2 * Copyright (C) 2010 Martin Willi
3 * Copyright (C) 2010 revosec AG
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 #include "tls_crypto.h"
20 ENUM_BEGIN(tls_cipher_suite_names
, TLS_NULL_WITH_NULL_NULL
,
21 TLS_DH_anon_WITH_3DES_EDE_CBC_SHA
,
22 "TLS_NULL_WITH_NULL_NULL",
23 "TLS_RSA_WITH_NULL_MD5",
24 "TLS_RSA_WITH_NULL_SHA",
25 "TLS_RSA_EXPORT_WITH_RC4_40_MD5",
26 "TLS_RSA_WITH_RC4_128_MD5",
27 "TLS_RSA_WITH_RC4_128_SHA",
28 "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5",
29 "TLS_RSA_WITH_IDEA_CBC_SHA",
30 "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA",
31 "TLS_RSA_WITH_DES_CBC_SHA",
32 "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
33 "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA",
34 "TLS_DH_DSS_WITH_DES_CBC_SHA",
35 "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA",
36 "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA",
37 "TLS_DH_RSA_WITH_DES_CBC_SHA",
38 "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA",
39 "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA",
40 "TLS_DHE_DSS_WITH_DES_CBC_SHA",
41 "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
42 "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",
43 "TLS_DHE_RSA_WITH_DES_CBC_SHA",
44 "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
45 "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5",
46 "TLS_DH_anon_WITH_RC4_128_MD5",
47 "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA",
48 "TLS_DH_anon_WITH_DES_CBC_SHA",
49 "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA");
50 ENUM_NEXT(tls_cipher_suite_names
, TLS_KRB5_WITH_DES_CBC_SHA
,
51 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA
,
52 TLS_DH_anon_WITH_3DES_EDE_CBC_SHA
,
53 "TLS_KRB5_WITH_DES_CBC_SHA",
54 "TLS_KRB5_WITH_3DES_EDE_CBC_SHA",
55 "TLS_KRB5_WITH_RC4_128_SHA",
56 "TLS_KRB5_WITH_IDEA_CBC_SHA",
57 "TLS_KRB5_WITH_DES_CBC_MD5",
58 "TLS_KRB5_WITH_3DES_EDE_CBC_MD5",
59 "TLS_KRB5_WITH_RC4_128_MD5",
60 "TLS_KRB5_WITH_IDEA_CBC_MD5",
61 "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA",
62 "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA",
63 "TLS_KRB5_EXPORT_WITH_RC4_40_SHA",
64 "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5",
65 "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5",
66 "TLS_KRB5_EXPORT_WITH_RC4_40_MD5",
67 "TLS_PSK_WITH_NULL_SHA",
68 "TLS_DHE_PSK_WITH_NULL_SHA",
69 "TLS_RSA_PSK_WITH_NULL_SHA",
70 "TLS_RSA_WITH_AES_128_CBC_SHA",
71 "TLS_DH_DSS_WITH_AES_128_CBC_SHA",
72 "TLS_DH_RSA_WITH_AES_128_CBC_SHA",
73 "TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
74 "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
75 "TLS_DH_anon_WITH_AES_128_CBC_SHA",
76 "TLS_RSA_WITH_AES_256_CBC_SHA",
77 "TLS_DH_DSS_WITH_AES_256_CBC_SHA",
78 "TLS_DH_RSA_WITH_AES_256_CBC_SHA",
79 "TLS_DHE_DSS_WITH_AES_256_CBC_SHA",
80 "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
81 "TLS_DH_anon_WITH_AES_256_CBC_SHA",
82 "TLS_RSA_WITH_NULL_SHA256",
83 "TLS_RSA_WITH_AES_128_CBC_SHA256 ",
84 "TLS_RSA_WITH_AES_256_CBC_SHA256",
85 "TLS_DH_DSS_WITH_AES_128_CBC_SHA256",
86 "TLS_DH_RSA_WITH_AES_128_CBC_SHA256",
87 "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
88 "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA",
89 "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA",
90 "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA",
91 "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA",
92 "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA",
93 "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA");
94 ENUM_NEXT(tls_cipher_suite_names
, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
,
95 TLS_DH_anon_WITH_AES_256_CBC_SHA256
,
96 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA
,
97 "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
98 "TLS_DH_DSS_WITH_AES_256_CBC_SHA256",
99 "TLS_DH_RSA_WITH_AES_256_CBC_SHA256",
100 "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256",
101 "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
102 "TLS_DH_anon_WITH_AES_128_CBC_SHA256",
103 "TLS_DH_anon_WITH_AES_256_CBC_SHA256");
104 ENUM_NEXT(tls_cipher_suite_names
, TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
,
105 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256
,
106 TLS_DH_anon_WITH_AES_256_CBC_SHA256
,
107 "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA",
108 "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA",
109 "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA",
110 "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA",
111 "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA",
112 "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA",
113 "TLS_PSK_WITH_RC4_128_SHA",
114 "TLS_PSK_WITH_3DES_EDE_CBC_SHA2",
115 "TLS_PSK_WITH_AES_128_CBC_SHA",
116 "TLS_PSK_WITH_AES_256_CBC_SHA",
117 "TLS_DHE_PSK_WITH_RC4_128_SHA",
118 "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA",
119 "TLS_DHE_PSK_WITH_AES_128_CBC_SHA",
120 "TLS_DHE_PSK_WITH_AES_256_CBC_SHA2",
121 "TLS_RSA_PSK_WITH_RC4_128_SHA",
122 "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA",
123 "TLS_RSA_PSK_WITH_AES_128_CBC_SHA",
124 "TLS_RSA_PSK_WITH_AES_256_CBC_SHA",
125 "TLS_RSA_WITH_SEED_CBC_SHA",
126 "TLS_DH_DSS_WITH_SEED_CBC_SHA",
127 "TLS_DH_RSA_WITH_SEED_CBC_SHA",
128 "TLS_DHE_DSS_WITH_SEED_CBC_SHA",
129 "TLS_DHE_RSA_WITH_SEED_CBC_SHA",
130 "TLS_DH_anon_WITH_SEED_CBC_SHA",
131 "TLS_RSA_WITH_AES_128_GCM_SHA256",
132 "TLS_RSA_WITH_AES_256_GCM_SHA384",
133 "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
134 "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
135 "TLS_DH_RSA_WITH_AES_128_GCM_SHA256",
136 "TLS_DH_RSA_WITH_AES_256_GCM_SHA384",
137 "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256",
138 "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384",
139 "TLS_DH_DSS_WITH_AES_128_GCM_SHA256",
140 "TLS_DH_DSS_WITH_AES_256_GCM_SHA384",
141 "TLS_DH_anon_WITH_AES_128_GCM_SHA256",
142 "TLS_DH_anon_WITH_AES_256_GCM_SHA384",
143 "TLS_PSK_WITH_AES_128_GCM_SHA256",
144 "TLS_PSK_WITH_AES_256_GCM_SHA384",
145 "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256",
146 "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384",
147 "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256",
