |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 1388 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_make_traffic_keys", ret ); |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 1389 | goto exit; |
| 1390 | } |
| 1391 | |
| 1392 | MBEDTLS_SSL_DEBUG_BUF( 4, "client_handshake write_key", |
| 1393 | traffic_keys->client_write_key, |
| 1394 | traffic_keys->key_len); |
| 1395 | |
| 1396 | MBEDTLS_SSL_DEBUG_BUF( 4, "server_handshake write_key", |
| 1397 | traffic_keys->server_write_key, |
| 1398 | traffic_keys->key_len); |
| 1399 | |
| 1400 | MBEDTLS_SSL_DEBUG_BUF( 4, "client_handshake write_iv", |
| 1401 | traffic_keys->client_write_iv, |
| 1402 | traffic_keys->iv_len); |
| 1403 | |
| 1404 | MBEDTLS_SSL_DEBUG_BUF( 4, "server_handshake write_iv", |
| 1405 | traffic_keys->server_write_iv, |
| 1406 | traffic_keys->iv_len); |
| 1407 | |
Jerry Yu | c068b66 | 2021-10-11 22:30:19 +0800 | [diff] [blame] | 1408 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_tls13_generate_handshake_keys" ) ); |
Jerry Yu | 61e35e0 | 2021-09-16 18:59:08 +0800 | [diff] [blame] | 1409 | |
| 1410 | exit: |
| 1411 | |
| 1412 | return( ret ); |
| 1413 | } |
| 1414 | |
Jerry Yu | f0ac235 | 2021-10-11 17:47:07 +0800 | [diff] [blame] | 1415 | int mbedtls_ssl_tls13_key_schedule_stage_handshake( mbedtls_ssl_context *ssl ) |
Jerry Yu | a0650eb | 2021-09-09 17:14:45 +0800 | [diff] [blame] | 1416 | { |
Jerry Yu | f0ac235 | 2021-10-11 17:47:07 +0800 | [diff] [blame] | 1417 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Jerry Yu | 5ccfcd4 | 2021-10-11 16:39:29 +0800 | [diff] [blame] | 1418 | mbedtls_ssl_handshake_params *handshake = ssl->handshake; |
Manuel Pégourié-Gonnard | abac037 | 2022-07-18 13:41:11 +0200 | [diff] [blame] | 1419 | psa_algorithm_t const hash_alg = mbedtls_hash_info_psa_from_md( |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1420 | handshake->ciphersuite_info->mac ); |
Ronald Cron | 3b05620 | 2022-10-05 17:20:21 +0200 | [diff] [blame] | 1421 | unsigned char *shared_secret = NULL; |
| 1422 | size_t shared_secret_len = 0; |
Jerry Yu | a0650eb | 2021-09-09 17:14:45 +0800 | [diff] [blame] | 1423 | |
Ronald Cron | a2900bc | 2022-10-20 14:37:35 +0200 | [diff] [blame] | 1424 | #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED) |
Jerry Yu | f0ac235 | 2021-10-11 17:47:07 +0800 | [diff] [blame] | 1425 | /* |
| 1426 | * Compute ECDHE secret used to compute the handshake secret from which |
| 1427 | * client_handshake_traffic_secret and server_handshake_traffic_secret |
| 1428 | * are derived in the handshake secret derivation stage. |
| 1429 | */ |
Ronald Cron | 7990771 | 2022-07-20 17:05:29 +0200 | [diff] [blame] | 1430 | if( mbedtls_ssl_tls13_key_exchange_mode_with_ephemeral( ssl ) ) |
Jerry Yu | f0ac235 | 2021-10-11 17:47:07 +0800 | [diff] [blame] | 1431 | { |
| 1432 | if( mbedtls_ssl_tls13_named_group_is_ecdhe( handshake->offered_group_id ) ) |
| 1433 | { |
| 1434 | #if defined(MBEDTLS_ECDH_C) |
Przemyslaw Stekiel | c0824bf | 2022-02-10 10:37:15 +0100 | [diff] [blame] | 1435 | /* Compute ECDH shared secret. */ |
Ronald Cron | 4c7edb2 | 2022-10-05 15:37:11 +0200 | [diff] [blame] | 1436 | psa_status_t status = PSA_ERROR_GENERIC_ERROR; |
Ronald Cron | 3b05620 | 2022-10-05 17:20:21 +0200 | [diff] [blame] | 1437 | psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT; |
| 1438 | |
| 1439 | status = psa_get_key_attributes( handshake->ecdh_psa_privkey, |
| 1440 | &key_attributes ); |
| 1441 | if( status != PSA_SUCCESS ) |
| 1442 | ret = psa_ssl_status_to_mbedtls( status ); |
| 1443 | |
