EAP-TLS server: MSK/EMSK derivation with TLS v1.3

Use new MSK/EMSK derivation mechanism if TLS v1.3 or newer is used per
draft-mattsson-eap-tls13-02.txt.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/eap_server/eap_server_tls.c b/src/eap_server/eap_server_tls.c
index 7249858844ef2bf27ec5922f97bf2765b9a906a3..37ce4cc9f33cd6b0d50b4096685022c96fd29a98 100644 (file)
--- a/src/eap_server/eap_server_tls.c
+++ b/src/eap_server/eap_server_tls.c
@@ -302,17 +302,22 @@ static u8 * eap_tls_getKey(struct eap_sm *sm, void *priv, size_t *len)
 {
        struct eap_tls_data *data = priv;
        u8 *eapKeyData;
+       const char *label;
 
        if (data->state != SUCCESS)
                return NULL;
 
-       eapKeyData = eap_server_tls_derive_key(sm, &data->ssl,
-                                              "client EAP encryption",
-                                              EAP_TLS_KEY_LEN);
+       if (data->ssl.tls_v13)
+               label = "client EAP encryption KM";
+       else
+               label = "client EAP encryption";
+       eapKeyData = eap_server_tls_derive_key(sm, &data->ssl, label,
+                                              EAP_TLS_KEY_LEN + EAP_EMSK_LEN);
        if (eapKeyData) {
                *len = EAP_TLS_KEY_LEN;
                wpa_hexdump(MSG_DEBUG, "EAP-TLS: Derived key",
                            eapKeyData, EAP_TLS_KEY_LEN);
+               os_memset(eapKeyData + EAP_TLS_KEY_LEN, 0, EAP_EMSK_LEN);
        } else {
                wpa_printf(MSG_DEBUG, "EAP-TLS: Failed to derive key");
        }
@@ -325,12 +330,12 @@ static u8 * eap_tls_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
 {
        struct eap_tls_data *data = priv;
        u8 *eapKeyData, *emsk;
+       const char *label = "client EAP encryption";
 
        if (data->state != SUCCESS)
                return NULL;
 
-       eapKeyData = eap_server_tls_derive_key(sm, &data->ssl,
-                                              "client EAP encryption",
+       eapKeyData = eap_server_tls_derive_key(sm, &data->ssl, label,
                                               EAP_TLS_KEY_LEN + EAP_EMSK_LEN);
        if (eapKeyData) {
                emsk = os_malloc(EAP_EMSK_LEN);