A local copy of OpenSSL from GitHub
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

406 lines
14 KiB

  1. /*
  2. * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * Refer to "The TLS Protocol Version 1.0" Section 5
  11. * (https://tools.ietf.org/html/rfc2246#section-5) and
  12. * "The Transport Layer Security (TLS) Protocol Version 1.2" Section 5
  13. * (https://tools.ietf.org/html/rfc5246#section-5).
  14. *
  15. * For TLS v1.0 and TLS v1.1 the TLS PRF algorithm is given by:
  16. *
  17. * PRF(secret, label, seed) = P_MD5(S1, label + seed) XOR
  18. * P_SHA-1(S2, label + seed)
  19. *
  20. * where P_MD5 and P_SHA-1 are defined by P_<hash>, below, and S1 and S2 are
  21. * two halves of the secret (with the possibility of one shared byte, in the
  22. * case where the length of the original secret is odd). S1 is taken from the
  23. * first half of the secret, S2 from the second half.
  24. *
  25. * For TLS v1.2 the TLS PRF algorithm is given by:
  26. *
  27. * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
  28. *
  29. * where hash is SHA-256 for all cipher suites defined in RFC 5246 as well as
  30. * those published prior to TLS v1.2 while the TLS v1.2 protocol is in effect,
  31. * unless defined otherwise by the cipher suite.
  32. *
  33. * P_<hash> is an expansion function that uses a single hash function to expand
  34. * a secret and seed into an arbitrary quantity of output:
  35. *
  36. * P_<hash>(secret, seed) = HMAC_<hash>(secret, A(1) + seed) +
  37. * HMAC_<hash>(secret, A(2) + seed) +
  38. * HMAC_<hash>(secret, A(3) + seed) + ...
  39. *
  40. * where + indicates concatenation. P_<hash> can be iterated as many times as
  41. * is necessary to produce the required quantity of data.
  42. *
  43. * A(i) is defined as:
  44. * A(0) = seed
  45. * A(i) = HMAC_<hash>(secret, A(i-1))
  46. */
  47. #include <stdio.h>
  48. #include <stdarg.h>
  49. #include <string.h>
  50. #include <openssl/evp.h>
  51. #include <openssl/kdf.h>
  52. #include <openssl/core_names.h>
  53. #include <openssl/params.h>
  54. #include <openssl/proverr.h>
  55. #include "internal/cryptlib.h"
  56. #include "internal/numbers.h"
  57. #include "crypto/evp.h"
  58. #include "prov/provider_ctx.h"
  59. #include "prov/providercommon.h"
  60. #include "prov/implementations.h"
  61. #include "prov/provider_util.h"
  62. #include "e_os.h"
  63. static OSSL_FUNC_kdf_newctx_fn kdf_tls1_prf_new;
  64. static OSSL_FUNC_kdf_freectx_fn kdf_tls1_prf_free;
  65. static OSSL_FUNC_kdf_reset_fn kdf_tls1_prf_reset;
  66. static OSSL_FUNC_kdf_derive_fn kdf_tls1_prf_derive;
  67. static OSSL_FUNC_kdf_settable_ctx_params_fn kdf_tls1_prf_settable_ctx_params;
  68. static OSSL_FUNC_kdf_set_ctx_params_fn kdf_tls1_prf_set_ctx_params;
  69. static OSSL_FUNC_kdf_gettable_ctx_params_fn kdf_tls1_prf_gettable_ctx_params;
  70. static OSSL_FUNC_kdf_get_ctx_params_fn kdf_tls1_prf_get_ctx_params;
  71. static int tls1_prf_alg(EVP_MAC_CTX *mdctx, EVP_MAC_CTX *sha1ctx,
  72. const unsigned char *sec, size_t slen,
  73. const unsigned char *seed, size_t seed_len,
  74. unsigned char *out, size_t olen);
  75. #define TLS1_PRF_MAXBUF 1024
  76. /* TLS KDF kdf context structure */
  77. typedef struct {
  78. void *provctx;