| 1444 | shared_secret_len = PSA_BITS_TO_BYTES( |
| 1445 | psa_get_key_bits( &key_attributes ) ); |
| 1446 | shared_secret = mbedtls_calloc( 1, shared_secret_len ); |
| 1447 | if( shared_secret == NULL ) |
| 1448 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
Przemyslaw Stekiel | c0824bf | 2022-02-10 10:37:15 +0100 | [diff] [blame] | 1449 | |
Ronald Cron | 4c7edb2 | 2022-10-05 15:37:11 +0200 | [diff] [blame] | 1450 | status = psa_raw_key_agreement( |
| 1451 | PSA_ALG_ECDH, handshake->ecdh_psa_privkey, |
| 1452 | handshake->ecdh_psa_peerkey, handshake->ecdh_psa_peerkey_len, |
Ronald Cron | 3b05620 | 2022-10-05 17:20:21 +0200 | [diff] [blame] | 1453 | shared_secret, shared_secret_len, &shared_secret_len ); |
Ronald Cron | 4c7edb2 | 2022-10-05 15:37:11 +0200 | [diff] [blame] | 1454 | if( status != PSA_SUCCESS ) |
| 1455 | { |
| 1456 | ret = psa_ssl_status_to_mbedtls( status ); |
| 1457 | MBEDTLS_SSL_DEBUG_RET( 1, "psa_raw_key_agreement", ret ); |
Ronald Cron | 3b05620 | 2022-10-05 17:20:21 +0200 | [diff] [blame] | 1458 | goto cleanup; |
Ronald Cron | 4c7edb2 | 2022-10-05 15:37:11 +0200 | [diff] [blame] | 1459 | } |
Przemyslaw Stekiel | c0824bf | 2022-02-10 10:37:15 +0100 | [diff] [blame] | 1460 | |
Ronald Cron | 4c7edb2 | 2022-10-05 15:37:11 +0200 | [diff] [blame] | 1461 | status = psa_destroy_key( handshake->ecdh_psa_privkey ); |
| 1462 | if( status != PSA_SUCCESS ) |
| 1463 | { |
| 1464 | ret = psa_ssl_status_to_mbedtls( status ); |
| 1465 | MBEDTLS_SSL_DEBUG_RET( 1, "psa_destroy_key", ret ); |
Ronald Cron | 3b05620 | 2022-10-05 17:20:21 +0200 | [diff] [blame] | 1466 | goto cleanup; |
Ronald Cron | 4c7edb2 | 2022-10-05 15:37:11 +0200 | [diff] [blame] | 1467 | } |
| 1468 | |
| 1469 | handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; |
Jerry Yu | f0ac235 | 2021-10-11 17:47:07 +0800 | [diff] [blame] | 1470 | #endif /* MBEDTLS_ECDH_C */ |
| 1471 | } |
Ronald Cron | 9a6a49c | 2022-10-17 08:52:30 +0200 | [diff] [blame] | 1472 | else |
Jerry Yu | f0ac235 | 2021-10-11 17:47:07 +0800 | [diff] [blame] | 1473 | { |
Ronald Cron | 9a6a49c | 2022-10-17 08:52:30 +0200 | [diff] [blame] | 1474 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "Group not supported." ) ); |
Ronald Cron | b15d4d8 | 2022-10-17 08:47:32 +0200 | [diff] [blame] | 1475 | return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); |
Jerry Yu | f0ac235 | 2021-10-11 17:47:07 +0800 | [diff] [blame] | 1476 | } |
| 1477 | } |
Ronald Cron | a2900bc | 2022-10-20 14:37:35 +0200 | [diff] [blame] | 1478 | #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED */ |
Jerry Yu | a0650eb | 2021-09-09 17:14:45 +0800 | [diff] [blame] | 1479 | |
| 1480 | /* |
Jerry Yu | f0ac235 | 2021-10-11 17:47:07 +0800 | [diff] [blame] | 1481 | * Compute the Handshake Secret |
Jerry Yu | a0650eb | 2021-09-09 17:14:45 +0800 | [diff] [blame] | 1482 | */ |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1483 | ret = mbedtls_ssl_tls13_evolve_secret( hash_alg, |
Xiaofei Bai | d25fab6 | 2021-12-02 06:36:27 +0000 | [diff] [blame] | 1484 | handshake->tls13_master_secrets.early, |
Ronald Cron | 3b05620 | 2022-10-05 17:20:21 +0200 | [diff] [blame] | 1485 | shared_secret, shared_secret_len, |
Xiaofei Bai | d25fab6 | 2021-12-02 06:36:27 +0000 | [diff] [blame] | 1486 | handshake->tls13_master_secrets.handshake ); |
Jerry Yu | a0650eb | 2021-09-09 17:14:45 +0800 | [diff] [blame] | 1487 | if( ret != 0 ) |
| 1488 | { |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 1489 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_evolve_secret", ret ); |
