]> git.ipfire.org Git - thirdparty/openssl.git/blame_incremental - providers/implementations/kdfs/hkdf.c
projects / thirdparty / openssl.git / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
Remove unnecessary OPENSSL_NO_RSA remnants
[thirdparty/openssl.git] / providers / implementations / kdfs / hkdf.c
... / ...
CommitLineData
1/*
2 * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10/*
11 * HMAC low level APIs are deprecated for public use, but still ok for internal
12 * use.
13 */
14#include "internal/deprecated.h"
15
16#include <stdlib.h>
17#include <stdarg.h>
18#include <string.h>
19#include <openssl/hmac.h>
20#include <openssl/evp.h>
21#include <openssl/kdf.h>
22#include <openssl/core_names.h>
23#include <openssl/proverr.h>
24#include "internal/cryptlib.h"
25#include "internal/numbers.h"
26#include "internal/packet.h"
27#include "crypto/evp.h"
28#include "prov/provider_ctx.h"
29#include "prov/providercommon.h"
30#include "prov/implementations.h"
31#include "prov/provider_util.h"
32#include "prov/securitycheck.h"
33#include "internal/e_os.h"
34#include "internal/params.h"
35#include "internal/sizes.h"
36
37#define HKDF_MAXBUF 2048
38#define HKDF_MAXINFO (32*1024)
39
40static OSSL_FUNC_kdf_newctx_fn kdf_hkdf_new;
41static OSSL_FUNC_kdf_dupctx_fn kdf_hkdf_dup;
42static OSSL_FUNC_kdf_freectx_fn kdf_hkdf_free;
43static OSSL_FUNC_kdf_reset_fn kdf_hkdf_reset;
44static OSSL_FUNC_kdf_derive_fn kdf_hkdf_derive;
45static OSSL_FUNC_kdf_settable_ctx_params_fn kdf_hkdf_settable_ctx_params;
46static OSSL_FUNC_kdf_set_ctx_params_fn kdf_hkdf_set_ctx_params;
47static OSSL_FUNC_kdf_gettable_ctx_params_fn kdf_hkdf_gettable_ctx_params;
48static OSSL_FUNC_kdf_get_ctx_params_fn kdf_hkdf_get_ctx_params;
49static OSSL_FUNC_kdf_derive_fn kdf_tls1_3_derive;
50static OSSL_FUNC_kdf_settable_ctx_params_fn kdf_tls1_3_settable_ctx_params;
51static OSSL_FUNC_kdf_set_ctx_params_fn kdf_tls1_3_set_ctx_params;
52static OSSL_FUNC_kdf_gettable_ctx_params_fn kdf_tls1_3_gettable_ctx_params;
53static OSSL_FUNC_kdf_get_ctx_params_fn kdf_tls1_3_get_ctx_params;
54static OSSL_FUNC_kdf_newctx_fn kdf_hkdf_sha256_new;
55static OSSL_FUNC_kdf_newctx_fn kdf_hkdf_sha384_new;
56static OSSL_FUNC_kdf_newctx_fn kdf_hkdf_sha512_new;
57
58static void *kdf_hkdf_fixed_digest_new(void *provctx, const char *digest);
59static void kdf_hkdf_reset_ex(void *vctx, int on_free);
60
61static int HKDF(OSSL_LIB_CTX *libctx, const EVP_MD *evp_md,
62 const unsigned char *salt, size_t salt_len,
63 const unsigned char *key, size_t key_len,
64 const unsigned char *info, size_t info_len,
65 unsigned char *okm, size_t okm_len);
66static int HKDF_Extract(OSSL_LIB_CTX *libctx, const EVP_MD *evp_md,
67 const unsigned char *salt, size_t salt_len,
68 const unsigned char *ikm, size_t ikm_len,
69 unsigned char *prk, size_t prk_len);
70static int HKDF_Expand(const EVP_MD *evp_md,
71 const unsigned char *prk, size_t prk_len,
72 const unsigned char *info, size_t info_len,
73 unsigned char *okm, size_t okm_len);
74
75/* Settable context parameters that are common across HKDF and the TLS KDF */
76#define HKDF_COMMON_SETTABLES \
77 OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_MODE, NULL, 0), \
78 OSSL_PARAM_int(OSSL_KDF_PARAM_MODE, NULL), \
79 OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_PROPERTIES, NULL, 0), \
80 OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_DIGEST, NULL, 0), \
81 OSSL_PARAM_octet_string(OSSL_KDF_PARAM_KEY, NULL, 0), \
82 OSSL_PARAM_octet_string(OSSL_KDF_PARAM_SALT, NULL, 0)
83
84/*
85 * Gettable context parameters that are common across HKDF and the TLS KDF.
86 * OSSL_KDF_PARAM_KEY is not gettable because it is a secret value.