148 "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384",
149 "TLS_PSK_WITH_AES_128_CBC_SHA256",
150 "TLS_PSK_WITH_AES_256_CBC_SHA384",
151 "TLS_PSK_WITH_NULL_SHA256",
152 "TLS_PSK_WITH_NULL_SHA384",
153 "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256",
154 "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384",
155 "TLS_DHE_PSK_WITH_NULL_SHA256",
156 "TLS_DHE_PSK_WITH_NULL_SHA384",
157 "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256",
158 "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384",
159 "TLS_RSA_PSK_WITH_NULL_SHA256",
160 "TLS_RSA_PSK_WITH_NULL_SHA384",
161 "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256",
162 "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256",
163 "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256",
164 "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256",
165 "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
166 "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256",
167 "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256",
168 "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256",
169 "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256",
170 "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256",
171 "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256",
172 "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256");
173 ENUM_NEXT(tls_cipher_suite_names
, TLS_EMPTY_RENEGOTIATION_INFO_SCSV
,
174 TLS_EMPTY_RENEGOTIATION_INFO_SCSV
,
175 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256
,
176 "TLS_EMPTY_RENEGOTIATION_INFO_SCSV");
177 ENUM_NEXT(tls_cipher_suite_names
, TLS_ECDH_ECDSA_WITH_NULL_SHA
,
178 TLS_ECDHE_PSK_WITH_NULL_SHA384
,
179 TLS_EMPTY_RENEGOTIATION_INFO_SCSV
,
180 "TLS_ECDH_ECDSA_WITH_NULL_SHA",
181 "TLS_ECDH_ECDSA_WITH_RC4_128_SHA",
182 "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA",
183 "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA",
184 "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA",
185 "TLS_ECDHE_ECDSA_WITH_NULL_SHA",
186 "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
187 "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",
188 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
189 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
190 "TLS_ECDH_RSA_WITH_NULL_SHA",
191 "TLS_ECDH_RSA_WITH_RC4_128_SHA",
192 "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA",
193 "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA",
194 "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA",
195 "TLS_ECDHE_RSA_WITH_NULL_SHA",
196 "TLS_ECDHE_RSA_WITH_RC4_128_SHA",
197 "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
198 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
199 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
200 "TLS_ECDH_anon_WITH_NULL_SHA",
201 "TLS_ECDH_anon_WITH_RC4_128_SHA",
202 "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA",
203 "TLS_ECDH_anon_WITH_AES_128_CBC_SHA",
204 "TLS_ECDH_anon_WITH_AES_256_CBC_SHA",
205 "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA",
206 "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA",
207 "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA",
208 "TLS_SRP_SHA_WITH_AES_128_CBC_SHA",
209 "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA",
210 "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA",
211 "TLS_SRP_SHA_WITH_AES_256_CBC_SHA",
212 "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA",
213 "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA",
214 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
215 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
216 "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256",
217 "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384",
218 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
219 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
220 "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256",
221 "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384",
222 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
223 "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
224 "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256",
225 "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384",
226 "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
227 "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
228 "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256",
229 "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384",
230 "TLS_ECDHE_PSK_WITH_RC4_128_SHA",
231 "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA",
232 "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA",
233 "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA",
234 "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256",
235 "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384",
236 "TLS_ECDHE_PSK_WITH_NULL_SHA",
237 "TLS_ECDHE_PSK_WITH_NULL_SHA256",
238 "TLS_ECDHE_PSK_WITH_NULL_SHA384");
239 ENUM_END(tls_cipher_suite_names
, TLS_ECDHE_PSK_WITH_NULL_SHA384
);
241 ENUM(tls_hash_algorithm_names
, TLS_HASH_NONE
, TLS_HASH_SHA512
,
251 ENUM(tls_signature_algorithm_names
, TLS_SIG_RSA
, TLS_SIG_ECDSA
,
257 ENUM_BEGIN(tls_client_certificate_type_names
,
258 TLS_RSA_SIGN
, TLS_DSS_EPHEMERAL_DH
,
265 ENUM_NEXT(tls_client_certificate_type_names
,
266 TLS_FORTEZZA_DMS
, TLS_FORTEZZA_DMS
, TLS_DSS_EPHEMERAL_DH
,
268 ENUM_NEXT(tls_client_certificate_type_names
,
269 TLS_ECDSA_SIGN
, TLS_ECDSA_FIXED_ECDH
, TLS_FORTEZZA_DMS
,
273 ENUM_END(tls_client_certificate_type_names
, TLS_ECDSA_FIXED_ECDH
);
275 ENUM(tls_ecc_curve_type_names
, TLS_ECC_EXPLICIT_PRIME
, TLS_ECC_NAMED_CURVE
,
281 ENUM(tls_named_curve_names
, TLS_SECT163K1
, TLS_SECP521R1
,
309 ENUM(tls_ansi_point_format_names
, TLS_ANSI_COMPRESSED
, TLS_ANSI_HYBRID_Y
,
318 ENUM(tls_ec_point_format_names
,
319 TLS_EC_POINT_UNCOMPRESSED
, TLS_EC_POINT_ANSIX962_COMPRESSED_CHAR2
,
321 "ansiX962 compressed prime",
322 "ansiX962 compressed char2",
325 typedef struct private_tls_crypto_t private_tls_crypto_t
;
328 * Private data of an tls_crypto_t object.
330 struct private_tls_crypto_t
{
333 * Public tls_crypto_t interface.
