crypto/kdf/tls1_prf.c

   1 /*
   2  * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 /*
  11  * Refer to "The TLS Protocol Version 1.0" Section 5
  12  * (https://tools.ietf.org/html/rfc2246#section-5) and
  13  * "The Transport Layer Security (TLS) Protocol Version 1.2" Section 5
  14  * (https://tools.ietf.org/html/rfc5246#section-5).
  15  *
  16  * For TLS v1.0 and TLS v1.1 the TLS PRF algorithm is given by:
  17  *
  18  *   PRF(secret, label, seed) = P_MD5(S1, label + seed) XOR
  19  *                              P_SHA-1(S2, label + seed)
  20  *
  21  * where P_MD5 and P_SHA-1 are defined by P_<hash>, below, and S1 and S2 are
  22  * two halves of the secret (with the possibility of one shared byte, in the
  23  * case where the length of the original secret is odd).  S1 is taken from the
  24  * first half of the secret, S2 from the second half.
  25  *
  26  * For TLS v1.2 the TLS PRF algorithm is given by:
  27  *
  28  *   PRF(secret, label, seed) = P_<hash>(secret, label + seed)
  29  *
  30  * where hash is SHA-256 for all cipher suites defined in RFC 5246 as well as
  31  * those published prior to TLS v1.2 while the TLS v1.2 protocol is in effect,
  32  * unless defined otherwise by the cipher suite.
  33  *
  34  * P_<hash> is an expansion function that uses a single hash function to expand
  35  * a secret and seed into an arbitrary quantity of output:
  36  *
  37  *   P_<hash>(secret, seed) = HMAC_<hash>(secret, A(1) + seed) +
  38  *                            HMAC_<hash>(secret, A(2) + seed) +
  39  *                            HMAC_<hash>(secret, A(3) + seed) + ...
  40  *
  41  * where + indicates concatenation.  P_<hash> can be iterated as many times as
  42  * is necessary to produce the required quantity of data.
  43  *
  44  * A(i) is defined as:
  45  *     A(0) = seed
  46  *     A(i) = HMAC_<hash>(secret, A(i-1))
  47  */
  48 #include <stdio.h>
  49 #include <stdarg.h>
  50 #include <string.h>
  51 #include "internal/cryptlib.h"
  52 #include <openssl/evp.h>
  53 #include <openssl/kdf.h>
  54 #include "internal/evp_int.h"
  55 #include "kdf_local.h"
  56
  57 static void kdf_tls1_prf_reset(EVP_KDF_IMPL *impl);
  58 static int tls1_prf_alg(const EVP_MD *md,
  59                         const unsigned char *sec, size_t slen,
  60                         const unsigned char *seed, size_t seed_len,
  61                         unsigned char *out, size_t olen);
  62
  63 #define TLS1_PRF_MAXBUF 1024
  64
  65 /* TLS KDF kdf context structure */
  66
  67 struct evp_kdf_impl_st {
  68     /* Digest to use for PRF */
  69     const EVP_MD *md;
  70     /* Secret value to use for PRF */
  71     unsigned char *sec;
  72     size_t seclen;
  73     /* Buffer of concatenated seed data */
  74     unsigned char seed[TLS1_PRF_MAXBUF];
  75     size_t seedlen;
  76 };
  77
  78 static EVP_KDF_IMPL *kdf_tls1_prf_new(void)
  79 {
  80     EVP_KDF_IMPL *impl;
  81
  82     if ((impl = OPENSSL_zalloc(sizeof(*impl))) == NULL)
  83         KDFerr(KDF_F_KDF_TLS1_PRF_NEW, ERR_R_MALLOC_FAILURE);
  84     return impl;
  85 }
  86
  87 static void kdf_tls1_prf_free(EVP_KDF_IMPL *impl)
  88 {
  89     kdf_tls1_prf_reset(impl);
  90     OPENSSL_free(impl);
  91 }
  92
  93 static void kdf_tls1_prf_reset(EVP_KDF_IMPL *impl)
  94 {
  95     OPENSSL_clear_free(impl->sec, impl->seclen);
  96     OPENSSL_cleanse(impl->seed, impl->seedlen);
  97     memset(impl, 0, sizeof(*impl));
  98 }
  99
 100 static int kdf_tls1_prf_ctrl(EVP_KDF_IMPL *impl, int cmd, va_list args)
 101 {
 102     const unsigned char *p;
 103     size_t len;
 104     const EVP_MD *md;
 105