87 */
88#define HKDF_COMMON_GETTABLES \
89 OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL), \
90 OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_MODE, NULL, 0), \
91 OSSL_PARAM_int(OSSL_KDF_PARAM_MODE, NULL), \
92 OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_DIGEST, NULL, 0), \
93 OSSL_PARAM_octet_string(OSSL_KDF_PARAM_SALT, NULL, 0), \
94 OSSL_PARAM_octet_string(OSSL_KDF_PARAM_INFO, NULL, 0)
95
96typedef struct {
97 void *provctx;
98 int mode;
99 PROV_DIGEST digest;
100 unsigned char *salt;
101 size_t salt_len;
102 unsigned char *key;
103 size_t key_len;
104 unsigned char *prefix;
105 size_t prefix_len;
106 unsigned char *label;
107 size_t label_len;
108 unsigned char *data;
109 size_t data_len;
110 unsigned char *info;
111 size_t info_len;
112 int fixed_digest;
113 OSSL_FIPS_IND_DECLARE
114} KDF_HKDF;
115
116static void *kdf_hkdf_new(void *provctx)
117{
118 KDF_HKDF *ctx;
119
120 if (!ossl_prov_is_running())
121 return NULL;
122
123 if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) != NULL) {
124 ctx->provctx = provctx;
125 OSSL_FIPS_IND_INIT(ctx)
126 }
127 return ctx;
128}
129
130static void kdf_hkdf_free(void *vctx)
131{
132 KDF_HKDF *ctx = (KDF_HKDF *)vctx;
133
134 if (ctx != NULL) {
135 kdf_hkdf_reset_ex(vctx, 1);
136 OPENSSL_free(ctx);
137 }
138}
139
140static void kdf_hkdf_reset(void *vctx)
141{
142 kdf_hkdf_reset_ex(vctx, 0);
143}
144
145static void kdf_hkdf_reset_ex(void *vctx, int on_free)
146{
147 KDF_HKDF *ctx = (KDF_HKDF *)vctx;
148 void *provctx = ctx->provctx;
149 int preserve_digest = on_free ? 0 : ctx->fixed_digest;
150 PROV_DIGEST save_prov_digest = { 0 };
151
152 /* For fixed digests just save and restore the PROV_DIGEST object */
153 if (preserve_digest)
154 save_prov_digest = ctx->digest;
155 else
156 ossl_prov_digest_reset(&ctx->digest);
157#ifdef OPENSSL_PEDANTIC_ZEROIZATION
158 OPENSSL_clear_free(ctx->salt, ctx->salt_len);
159#else
160 OPENSSL_free(ctx->salt);
161#endif
162 OPENSSL_free(ctx->prefix);
163 OPENSSL_free(ctx->label);
164 OPENSSL_clear_free(ctx->data, ctx->data_len);
165 OPENSSL_clear_free(ctx->key, ctx->key_len);
166 OPENSSL_clear_free(ctx->info, ctx->info_len);
167 memset(ctx, 0, sizeof(*ctx));
168 ctx->provctx = provctx;
169 if (preserve_digest) {
170 ctx->fixed_digest = preserve_digest;
171 ctx->digest = save_prov_digest;
172 }
173}
174
175static void *kdf_hkdf_dup(void *vctx)
176{
177 const KDF_HKDF *src = (const KDF_HKDF *)vctx;
178 KDF_HKDF *dest;
179
180 dest = kdf_hkdf_new(src->provctx);
181 if (dest != NULL) {
182 if (!ossl_prov_memdup(src->salt, src->salt_len, &dest->salt,
183 &dest->salt_len)
184 || !ossl_prov_memdup(src->key, src->key_len,
185 &dest->key , &dest->key_len)
186 || !ossl_prov_memdup(src->prefix, src->prefix_len,
187 &dest->prefix, &dest->prefix_len)
188 || !ossl_prov_memdup(src->label, src->label_len,
189 &dest->label, &dest->label_len)
190 || !ossl_prov_memdup(src->data, src->data_len,
191 &dest->data, &dest->data_len)
192 || !ossl_prov_memdup(src->info, src->info_len,
193 &dest->info, &dest->info_len)
194 || !ossl_prov_digest_copy(&dest->digest, &src->digest))
195 goto err;
196 dest->mode = src->mode;
197 dest->fixed_digest = src->fixed_digest;
198 OSSL_FIPS_IND_COPY(dest, src)
199 }
200 return dest;
201
202 err:
203 kdf_hkdf_free(dest);
204 return NULL;
205}
206
207static size_t kdf_hkdf_size(KDF_HKDF *ctx)
208{
209 int sz;
210 const EVP_MD *md = ossl_prov_digest_md(&ctx->digest);
211
212 if (ctx->mode != EVP_KDF_HKDF_MODE_EXTRACT_ONLY)
213 return SIZE_MAX;
214
215 if (md == NULL) {
216 ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST);
217 return 0;
218 }
219 sz = EVP_MD_get_size(md);
220 if (sz <= 0)
221 return 0;
222
223 return sz;
224}
225
226#ifdef FIPS_MODULE
227static int fips_hkdf_key_check_passed(KDF_HKDF *ctx)
228{
229 OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
230 int key_approved = ossl_kdf_check_key_size(ctx->key_len);
231
232 if (!key_approved) {
233 if (!OSSL_FIPS_IND_ON_UNAPPROVED(ctx, OSSL_FIPS_IND_SETTABLE0,
234 libctx, "HKDF", "Key size",
235 ossl_fips_config_hkdf_key_check)) {
236 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
237 return 0;
238 }
239 }
240 return 1;
241}
242#endif
243
244static int kdf_hkdf_derive(void *vctx, unsigned char *key, size_t keylen,
245 const OSSL_PARAM params[])
246{
247 KDF_HKDF *ctx = (KDF_HKDF *)vctx;
248 OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
249 const EVP_MD *md;
250
251 if (!ossl_prov_is_running() || !kdf_hkdf_set_ctx_params(ctx, params))
252 return 0;
253
254 md = ossl_prov_digest_md(&ctx->digest);
255 if (md == NULL) {
256 ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST);
257 return 0;
258 }
259 if (ctx->key == NULL) {
260 ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_KEY);
261 return 0;
262 }
263 if (keylen == 0) {
