2021-08-03 09:04:02 +00:00
|
|
|
// Copyright 2018 The Go Authors. All rights reserved.
|
|
|
|
// Use of this source code is governed by a BSD-style
|
|
|
|
// license that can be found in the LICENSE file.
|
|
|
|
|
|
|
|
package qtls
|
|
|
|
|
|
|
|
import (
|
2023-05-06 00:42:41 +00:00
|
|
|
"crypto/ecdh"
|
2021-08-03 09:04:02 +00:00
|
|
|
"crypto/hmac"
|
|
|
|
"errors"
|
2023-05-06 00:42:41 +00:00
|
|
|
"fmt"
|
2021-08-03 09:04:02 +00:00
|
|
|
"hash"
|
|
|
|
"io"
|
|
|
|
|
|
|
|
"golang.org/x/crypto/cryptobyte"
|
|
|
|
"golang.org/x/crypto/hkdf"
|
|
|
|
)
|
|
|
|
|
|
|
|
// This file contains the functions necessary to compute the TLS 1.3 key
|
|
|
|
// schedule. See RFC 8446, Section 7.
|
|
|
|
|
|
|
|
const (
|
|
|
|
resumptionBinderLabel = "res binder"
|
2023-12-04 09:49:00 +00:00
|
|
|
clientEarlyTrafficLabel = "c e traffic"
|
2021-08-03 09:04:02 +00:00
|
|
|
clientHandshakeTrafficLabel = "c hs traffic"
|
|
|
|
serverHandshakeTrafficLabel = "s hs traffic"
|
|
|
|
clientApplicationTrafficLabel = "c ap traffic"
|
|
|
|
serverApplicationTrafficLabel = "s ap traffic"
|
|
|
|
exporterLabel = "exp master"
|
|
|
|
resumptionLabel = "res master"
|
|
|
|
trafficUpdateLabel = "traffic upd"
|
|
|
|
)
|
|
|
|
|
2021-08-27 11:26:00 +00:00
|
|
|
// expandLabel implements HKDF-Expand-Label from RFC 8446, Section 7.1.
|
|
|
|
func (c *cipherSuiteTLS13) expandLabel(secret []byte, label string, context []byte, length int) []byte {
|
2021-08-03 09:04:02 +00:00
|
|
|
var hkdfLabel cryptobyte.Builder
|
|
|
|
hkdfLabel.AddUint16(uint16(length))
|
|
|
|
hkdfLabel.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) {
|
|
|
|
b.AddBytes([]byte("tls13 "))
|
|
|
|
b.AddBytes([]byte(label))
|
|
|
|
})
|
|
|
|
hkdfLabel.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) {
|
|
|
|
b.AddBytes(context)
|
|
|
|
})
|
2023-05-06 00:42:41 +00:00
|
|
|
hkdfLabelBytes, err := hkdfLabel.Bytes()
|
|
|
|
if err != nil {
|
|
|
|
// Rather than calling BytesOrPanic, we explicitly handle this error, in
|
|
|
|
// order to provide a reasonable error message. It should be basically
|
|
|
|
// impossible for this to panic, and routing errors back through the
|
|
|
|
// tree rooted in this function is quite painful. The labels are fixed
|
|
|
|
// size, and the context is either a fixed-length computed hash, or
|
|
|
|
// parsed from a field which has the same length limitation. As such, an
|
|
|
|
// error here is likely to only be caused during development.
|
|
|
|
//
|
|
|
|
// NOTE: another reasonable approach here might be to return a
|
|
|
|
// randomized slice if we encounter an error, which would break the
|
|
|
|
// connection, but avoid panicking. This would perhaps be safer but
|
|
|
|
// significantly more confusing to users.
|
|
|
|
panic(fmt.Errorf("failed to construct HKDF label: %s", err))
|
|
|
|
}
|
2021-08-03 09:04:02 +00:00
|
|
|
out := make([]byte, length)
|
2023-05-06 00:42:41 +00:00
|
|
|
n, err := hkdf.Expand(c.hash.New, secret, hkdfLabelBytes).Read(out)
|
2021-08-03 09:04:02 +00:00
|
|
|
if err != nil || n != length {
|
|
|
|
panic("tls: HKDF-Expand-Label invocation failed unexpectedly")
|
|
|
|
}
|
|
|
|
return out
|
|
|
|
}
|
|
|
|
|
|
|
|
// deriveSecret implements Derive-Secret from RFC 8446, Section 7.1.
|
|
|
|
func (c *cipherSuiteTLS13) deriveSecret(secret []byte, label string, transcript hash.Hash) []byte {
|
|
|
|
if transcript == nil {
|
|
|
|
transcript = c.hash.New()
|
|
|
|
}
|
|
|
|
return c.expandLabel(secret, label, transcript.Sum(nil), c.hash.Size())
|
|
|
|
}
|
|
|
|
|
|
|
|
// extract implements HKDF-Extract with the cipher suite hash.