  79. /* MAC context for the main digest */
  80. EVP_MAC_CTX *P_hash;
  81. /* MAC context for SHA1 for the MD5/SHA-1 combined PRF */
  82. EVP_MAC_CTX *P_sha1;
  83. /* Secret value to use for PRF */
  84. unsigned char *sec;
  85. size_t seclen;
  86. /* Buffer of concatenated seed data */
  87. unsigned char seed[TLS1_PRF_MAXBUF];
  88. size_t seedlen;
  89. } TLS1_PRF;
  90. static void *kdf_tls1_prf_new(void *provctx)
  91. {
  92. TLS1_PRF *ctx;
  93. if (!ossl_prov_is_running())
  94. return NULL;
  95. if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL)
  96. ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
  97. ctx->provctx = provctx;
  98. return ctx;
  99. }
  100. static void kdf_tls1_prf_free(void *vctx)
  101. {
  102. TLS1_PRF *ctx = (TLS1_PRF *)vctx;
  103. if (ctx != NULL) {
  104. kdf_tls1_prf_reset(ctx);
  105. OPENSSL_free(ctx);
  106. }
  107. }
  108. static void kdf_tls1_prf_reset(void *vctx)
  109. {
  110. TLS1_PRF *ctx = (TLS1_PRF *)vctx;
  111. void *provctx = ctx->provctx;
  112. EVP_MAC_CTX_free(ctx->P_hash);
  113. EVP_MAC_CTX_free(ctx->P_sha1);
  114. OPENSSL_clear_free(ctx->sec, ctx->seclen);
  115. OPENSSL_cleanse(ctx->seed, ctx->seedlen);
  116. memset(ctx, 0, sizeof(*ctx));
  117. ctx->provctx = provctx;
  118. }
  119. static int kdf_tls1_prf_derive(void *vctx, unsigned char *key, size_t keylen,
  120. const OSSL_PARAM params[])
  121. {
  122. TLS1_PRF *ctx = (TLS1_PRF *)vctx;
  123. if (!ossl_prov_is_running() || !kdf_tls1_prf_set_ctx_params(ctx, params))
  124. return 0;
  125. if (ctx->P_hash == NULL) {
  126. ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST);
  127. return 0;
  128. }
  129. if (ctx->sec == NULL) {
  130. ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_SECRET);
  131. return 0;
  132. }
  133. if (ctx->seedlen == 0) {
  134. ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_SEED);
  135. return 0;
  136. }
  137. if (keylen == 0) {
  138. ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
  139. return 0;
  140. }
  141. return tls1_prf_alg(ctx->P_hash, ctx->P_sha1,
  142. ctx->sec, ctx->seclen,
  143. ctx->seed, ctx->seedlen,
  144. key, keylen);
  145. }
  146. static int kdf_tls1_prf_set_ctx_params(void *vctx, const OSSL_PARAM params[])
  147. {
  148. const OSSL_PARAM *p;
  149. TLS1_PRF *ctx = vctx;
  150. OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
  151. if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_DIGEST)) != NULL) {
  152. if (strcasecmp(p->data, SN_md5_sha1) == 0) {
  153. if (!ossl_prov_macctx_load_from_params(&ctx->P_hash, params,
  154. OSSL_MAC_NAME_HMAC,
  155. NULL, SN_md5, libctx)
  156. || !ossl_prov_macctx_load_from_params(&ctx->P_sha1, params,
  157. OSSL_MAC_NAME_HMAC,
  158. NULL, SN_sha1, libctx))
  159. return 0;
  160. } else {
  161. EVP_MAC_CTX_free(ctx->P_sha1);
  162. if (!ossl_prov_macctx_load_from_params(&ctx->P_hash, params,
  163. OSSL_MAC_NAME_HMAC,
  164. NULL, NULL, libctx))
  165. return 0;
  166. }
  167. }
  168. if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_SECRET)) != NULL) {
  169. OPENSSL_clear_free(ctx->sec, ctx->seclen);
  170. ctx->sec = NULL;
  171. if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->sec, 0, &ctx->seclen))