Ronald Cron | 3b05620 | 2022-10-05 17:20:21 +0200 | [diff] [blame] | 1490 | goto cleanup; |
Jerry Yu | a0650eb | 2021-09-09 17:14:45 +0800 | [diff] [blame] | 1491 | } |
| 1492 | |
| 1493 | MBEDTLS_SSL_DEBUG_BUF( 4, "Handshake secret", |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1494 | handshake->tls13_master_secrets.handshake, |
| 1495 | PSA_HASH_LENGTH( hash_alg ) ); |
Jerry Yu | a0650eb | 2021-09-09 17:14:45 +0800 | [diff] [blame] | 1496 | |
Ronald Cron | 3b05620 | 2022-10-05 17:20:21 +0200 | [diff] [blame] | 1497 | cleanup: |
| 1498 | if( shared_secret != NULL ) |
| 1499 | { |
| 1500 | mbedtls_platform_zeroize( shared_secret, shared_secret_len ); |
| 1501 | mbedtls_free( shared_secret ); |
| 1502 | } |
| 1503 | |
| 1504 | return( ret ); |
Jerry Yu | a0650eb | 2021-09-09 17:14:45 +0800 | [diff] [blame] | 1505 | } |
| 1506 | |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1507 | /* Generate application traffic keys since any records following a 1-RTT Finished message |
| 1508 | * MUST be encrypted under the application traffic key. |
| 1509 | */ |
XiaokangQian | d0aa3e9 | 2021-11-10 06:17:40 +0000 | [diff] [blame] | 1510 | int mbedtls_ssl_tls13_generate_application_keys( |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1511 | mbedtls_ssl_context *ssl, |
| 1512 | mbedtls_ssl_key_set *traffic_keys ) |
| 1513 | { |
XiaokangQian | a763498 | 2021-10-22 06:32:32 +0000 | [diff] [blame] | 1514 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
XiaokangQian | 3306284 | 2021-11-11 03:37:45 +0000 | [diff] [blame] | 1515 | mbedtls_ssl_handshake_params *handshake = ssl->handshake; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1516 | |
| 1517 | /* Address at which to store the application secrets */ |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 1518 | mbedtls_ssl_tls13_application_secrets * const app_secrets = |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1519 | &ssl->session_negotiate->app_secrets; |
| 1520 | |
| 1521 | /* Holding the transcript up to and including the ServerFinished */ |
XiaokangQian | 3306284 | 2021-11-11 03:37:45 +0000 | [diff] [blame] | 1522 | unsigned char transcript[MBEDTLS_TLS1_3_MD_MAX_SIZE]; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1523 | size_t transcript_len; |
| 1524 | |
| 1525 | /* Variables relating to the hash for the chosen ciphersuite. */ |
| 1526 | mbedtls_md_type_t md_type; |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1527 | |
| 1528 | psa_algorithm_t hash_alg; |
| 1529 | size_t hash_len; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1530 | |
| 1531 | /* Variables relating to the cipher for the chosen ciphersuite. */ |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 1532 | size_t key_len, iv_len; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1533 | |
| 1534 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive application traffic keys" ) ); |
| 1535 | |
| 1536 | /* Extract basic information about hash and ciphersuite */ |
| 1537 | |
Jerry Yu | 84a6eda | 2022-11-04 11:17:35 +0800 | [diff] [blame] | 1538 | ret = ssl_tls13_get_cipher_key_info( handshake->ciphersuite_info, |
Jerry Yu | b094e12 | 2022-11-21 13:03:47 +0800 | [diff] [blame] | 1539 | &key_len, &iv_len ); |
Neil Armstrong | b818e16 | 2022-05-17 09:24:52 +0200 | [diff] [blame] | 1540 | if( ret != 0 ) |
Neil Armstrong | 4f4f271 | 2022-05-05 15:34:39 +0200 | [diff] [blame] | 1541 | { |
Jerry Yu | 84a6eda | 2022-11-04 11:17:35 +0800 | [diff] [blame] | 1542 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls13_get_cipher_key_info", ret ); |
Neil Armstrong | 4f4f271 | 2022-05-05 15:34:39 +0200 | [diff] [blame] | 1543 | goto cleanup; |
