1 /* $OpenBSD: t1_enc.c,v 1.114 2018/09/08 14:39:41 jsing Exp $ */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
58 /* ====================================================================
59 * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.
61 * Redistribution and use in source and binary forms, with or without
62 * modification, are permitted provided that the following conditions
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
68 * 2. Redistributions in binary form must reproduce the above copyright
69 * notice, this list of conditions and the following disclaimer in
70 * the documentation and/or other materials provided with the
73 * 3. All advertising materials mentioning features or use of this
74 * software must display the following acknowledgment:
75 * "This product includes software developed by the OpenSSL Project
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 * endorse or promote products derived from this software without
80 * prior written permission. For written permission, please contact
81 * openssl-core@openssl.org.
83 * 5. Products derived from this software may not be called "OpenSSL"
84 * nor may "OpenSSL" appear in their names without prior written
85 * permission of the OpenSSL Project.
87 * 6. Redistributions of any form whatsoever must retain the following
89 * "This product includes software developed by the OpenSSL Project
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 * OF THE POSSIBILITY OF SUCH DAMAGE.
104 * ====================================================================
106 * This product includes cryptographic software written by Eric Young
107 * (eay@cryptsoft.com). This product includes software written by Tim
108 * Hudson (tjh@cryptsoft.com).
111 /* ====================================================================
112 * Copyright 2005 Nokia. All rights reserved.
114 * The portions of the attached software ("Contribution") is developed by
115 * Nokia Corporation and is licensed pursuant to the OpenSSL open source
118 * The Contribution, originally written by Mika Kousa and Pasi Eronen of
119 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
120 * support (see RFC 4279) to OpenSSL.
122 * No patent licenses or other rights except those expressly stated in
123 * the OpenSSL open source license shall be deemed granted or received
124 * expressly, by implication, estoppel, or otherwise.
126 * No assurances are provided by Nokia that the Contribution does not
127 * infringe the patent or other intellectual property rights of any third
128 * party or that the license provides you with all the necessary rights
129 * to make use of the Contribution.
131 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
132 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
133 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
134 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
141 #include "ssl_locl.h"
143 #include <openssl/evp.h>
144 #include <openssl/hmac.h>
145 #include <openssl/md5.h>
147 int tls1_PRF(SSL
*s
, const unsigned char *secret
, size_t secret_len
,
148 const void *seed1
, size_t seed1_len
, const void *seed2
, size_t seed2_len
,
149 const void *seed3
, size_t seed3_len
, const void *seed4
, size_t seed4_len
,
150 const void *seed5
, size_t seed5_len
, unsigned char *out
, size_t out_len
);
153 tls1_cleanup_key_block(SSL
*s
)
155 freezero(S3I(s
)->hs
.key_block
, S3I(s
)->hs
.key_block_len
);
156 S3I(s
)->hs
.key_block
= NULL
;
157 S3I(s
)->hs
.key_block_len
= 0;
161 tls1_init_finished_mac(SSL
*s
)
163 BIO_free(S3I(s
)->handshake_buffer
);
165 S3I(s
)->handshake_buffer
= BIO_new(BIO_s_mem());
166 if (S3I(s
)->handshake_buffer
== NULL
)
169 (void)BIO_set_close(S3I(s
)->handshake_buffer
, BIO_CLOSE
);
175 tls1_finish_mac(SSL
*s
, const unsigned char *buf
, int len
)
180 if (!tls1_handshake_hash_update(s
, buf
, len
))
183 if (S3I(s
)->handshake_buffer
&&
184 !(s
->s3
->flags
& TLS1_FLAGS_KEEP_HANDSHAKE
)) {
185 BIO_write(S3I(s
)->handshake_buffer
, (void *)buf
, len
);
193 tls1_digest_cached_records(SSL
*s
)
198 hdatalen
= BIO_get_mem_data(S3I(s
)->handshake_buffer
, &hdata
);
200 SSLerror(s
, SSL_R_BAD_HANDSHAKE_LENGTH
);
204 if (!(s
->s3
->flags
& TLS1_FLAGS_KEEP_HANDSHAKE
)) {
205 BIO_free(S3I(s
)->handshake_buffer
);
206 S3I(s
)->handshake_buffer
= NULL
;
216 tls1_record_sequence_increment(unsigned char *seq
)
220 for (i
= SSL3_SEQUENCE_SIZE
- 1; i
>= 0; i
--) {
227 * TLS P_hash() data expansion function - see RFC 5246, section 5.