 106     switch (cmd) {
 107     case EVP_KDF_CTRL_SET_MD:
 108         md = va_arg(args, const EVP_MD *);
 109         if (md == NULL)
 110             return 0;
 111
 112         impl->md = md;
 113         return 1;
 114
 115     case EVP_KDF_CTRL_SET_TLS_SECRET:
 116         p = va_arg(args, const unsigned char *);
 117         len = va_arg(args, size_t);
 118         OPENSSL_clear_free(impl->sec, impl->seclen);
 119         impl->sec = OPENSSL_memdup(p, len);
 120         if (impl->sec == NULL)
 121             return 0;
 122
 123         impl->seclen = len;
 124         return 1;
 125
 126     case EVP_KDF_CTRL_RESET_TLS_SEED:
 127         OPENSSL_cleanse(impl->seed, impl->seedlen);
 128         impl->seedlen = 0;
 129         return 1;
 130
 131     case EVP_KDF_CTRL_ADD_TLS_SEED:
 132         p = va_arg(args, const unsigned char *);
 133         len = va_arg(args, size_t);
 134         if (len == 0 || p == NULL)
 135             return 1;
 136
 137         if (len > (TLS1_PRF_MAXBUF - impl->seedlen))
 138             return 0;
 139
 140         memcpy(impl->seed + impl->seedlen, p, len);
 141         impl->seedlen += len;
 142         return 1;
 143
 144     default:
 145         return -2;
 146     }
 147 }
 148
 149 static int kdf_tls1_prf_ctrl_str(EVP_KDF_IMPL *impl,
 150                                  const char *type, const char *value)
 151 {
 152     if (value == NULL) {
 153         KDFerr(KDF_F_KDF_TLS1_PRF_CTRL_STR, KDF_R_VALUE_MISSING);
 154         return 0;
 155     }
 156     if (strcmp(type, "digest") == 0)
 157         return kdf_md2ctrl(impl, kdf_tls1_prf_ctrl, EVP_KDF_CTRL_SET_MD, value);
 158
 159     if (strcmp(type, "secret") == 0)
 160         return kdf_str2ctrl(impl, kdf_tls1_prf_ctrl,
 161                             EVP_KDF_CTRL_SET_TLS_SECRET, value);
 162
 163     if (strcmp(type, "hexsecret") == 0)
 164         return kdf_hex2ctrl(impl, kdf_tls1_prf_ctrl,
 165                             EVP_KDF_CTRL_SET_TLS_SECRET, value);
 166
 167     if (strcmp(type, "seed") == 0)
 168         return kdf_str2ctrl(impl, kdf_tls1_prf_ctrl, EVP_KDF_CTRL_ADD_TLS_SEED,
 169                             value);
 170
 171     if (strcmp(type, "hexseed") == 0)
 172         return kdf_hex2ctrl(impl, kdf_tls1_prf_ctrl, EVP_KDF_CTRL_ADD_TLS_SEED,
 173                             value);
 174
 175     return -2;
 176 }
 177
 178 static int kdf_tls1_prf_derive(EVP_KDF_IMPL *impl, unsigned char *key,
 179                                size_t keylen)
 180 {
 181     if (impl->md == NULL) {
 182         KDFerr(KDF_F_KDF_TLS1_PRF_DERIVE, KDF_R_MISSING_MESSAGE_DIGEST);
 183         return 0;
 184     }
 185     if (impl->sec == NULL) {
 186         KDFerr(KDF_F_KDF_TLS1_PRF_DERIVE, KDF_R_MISSING_SECRET);
 187         return 0;
 188     }
 189     if (impl->seedlen == 0) {
 190         KDFerr(KDF_F_KDF_TLS1_PRF_DERIVE, KDF_R_MISSING_SEED);
 191         return 0;
 192     }
 193     return tls1_prf_alg(impl->md, impl->sec, impl->seclen,
 194                         impl->seed, impl->seedlen,
 195                         key, keylen);
 196 }
 197
 198 const EVP_KDF tls1_prf_kdf_meth = {
 199     EVP_KDF_TLS1_PRF,
 200     kdf_tls1_prf_new,
 201     kdf_tls1_prf_free,
 202     kdf_tls1_prf_reset,
 203     kdf_tls1_prf_ctrl,
 204     kdf_tls1_prf_ctrl_str,
 205     NULL,
 206     kdf_tls1_prf_derive
 207 };
 208
 209 /*
 210  * Refer to "The TLS Protocol Version 1.0" Section 5
 211  * (https://tools.ietf.org/html/rfc2246#section-5) and
 212  * "The Transport Layer Security (TLS) Protocol Version 1.2" Section 5
 213  * (https://tools.ietf.org/html/rfc5246#section-5).