  172. return 0;
  173. }
  174. /* The seed fields concatenate, so process them all */
  175. if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_SEED)) != NULL) {
  176. for (; p != NULL; p = OSSL_PARAM_locate_const(p + 1,
  177. OSSL_KDF_PARAM_SEED)) {
  178. const void *q = ctx->seed + ctx->seedlen;
  179. size_t sz = 0;
  180. if (p->data_size != 0
  181. && p->data != NULL
  182. && !OSSL_PARAM_get_octet_string(p, (void **)&q,
  183. TLS1_PRF_MAXBUF - ctx->seedlen,
  184. &sz))
  185. return 0;
  186. ctx->seedlen += sz;
  187. }
  188. }
  189. return 1;
  190. }
  191. static const OSSL_PARAM *kdf_tls1_prf_settable_ctx_params(
  192. ossl_unused void *ctx, ossl_unused void *provctx)
  193. {
  194. static const OSSL_PARAM known_settable_ctx_params[] = {
  195. OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_PROPERTIES, NULL, 0),
  196. OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_DIGEST, NULL, 0),
  197. OSSL_PARAM_octet_string(OSSL_KDF_PARAM_SECRET, NULL, 0),
  198. OSSL_PARAM_octet_string(OSSL_KDF_PARAM_SEED, NULL, 0),
  199. OSSL_PARAM_END
  200. };
  201. return known_settable_ctx_params;
  202. }
  203. static int kdf_tls1_prf_get_ctx_params(void *vctx, OSSL_PARAM params[])
  204. {
  205. OSSL_PARAM *p;
  206. if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_SIZE)) != NULL)
  207. return OSSL_PARAM_set_size_t(p, SIZE_MAX);
  208. return -2;
  209. }
  210. static const OSSL_PARAM *kdf_tls1_prf_gettable_ctx_params(
  211. ossl_unused void *ctx, ossl_unused void *provctx)
  212. {
  213. static const OSSL_PARAM known_gettable_ctx_params[] = {
  214. OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL),
  215. OSSL_PARAM_END
  216. };
  217. return known_gettable_ctx_params;
  218. }
  219. const OSSL_DISPATCH ossl_kdf_tls1_prf_functions[] = {
  220. { OSSL_FUNC_KDF_NEWCTX, (void(*)(void))kdf_tls1_prf_new },
  221. { OSSL_FUNC_KDF_FREECTX, (void(*)(void))kdf_tls1_prf_free },
  222. { OSSL_FUNC_KDF_RESET, (void(*)(void))kdf_tls1_prf_reset },
  223. { OSSL_FUNC_KDF_DERIVE, (void(*)(void))kdf_tls1_prf_derive },
  224. { OSSL_FUNC_KDF_SETTABLE_CTX_PARAMS,
  225. (void(*)(void))kdf_tls1_prf_settable_ctx_params },
  226. { OSSL_FUNC_KDF_SET_CTX_PARAMS,
  227. (void(*)(void))kdf_tls1_prf_set_ctx_params },
  228. { OSSL_FUNC_KDF_GETTABLE_CTX_PARAMS,
  229. (void(*)(void))kdf_tls1_prf_gettable_ctx_params },
  230. { OSSL_FUNC_KDF_GET_CTX_PARAMS,
  231. (void(*)(void))kdf_tls1_prf_get_ctx_params },
  232. { 0, NULL }
  233. };
  234. /*
  235. * Refer to "The TLS Protocol Version 1.0" Section 5
  236. * (https://tools.ietf.org/html/rfc2246#section-5) and
  237. * "The Transport Layer Security (TLS) Protocol Version 1.2" Section 5
  238. * (https://tools.ietf.org/html/rfc5246#section-5).
  239. *
  240. * P_<hash> is an expansion function that uses a single hash function to expand
  241. * a secret and seed into an arbitrary quantity of output:
  242. *
  243. * P_<hash>(secret, seed) = HMAC_<hash>(secret, A(1) + seed) +
  244. * HMAC_<hash>(secret, A(2) + seed) +
  245. * HMAC_<hash>(secret, A(3) + seed) + ...
  246. *
  247. * where + indicates concatenation. P_<hash> can be iterated as many times as
  248. * is necessary to produce the required quantity of data.