230 tls1_P_hash(const EVP_MD
*md
, const unsigned char *secret
, size_t secret_len
,
231 const void *seed1
, size_t seed1_len
, const void *seed2
, size_t seed2_len
,
232 const void *seed3
, size_t seed3_len
, const void *seed4
, size_t seed4_len
,
233 const void *seed5
, size_t seed5_len
, unsigned char *out
, size_t out_len
)
235 unsigned char A1
[EVP_MAX_MD_SIZE
], hmac
[EVP_MAX_MD_SIZE
];
236 size_t A1_len
, hmac_len
;
243 chunk
= EVP_MD_size(md
);
244 OPENSSL_assert(chunk
>= 0);
246 EVP_MD_CTX_init(&ctx
);
248 mac_key
= EVP_PKEY_new_mac_key(EVP_PKEY_HMAC
, NULL
, secret
, secret_len
);
251 if (!EVP_DigestSignInit(&ctx
, NULL
, md
, NULL
, mac_key
))
253 if (seed1
&& !EVP_DigestSignUpdate(&ctx
, seed1
, seed1_len
))
255 if (seed2
&& !EVP_DigestSignUpdate(&ctx
, seed2
, seed2_len
))
257 if (seed3
&& !EVP_DigestSignUpdate(&ctx
, seed3
, seed3_len
))
259 if (seed4
&& !EVP_DigestSignUpdate(&ctx
, seed4
, seed4_len
))
261 if (seed5
&& !EVP_DigestSignUpdate(&ctx
, seed5
, seed5_len
))
263 if (!EVP_DigestSignFinal(&ctx
, A1
, &A1_len
))
267 if (!EVP_DigestSignInit(&ctx
, NULL
, md
, NULL
, mac_key
))
269 if (!EVP_DigestSignUpdate(&ctx
, A1
, A1_len
))
271 if (seed1
&& !EVP_DigestSignUpdate(&ctx
, seed1
, seed1_len
))
273 if (seed2
&& !EVP_DigestSignUpdate(&ctx
, seed2
, seed2_len
))
275 if (seed3
&& !EVP_DigestSignUpdate(&ctx
, seed3
, seed3_len
))
277 if (seed4
&& !EVP_DigestSignUpdate(&ctx
, seed4
, seed4_len
))
279 if (seed5
&& !EVP_DigestSignUpdate(&ctx
, seed5
, seed5_len
))
281 if (!EVP_DigestSignFinal(&ctx
, hmac
, &hmac_len
))
284 if (hmac_len
> out_len
)
287 for (i
= 0; i
< hmac_len
; i
++)
296 if (!EVP_DigestSignInit(&ctx
, NULL
, md
, NULL
, mac_key
))
298 if (!EVP_DigestSignUpdate(&ctx
, A1
, A1_len
))
300 if (!EVP_DigestSignFinal(&ctx
, A1
, &A1_len
))
306 EVP_PKEY_free(mac_key
);
307 EVP_MD_CTX_cleanup(&ctx
);
309 explicit_bzero(A1
, sizeof(A1
));
310 explicit_bzero(hmac
, sizeof(hmac
));
316 tls1_PRF(SSL
*s
, const unsigned char *secret
, size_t secret_len
,
317 const void *seed1
, size_t seed1_len
, const void *seed2
, size_t seed2_len
,
318 const void *seed3
, size_t seed3_len
, const void *seed4
, size_t seed4_len
,
319 const void *seed5
, size_t seed5_len
, unsigned char *out
, size_t out_len
)
324 memset(out
, 0, out_len
);
326 if (!ssl_get_handshake_evp_md(s
, &md
))
329 if (md
->type
== NID_md5_sha1
) {
331 * Partition secret between MD5 and SHA1, then XOR result.
332 * If the secret length is odd, a one byte overlap is used.
334 half_len
= secret_len
- (secret_len
/ 2);
335 if (!tls1_P_hash(EVP_md5(), secret
, half_len
, seed1
, seed1_len
,
336 seed2
, seed2_len
, seed3
, seed3_len
, seed4
, seed4_len
,
337 seed5
, seed5_len
, out
, out_len
))
340 secret
+= secret_len
- half_len
;
341 if (!tls1_P_hash(EVP_sha1(), secret
, half_len
, seed1
, seed1_len
,
342 seed2
, seed2_len
, seed3
, seed3_len
, seed4
, seed4_len
,
343 seed5
, seed5_len
, out
, out_len
))
349 if (!tls1_P_hash(md
, secret
, secret_len
, seed1
, seed1_len
,
350 seed2
, seed2_len
, seed3
, seed3_len
, seed4
, seed4_len
,
351 seed5
, seed5_len
, out
, out_len
))
358 tls1_generate_key_block(SSL
*s
, unsigned char *km
, int num
)
364 s
->session
->master_key
, s
->session
->master_key_length
,
365 TLS_MD_KEY_EXPANSION_CONST
, TLS_MD_KEY_EXPANSION_CONST_SIZE
,
366 s
->s3
->server_random
, SSL3_RANDOM_SIZE
,
367 s
->s3
->client_random
, SSL3_RANDOM_SIZE
,
368 NULL
, 0, NULL
, 0, km
, num
);