264 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
265 return 0;
266 }
267
268 switch (ctx->mode) {
269 case EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND:
270 default:
271 return HKDF(libctx, md, ctx->salt, ctx->salt_len,
272 ctx->key, ctx->key_len, ctx->info, ctx->info_len, key, keylen);
273
274 case EVP_KDF_HKDF_MODE_EXTRACT_ONLY:
275 return HKDF_Extract(libctx, md, ctx->salt, ctx->salt_len,
276 ctx->key, ctx->key_len, key, keylen);
277
278 case EVP_KDF_HKDF_MODE_EXPAND_ONLY:
279 return HKDF_Expand(md, ctx->key, ctx->key_len, ctx->info,
280 ctx->info_len, key, keylen);
281 }
282}
283
284static int hkdf_common_set_ctx_params(KDF_HKDF *ctx, const OSSL_PARAM params[])
285{
286 OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
287 const OSSL_PARAM *p;
288 int n;
289
290 if (ossl_param_is_empty(params))
291 return 1;
292
293 if ((p = OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_DIGEST)) != NULL) {
294 const EVP_MD *md = NULL;
295
296 if (ctx->fixed_digest) {
297 ERR_raise_data(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED,
298 "Setting the digest is not supported for fixed-digest HKDFs");
299 return 0;
300 }
301
302 if (!ossl_prov_digest_load_from_params(&ctx->digest, params, libctx))
303 return 0;
304
305 md = ossl_prov_digest_md(&ctx->digest);
306 if (EVP_MD_xof(md)) {
307 ERR_raise(ERR_LIB_PROV, PROV_R_XOF_DIGESTS_NOT_ALLOWED);
308 return 0;
309 }
310 }
311
312 if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_MODE)) != NULL) {
313 if (p->data_type == OSSL_PARAM_UTF8_STRING) {
314 if (OPENSSL_strcasecmp(p->data, "EXTRACT_AND_EXPAND") == 0) {
315 ctx->mode = EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND;
316 } else if (OPENSSL_strcasecmp(p->data, "EXTRACT_ONLY") == 0) {
317 ctx->mode = EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
318 } else if (OPENSSL_strcasecmp(p->data, "EXPAND_ONLY") == 0) {
319 ctx->mode = EVP_KDF_HKDF_MODE_EXPAND_ONLY;
320 } else {
321 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE);
322 return 0;
323 }
324 } else if (OSSL_PARAM_get_int(p, &n)) {
325 if (n != EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND
326 && n != EVP_KDF_HKDF_MODE_EXTRACT_ONLY
327 && n != EVP_KDF_HKDF_MODE_EXPAND_ONLY) {
328 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE);
329 return 0;
330 }
331 ctx->mode = n;
332 } else {
333 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE);
334 return 0;
335 }
336 }
337
338 if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_KEY)) != NULL) {
339 OPENSSL_clear_free(ctx->key, ctx->key_len);
340 ctx->key = NULL;
341 if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->key, 0,
342 &ctx->key_len))
343 return 0;
344 }
345
346 if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_SALT)) != NULL) {
347 OPENSSL_free(ctx->salt);
348 ctx->salt = NULL;
349 if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->salt, 0,
350 &ctx->salt_len))
351 return 0;
352 }
353
354 return 1;
355}
356
357static int kdf_hkdf_set_ctx_params(void *vctx, const OSSL_PARAM params[])
358{
359 KDF_HKDF *ctx = vctx;
360
361 if (ossl_param_is_empty(params))
362 return 1;
363
364 if (!OSSL_FIPS_IND_SET_CTX_PARAM(ctx, OSSL_FIPS_IND_SETTABLE0, params,
365 OSSL_KDF_PARAM_FIPS_KEY_CHECK))
366 return 0;
367
368 if (!hkdf_common_set_ctx_params(ctx, params))
369 return 0;
370
371 if (ossl_param_get1_concat_octet_string(params, OSSL_KDF_PARAM_INFO,
372 &ctx->info, &ctx->info_len,
373 HKDF_MAXINFO) == 0)
374 return 0;
375
376#ifdef FIPS_MODULE
377 if (OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_KEY) != NULL)
378 if (!fips_hkdf_key_check_passed(ctx))
379 return 0;
380#endif
381
382 return 1;
383}
384
385static const OSSL_PARAM *kdf_hkdf_settable_ctx_params(ossl_unused void *ctx,
386 ossl_unused void *provctx)
387{
388 static const OSSL_PARAM known_settable_ctx_params[] = {
389 HKDF_COMMON_SETTABLES,
390 OSSL_PARAM_octet_string(OSSL_KDF_PARAM_INFO, NULL, 0),
391 OSSL_FIPS_IND_SETTABLE_CTX_PARAM(OSSL_KDF_PARAM_FIPS_KEY_CHECK)
392 OSSL_PARAM_END
393 };
394 return known_settable_ctx_params;
395}
396
397static int hkdf_common_get_ctx_params(KDF_HKDF *ctx, OSSL_PARAM params[])
398{
399 OSSL_PARAM *p;
400
401 if (ossl_param_is_empty(params))
402 return 1;
403
404 if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_SIZE)) != NULL) {
405 size_t sz = kdf_hkdf_size(ctx);
406
407 if (sz == 0)
408 return 0;
409 if (!OSSL_PARAM_set_size_t(p, sz))
410 return 0;
411 }
412
413 if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_DIGEST)) != NULL) {
414 const EVP_MD *md = ossl_prov_digest_md(&ctx->digest);
415
416 if (md == NULL)
417 return 0;
418 else if (!OSSL_PARAM_set_utf8_string(p, EVP_MD_get0_name(md)))
419 return 0;
420 }
421
422 /* OSSL_KDF_PARAM_MODE has multiple parameter types, so look for all instances */
423 p = params;
