]> git.ipfire.org Git - thirdparty/strongswan.git/blame - src/libtls/tls_crypto.c
projects / thirdparty / strongswan.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
tls-crypto: Support EdDSA keys with ECDSA cipher suites
[thirdparty/strongswan.git] / src / libtls / tls_crypto.c
CommitLineData
536dbc00 1/*
53ba0801
TB		 2 * Copyright (C) 2020 Tobias Brunner
3 * Copyright (C) 2020 Pascal Knecht
4 * Copyright (C) 2020 Méline Sieber
5 * HSR Hochschule fuer Technik Rapperswil
6 *
48d6b57c
MW		 7 * Copyright (C) 2010-2014 Martin Willi
8 * Copyright (C) 2010-2014 revosec AG
536dbc00
MW		 9 *
10 * This program is free software; you can redistribute it and/or modify it
11 * under the terms of the GNU General Public License as published by the
12 * Free Software Foundation; either version 2 of the License, or (at your
13 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
14 *
15 * This program is distributed in the hope that it will be useful, but
16 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
17 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
18 * for more details.
19 */
20
21#include "tls_crypto.h"
7a2b0266 22#include "tls_hkdf.h"
536dbc00 23
f05b4272 24#include <utils/debug.h>
48d6b57c 25#include <plugins/plugin_feature.h>
9803fb82 26#include <collections/hashtable.h>
18010de2 27
4657b3a4
AS		 28ENUM_BEGIN(tls_cipher_suite_names, TLS_NULL_WITH_NULL_NULL,
29 TLS_DH_anon_WITH_3DES_EDE_CBC_SHA,
30 "TLS_NULL_WITH_NULL_NULL",
31 "TLS_RSA_WITH_NULL_MD5",
32 "TLS_RSA_WITH_NULL_SHA",
33 "TLS_RSA_EXPORT_WITH_RC4_40_MD5",
34 "TLS_RSA_WITH_RC4_128_MD5",
35 "TLS_RSA_WITH_RC4_128_SHA",
36 "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5",
37 "TLS_RSA_WITH_IDEA_CBC_SHA",
38 "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA",
39 "TLS_RSA_WITH_DES_CBC_SHA",
40 "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
41 "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA",
42 "TLS_DH_DSS_WITH_DES_CBC_SHA",
43 "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA",
44 "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA",
45 "TLS_DH_RSA_WITH_DES_CBC_SHA",
46 "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA",
47 "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA",
37d2d7e1 48 "TLS_DHE_DSS_WITH_DES_CBC_SHA",
4657b3a4
AS		 49 "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
50 "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",
51 "TLS_DHE_RSA_WITH_DES_CBC_SHA",
52 "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
53 "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5",
54 "TLS_DH_anon_WITH_RC4_128_MD5",
55 "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA",
56 "TLS_DH_anon_WITH_DES_CBC_SHA",
57 "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA");
58ENUM_NEXT(tls_cipher_suite_names, TLS_KRB5_WITH_DES_CBC_SHA,
59 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA,
60 TLS_DH_anon_WITH_3DES_EDE_CBC_SHA,
61 "TLS_KRB5_WITH_DES_CBC_SHA",
62 "TLS_KRB5_WITH_3DES_EDE_CBC_SHA",
63 "TLS_KRB5_WITH_RC4_128_SHA",
64 "TLS_KRB5_WITH_IDEA_CBC_SHA",
65 "TLS_KRB5_WITH_DES_CBC_MD5",
66 "TLS_KRB5_WITH_3DES_EDE_CBC_MD5",
67 "TLS_KRB5_WITH_RC4_128_MD5",
68 "TLS_KRB5_WITH_IDEA_CBC_MD5",
69 "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA",
37d2d7e1 70 "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA",
4657b3a4
AS		 71 "TLS_KRB5_EXPORT_WITH_RC4_40_SHA",
72 "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5",
73 "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5",
74 "TLS_KRB5_EXPORT_WITH_RC4_40_MD5",
75 "TLS_PSK_WITH_NULL_SHA",
76 "TLS_DHE_PSK_WITH_NULL_SHA",
77 "TLS_RSA_PSK_WITH_NULL_SHA",
78 "TLS_RSA_WITH_AES_128_CBC_SHA",
79 "TLS_DH_DSS_WITH_AES_128_CBC_SHA",
80 "TLS_DH_RSA_WITH_AES_128_CBC_SHA",
81 "TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
82 "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
83 "TLS_DH_anon_WITH_AES_128_CBC_SHA",
84 "TLS_RSA_WITH_AES_256_CBC_SHA",
85 "TLS_DH_DSS_WITH_AES_256_CBC_SHA",
86 "TLS_DH_RSA_WITH_AES_256_CBC_SHA",
87 "TLS_DHE_DSS_WITH_AES_256_CBC_SHA",
88 "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
89 "TLS_DH_anon_WITH_AES_256_CBC_SHA",
90 "TLS_RSA_WITH_NULL_SHA256",
e67e8dd1 91 "TLS_RSA_WITH_AES_128_CBC_SHA256",
4657b3a4
AS		 92 "TLS_RSA_WITH_AES_256_CBC_SHA256",
93 "TLS_DH_DSS_WITH_AES_128_CBC_SHA256",
94 "TLS_DH_RSA_WITH_AES_128_CBC_SHA256",
95 "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
96 "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA",
97 "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA",
98 "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA",
99 "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA",
37d2d7e1 100 "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA",
4657b3a4
AS		 101 "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA");
102ENUM_NEXT(tls_cipher_suite_names, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
103 TLS_DH_anon_WITH_AES_256_CBC_SHA256,
104 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA,
105 "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
106 "TLS_DH_DSS_WITH_AES_256_CBC_SHA256",
107 "TLS_DH_RSA_WITH_AES_256_CBC_SHA256",
108 "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256",
109 "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
110 "TLS_DH_anon_WITH_AES_128_CBC_SHA256",
111 "TLS_DH_anon_WITH_AES_256_CBC_SHA256");
112ENUM_NEXT(tls_cipher_suite_names, TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,
37d2d7e1 113 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256,
4657b3a4
AS		 114 TLS_DH_anon_WITH_AES_256_CBC_SHA256,
115 "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA",
116 "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA",
117 "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA",
118 "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA",
119 "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA",
120 "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA",
121 "TLS_PSK_WITH_RC4_128_SHA",
e67e8dd1 122 "TLS_PSK_WITH_3DES_EDE_CBC_SHA",
4657b3a4
AS		 123 "TLS_PSK_WITH_AES_128_CBC_SHA",
124 "TLS_PSK_WITH_AES_256_CBC_SHA",
125 "TLS_DHE_PSK_WITH_RC4_128_SHA",
126 "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA",
127 "TLS_DHE_PSK_WITH_AES_128_CBC_SHA",
e67e8dd1 128 "TLS_DHE_PSK_WITH_AES_256_CBC_SHA",
4657b3a4
AS		 129 "TLS_RSA_PSK_WITH_RC4_128_SHA",
130 "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA",
131 "TLS_RSA_PSK_WITH_AES_128_CBC_SHA",
132 "TLS_RSA_PSK_WITH_AES_256_CBC_SHA",
133 "TLS_RSA_WITH_SEED_CBC_SHA",
134 "TLS_DH_DSS_WITH_SEED_CBC_SHA",
135 "TLS_DH_RSA_WITH_SEED_CBC_SHA",
136 "TLS_DHE_DSS_WITH_SEED_CBC_SHA",
137 "TLS_DHE_RSA_WITH_SEED_CBC_SHA",
138 "TLS_DH_anon_WITH_SEED_CBC_SHA",
139 "TLS_RSA_WITH_AES_128_GCM_SHA256",
140 "TLS_RSA_WITH_AES_256_GCM_SHA384",
141 "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
142 "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
143 "TLS_DH_RSA_WITH_AES_128_GCM_SHA256",
144 "TLS_DH_RSA_WITH_AES_256_GCM_SHA384",
145 "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256",
146 "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384",
147 "TLS_DH_DSS_WITH_AES_128_GCM_SHA256",
148 "TLS_DH_DSS_WITH_AES_256_GCM_SHA384",
149 "TLS_DH_anon_WITH_AES_128_GCM_SHA256",
150 "TLS_DH_anon_WITH_AES_256_GCM_SHA384",
151 "TLS_PSK_WITH_AES_128_GCM_SHA256",
152 "TLS_PSK_WITH_AES_256_GCM_SHA384",
153 "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256",
154 "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384",
155 "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256",
156 "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384",
157 "TLS_PSK_WITH_AES_128_CBC_SHA256",
158 "TLS_PSK_WITH_AES_256_CBC_SHA384",
159 "TLS_PSK_WITH_NULL_SHA256",
160 "TLS_PSK_WITH_NULL_SHA384",
161 "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256",
162 "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384",
163 "TLS_DHE_PSK_WITH_NULL_SHA256",
164 "TLS_DHE_PSK_WITH_NULL_SHA384",
165 "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256",
166 "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384",
167 "TLS_RSA_PSK_WITH_NULL_SHA256",
168 "TLS_RSA_PSK_WITH_NULL_SHA384",
169 "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256",
170 "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256",
171 "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256",
172 "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256",
173 "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
174 "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256",
175 "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256",
176 "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256",
177 "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256",
178 "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256",
179 "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256",
180 "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256");
181ENUM_NEXT(tls_cipher_suite_names, TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
37d2d7e1 182 TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
4657b3a4
AS		 183 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256,
184 "TLS_EMPTY_RENEGOTIATION_INFO_SCSV");
7a2b0266 185ENUM_NEXT(tls_cipher_suite_names, TLS_AES_128_GCM_SHA256,
186 TLS_AES_128_CCM_8_SHA256,
187 TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
188 "TLS_AES_128_GCM_SHA256",
189 "TLS_AES_256_GCM_SHA384",
190 "TLS_CHACHA20_POLY1305_SHA256",
191 "TLS_AES_128_CCM_SHA256",
192 "TLS_AES_128_CCM_8_SHA256");
4657b3a4 193ENUM_NEXT(tls_cipher_suite_names, TLS_ECDH_ECDSA_WITH_NULL_SHA,
37d2d7e1 194 TLS_ECDHE_PSK_WITH_NULL_SHA384,
7a2b0266 195 TLS_AES_128_CCM_8_SHA256,
4657b3a4
AS		 196 "TLS_ECDH_ECDSA_WITH_NULL_SHA",
197 "TLS_ECDH_ECDSA_WITH_RC4_128_SHA",
198 "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA",
199 "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA",
200 "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA",
201 "TLS_ECDHE_ECDSA_WITH_NULL_SHA",
202 "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
203 "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",
204 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
205 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
206 "TLS_ECDH_RSA_WITH_NULL_SHA",
207 "TLS_ECDH_RSA_WITH_RC4_128_SHA",
208 "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA",
