1 // Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
2 // Copyright 2005 Nokia. All rights reserved.
3 //
4 // Licensed under the Apache License, Version 2.0 (the "License");
5 // you may not use this file except in compliance with the License.
6 // You may obtain a copy of the License at
7 //
8 // https://www.apache.org/licenses/LICENSE-2.0
9 //
10 // Unless required by applicable law or agreed to in writing, software
11 // distributed under the License is distributed on an "AS IS" BASIS,
12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 // See the License for the specific language governing permissions and
14 // limitations under the License.
15
16 #include <openssl/ssl.h>
17
18 #include <assert.h>
19 #include <string.h>
20
21 #include <string_view>
22 #include <utility>
23
24 #include <openssl/err.h>
25 #include <openssl/evp.h>
26 #include <openssl/hmac.h>
27 #include <openssl/md5.h>
28 #include <openssl/mem.h>
29 #include <openssl/nid.h>
30 #include <openssl/rand.h>
31
32 #include "../crypto/fipsmodule/tls/internal.h"
33 #include "../crypto/internal.h"
34 #include "internal.h"
35
36
37 BSSL_NAMESPACE_BEGIN
38
tls1_prf(const EVP_MD * digest,Span<uint8_t> out,Span<const uint8_t> secret,std::string_view label,Span<const uint8_t> seed1,Span<const uint8_t> seed2)39 bool tls1_prf(const EVP_MD *digest, Span<uint8_t> out,
40 Span<const uint8_t> secret, std::string_view label,
41 Span<const uint8_t> seed1, Span<const uint8_t> seed2) {
42 return 1 == CRYPTO_tls1_prf(digest, out.data(), out.size(), secret.data(),
43 secret.size(), label.data(), label.size(),
44 seed1.data(), seed1.size(), seed2.data(),
45 seed2.size());
46 }
47
get_key_block_lengths(const SSL * ssl,size_t * out_mac_secret_len,size_t * out_key_len,size_t * out_iv_len,const SSL_CIPHER * cipher)48 static bool get_key_block_lengths(const SSL *ssl, size_t *out_mac_secret_len,
49 size_t *out_key_len, size_t *out_iv_len,
50 const SSL_CIPHER *cipher) {
51 const EVP_AEAD *aead = NULL;
52 if (!ssl_cipher_get_evp_aead(&aead, out_mac_secret_len, out_iv_len, cipher,
53 ssl_protocol_version(ssl))) {
54 OPENSSL_PUT_ERROR(SSL, SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
55 return false;
56 }
57
58 *out_key_len = EVP_AEAD_key_length(aead);
59 if (*out_mac_secret_len > 0) {
60 // For "stateful" AEADs (i.e. compatibility with pre-AEAD cipher suites) the
61 // key length reported by |EVP_AEAD_key_length| will include the MAC key
62 // bytes and initial implicit IV.
63 if (*out_key_len < *out_mac_secret_len + *out_iv_len) {
64 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
65 return false;
66 }
67 *out_key_len -= *out_mac_secret_len + *out_iv_len;
68 }
69
70 return true;
71 }
72
generate_key_block(const SSL * ssl,Span<uint8_t> out,const SSL_SESSION * session)73 static bool generate_key_block(const SSL *ssl, Span<uint8_t> out,
74 const SSL_SESSION *session) {
75 const EVP_MD *digest = ssl_session_get_digest(session);
76 // Note this function assumes that |session|'s key material corresponds to
77 // |ssl->s3->client_random| and |ssl->s3->server_random|.
78 return tls1_prf(digest, out, session->secret, "key expansion",
79 ssl->s3->server_random, ssl->s3->client_random);
80 }
81
tls1_configure_aead(SSL * ssl,evp_aead_direction_t direction,Array<uint8_t> * key_block_cache,const SSL_SESSION * session,Span<const uint8_t> iv_override)82 bool tls1_configure_aead(SSL *ssl, evp_aead_direction_t direction,
83 Array<uint8_t> *key_block_cache,
84 const SSL_SESSION *session,
85 Span<const uint8_t> iv_override) {
86 size_t mac_secret_len, key_len, iv_len;
87 if (!get_key_block_lengths(ssl, &mac_secret_len, &key_len, &iv_len,
88 session->cipher)) {
89 return false;
90 }
91
92 // Ensure that |key_block_cache| is set up.