424 while ((p = OSSL_PARAM_locate(p, OSSL_KDF_PARAM_MODE)) != NULL) {
425 if (p->data_type == OSSL_PARAM_UTF8_STRING) {
426 switch (ctx->mode) {
427 case EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND:
428 if (!OSSL_PARAM_set_utf8_string(p, "EXTRACT_AND_EXPAND"))
429 return 0;
430 break;
431 case EVP_KDF_HKDF_MODE_EXTRACT_ONLY:
432 if (!OSSL_PARAM_set_utf8_string(p, "EXTRACT_ONLY"))
433 return 0;
434 break;
435 case EVP_KDF_HKDF_MODE_EXPAND_ONLY:
436 if (!OSSL_PARAM_set_utf8_string(p, "EXPAND_ONLY"))
437 return 0;
438 break;
439 default:
440 return 0;
441 }
442 } else if (p->data_type == OSSL_PARAM_INTEGER) {
443 if (!OSSL_PARAM_set_int(p, ctx->mode))
444 return 0;
445 }
446 p++;
447 }
448
449 if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_SALT)) != NULL) {
450 if (ctx->salt == NULL || ctx->salt_len == 0)
451 p->return_size = 0;
452 else if (!OSSL_PARAM_set_octet_string(p, ctx->salt, ctx->salt_len))
453 return 0;
454 }
455
456 if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_INFO)) != NULL) {
457 if (ctx->info == NULL || ctx->info_len == 0)
458 p->return_size = 0;
459 else if (!OSSL_PARAM_set_octet_string(p, ctx->info, ctx->info_len))
460 return 0;
461 }
462
463 return 1;
464}
465
466static int kdf_hkdf_get_ctx_params(void *vctx, OSSL_PARAM params[])
467{
468 KDF_HKDF *ctx = (KDF_HKDF *)vctx;
469
470 if (ossl_param_is_empty(params))
471 return 1;
472
473 if (!hkdf_common_get_ctx_params(ctx, params))
474 return 0;
475
476 if (!OSSL_FIPS_IND_GET_CTX_PARAM(ctx, params))
477 return 0;
478
479 return 1;
480}
481
482static const OSSL_PARAM *kdf_hkdf_gettable_ctx_params(ossl_unused void *ctx,
483 ossl_unused void *provctx)
484{
485 static const OSSL_PARAM known_gettable_ctx_params[] = {
486 HKDF_COMMON_GETTABLES,
487 OSSL_FIPS_IND_GETTABLE_CTX_PARAM()
488 OSSL_PARAM_END
489 };
490 return known_gettable_ctx_params;
491}
492
493const OSSL_DISPATCH ossl_kdf_hkdf_functions[] = {
494 { OSSL_FUNC_KDF_NEWCTX, (void(*)(void))kdf_hkdf_new },
495 { OSSL_FUNC_KDF_DUPCTX, (void(*)(void))kdf_hkdf_dup },
496 { OSSL_FUNC_KDF_FREECTX, (void(*)(void))kdf_hkdf_free },
497 { OSSL_FUNC_KDF_RESET, (void(*)(void))kdf_hkdf_reset },
498 { OSSL_FUNC_KDF_DERIVE, (void(*)(void))kdf_hkdf_derive },
499 { OSSL_FUNC_KDF_SETTABLE_CTX_PARAMS,
500 (void(*)(void))kdf_hkdf_settable_ctx_params },
501 { OSSL_FUNC_KDF_SET_CTX_PARAMS, (void(*)(void))kdf_hkdf_set_ctx_params },
502 { OSSL_FUNC_KDF_GETTABLE_CTX_PARAMS,
503 (void(*)(void))kdf_hkdf_gettable_ctx_params },
504 { OSSL_FUNC_KDF_GET_CTX_PARAMS, (void(*)(void))kdf_hkdf_get_ctx_params },
505 OSSL_DISPATCH_END
506};
507
508static void *kdf_hkdf_fixed_digest_new(void *provctx, const char *digest)
509{
510 OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(provctx);
511 KDF_HKDF *ctx;
512 OSSL_PARAM params[2];
513
514 ctx = kdf_hkdf_new(provctx);
515 if (ctx == NULL)
516 return NULL;
517
518 params[0] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_DIGEST,
519 (char *)digest, 0);
520 params[1] = OSSL_PARAM_construct_end();
521 if (!ossl_prov_digest_load_from_params(&ctx->digest, params, libctx)) {
522 kdf_hkdf_free(ctx);
523 return NULL;
524 }
525
526 /* Now the digest can no longer be changed */
527 ctx->fixed_digest = 1;
528
529 return ctx;
530}
531
532#define KDF_HKDF_FIXED_DIGEST_NEW(hashname, hashstring) \
533 static void *kdf_hkdf_##hashname##_new(void *provctx) \
534 { \
535 return kdf_hkdf_fixed_digest_new(provctx, hashstring); \
536 }
537
538KDF_HKDF_FIXED_DIGEST_NEW(sha256, "SHA256")
539KDF_HKDF_FIXED_DIGEST_NEW(sha384, "SHA384")
540KDF_HKDF_FIXED_DIGEST_NEW(sha512, "SHA512")
541
542#define MAKE_KDF_HKDF_FIXED_DIGEST_FUNCTIONS(hashname) \
543 const OSSL_DISPATCH ossl_kdf_hkdf_##hashname##_functions[] = { \
544 { OSSL_FUNC_KDF_NEWCTX, (void(*)(void))kdf_hkdf_##hashname##_new }, \
545 { OSSL_FUNC_KDF_DUPCTX, (void(*)(void))kdf_hkdf_dup }, \
546 { OSSL_FUNC_KDF_FREECTX, (void(*)(void))kdf_hkdf_free }, \
547 { OSSL_FUNC_KDF_RESET, (void(*)(void))kdf_hkdf_reset }, \
548 { OSSL_FUNC_KDF_DERIVE, (void(*)(void))kdf_hkdf_derive }, \
549 { OSSL_FUNC_KDF_SETTABLE_CTX_PARAMS, (void(*)(void))kdf_hkdf_settable_ctx_params }, \
550 { OSSL_FUNC_KDF_SET_CTX_PARAMS, (void(*)(void))kdf_hkdf_set_ctx_params }, \
551 { OSSL_FUNC_KDF_GETTABLE_CTX_PARAMS, (void(*)(void))kdf_hkdf_gettable_ctx_params }, \
552 { OSSL_FUNC_KDF_GET_CTX_PARAMS, (void(*)(void))kdf_hkdf_get_ctx_params }, \
553 OSSL_DISPATCH_END \
554 };
555
556MAKE_KDF_HKDF_FIXED_DIGEST_FUNCTIONS(sha256)
557MAKE_KDF_HKDF_FIXED_DIGEST_FUNCTIONS(sha384)
558MAKE_KDF_HKDF_FIXED_DIGEST_FUNCTIONS(sha512)
559
560/*
561 * Refer to "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)"
562 * Section 2 (https://tools.ietf.org/html/rfc5869#section-2) and
563 * "Cryptographic Extraction and Key Derivation: The HKDF Scheme"
564 * Section 4.2 (https://eprint.iacr.org/2010/264.pdf).