209 "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA",
210 "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA",
211 "TLS_ECDHE_RSA_WITH_NULL_SHA",
212 "TLS_ECDHE_RSA_WITH_RC4_128_SHA",
213 "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
214 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
215 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
216 "TLS_ECDH_anon_WITH_NULL_SHA",
217 "TLS_ECDH_anon_WITH_RC4_128_SHA",
218 "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA",
219 "TLS_ECDH_anon_WITH_AES_128_CBC_SHA",
220 "TLS_ECDH_anon_WITH_AES_256_CBC_SHA",
221 "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA",
222 "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA",
223 "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA",
224 "TLS_SRP_SHA_WITH_AES_128_CBC_SHA",
225 "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA",
226 "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA",
227 "TLS_SRP_SHA_WITH_AES_256_CBC_SHA",
228 "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA",
229 "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA",
230 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
231 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
232 "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256",
233 "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384",
234 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
235 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
236 "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256",
237 "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384",
238 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
239 "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
240 "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256",
241 "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384",
242 "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
243 "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
244 "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256",
245 "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384",
246 "TLS_ECDHE_PSK_WITH_RC4_128_SHA",
247 "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA",
248 "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA",
249 "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA",
250 "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256",
251 "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384",
252 "TLS_ECDHE_PSK_WITH_NULL_SHA",
253 "TLS_ECDHE_PSK_WITH_NULL_SHA256",
254 "TLS_ECDHE_PSK_WITH_NULL_SHA384");
f81c04e9
PK		 255ENUM_NEXT(tls_cipher_suite_names, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
256 TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
257 TLS_ECDHE_PSK_WITH_NULL_SHA384,
258 "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
259 "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
260 "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256");
261ENUM_END(tls_cipher_suite_names, TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256);
262
4657b3a4 263
9dd2ca92
MW		 264ENUM(tls_hash_algorithm_names, TLS_HASH_NONE, TLS_HASH_SHA512,
265 "NONE",
266 "MD5",
267 "SHA1",
268 "SHA224",
269 "SHA256",
270 "SHA384",
271 "SHA512",
272);
273
1b593e1d
TB		 274ENUM_BEGIN(tls_signature_scheme_names,
275 TLS_SIG_RSA_PKCS1_SHA1, TLS_SIG_RSA_PKCS1_SHA1,
276 "RSA_PKCS1_SHA1");
277ENUM_NEXT(tls_signature_scheme_names,
278 TLS_SIG_ECDSA_SHA1, TLS_SIG_ECDSA_SHA1, TLS_SIG_RSA_PKCS1_SHA1,
279 "ECDSA_SHA1");
280ENUM_NEXT(tls_signature_scheme_names,
91c9e4d5
PK		 281 TLS_SIG_RSA_PKCS1_SHA224, TLS_SIG_ECDSA_SHA224, TLS_SIG_ECDSA_SHA1,
282 "RSA_PKCS1_SHA224",
283 "DSA_SHA224",
284 "ECDSA_SHA224");
1b593e1d 285ENUM_NEXT(tls_signature_scheme_names,
91c9e4d5
PK		 286 TLS_SIG_RSA_PKCS1_SHA256, TLS_SIG_ECDSA_SHA256, TLS_SIG_ECDSA_SHA224,
287 "RSA_PKCS1_SHA256",
288 "DSA_SHA256",
1b593e1d
TB		 289 "ECDSA_SHA256");
290ENUM_NEXT(tls_signature_scheme_names,
91c9e4d5
PK		 291 TLS_SIG_RSA_PKCS1_SHA384, TLS_SIG_ECDSA_SHA384, TLS_SIG_ECDSA_SHA256,
292 "RSA_PKCS1_SHA384",
293 "DSA_SHA384",
1b593e1d
TB		 294 "ECDSA_SHA384");
295ENUM_NEXT(tls_signature_scheme_names,
91c9e4d5
PK		 296 TLS_SIG_RSA_PKCS1_SHA512, TLS_SIG_ECDSA_SHA512, TLS_SIG_ECDSA_SHA384,
297 "RSA_PKCS1_SHA512",
298 "DSA_SHA512",
1b593e1d
TB		 299 "ECDSA_SHA512");
300ENUM_NEXT(tls_signature_scheme_names,
301 TLS_SIG_RSA_PSS_RSAE_SHA256, TLS_SIG_RSA_PSS_PSS_SHA512, TLS_SIG_ECDSA_SHA512,
302 "RSA_PSS_RSAE_SHA256",
303 "RSA_PSS_RSAE_SHA384",
304 "RSA_PSS_RSAE_SHA512",
305 "ED25519",
306 "ED448",
307 "RSA_PSS_PSS_SHA256",
308 "RSA_PSS_PSS_SHA384",
309 "RSA_PSS_PSS_SHA512",
9dd2ca92 310);
1b593e1d 311ENUM_END(tls_signature_scheme_names, TLS_SIG_RSA_PSS_PSS_SHA512);
9dd2ca92 312
99dcaea9
MW		 313ENUM_BEGIN(tls_client_certificate_type_names,
314 TLS_RSA_SIGN, TLS_DSS_EPHEMERAL_DH,
315 "RSA_SIGN",
316 "DSA_SIGN",
317 "RSA_FIXED_DH",
318 "DSS_FIXED_DH",
319 "RSA_EPHEMERAL_DH",
320 "DSS_EPHEMERAL_DH");
321ENUM_NEXT(tls_client_certificate_type_names,
322 TLS_FORTEZZA_DMS, TLS_FORTEZZA_DMS, TLS_DSS_EPHEMERAL_DH,
323 "FORTEZZA_DMS");
324ENUM_NEXT(tls_client_certificate_type_names,
325 TLS_ECDSA_SIGN, TLS_ECDSA_FIXED_ECDH, TLS_FORTEZZA_DMS,
326 "ECDSA_SIGN",
327 "RSA_FIXED_ECDH",
328 "ECDSA_FIXED_ECDH");
329ENUM_END(tls_client_certificate_type_names, TLS_ECDSA_FIXED_ECDH);
330
691ca54d
MW		 331ENUM(tls_ecc_curve_type_names, TLS_ECC_EXPLICIT_PRIME, TLS_ECC_NAMED_CURVE,
332 "EXPLICIT_PRIME",
333 "EXPLICIT_CHAR2",
334 "NAMED_CURVE",
335);
336
7a2b0266 337ENUM_BEGIN(tls_named_group_names, TLS_SECT163K1, TLS_SECP521R1,
691ca54d
MW		 338 "SECT163K1",
339 "SECT163R1",
340 "SECT163R2",
341 "SECT193R1",
342 "SECT193R2",
343 "SECT233K1",
344 "SECT233R1",
345 "SECT239K1",
346 "SECT283K1",
347 "SECT283R1",
348 "SECT409K1",
349 "SECT409R1",
350 "SECT571K1",
351 "SECT571R1",
352 "SECP160K1",
353 "SECP160R1",
354 "SECP160R2",
355 "SECP192K1",
356 "SECP192R1",
357 "SECP224K1",
358 "SECP224R1",
359 "SECP256K1",
360 "SECP256R1",
361 "SECP384R1",
362 "SECP521R1",
363);
3101120c 364ENUM_NEXT(tls_named_group_names, TLS_CURVE25519, TLS_CURVE448, TLS_SECP521R1,
7a2b0266 365 "CURVE25519",
366 "CURVE448",
367);
3101120c 368ENUM_NEXT(tls_named_group_names, TLS_FFDHE2048, TLS_FFDHE8192, TLS_CURVE448,
7a2b0266 369 "FFDHE2048",
370 "FFDHE3072",
371 "FFDHE4096",
372 "FFDHE6144",
373 "FFDHE8192",
374);
375ENUM_END(tls_named_group_names, TLS_FFDHE8192);
691ca54d 376
ec7d4e70 377ENUM(tls_ansi_point_format_names, TLS_ANSI_COMPRESSED, TLS_ANSI_HYBRID_Y,
e6cce7ff
MW		 378 "compressed",
379 "compressed y",
380 "uncompressed",
381 "uncompressed y",
382 "hybrid",
383 "hybrid y",
384);
99dcaea9 385
02281c87
MW		 386ENUM(tls_ec_point_format_names,
387 TLS_EC_POINT_UNCOMPRESSED, TLS_EC_POINT_ANSIX962_COMPRESSED_CHAR2,
388 "uncompressed",
389 "ansiX962 compressed prime",
390 "ansiX962 compressed char2",
391);
392
536dbc00
MW		 393typedef struct private_tls_crypto_t private_tls_crypto_t;
394
395/**
396 * Private data of an tls_crypto_t object.
397 */
398struct private_tls_crypto_t {
399
400 /**
401 * Public tls_crypto_t interface.
402 */
403 tls_crypto_t public;
18010de2 404
dc9f34be
MW		 405 /**
406 * Protection layer
407 */
408 tls_protection_t *protection;
409
18010de2
MW		 410 /**
411 * List of supported/acceptable cipher suites
412 */
413 tls_cipher_suite_t *suites;
414
415 /**
416 * Number of supported suites
417 */
418 int suite_count;
419
7a2b0266 420 /**
421 * HKDF for TLS 1.3
422 */
423 tls_hkdf_t *hkdf;
424
18010de2
MW		 425 /**
426 * Selected cipher suite
427 */
428 tls_cipher_suite_t suite;
429
4254257f
MW		 430 /**
431 * RSA supported?
432 */
433 bool rsa;
434
435 /**
436 * ECDSA supported?
437 */
438 bool ecdsa;
439
18010de2
MW		 440 /**
441 * TLS context
442 */
443 tls_t *tls;
444
6a5c86b7
MW		 445 /**
446 * TLS session cache
447 */
448 tls_cache_t *cache;
449
84d67ead 450 /**
2db6d5b8 451 * All handshake data concatenated
84d67ead
MW		 452 */
453 chunk_t handshake;
454
18010de2
MW		 455 /**
456 * Connection state TLS PRF
457 */
458 tls_prf_t *prf;
84543e6e
MW		 459
460 /**
d3204677 461 * AEAD transform for inbound traffic
84543e6e 462 */
d3204677 463 tls_aead_t *aead_in;
84543e6e
MW		 464
465 /**
d3204677 466 * AEAD transform for outbound traffic
84543e6e 467 */
d3204677 468 tls_aead_t *aead_out;
51313a39
MW		 469
470 /**
a6444fcd 471 * EAP-[T]TLS MSK
51313a39
MW		 472 */
473 chunk_t msk;
a6444fcd
AS		 474
475 /**
476 * ASCII string constant used as seed for EAP-[T]TLS MSK PRF
477 */
478 char *msk_label;
536dbc00
MW		 479};
480
84543e6e
MW		 481typedef struct {
482 tls_cipher_suite_t suite;
4cdade5a
MW		 483 key_type_t key;
484 diffie_hellman_group_t dh;
84543e6e
MW		 485 hash_algorithm_t hash;
486 pseudo_random_function_t prf;
487 integrity_algorithm_t mac;
488 encryption_algorithm_t encr;
489 size_t encr_size;
281766c5
TB		 490 tls_version_t min_version;
491 tls_version_t max_version;
84543e6e
MW		 492} suite_algs_t;
493
494/**
495 * Mapping suites to a set of algorithms
d107198f
PK		 496 *
497 * The order represents the descending preference of cipher suites and follows
498 * this rule set:
499 *
500 * 1. TLS 1.3 > Legacy TLS
501 * 2. AES > CAMELLIA > NULL
502 * 3. AES256 > AES128
503 * 4. GCM > CBC
504 * 5. ECDHE > DHE > NULL
505 * 6. ECDSA > RSA
506 * 7. SHA384 > SHA256 > SHA1
507 *
84543e6e
MW		 508 */
509static suite_algs_t suite_algs[] = {
7a2b0266 510 /* Cipher suites of TLS 1.3: key exchange and authentication
511 * delegated to extensions, therefore KEY_ANY, MODP_NONE, PRF_UNDEFINED */
7a2b0266 512 { TLS_AES_256_GCM_SHA384,
513 KEY_ANY, MODP_NONE,
514 HASH_SHA384, PRF_UNDEFINED,
515 AUTH_HMAC_SHA2_384_384, ENCR_AES_GCM_ICV16, 32,
281766c5 516 TLS_1_3, TLS_1_3,
7a2b0266 517 },
d107198f
PK		 518 { TLS_AES_128_GCM_SHA256,
519 KEY_ANY, MODP_NONE,
520 HASH_SHA256, PRF_UNDEFINED,
521 AUTH_HMAC_SHA2_256_256, ENCR_AES_GCM_ICV16, 16,
522 TLS_1_3, TLS_1_3,
523 },
7a2b0266 524 { TLS_CHACHA20_POLY1305_SHA256,
525 KEY_ANY, MODP_NONE,
526 HASH_SHA256, PRF_UNDEFINED,
b7ea969b 527 AUTH_HMAC_SHA2_256_256, ENCR_CHACHA20_POLY1305, 32,
281766c5 528 TLS_1_3, TLS_1_3,
7a2b0266 529 },
530 { TLS_AES_128_CCM_SHA256,
281766c5
TB		 531 KEY_ANY, MODP_NONE,
532 HASH_SHA256, PRF_UNDEFINED,
533 AUTH_HMAC_SHA2_256_256, ENCR_AES_CCM_ICV16, 16,
534 TLS_1_3, TLS_1_3,
7a2b0266 535 },
536 { TLS_AES_128_CCM_8_SHA256,
281766c5
TB		 537 KEY_ANY, MODP_NONE,