93 const size_t key_block_size = 2 * (mac_secret_len + key_len + iv_len);
94 if (key_block_cache->empty()) {
95 if (!key_block_cache->InitForOverwrite(key_block_size) ||
96 !generate_key_block(ssl, Span(*key_block_cache), session)) {
97 return false;
98 }
99 }
100 assert(key_block_cache->size() == key_block_size);
101
102 Span<const uint8_t> key_block = *key_block_cache;
103 Span<const uint8_t> mac_secret, key, iv;
104 if (direction == (ssl->server ? evp_aead_open : evp_aead_seal)) {
105 // Use the client write (server read) keys.
106 mac_secret = key_block.subspan(0, mac_secret_len);
107 key = key_block.subspan(2 * mac_secret_len, key_len);
108 iv = key_block.subspan(2 * mac_secret_len + 2 * key_len, iv_len);
109 } else {
110 // Use the server write (client read) keys.
111 mac_secret = key_block.subspan(mac_secret_len, mac_secret_len);
112 key = key_block.subspan(2 * mac_secret_len + key_len, key_len);
113 iv = key_block.subspan(2 * mac_secret_len + 2 * key_len + iv_len, iv_len);
114 }
115
116 if (!iv_override.empty()) {
117 if (iv_override.size() != iv_len) {
118 return false;
119 }
120 iv = iv_override;
121 }
122
123 UniquePtr<SSLAEADContext> aead_ctx = SSLAEADContext::Create(
124 direction, ssl->s3->version, session->cipher, key, mac_secret, iv);
125 if (!aead_ctx) {
126 return false;
127 }
128
129 if (direction == evp_aead_open) {
130 return ssl->method->set_read_state(ssl, ssl_encryption_application,
131 std::move(aead_ctx),
132 /*traffic_secret=*/{});
133 }
134
135 return ssl->method->set_write_state(ssl, ssl_encryption_application,
136 std::move(aead_ctx),
137 /*traffic_secret=*/{});
138 }
139
tls1_change_cipher_state(SSL_HANDSHAKE * hs,evp_aead_direction_t direction)140 bool tls1_change_cipher_state(SSL_HANDSHAKE *hs,
141 evp_aead_direction_t direction) {
142 return tls1_configure_aead(hs->ssl, direction, &hs->key_block,
143 ssl_handshake_session(hs), {});
144 }
145
tls1_generate_master_secret(SSL_HANDSHAKE * hs,Span<uint8_t> out,Span<const uint8_t> premaster)146 bool tls1_generate_master_secret(SSL_HANDSHAKE *hs, Span<uint8_t> out,
147 Span<const uint8_t> premaster) {
148 BSSL_CHECK(out.size() == SSL3_MASTER_SECRET_SIZE);
149
150 const SSL *ssl = hs->ssl;
151 if (hs->extended_master_secret) {
152 uint8_t digests[EVP_MAX_MD_SIZE];
153 size_t digests_len;
154 if (!hs->transcript.GetHash(digests, &digests_len) ||
155 !tls1_prf(hs->transcript.Digest(), out, premaster,
156 "extended master secret", Span(digests, digests_len), {})) {
157 return false;
158 }
159 } else {
160 if (!tls1_prf(hs->transcript.Digest(), out, premaster, "master secret",
161 ssl->s3->client_random, ssl->s3->server_random)) {
162 return false;
163 }
164 }
165
166 return true;
167 }
168
169 BSSL_NAMESPACE_END
170
171 using namespace bssl;
172
SSL_get_key_block_len(const SSL * ssl)173 size_t SSL_get_key_block_len(const SSL *ssl) {
174 // See |SSL_generate_key_block|.