340 tls_protection_t
*protection
;
343 * List of supported/acceptable cipher suites
345 tls_cipher_suite_t
*suites
;
348 * Number of supported suites
353 * Selected cipher suite
355 tls_cipher_suite_t suite
;
378 * All handshake data concatentated
383 * Connection state TLS PRF
388 * Signer instance for inbound traffic
393 * Signer instance for outbound traffic
395 signer_t
*signer_out
;
398 * Crypter instance for inbound traffic
400 crypter_t
*crypter_in
;
403 * Crypter instance for outbound traffic
405 crypter_t
*crypter_out
;
408 * IV for input decryption, if < TLSv1.2
413 * IV for output decryption, if < TLSv1.2
423 * ASCII string constant used as seed for EAP-[T]TLS MSK PRF
429 tls_cipher_suite_t suite
;
431 diffie_hellman_group_t dh
;
432 hash_algorithm_t hash
;
433 pseudo_random_function_t prf
;
434 integrity_algorithm_t mac
;
435 encryption_algorithm_t encr
;
440 * Mapping suites to a set of algorithms
442 static suite_algs_t suite_algs
[] = {
443 { TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
,
444 KEY_ECDSA
, ECP_256_BIT
,
445 HASH_SHA256
, PRF_HMAC_SHA2_256
,
446 AUTH_HMAC_SHA1_160
, ENCR_AES_CBC
, 16
448 { TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
,
449 KEY_ECDSA
, ECP_256_BIT
,
450 HASH_SHA256
, PRF_HMAC_SHA2_256
,
451 AUTH_HMAC_SHA2_256_256
, ENCR_AES_CBC
, 16
453 { TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
,
454 KEY_ECDSA
, ECP_384_BIT
,
455 HASH_SHA256
, PRF_HMAC_SHA2_256
,
456 AUTH_HMAC_SHA1_160
, ENCR_AES_CBC
, 32
458 { TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
,
459 KEY_ECDSA
, ECP_384_BIT
,
460 HASH_SHA384
, PRF_HMAC_SHA2_384
,
461 AUTH_HMAC_SHA2_384_384
, ENCR_AES_CBC
, 32
463 { TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
,
464 KEY_RSA
, ECP_256_BIT
,
465 HASH_SHA256
, PRF_HMAC_SHA2_256
,
466 AUTH_HMAC_SHA1_160
, ENCR_AES_CBC
, 16
468 { TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
,
469 KEY_RSA
, ECP_256_BIT
,
470 HASH_SHA256
, PRF_HMAC_SHA2_256
,
471 AUTH_HMAC_SHA2_256_256
, ENCR_AES_CBC
, 16
473 { TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
,
474 KEY_RSA
, ECP_384_BIT
,
475 HASH_SHA256
, PRF_HMAC_SHA2_256
,
476 AUTH_HMAC_SHA1_160
, ENCR_AES_CBC
, 32
478 { TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
,
479 KEY_RSA
, ECP_384_BIT
,
480 HASH_SHA384
, PRF_HMAC_SHA2_384
,
481 AUTH_HMAC_SHA2_384_384
, ENCR_AES_CBC
, 32
483 { TLS_DHE_RSA_WITH_AES_128_CBC_SHA
,
484 KEY_RSA
, MODP_2048_BIT
,
485 HASH_SHA256
,PRF_HMAC_SHA2_256
,
486 AUTH_HMAC_SHA1_160
, ENCR_AES_CBC
, 16
488 { TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
,
489 KEY_RSA
, MODP_3072_BIT
,
490 HASH_SHA256
, PRF_HMAC_SHA2_256
,
491 AUTH_HMAC_SHA2_256_256
, ENCR_AES_CBC
, 16
493 { TLS_DHE_RSA_WITH_AES_256_CBC_SHA
,
494 KEY_RSA
, MODP_3072_BIT
,
495 HASH_SHA256
, PRF_HMAC_SHA2_256
,
496 AUTH_HMAC_SHA1_160
, ENCR_AES_CBC
, 32
498 { TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
,
499 KEY_RSA
, MODP_4096_BIT
,
500 HASH_SHA256
, PRF_HMAC_SHA2_256
,
501 AUTH_HMAC_SHA2_256_256
, ENCR_AES_CBC
, 32
503 { TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
,
504 KEY_RSA
, MODP_2048_BIT
,
505 HASH_SHA256
, PRF_HMAC_SHA2_256
,
506 AUTH_HMAC_SHA1_160
, ENCR_CAMELLIA_CBC
, 16
508 { TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
,
509 KEY_RSA
, MODP_3072_BIT
,
510 HASH_SHA256
, PRF_HMAC_SHA2_256
,
511 AUTH_HMAC_SHA2_256_256
, ENCR_CAMELLIA_CBC
, 16
513 { TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
,
514 KEY_RSA
, MODP_3072_BIT
,
515 HASH_SHA256
, PRF_HMAC_SHA2_256
,
516 AUTH_HMAC_SHA1_160
, ENCR_CAMELLIA_CBC
, 32
518 { TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
,
519 KEY_RSA
, MODP_4096_BIT
,
520 HASH_SHA256
, PRF_HMAC_SHA2_256
,
521 AUTH_HMAC_SHA2_256_256
, ENCR_CAMELLIA_CBC
, 32
523 { TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
,
524 KEY_RSA
, MODP_2048_BIT
,
525 HASH_SHA256
, PRF_HMAC_SHA2_256
,
526 AUTH_HMAC_SHA1_160
, ENCR_3DES
, 0
528 { TLS_RSA_WITH_AES_128_CBC_SHA
,
530 HASH_SHA256
, PRF_HMAC_SHA2_256
,
531 AUTH_HMAC_SHA1_160
, ENCR_AES_CBC
, 16
533 { TLS_RSA_WITH_AES_128_CBC_SHA256
,
535 HASH_SHA256
, PRF_HMAC_SHA2_256
,
536 AUTH_HMAC_SHA2_256_256
, ENCR_AES_CBC
, 16
538 { TLS_RSA_WITH_AES_256_CBC_SHA
,
540 HASH_SHA256
, PRF_HMAC_SHA2_256
,
541 AUTH_HMAC_SHA1_160
, ENCR_AES_CBC
, 32
543 { TLS_RSA_WITH_AES_256_CBC_SHA256
,
545 HASH_SHA256
, PRF_HMAC_SHA2_256
,
546 AUTH_HMAC_SHA2_256_256
, ENCR_AES_CBC
, 32
548 { TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
,
550 HASH_SHA256
, PRF_HMAC_SHA2_256
,
551 AUTH_HMAC_SHA1_160
, ENCR_CAMELLIA_CBC
, 16
553 { TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
,
555 HASH_SHA256
, PRF_HMAC_SHA2_256
,
556 AUTH_HMAC_SHA2_256_256
, ENCR_CAMELLIA_CBC
, 16
558 { TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
,
560 HASH_SHA256
, PRF_HMAC_SHA2_256
,
561 AUTH_HMAC_SHA1_160
, ENCR_CAMELLIA_CBC
, 32
563 { TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
,
565 HASH_SHA256
, PRF_HMAC_SHA2_256
,
566 AUTH_HMAC_SHA2_256_256
, ENCR_CAMELLIA_CBC
, 32
568 { TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
,
569 KEY_ECDSA
, ECP_256_BIT
,
570 HASH_SHA256
, PRF_HMAC_SHA2_256