538 HASH_SHA256, PRF_UNDEFINED,
539 AUTH_HMAC_SHA2_256_256, ENCR_AES_CCM_ICV8, 16,
540 TLS_1_3, TLS_1_3,
7a2b0266 541 },
542 /* Legacy TLS cipher suites */
d107198f
PK		 543 { TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
544 KEY_ECDSA, ECP_384_BIT,
545 HASH_SHA384, PRF_HMAC_SHA2_384,
546 AUTH_UNDEFINED, ENCR_AES_GCM_ICV16, 32,
547 TLS_1_2, TLS_1_2,
2066918d 548 },
d107198f
PK		 549 { TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
550 KEY_ECDSA, ECP_384_BIT,
551 HASH_SHA384, PRF_HMAC_SHA2_384,
552 AUTH_HMAC_SHA2_384_384, ENCR_AES_CBC, 32,
281766c5 553 TLS_1_2, TLS_1_2,
2066918d
MW		 554 },
555 { TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
556 KEY_ECDSA, ECP_384_BIT,
ed57dfca 557 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 558 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 32,
281766c5 559 TLS_1_0, TLS_1_2,
2066918d 560 },
d06890d6
MW		 561 { TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
562 KEY_ECDSA, ECP_256_BIT,
563 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 564 AUTH_UNDEFINED, ENCR_AES_GCM_ICV16, 16,
281766c5 565 TLS_1_2, TLS_1_2,
d06890d6 566 },
d107198f
PK		 567 { TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
568 KEY_ECDSA, ECP_256_BIT,
569 HASH_SHA256, PRF_HMAC_SHA2_256,
570 AUTH_HMAC_SHA2_256_256, ENCR_AES_CBC, 16,
281766c5 571 TLS_1_2, TLS_1_2,
d06890d6 572 },
d107198f
PK		 573 { TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
574 KEY_ECDSA, ECP_256_BIT,
ed57dfca 575 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 576 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 16,
281766c5 577 TLS_1_0, TLS_1_2,
2066918d 578 },
d107198f 579 { TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
f9c0cf86 580 KEY_RSA, ECP_384_BIT,
d107198f
PK		 581 HASH_SHA384, PRF_HMAC_SHA2_384,
582 AUTH_UNDEFINED, ENCR_AES_GCM_ICV16, 32,
583 TLS_1_2, TLS_1_2,
2066918d
MW		 584 },
585 { TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
f9c0cf86 586 KEY_RSA, ECP_384_BIT,
2066918d 587 HASH_SHA384, PRF_HMAC_SHA2_384,
7a2b0266 588 AUTH_HMAC_SHA2_384_384, ENCR_AES_CBC, 32,
281766c5 589 TLS_1_2, TLS_1_2,
2066918d 590 },
d107198f
PK		 591 { TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
592 KEY_RSA, ECP_384_BIT,
593 HASH_SHA256, PRF_HMAC_SHA2_256,
594 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 32,
595 TLS_1_0, TLS_1_2,
596 },
d06890d6
MW		 597 { TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
598 KEY_RSA, ECP_256_BIT,
599 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 600 AUTH_UNDEFINED, ENCR_AES_GCM_ICV16, 16,
281766c5 601 TLS_1_2, TLS_1_2,
d06890d6 602 },
d107198f
PK		 603 { TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
604 KEY_RSA, ECP_256_BIT,
605 HASH_SHA256, PRF_HMAC_SHA2_256,
606 AUTH_HMAC_SHA2_256_256, ENCR_AES_CBC, 16,
281766c5 607 TLS_1_2, TLS_1_2,
d06890d6 608 },
d107198f
PK		 609 { TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
610 KEY_RSA, ECP_256_BIT,
611 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 612 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 16,
d107198f 613 TLS_1_0, TLS_1_2,
ef0a8e58 614 },
d107198f
PK		 615 { TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
616 KEY_RSA, MODP_4096_BIT,
617 HASH_SHA384, PRF_HMAC_SHA2_384,
618 AUTH_UNDEFINED, ENCR_AES_GCM_ICV16, 32,
619 TLS_1_2, TLS_1_2,
620 },
621 { TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
622 KEY_RSA, MODP_4096_BIT,
4cdade5a 623 HASH_SHA256, PRF_HMAC_SHA2_256,
d107198f 624 AUTH_HMAC_SHA2_256_256, ENCR_AES_CBC, 32,
281766c5 625 TLS_1_2, TLS_1_2,
ef0a8e58
MW		 626 },
627 { TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
4cdade5a 628 KEY_RSA, MODP_3072_BIT,
ed57dfca 629 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 630 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 32,
281766c5 631 SSL_3_0, TLS_1_2,
ef0a8e58 632 },
d107198f 633 { TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,
4cdade5a
MW		 634 KEY_RSA, MODP_4096_BIT,
635 HASH_SHA256, PRF_HMAC_SHA2_256,
d107198f 636 AUTH_HMAC_SHA2_256_256, ENCR_CAMELLIA_CBC, 32,
281766c5 637 TLS_1_2, TLS_1_2,
ef0a8e58 638 },
d107198f
PK		 639 { TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
640 KEY_RSA, MODP_3072_BIT,
641 HASH_SHA256, PRF_HMAC_SHA2_256,
642 AUTH_HMAC_SHA1_160, ENCR_CAMELLIA_CBC, 32,
643 SSL_3_0, TLS_1_2,
644 },
d06890d6
MW		 645 { TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
646 KEY_RSA, MODP_3072_BIT,
647 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 648 AUTH_UNDEFINED, ENCR_AES_GCM_ICV16, 16,
281766c5 649 TLS_1_2, TLS_1_2,
d06890d6 650 },
d107198f
PK		 651 { TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
652 KEY_RSA, MODP_3072_BIT,
653 HASH_SHA256, PRF_HMAC_SHA2_256,
654 AUTH_HMAC_SHA2_256_256, ENCR_AES_CBC, 16,
281766c5 655 TLS_1_2, TLS_1_2,
d06890d6 656 },
d107198f 657 { TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
4cdade5a 658 KEY_RSA, MODP_2048_BIT,
d107198f
PK		 659 HASH_SHA256,PRF_HMAC_SHA2_256,
660 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 16,
281766c5 661 SSL_3_0, TLS_1_2,
ef0a8e58
MW		 662 },
663 { TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
4cdade5a
MW		 664 KEY_RSA, MODP_3072_BIT,
665 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 666 AUTH_HMAC_SHA2_256_256, ENCR_CAMELLIA_CBC, 16,
281766c5 667 TLS_1_2, TLS_1_2,
ef0a8e58 668 },
d107198f 669 { TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
4cdade5a 670 KEY_RSA, MODP_2048_BIT,
ed57dfca 671 HASH_SHA256, PRF_HMAC_SHA2_256,
d107198f 672 AUTH_HMAC_SHA1_160, ENCR_CAMELLIA_CBC, 16,
281766c5 673 SSL_3_0, TLS_1_2,
ef0a8e58 674 },
d107198f 675 { TLS_RSA_WITH_AES_256_GCM_SHA384,
4cdade5a 676 KEY_RSA, MODP_NONE,
d107198f
PK		 677 HASH_SHA384, PRF_HMAC_SHA2_384,
678 AUTH_UNDEFINED, ENCR_AES_GCM_ICV16, 32,
679 TLS_1_2, TLS_1_2,
6e413d9c 680 },
d107198f 681 { TLS_RSA_WITH_AES_256_CBC_SHA256,
4cdade5a
MW		 682 KEY_RSA, MODP_NONE,
683 HASH_SHA256, PRF_HMAC_SHA2_256,
d107198f 684 AUTH_HMAC_SHA2_256_256, ENCR_AES_CBC, 32,
281766c5 685 TLS_1_2, TLS_1_2,
84543e6e
MW		 686 },
687 { TLS_RSA_WITH_AES_256_CBC_SHA,
4cdade5a 688 KEY_RSA, MODP_NONE,
ed57dfca 689 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 690 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 32,
281766c5 691 SSL_3_0, TLS_1_2,
84543e6e 692 },
d06890d6
MW		 693 { TLS_RSA_WITH_AES_128_GCM_SHA256,
694 KEY_RSA, MODP_NONE,
695 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 696 AUTH_UNDEFINED, ENCR_AES_GCM_ICV16, 16,
281766c5 697 TLS_1_2, TLS_1_2,
d06890d6 698 },
d107198f 699 { TLS_RSA_WITH_AES_128_CBC_SHA256,
d06890d6 700 KEY_RSA, MODP_NONE,
d107198f
PK		 701 HASH_SHA256, PRF_HMAC_SHA2_256,
702 AUTH_HMAC_SHA2_256_256, ENCR_AES_CBC, 16,
281766c5 703 TLS_1_2, TLS_1_2,
d06890d6 704 },
d107198f 705 { TLS_RSA_WITH_AES_128_CBC_SHA,
4cdade5a 706 KEY_RSA, MODP_NONE,
ed57dfca 707 HASH_SHA256, PRF_HMAC_SHA2_256,
d107198f 708 AUTH_HMAC_SHA1_160, ENCR_AES_CBC, 16,
281766c5 709 SSL_3_0, TLS_1_2,
6e413d9c 710 },
d107198f 711 { TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256,
4cdade5a
MW		 712 KEY_RSA, MODP_NONE,
713 HASH_SHA256, PRF_HMAC_SHA2_256,
d107198f 714 AUTH_HMAC_SHA2_256_256, ENCR_CAMELLIA_CBC, 32,
281766c5 715 TLS_1_2, TLS_1_2,
6e413d9c
MW		 716 },
717 { TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,
4cdade5a 718 KEY_RSA, MODP_NONE,
ed57dfca 719 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 720 AUTH_HMAC_SHA1_160, ENCR_CAMELLIA_CBC, 32,
281766c5 721 SSL_3_0, TLS_1_2,
6e413d9c 722 },
d107198f 723 { TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256,
4cdade5a
MW		 724 KEY_RSA, MODP_NONE,
725 HASH_SHA256, PRF_HMAC_SHA2_256,
d107198f 726 AUTH_HMAC_SHA2_256_256, ENCR_CAMELLIA_CBC, 16,
281766c5 727 TLS_1_2, TLS_1_2,
84543e6e 728 },
d107198f 729 { TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,
4cdade5a 730 KEY_RSA, MODP_NONE,
ed57dfca 731 HASH_SHA256, PRF_HMAC_SHA2_256,
d107198f 732 AUTH_HMAC_SHA1_160, ENCR_CAMELLIA_CBC, 16,
281766c5 733 SSL_3_0, TLS_1_2,
2bf0e74c 734 },
2066918d
MW		 735 { TLS_ECDHE_ECDSA_WITH_NULL_SHA,
736 KEY_ECDSA, ECP_256_BIT,
ed57dfca 737 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 738 AUTH_HMAC_SHA1_160, ENCR_NULL, 0,
281766c5 739 TLS_1_0, TLS_1_2,
2066918d
MW		 740 },
741 { TLS_ECDHE_RSA_WITH_NULL_SHA,
742 KEY_ECDSA, ECP_256_BIT,
ed57dfca 743 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 744 AUTH_HMAC_SHA1_160, ENCR_NULL, 0,
281766c5 745 TLS_1_0, TLS_1_2,
2066918d 746 },
2bf0e74c 747 { TLS_RSA_WITH_NULL_SHA256,
4cdade5a
MW		 748 KEY_RSA, MODP_NONE,
749 HASH_SHA256, PRF_HMAC_SHA2_256,
7a2b0266 750 AUTH_HMAC_SHA2_256_256, ENCR_NULL, 0,
281766c5 751 TLS_1_2, TLS_1_2,
2bf0e74c 752 },
d107198f 753 { TLS_RSA_WITH_NULL_SHA,
4cdade5a 754 KEY_RSA, MODP_NONE,
ed57dfca 755 HASH_SHA256, PRF_HMAC_SHA2_256,
d107198f
PK		 756 AUTH_HMAC_SHA1_160, ENCR_NULL, 0,
757 SSL_3_0, TLS_1_2,
2bf0e74c 758 },
84543e6e
MW		 759};
760
761/**
f3bb1bd0 762 * Look up algorithms by a suite
84543e6e
MW		 763 */
764static suite_algs_t *find_suite(tls_cipher_suite_t suite)
765{
766 int i;
767
768 for (i = 0; i < countof(suite_algs); i++)
769 {
770 if (suite_algs[i].suite == suite)
771 {
772 return &suite_algs[i];
773 }
774 }
775 return NULL;
776}
777
18010de2 778/**
a2bfc45b 779 * Filter a suite list using a transform enumerator
18010de2 780 */
ac5717c9 781static void filter_suite(suite_algs_t suites[], int *count, int offset,
a2bfc45b 782 enumerator_t*(*create_enumerator)(crypto_factory_t*))
536dbc00 783{
5932f41f 784 const char *plugin_name;
a2bfc45b 785 suite_algs_t current;
f10e7234 786 int *current_alg, i, remaining = 0;
a2bfc45b 787 enumerator_t *enumerator;
536dbc00 788
a2bfc45b 789 memset(&current, 0, sizeof(current));
f10e7234
AS		 790 current_alg = (int*)((char*)&current + offset);
791
a2bfc45b 792 for (i = 0; i < *count; i++)
536dbc00 793 {
b886dad4
MW		 794 if (create_enumerator == lib->crypto->create_crypter_enumerator &&
795 encryption_algorithm_is_aead(suites[i].encr))
796 { /* filtering crypters, but current suite uses an AEAD, apply */
797 suites[remaining] = suites[i];
798 remaining++;
799 continue;
800 }
801 if (create_enumerator == lib->crypto->create_aead_enumerator &&
802 !encryption_algorithm_is_aead(suites[i].encr))
803 { /* filtering AEADs, but current suite doesn't use one, apply */
804 suites[remaining] = suites[i];
805 remaining++;
806 continue;
807 }
a2bfc45b 808 enumerator = create_enumerator(lib->crypto);