372 * tls1_aead_ctx_init allocates aead_ctx, if needed. It returns 1 on success
376 tls1_aead_ctx_init(SSL_AEAD_CTX
**aead_ctx
)
378 if (*aead_ctx
!= NULL
) {
379 EVP_AEAD_CTX_cleanup(&(*aead_ctx
)->ctx
);
383 *aead_ctx
= malloc(sizeof(SSL_AEAD_CTX
));
384 if (*aead_ctx
== NULL
) {
385 SSLerrorx(ERR_R_MALLOC_FAILURE
);
393 tls1_change_cipher_state_aead(SSL
*s
, char is_read
, const unsigned char *key
,
394 unsigned key_len
, const unsigned char *iv
, unsigned iv_len
)
396 const EVP_AEAD
*aead
= S3I(s
)->tmp
.new_aead
;
397 SSL_AEAD_CTX
*aead_ctx
;
400 ssl_clear_cipher_read_state(s
);
401 if (!tls1_aead_ctx_init(&s
->internal
->aead_read_ctx
))
403 aead_ctx
= s
->internal
->aead_read_ctx
;
405 /* XXX - Need to correctly handle DTLS. */
406 ssl_clear_cipher_write_state(s
);
407 if (!tls1_aead_ctx_init(&s
->internal
->aead_write_ctx
))
409 aead_ctx
= s
->internal
->aead_write_ctx
;
412 if (!EVP_AEAD_CTX_init(&aead_ctx
->ctx
, aead
, key
, key_len
,
413 EVP_AEAD_DEFAULT_TAG_LENGTH
, NULL
))
415 if (iv_len
> sizeof(aead_ctx
->fixed_nonce
)) {
416 SSLerrorx(ERR_R_INTERNAL_ERROR
);
419 memcpy(aead_ctx
->fixed_nonce
, iv
, iv_len
);
420 aead_ctx
->fixed_nonce_len
= iv_len
;
421 aead_ctx
->variable_nonce_len
= 8; /* always the case, currently. */
422 aead_ctx
->variable_nonce_in_record
=
423 (S3I(s
)->hs
.new_cipher
->algorithm2
&
424 SSL_CIPHER_ALGORITHM2_VARIABLE_NONCE_IN_RECORD
) != 0;
425 aead_ctx
->xor_fixed_nonce
=
426 S3I(s
)->hs
.new_cipher
->algorithm_enc
== SSL_CHACHA20POLY1305
;
427 aead_ctx
->tag_len
= EVP_AEAD_max_overhead(aead
);
429 if (aead_ctx
->xor_fixed_nonce
) {
430 if (aead_ctx
->fixed_nonce_len
!= EVP_AEAD_nonce_length(aead
) ||
431 aead_ctx
->variable_nonce_len
> EVP_AEAD_nonce_length(aead
)) {
432 SSLerrorx(ERR_R_INTERNAL_ERROR
);
436 if (aead_ctx
->variable_nonce_len
+ aead_ctx
->fixed_nonce_len
!=
437 EVP_AEAD_nonce_length(aead
)) {
438 SSLerrorx(ERR_R_INTERNAL_ERROR
);
447 * tls1_change_cipher_state_cipher performs the work needed to switch cipher
448 * states when using EVP_CIPHER. The argument is_read is true iff this function
449 * is being called due to reading, as opposed to writing, a ChangeCipherSpec
453 tls1_change_cipher_state_cipher(SSL
*s
, char is_read
,
454 const unsigned char *mac_secret
, unsigned int mac_secret_size
,
455 const unsigned char *key
, unsigned int key_len
, const unsigned char *iv
,
458 EVP_CIPHER_CTX
*cipher_ctx
;
459 const EVP_CIPHER
*cipher
;
465 cipher
= S3I(s
)->tmp
.new_sym_enc
;
466 mac
= S3I(s
)->tmp
.new_hash
;
467 mac_type
= S3I(s
)->tmp
.new_mac_pkey_type
;
470 if (S3I(s
)->hs
.new_cipher
->algorithm2
& TLS1_STREAM_MAC
)
471 s
->internal
->mac_flags
|= SSL_MAC_FLAG_READ_MAC_STREAM
;
473 s
->internal
->mac_flags
&= ~SSL_MAC_FLAG_READ_MAC_STREAM
;
475 ssl_clear_cipher_read_state(s
);
477 if ((cipher_ctx
= EVP_CIPHER_CTX_new()) == NULL
)
479 s
->enc_read_ctx
= cipher_ctx
;
480 if ((mac_ctx
= EVP_MD_CTX_new()) == NULL
)
482 s
->read_hash
= mac_ctx
;
484 if (S3I(s
)->hs
.new_cipher
->algorithm2
& TLS1_STREAM_MAC
)
485 s
->internal
->mac_flags
|= SSL_MAC_FLAG_WRITE_MAC_STREAM
;
487 s
->internal
->mac_flags
&= ~SSL_MAC_FLAG_WRITE_MAC_STREAM
;
490 * DTLS fragments retain a pointer to the compression, cipher
491 * and hash contexts, so that it can restore state in order
492 * to perform retransmissions. As such, we cannot free write
493 * contexts that are used for DTLS - these are instead freed
494 * by DTLS when its frees a ChangeCipherSpec fragment.