,
571 AUTH_HMAC_SHA1_160
, ENCR_3DES
, 0
573 { TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
,
574 KEY_RSA
, ECP_256_BIT
,
575 HASH_SHA256
, PRF_HMAC_SHA2_256
,
576 AUTH_HMAC_SHA1_160
, ENCR_3DES
, 0
578 { TLS_RSA_WITH_3DES_EDE_CBC_SHA
,
580 HASH_SHA256
, PRF_HMAC_SHA2_256
,
581 AUTH_HMAC_SHA1_160
, ENCR_3DES
, 0
583 { TLS_ECDHE_ECDSA_WITH_NULL_SHA
,
584 KEY_ECDSA
, ECP_256_BIT
,
585 HASH_SHA256
, PRF_HMAC_SHA2_256
,
586 AUTH_HMAC_SHA1_160
, ENCR_NULL
, 0
588 { TLS_ECDHE_RSA_WITH_NULL_SHA
,
589 KEY_ECDSA
, ECP_256_BIT
,
590 HASH_SHA256
, PRF_HMAC_SHA2_256
,
591 AUTH_HMAC_SHA1_160
, ENCR_NULL
, 0
593 { TLS_RSA_WITH_NULL_SHA
,
595 HASH_SHA256
, PRF_HMAC_SHA2_256
,
596 AUTH_HMAC_SHA1_160
, ENCR_NULL
, 0
598 { TLS_RSA_WITH_NULL_SHA256
,
600 HASH_SHA256
, PRF_HMAC_SHA2_256
,
601 AUTH_HMAC_SHA2_256_256
, ENCR_NULL
, 0
603 { TLS_RSA_WITH_NULL_MD5
,
605 HASH_SHA256
, PRF_HMAC_SHA2_256
,
606 AUTH_HMAC_MD5_128
, ENCR_NULL
, 0
611 * Look up algorithms by a suite
613 static suite_algs_t
*find_suite(tls_cipher_suite_t suite
)
617 for (i
= 0; i
< countof(suite_algs
); i
++)
619 if (suite_algs
[i
].suite
== suite
)
621 return &suite_algs
[i
];
628 * Filter a suite list using a transform enumerator
630 static void filter_suite(private_tls_crypto_t
*this,
631 suite_algs_t suites
[], int *count
, int offset
,
632 enumerator_t
*(*create_enumerator
)(crypto_factory_t
*))
634 const char *plugin_name
;
635 suite_algs_t current
;
636 int *current_alg
, i
, remaining
= 0;
637 enumerator_t
*enumerator
;
639 memset(¤t
, 0, sizeof(current
));
640 current_alg
= (int*)((char*)¤t
+ offset
);
642 for (i
= 0; i
< *count
; i
++)
644 enumerator
= create_enumerator(lib
->crypto
);
645 while (enumerator
->enumerate(enumerator
, current_alg
, &plugin_name
))
647 if ((suites
[i
].encr
== ENCR_NULL
||
648 !current
.encr
|| current
.encr
== suites
[i
].encr
) &&
649 (!current
.mac
|| current
.mac
== suites
[i
].mac
) &&
650 (!current
.prf
|| current
.prf
== suites
[i
].prf
) &&
651 (!current
.hash
|| current
.hash
== suites
[i
].hash
) &&
652 (suites
[i
].dh
== MODP_NONE
||
653 !current
.dh
|| current
.dh
== suites
[i
].dh
))
655 suites
[remaining
] = suites
[i
];
660 enumerator
->destroy(enumerator
);
666 * Purge NULL encryption cipher suites from list
668 static void filter_null_suites(private_tls_crypto_t
*this,
669 suite_algs_t suites
[], int *count
)
671 int i
, remaining
= 0;
673 for (i
= 0; i
< *count
; i
++)
675 if (suites
[i
].encr
!= ENCR_NULL
)
677 suites
[remaining
] = suites
[i
];
685 * Purge suites using a given key type
687 static void filter_key_suites(private_tls_crypto_t
*this,
688 suite_algs_t suites
[], int *count
, key_type_t key
)
690 int i
, remaining
= 0;
692 DBG2(DBG_TLS
, "disabling %N suites, no backend found", key_type_names
, key
);
693 for (i
= 0; i
< *count
; i
++)
695 if (suites
[i
].key
!= key
)
697 suites
[remaining
] = suites
[i
];
705 * Filter suites by key exchange user config
707 static void filter_key_exchange_config_suites(private_tls_crypto_t
*this,
708 suite_algs_t suites
[], int *count
)
710 enumerator_t
*enumerator
;
711 int i
, remaining
= 0;
712 char *token
, *config
;
714 config
= lib
->settings
->get_str(lib
->settings
, "libtls.key_exchange", NULL
);
717 for (i
= 0; i
< *count
; i
++)
719 enumerator
= enumerator_create_token(config
, ",", " ");
720 while (enumerator
->enumerate(enumerator
, &token
))
722 if (strcaseeq(token
, "ecdhe-ecdsa") &&
723 diffie_hellman_group_is_ec(suites
[i
].dh
) &&
724 suites
[i
].key
== KEY_ECDSA
)
726 suites
[remaining
++] = suites
[i
];
729 if (strcaseeq(token
, "ecdhe-rsa") &&
730 diffie_hellman_group_is_ec(suites
[i
].dh
) &&
731 suites
[i
].key
== KEY_RSA
)
733 suites
[remaining
++] = suites
[i
];
736 if (strcaseeq(token
, "dhe-rsa") &&
737 !diffie_hellman_group_is_ec(suites
[i
].dh
) &&
738 suites
[i
].dh
!= MODP_NONE
&&
739 suites
[i
].key
== KEY_RSA
)
741 suites
[remaining
++] = suites
[i
];
744 if (strcaseeq(token
, "rsa") &&
745 suites
[i
].dh
== MODP_NONE
&&
746 suites
[i
].key
== KEY_RSA
)
748 suites
[remaining
++] = suites
[i
];
752 enumerator
->destroy(enumerator
);
759 * Filter suites by cipher user config
761 static void filter_cipher_config_suites(private_tls_crypto_t
*this,
762 suite_algs_t suites
[], int *count
)
764 enumerator_t
*enumerator
;
765 int i
, remaining
= 0;
766 char *token
, *config
;
768 config
= lib
->settings
->get_str(lib
->settings
, "libtls.cipher", NULL
);
771 for (i
= 0; i
< *count
; i
++)
773 enumerator
= enumerator_create_token(config
, ",", " ");
774 while (enumerator
->enumerate(enumerator
, &token
))
776 if (strcaseeq(token
, "aes128") &&
777 suites
[i
].encr
== ENCR_AES_CBC
&&
778 suites
[i
].encr_size
== 16)
780 suites
[remaining
++] = suites
[i
];
783 if (strcaseeq(token
, "aes256") &&
784 suites
[i
].encr
== ENCR_AES_CBC
&&
785 suites
[i
].encr_size
== 32)
787 suites
[remaining
++] = suites
[i
];
790 if (strcaseeq(token
, "camellia128") &&
791 suites
[i
].encr
== ENCR_CAMELLIA_CBC
&&
792 suites
[i
].encr_size
== 16)
794 suites
[remaining
++] = suites
[i
];
797 if (strcaseeq(token
, "camellia256") &&
798 suites
[i
].encr
== ENCR_CAMELLIA_CBC
&&