f10e7234 809 while (enumerator->enumerate(enumerator, current_alg, &plugin_name))
536dbc00 810 {
b886dad4 811 if (current.encr && current.encr != suites[i].encr)
536dbc00 812 {
b886dad4
MW		 813 if (suites[i].encr != ENCR_NULL)
814 { /* skip, ENCR does not match nor is NULL */
815 continue;
816 }
536dbc00 817 }
b886dad4
MW		 818 if (current.mac && current.mac != suites[i].mac)
819 {
820 if (suites[i].mac != AUTH_UNDEFINED)
821 { /* skip, MAC does not match nor is it undefined */
822 continue;
823 }
824 }
825 if (current.prf && current.prf != suites[i].prf)
436571b2
TB		 826 {
827 if (suites[i].prf != PRF_UNDEFINED)
828 {
829 /* skip, PRF does not match nor is it undefined */
830 continue;
831 }
b886dad4
MW		 832 }
833 if (current.hash && current.hash != suites[i].hash)
834 { /* skip, hash does not match */
835 continue;
836 }
837 if (current.dh && current.dh != suites[i].dh)
838 {
839 if (suites[i].dh != MODP_NONE)
840 { /* skip DH group, does not match nor NONE */
841 continue;
842 }
843 }
844 /* suite supported, apply */
845 suites[remaining] = suites[i];
846 remaining++;
847 break;
536dbc00 848 }
a2bfc45b 849 enumerator->destroy(enumerator);
536dbc00 850 }
a2bfc45b
MW		 851 *count = remaining;
852}
853
96b2fbcc
MW		 854/**
855 * Purge NULL encryption cipher suites from list
856 */
ac5717c9 857static void filter_null_suites(suite_algs_t suites[], int *count)
96b2fbcc
MW		 858{
859 int i, remaining = 0;
860
861 for (i = 0; i < *count; i++)
862 {
863 if (suites[i].encr != ENCR_NULL)
864 {
865 suites[remaining] = suites[i];
866 remaining++;
867 }
868 }
869 *count = remaining;
870}
871
4254257f
MW		 872/**
873 * Purge suites using a given key type
874 */
875static void filter_key_suites(private_tls_crypto_t *this,
876 suite_algs_t suites[], int *count, key_type_t key)
877{
878 int i, remaining = 0;
879
880 DBG2(DBG_TLS, "disabling %N suites, no backend found", key_type_names, key);
881 for (i = 0; i < *count; i++)
882 {
883 if (suites[i].key != key)
884 {
885 suites[remaining] = suites[i];
886 remaining++;
887 }
888 }
889 *count = remaining;
890}
891
24a5b935
MW		 892/**
893 * Filter suites by key exchange user config
894 */
895static void filter_key_exchange_config_suites(private_tls_crypto_t *this,
896 suite_algs_t suites[], int *count)
897{
898 enumerator_t *enumerator;
899 int i, remaining = 0;
900 char *token, *config;
901
409adef4
TB		 902 config = lib->settings->get_str(lib->settings, "%s.tls.key_exchange", NULL,
903 lib->ns);
24a5b935
MW		 904 if (config)
905 {
906 for (i = 0; i < *count; i++)
907 {
908 enumerator = enumerator_create_token(config, ",", " ");
909 while (enumerator->enumerate(enumerator, &token))
910 {
911 if (strcaseeq(token, "ecdhe-ecdsa") &&
912 diffie_hellman_group_is_ec(suites[i].dh) &&
913 suites[i].key == KEY_ECDSA)
914 {
915 suites[remaining++] = suites[i];
916 break;
917 }
918 if (strcaseeq(token, "ecdhe-rsa") &&
919 diffie_hellman_group_is_ec(suites[i].dh) &&
920 suites[i].key == KEY_RSA)
921 {
922 suites[remaining++] = suites[i];
923 break;
924 }
925 if (strcaseeq(token, "dhe-rsa") &&
926 !diffie_hellman_group_is_ec(suites[i].dh) &&
927 suites[i].dh != MODP_NONE &&
928 suites[i].key == KEY_RSA)
929 {
930 suites[remaining++] = suites[i];
931 break;
932 }
933 if (strcaseeq(token, "rsa") &&
934 suites[i].dh == MODP_NONE &&
935 suites[i].key == KEY_RSA)
936 {
937 suites[remaining++] = suites[i];
938 break;
939 }
940 }
941 enumerator->destroy(enumerator);
942 }
943 *count = remaining;
944 }
945}
946
947/**
948 * Filter suites by cipher user config
949 */
950static void filter_cipher_config_suites(private_tls_crypto_t *this,
951 suite_algs_t suites[], int *count)
952{
953 enumerator_t *enumerator;
954 int i, remaining = 0;
955 char *token, *config;
956
409adef4
TB		 957 config = lib->settings->get_str(lib->settings, "%s.tls.cipher", NULL,
958 lib->ns);
24a5b935
MW		 959 if (config)
960 {
961 for (i = 0; i < *count; i++)
962 {
963 enumerator = enumerator_create_token(config, ",", " ");
964 while (enumerator->enumerate(enumerator, &token))
965 {
966 if (strcaseeq(token, "aes128") &&
967 suites[i].encr == ENCR_AES_CBC &&
968 suites[i].encr_size == 16)
969 {
970 suites[remaining++] = suites[i];
971 break;
972 }
973 if (strcaseeq(token, "aes256") &&
974 suites[i].encr == ENCR_AES_CBC &&
975 suites[i].encr_size == 32)
976 {
977 suites[remaining++] = suites[i];
978 break;
979 }
d06890d6
MW		 980 if (strcaseeq(token, "aes128gcm") &&
981 suites[i].encr == ENCR_AES_GCM_ICV16 &&
982 suites[i].encr_size == 16)
983 {
984 suites[remaining++] = suites[i];
985 break;
986 }
987 if (strcaseeq(token, "aes256gcm") &&
988 suites[i].encr == ENCR_AES_GCM_ICV16 &&
989 suites[i].encr_size == 32)
990 {
991 suites[remaining++] = suites[i];
992 break;
993 }
24a5b935
MW		 994 if (strcaseeq(token, "camellia128") &&
995 suites[i].encr == ENCR_CAMELLIA_CBC &&
996 suites[i].encr_size == 16)
997 {
998 suites[remaining++] = suites[i];
999 break;
1000 }
1001 if (strcaseeq(token, "camellia256") &&
1002 suites[i].encr == ENCR_CAMELLIA_CBC &&
1003 suites[i].encr_size == 32)
1004 {
1005 suites[remaining++] = suites[i];
1006 break;
1007 }
24a5b935
MW		 1008 if (strcaseeq(token, "null") &&
1009 suites[i].encr == ENCR_NULL)
1010 {
1011 suites[remaining++] = suites[i];
1012 break;
1013 }
1014 }
1015 enumerator->destroy(enumerator);
1016 }
1017 *count = remaining;
1018 }
1019}
1020
1021/**
1022 * Filter suites by mac user config
1023 */
1024static void filter_mac_config_suites(private_tls_crypto_t *this,
1025 suite_algs_t suites[], int *count)
1026{
1027 enumerator_t *enumerator;
1028 int i, remaining = 0;
1029 char *token, *config;
1030
409adef4
TB		 1031 config = lib->settings->get_str(lib->settings, "%s.tls.mac", NULL,
1032 lib->ns);
24a5b935
MW		 1033 if (config)
1034 {
1035 for (i = 0; i < *count; i++)
1036 {
1037 enumerator = enumerator_create_token(config, ",", " ");
1038 while (enumerator->enumerate(enumerator, &token))
1039 {
24a5b935 1040 if (strcaseeq(token, "sha1") &&
1dabf5bf 1041 suites[i].mac == AUTH_HMAC_SHA1_160)
24a5b935
MW		 1042 {
1043 suites[remaining++] = suites[i];
1044 break;
1045 }
1046 if (strcaseeq(token, "sha256") &&
1dabf5bf 1047 suites[i].mac == AUTH_HMAC_SHA2_256_256)
24a5b935
MW		 1048 {
1049 suites[remaining++] = suites[i];
1050 break;
1051 }
1052 if (strcaseeq(token, "sha384") &&
1dabf5bf 1053 suites[i].mac == AUTH_HMAC_SHA2_384_384)
24a5b935
MW		 1054 {
1055 suites[remaining++] = suites[i];
1056 break;
1057 }
1058 }
1059 enumerator->destroy(enumerator);
1060 }
1061 *count = remaining;
1062 }
1063}
1064
adb913ad
MW		 1065/**
1066 * Filter for specific suites specified in strongswan.conf
1067 */
1068static void filter_specific_config_suites(private_tls_crypto_t *this,
1069 suite_algs_t suites[], int *count)
1070{
1071 enumerator_t *enumerator;
1072 int i, remaining = 0, suite;
1073 char *token, *config;
1074
409adef4
TB		 1075 config = lib->settings->get_str(lib->settings, "%s.tls.suites", NULL,
1076 lib->ns);
adb913ad
MW		 1077 if (config)
1078 {
1079 for (i = 0; i < *count; i++)
1080 {
1081 enumerator = enumerator_create_token(config, ",", " ");
1082 while (enumerator->enumerate(enumerator, &token))
1083 {
064fe9c9
MW		 1084 if (enum_from_name(tls_cipher_suite_names, token, &suite) &&
1085 suite == suites[i].suite)
adb913ad
MW		 1086 {
1087 suites[remaining++] = suites[i];
1088 break;
1089 }
1090 }
1091 enumerator->destroy(enumerator);
1092 }
1093 *count = remaining;
1094 }
1095}
1096
e53bee9d
PK		 1097/**
1098 * Filter key exchange curves by curve user config
1099 */
1100static bool filter_curve_config(tls_named_group_t curve)
1101{
1102 enumerator_t *enumerator;
1103 char *token, *config;
1104
1105 config = lib->settings->get_str(lib->settings, "%s.tls.curve", NULL, lib->ns);
1106 if (config)
1107 {
1108 enumerator = enumerator_create_token(config, ",", " ");
1109 while (enumerator->enumerate(enumerator, &token))
1110 {
1111 const proposal_token_t *tok;
1112
1113 tok = lib->proposal->get_token(lib->proposal, token);
1114 if (tok != NULL && tok->type == DIFFIE_HELLMAN_GROUP &&
1115 curve == tls_ec_group_to_curve(tok->algorithm))
1116 {
1117 enumerator->destroy(enumerator);
1118 return TRUE;
1119 }
1120 }
1121 enumerator->destroy(enumerator);
1122 }
1123 return !config;
1124}
1125
ac5717c9
MW		 1126/**
1127 * Filter out unsupported suites on given suite array
1128 */
1129static void filter_unsupported_suites(suite_algs_t suites[], int *count)
1130{
1131 /* filter suite list by each algorithm */
436571b2
TB		 1132 filter_suite(suites, count, offsetof(suite_algs_t, encr),
1133 lib->crypto->create_aead_enumerator);
1134 filter_suite(suites, count, offsetof(suite_algs_t, prf),
1135 lib->crypto->create_prf_enumerator);
ac5717c9
MW		 1136 filter_suite(suites, count, offsetof(suite_algs_t, encr),
1137 lib->crypto->create_crypter_enumerator);
ac5717c9
MW		 1138 filter_suite(suites, count, offsetof(suite_algs_t, mac),
1139 lib->crypto->create_signer_enumerator);
ac5717c9
MW		 1140 filter_suite(suites, count, offsetof(suite_algs_t, hash),
1141 lib->crypto->create_hasher_enumerator);
1142 filter_suite(suites, count, offsetof(suite_algs_t, dh),
1143 lib->crypto->create_dh_enumerator);
1144}
1145
a2bfc45b
MW		 1146/**
1147 * Initialize the cipher suite list
1148 */
43c8f950 1149static void build_cipher_suite_list(private_tls_crypto_t *this)
a2bfc45b
MW		 1150{
1151 suite_algs_t suites[countof(suite_algs)];
8a6edc08 1152 tls_version_t min_version, max_version, new_min_version, new_max_version;
43c8f950 1153 bool require_encryption;
281766c5 1154 int count = 0, i;
536dbc00 1155
43c8f950
TB		 1156 switch (this->tls->get_purpose(this->tls))
1157 {
1158 case TLS_PURPOSE_EAP_TLS:
1159 case TLS_PURPOSE_GENERIC_NULLOK:
1160 require_encryption = FALSE;
1161 break;
1162 case TLS_PURPOSE_EAP_PEAP:
1163 case TLS_PURPOSE_EAP_TTLS:
1164 case TLS_PURPOSE_GENERIC:
1165 require_encryption = TRUE;
1166 break;
1167 default:
1168 return;
1169 }
1170
281766c5
TB		 1171 min_version = this->tls->get_version_min(this->tls);
1172 max_version = this->tls->get_version_max(this->tls);
1173
1174 /* copy all suites appropriate for the current min/max versions */
1175 for (i = 0; i < countof(suite_algs); i++)
536dbc00 1176 {
281766c5
TB		 1177 if (suite_algs[i].min_version <= max_version &&
1178 suite_algs[i].max_version >= min_version)
1179 {
1180 suites[count++] = suite_algs[i];