175 if (SSL_in_init(ssl) || ssl_protocol_version(ssl) > TLS1_2_VERSION) {
176 return 0;
177 }
178
179 size_t mac_secret_len, key_len, fixed_iv_len;
180 if (!get_key_block_lengths(ssl, &mac_secret_len, &key_len, &fixed_iv_len,
181 SSL_get_current_cipher(ssl))) {
182 ERR_clear_error();
183 return 0;
184 }
185
186 return 2 * (mac_secret_len + key_len + fixed_iv_len);
187 }
188
SSL_generate_key_block(const SSL * ssl,uint8_t * out,size_t out_len)189 int SSL_generate_key_block(const SSL *ssl, uint8_t *out, size_t out_len) {
190 // Which cipher state to use is ambiguous during a handshake. In particular,
191 // there are points where read and write states are from different epochs.
192 // During a handshake, before ChangeCipherSpec, the encryption states may not
193 // match |ssl->s3->client_random| and |ssl->s3->server_random|.
194 if (SSL_in_init(ssl) || ssl_protocol_version(ssl) > TLS1_2_VERSION) {
195 OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
196 return 0;
197 }
198
199 return generate_key_block(ssl, Span(out, out_len), SSL_get_session(ssl));
200 }
201
SSL_export_keying_material(const SSL * ssl,uint8_t * out,size_t out_len,const char * label,size_t label_len,const uint8_t * context,size_t context_len,int use_context)202 int SSL_export_keying_material(const SSL *ssl, uint8_t *out, size_t out_len,
203 const char *label, size_t label_len,
204 const uint8_t *context, size_t context_len,
205 int use_context) {
206 auto out_span = Span(out, out_len);
207 std::string_view label_sv(label, label_len);
208 // In TLS 1.3, the exporter may be used whenever the secret has been derived.
209 if (ssl->s3->version != 0 && ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
210 if (ssl->s3->exporter_secret.empty()) {
211 OPENSSL_PUT_ERROR(SSL, SSL_R_HANDSHAKE_NOT_COMPLETE);
212 return 0;
213 }
214 if (!use_context) {
215 context = nullptr;
216 context_len = 0;
217 }
218 return tls13_export_keying_material(ssl, out_span, ssl->s3->exporter_secret,
219 label_sv, Span(context, context_len));
220 }
221
222 // Exporters may be used in False Start, where the handshake has progressed
223 // enough. Otherwise, they may not be used during a handshake.
224 if (SSL_in_init(ssl) && !SSL_in_false_start(ssl)) {
225 OPENSSL_PUT_ERROR(SSL, SSL_R_HANDSHAKE_NOT_COMPLETE);
226 return 0;
227 }
228
229 size_t seed_len = 2 * SSL3_RANDOM_SIZE;
230 if (use_context) {
231 if (context_len >= 1u << 16) {
232 OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW);
233 return 0;
234 }
235 seed_len += 2 + context_len;
236 }
237 Array<uint8_t> seed;
238 if (!seed.InitForOverwrite(seed_len)) {
239 return 0;
240 }
241
242 OPENSSL_memcpy(seed.data(), ssl->s3->client_random, SSL3_RANDOM_SIZE);
243 OPENSSL_memcpy(seed.data() + SSL3_RANDOM_SIZE, ssl->s3->server_random,
244 SSL3_RANDOM_SIZE);
245 if (use_context) {
246 seed[2 * SSL3_RANDOM_SIZE] = static_cast<uint8_t>(context_len >> 8);
247 seed[2 * SSL3_RANDOM_SIZE + 1] = static_cast<uint8_t>(context_len);
248 OPENSSL_memcpy(seed.data() + 2 * SSL3_RANDOM_SIZE + 2, context,
249 context_len);
250 }
251
252 const SSL_SESSION *session = SSL_get_session(ssl);
253 const EVP_MD *digest = ssl_session_get_digest(session);
254 return tls1_prf(digest, out_span, session->secret, label_sv, seed, {});
255 }
256