| 1544 | } |
| 1545 | |
XiaokangQian | 3306284 | 2021-11-11 03:37:45 +0000 | [diff] [blame] | 1546 | md_type = handshake->ciphersuite_info->mac; |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1547 | |
Manuel Pégourié-Gonnard | abac037 | 2022-07-18 13:41:11 +0200 | [diff] [blame] | 1548 | hash_alg = mbedtls_hash_info_psa_from_md( handshake->ciphersuite_info->mac ); |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1549 | hash_len = PSA_HASH_LENGTH( hash_alg ); |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1550 | |
Shaun Case | 8b0ecbc | 2021-12-20 21:14:10 -0800 | [diff] [blame] | 1551 | /* Compute current handshake transcript. It's the caller's responsibility |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1552 | * to call this at the right time, that is, after the ServerFinished. */ |
| 1553 | |
| 1554 | ret = mbedtls_ssl_get_handshake_transcript( ssl, md_type, |
| 1555 | transcript, sizeof( transcript ), |
| 1556 | &transcript_len ); |
| 1557 | if( ret != 0 ) |
XiaokangQian | 4cab024 | 2021-10-12 08:43:37 +0000 | [diff] [blame] | 1558 | goto cleanup; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1559 | |
| 1560 | /* Compute application secrets from master secret and transcript hash. */ |
| 1561 | |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1562 | ret = mbedtls_ssl_tls13_derive_application_secrets( hash_alg, |
Xiaofei Bai | d25fab6 | 2021-12-02 06:36:27 +0000 | [diff] [blame] | 1563 | handshake->tls13_master_secrets.app, |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1564 | transcript, transcript_len, |
| 1565 | app_secrets ); |
| 1566 | if( ret != 0 ) |
| 1567 | { |
| 1568 | MBEDTLS_SSL_DEBUG_RET( 1, |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 1569 | "mbedtls_ssl_tls13_derive_application_secrets", ret ); |
XiaokangQian | 4cab024 | 2021-10-12 08:43:37 +0000 | [diff] [blame] | 1570 | goto cleanup; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1571 | } |
| 1572 | |
| 1573 | /* Derive first epoch of IV + Key for application traffic. */ |
| 1574 | |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1575 | ret = mbedtls_ssl_tls13_make_traffic_keys( hash_alg, |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1576 | app_secrets->client_application_traffic_secret_N, |
| 1577 | app_secrets->server_application_traffic_secret_N, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1578 | hash_len, key_len, iv_len, traffic_keys ); |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1579 | if( ret != 0 ) |
| 1580 | { |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 1581 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_make_traffic_keys", ret ); |
XiaokangQian | 4cab024 | 2021-10-12 08:43:37 +0000 | [diff] [blame] | 1582 | goto cleanup; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1583 | } |
| 1584 | |
| 1585 | MBEDTLS_SSL_DEBUG_BUF( 4, "Client application traffic secret", |
| 1586 | app_secrets->client_application_traffic_secret_N, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1587 | hash_len ); |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1588 | |
| 1589 | MBEDTLS_SSL_DEBUG_BUF( 4, "Server application traffic secret", |
| 1590 | app_secrets->server_application_traffic_secret_N, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1591 | hash_len ); |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1592 | |
XiaokangQian | ac0385c | 2021-11-03 06:40:11 +0000 | [diff] [blame] | 1593 | /* |
| 1594 | * Export client/server application traffic secret 0 |
| 1595 | */ |