565 *
566 * From the paper:
567 * The scheme HKDF is specified as:
568 * HKDF(XTS, SKM, CTXinfo, L) = K(1) | K(2) | ... | K(t)
569 *
570 * where:
571 * SKM is source key material
572 * XTS is extractor salt (which may be null or constant)
573 * CTXinfo is context information (may be null)
574 * L is the number of key bits to be produced by KDF
575 * k is the output length in bits of the hash function used with HMAC
576 * t = ceil(L/k)
577 * the value K(t) is truncated to its first d = L mod k bits.
578 *
579 * From RFC 5869:
580 * 2.2. Step 1: Extract
581 * HKDF-Extract(salt, IKM) -> PRK
582 * 2.3. Step 2: Expand
583 * HKDF-Expand(PRK, info, L) -> OKM
584 */
585static int HKDF(OSSL_LIB_CTX *libctx, const EVP_MD *evp_md,
586 const unsigned char *salt, size_t salt_len,
587 const unsigned char *ikm, size_t ikm_len,
588 const unsigned char *info, size_t info_len,
589 unsigned char *okm, size_t okm_len)
590{
591 unsigned char prk[EVP_MAX_MD_SIZE];
592 int ret, sz;
593 size_t prk_len;
594
595 sz = EVP_MD_get_size(evp_md);
596 if (sz <= 0)
597 return 0;
598 prk_len = (size_t)sz;
599
600 /* Step 1: HKDF-Extract(salt, IKM) -> PRK */
601 if (!HKDF_Extract(libctx, evp_md,
602 salt, salt_len, ikm, ikm_len, prk, prk_len))
603 return 0;
604
605 /* Step 2: HKDF-Expand(PRK, info, L) -> OKM */
606 ret = HKDF_Expand(evp_md, prk, prk_len, info, info_len, okm, okm_len);
607 OPENSSL_cleanse(prk, sizeof(prk));
608
609 return ret;
610}
611
612/*
613 * Refer to "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)"
614 * Section 2.2 (https://tools.ietf.org/html/rfc5869#section-2.2).
615 *
616 * 2.2. Step 1: Extract
617 *
618 * HKDF-Extract(salt, IKM) -> PRK
619 *
620 * Options:
621 * Hash a hash function; HashLen denotes the length of the
622 * hash function output in octets
623 *
624 * Inputs:
625 * salt optional salt value (a non-secret random value);
626 * if not provided, it is set to a string of HashLen zeros.
627 * IKM input keying material
628 *
629 * Output:
630 * PRK a pseudorandom key (of HashLen octets)
631 *
632 * The output PRK is calculated as follows:
633 *
634 * PRK = HMAC-Hash(salt, IKM)
635 */
636static int HKDF_Extract(OSSL_LIB_CTX *libctx, const EVP_MD *evp_md,
637 const unsigned char *salt, size_t salt_len,
638 const unsigned char *ikm, size_t ikm_len,
639 unsigned char *prk, size_t prk_len)
640{
641 int sz = EVP_MD_get_size(evp_md);
642
643 if (sz <= 0)
644 return 0;
645 if (prk_len != (size_t)sz) {
646 ERR_raise(ERR_LIB_PROV, PROV_R_WRONG_OUTPUT_BUFFER_SIZE);
647 return 0;
648 }
649 /* calc: PRK = HMAC-Hash(salt, IKM) */
650 return
651 EVP_Q_mac(libctx, "HMAC", NULL, EVP_MD_get0_name(evp_md), NULL, salt,
652 salt_len, ikm, ikm_len, prk, EVP_MD_get_size(evp_md), NULL)
653 != NULL;
654}
655
656/*
657 * Refer to "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)"
658 * Section 2.3 (https://tools.ietf.org/html/rfc5869#section-2.3).