 214  *
 215  * P_<hash> is an expansion function that uses a single hash function to expand
 216  * a secret and seed into an arbitrary quantity of output:
 217  *
 218  *   P_<hash>(secret, seed) = HMAC_<hash>(secret, A(1) + seed) +
 219  *                            HMAC_<hash>(secret, A(2) + seed) +
 220  *                            HMAC_<hash>(secret, A(3) + seed) + ...
 221  *
 222  * where + indicates concatenation.  P_<hash> can be iterated as many times as
 223  * is necessary to produce the required quantity of data.
 224  *
 225  * A(i) is defined as:
 226  *     A(0) = seed
 227  *     A(i) = HMAC_<hash>(secret, A(i-1))
 228  */
 229 static int tls1_prf_P_hash(const EVP_MD *md,
 230                            const unsigned char *sec, size_t sec_len,
 231                            const unsigned char *seed, size_t seed_len,
 232                            unsigned char *out, size_t olen)
 233 {
 234     size_t chunk;
 235     EVP_MAC_CTX *ctx = NULL, *ctx_Ai = NULL, *ctx_init = NULL;
 236     unsigned char Ai[EVP_MAX_MD_SIZE];
 237     size_t Ai_len;
 238     int ret = 0;
 239
 240     ctx_init = EVP_MAC_CTX_new_id(EVP_MAC_HMAC);
 241     if (ctx_init == NULL)
 242         goto err;
 243     if (EVP_MAC_ctrl(ctx_init, EVP_MAC_CTRL_SET_FLAGS, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW) != 1)
 244         goto err;
 245     if (EVP_MAC_ctrl(ctx_init, EVP_MAC_CTRL_SET_MD, md) != 1)
 246         goto err;
 247     if (EVP_MAC_ctrl(ctx_init, EVP_MAC_CTRL_SET_KEY, sec, sec_len) != 1)
 248         goto err;
 249     if (!EVP_MAC_init(ctx_init))
 250         goto err;
 251     chunk = EVP_MAC_size(ctx_init);
 252     if (chunk == 0)
 253         goto err;
 254     /* A(0) = seed */
 255     ctx_Ai = EVP_MAC_CTX_dup(ctx_init);
 256     if (ctx_Ai == NULL)
 257         goto err;
 258     if (seed != NULL && !EVP_MAC_update(ctx_Ai, seed, seed_len))
 259         goto err;
 260
 261     for (;;) {
 262         /* calc: A(i) = HMAC_<hash>(secret, A(i-1)) */
 263         if (!EVP_MAC_final(ctx_Ai, Ai, &Ai_len))
 264             goto err;
 265         EVP_MAC_CTX_free(ctx_Ai);
 266         ctx_Ai = NULL;
 267
 268         /* calc next chunk: HMAC_<hash>(secret, A(i) + seed) */
 269         ctx = EVP_MAC_CTX_dup(ctx_init);
 270         if (ctx == NULL)
 271             goto err;
 272         if (!EVP_MAC_update(ctx, Ai, Ai_len))
 273             goto err;
 274         /* save state for calculating next A(i) value */
 275         if (olen > chunk) {
 276             ctx_Ai = EVP_MAC_CTX_dup(ctx);
 277             if (ctx_Ai == NULL)
 278                 goto err;
 279         }
 280         if (seed != NULL && !EVP_MAC_update(ctx, seed, seed_len))
 281             goto err;
 282         if (olen <= chunk) {