| 1596 | if( ssl->f_export_keys != NULL ) |
| 1597 | { |
| 1598 | ssl->f_export_keys( ssl->p_export_keys, |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 1599 | MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_APPLICATION_TRAFFIC_SECRET, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1600 | app_secrets->client_application_traffic_secret_N, hash_len, |
XiaokangQian | 3306284 | 2021-11-11 03:37:45 +0000 | [diff] [blame] | 1601 | handshake->randbytes, |
lhuang04 | a3890a3 | 2022-01-04 09:47:20 -0800 | [diff] [blame] | 1602 | handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN, |
XiaokangQian | b51f884 | 2021-11-04 03:02:47 +0000 | [diff] [blame] | 1603 | MBEDTLS_SSL_TLS_PRF_NONE /* TODO: this should be replaced by |
| 1604 | a new constant for TLS 1.3! */ ); |
XiaokangQian | ac0385c | 2021-11-03 06:40:11 +0000 | [diff] [blame] | 1605 | |
| 1606 | ssl->f_export_keys( ssl->p_export_keys, |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 1607 | MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_APPLICATION_TRAFFIC_SECRET, |
Gabor Mezei | 07732f7 | 2022-03-26 17:04:19 +0100 | [diff] [blame] | 1608 | app_secrets->server_application_traffic_secret_N, hash_len, |
XiaokangQian | 3306284 | 2021-11-11 03:37:45 +0000 | [diff] [blame] | 1609 | handshake->randbytes, |
lhuang04 | a3890a3 | 2022-01-04 09:47:20 -0800 | [diff] [blame] | 1610 | handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN, |
XiaokangQian | b51f884 | 2021-11-04 03:02:47 +0000 | [diff] [blame] | 1611 | MBEDTLS_SSL_TLS_PRF_NONE /* TODO: this should be replaced by |
| 1612 | a new constant for TLS 1.3! */ ); |
XiaokangQian | ac0385c | 2021-11-03 06:40:11 +0000 | [diff] [blame] | 1613 | } |
| 1614 | |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1615 | MBEDTLS_SSL_DEBUG_BUF( 4, "client application_write_key:", |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 1616 | traffic_keys->client_write_key, key_len ); |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1617 | MBEDTLS_SSL_DEBUG_BUF( 4, "server application write key", |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 1618 | traffic_keys->server_write_key, key_len ); |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1619 | MBEDTLS_SSL_DEBUG_BUF( 4, "client application write IV", |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 1620 | traffic_keys->client_write_iv, iv_len ); |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1621 | MBEDTLS_SSL_DEBUG_BUF( 4, "server application write IV", |
Xiaofei Bai | b797284 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 1622 | traffic_keys->server_write_iv, iv_len ); |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1623 | |
| 1624 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= derive application traffic keys" ) ); |
XiaokangQian | 4cab024 | 2021-10-12 08:43:37 +0000 | [diff] [blame] | 1625 | |
| 1626 | cleanup: |
Jerry Yu | 2c70a39 | 2021-12-08 13:28:49 +0800 | [diff] [blame] | 1627 | /* randbytes is not used again */ |
| 1628 | mbedtls_platform_zeroize( ssl->handshake->randbytes, |
| 1629 | sizeof( ssl->handshake->randbytes ) ); |
Jerry Yu | ef2b98a | 2022-05-06 16:40:05 +0800 | [diff] [blame] | 1630 | |
XiaokangQian | 3306284 | 2021-11-11 03:37:45 +0000 | [diff] [blame] | 1631 | mbedtls_platform_zeroize( transcript, sizeof( transcript ) ); |
XiaokangQian | 4cab024 | 2021-10-12 08:43:37 +0000 | [diff] [blame] | 1632 | return( ret ); |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1633 | } |
| 1634 | |
Jerry Yu | f86eb75 | 2022-05-06 11:16:55 +0800 | [diff] [blame] | 1635 | int mbedtls_ssl_tls13_compute_handshake_transform( mbedtls_ssl_context *ssl ) |