1181 }
18010de2 1182 }
ac5717c9 1183
96b2fbcc
MW		 1184 if (require_encryption)
1185 {
ac5717c9 1186 filter_null_suites(suites, &count);
96b2fbcc 1187 }
4254257f
MW		 1188 if (!this->rsa)
1189 {
1190 filter_key_suites(this, suites, &count, KEY_RSA);
1191 }
1192 if (!this->ecdsa)
1193 {
1194 filter_key_suites(this, suites, &count, KEY_ECDSA);
1195 }
1196
ac5717c9 1197 filter_unsupported_suites(suites, &count);
a2bfc45b 1198
24a5b935
MW		 1199 /* filter suites with strongswan.conf options */
1200 filter_key_exchange_config_suites(this, suites, &count);
1201 filter_cipher_config_suites(this, suites, &count);
1202 filter_mac_config_suites(this, suites, &count);
adb913ad 1203 filter_specific_config_suites(this, suites, &count);
24a5b935 1204
56a1167b
AS		 1205 free(this->suites);
1206 this->suite_count = count;
1207 this->suites = malloc(sizeof(tls_cipher_suite_t) * count);
1208
3c19b346 1209 DBG2(DBG_TLS, "%d supported TLS cipher suites:", count);
8a6edc08
PK		 1210 new_min_version = max_version;
1211 new_max_version = min_version;
a2bfc45b
MW		 1212 for (i = 0; i < count; i++)
1213 {
3c19b346 1214 DBG2(DBG_TLS, " %N", tls_cipher_suite_names, suites[i].suite);
56a1167b 1215 this->suites[i] = suites[i].suite;
8a6edc08
PK		 1216
1217 /* set TLS min/max versions appropriate to the final cipher suites */
1218 new_max_version = max(new_max_version, suites[i].max_version);
1219 new_min_version = min(new_min_version, suites[i].min_version);
1220 }
1221 new_max_version = min(new_max_version, max_version);
1222 new_min_version = max(new_min_version, min_version);
1223
1224 if (min_version != new_min_version || max_version != new_max_version)
1225 {
1226 this->tls->set_version(this->tls, new_min_version, new_max_version);
1227 DBG2(DBG_TLS, "TLS min/max %N/%N according to the cipher suites",
1228 tls_version_names, new_min_version,
1229 tls_version_names, new_max_version);
a2bfc45b 1230 }
18010de2
MW		 1231}
1232
1233METHOD(tls_crypto_t, get_cipher_suites, int,
1234 private_tls_crypto_t *this, tls_cipher_suite_t **suites)
1235{
43c8f950
TB		 1236 if (!this->suites)
1237 {
1238 build_cipher_suite_list(this);
1239 }
06424efa
TB		 1240 if (suites)
1241 {
1242 *suites = this->suites;
1243 }
18010de2
MW		 1244 return this->suite_count;
1245}
1246
d3204677
MW		 1247/**
1248 * Create NULL encryption transforms
1249 */
1250static bool create_null(private_tls_crypto_t *this, suite_algs_t *algs)
1251{
1252 this->aead_in = tls_aead_create_null(algs->mac);
1253 this->aead_out = tls_aead_create_null(algs->mac);
1254 if (!this->aead_in || !this->aead_out)
1255 {
1256 DBG1(DBG_TLS, "selected TLS MAC %N not supported",
1257 integrity_algorithm_names, algs->mac);
1258 return FALSE;
1259 }
1260 return TRUE;
1261}
1262
1263/**
1264 * Create traditional transforms
1265 */
1266static bool create_traditional(private_tls_crypto_t *this, suite_algs_t *algs)
1267{
7a2b0266 1268 if (this->tls->get_version_max(this->tls) < TLS_1_1)
d3204677
MW		 1269 {
1270 this->aead_in = tls_aead_create_implicit(algs->mac,
1271 algs->encr, algs->encr_size);
1272 this->aead_out = tls_aead_create_implicit(algs->mac,
1273 algs->encr, algs->encr_size);
1274 }
1275 else
1276 {
1277 this->aead_in = tls_aead_create_explicit(algs->mac,
1278 algs->encr, algs->encr_size);
1279 this->aead_out = tls_aead_create_explicit(algs->mac,
1280 algs->encr, algs->encr_size);
1281 }
1282 if (!this->aead_in || !this->aead_out)
1283 {
1284 DBG1(DBG_TLS, "selected TLS transforms %N-%u-%N not supported",
1285 encryption_algorithm_names, algs->encr, algs->encr_size * 8,
1286 integrity_algorithm_names, algs->mac);
1287 return FALSE;
1288 }
1289 return TRUE;
1290}
1291
f0f30117
MW		 1292/**
1293 * Create AEAD transforms
1294 */
1295static bool create_aead(private_tls_crypto_t *this, suite_algs_t *algs)
1296{
7a2b0266 1297 if (this->tls->get_version_max(this->tls) < TLS_1_3)
1298 {
1299 this->aead_in = tls_aead_create_aead(algs->encr, algs->encr_size);
1300 this->aead_out = tls_aead_create_aead(algs->encr, algs->encr_size);
1301 }
1302 else
1303 {
1304 this->aead_in = tls_aead_create_seq(algs->encr, algs->encr_size);
1305 this->aead_out = tls_aead_create_seq(algs->encr, algs->encr_size);
7a2b0266 1306 }
f0f30117
MW		 1307 if (!this->aead_in || !this->aead_out)
1308 {
1309 DBG1(DBG_TLS, "selected TLS transforms %N-%u not supported",
1310 encryption_algorithm_names, algs->encr, algs->encr_size * 8);
1311 return FALSE;
1312 }
1313 return TRUE;
1314}
1315
d3204677
MW		 1316/**
1317 * Clean up and unset AEAD transforms
1318 */
1319static void destroy_aeads(private_tls_crypto_t *this)
1320{
1321 DESTROY_IF(this->aead_in);
1322 DESTROY_IF(this->aead_out);
1323 this->aead_in = this->aead_out = NULL;
1324}
1325
84543e6e
MW		 1326/**
1327 * Create crypto primitives
1328 */
4cdade5a 1329static bool create_ciphers(private_tls_crypto_t *this, suite_algs_t *algs)
84543e6e 1330{
d3204677 1331 destroy_aeads(this);
64e63c68 1332 DESTROY_IF(this->hkdf);
84543e6e 1333 DESTROY_IF(this->prf);
7a2b0266 1334 if (this->tls->get_version_max(this->tls) < TLS_1_3)
84543e6e 1335 {
7a2b0266 1336 if (this->tls->get_version_max(this->tls) < TLS_1_2)
1337 {
1338 this->prf = tls_prf_create_10();
1339 }
1340 else
1341 {
1342 this->prf = tls_prf_create_12(algs->prf);
1343 }
1344 if (!this->prf)
1345 {
1346 DBG1(DBG_TLS, "selected TLS PRF not supported");
1347 return FALSE;
1348 }
84543e6e
MW		 1349 }
1350 else
1351 {
7a2b0266 1352 this->hkdf = tls_hkdf_create(algs->hash, chunk_empty);
1353 if (!this->hkdf)
1354 {
1355 DBG1(DBG_TLS, "TLS HKDF creation unsuccessful");
1356 return FALSE;
1357 }
84543e6e 1358 }
84543e6e
MW		 1359 if (algs->encr == ENCR_NULL)
1360 {
d3204677
MW		 1361 if (create_null(this, algs))
1362 {
1363 return TRUE;
1364 }
84543e6e 1365 }
f0f30117
MW		 1366 else if (encryption_algorithm_is_aead(algs->encr))
1367 {
1368 if (create_aead(this, algs))
1369 {
1370 return TRUE;
1371 }
1372 }
84543e6e
MW		 1373 else
1374 {
d3204677 1375 if (create_traditional(this, algs))
84543e6e 1376 {
d3204677 1377 return TRUE;
84543e6e
MW		 1378 }
1379 }
d3204677
MW		 1380 destroy_aeads(this);
1381 return FALSE;
84543e6e
MW		 1382}
1383
18010de2 1384METHOD(tls_crypto_t, select_cipher_suite, tls_cipher_suite_t,
4cdade5a
MW		 1385 private_tls_crypto_t *this, tls_cipher_suite_t *suites, int count,
1386 key_type_t key)
18010de2 1387{
4cdade5a 1388 suite_algs_t *algs;
18010de2
MW		 1389 int i, j;
1390
1391 for (i = 0; i < this->suite_count; i++)
1392 {
1393 for (j = 0; j < count; j++)
1394 {
1395 if (this->suites[i] == suites[j])
1396 {
4cdade5a
MW		 1397 algs = find_suite(this->suites[i]);
1398 if (algs)
84543e6e 1399 {
34f66ce6
PK		 1400 if (key == KEY_ANY || key == algs->key ||
1401 (algs->key == KEY_ECDSA && key == KEY_ED25519) ||
1402 (algs->key == KEY_ECDSA && key == KEY_ED448))
4cdade5a
MW		 1403 {
1404 if (create_ciphers(this, algs))
1405 {
1406 this->suite = this->suites[i];
1407 return this->suite;
1408 }
1409 }
84543e6e 1410 }
18010de2
MW		 1411 }
1412 }
1413 }
1414 return 0;
1415}
1416
35d9c15d
MW		 1417METHOD(tls_crypto_t, get_dh_group, diffie_hellman_group_t,
1418 private_tls_crypto_t *this)
1419{
1420 suite_algs_t *algs;
1421
1422 algs = find_suite(this->suite);
1423 if (algs)
1424 {
1425 return algs->dh;
1426 }
1427 return MODP_NONE;
1428}
1429
48d6b57c 1430/**
1b593e1d
TB		 1431 * Parameters for RSA/PSS signature schemes
1432 */
1433#define PSS_PARAMS(bits) static rsa_pss_params_t pss_params_sha##bits = { \
1434 .hash = HASH_SHA##bits, \
1435 .mgf1_hash = HASH_SHA##bits, \
1436 .salt_len = HASH_SIZE_SHA##bits, \
1437}
1438
1439PSS_PARAMS(256);
1440PSS_PARAMS(384);
1441PSS_PARAMS(512);
1442
1443/**
1444 * Map TLS signature schemes, ordered by preference
48d6b57c
MW		 1445 */
1446static struct {
1b593e1d
TB		 1447 tls_signature_scheme_t sig;
1448 signature_params_t params;
1449 /* min/max versions for use in CertificateVerify */
1450 tls_version_t min_version;
1451 tls_version_t max_version;
48d6b57c 1452} schemes[] = {
1b593e1d
TB		 1453 { TLS_SIG_ECDSA_SHA256, { .scheme = SIGN_ECDSA_WITH_SHA256_DER },
1454 TLS_1_0, TLS_1_3 },
1455 { TLS_SIG_ECDSA_SHA384, { .scheme = SIGN_ECDSA_WITH_SHA384_DER },
1456 TLS_1_0, TLS_1_3 },
1457 { TLS_SIG_ECDSA_SHA512, { .scheme = SIGN_ECDSA_WITH_SHA512_DER },
1458 TLS_1_0, TLS_1_3 },
1459 { TLS_SIG_ED25519, { .scheme = SIGN_ED25519 },
34f66ce6 1460 TLS_1_0, TLS_1_3 },
1b593e1d 1461 { TLS_SIG_ED448, { .scheme = SIGN_ED448 },
34f66ce6 1462 TLS_1_0, TLS_1_3 },
1b593e1d
TB		 1463 { TLS_SIG_RSA_PSS_RSAE_SHA256, { .scheme = SIGN_RSA_EMSA_PSS, .params = &pss_params_sha256, },
1464 TLS_1_2, TLS_1_3 },
1465 { TLS_SIG_RSA_PSS_RSAE_SHA384, { .scheme = SIGN_RSA_EMSA_PSS, .params = &pss_params_sha384, },
1466 TLS_1_2, TLS_1_3 },
1467 { TLS_SIG_RSA_PSS_RSAE_SHA512, { .scheme = SIGN_RSA_EMSA_PSS, .params = &pss_params_sha512, },
1468 TLS_1_2, TLS_1_3 },
1469 /* the parameters for the next three should actually be taken from the
1470 * public key, we currently don't have an API for that, so assume defaults */
1471 { TLS_SIG_RSA_PSS_PSS_SHA256, { .scheme = SIGN_RSA_EMSA_PSS, .params = &pss_params_sha256, },
1472 TLS_1_2, TLS_1_3 },
1473 { TLS_SIG_RSA_PSS_PSS_SHA384, { .scheme = SIGN_RSA_EMSA_PSS, .params = &pss_params_sha384, },
1474 TLS_1_2, TLS_1_3 },
1475 { TLS_SIG_RSA_PSS_PSS_SHA512, { .scheme = SIGN_RSA_EMSA_PSS, .params = &pss_params_sha512, },
1476 TLS_1_2, TLS_1_3 },
1477 { TLS_SIG_RSA_PKCS1_SHA256, { .scheme = SIGN_RSA_EMSA_PKCS1_SHA2_256 },
1478 TLS_1_0, TLS_1_2 },
1479 { TLS_SIG_RSA_PKCS1_SHA384, { .scheme = SIGN_RSA_EMSA_PKCS1_SHA2_384 },
1480 TLS_1_0, TLS_1_2 },
1481 { TLS_SIG_RSA_PKCS1_SHA512, { .scheme = SIGN_RSA_EMSA_PKCS1_SHA2_512 },
1482 TLS_1_0, TLS_1_2 },
48d6b57c
MW		 1483};
1484
d29a82a9 1485METHOD(tls_crypto_t, get_signature_algorithms, void,
1b593e1d 1486 private_tls_crypto_t *this, bio_writer_t *writer, bool cert)
d29a82a9 1487{
7e432eff 1488 bio_writer_t *supported;
1b593e1d 1489 tls_version_t min_version, max_version;
48d6b57c 1490 int i;
d29a82a9 1491
7e432eff 1492 supported = bio_writer_create(32);
1b593e1d
TB		 1493
1494 if (!cert)
1495 {
1496 min_version = this->tls->get_version_min(this->tls);
1497 max_version = this->tls->get_version_max(this->tls);
1498 }
48d6b57c
MW		 1499
1500 for (i = 0; i < countof(schemes); i++)
d29a82a9 1501 {
1b593e1d
TB		 1502 if ((cert || (schemes[i].min_version <= max_version &&