  249. *
  250. * A(i) is defined as:
  251. * A(0) = seed
  252. * A(i) = HMAC_<hash>(secret, A(i-1))
  253. */
  254. static int tls1_prf_P_hash(EVP_MAC_CTX *ctx_init,
  255. const unsigned char *sec, size_t sec_len,
  256. const unsigned char *seed, size_t seed_len,
  257. unsigned char *out, size_t olen)
  258. {
  259. size_t chunk;
  260. EVP_MAC_CTX *ctx = NULL, *ctx_Ai = NULL;
  261. unsigned char Ai[EVP_MAX_MD_SIZE];
  262. size_t Ai_len;
  263. int ret = 0;
  264. if (!EVP_MAC_init(ctx_init, sec, sec_len, NULL))
  265. goto err;
  266. chunk = EVP_MAC_CTX_get_mac_size(ctx_init);
  267. if (chunk == 0)
  268. goto err;
  269. /* A(0) = seed */
  270. ctx_Ai = EVP_MAC_CTX_dup(ctx_init);
  271. if (ctx_Ai == NULL)
  272. goto err;
  273. if (seed != NULL && !EVP_MAC_update(ctx_Ai, seed, seed_len))
  274. goto err;
  275. for (;;) {
  276. /* calc: A(i) = HMAC_<hash>(secret, A(i-1)) */
  277. if (!EVP_MAC_final(ctx_Ai, Ai, &Ai_len, sizeof(Ai)))
  278. goto err;
  279. EVP_MAC_CTX_free(ctx_Ai);
  280. ctx_Ai = NULL;
  281. /* calc next chunk: HMAC_<hash>(secret, A(i) + seed) */
  282. ctx = EVP_MAC_CTX_dup(ctx_init);
  283. if (ctx == NULL)
  284. goto err;
  285. if (!EVP_MAC_update(ctx, Ai, Ai_len))
  286. goto err;
  287. /* save state for calculating next A(i) value */
  288. if (olen > chunk) {
  289. ctx_Ai = EVP_MAC_CTX_dup(ctx);
  290. if (ctx_Ai == NULL)
  291. goto err;
  292. }
  293. if (seed != NULL && !EVP_MAC_update(ctx, seed, seed_len))
  294. goto err;
  295. if (olen <= chunk) {
  296. /* last chunk - use Ai as temp bounce buffer */
  297. if (!EVP_MAC_final(ctx, Ai, &Ai_len, sizeof(Ai)))
  298. goto err;
  299. memcpy(out, Ai, olen);
  300. break;
  301. }
  302. if (!EVP_MAC_final(ctx, out, NULL, olen))
  303. goto err;
  304. EVP_MAC_CTX_free(ctx);
  305. ctx = NULL;
  306. out += chunk;
  307. olen -= chunk;
  308. }
  309. ret = 1;
  310. err:
  311. EVP_MAC_CTX_free(ctx);
  312. EVP_MAC_CTX_free(ctx_Ai);
  313. OPENSSL_cleanse(Ai, sizeof(Ai));
  314. return ret;
  315. }
  316. /*
  317. * Refer to "The TLS Protocol Version 1.0" Section 5
  318. * (https://tools.ietf.org/html/rfc2246#section-5) and
  319. * "The Transport Layer Security (TLS) Protocol Version 1.2" Section 5
  320. * (https://tools.ietf.org/html/rfc5246#section-5).
  321. *
  322. * For TLS v1.0 and TLS v1.1:
  323. *
  324. * PRF(secret, label, seed) = P_MD5(S1, label + seed) XOR
  325. * P_SHA-1(S2, label + seed)
  326. *
  327. * S1 is taken from the first half of the secret, S2 from the second half.
  328. *
  329. * L_S = length in bytes of secret;
  330. * L_S1 = L_S2 = ceil(L_S / 2);
  331. *
  332. * For TLS v1.2:
  333. *
  334. * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
  335. */
  336. static int tls1_prf_alg(EVP_MAC_CTX *mdctx, EVP_MAC_CTX *sha1ctx,
  337. const unsigned char *sec, size_t slen,
  338. const unsigned char *seed, size_t seed_len,
  339. unsigned char *out, size_t olen)
  340. {
  341. if (sha1ctx != NULL) {
  342. /* TLS v1.0 and TLS v1.1 */
  343. size_t i;
  344. unsigned char *tmp;
  345. /* calc: L_S1 = L_S2 = ceil(L_S / 2) */
  346. size_t L_S1 = (slen + 1) / 2;
  347. size_t L_S2 = L_S1;
  348. if (!tls1_prf_P_hash(mdctx, sec, L_S1,
  349. seed, seed_len, out, olen))
  350. return 0;
  351. if ((tmp = OPENSSL_malloc(olen)) == NULL) {
  352. ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
  353. return 0;
  354. }
  355. if (!tls1_prf_P_hash(sha1ctx, sec + slen - L_S2, L_S2,
  356. seed, seed_len, tmp, olen)) {
  357. OPENSSL_clear_free(tmp, olen);
  358. return 0;
  359. }
  360. for (i = 0; i < olen; i++)
  361. out[i] ^= tmp[i];
  362. OPENSSL_clear_free(tmp, olen);
  363. return 1;
  364. }
  365. /* TLS v1.2 */
  366. if (!tls1_prf_P_hash(mdctx, sec, slen, seed, seed_len, out, olen))
  367. return 0;
  368. return 1;
  369. }