497 ssl_clear_cipher_write_state(s
);
499 if ((cipher_ctx
= EVP_CIPHER_CTX_new()) == NULL
)
501 s
->internal
->enc_write_ctx
= cipher_ctx
;
502 if ((mac_ctx
= EVP_MD_CTX_new()) == NULL
)
504 s
->internal
->write_hash
= mac_ctx
;
507 EVP_CipherInit_ex(cipher_ctx
, cipher
, NULL
, key
, iv
, !is_read
);
509 if ((mac_key
= EVP_PKEY_new_mac_key(mac_type
, NULL
, mac_secret
,
510 mac_secret_size
)) == NULL
)
512 EVP_DigestSignInit(mac_ctx
, NULL
, mac
, NULL
, mac_key
);
513 EVP_PKEY_free(mac_key
);
515 if (S3I(s
)->hs
.new_cipher
->algorithm_enc
== SSL_eGOST2814789CNT
) {
517 if (S3I(s
)->hs
.new_cipher
->algorithm2
& SSL_HANDSHAKE_MAC_GOST94
)
518 nid
= NID_id_Gost28147_89_CryptoPro_A_ParamSet
;
520 nid
= NID_id_tc26_gost_28147_param_Z
;
522 EVP_CIPHER_CTX_ctrl(cipher_ctx
, EVP_CTRL_GOST_SET_SBOX
, nid
, 0);
523 if (S3I(s
)->hs
.new_cipher
->algorithm_mac
== SSL_GOST89MAC
)
524 EVP_MD_CTX_ctrl(mac_ctx
, EVP_MD_CTRL_GOST_SET_SBOX
, nid
, 0);
530 SSLerrorx(ERR_R_MALLOC_FAILURE
);
535 tls1_change_cipher_state(SSL
*s
, int which
)
537 const unsigned char *client_write_mac_secret
, *server_write_mac_secret
;
538 const unsigned char *client_write_key
, *server_write_key
;
539 const unsigned char *client_write_iv
, *server_write_iv
;
540 const unsigned char *mac_secret
, *key
, *iv
;
541 int mac_secret_size
, key_len
, iv_len
;
542 unsigned char *key_block
, *seq
;
543 const EVP_CIPHER
*cipher
;
544 const EVP_AEAD
*aead
;
545 char is_read
, use_client_keys
;
547 cipher
= S3I(s
)->tmp
.new_sym_enc
;
548 aead
= S3I(s
)->tmp
.new_aead
;
551 * is_read is true if we have just read a ChangeCipherSpec message,
552 * that is we need to update the read cipherspec. Otherwise we have
555 is_read
= (which
& SSL3_CC_READ
) != 0;
558 * use_client_keys is true if we wish to use the keys for the "client
559 * write" direction. This is the case if we're a client sending a
560 * ChangeCipherSpec, or a server reading a client's ChangeCipherSpec.
562 use_client_keys
= ((which
== SSL3_CHANGE_CIPHER_CLIENT_WRITE
) ||
563 (which
== SSL3_CHANGE_CIPHER_SERVER_READ
));
566 * Reset sequence number to zero - for DTLS this is handled in
567 * dtls1_reset_seq_numbers().
569 if (!SSL_IS_DTLS(s
)) {
570 seq
= is_read
? S3I(s
)->read_sequence
: S3I(s
)->write_sequence
;
571 memset(seq
, 0, SSL3_SEQUENCE_SIZE
);
575 key_len
= EVP_AEAD_key_length(aead
);
576 iv_len
= SSL_CIPHER_AEAD_FIXED_NONCE_LEN(S3I(s
)->hs
.new_cipher
);
578 key_len
= EVP_CIPHER_key_length(cipher
);
579 iv_len
= EVP_CIPHER_iv_length(cipher
);
582 mac_secret_size
= s
->s3
->tmp
.new_mac_secret_size
;
584 key_block
= S3I(s
)->hs
.key_block
;
585 client_write_mac_secret
= key_block
;
586 key_block
+= mac_secret_size
;
587 server_write_mac_secret
= key_block
;
588 key_block
+= mac_secret_size
;
589 client_write_key
= key_block
;
590 key_block
+= key_len
;
591 server_write_key
= key_block
;
592 key_block
+= key_len
;
593 client_write_iv
= key_block
;
595 server_write_iv
= key_block
;
598 if (use_client_keys
) {
599 mac_secret
= client_write_mac_secret
;
600 key
= client_write_key
;
601 iv
= client_write_iv
;
603 mac_secret
= server_write_mac_secret
;
604 key
= server_write_key
;
605 iv
= server_write_iv
;
608 if (key_block
- S3I(s
)->hs
.key_block
!= S3I(s
)->hs
.key_block_len
) {
609 SSLerror(s
, ERR_R_INTERNAL_ERROR
);
614 memcpy(S3I(s
)->read_mac_secret
, mac_secret
, mac_secret_size
);
615 S3I(s
)->read_mac_secret_size
= mac_secret_size
;
617 memcpy(S3I(s
)->write_mac_secret
, mac_secret
, mac_secret_size
);
618 S3I(s
)->write_mac_secret_size
= mac_secret_size
;
622 return tls1_change_cipher_state_aead(s
, is_read
, key
, key_len
,
626 return tls1_change_cipher_state_cipher(s
, is_read
,
627 mac_secret
, mac_secret_size
, key
, key_len
, iv
, iv_len
);
634 tls1_setup_key_block(SSL
*s
)
636 unsigned char *key_block
;
637 int mac_type
= NID_undef
, mac_secret_size
= 0;