659 *
660 * 2.3. Step 2: Expand
661 *
662 * HKDF-Expand(PRK, info, L) -> OKM
663 *
664 * Options:
665 * Hash a hash function; HashLen denotes the length of the
666 * hash function output in octets
667 *
668 * Inputs:
669 * PRK a pseudorandom key of at least HashLen octets
670 * (usually, the output from the extract step)
671 * info optional context and application specific information
672 * (can be a zero-length string)
673 * L length of output keying material in octets
674 * (<= 255*HashLen)
675 *
676 * Output:
677 * OKM output keying material (of L octets)
678 *
679 * The output OKM is calculated as follows:
680 *
681 * N = ceil(L/HashLen)
682 * T = T(1) | T(2) | T(3) | ... | T(N)
683 * OKM = first L octets of T
684 *
685 * where:
686 * T(0) = empty string (zero length)
687 * T(1) = HMAC-Hash(PRK, T(0) | info | 0x01)
688 * T(2) = HMAC-Hash(PRK, T(1) | info | 0x02)
689 * T(3) = HMAC-Hash(PRK, T(2) | info | 0x03)
690 * ...
691 *
692 * (where the constant concatenated to the end of each T(n) is a
693 * single octet.)
694 */
695static int HKDF_Expand(const EVP_MD *evp_md,
696 const unsigned char *prk, size_t prk_len,
697 const unsigned char *info, size_t info_len,
698 unsigned char *okm, size_t okm_len)
699{
700 HMAC_CTX *hmac;
701 int ret = 0, sz;
702 unsigned int i;
703 unsigned char prev[EVP_MAX_MD_SIZE];
704 size_t done_len = 0, dig_len, n;
705
706 sz = EVP_MD_get_size(evp_md);
707 if (sz <= 0)
708 return 0;
709 dig_len = (size_t)sz;
710
711 /* calc: N = ceil(L/HashLen) */
712 n = okm_len / dig_len;
713 if (okm_len % dig_len)
714 n++;
715
716 if (n > 255 || okm == NULL)
717 return 0;
718
719 if ((hmac = HMAC_CTX_new()) == NULL)
720 return 0;
721
722 if (!HMAC_Init_ex(hmac, prk, (int)prk_len, evp_md, NULL))
723 goto err;
724
725 for (i = 1; i <= n; i++) {
726 size_t copy_len;
727 const unsigned char ctr = i;
728
729 /* calc: T(i) = HMAC-Hash(PRK, T(i - 1) | info | i) */
730 if (i > 1) {
731 if (!HMAC_Init_ex(hmac, NULL, 0, NULL, NULL))
732 goto err;
733
734 if (!HMAC_Update(hmac, prev, dig_len))
735 goto err;
736 }
737
738 if (!HMAC_Update(hmac, info, info_len))
739 goto err;
740
741 if (!HMAC_Update(hmac, &ctr, 1))
742 goto err;
743
744 if (!HMAC_Final(hmac, prev, NULL))
745 goto err;
746
747 copy_len = (dig_len > okm_len - done_len) ?
748 okm_len - done_len :
749 dig_len;
750
751 memcpy(okm + done_len, prev, copy_len);
752
753 done_len += copy_len;
754 }
755 ret = 1;
756
757 err:
758 OPENSSL_cleanse(prev, sizeof(prev));
759 HMAC_CTX_free(hmac);
760 return ret;
761}
762
763/*
764 * TLS uses slight variations of the above and for FIPS validation purposes,
765 * they need to be present here.
766 * Refer to RFC 8446 section 7 for specific details.
767 */
768
769/*
770 * Given a |secret|; a |label| of length |labellen|; and |data| of length
771 * |datalen| (e.g. typically a hash of the handshake messages), derive a new
772 * secret |outlen| bytes long and store it in the location pointed to be |out|.
773 * The |data| value may be zero length. Returns 1 on success and 0 on failure.
774 */
775static int prov_tls13_hkdf_expand(const EVP_MD *md,
776 const unsigned char *key, size_t keylen,
777 const unsigned char *prefix, size_t prefixlen,
778 const unsigned char *label, size_t labellen,
779 const unsigned char *data, size_t datalen,
780 unsigned char *out, size_t outlen)
781{
782 size_t hkdflabellen;
783 unsigned char hkdflabel[HKDF_MAXBUF];
784 WPACKET pkt;
785
786 /*
787 * 2 bytes for length of derived secret + 1 byte for length of combined
788 * prefix and label + bytes for the label itself + 1 byte length of hash
789 * + bytes for the hash itself. We've got the maximum the KDF can handle
790 * which should always be sufficient.