Jerry Yu | e110d25 | 2022-05-05 10:19:22 +0800 | [diff] [blame] | 1636 | { |
Jerry Yu | ef2b98a | 2022-05-06 16:40:05 +0800 | [diff] [blame] | 1637 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Jerry Yu | e110d25 | 2022-05-05 10:19:22 +0800 | [diff] [blame] | 1638 | mbedtls_ssl_key_set traffic_keys; |
| 1639 | mbedtls_ssl_transform *transform_handshake = NULL; |
| 1640 | mbedtls_ssl_handshake_params *handshake = ssl->handshake; |
| 1641 | |
| 1642 | /* Compute handshake secret */ |
| 1643 | ret = mbedtls_ssl_tls13_key_schedule_stage_handshake( ssl ); |
| 1644 | if( ret != 0 ) |
| 1645 | { |
| 1646 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_derive_master_secret", ret ); |
| 1647 | goto cleanup; |
| 1648 | } |
| 1649 | |
| 1650 | /* Next evolution in key schedule: Establish handshake secret and |
| 1651 | * key material. */ |
| 1652 | ret = mbedtls_ssl_tls13_generate_handshake_keys( ssl, &traffic_keys ); |
| 1653 | if( ret != 0 ) |
| 1654 | { |
| 1655 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_generate_handshake_keys", |
| 1656 | ret ); |
| 1657 | goto cleanup; |
| 1658 | } |
| 1659 | |
| 1660 | transform_handshake = mbedtls_calloc( 1, sizeof( mbedtls_ssl_transform ) ); |
| 1661 | if( transform_handshake == NULL ) |
| 1662 | { |
| 1663 | ret = MBEDTLS_ERR_SSL_ALLOC_FAILED; |
| 1664 | goto cleanup; |
| 1665 | } |
| 1666 | |
Jerry Yu | ef2b98a | 2022-05-06 16:40:05 +0800 | [diff] [blame] | 1667 | ret = mbedtls_ssl_tls13_populate_transform( |
| 1668 | transform_handshake, |
| 1669 | ssl->conf->endpoint, |
| 1670 | ssl->session_negotiate->ciphersuite, |
| 1671 | &traffic_keys, |
| 1672 | ssl ); |
Jerry Yu | e110d25 | 2022-05-05 10:19:22 +0800 | [diff] [blame] | 1673 | if( ret != 0 ) |
| 1674 | { |
| 1675 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_populate_transform", ret ); |
| 1676 | goto cleanup; |
| 1677 | } |
| 1678 | handshake->transform_handshake = transform_handshake; |
| 1679 | |
| 1680 | cleanup: |
| 1681 | mbedtls_platform_zeroize( &traffic_keys, sizeof( traffic_keys ) ); |
| 1682 | if( ret != 0 ) |
Jerry Yu | e110d25 | 2022-05-05 10:19:22 +0800 | [diff] [blame] | 1683 | mbedtls_free( transform_handshake ); |
Jerry Yu | e110d25 | 2022-05-05 10:19:22 +0800 | [diff] [blame] | 1684 | |
| 1685 | return( ret ); |
| 1686 | } |
| 1687 | |
Jerry Yu | 466dda8 | 2022-09-13 11:20:20 +0800 | [diff] [blame] | 1688 | int mbedtls_ssl_tls13_compute_resumption_master_secret( mbedtls_ssl_context *ssl ) |
Jerry Yu | ff22698 | 2022-04-16 16:52:57 +0800 | [diff] [blame] | 1689 | { |
Jerry Yu | 46bffe0 | 2022-09-13 11:25:28 +0800 | [diff] [blame] | 1690 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Jerry Yu | 49d63f8 | 2022-08-03 12:28:08 +0800 | [diff] [blame] | 1691 | mbedtls_md_type_t md_type; |
Jerry Yu | 46bffe0 | 2022-09-13 11:25:28 +0800 | [diff] [blame] | 1692 | mbedtls_ssl_handshake_params *handshake = ssl->handshake; |
| 1693 | unsigned char transcript[MBEDTLS_TLS1_3_MD_MAX_SIZE]; |
Jerry Yu | 49d63f8 | 2022-08-03 12:28:08 +0800 | [diff] [blame] | 1694 | size_t transcript_len; |
| 1695 | |
| 1696 | MBEDTLS_SSL_DEBUG_MSG( 2, |
Jerry Yu | 466dda8 | 2022-09-13 11:20:20 +0800 | [diff] [blame] | 1697 | ( "=> mbedtls_ssl_tls13_compute_resumption_master_secret" ) ); |
Jerry Yu | 49d63f8 | 2022-08-03 12:28:08 +0800 | [diff] [blame] | 1698 | |
Jerry Yu | 46bffe0 | 2022-09-13 11:25:28 +0800 | [diff] [blame] | 1699 | md_type = handshake->ciphersuite_info->mac; |
Jerry Yu | 49d63f8 | 2022-08-03 12:28:08 +0800 | [diff] [blame] | 1700 | |