|
|
|
|
func (c *cipherSuiteTLS13) extract(newSecret, currentSecret []byte) []byte {
|
2021-08-27 11:26:00 +00:00
|
|
|
if newSecret == nil {
|
|
|
|
newSecret = make([]byte, c.hash.Size())
|
|
|
|
}
|
|
|
|
return hkdf.Extract(c.hash.New, newSecret, currentSecret)
|
2021-08-03 09:04:02 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// nextTrafficSecret generates the next traffic secret, given the current one,
|
|
|
|
// according to RFC 8446, Section 7.2.
|
|
|
|
func (c *cipherSuiteTLS13) nextTrafficSecret(trafficSecret []byte) []byte {
|
|
|
|
return c.expandLabel(trafficSecret, trafficUpdateLabel, nil, c.hash.Size())
|
|
|
|
}
|
|
|
|
|
|
|
|
// trafficKey generates traffic keys according to RFC 8446, Section 7.3.
|
|
|
|
func (c *cipherSuiteTLS13) trafficKey(trafficSecret []byte) (key, iv []byte) {
|
|
|
|
key = c.expandLabel(trafficSecret, "key", nil, c.keyLen)
|
|
|
|
iv = c.expandLabel(trafficSecret, "iv", nil, aeadNonceLength)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// finishedHash generates the Finished verify_data or PskBinderEntry according
|
|
|
|
// to RFC 8446, Section 4.4.4. See sections 4.4 and 4.2.11.2 for the baseKey
|
|
|
|
// selection.
|
|
|
|
func (c *cipherSuiteTLS13) finishedHash(baseKey []byte, transcript hash.Hash) []byte {
|
|
|
|
finishedKey := c.expandLabel(baseKey, "finished", nil, c.hash.Size())
|
|
|
|
verifyData := hmac.New(c.hash.New, finishedKey)
|
|
|
|
verifyData.Write(transcript.Sum(nil))
|
|
|
|
return verifyData.Sum(nil)
|
|
|
|
}
|
|
|
|
|
|
|
|
// exportKeyingMaterial implements RFC5705 exporters for TLS 1.3 according to
|
|
|
|
// RFC 8446, Section 7.5.
|
|
|
|
func (c *cipherSuiteTLS13) exportKeyingMaterial(masterSecret []byte, transcript hash.Hash) func(string, []byte, int) ([]byte, error) {
|
|
|
|
expMasterSecret := c.deriveSecret(masterSecret, exporterLabel, transcript)
|
|
|
|
return func(label string, context []byte, length int) ([]byte, error) {
|
|
|
|
secret := c.deriveSecret(expMasterSecret, label, nil)
|
|
|
|
h := c.hash.New()
|
|
|
|
h.Write(context)
|
|
|
|
return c.expandLabel(secret, "exporter", h.Sum(nil), length), nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-05-06 00:42:41 +00:00
|
|
|
// generateECDHEKey returns a PrivateKey that implements Diffie-Hellman
|
2021-08-03 09:04:02 +00:00
|
|
|
// according to RFC 8446, Section 4.2.8.2.
|
2023-05-06 00:42:41 +00:00
|
|
|
func generateECDHEKey(rand io.Reader, curveID CurveID) (*ecdh.PrivateKey, error) {
|
2021-08-03 09:04:02 +00:00
|
|
|
curve, ok := curveForCurveID(curveID)
|
|
|
|
if !ok {
|
|
|
|
return nil, errors.New("tls: internal error: unsupported curve")
|
|
|
|
}
|
|
|
|
|
2023-05-06 00:42:41 +00:00
|
|
|
return curve.GenerateKey(rand)
|
2021-08-03 09:04:02 +00:00
|
|
|
}
|
|
|
|
|
2023-05-06 00:42:41 +00:00
|
|
|
func curveForCurveID(id CurveID) (ecdh.Curve, bool) {
|
2021-08-03 09:04:02 +00:00
|
|
|
switch id {
|
2023-05-06 00:42:41 +00:00
|
|
|
case X25519:
|
|
|
|
return ecdh.X25519(), true
|
2021-08-03 09:04:02 +00:00
|
|
|
case CurveP256:
|
2023-05-06 00:42:41 +00:00
|
|
|
return ecdh.P256(), true
|
2021-08-03 09:04:02 +00:00
|
|
|
case CurveP384:
|
2023-05-06 00:42:41 +00:00
|
|
|
return ecdh.P384(), true
|
2021-08-03 09:04:02 +00:00
|
|
|
case CurveP521:
|
2023-05-06 00:42:41 +00:00
|
|
|
return ecdh.P521(), true
|
2021-08-03 09:04:02 +00:00
|
|
|
default:
|
|
|
|
return nil, false
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-05-06 00:42:41 +00:00
|
|
|
func curveIDForCurve(curve ecdh.Curve) (CurveID, bool) {
|
|
|
|
switch curve {
|
|
|
|
case ecdh.X25519():
|
|
|
|
return X25519, true
|
|
|
|
case ecdh.P256():
|
|
|
|
return CurveP256, true
|
|
|
|
case ecdh.P384():
|
|
|
|
return CurveP384, true
|
|
|
|
case ecdh.P521():
|
|
|
|
return CurveP521, true
|
|
|
|
default:
|
|
|
|
return 0, false
|
2021-08-03 09:04:02 +00:00
|
|
|
}
|
|
|
|
}
|