 283             /* last chunk - use Ai as temp bounce buffer */
 284             if (!EVP_MAC_final(ctx, Ai, &Ai_len))
 285                 goto err;
 286             memcpy(out, Ai, olen);
 287             break;
 288         }
 289         if (!EVP_MAC_final(ctx, out, NULL))
 290             goto err;
 291         EVP_MAC_CTX_free(ctx);
 292         ctx = NULL;
 293         out += chunk;
 294         olen -= chunk;
 295     }
 296     ret = 1;
 297  err:
 298     EVP_MAC_CTX_free(ctx);
 299     EVP_MAC_CTX_free(ctx_Ai);
 300     EVP_MAC_CTX_free(ctx_init);
 301     OPENSSL_cleanse(Ai, sizeof(Ai));
 302     return ret;
 303 }
 304
 305 /*
 306  * Refer to "The TLS Protocol Version 1.0" Section 5
 307  * (https://tools.ietf.org/html/rfc2246#section-5) and
 308  * "The Transport Layer Security (TLS) Protocol Version 1.2" Section 5
 309  * (https://tools.ietf.org/html/rfc5246#section-5).
 310  *
 311  * For TLS v1.0 and TLS v1.1:
 312  *
 313  *   PRF(secret, label, seed) = P_MD5(S1, label + seed) XOR
 314  *                              P_SHA-1(S2, label + seed)
 315  *
 316  * S1 is taken from the first half of the secret, S2 from the second half.
 317  *
 318  *   L_S = length in bytes of secret;
 319  *   L_S1 = L_S2 = ceil(L_S / 2);
 320  *
 321  * For TLS v1.2:
 322  *
 323  *   PRF(secret, label, seed) = P_<hash>(secret, label + seed)
 324  */
 325 static int tls1_prf_alg(const EVP_MD *md,
 326                         const unsigned char *sec, size_t slen,
 327                         const unsigned char *seed, size_t seed_len,
 328                         unsigned char *out, size_t olen)
 329 {
 330     if (EVP_MD_type(md) == NID_md5_sha1) {
 331         /* TLS v1.0 and TLS v1.1 */
 332         size_t i;
 333         unsigned char *tmp;
 334         /* calc: L_S1 = L_S2 = ceil(L_S / 2) */
 335         size_t L_S1 = (slen + 1) / 2;
 336         size_t L_S2 = L_S1;
 337
 338         if (!tls1_prf_P_hash(EVP_md5(), sec, L_S1,
 339                              seed, seed_len, out, olen))
 340             return 0;
 341
 342         if ((tmp = OPENSSL_malloc(olen)) == NULL) {
 343             KDFerr(KDF_F_TLS1_PRF_ALG, ERR_R_MALLOC_FAILURE);
 344             return 0;
 345         }
 346         if (!tls1_prf_P_hash(EVP_sha1(), sec + slen - L_S2, L_S2,
 347                              seed, seed_len, tmp, olen)) {
 348             OPENSSL_clear_free(tmp, olen);
 349             return 0;
 350         }
 351         for (i = 0; i < olen; i++)
 352             out[i] ^= tmp[i];
 353         OPENSSL_clear_free(tmp, olen);
 354         return 1;
 355     }
 356
 357     /* TLS v1.2 */
 358     if (!tls1_prf_P_hash(md, sec, slen, seed, seed_len, out, olen))
 359         return 0;
 360
 361     return 1;
 362 }