1 /* $OpenBSD: tls12_key_schedule.c,v 1.1 2021/05/05 10:05:27 jsing Exp $ */
2 /*
3 * Copyright (c) 2021 Joel Sing <jsing@openbsd.org>
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18 #include <stdlib.h>
19
20 #include <openssl/evp.h>
21
22 #include "bytestring.h"
23 #include "ssl_locl.h"
24
25 struct tls12_key_block {
26 CBS client_write_mac_key;
27 CBS server_write_mac_key;
28 CBS client_write_key;
29 CBS server_write_key;
30 CBS client_write_iv;
31 CBS server_write_iv;
32
33 uint8_t *key_block;
34 size_t key_block_len;
35 };
36
37 struct tls12_key_block *
tls12_key_block_new(void)38 tls12_key_block_new(void)
39 {
40 return calloc(1, sizeof(struct tls12_key_block));
41 }
42
43 static void
tls12_key_block_clear(struct tls12_key_block * kb)44 tls12_key_block_clear(struct tls12_key_block *kb)
45 {
46 CBS_init(&kb->client_write_mac_key, NULL, 0);
47 CBS_init(&kb->server_write_mac_key, NULL, 0);
48 CBS_init(&kb->client_write_key, NULL, 0);
49 CBS_init(&kb->server_write_key, NULL, 0);
50 CBS_init(&kb->client_write_iv, NULL, 0);
51 CBS_init(&kb->server_write_iv, NULL, 0);
52
53 freezero(kb->key_block, kb->key_block_len);
54 kb->key_block = NULL;
55 kb->key_block_len = 0;
56 }
57
58 void
tls12_key_block_free(struct tls12_key_block * kb)59 tls12_key_block_free(struct tls12_key_block *kb)
60 {
61 if (kb == NULL)
62 return;
63
64 tls12_key_block_clear(kb);
65
66 freezero(kb, sizeof(struct tls12_key_block));
67 }
68
69 void
tls12_key_block_client_write(struct tls12_key_block * kb,CBS * mac_key,CBS * key,CBS * iv)70 tls12_key_block_client_write(struct tls12_key_block *kb, CBS *mac_key,
71 CBS *key, CBS *iv)
72 {
73 CBS_dup(&kb->client_write_mac_key, mac_key);
74 CBS_dup(&kb->client_write_key, key);
75 CBS_dup(&kb->client_write_iv, iv);
76 }
77
78 void
tls12_key_block_server_write(struct tls12_key_block * kb,CBS * mac_key,CBS * key,CBS * iv)79 tls12_key_block_server_write(struct tls12_key_block *kb, CBS *mac_key,
80 CBS *key, CBS *iv)
81 {
82 CBS_dup(&kb->server_write_mac_key, mac_key);
83 CBS_dup(&kb->server_write_key, key);
84 CBS_dup(&kb->server_write_iv, iv);
85 }
86
87 int
tls12_key_block_generate(struct tls12_key_block * kb,SSL * s,const EVP_AEAD * aead,const EVP_CIPHER * cipher,const EVP_MD * mac_hash)88 tls12_key_block_generate(struct tls12_key_block *kb, SSL *s,
89 const EVP_AEAD *aead, const EVP_CIPHER *cipher, const EVP_MD *mac_hash)
90 {
91 size_t mac_key_len = 0, key_len = 0, iv_len = 0;
92 uint8_t *key_block = NULL;
93 size_t key_block_len = 0;
94 CBS cbs;
95
96 /*
97 * Generate a TLSv1.2 key block and partition into individual secrets,
98 * as per RFC 5246 section 6.3.
99 */
100
101 tls12_key_block_clear(kb);
102
103 /* Must have AEAD or cipher/MAC pair. */
104 if (aead == NULL && (cipher == NULL || mac_hash == NULL))
105 goto err;
106
107 if (aead != NULL) {
108 key_len = EVP_AEAD_key_length(aead);
109
110 /* AEAD fixed nonce length. */
111 if (aead == EVP_aead_aes_128_gcm() ||
112 aead == EVP_aead_aes_256_gcm())
113 iv_len = 4;
114 else if (aead == EVP_aead_chacha20_poly1305())
115 iv_len = 12;
116 else
117 goto err;
118 } else if (cipher != NULL && mac_hash != NULL) {
119 /*
120 * A negative integer return value will be detected via the
121 * EVP_MAX_* checks against the size_t variables below.
122 */
123 mac_key_len = EVP_MD_size(mac_hash);
124 key_len = EVP_CIPHER_key_length(cipher);
125 iv_len = EVP_CIPHER_iv_length(cipher);
126
127 /* Special handling for GOST... */
128 if (EVP_MD_type(mac_hash) == NID_id_Gost28147_89_MAC)
129 mac_key_len = 32;
130 }
131
132 if (mac_key_len > EVP_MAX_MD_SIZE)
133 goto err;
134 if (key_len > EVP_MAX_KEY_LENGTH)
135 goto err;
136 if (iv_len > EVP_MAX_IV_LENGTH)
137 goto err;
138
139 key_block_len = 2 * mac_key_len + 2 * key_len + 2 * iv_len;
140 if ((key_block = calloc(1, key_block_len)) == NULL)
141 goto err;
142
143 if (!tls1_generate_key_block(s, key_block, key_block_len))
144 goto err;
145
146 kb->key_block = key_block;
147 kb->key_block_len = key_block_len;
148 key_block = NULL;
149 key_block_len = 0;
150
151 /* Partition key block into individual secrets. */
152 CBS_init(&cbs, kb->key_block, kb->key_block_len);
153 if (!CBS_get_bytes(&cbs, &kb->client_write_mac_key, mac_key_len))
154 goto err;
155 if (!CBS_get_bytes(&cbs, &kb->server_write_mac_key, mac_key_len))
156 goto err;
157 if (!CBS_get_bytes(&cbs, &kb->client_write_key, key_len))
158 goto err;
159 if (!CBS_get_bytes(&cbs, &kb->server_write_key, key_len))
160 goto err;
161 if (!CBS_get_bytes(&cbs, &kb->client_write_iv, iv_len))
162 goto err;
163 if (!CBS_get_bytes(&cbs, &kb->server_write_iv, iv_len))
164 goto err;
165 if (CBS_len(&cbs) != 0)
166 goto err;
167
168 return 1;
169
170 err:
171 tls12_key_block_clear(kb);
172 freezero(key_block, key_block_len);
173
174 return 0;
175 }
176