1503 schemes[i].max_version >= min_version)) &&
1504 lib->plugins->has_feature(lib->plugins,
1505 PLUGIN_PROVIDE(PUBKEY_VERIFY, schemes[i].params.scheme)))
d29a82a9 1506 {
1b593e1d 1507 supported->write_uint16(supported, schemes[i].sig);
7a2b0266 1508 }
d29a82a9 1509 }
d29a82a9
MW		 1510
1511 writer->write_data16(writer, supported->get_buf(supported));
1512 supported->destroy(supported);
1513}
1514
48d6b57c 1515/**
1b593e1d 1516 * Get the signature parameters from a TLS signature scheme
48d6b57c 1517 */
06112f3f
PK		 1518static signature_params_t *params_for_scheme(tls_signature_scheme_t sig,
1519 bool sign)
48d6b57c
MW		 1520{
1521 int i;
1522
1b593e1d 1523 for (i = 0; i < countof(schemes); i++)
48d6b57c 1524 {
7fbe2e27 1525 /* strongSwan supports only RSA_PSS_RSAE schemes for signing but can
06112f3f
PK		 1526 * verify public keys in rsaEncryption as well as rsassaPss encoding. */
1527 if (sign && (sig == TLS_SIG_RSA_PSS_PSS_SHA256 ||
1528 sig == TLS_SIG_RSA_PSS_PSS_SHA384 ||
1529 sig == TLS_SIG_RSA_PSS_PSS_SHA512))
7fbe2e27
PK		 1530 {
1531 continue;
1532 }
1b593e1d 1533 if (schemes[i].sig == sig)
48d6b57c 1534 {
1b593e1d 1535 return &schemes[i].params;
48d6b57c
MW		 1536 }
1537 }
1b593e1d 1538 return NULL;
48d6b57c
MW		 1539}
1540
3f7bb88b
MW		 1541/**
1542 * Mapping groups to TLS named curves
1543 */
1544static struct {
1545 diffie_hellman_group_t group;
7a2b0266 1546 tls_named_group_t curve;
3f7bb88b
MW		 1547} curves[] = {
1548 { ECP_256_BIT, TLS_SECP256R1},
1549 { ECP_384_BIT, TLS_SECP384R1},
1550 { ECP_521_BIT, TLS_SECP521R1},
1551 { ECP_224_BIT, TLS_SECP224R1},
1552 { ECP_192_BIT, TLS_SECP192R1},
3101120c
TB		 1553 { CURVE_25519, TLS_CURVE25519},
1554 { CURVE_448, TLS_CURVE448},
3f7bb88b
MW		 1555};
1556
525cc46c
TB		 1557CALLBACK(group_filter, bool,
1558 void *null, enumerator_t *orig, va_list args)
3f7bb88b 1559{
e53bee9d
PK		 1560 diffie_hellman_group_t group, *group_out;
1561 tls_named_group_t curve, *curve_out;
525cc46c 1562 char *plugin;
3f7bb88b 1563
e53bee9d 1564 VA_ARGS_VGET(args, group_out, curve_out);
525cc46c
TB		 1565
1566 while (orig->enumerate(orig, &group, &plugin))
3f7bb88b 1567 {
e53bee9d
PK		 1568 curve = tls_ec_group_to_curve(group);
1569 if (curve)
3f7bb88b 1570 {
e53bee9d 1571 if (group_out)
3f7bb88b 1572 {
e53bee9d
PK		 1573 *group_out = group;
1574 }
1575 if (curve_out)
1576 {
1577 *curve_out = curve;
1578 }
1579 return TRUE;
1580 }
1581 }
1582 return FALSE;
1583}
1584
1585CALLBACK(config_filter, bool,
1586 void *null, enumerator_t *orig, va_list args)
1587{
1588 diffie_hellman_group_t group, *group_out;
1589 tls_named_group_t curve, *curve_out;
1590
1591 VA_ARGS_VGET(args, group_out, curve_out);
1592
1593 while (orig->enumerate(orig, &group, &curve))
1594 {
1595 if (filter_curve_config(curve))
1596 {
1597 if (group_out)
1598 {
1599 *group_out = group;
3f7bb88b 1600 }
e53bee9d
PK		 1601 if (curve_out)
1602 {
1603 *curve_out = curve;
1604 }
1605 return TRUE;
3f7bb88b
MW		 1606 }
1607 }
1608 return FALSE;
1609}
1610
1611METHOD(tls_crypto_t, create_ec_enumerator, enumerator_t*,
1612 private_tls_crypto_t *this)
37a59a8f 1613{
3f7bb88b 1614 return enumerator_create_filter(
e53bee9d
PK		 1615 enumerator_create_filter(
1616 lib->crypto->create_dh_enumerator(lib->crypto),
1617 group_filter, NULL, NULL),
1618 config_filter, NULL, NULL);
37a59a8f
MW		 1619}
1620
dc9f34be
MW		 1621METHOD(tls_crypto_t, set_protection, void,
1622 private_tls_crypto_t *this, tls_protection_t *protection)
1623{
1624 this->protection = protection;
1625}
1626
84d67ead
MW		 1627METHOD(tls_crypto_t, append_handshake, void,
1628 private_tls_crypto_t *this, tls_handshake_type_t type, chunk_t data)
1629{
b12c53ce 1630 uint32_t header;
84d67ead
MW		 1631
1632 /* reconstruct handshake header */
1633 header = htonl(data.len | (type << 24));
1634 this->handshake = chunk_cat("mcc", this->handshake,
1635 chunk_from_thing(header), data);
1636}
1637
1638/**
d29a82a9 1639 * Create a hash using the suites HASH algorithm
84d67ead 1640 */
d29a82a9 1641static bool hash_data(private_tls_crypto_t *this, chunk_t data, chunk_t *hash)
84d67ead 1642{
7a2b0266 1643 if (this->tls->get_version_max(this->tls) >= TLS_1_2)
84d67ead
MW		 1644 {
1645 hasher_t *hasher;
1646 suite_algs_t *alg;
1647
1648 alg = find_suite(this->suite);
1649 if (!alg)
1650 {
1651 return FALSE;
1652 }
1653 hasher = lib->crypto->create_hasher(lib->crypto, alg->hash);
87dd205b 1654 if (!hasher || !hasher->allocate_hash(hasher, data, hash))
84d67ead 1655 {
3c19b346 1656 DBG1(DBG_TLS, "%N not supported", hash_algorithm_names, alg->hash);
87dd205b 1657 DESTROY_IF(hasher);
84d67ead
MW		 1658 return FALSE;
1659 }
84d67ead
MW		 1660 hasher->destroy(hasher);
1661 }
1662 else
1663 {
1664 hasher_t *md5, *sha1;
1665 char buf[HASH_SIZE_MD5 + HASH_SIZE_SHA1];
1666
1667 md5 = lib->crypto->create_hasher(lib->crypto, HASH_MD5);
8bd6a30a 1668 if (!md5 || !md5->get_hash(md5, data, buf))
84d67ead 1669 {
3c19b346 1670 DBG1(DBG_TLS, "%N not supported", hash_algorithm_names, HASH_MD5);
8bd6a30a 1671 DESTROY_IF(md5);
84d67ead
MW		 1672 return FALSE;
1673 }
84d67ead
MW		 1674 md5->destroy(md5);
1675 sha1 = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
8bd6a30a 1676 if (!sha1 || !sha1->get_hash(sha1, data, buf + HASH_SIZE_MD5))
84d67ead 1677 {
3c19b346 1678 DBG1(DBG_TLS, "%N not supported", hash_algorithm_names, HASH_SHA1);
8bd6a30a 1679 DESTROY_IF(sha1);
84d67ead
MW		 1680 return FALSE;
1681 }
84d67ead
MW		 1682 sha1->destroy(sha1);
1683
1684 *hash = chunk_clone(chunk_from_thing(buf));
1685 }
1686 return TRUE;
1687}
1688
2271d67f
TB		 1689METHOD(tls_crypto_t, hash_handshake, bool,
1690 private_tls_crypto_t *this, chunk_t *out)
1691{
1692 chunk_t hash;
1693
1694 if (!hash_data(this, this->handshake, &hash))
1695 {
1696 return FALSE;
1697 }
1698
1699 chunk_free(&this->handshake);
1700 append_handshake(this, TLS_MESSAGE_HASH, hash);
1701
1702 if (out)
1703 {
1704 *out = hash;
1705 }
1706 else
1707 {
1708 free(hash.ptr);
1709 }
1710 return TRUE;
1711}
1712
de983a3c
TB		 1713/**
1714 * TLS 1.3 static part of the data the server signs (64 spaces followed by the
1715 * context string "TLS 1.3, server CertificateVerify" and a 0 byte).
1716 */
1717static chunk_t tls13_sig_data_server = chunk_from_chars(
1718 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1719 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1720 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1721 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1722 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1723 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1724 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1725 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
1726 0x54, 0x4c, 0x53, 0x20, 0x31, 0x2e, 0x33, 0x2c,
1727 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20,
1728 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
1729 0x61, 0x74, 0x65, 0x56, 0x65, 0x72, 0x69, 0x66,
1730 0x79, 0x00,
1731);
1732
d29a82a9 1733METHOD(tls_crypto_t, sign, bool,
7e432eff 1734 private_tls_crypto_t *this, private_key_t *key, bio_writer_t *writer,
d29a82a9 1735 chunk_t data, chunk_t hashsig)
dbb7c030 1736{
7a2b0266 1737 if (this->tls->get_version_max(this->tls) >= TLS_1_2)
84d67ead 1738 {
1b593e1d
TB		 1739 /* fallback to SHA1/RSA and SHA1/ECDSA */
1740 const chunk_t hashsig_def = chunk_from_chars(0x02, 0x01, 0x02, 0x03);
1741 signature_params_t *params;
1742 key_type_t type;
1743 uint16_t scheme;
7e432eff 1744 bio_reader_t *reader;
dbb7c030
MW		 1745 chunk_t sig;
1746 bool done = FALSE;
1747
7fbe2e27
PK		 1748 if (this->tls->get_version_max(this->tls) >= TLS_1_3)
1749 {
1750 chunk_t transcript_hash;
1751
1752 if (!hash_data(this, data, &transcript_hash))
1753 {
1754 DBG1(DBG_TLS, "unable to create transcript hash");
1755 return FALSE;
1756 }
1757 data = chunk_cata("cm", tls13_sig_data_server, transcript_hash);
1758 }
1759
d29a82a9
MW		 1760 if (!hashsig.len)
1761 { /* fallback if none given */
d5cf2d1f 1762 hashsig = hashsig_def;
d29a82a9 1763 }
1b593e1d 1764 type = key->get_type(key);
7e432eff 1765 reader = bio_reader_create(hashsig);
dbb7c030 1766 while (reader->remaining(reader) >= 2)
400df4ca 1767 {
1b593e1d 1768 if (reader->read_uint16(reader, &scheme))
dbb7c030 1769 {
06112f3f 1770 params = params_for_scheme(scheme, TRUE);
1b593e1d
TB		 1771 if (params &&
1772 type == key_type_from_signature_scheme(params->scheme) &&
1773 key->sign(key, params->scheme, params->params, data, &sig))
dbb7c030
MW		 1774 {
1775 done = TRUE;
1776 break;
1777 }
1778 }
1779 }
1780 reader->destroy(reader);
1781 if (!done)
1782 {
1783 DBG1(DBG_TLS, "none of the proposed hash/sig algorithms supported");
400df4ca
MW		 1784 return FALSE;
1785 }
1b593e1d
TB		 1786 DBG2(DBG_TLS, "created signature with %N", tls_signature_scheme_names,
1787 scheme);
1788 writer->write_uint16(writer, scheme);
400df4ca
MW		 1789 writer->write_data16(writer, sig);
1790 free(sig.ptr);
1791 }
1792 else
1793 {
dbb7c030 1794 chunk_t sig, hash;
d29a82a9 1795 bool done;
dbb7c030
MW		 1796
1797 switch (key->get_type(key))
400df4ca 1798 {
dbb7c030 1799 case KEY_RSA:
d29a82a9 1800 if (!hash_data(this, data, &hash))
dbb7c030
MW		 1801 {
1802 return FALSE;
1803 }
de280c2e
TB		 1804 done = key->sign(key, SIGN_RSA_EMSA_PKCS1_NULL, NULL, hash,
1805 &sig);
d29a82a9
MW		 1806 free(hash.ptr);
1807 if (!done)
dbb7c030 1808 {
dbb7c030
MW		 1809 return FALSE;
1810 }
d29a82a9 1811 DBG2(DBG_TLS, "created signature with MD5+SHA1/RSA");
dbb7c030
MW		 1812 break;
1813 case KEY_ECDSA:
de280c2e 1814 if (!key->sign(key, SIGN_ECDSA_WITH_SHA1_DER, NULL, data, &sig))
dbb7c030
MW		 1815 {
1816 return FALSE;
1817 }
d29a82a9 1818 DBG2(DBG_TLS, "created signature with SHA1/ECDSA");
dbb7c030 1819 break;
34f66ce6
PK		 1820 case KEY_ED25519:
1821 if (!key->sign(key, SIGN_ED25519, NULL, data, &sig))
1822 {
1823 return FALSE;
1824 }
1825 DBG2(DBG_TLS, "created signature with Ed25519");
1826 break;
1827 case KEY_ED448:
1828 if (!key->sign(key, SIGN_ED448, NULL, data, &sig))
1829 {
1830 return FALSE;
1831 }
1832 DBG2(DBG_TLS, "created signature with Ed448");
1833 break;
dbb7c030
MW		 1834 default:
1835 return FALSE;
400df4ca
MW		 1836 }
1837 writer->write_data16(writer, sig);
400df4ca
MW		 1838 free(sig.ptr);
1839 }
1840 return TRUE;
1841}
1842
d29a82a9 1843METHOD(tls_crypto_t, verify, bool,