791 */
792 if (!WPACKET_init_static_len(&pkt, hkdflabel, sizeof(hkdflabel), 0)
793 || !WPACKET_put_bytes_u16(&pkt, outlen)
794 || !WPACKET_start_sub_packet_u8(&pkt)
795 || !WPACKET_memcpy(&pkt, prefix, prefixlen)
796 || !WPACKET_memcpy(&pkt, label, labellen)
797 || !WPACKET_close(&pkt)
798 || !WPACKET_sub_memcpy_u8(&pkt, data, (data == NULL) ? 0 : datalen)
799 || !WPACKET_get_total_written(&pkt, &hkdflabellen)
800 || !WPACKET_finish(&pkt)) {
801 WPACKET_cleanup(&pkt);
802 return 0;
803 }
804
805 return HKDF_Expand(md, key, keylen, hkdflabel, hkdflabellen,
806 out, outlen);
807}
808
809static int prov_tls13_hkdf_generate_secret(OSSL_LIB_CTX *libctx,
810 const EVP_MD *md,
811 const unsigned char *prevsecret,
812 size_t prevsecretlen,
813 const unsigned char *insecret,
814 size_t insecretlen,
815 const unsigned char *prefix,
816 size_t prefixlen,
817 const unsigned char *label,
818 size_t labellen,
819 unsigned char *out, size_t outlen)
820{
821 size_t mdlen;
822 int ret;
823 unsigned char preextractsec[EVP_MAX_MD_SIZE];
824 /* Always filled with zeros */
825 static const unsigned char default_zeros[EVP_MAX_MD_SIZE];
826
827 ret = EVP_MD_get_size(md);
828 /* Ensure cast to size_t is safe */
829 if (ret <= 0)
830 return 0;
831 mdlen = (size_t)ret;
832
833 if (insecret == NULL) {
834 insecret = default_zeros;
835 insecretlen = mdlen;
836 }
837 if (prevsecret == NULL) {
838 prevsecret = default_zeros;
839 prevsecretlen = mdlen;
840 } else {
841 EVP_MD_CTX *mctx = EVP_MD_CTX_new();
842 unsigned char hash[EVP_MAX_MD_SIZE];
843
844 /* The pre-extract derive step uses a hash of no messages */
845 if (mctx == NULL
846 || EVP_DigestInit_ex(mctx, md, NULL) <= 0
847 || EVP_DigestFinal_ex(mctx, hash, NULL) <= 0) {
848 EVP_MD_CTX_free(mctx);
849 return 0;
850 }
851 EVP_MD_CTX_free(mctx);
852
853 /* Generate the pre-extract secret */
854 if (!prov_tls13_hkdf_expand(md, prevsecret, prevsecretlen,
855 prefix, prefixlen, label, labellen,
856 hash, mdlen, preextractsec, mdlen))
857 return 0;
858 prevsecret = preextractsec;
859 prevsecretlen = mdlen;
860 }
861
862 ret = HKDF_Extract(libctx, md, prevsecret, prevsecretlen,
863 insecret, insecretlen, out, outlen);
864
865 if (prevsecret == preextractsec)
866 OPENSSL_cleanse(preextractsec, mdlen);
867 return ret;
868}
869
870#ifdef FIPS_MODULE
871static int fips_tls1_3_digest_check_passed(KDF_HKDF *ctx, const EVP_MD *md)
872{
873 OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
874 /*
875 * Perform digest check
876 *
877 * According to RFC 8446 appendix B.4, the valid hash functions are
878 * specified in FIPS 180-4. However, it only lists SHA2-256 and SHA2-384 in
879 * the table. ACVP also only lists the same set of hash functions.
880 */
881 int digest_unapproved = !EVP_MD_is_a(md, SN_sha256)
882 && !EVP_MD_is_a(md, SN_sha384);
883
884 if (digest_unapproved) {
885 if (!OSSL_FIPS_IND_ON_UNAPPROVED(ctx, OSSL_FIPS_IND_SETTABLE0,
886 libctx, "TLS13 KDF", "Digest",
887 ossl_fips_config_tls13_kdf_digest_check)) {
888 ERR_raise(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED);
889 return 0;
890 }
891 }
892 return 1;
893}
894
895/*
896 * Calculate the correct length of the secret key.
897 *
898 * RFC 8446:
899 * If a given secret is not available, then the 0-value consisting of a
900 * string of Hash.length bytes set to zeros is used.
901 */
902static size_t fips_tls1_3_key_size(KDF_HKDF *ctx)
903{
904 const EVP_MD *md = ossl_prov_digest_md(&ctx->digest);
905 size_t key_size = 0;
906
907 if (ctx->key != NULL)
908 key_size = ctx->key_len;
909 else if (md != NULL)
910 key_size = EVP_MD_size(md);
911
912 return key_size;
913}
914
915static int fips_tls1_3_key_check_passed(KDF_HKDF *ctx)
916{
917 OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
918 int key_approved = ossl_kdf_check_key_size(fips_tls1_3_key_size(ctx));
919
920 if (!key_approved) {
921 if (!OSSL_FIPS_IND_ON_UNAPPROVED(ctx, OSSL_FIPS_IND_SETTABLE1,
922 libctx, "TLS13 KDF", "Key size",
923 ossl_fips_config_tls13_kdf_key_check)) {
924 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
925 return 0;
926 }
927 }
928 return 1;
929}
930#endif
931
932static int kdf_tls1_3_derive(void *vctx, unsigned char *key, size_t keylen,
933 const OSSL_PARAM params[])
934{
935 KDF_HKDF *ctx = (KDF_HKDF *)vctx;
936 const EVP_MD *md;
937
938 if (!ossl_prov_is_running() || !kdf_tls1_3_set_ctx_params(ctx, params))
939 return 0;
940
941 md = ossl_prov_digest_md(&ctx->digest);
942 if (md == NULL) {
943 ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST);
944 return 0;