799 suites
[i
].encr_size
== 32)
801 suites
[remaining
++] = suites
[i
];
804 if (strcaseeq(token
, "3des") &&
805 suites
[i
].encr
== ENCR_3DES
)
807 suites
[remaining
++] = suites
[i
];
810 if (strcaseeq(token
, "null") &&
811 suites
[i
].encr
== ENCR_NULL
)
813 suites
[remaining
++] = suites
[i
];
817 enumerator
->destroy(enumerator
);
824 * Filter suites by mac user config
826 static void filter_mac_config_suites(private_tls_crypto_t
*this,
827 suite_algs_t suites
[], int *count
)
829 enumerator_t
*enumerator
;
830 int i
, remaining
= 0;
831 char *token
, *config
;
833 config
= lib
->settings
->get_str(lib
->settings
, "libtls.mac", NULL
);
836 for (i
= 0; i
< *count
; i
++)
838 enumerator
= enumerator_create_token(config
, ",", " ");
839 while (enumerator
->enumerate(enumerator
, &token
))
841 if (strcaseeq(token
, "md5") &&
842 suites
[i
].mac
== AUTH_HMAC_MD5_128
)
844 suites
[remaining
++] = suites
[i
];
847 if (strcaseeq(token
, "sha1") &&
848 suites
[i
].mac
== AUTH_HMAC_SHA1_160
)
850 suites
[remaining
++] = suites
[i
];
853 if (strcaseeq(token
, "sha256") &&
854 suites
[i
].mac
== AUTH_HMAC_SHA2_256_256
)
856 suites
[remaining
++] = suites
[i
];
859 if (strcaseeq(token
, "sha384") &&
860 suites
[i
].mac
== AUTH_HMAC_SHA2_384_384
)
862 suites
[remaining
++] = suites
[i
];
866 enumerator
->destroy(enumerator
);
873 * Filter for specific suites specified in strongswan.conf
875 static void filter_specific_config_suites(private_tls_crypto_t
*this,
876 suite_algs_t suites
[], int *count
)
878 enumerator_t
*enumerator
;
879 int i
, remaining
= 0, suite
;
880 char *token
, *config
;
882 config
= lib
->settings
->get_str(lib
->settings
, "libtls.suites", NULL
);
885 for (i
= 0; i
< *count
; i
++)
887 enumerator
= enumerator_create_token(config
, ",", " ");
888 while (enumerator
->enumerate(enumerator
, &token
))
890 suite
= enum_from_name(tls_cipher_suite_names
, token
);
891 if (suite
== suites
[i
].suite
)
893 suites
[remaining
++] = suites
[i
];
897 enumerator
->destroy(enumerator
);
904 * Initialize the cipher suite list
906 static void build_cipher_suite_list(private_tls_crypto_t
*this,
907 bool require_encryption
)
909 suite_algs_t suites
[countof(suite_algs
)];
910 int count
= countof(suite_algs
), i
;
912 /* copy all suites */
913 for (i
= 0; i
< count
; i
++)
915 suites
[i
] = suite_algs
[i
];
917 if (require_encryption
)
919 filter_null_suites(this, suites
, &count
);
923 filter_key_suites(this, suites
, &count
, KEY_RSA
);
927 filter_key_suites(this, suites
, &count
, KEY_ECDSA
);
930 /* filter suite list by each algorithm */
931 filter_suite(this, suites
, &count
, offsetof(suite_algs_t
, encr
),
932 lib
->crypto
->create_crypter_enumerator
);
933 filter_suite(this, suites
, &count
, offsetof(suite_algs_t
, mac
),
934 lib
->crypto
->create_signer_enumerator
);
935 filter_suite(this, suites
, &count
, offsetof(suite_algs_t
, prf
),
936 lib
->crypto
->create_prf_enumerator
);
937 filter_suite(this, suites
, &count
, offsetof(suite_algs_t
, hash
),
938 lib
->crypto
->create_hasher_enumerator
);
939 filter_suite(this, suites
, &count
, offsetof(suite_algs_t
, dh
),
940 lib
->crypto
->create_dh_enumerator
);
942 /* filter suites with strongswan.conf options */
943 filter_key_exchange_config_suites(this, suites
, &count
);
944 filter_cipher_config_suites(this, suites
, &count
);
945 filter_mac_config_suites(this, suites
, &count
);
946 filter_specific_config_suites(this, suites
, &count
);
949 this->suite_count
= count
;
950 this->suites
= malloc(sizeof(tls_cipher_suite_t
) * count
);
952 DBG2(DBG_TLS
, "%d supported TLS cipher suites:", count
);
953 for (i
= 0; i
< count
; i
++)
955 DBG2(DBG_TLS
, " %N", tls_cipher_suite_names
, suites
[i
].suite
);
956 this->suites
[i
] = suites
[i
].suite
;
960 METHOD(tls_crypto_t
, get_cipher_suites
, int,
961 private_tls_crypto_t
*this, tls_cipher_suite_t
**suites
)
963 *suites
= this->suites
;
964 return this->suite_count
;
968 * Create crypto primitives
970 static bool create_ciphers(private_tls_crypto_t
*this, suite_algs_t
*algs
)
972 DESTROY_IF(this->prf
);
973 if (this->tls
->get_version(this->tls
) < TLS_1_2
)
975 this->prf
= tls_prf_create_10();
979 this->prf
= tls_prf_create_12(algs
->prf
);
983 DBG1(DBG_TLS
, "selected TLS PRF not supported");
987 DESTROY_IF(this->signer_in
);
988 DESTROY_IF(this->signer_out
);
989 this->signer_in
= lib
->crypto
->create_signer(lib
->crypto
, algs
->mac
);
990 this->signer_out
= lib
->crypto
->create_signer(lib
->crypto
, algs
->mac
);
991 if (!this->signer_in
|| !this->signer_out
)
993 DBG1(DBG_TLS
, "selected TLS MAC %N not supported",
994 integrity_algorithm_names
, algs
->mac
);
998 DESTROY_IF(this->crypter_in
);
999 DESTROY_IF(this->crypter_out
);
1000 if (algs
->encr
== ENCR_NULL
)
1002 this->crypter_in
= this->crypter_out
= NULL
;
1006 this->crypter_in
= lib
->crypto
->create_crypter(lib
->crypto
,
1007 algs
->encr
, algs
->encr_size
);
1008 this->crypter_out
= lib
->crypto
->create_crypter(lib
->crypto
,
1009 algs
->encr
, algs
->encr_size
);
1010 if (!this->crypter_in
|| !this->crypter_out
)
1012 DBG1(DBG_TLS
, "selected TLS crypter %N not supported",