7e432eff 1844 private_tls_crypto_t *this, public_key_t *key, bio_reader_t *reader,
d29a82a9 1845 chunk_t data)
400df4ca 1846{
de983a3c 1847 if (this->tls->get_version_max(this->tls) >= TLS_1_2)
7a2b0266 1848 {
1b593e1d
TB		 1849 signature_params_t *params;
1850 uint16_t scheme;
de983a3c 1851 chunk_t sig;
7a2b0266 1852
1b593e1d 1853 if (!reader->read_uint16(reader, &scheme) ||
7a2b0266 1854 !reader->read_data16(reader, &sig))
1855 {
1856 DBG1(DBG_TLS, "received invalid signature");
1857 return FALSE;
1858 }
06112f3f 1859 params = params_for_scheme(scheme, FALSE);
1b593e1d 1860 if (!params)
7a2b0266 1861 {
1b593e1d
TB		 1862 DBG1(DBG_TLS, "signature algorithms %N not supported",
1863 tls_signature_scheme_names, scheme);
7a2b0266 1864 return FALSE;
1865 }
de983a3c 1866 if (this->tls->get_version_max(this->tls) == TLS_1_3)
7a2b0266 1867 {
de983a3c 1868 chunk_t transcript_hash;
84d67ead 1869
de983a3c
TB		 1870 if (!hash_data(this, data, &transcript_hash))
1871 {
1872 DBG1(DBG_TLS, "Unable to create transcript hash");
1873 return FALSE;
1874 }
1875
1876 data = chunk_cata("cm", tls13_sig_data_server, transcript_hash);
84d67ead 1877 }
1b593e1d 1878 if (!key->verify(key, params->scheme, params->params, data, sig))
dbb7c030 1879 {
1b593e1d
TB		 1880 DBG1(DBG_TLS, "signature verification with %N failed",
1881 tls_signature_scheme_names, scheme);
dbb7c030
MW		 1882 return FALSE;
1883 }
1b593e1d
TB		 1884 DBG2(DBG_TLS, "verified signature with %N",
1885 tls_signature_scheme_names, scheme);
84d67ead
MW		 1886 }
1887 else
1888 {
400df4ca 1889 chunk_t sig, hash;
d29a82a9 1890 bool done;
84d67ead 1891
400df4ca
MW		 1892 if (!reader->read_data16(reader, &sig))
1893 {
d29a82a9 1894 DBG1(DBG_TLS, "received invalid signature");
400df4ca
MW		 1895 return FALSE;
1896 }
dbb7c030 1897 switch (key->get_type(key))
84d67ead 1898 {
dbb7c030 1899 case KEY_RSA:
d29a82a9 1900 if (!hash_data(this, data, &hash))
dbb7c030
MW		 1901 {
1902 return FALSE;
1903 }
a413571f
TB		 1904 done = key->verify(key, SIGN_RSA_EMSA_PKCS1_NULL, NULL, hash,
1905 sig);
d29a82a9
MW		 1906 free(hash.ptr);
1907 if (!done)
dbb7c030 1908 {
dbb7c030
MW		 1909 return FALSE;
1910 }
d29a82a9 1911 DBG2(DBG_TLS, "verified signature data with MD5+SHA1/RSA");
dbb7c030
MW		 1912 break;
1913 case KEY_ECDSA:
a413571f
TB		 1914 if (!key->verify(key, SIGN_ECDSA_WITH_SHA1_DER, NULL, data,
1915 sig))
dbb7c030 1916 {
dbb7c030
MW		 1917 return FALSE;
1918 }
d29a82a9 1919 DBG2(DBG_TLS, "verified signature with SHA1/ECDSA");
dbb7c030 1920 break;
34f66ce6
PK		 1921 case KEY_ED25519:
1922 if (!key->verify(key, SIGN_ED25519, NULL, data, sig))
1923 {
1924 return FALSE;
1925 }
1926 DBG2(DBG_TLS, "verified signature with Ed25519");
1927 break;
1928 case KEY_ED448:
1929 if (!key->verify(key, SIGN_ED448, NULL, data, sig))
1930 {
1931 return FALSE;
1932 }
1933 DBG2(DBG_TLS, "verified signature with Ed448");
1934 break;
dbb7c030
MW		 1935 default:
1936 return FALSE;
84d67ead 1937 }
84d67ead
MW		 1938 }
1939 return TRUE;
1940}
1941
d29a82a9 1942METHOD(tls_crypto_t, sign_handshake, bool,
7e432eff 1943 private_tls_crypto_t *this, private_key_t *key, bio_writer_t *writer,
d29a82a9
MW		 1944 chunk_t hashsig)
1945{
1946 return sign(this, key, writer, this->handshake, hashsig);
1947}
1948
1949METHOD(tls_crypto_t, verify_handshake, bool,
7e432eff 1950 private_tls_crypto_t *this, public_key_t *key, bio_reader_t *reader)
d29a82a9
MW		 1951{
1952 return verify(this, key, reader, this->handshake);
1953}
1954
2e1c0a27 1955METHOD(tls_crypto_t, calculate_finished_legacy, bool,
84d67ead
MW		 1956 private_tls_crypto_t *this, char *label, char out[12])
1957{
1958 chunk_t seed;
1959
1960 if (!this->prf)
1961 {
1962 return FALSE;
1963 }
d29a82a9 1964 if (!hash_data(this, this->handshake, &seed))
84d67ead
MW		 1965 {
1966 return FALSE;
1967 }
97b30b93
MW		 1968 if (!this->prf->get_bytes(this->prf, label, seed, 12, out))
1969 {
1970 free(seed.ptr);
1971 return FALSE;
1972 }
84d67ead
MW		 1973 free(seed.ptr);
1974 return TRUE;
1975}
1976
2e1c0a27 1977METHOD(tls_crypto_t, calculate_finished, bool,
328d7af6 1978 private_tls_crypto_t *this, bool server, chunk_t *out)
7a2b0266 1979{
1980 chunk_t finished_key, finished_hash;
7a2b0266 1981
f116a482 1982 if (!this->hkdf)
7a2b0266 1983 {
f116a482 1984 return FALSE;
7a2b0266 1985 }
f116a482 1986 if (!hash_data(this, this->handshake, &finished_hash))
7a2b0266 1987 {
f116a482
TB		 1988 DBG1(DBG_TLS, "creating hash of handshake failed");
1989 return FALSE;
7a2b0266 1990 }
328d7af6 1991 if (!this->hkdf->derive_finished(this->hkdf, server, &finished_key))
7a2b0266 1992 {
f116a482
TB		 1993 DBG1(DBG_TLS, "generating finished key failed");
1994 chunk_clear(&finished_hash);
1995 return FALSE;
7a2b0266 1996 }
f116a482 1997 if (!this->hkdf->allocate_bytes(this->hkdf, finished_key, finished_hash, out))
7a2b0266 1998 {
f116a482 1999 DBG1(DBG_TLS, "generating finished HMAC failed");
7a2b0266 2000 chunk_clear(&finished_key);
2001 chunk_clear(&finished_hash);
7a2b0266 2002 return FALSE;
2003 }
7a2b0266 2004 chunk_clear(&finished_key);
2005 chunk_clear(&finished_hash);
7a2b0266 2006 return TRUE;
2007}
2008
6a5c86b7
MW		 2009/**
2010 * Derive master secret from premaster, optionally save session
2011 */
97b30b93 2012static bool derive_master(private_tls_crypto_t *this, chunk_t premaster,
6a5c86b7
MW		 2013 chunk_t session, identification_t *id,
2014 chunk_t client_random, chunk_t server_random)
18010de2 2015{
84543e6e 2016 char master[48];
6a5c86b7 2017 chunk_t seed;
84543e6e
MW		 2018
2019 /* derive master secret */
2020 seed = chunk_cata("cc", client_random, server_random);
e7d98b8c
MW		 2021
2022 if (!this->prf->set_key(this->prf, premaster) ||
2023 !this->prf->get_bytes(this->prf, "master secret", seed,
2024 sizeof(master), master) ||
2025 !this->prf->set_key(this->prf, chunk_from_thing(master)))
97b30b93
MW		 2026 {
2027 return FALSE;
2028 }
97b30b93 2029
6a5c86b7
MW		 2030 if (this->cache && session.len)
2031 {
2032 this->cache->create(this->cache, session, id, chunk_from_thing(master),
2033 this->suite);
2034 }
2035 memwipe(master, sizeof(master));
97b30b93 2036 return TRUE;
6a5c86b7
MW		 2037}
2038
2039/**
2040 * Expand key material from master secret
2041 */
9020f7d0 2042static bool expand_keys(private_tls_crypto_t *this,
6a5c86b7
MW		 2043 chunk_t client_random, chunk_t server_random)
2044{
d3204677
MW		 2045 chunk_t seed, block;
2046 chunk_t cw_mac, cw, cw_iv;
2047 chunk_t sw_mac, sw, sw_iv;
2048 int mklen, eklen, ivlen;
84543e6e 2049
d3204677 2050 if (!this->aead_in || !this->aead_out)
18010de2 2051 {
d3204677 2052 return FALSE;
84543e6e 2053 }
d3204677
MW		 2054
2055 /* derive key block for key expansion */
2056 mklen = this->aead_in->get_mac_key_size(this->aead_in);
2057 eklen = this->aead_in->get_encr_key_size(this->aead_in);
2058 ivlen = this->aead_in->get_iv_size(this->aead_in);
84543e6e 2059 seed = chunk_cata("cc", server_random, client_random);
d3204677 2060 block = chunk_alloca((mklen + eklen + ivlen) * 2);
97b30b93
MW		 2061 if (!this->prf->get_bytes(this->prf, "key expansion", seed,
2062 block.len, block.ptr))
2063 {
2064 return FALSE;
2065 }
84543e6e 2066
d3204677
MW		 2067 /* client/server write signer keys */
2068 cw_mac = chunk_create(block.ptr, mklen);
2069 block = chunk_skip(block, mklen);
2070 sw_mac = chunk_create(block.ptr, mklen);
2071 block = chunk_skip(block, mklen);
2072
2073 /* client/server write encryption keys */
2074 cw = chunk_create(block.ptr, eklen);
2075 block = chunk_skip(block, eklen);
2076 sw = chunk_create(block.ptr, eklen);
2077 block = chunk_skip(block, eklen);
2078
2079 /* client/server write IV; TLS 1.0 implicit IVs or AEAD salt, if any */
2080 cw_iv = chunk_create(block.ptr, ivlen);
2081 block = chunk_skip(block, ivlen);
2082 sw_iv = chunk_create(block.ptr, ivlen);
2083 block = chunk_skip(block, ivlen);
2084
84543e6e
MW		 2085 if (this->tls->is_server(this->tls))
2086 {
d3204677
MW		 2087 if (!this->aead_in->set_keys(this->aead_in, cw_mac, cw, cw_iv) ||
2088 !this->aead_out->set_keys(this->aead_out, sw_mac, sw, sw_iv))
2d56575d
MW		 2089 {
2090 return FALSE;
2091 }
84543e6e
MW		 2092 }
2093 else
2094 {
d3204677
MW		 2095 if (!this->aead_out->set_keys(this->aead_out, cw_mac, cw, cw_iv) ||
2096 !this->aead_in->set_keys(this->aead_in, sw_mac, sw, sw_iv))
2d56575d
MW		 2097 {
2098 return FALSE;
2099 }
84543e6e
MW		 2100 }
2101
6a5c86b7
MW		 2102 /* EAP-MSK */
2103 if (this->msk_label)
2104 {
06c15036 2105 seed = chunk_cata("cc", client_random, server_random);
6a5c86b7 2106 this->msk = chunk_alloc(64);
97b30b93
MW		 2107 if (!this->prf->get_bytes(this->prf, this->msk_label, seed,
2108 this->msk.len, this->msk.ptr))
2109 {
2110 return FALSE;
2111 }
6a5c86b7 2112 }
9020f7d0 2113 return TRUE;
6a5c86b7
MW		 2114}
2115
9020f7d0 2116METHOD(tls_crypto_t, derive_secrets, bool,
6a5c86b7
MW		 2117 private_tls_crypto_t *this, chunk_t premaster, chunk_t session,
2118 identification_t *id, chunk_t client_random, chunk_t server_random)
2119{
97b30b93
MW		 2120 return derive_master(this, premaster, session, id,
2121 client_random, server_random) &&
2122 expand_keys(this, client_random, server_random);
6a5c86b7
MW		 2123}
2124
2921f437 2125/**
1466d4da 2126 * Derive and configure the client/server key/IV on an AEAD using a given label.
2921f437 2127 */
1466d4da
TB		 2128static bool derive_labeled_key(private_tls_crypto_t *this, bool server,
2129 tls_hkdf_label_t label, tls_aead_t *aead)
7a2b0266 2130{
1466d4da 2131 chunk_t key = chunk_empty, iv = chunk_empty;
2921f437 2132 bool success = FALSE;
7a2b0266 2133
1466d4da 2134 if (!this->hkdf->generate_secret(this->hkdf, label, this->handshake,
2921f437 2135 NULL) ||
1466d4da
TB		 2136 !this->hkdf->derive_key(this->hkdf, server,
2137 aead->get_encr_key_size(aead), &key) ||
2138 !this->hkdf->derive_iv(this->hkdf, server,
2139 aead->get_iv_size(aead), &iv))
2140 {
2141 DBG1(DBG_TLS, "deriving key material failed");
2921f437 2142 goto out;
7a2b0266 2143 }
2144
1466d4da 2145 if (!aead->set_keys(aead, chunk_empty, key, iv))
7a2b0266 2146 {
2921f437
TB		 2147 DBG1(DBG_TLS, "setting AEAD key material failed");
2148 goto out;
7a2b0266 2149 }
2921f437 2150 success = TRUE;
7a2b0266 2151
2921f437 2152out:
1466d4da
TB		 2153 chunk_clear(&key);
2154 chunk_clear(&iv);
2921f437 2155 return success;
7a2b0266 2156}
2157
1466d4da
TB		 2158/**
2159 * Derive and configure the keys/IVs using the given labels.