945 }
946
947 switch (ctx->mode) {
948 default:
949 return 0;
950
951 case EVP_KDF_HKDF_MODE_EXTRACT_ONLY:
952 return prov_tls13_hkdf_generate_secret(PROV_LIBCTX_OF(ctx->provctx),
953 md,
954 ctx->salt, ctx->salt_len,
955 ctx->key, ctx->key_len,
956 ctx->prefix, ctx->prefix_len,
957 ctx->label, ctx->label_len,
958 key, keylen);
959
960 case EVP_KDF_HKDF_MODE_EXPAND_ONLY:
961 return prov_tls13_hkdf_expand(md, ctx->key, ctx->key_len,
962 ctx->prefix, ctx->prefix_len,
963 ctx->label, ctx->label_len,
964 ctx->data, ctx->data_len,
965 key, keylen);
966 }
967}
968
969static int kdf_tls1_3_set_ctx_params(void *vctx, const OSSL_PARAM params[])
970{
971 const OSSL_PARAM *p;
972 KDF_HKDF *ctx = vctx;
973
974 if (ossl_param_is_empty(params))
975 return 1;
976
977 if (!OSSL_FIPS_IND_SET_CTX_PARAM(ctx, OSSL_FIPS_IND_SETTABLE0, params,
978 OSSL_KDF_PARAM_FIPS_DIGEST_CHECK))
979 return 0;
980 if (!OSSL_FIPS_IND_SET_CTX_PARAM(ctx, OSSL_FIPS_IND_SETTABLE1, params,
981 OSSL_KDF_PARAM_FIPS_KEY_CHECK))
982 return 0;
983
984 if (!hkdf_common_set_ctx_params(ctx, params))
985 return 0;
986
987 if (ctx->mode == EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND) {
988 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE);
989 return 0;
990 }
991
992 if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_PREFIX)) != NULL) {
993 OPENSSL_free(ctx->prefix);
994 ctx->prefix = NULL;
995 if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->prefix, 0,
996 &ctx->prefix_len))
997 return 0;
998 }
999
1000 if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_LABEL)) != NULL) {
1001 OPENSSL_free(ctx->label);
1002 ctx->label = NULL;
1003 if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->label, 0,
1004 &ctx->label_len))
1005 return 0;
1006 }
1007
1008 OPENSSL_clear_free(ctx->data, ctx->data_len);
1009 ctx->data = NULL;
1010 if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_DATA)) != NULL
1011 && !OSSL_PARAM_get_octet_string(p, (void **)&ctx->data, 0,
1012 &ctx->data_len))
1013 return 0;
1014
1015#ifdef FIPS_MODULE
1016 if (OSSL_PARAM_locate_const(params, OSSL_ALG_PARAM_DIGEST) != NULL) {
1017 const EVP_MD *md = ossl_prov_digest_md(&ctx->digest);
1018
1019 if (!fips_tls1_3_digest_check_passed(ctx, md))
1020 return 0;
1021 }
1022
1023 if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_KEY)) != NULL)
1024 if (!fips_tls1_3_key_check_passed(ctx))
1025 return 0;
1026#endif
1027
1028 return 1;
1029}
1030
1031static const OSSL_PARAM *kdf_tls1_3_settable_ctx_params(ossl_unused void *ctx,
1032 ossl_unused void *provctx)
1033{
1034 static const OSSL_PARAM known_settable_ctx_params[] = {
1035 HKDF_COMMON_SETTABLES,
1036 OSSL_PARAM_octet_string(OSSL_KDF_PARAM_PREFIX, NULL, 0),
1037 OSSL_PARAM_octet_string(OSSL_KDF_PARAM_LABEL, NULL, 0),
1038 OSSL_PARAM_octet_string(OSSL_KDF_PARAM_DATA, NULL, 0),
1039 OSSL_FIPS_IND_SETTABLE_CTX_PARAM(OSSL_KDF_PARAM_FIPS_DIGEST_CHECK)
1040 OSSL_FIPS_IND_SETTABLE_CTX_PARAM(OSSL_KDF_PARAM_FIPS_KEY_CHECK)
1041 OSSL_PARAM_END
1042 };
1043 return known_settable_ctx_params;
1044}
1045
1046static int kdf_tls1_3_get_ctx_params(void *vctx, OSSL_PARAM params[])
1047{
1048 KDF_HKDF *ctx = (KDF_HKDF *)vctx;
1049
1050 if (ossl_param_is_empty(params))
1051 return 1;
1052
1053 if (!hkdf_common_get_ctx_params(ctx, params))
1054 return 0;
1055
1056 if (!OSSL_FIPS_IND_GET_CTX_PARAM(ctx, params))
1057 return 0;
1058
1059 return 1;
1060}
1061
1062static const OSSL_PARAM *kdf_tls1_3_gettable_ctx_params(ossl_unused void *ctx,
1063 ossl_unused void *provctx)
1064{
1065 static const OSSL_PARAM known_gettable_ctx_params[] = {
1066 HKDF_COMMON_GETTABLES,
1067 OSSL_FIPS_IND_GETTABLE_CTX_PARAM()
1068 OSSL_PARAM_END
1069 };
1070 return known_gettable_ctx_params;
1071}
1072
1073const OSSL_DISPATCH ossl_kdf_tls1_3_kdf_functions[] = {
1074 { OSSL_FUNC_KDF_NEWCTX, (void(*)(void))kdf_hkdf_new },
1075 { OSSL_FUNC_KDF_DUPCTX, (void(*)(void))kdf_hkdf_dup },
1076 { OSSL_FUNC_KDF_FREECTX, (void(*)(void))kdf_hkdf_free },
1077 { OSSL_FUNC_KDF_RESET, (void(*)(void))kdf_hkdf_reset },
1078 { OSSL_FUNC_KDF_DERIVE, (void(*)(void))kdf_tls1_3_derive },
1079 { OSSL_FUNC_KDF_SETTABLE_CTX_PARAMS,
1080 (void(*)(void))kdf_tls1_3_settable_ctx_params },
1081 { OSSL_FUNC_KDF_SET_CTX_PARAMS, (void(*)(void))kdf_tls1_3_set_ctx_params },
1082 { OSSL_FUNC_KDF_GETTABLE_CTX_PARAMS,
1083 (void(*)(void))kdf_tls1_3_gettable_ctx_params },
1084 { OSSL_FUNC_KDF_GET_CTX_PARAMS, (void(*)(void))kdf_tls1_3_get_ctx_params },
1085 OSSL_DISPATCH_END
1086};
Mirror of https://github.com/openssl/openssl.git