| 1701 | ret = mbedtls_ssl_get_handshake_transcript( ssl, md_type, |
| 1702 | transcript, sizeof( transcript ), |
| 1703 | &transcript_len ); |
| 1704 | if( ret != 0 ) |
| 1705 | return( ret ); |
| 1706 | |
| 1707 | ret = mbedtls_ssl_tls13_derive_resumption_master_secret( |
| 1708 | mbedtls_psa_translate_md( md_type ), |
Jerry Yu | 46bffe0 | 2022-09-13 11:25:28 +0800 | [diff] [blame] | 1709 | handshake->tls13_master_secrets.app, |
Jerry Yu | 49d63f8 | 2022-08-03 12:28:08 +0800 | [diff] [blame] | 1710 | transcript, transcript_len, |
| 1711 | &ssl->session_negotiate->app_secrets ); |
| 1712 | if( ret != 0 ) |
| 1713 | return( ret ); |
| 1714 | |
Jerry Yu | ff22698 | 2022-04-16 16:52:57 +0800 | [diff] [blame] | 1715 | /* Erase master secrets */ |
Jerry Yu | 46bffe0 | 2022-09-13 11:25:28 +0800 | [diff] [blame] | 1716 | mbedtls_platform_zeroize( &handshake->tls13_master_secrets, |
| 1717 | sizeof( handshake->tls13_master_secrets ) ); |
Jerry Yu | 49d63f8 | 2022-08-03 12:28:08 +0800 | [diff] [blame] | 1718 | |
| 1719 | MBEDTLS_SSL_DEBUG_BUF( 4, "Resumption master secret", |
| 1720 | ssl->session_negotiate->app_secrets.resumption_master_secret, |
Jerry Yu | 6ee726e | 2022-09-16 16:32:27 +0800 | [diff] [blame] | 1721 | PSA_HASH_LENGTH( mbedtls_psa_translate_md( md_type ) ) ) ; |
Jerry Yu | 46bffe0 | 2022-09-13 11:25:28 +0800 | [diff] [blame] | 1722 | |
Jerry Yu | 49d63f8 | 2022-08-03 12:28:08 +0800 | [diff] [blame] | 1723 | MBEDTLS_SSL_DEBUG_MSG( 2, |
Jerry Yu | 466dda8 | 2022-09-13 11:20:20 +0800 | [diff] [blame] | 1724 | ( "<= mbedtls_ssl_tls13_compute_resumption_master_secret" ) ); |
Jerry Yu | ff22698 | 2022-04-16 16:52:57 +0800 | [diff] [blame] | 1725 | return( 0 ); |
| 1726 | } |
| 1727 | |
Jerry Yu | fd5ea04 | 2022-05-19 14:29:48 +0800 | [diff] [blame] | 1728 | int mbedtls_ssl_tls13_compute_application_transform( mbedtls_ssl_context *ssl ) |
| 1729 | { |
| 1730 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 1731 | mbedtls_ssl_key_set traffic_keys; |
| 1732 | mbedtls_ssl_transform *transform_application = NULL; |
| 1733 | |
| 1734 | ret = mbedtls_ssl_tls13_key_schedule_stage_application( ssl ); |
| 1735 | if( ret != 0 ) |
| 1736 | { |
| 1737 | MBEDTLS_SSL_DEBUG_RET( 1, |
| 1738 | "mbedtls_ssl_tls13_key_schedule_stage_application", ret ); |
| 1739 | goto cleanup; |
| 1740 | } |
| 1741 | |
| 1742 | ret = mbedtls_ssl_tls13_generate_application_keys( ssl, &traffic_keys ); |
| 1743 | if( ret != 0 ) |
| 1744 | { |
| 1745 | MBEDTLS_SSL_DEBUG_RET( 1, |
| 1746 | "mbedtls_ssl_tls13_generate_application_keys", ret ); |
| 1747 | goto cleanup; |
| 1748 | } |
| 1749 | |
| 1750 | transform_application = |
| 1751 | mbedtls_calloc( 1, sizeof( mbedtls_ssl_transform ) ); |
| 1752 | if( transform_application == NULL ) |
| 1753 | { |
| 1754 | ret = MBEDTLS_ERR_SSL_ALLOC_FAILED; |
| 1755 | goto cleanup; |
| 1756 | } |
| 1757 | |
| 1758 | ret = mbedtls_ssl_tls13_populate_transform( |
| 1759 | transform_application, |
| 1760 | ssl->conf->endpoint, |
| 1761 | ssl->session_negotiate->ciphersuite, |
| 1762 | &traffic_keys, |
| 1763 | ssl ); |
| 1764 | if( ret != 0 ) |
| 1765 | { |
| 1766 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_populate_transform", ret ); |
| 1767 | goto cleanup; |
| 1768 | } |
| 1769 | |
| 1770 | ssl->transform_application = transform_application; |
| 1771 | |
| 1772 | cleanup: |
| 1773 | |
| 1774 | mbedtls_platform_zeroize( &traffic_keys, sizeof( traffic_keys ) ); |
| 1775 | if( ret != 0 ) |
| 1776 | { |
| 1777 | mbedtls_free( transform_application ); |
| 1778 | } |
| 1779 | return( ret ); |