1013 encryption_algorithm_names
, algs
->encr
);
1020 METHOD(tls_crypto_t
, select_cipher_suite
, tls_cipher_suite_t
,
1021 private_tls_crypto_t
*this, tls_cipher_suite_t
*suites
, int count
,
1027 for (i
= 0; i
< this->suite_count
; i
++)
1029 for (j
= 0; j
< count
; j
++)
1031 if (this->suites
[i
] == suites
[j
])
1033 algs
= find_suite(this->suites
[i
]);
1036 if (key
== KEY_ANY
|| key
== algs
->key
)
1038 if (create_ciphers(this, algs
))
1040 this->suite
= this->suites
[i
];
1051 METHOD(tls_crypto_t
, get_dh_group
, diffie_hellman_group_t
,
1052 private_tls_crypto_t
*this)
1056 algs
= find_suite(this->suite
);
1064 METHOD(tls_crypto_t
, get_signature_algorithms
, void,
1065 private_tls_crypto_t
*this, bio_writer_t
*writer
)
1067 bio_writer_t
*supported
;
1068 enumerator_t
*enumerator
;
1069 hash_algorithm_t alg
;
1070 tls_hash_algorithm_t hash
;
1071 const char *plugin_name
;
1073 supported
= bio_writer_create(32);
1074 enumerator
= lib
->crypto
->create_hasher_enumerator(lib
->crypto
);
1075 while (enumerator
->enumerate(enumerator
, &alg
, &plugin_name
))
1080 hash
= TLS_HASH_MD5
;
1083 hash
= TLS_HASH_SHA1
;
1086 hash
= TLS_HASH_SHA224
;
1089 hash
= TLS_HASH_SHA256
;
1092 hash
= TLS_HASH_SHA384
;
1095 hash
= TLS_HASH_SHA512
;
1102 supported
->write_uint8(supported
, hash
);
1103 supported
->write_uint8(supported
, TLS_SIG_RSA
);
1105 if (this->ecdsa
&& alg
!= HASH_MD5
&& alg
!= HASH_SHA224
)
1106 { /* currently we have no signature scheme for MD5/SHA224 */
1107 supported
->write_uint8(supported
, hash
);
1108 supported
->write_uint8(supported
, TLS_SIG_ECDSA
);
1111 enumerator
->destroy(enumerator
);
1113 writer
->write_data16(writer
, supported
->get_buf(supported
));
1114 supported
->destroy(supported
);
1118 * Mapping groups to TLS named curves
1121 diffie_hellman_group_t group
;
1122 tls_named_curve_t curve
;
1124 { ECP_256_BIT
, TLS_SECP256R1
},
1125 { ECP_384_BIT
, TLS_SECP384R1
},
1126 { ECP_521_BIT
, TLS_SECP521R1
},
1127 { ECP_224_BIT
, TLS_SECP224R1
},
1128 { ECP_192_BIT
, TLS_SECP192R1
},
1132 * Filter EC groups, add TLS curve
1134 static bool group_filter(void *null
,
1135 diffie_hellman_group_t
*in
, diffie_hellman_group_t
*out
,
1136 void* dummy1
, tls_named_curve_t
*curve
)
1140 for (i
= 0; i
< countof(curves
); i
++)
1142 if (curves
[i
].group
== *in
)
1146 *out
= curves
[i
].group
;
1150 *curve
= curves
[i
].curve
;
1158 METHOD(tls_crypto_t
, create_ec_enumerator
, enumerator_t
*,
1159 private_tls_crypto_t
*this)
1161 return enumerator_create_filter(
1162 lib
->crypto
->create_dh_enumerator(lib
->crypto
),
1163 (void*)group_filter
, NULL
, NULL
);
1166 METHOD(tls_crypto_t
, set_protection
, void,
1167 private_tls_crypto_t
*this, tls_protection_t
*protection
)
1169 this->protection
= protection
;
1172 METHOD(tls_crypto_t
, append_handshake
, void,
1173 private_tls_crypto_t
*this, tls_handshake_type_t type
, chunk_t data
)
1177 /* reconstruct handshake header */
1178 header
= htonl(data
.len
| (type
<< 24));
1179 this->handshake
= chunk_cat("mcc", this->handshake
,
1180 chunk_from_thing(header
), data
);
1184 * Create a hash using the suites HASH algorithm
1186 static bool hash_data(private_tls_crypto_t
*this, chunk_t data
, chunk_t
*hash
)
1188 if (this->tls
->get_version(this->tls
) >= TLS_1_2
)
1193 alg
= find_suite(this->suite
);
1198 hasher
= lib
->crypto
->create_hasher(lib
->crypto
, alg
->hash
);
1199 if (!hasher
|| !hasher
->allocate_hash(hasher
, data
, hash
))
1201 DBG1(DBG_TLS
, "%N not supported", hash_algorithm_names
, alg
->hash
);
1205 hasher
->destroy(hasher
);
1209 hasher_t
*md5
, *sha1
;
1210 char buf
[HASH_SIZE_MD5
+ HASH_SIZE_SHA1
];
1212 md5
= lib
->crypto
->create_hasher(lib
->crypto
, HASH_MD5
);
1213 if (!md5
|| !md5
->get_hash(md5
, data
, buf
))
1215 DBG1(DBG_TLS
, "%N not supported", hash_algorithm_names
, HASH_MD5
);
1220 sha1
= lib
->crypto
->create_hasher(lib
->crypto
, HASH_SHA1
);
1221 if (!sha1
|| !sha1
->get_hash(sha1
, data
, buf
+ HASH_SIZE_MD5
))
1223 DBG1(DBG_TLS
, "%N not supported", hash_algorithm_names
, HASH_SHA1
);
1227 sha1
->destroy(sha1
);
1229 *hash
= chunk_clone(chunk_from_thing(buf
));
1235 * Get the signature scheme from a TLS 1.2 hash/sig algorithm pair
1237 static signature_scheme_t
hashsig_to_scheme(key_type_t type
,
1238 tls_hash_algorithm_t hash
, tls_signature_algorithm_t sig
)
1243 if (type
!= KEY_RSA
)
1245 return SIGN_UNKNOWN
;
1250 return SIGN_RSA_EMSA_PKCS1_MD5
;
1252 return SIGN_RSA_EMSA_PKCS1_SHA1
;
1253 case TLS_HASH_SHA224
:
1254 return SIGN_RSA_EMSA_PKCS1_SHA224
;
1255 case TLS_HASH_SHA256
:
1256 return SIGN_RSA_EMSA_PKCS1_SHA256
;
1257 case TLS_HASH_SHA384
:
1258 return SIGN_RSA_EMSA_PKCS1_SHA384
;
1259 case TLS_HASH_SHA512
:
1260 return SIGN_RSA_EMSA_PKCS1_SHA512
;
1262 return SIGN_UNKNOWN
;
1265 if (type
!= KEY_ECDSA
)
1267 return SIGN_UNKNOWN
;
1271 case TLS_HASH_SHA224
:
1272 return SIGN_ECDSA_WITH_SHA1_DER
;
1273 case TLS_HASH_SHA256
:
1274 return SIGN_ECDSA_WITH_SHA256_DER
;
1275 case TLS_HASH_SHA384
:
1276 return SIGN_ECDSA_WITH_SHA384_DER
;
1277 case TLS_HASH_SHA512
:
1278 return SIGN_ECDSA_WITH_SHA512_DER
;
1280 return SIGN_UNKNOWN
;