2160 */
2161static bool derive_labeled_keys(private_tls_crypto_t *this,
2162 tls_hkdf_label_t client_label,
2163 tls_hkdf_label_t server_label)
2164{
2165 tls_aead_t *aead_c = this->aead_out, *aead_s = this->aead_in;
2166
2167 if (this->tls->is_server(this->tls))
2168 {
2169 aead_c = this->aead_in;
2170 aead_s = this->aead_out;
2171 }
2172 return derive_labeled_key(this, FALSE, client_label, aead_c) &&
2173 derive_labeled_key(this, TRUE, server_label, aead_s);
2174}
2175
2921f437
TB		 2176METHOD(tls_crypto_t, derive_handshake_keys, bool,
2177 private_tls_crypto_t *this, chunk_t shared_secret)
7a2b0266 2178{
2921f437
TB		 2179 this->hkdf->set_shared_secret(this->hkdf, shared_secret);
2180 return derive_labeled_keys(this, TLS_HKDF_C_HS_TRAFFIC,
2181 TLS_HKDF_S_HS_TRAFFIC);
2182}
7a2b0266 2183
2921f437
TB		 2184METHOD(tls_crypto_t, derive_app_keys, bool,
2185 private_tls_crypto_t *this)
2186{
121ac4b9
TB		 2187 if (!derive_labeled_keys(this, TLS_HKDF_C_AP_TRAFFIC,
2188 TLS_HKDF_S_AP_TRAFFIC))
2189 {
2190 return FALSE;
2191 }
2192
2193 /* EAP-MSK */
2194 if (this->msk_label)
2195 {
2196 /* because the length is encoded when expanding key material, we
2197 * request the same number of bytes as FreeRADIUS (the first 64 for
2198 * the MSK, the next for the EMSK, which we just ignore) */
2199 if (!this->hkdf->export(this->hkdf, this->msk_label, chunk_empty,
2200 this->handshake, 128, &this->msk))
2201 {
2202 return FALSE;
2203 }
2204 this->msk.len = 64;
2205 }
2206 return TRUE;
7a2b0266 2207}
2208
1466d4da
TB		 2209METHOD(tls_crypto_t, update_app_keys, bool,
2210 private_tls_crypto_t *this, bool inbound)
2211{
2212 tls_hkdf_label_t label = TLS_HKDF_UPD_C_TRAFFIC;
2213
2214 if (this->tls->is_server(this->tls) != inbound)
2215 {
2216 label = TLS_HKDF_UPD_S_TRAFFIC;
2217 }
2218 return derive_labeled_key(this, label == TLS_HKDF_UPD_S_TRAFFIC, label,
2219 inbound ? this->aead_in : this->aead_out);
2220}
2221
6a5c86b7
MW		 2222METHOD(tls_crypto_t, resume_session, tls_cipher_suite_t,
2223 private_tls_crypto_t *this, chunk_t session, identification_t *id,
2224 chunk_t client_random, chunk_t server_random)
2225{
2226 chunk_t master;
2227
2228 if (this->cache && session.len)
2229 {
2230 this->suite = this->cache->lookup(this->cache, session, id, &master);
2231 if (this->suite)
2232 {
ae10ee6d 2233 this->suite = select_cipher_suite(this, &this->suite, 1, KEY_ANY);
6a5c86b7
MW		 2234 if (this->suite)
2235 {
e7d98b8c
MW		 2236 if (!this->prf->set_key(this->prf, master) ||
2237 !expand_keys(this, client_random, server_random))
9020f7d0
MW		 2238 {
2239 this->suite = 0;
2240 }
6a5c86b7
MW		 2241 }
2242 chunk_clear(&master);
2243 }
ae10ee6d 2244 return this->suite;
6a5c86b7 2245 }
ae10ee6d 2246 return 0;
6a5c86b7
MW		 2247}
2248
2249METHOD(tls_crypto_t, get_session, chunk_t,
2250 private_tls_crypto_t *this, identification_t *server)
2251{
2252 if (this->cache)
2253 {
2254 return this->cache->check(this->cache, server);
2255 }
2256 return chunk_empty;
84543e6e 2257}
18010de2 2258
84543e6e
MW		 2259METHOD(tls_crypto_t, change_cipher, void,
2260 private_tls_crypto_t *this, bool inbound)
2261{
dc9f34be 2262 if (this->protection)
84543e6e 2263 {
dc9f34be
MW		 2264 if (inbound)
2265 {
d3204677 2266 this->protection->set_cipher(this->protection, TRUE, this->aead_in);
dc9f34be
MW		 2267 }
2268 else
2269 {
d3204677 2270 this->protection->set_cipher(this->protection, FALSE, this->aead_out);
dc9f34be 2271 }
18010de2 2272 }
536dbc00
MW		 2273}
2274
51313a39
MW		 2275METHOD(tls_crypto_t, get_eap_msk, chunk_t,
2276 private_tls_crypto_t *this)
2277{
2278 return this->msk;
2279}
2280
536dbc00
MW		 2281METHOD(tls_crypto_t, destroy, void,
2282 private_tls_crypto_t *this)
2283{
d3204677 2284 destroy_aeads(this);
84d67ead 2285 free(this->handshake.ptr);
51313a39 2286 free(this->msk.ptr);
18010de2 2287 DESTROY_IF(this->prf);
7a2b0266 2288 DESTROY_IF(this->hkdf);
84543e6e 2289 free(this->suites);
536dbc00
MW		 2290 free(this);
2291}
2292
2293/**
2294 * See header
2295 */
6a5c86b7 2296tls_crypto_t *tls_crypto_create(tls_t *tls, tls_cache_t *cache)
536dbc00
MW		 2297{
2298 private_tls_crypto_t *this;
4254257f
MW		 2299 enumerator_t *enumerator;
2300 credential_type_t type;
2301 int subtype;
536dbc00
MW		 2302
2303 INIT(this,
2304 .public = {
2305 .get_cipher_suites = _get_cipher_suites,
18010de2 2306 .select_cipher_suite = _select_cipher_suite,
35d9c15d 2307 .get_dh_group = _get_dh_group,
d29a82a9 2308 .get_signature_algorithms = _get_signature_algorithms,
3f7bb88b 2309 .create_ec_enumerator = _create_ec_enumerator,
dc9f34be 2310 .set_protection = _set_protection,
84d67ead 2311 .append_handshake = _append_handshake,
2271d67f 2312 .hash_handshake = _hash_handshake,
d29a82a9
MW		 2313 .sign = _sign,
2314 .verify = _verify,
84d67ead 2315 .sign_handshake = _sign_handshake,
400df4ca 2316 .verify_handshake = _verify_handshake,
2e1c0a27 2317 .calculate_finished_legacy = _calculate_finished_legacy,
84d67ead
MW		 2318 .calculate_finished = _calculate_finished,
2319 .derive_secrets = _derive_secrets,
2921f437
TB		 2320 .derive_handshake_keys = _derive_handshake_keys,
2321 .derive_app_keys = _derive_app_keys,
1466d4da 2322 .update_app_keys = _update_app_keys,
6a5c86b7
MW		 2323 .resume_session = _resume_session,
2324 .get_session = _get_session,
84543e6e 2325 .change_cipher = _change_cipher,
51313a39 2326 .get_eap_msk = _get_eap_msk,
536dbc00
MW		 2327 .destroy = _destroy,
2328 },
18010de2 2329 .tls = tls,
6a5c86b7 2330 .cache = cache,
536dbc00
MW		 2331 );
2332
34f66ce6
PK		 2333 /* FIXME: EDDSA keys are currently treated like ECDSA keys. A cleaner
2334 * separation would be welcome. */
4254257f
MW		 2335 enumerator = lib->creds->create_builder_enumerator(lib->creds);
2336 while (enumerator->enumerate(enumerator, &type, &subtype))
2337 {
2338 if (type == CRED_PUBLIC_KEY)
2339 {
2340 switch (subtype)
2341 {
2342 case KEY_RSA:
2343 this->rsa = TRUE;
2344 break;
2345 case KEY_ECDSA:
34f66ce6
PK		 2346 case KEY_ED25519:
2347 case KEY_ED448:
4254257f
MW		 2348 this->ecdsa = TRUE;
2349 break;
2350 default:
2351 break;
2352 }
2353 }
2354 }
2355 enumerator->destroy(enumerator);
2356
96b2fbcc
MW		 2357 switch (tls->get_purpose(tls))
2358 {
2359 case TLS_PURPOSE_EAP_TLS:
2360 /* MSK PRF ASCII constant label according to EAP-TLS RFC 5216 */
2361 this->msk_label = "client EAP encryption";
1407a002 2362 break;
ab2c989c
MW		 2363 case TLS_PURPOSE_EAP_PEAP:
2364 this->msk_label = "client EAP encryption";
96b2fbcc
MW		 2365 break;
2366 case TLS_PURPOSE_EAP_TTLS:
2367 /* MSK PRF ASCII constant label according to EAP-TTLS RFC 5281 */
2368 this->msk_label = "ttls keying material";
ddf52220 2369 break;
99b0f633
AS		 2370 default:
2371 break;
96b2fbcc 2372 }
536dbc00
MW		 2373 return &this->public;
2374}
ac5717c9
MW		 2375
2376/**
2377 * See header.
2378 */
281766c5
TB		 2379int tls_crypto_get_supported_suites(bool null, tls_version_t version,
2380 tls_cipher_suite_t **out)
ac5717c9
MW		 2381{
2382 suite_algs_t suites[countof(suite_algs)];
281766c5 2383 int count = 0, i;
ac5717c9
MW		 2384
2385 /* initialize copy of suite list */
281766c5 2386 for (i = 0; i < countof(suite_algs); i++)
ac5717c9 2387 {
281766c5
TB		 2388 if (suite_algs[i].min_version <= version &&
2389 suite_algs[i].max_version >= version)
2390 {
2391 suites[count++] = suite_algs[i];
2392 }
ac5717c9
MW		 2393 }
2394
2395 filter_unsupported_suites(suites, &count);
2396
2397 if (!null)
2398 {
2399 filter_null_suites(suites, &count);
2400 }
2401
2402 if (out)
2403 {
2404 *out = calloc(count, sizeof(tls_cipher_suite_t));
2405 for (i = 0; i < count; i++)
2406 {
2407 (*out)[i] = suites[i].suite;
2408 }
2409 }
2410 return count;
2411}
066ac880 2412
e53bee9d
PK		 2413/**
2414 * See header.
2415 */
2416int tls_crypto_get_supported_groups(diffie_hellman_group_t **out)
2417{
2418 enumerator_t *enumerator;
2419 diffie_hellman_group_t groups[countof(curves)];
2420 diffie_hellman_group_t group;
2421 tls_named_group_t curve;
2422 int count = 0, i;
2423
2424 enumerator = enumerator_create_filter(
2425 lib->crypto->create_dh_enumerator(lib->crypto),
2426 group_filter, NULL, NULL);
2427
2428 while (enumerator->enumerate(enumerator, &group, &curve))
2429 {
2430 groups[count++] = group;
2431 }
2432 enumerator->destroy(enumerator);
2433
2434 if (out)
2435 {
2436 *out = calloc(count, sizeof(diffie_hellman_group_t));
2437 for (i = 0; i < count; i++)
2438 {
2439 (*out)[i] = groups[i];
2440 }
2441 }
2442 return count;
2443}
2444
066ac880
PK		 2445/**
2446 * See header.
2447 */
2448tls_named_group_t tls_ec_group_to_curve(diffie_hellman_group_t group)
2449{
2450 int i;
2451
2452 for (i = 0; i < countof(curves); i++)
2453 {
2454 if (curves[i].group == group)
2455 {
2456 return curves[i].curve;
2457 }
2458 }
2459 return 0;
2460}
9803fb82
PK		 2461
2462/**
2463 * See header.
2464 */
2465key_type_t tls_signature_scheme_to_key_type(tls_signature_scheme_t sig)
2466{
2467 int i;
2468
2469 for (i = 0; i < countof(schemes); i++)
2470 {
2471 if (schemes[i].sig == sig)
2472 {
2473 return key_type_from_signature_scheme(schemes[i].params.scheme);
2474 }
2475 }
2476 return 0;
2477}
2478
2479/**
2480 * Hashtable hash function
2481 */
2482static u_int hash_key_type(key_type_t *type)
2483{
2484 return chunk_hash(chunk_from_thing(*type));
2485}
2486
2487/**
2488 * Hashtable equals function
2489 */
2490static bool equals_key_type(key_type_t *key1, key_type_t *key2)
2491{
2492 return *key1 == *key2;
2493}
2494
2495CALLBACK(filter_key_types, bool,
2496 void *data, enumerator_t *orig, va_list args)
2497{
2498 key_type_t *key_type, *out;
2499
2500 VA_ARGS_VGET(args, out);
2501
2502 if (orig->enumerate(orig, NULL, &key_type))
2503 {
2504 *out = *key_type;
2505 return TRUE;
2506 }
2507 return FALSE;
2508}
2509
2510CALLBACK(destroy_key_types, void,
2511 hashtable_t *ht)
2512{
2513 ht->destroy_function(ht, (void*)free);
2514}
2515
2516/*
2517 * See header.
2518 */
2519enumerator_t *tls_get_supported_key_types(tls_version_t min_version,
2520 tls_version_t max_version)
2521{
2522 hashtable_t *ht;
2523 key_type_t *type, lookup;
2524 int i;
2525
2526 ht = hashtable_create((hashtable_hash_t)hash_key_type,
2527 (hashtable_equals_t)equals_key_type, 4);
2528 for (i = 0; i < countof(schemes); i++)
2529 {
2530 if (schemes[i].min_version <= max_version &&
2531 schemes[i].max_version >= min_version)
2532 {
2533 lookup = key_type_from_signature_scheme(schemes[i].params.scheme);
2534 if (!ht->get(ht, &lookup))
2535 {
2536 type = malloc_thing(key_type_t);
2537 *type = lookup;
2538 ht->put(ht, type, type);
2539 }
2540 }
2541 }
2542 return enumerator_create_filter(ht->create_enumerator(ht),
2543 filter_key_types, ht, destroy_key_types);
2544}
Unnamed repository; edit this file 'description' to name the repository.