638 int key_block_len
, key_len
, iv_len
;
639 const EVP_CIPHER
*cipher
= NULL
;
640 const EVP_AEAD
*aead
= NULL
;
641 const EVP_MD
*mac
= NULL
;
644 if (S3I(s
)->hs
.key_block_len
!= 0)
647 if (s
->session
->cipher
&&
648 (s
->session
->cipher
->algorithm_mac
& SSL_AEAD
)) {
649 if (!ssl_cipher_get_evp_aead(s
->session
, &aead
)) {
650 SSLerror(s
, SSL_R_CIPHER_OR_HASH_UNAVAILABLE
);
653 key_len
= EVP_AEAD_key_length(aead
);
654 iv_len
= SSL_CIPHER_AEAD_FIXED_NONCE_LEN(s
->session
->cipher
);
656 if (!ssl_cipher_get_evp(s
->session
, &cipher
, &mac
, &mac_type
,
658 SSLerror(s
, SSL_R_CIPHER_OR_HASH_UNAVAILABLE
);
661 key_len
= EVP_CIPHER_key_length(cipher
);
662 iv_len
= EVP_CIPHER_iv_length(cipher
);
665 S3I(s
)->tmp
.new_aead
= aead
;
666 S3I(s
)->tmp
.new_sym_enc
= cipher
;
667 S3I(s
)->tmp
.new_hash
= mac
;
668 S3I(s
)->tmp
.new_mac_pkey_type
= mac_type
;
669 s
->s3
->tmp
.new_mac_secret_size
= mac_secret_size
;
671 tls1_cleanup_key_block(s
);
673 if ((key_block
= reallocarray(NULL
, mac_secret_size
+ key_len
+ iv_len
,
675 SSLerror(s
, ERR_R_MALLOC_FAILURE
);
678 key_block_len
= (mac_secret_size
+ key_len
+ iv_len
) * 2;
680 S3I(s
)->hs
.key_block_len
= key_block_len
;
681 S3I(s
)->hs
.key_block
= key_block
;
683 if (!tls1_generate_key_block(s
, key_block
, key_block_len
))
686 if (!(s
->internal
->options
& SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
) &&
687 s
->method
->internal
->version
<= TLS1_VERSION
) {
689 * Enable vulnerability countermeasure for CBC ciphers with
690 * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt)
692 S3I(s
)->need_empty_fragments
= 1;
694 if (s
->session
->cipher
!= NULL
) {
695 if (s
->session
->cipher
->algorithm_enc
== SSL_eNULL
)
696 S3I(s
)->need_empty_fragments
= 0;
698 #ifndef OPENSSL_NO_RC4
699 if (s
->session
->cipher
->algorithm_enc
== SSL_RC4
)
700 S3I(s
)->need_empty_fragments
= 0;
711 /* tls1_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
714 * 0: (in non-constant time) if the record is publically invalid (i.e. too
716 * 1: if the record's padding is valid / the encryption was successful.
717 * -1: if the record's padding/AEAD-authenticator is invalid or, if sending,
718 * an internal error occured.
721 tls1_enc(SSL
*s
, int send
)
723 const SSL_AEAD_CTX
*aead
;
724 const EVP_CIPHER
*enc
;
729 int bs
, i
, j
, k
, pad
= 0, ret
, mac_size
= 0;
732 aead
= s
->internal
->aead_write_ctx
;
734 seq
= S3I(s
)->write_sequence
;
736 aead
= s
->internal
->aead_read_ctx
;
738 seq
= S3I(s
)->read_sequence
;
742 unsigned char ad
[13], *in
, *out
, nonce
[16];
743 size_t out_len
, pad_len
= 0;
744 unsigned int nonce_used
;
746 if (SSL_IS_DTLS(s
)) {
747 dtls1_build_sequence_number(ad
, seq
,
748 send
? D1I(s
)->w_epoch
: D1I(s
)->r_epoch
);
750 memcpy(ad
, seq
, SSL3_SEQUENCE_SIZE
);
751 tls1_record_sequence_increment(seq
);
755 ad
[9] = (unsigned char)(s
->version
>> 8);
756 ad
[10] = (unsigned char)(s
->version
);
758 if (aead
->variable_nonce_len
> 8 ||
759 aead
->variable_nonce_len
> sizeof(nonce
))
762 if (aead
->xor_fixed_nonce
) {
763 if (aead
->fixed_nonce_len
> sizeof(nonce
) ||
764 aead
->variable_nonce_len
> aead
->fixed_nonce_len
)
765 return -1; /* Should never happen. */
766 pad_len
= aead
->fixed_nonce_len
- aead
->variable_nonce_len
;
768 if (aead
->fixed_nonce_len
+
769 aead
->variable_nonce_len
> sizeof(nonce
))
770 return -1; /* Should never happen. */
774 size_t len
= rec
->length
;
779 if (aead
->xor_fixed_nonce
) {
781 * The sequence number is left zero
782 * padded, then xored with the fixed
785 memset(nonce
, 0, pad_len
);
786 memcpy(nonce
+ pad_len
, ad
,
787 aead
->variable_nonce_len
);
788 for (i
= 0; i
< aead
->fixed_nonce_len
; i
++)
789 nonce
[i
] ^= aead
->fixed_nonce
[i
];
790 nonce_used
= aead
->fixed_nonce_len
;
793 * When sending we use the sequence number as
794 * the variable part of the nonce.