1283 return SIGN_UNKNOWN
;
1287 METHOD(tls_crypto_t
, sign
, bool,
1288 private_tls_crypto_t
*this, private_key_t
*key
, bio_writer_t
*writer
,
1289 chunk_t data
, chunk_t hashsig
)
1291 if (this->tls
->get_version(this->tls
) >= TLS_1_2
)
1293 signature_scheme_t scheme
;
1294 bio_reader_t
*reader
;
1300 { /* fallback if none given */
1301 hashsig
= chunk_from_chars(
1302 TLS_HASH_SHA1
, TLS_SIG_RSA
, TLS_HASH_SHA1
, TLS_SIG_ECDSA
);
1304 reader
= bio_reader_create(hashsig
);
1305 while (reader
->remaining(reader
) >= 2)
1307 if (reader
->read_uint8(reader
, &hash
) &&
1308 reader
->read_uint8(reader
, &alg
))
1310 scheme
= hashsig_to_scheme(key
->get_type(key
), hash
, alg
);
1311 if (scheme
!= SIGN_UNKNOWN
&&
1312 key
->sign(key
, scheme
, data
, &sig
))
1319 reader
->destroy(reader
);
1322 DBG1(DBG_TLS
, "none of the proposed hash/sig algorithms supported");
1325 DBG2(DBG_TLS
, "created signature with %N/%N",
1326 tls_hash_algorithm_names
, hash
, tls_signature_algorithm_names
, alg
);
1327 writer
->write_uint8(writer
, hash
);
1328 writer
->write_uint8(writer
, alg
);
1329 writer
->write_data16(writer
, sig
);
1337 switch (key
->get_type(key
))
1340 if (!hash_data(this, data
, &hash
))
1344 done
= key
->sign(key
, SIGN_RSA_EMSA_PKCS1_NULL
, hash
, &sig
);
1350 DBG2(DBG_TLS
, "created signature with MD5+SHA1/RSA");
1353 if (!key
->sign(key
, SIGN_ECDSA_WITH_SHA1_DER
, data
, &sig
))
1357 DBG2(DBG_TLS
, "created signature with SHA1/ECDSA");
1362 writer
->write_data16(writer
, sig
);
1368 METHOD(tls_crypto_t
, verify
, bool,
1369 private_tls_crypto_t
*this, public_key_t
*key
, bio_reader_t
*reader
,
1372 if (this->tls
->get_version(this->tls
) >= TLS_1_2
)
1374 signature_scheme_t scheme
= SIGN_UNKNOWN
;
1378 if (!reader
->read_uint8(reader
, &hash
) ||
1379 !reader
->read_uint8(reader
, &alg
) ||
1380 !reader
->read_data16(reader
, &sig
))
1382 DBG1(DBG_TLS
, "received invalid signature");
1385 scheme
= hashsig_to_scheme(key
->get_type(key
), hash
, alg
);
1386 if (scheme
== SIGN_UNKNOWN
)
1388 DBG1(DBG_TLS
, "signature algorithms %N/%N not supported",
1389 tls_hash_algorithm_names
, hash
,
1390 tls_signature_algorithm_names
, alg
);
1393 if (!key
->verify(key
, scheme
, data
, sig
))
1397 DBG2(DBG_TLS
, "verified signature with %N/%N",
1398 tls_hash_algorithm_names
, hash
, tls_signature_algorithm_names
, alg
);
1405 if (!reader
->read_data16(reader
, &sig
))
1407 DBG1(DBG_TLS
, "received invalid signature");
1410 switch (key
->get_type(key
))
1413 if (!hash_data(this, data
, &hash
))
1417 done
= key
->verify(key
, SIGN_RSA_EMSA_PKCS1_NULL
, hash
, sig
);
1423 DBG2(DBG_TLS
, "verified signature data with MD5+SHA1/RSA");
1426 if (!key
->verify(key
, SIGN_ECDSA_WITH_SHA1_DER
, data
, sig
))
1430 DBG2(DBG_TLS
, "verified signature with SHA1/ECDSA");
1439 METHOD(tls_crypto_t
, sign_handshake
, bool,
1440 private_tls_crypto_t
*this, private_key_t
*key
, bio_writer_t
*writer
,
1443 return sign(this, key
, writer
, this->handshake
, hashsig
);
1446 METHOD(tls_crypto_t
, verify_handshake
, bool,
1447 private_tls_crypto_t
*this, public_key_t
*key
, bio_reader_t
*reader
)
1449 return verify(this, key
, reader
, this->handshake
);
1452 METHOD(tls_crypto_t
, calculate_finished
, bool,
1453 private_tls_crypto_t
*this, char *label
, char out
[12])
1461 if (!hash_data(this, this->handshake
, &seed
))
1465 if (!this->prf
->get_bytes(this->prf
, label
, seed
, 12, out
))
1475 * Derive master secret from premaster, optionally save session
1477 static bool derive_master(private_tls_crypto_t
*this, chunk_t premaster
,
1478 chunk_t session
, identification_t
*id
,
1479 chunk_t client_random
, chunk_t server_random
)
1484 /* derive master secret */
1485 seed
= chunk_cata("cc", client_random
, server_random
);
1487 if (!this->prf
->set_key(this->prf
, premaster
) ||
1488 !this->prf
->get_bytes(this->prf
, "master secret", seed
,
1489 sizeof(master
), master
) ||
1490 !this->prf
->set_key(this->prf
, chunk_from_thing(master
)))
1495 if (this->cache
&& session
.len
)
1497 this->cache
->create(this->cache
, session
, id
, chunk_from_thing(master
),
1500 memwipe(master
, sizeof(master
));
1505 * Expand key material from master secret
1507 static bool expand_keys(private_tls_crypto_t
*this,
1508 chunk_t client_random
, chunk_t server_random
)
1510 chunk_t seed
, block
, client_write
, server_write
;
1511 int mks
, eks
= 0, ivs
= 0;
1513 /* derive key block for key expansion */
1514 mks
= this->signer_out
->get_key_size(this->signer_out
);
1515 if (this->crypter_out
)
1517 eks
= this->crypter_out
->get_key_size(this->crypter_out
);
1518 if (this->tls
->get_version(this->tls
) < TLS_1_1
)
1520 ivs
= this->crypter_out
->get_iv_size(this->crypter_out
);
1523 seed
= chunk_cata("cc", server_random
, client_random
);
1524 block
= chunk_alloca((mks
+ eks
+ ivs
) * 2);
1525 if (!this->prf
->get_bytes(this->prf
, "key expansion", seed
,
1526 block
.len
, block
.ptr
))
1532 client_write
= chunk_create(block
.ptr
, mks
);
1533 block
= chunk_skip(block
, mks
);
1534 server_write
= chunk_create(block
.ptr
, mks
);
1535 block
= chunk_skip(block
, mks
);
1536 if (this->tls
->is_server(this->tls