| 1780 | } |
| 1781 | |
Ronald Cron | 41a443a | 2022-10-04 16:38:25 +0200 | [diff] [blame] | 1782 | #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED) |
Jerry Yu | 40f3771 | 2022-07-26 16:58:57 +0800 | [diff] [blame] | 1783 | int mbedtls_ssl_tls13_export_handshake_psk( mbedtls_ssl_context *ssl, |
| 1784 | unsigned char **psk, |
| 1785 | size_t *psk_len ) |
| 1786 | { |
Jerry Yu | 40f3771 | 2022-07-26 16:58:57 +0800 | [diff] [blame] | 1787 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 1788 | psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT; |
Jerry Yu | c5a23a0 | 2022-08-25 10:51:44 +0800 | [diff] [blame] | 1789 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Jerry Yu | 40f3771 | 2022-07-26 16:58:57 +0800 | [diff] [blame] | 1790 | |
| 1791 | *psk_len = 0; |
| 1792 | *psk = NULL; |
| 1793 | |
| 1794 | if( mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) ) |
Jerry Yu | 29d9faa | 2022-08-23 17:52:45 +0800 | [diff] [blame] | 1795 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Jerry Yu | 40f3771 | 2022-07-26 16:58:57 +0800 | [diff] [blame] | 1796 | |
| 1797 | status = psa_get_key_attributes( ssl->handshake->psk_opaque, &key_attributes ); |
Jerry Yu | 6cf6b47 | 2022-08-16 14:50:28 +0800 | [diff] [blame] | 1798 | if( status != PSA_SUCCESS ) |
Jerry Yu | 40f3771 | 2022-07-26 16:58:57 +0800 | [diff] [blame] | 1799 | return( psa_ssl_status_to_mbedtls( status ) ); |
Jerry Yu | 40f3771 | 2022-07-26 16:58:57 +0800 | [diff] [blame] | 1800 | |
| 1801 | *psk_len = PSA_BITS_TO_BYTES( psa_get_key_bits( &key_attributes ) ); |
| 1802 | *psk = mbedtls_calloc( 1, *psk_len ); |
| 1803 | if( *psk == NULL ) |
Jerry Yu | 40f3771 | 2022-07-26 16:58:57 +0800 | [diff] [blame] | 1804 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
Jerry Yu | 40f3771 | 2022-07-26 16:58:57 +0800 | [diff] [blame] | 1805 | |
| 1806 | status = psa_export_key( ssl->handshake->psk_opaque, |
| 1807 | (uint8_t *)*psk, *psk_len, psk_len ); |
Jerry Yu | 6cf6b47 | 2022-08-16 14:50:28 +0800 | [diff] [blame] | 1808 | if( status != PSA_SUCCESS ) |
Jerry Yu | 40f3771 | 2022-07-26 16:58:57 +0800 | [diff] [blame] | 1809 | { |
| 1810 | mbedtls_free( (void *)*psk ); |
Jerry Yu | 5d01c05 | 2022-08-17 10:18:10 +0800 | [diff] [blame] | 1811 | *psk = NULL; |
Jerry Yu | 40f3771 | 2022-07-26 16:58:57 +0800 | [diff] [blame] | 1812 | return( psa_ssl_status_to_mbedtls( status ) ); |
| 1813 | } |
Jerry Yu | 5d01c05 | 2022-08-17 10:18:10 +0800 | [diff] [blame] | 1814 | return( 0 ); |
Jerry Yu | 40f3771 | 2022-07-26 16:58:57 +0800 | [diff] [blame] | 1815 | #else |
| 1816 | *psk = ssl->handshake->psk; |
| 1817 | *psk_len = ssl->handshake->psk_len; |
Jerry Yu | 5d01c05 | 2022-08-17 10:18:10 +0800 | [diff] [blame] | 1818 | if( *psk == NULL ) |
Jerry Yu | 29d9faa | 2022-08-23 17:52:45 +0800 | [diff] [blame] | 1819 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Jerry Yu | 5d01c05 | 2022-08-17 10:18:10 +0800 | [diff] [blame] | 1820 | return( 0 ); |
Jerry Yu | 40f3771 | 2022-07-26 16:58:57 +0800 | [diff] [blame] | 1821 | #endif /* !MBEDTLS_USE_PSA_CRYPTO */ |
Jerry Yu | 40f3771 | 2022-07-26 16:58:57 +0800 | [diff] [blame] | 1822 | } |
Ronald Cron | 41a443a | 2022-10-04 16:38:25 +0200 | [diff] [blame] | 1823 | #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */ |
Jerry Yu | 40f3771 | 2022-07-26 16:58:57 +0800 | [diff] [blame] | 1824 | |
Ronald Cron | 6f135e1 | 2021-12-08 16:57:54 +0100 | [diff] [blame] | 1825 | #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ |
Jerry Yu | 40f3771 | 2022-07-26 16:58:57 +0800 | [diff] [blame] | 1826 | |