796 memcpy(nonce
, aead
->fixed_nonce
,
797 aead
->fixed_nonce_len
);
798 nonce_used
= aead
->fixed_nonce_len
;
799 memcpy(nonce
+ nonce_used
, ad
,
800 aead
->variable_nonce_len
);
801 nonce_used
+= aead
->variable_nonce_len
;
805 * In do_ssl3_write, rec->input is moved forward by
806 * variable_nonce_len in order to leave space for the
807 * variable nonce. Thus we can copy the sequence number
808 * bytes into place without overwriting any of the
811 if (aead
->variable_nonce_in_record
) {
812 memcpy(out
, ad
, aead
->variable_nonce_len
);
813 len
-= aead
->variable_nonce_len
;
814 eivlen
= aead
->variable_nonce_len
;
820 if (!EVP_AEAD_CTX_seal(&aead
->ctx
,
821 out
+ eivlen
, &out_len
, len
+ aead
->tag_len
, nonce
,
822 nonce_used
, in
+ eivlen
, len
, ad
, sizeof(ad
)))
824 if (aead
->variable_nonce_in_record
)
825 out_len
+= aead
->variable_nonce_len
;
828 size_t len
= rec
->length
;
830 if (rec
->data
!= rec
->input
)
831 return -1; /* internal error - should never happen. */
832 out
= in
= rec
->input
;
834 if (len
< aead
->variable_nonce_len
)
837 if (aead
->xor_fixed_nonce
) {
839 * The sequence number is left zero
840 * padded, then xored with the fixed
843 memset(nonce
, 0, pad_len
);
844 memcpy(nonce
+ pad_len
, ad
,
845 aead
->variable_nonce_len
);
846 for (i
= 0; i
< aead
->fixed_nonce_len
; i
++)
847 nonce
[i
] ^= aead
->fixed_nonce
[i
];
848 nonce_used
= aead
->fixed_nonce_len
;
850 memcpy(nonce
, aead
->fixed_nonce
,
851 aead
->fixed_nonce_len
);
852 nonce_used
= aead
->fixed_nonce_len
;
854 memcpy(nonce
+ nonce_used
,
855 aead
->variable_nonce_in_record
? in
: ad
,
856 aead
->variable_nonce_len
);
857 nonce_used
+= aead
->variable_nonce_len
;
860 if (aead
->variable_nonce_in_record
) {
861 in
+= aead
->variable_nonce_len
;
862 len
-= aead
->variable_nonce_len
;
863 out
+= aead
->variable_nonce_len
;
866 if (len
< aead
->tag_len
)
868 len
-= aead
->tag_len
;
873 if (!EVP_AEAD_CTX_open(&aead
->ctx
, out
, &out_len
, len
,
874 nonce
, nonce_used
, in
, len
+ aead
->tag_len
, ad
,
878 rec
->data
= rec
->input
= out
;
881 rec
->length
= out_len
;
887 if (EVP_MD_CTX_md(s
->internal
->write_hash
)) {
888 int n
= EVP_MD_CTX_size(s
->internal
->write_hash
);
889 OPENSSL_assert(n
>= 0);
891 ds
= s
->internal
->enc_write_ctx
;
892 if (s
->internal
->enc_write_ctx
== NULL
)
896 enc
= EVP_CIPHER_CTX_cipher(s
->internal
->enc_write_ctx
);
897 if (SSL_USE_EXPLICIT_IV(s
) &&
898 EVP_CIPHER_mode(enc
) == EVP_CIPH_CBC_MODE
)
899 ivlen
= EVP_CIPHER_iv_length(enc
);
901 if (rec
->data
!= rec
->input
) {
903 /* we can't write into the input stream:
904 * Can this ever happen?? (steve)
907 "%s:%d: rec->data != rec->input\n",
911 arc4random_buf(rec
->input
, ivlen
);
915 if (EVP_MD_CTX_md(s
->read_hash
)) {
916 int n
= EVP_MD_CTX_size(s
->read_hash
);
917 OPENSSL_assert(n
>= 0);
919 ds
= s
->enc_read_ctx
;
920 if (s
->enc_read_ctx
== NULL
)
923 enc
= EVP_CIPHER_CTX_cipher(s
->enc_read_ctx
);
926 if ((s
->session
== NULL
) || (ds
== NULL
) || (enc
== NULL
)) {
927 memmove(rec
->data
, rec
->input
, rec
->length
);
928 rec
->input
= rec
->data
;
932 bs
= EVP_CIPHER_block_size(ds
->cipher
);
934 if (bs
!= 1 && send
) {
935 i
= bs
- ((int)l
% bs
);
937 /* Add weird padding of upto 256 bytes */
939 /* we need to add 'i' padding bytes of value j */
941 for (k
= (int)l
; k
< (int)(l
+ i
); k
++)
948 if (l
== 0 || l
% bs
!= 0)
952 i
= EVP_Cipher(ds
, rec
->data
, rec
->input
, l
);
953 if ((EVP_CIPHER_flags(ds
->cipher
) &
954 EVP_CIPH_FLAG_CUSTOM_CIPHER
) ? (i
< 0) : (i
== 0))
955 return -1; /* AEAD can fail to verify MAC */
958 if (EVP_MD_CTX_md(s
->read_hash
) != NULL
)
959 mac_size
= EVP_MD_CTX_size(s
->read_hash
);
960 if ((bs
!= 1) && !send
)
961 ret
= tls1_cbc_remove_padding(s
, rec
, bs
, mac_size
);
969 tls1_final_finish_mac(SSL
*s
, const char *str
, int str_len
, unsigned char *out
)
971 unsigned char buf
[EVP_MAX_MD_SIZE
];
977 if (!tls1_handshake_hash_value(s
, buf
, sizeof(buf
), &hash_len
))
980 if (!tls1_PRF(s
, s
->session
->master_key
, s
->session
->master_key_length
,
981 str
, str_len
, buf
, hash_len
, NULL
, 0, NULL
, 0, NULL
, 0,
982 out
, TLS1_FINISH_MAC_LENGTH
))
985 return TLS1_FINISH_MAC_LENGTH
;
989 tls1_mac(SSL
*ssl
, unsigned char *md
, int send
)
994 size_t md_size
, orig_len
;
995 EVP_MD_CTX hmac
, *mac_ctx
;
996 unsigned char header
[13];
997 int stream_mac
= (send
?