))
1538 if (!this->signer_in
->set_key(this->signer_in
, client_write
) ||
1539 !this->signer_out
->set_key(this->signer_out
, server_write
))
1546 if (!this->signer_out
->set_key(this->signer_out
, client_write
) ||
1547 !this->signer_in
->set_key(this->signer_in
, server_write
))
1553 /* crypter keys, and IVs if < TLSv1.2 */
1554 if (this->crypter_out
&& this->crypter_in
)
1556 client_write
= chunk_create(block
.ptr
, eks
);
1557 block
= chunk_skip(block
, eks
);
1558 server_write
= chunk_create(block
.ptr
, eks
);
1559 block
= chunk_skip(block
, eks
);
1561 if (this->tls
->is_server(this->tls
))
1563 if (!this->crypter_in
->set_key(this->crypter_in
, client_write
) ||
1564 !this->crypter_out
->set_key(this->crypter_out
, server_write
))
1571 if (!this->crypter_out
->set_key(this->crypter_out
, client_write
) ||
1572 !this->crypter_in
->set_key(this->crypter_in
, server_write
))
1579 client_write
= chunk_create(block
.ptr
, ivs
);
1580 block
= chunk_skip(block
, ivs
);
1581 server_write
= chunk_create(block
.ptr
, ivs
);
1582 block
= chunk_skip(block
, ivs
);
1584 if (this->tls
->is_server(this->tls
))
1586 this->iv_in
= chunk_clone(client_write
);
1587 this->iv_out
= chunk_clone(server_write
);
1591 this->iv_out
= chunk_clone(client_write
);
1592 this->iv_in
= chunk_clone(server_write
);
1598 if (this->msk_label
)
1600 seed
= chunk_cata("cc", client_random
, server_random
);
1601 this->msk
= chunk_alloc(64);
1602 if (!this->prf
->get_bytes(this->prf
, this->msk_label
, seed
,
1603 this->msk
.len
, this->msk
.ptr
))
1611 METHOD(tls_crypto_t
, derive_secrets
, bool,
1612 private_tls_crypto_t
*this, chunk_t premaster
, chunk_t session
,
1613 identification_t
*id
, chunk_t client_random
, chunk_t server_random
)
1615 return derive_master(this, premaster
, session
, id
,
1616 client_random
, server_random
) &&
1617 expand_keys(this, client_random
, server_random
);
1620 METHOD(tls_crypto_t
, resume_session
, tls_cipher_suite_t
,
1621 private_tls_crypto_t
*this, chunk_t session
, identification_t
*id
,
1622 chunk_t client_random
, chunk_t server_random
)
1626 if (this->cache
&& session
.len
)
1628 this->suite
= this->cache
->lookup(this->cache
, session
, id
, &master
);
1631 this->suite
= select_cipher_suite(this, &this->suite
, 1, KEY_ANY
);
1634 if (!this->prf
->set_key(this->prf
, master
) ||
1635 !expand_keys(this, client_random
, server_random
))
1640 chunk_clear(&master
);
1647 METHOD(tls_crypto_t
, get_session
, chunk_t
,
1648 private_tls_crypto_t
*this, identification_t
*server
)
1652 return this->cache
->check(this->cache
, server
);
1657 METHOD(tls_crypto_t
, change_cipher
, void,
1658 private_tls_crypto_t
*this, bool inbound
)
1660 if (this->protection
)
1664 this->protection
->set_cipher(this->protection
, TRUE
,
1665 this->signer_in
, this->crypter_in
, this->iv_in
);
1669 this->protection
->set_cipher(this->protection
, FALSE
,
1670 this->signer_out
, this->crypter_out
, this->iv_out
);
1675 METHOD(tls_crypto_t
, get_eap_msk
, chunk_t
,
1676 private_tls_crypto_t
*this)
1681 METHOD(tls_crypto_t
, destroy
, void,
1682 private_tls_crypto_t
*this)
1684 DESTROY_IF(this->signer_in
);
1685 DESTROY_IF(this->signer_out
);
1686 DESTROY_IF(this->crypter_in
);
1687 DESTROY_IF(this->crypter_out
);
1688 free(this->iv_in
.ptr
);
1689 free(this->iv_out
.ptr
);
1690 free(this->handshake
.ptr
);
1691 free(this->msk
.ptr
);
1692 DESTROY_IF(this->prf
);
1700 tls_crypto_t
*tls_crypto_create(tls_t
*tls
, tls_cache_t
*cache
)
1702 private_tls_crypto_t
*this;
1703 enumerator_t
*enumerator
;
1704 credential_type_t type
;
1709 .get_cipher_suites
= _get_cipher_suites
,
1710 .select_cipher_suite
= _select_cipher_suite
,
1711 .get_dh_group
= _get_dh_group
,
1712 .get_signature_algorithms
= _get_signature_algorithms
,
1713 .create_ec_enumerator
= _create_ec_enumerator
,
1714 .set_protection
= _set_protection
,
1715 .append_handshake
= _append_handshake
,
1718 .sign_handshake
= _sign_handshake
,
1719 .verify_handshake
= _verify_handshake
,
1720 .calculate_finished
= _calculate_finished
,
1721 .derive_secrets
= _derive_secrets
,
1722 .resume_session
= _resume_session
,
1723 .get_session
= _get_session
,
1724 .change_cipher
= _change_cipher
,
1725 .get_eap_msk
= _get_eap_msk
,
1726 .destroy
= _destroy
,
1732 enumerator
= lib
->creds
->create_builder_enumerator(lib
->creds
);
1733 while (enumerator
->enumerate(enumerator
, &type
, &subtype
))
1735 if (type
== CRED_PUBLIC_KEY
)
1750 enumerator
->destroy(enumerator
);
1752 switch (tls
->get_purpose(tls
))
1754 case TLS_PURPOSE_EAP_TLS
:
1755 /* MSK PRF ASCII constant label according to EAP-TLS RFC 5216 */
1756 this->msk_label
= "client EAP encryption";
1757 build_cipher_suite_list(this, FALSE
);
1759 case TLS_PURPOSE_EAP_PEAP
:
1760 this->msk_label
= "client EAP encryption";
1761 build_cipher_suite_list(this, TRUE
);
1763 case TLS_PURPOSE_EAP_TTLS
:
1764 /* MSK PRF ASCII constant label according to EAP-TTLS RFC 5281 */
1765 this->msk_label
= "ttls keying material";
1766 build_cipher_suite_list(this, TRUE
);
1768 case TLS_PURPOSE_GENERIC
:
1769 build_cipher_suite_list(this, TRUE
);
1774 return &this->public;