998 (ssl
->internal
->mac_flags
& SSL_MAC_FLAG_WRITE_MAC_STREAM
) :
999 (ssl
->internal
->mac_flags
& SSL_MAC_FLAG_READ_MAC_STREAM
));
1003 rec
= &(ssl
->s3
->internal
->wrec
);
1004 seq
= &(ssl
->s3
->internal
->write_sequence
[0]);
1005 hash
= ssl
->internal
->write_hash
;
1007 rec
= &(ssl
->s3
->internal
->rrec
);
1008 seq
= &(ssl
->s3
->internal
->read_sequence
[0]);
1009 hash
= ssl
->read_hash
;
1012 t
= EVP_MD_CTX_size(hash
);
1013 OPENSSL_assert(t
>= 0);
1016 /* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */
1020 if (!EVP_MD_CTX_copy(&hmac
, hash
))
1025 if (SSL_IS_DTLS(ssl
))
1026 dtls1_build_sequence_number(header
, seq
,
1027 send
? D1I(ssl
)->w_epoch
: D1I(ssl
)->r_epoch
);
1029 memcpy(header
, seq
, SSL3_SEQUENCE_SIZE
);
1031 /* kludge: tls1_cbc_remove_padding passes padding length in rec->type */
1032 orig_len
= rec
->length
+ md_size
+ ((unsigned int)rec
->type
>> 8);
1035 header
[8] = rec
->type
;
1036 header
[9] = (unsigned char)(ssl
->version
>> 8);
1037 header
[10] = (unsigned char)(ssl
->version
);
1038 header
[11] = (rec
->length
) >> 8;
1039 header
[12] = (rec
->length
) & 0xff;
1042 EVP_CIPHER_CTX_mode(ssl
->enc_read_ctx
) == EVP_CIPH_CBC_MODE
&&
1043 ssl3_cbc_record_digest_supported(mac_ctx
)) {
1044 /* This is a CBC-encrypted record. We must avoid leaking any
1045 * timing-side channel information about how many blocks of
1046 * data we are hashing because that gives an attacker a
1048 if (!ssl3_cbc_digest_record(mac_ctx
,
1049 md
, &md_size
, header
, rec
->input
,
1050 rec
->length
+ md_size
, orig_len
,
1051 ssl
->s3
->internal
->read_mac_secret
,
1052 ssl
->s3
->internal
->read_mac_secret_size
))
1055 EVP_DigestSignUpdate(mac_ctx
, header
, sizeof(header
));
1056 EVP_DigestSignUpdate(mac_ctx
, rec
->input
, rec
->length
);
1057 t
= EVP_DigestSignFinal(mac_ctx
, md
, &md_size
);
1058 OPENSSL_assert(t
> 0);
1062 EVP_MD_CTX_cleanup(&hmac
);
1064 if (!SSL_IS_DTLS(ssl
))
1065 tls1_record_sequence_increment(seq
);
1071 tls1_generate_master_secret(SSL
*s
, unsigned char *out
, unsigned char *p
,
1077 if (!tls1_PRF(s
, p
, len
,
1078 TLS_MD_MASTER_SECRET_CONST
, TLS_MD_MASTER_SECRET_CONST_SIZE
,
1079 s
->s3
->client_random
, SSL3_RANDOM_SIZE
, NULL
, 0,
1080 s
->s3
->server_random
, SSL3_RANDOM_SIZE
, NULL
, 0,
1081 s
->session
->master_key
, SSL_MAX_MASTER_KEY_LENGTH
))
1084 return (SSL_MAX_MASTER_KEY_LENGTH
);
1088 tls1_export_keying_material(SSL
*s
, unsigned char *out
, size_t olen
,
1089 const char *label
, size_t llen
, const unsigned char *context
,
1090 size_t contextlen
, int use_context
)
1092 unsigned char *val
= NULL
;
1093 size_t vallen
, currentvalpos
;
1096 /* construct PRF arguments
1097 * we construct the PRF argument ourself rather than passing separate
1098 * values into the TLS PRF to ensure that the concatenation of values
1099 * does not create a prohibited label.
1101 vallen
= llen
+ SSL3_RANDOM_SIZE
* 2;
1103 vallen
+= 2 + contextlen
;
1106 val
= malloc(vallen
);
1110 memcpy(val
+ currentvalpos
, (unsigned char *) label
, llen
);
1111 currentvalpos
+= llen
;
1112 memcpy(val
+ currentvalpos
, s
->s3
->client_random
, SSL3_RANDOM_SIZE
);
1113 currentvalpos
+= SSL3_RANDOM_SIZE
;
1114 memcpy(val
+ currentvalpos
, s
->s3
->server_random
, SSL3_RANDOM_SIZE
);
1115 currentvalpos
+= SSL3_RANDOM_SIZE
;
1118 val
[currentvalpos
] = (contextlen
>> 8) & 0xff;
1120 val
[currentvalpos
] = contextlen
& 0xff;
1122 if ((contextlen
> 0) || (context
!= NULL
)) {
1123 memcpy(val
+ currentvalpos
, context
, contextlen
);
1127 /* disallow prohibited labels
1128 * note that SSL3_RANDOM_SIZE > max(prohibited label len) =
1129 * 15, so size of val > max(prohibited label len) = 15 and the
1130 * comparisons won't have buffer overflow
1132 if (memcmp(val
, TLS_MD_CLIENT_FINISH_CONST
,
1133 TLS_MD_CLIENT_FINISH_CONST_SIZE
) == 0)
1135 if (memcmp(val
, TLS_MD_SERVER_FINISH_CONST
,
1136 TLS_MD_SERVER_FINISH_CONST_SIZE
) == 0)
1138 if (memcmp(val
, TLS_MD_MASTER_SECRET_CONST
,
1139 TLS_MD_MASTER_SECRET_CONST_SIZE
) == 0)
1141 if (memcmp(val
, TLS_MD_KEY_EXPANSION_CONST
,
1142 TLS_MD_KEY_EXPANSION_CONST_SIZE
) == 0)
1145 rv
= tls1_PRF(s
, s
->session
->master_key
, s
->session
->master_key_length
,
1146 val
, vallen
, NULL
, 0, NULL
, 0, NULL
, 0, NULL
, 0, out
, olen
);
1150 SSLerror(s
, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL
);
1154 SSLerror(s
, ERR_R_MALLOC_FAILURE
);
1163 tls1_alert_code(int code
)
1166 case SSL_AD_CLOSE_NOTIFY
:
1167 return (SSL3_AD_CLOSE_NOTIFY
);
1168 case SSL_AD_UNEXPECTED_MESSAGE
:
1169 return (SSL3_AD_UNEXPECTED_MESSAGE
);
1170 case SSL_AD_BAD_RECORD_MAC
:
1171 return (SSL3_AD_BAD_RECORD_MAC
);
1172 case SSL_AD_DECRYPTION_FAILED
:
1173 return (TLS1_AD_DECRYPTION_FAILED
);
1174 case SSL_AD_RECORD_OVERFLOW
:
1175 return (TLS1_AD_RECORD_OVERFLOW
);
1176 case SSL_AD_DECOMPRESSION_FAILURE
:
1177 return (SSL3_AD_DECOMPRESSION_FAILURE
);
1178 case SSL_AD_HANDSHAKE_FAILURE
:
1179 return (SSL3_AD_HANDSHAKE_FAILURE
);
1180 case SSL_AD_NO_CERTIFICATE
:
1182 case SSL_AD_BAD_CERTIFICATE
:
1183 return (SSL3_AD_BAD_CERTIFICATE
);
1184 case SSL_AD_UNSUPPORTED_CERTIFICATE
:
1185 return (SSL3_AD_UNSUPPORTED_CERTIFICATE
);
1186 case SSL_AD_CERTIFICATE_REVOKED
:
1187 return (SSL3_AD_CERTIFICATE_REVOKED
);
1188 case SSL_AD_CERTIFICATE_EXPIRED
:
1189 return (SSL3_AD_CERTIFICATE_EXPIRED
);
1190 case SSL_AD_CERTIFICATE_UNKNOWN
:
1191 return (SSL3_AD_CERTIFICATE_UNKNOWN
);
1192 case SSL_AD_ILLEGAL_PARAMETER
:
1193 return (SSL3_AD_ILLEGAL_PARAMETER
);
1194 case SSL_AD_UNKNOWN_CA
:
1195 return (TLS1_AD_UNKNOWN_CA
);
1196 case SSL_AD_ACCESS_DENIED
:
1197 return (TLS1_AD_ACCESS_DENIED
);
1198 case SSL_AD_DECODE_ERROR
:
1199 return (TLS1_AD_DECODE_ERROR
);
1200 case SSL_AD_DECRYPT_ERROR
:
1201 return (TLS1_AD_DECRYPT_ERROR
);
1202 case SSL_AD_EXPORT_RESTRICTION
:
1203 return (TLS1_AD_EXPORT_RESTRICTION
);
1204 case SSL_AD_PROTOCOL_VERSION
:
1205 return (TLS1_AD_PROTOCOL_VERSION
);
1206 case SSL_AD_INSUFFICIENT_SECURITY
:
1207 return (TLS1_AD_INSUFFICIENT_SECURITY
);
1208 case SSL_AD_INTERNAL_ERROR
:
1209 return (TLS1_AD_INTERNAL_ERROR
);
1210 case SSL_AD_INAPPROPRIATE_FALLBACK
:
1211 return(TLS1_AD_INAPPROPRIATE_FALLBACK
);
1212 case SSL_AD_USER_CANCELLED
:
1213 return (TLS1_AD_USER_CANCELLED
);
1214 case SSL_AD_NO_RENEGOTIATION
:
1215 return (TLS1_AD_NO_RENEGOTIATION
);
1216 case SSL_AD_UNSUPPORTED_EXTENSION
:
1217 return (TLS1_AD_UNSUPPORTED_EXTENSION
);
1218 case SSL_AD_CERTIFICATE_UNOBTAINABLE
:
1219 return (TLS1_AD_CERTIFICATE_UNOBTAINABLE
);
1220 case SSL_AD_UNRECOGNIZED_NAME
:
1221 return (TLS1_AD_UNRECOGNIZED_NAME
);
1222 case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE
:
1223 return (TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE
);
1224 case SSL_AD_BAD_CERTIFICATE_HASH_VALUE
:
1225 return (TLS1_AD_BAD_CERTIFICATE_HASH_VALUE
);
1226 case SSL_AD_UNKNOWN_PSK_IDENTITY
:
1227 return (TLS1_AD_UNKNOWN_PSK_IDENTITY
);