Construct the client side psk extension for TLSv1.3 (ec15acb6) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP OpenSSL

include/openssl/ssl.h

+3 −1

Original line number	Diff line number	Diff line
		@@ -76,7 +76,7 @@ extern "C" {

		# define SSL_MIN_RSA_MODULUS_LENGTH_IN_BYTES (512/8)
		# define SSL_MAX_KEY_ARG_LENGTH 8
		# define SSL_MAX_MASTER_KEY_LENGTH 48
		# define SSL_MAX_MASTER_KEY_LENGTH 64

		/* The maximum number of encrypt/decrypt pipelines we can support */
		# define SSL_MAX_PIPELINES 32
		@@ -2282,6 +2282,7 @@ int ERR_load_SSL_strings(void);
		# define SSL_F_TLS_CONSTRUCT_CTOS_NPN 471
		# define SSL_F_TLS_CONSTRUCT_CTOS_PADDING 472
		# define SSL_F_TLS_CONSTRUCT_CTOS_PSK_KEX_MODES 509
		# define SSL_F_TLS_CONSTRUCT_CTOS_PSK 501
		# define SSL_F_TLS_CONSTRUCT_CTOS_RENEGOTIATE 473
		# define SSL_F_TLS_CONSTRUCT_CTOS_SCT 474
		# define SSL_F_TLS_CONSTRUCT_CTOS_SERVER_NAME 475
		@@ -2382,6 +2383,7 @@ int ERR_load_SSL_strings(void);
		# define SSL_R_BAD_LENGTH 271
		# define SSL_R_BAD_PACKET_LENGTH 115
		# define SSL_R_BAD_PROTOCOL_VERSION_NUMBER 116
		# define SSL_R_BAD_PSK_IDENTITY 114
		# define SSL_R_BAD_RECORD_TYPE 443
		# define SSL_R_BAD_RSA_ENCRYPT 119
		# define SSL_R_BAD_SIGNATURE 123

include/openssl/tls1.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -177,6 +177,7 @@ extern "C" {

		/* As defined for TLS1.3 */
		# define TLSEXT_TYPE_key_share 40
		# define TLSEXT_TYPE_psk 41
		# define TLSEXT_TYPE_supported_versions 43
		# define TLSEXT_TYPE_psk_kex_modes 45

ssl/s3_lib.c

+18 −14

Original line number	Diff line number	Diff line
		@@ -3545,20 +3545,23 @@ long ssl3_ctx_callback_ctrl(SSL_CTX ctx, int cmd, void (fp) (void))
		return (1);
		}

		const SSL_CIPHER *ssl3_get_cipher_by_id(uint32_t id)
		{
		SSL_CIPHER c;

		c.id = id;
		return OBJ_bsearch_ssl_cipher_id(&c, ssl3_ciphers, SSL3_NUM_CIPHERS);
		}

		/*
		* This function needs to check if the ciphers required are actually
		* available
		*/
		const SSL_CIPHER ssl3_get_cipher_by_char(const unsigned char p)
		{
		SSL_CIPHER c;
		const SSL_CIPHER *cp;
		uint32_t id;

		id = 0x03000000 \| ((uint32_t)p[0] << 8L) \| (uint32_t)p[1];
		c.id = id;
		cp = OBJ_bsearch_ssl_cipher_id(&c, ssl3_ciphers, SSL3_NUM_CIPHERS);
		return cp;
		return ssl3_get_cipher_by_id(0x03000000
		\| ((uint32_t)p[0] << 8L)
		\| (uint32_t)p[1]);
		}

		int ssl3_put_cipher_by_char(const SSL_CIPHER c, WPACKET pkt, size_t *len)
		@@ -4103,13 +4106,14 @@ int ssl_derive(SSL s, EVP_PKEY privkey, EVP_PKEY *pubkey, int gensecret)
		if (gensecret) {
		if (SSL_IS_TLS13(s)) {
		/*
		* TODO(TLS1.3): For now we just use the default early_secret, this
		* will need to change later when other early_secrets will be
		* possible.
		* If we are resuming then we already generated the early secret
		* when we created the ClientHello, so don't recreate it.
		*/
		rv = tls13_generate_early_secret(s, NULL, 0)
		&& tls13_generate_handshake_secret(s, pms, pmslen);
		OPENSSL_free(pms);
		if (!s->hit)
		rv = tls13_generate_secret(s, ssl_handshake_md(s), NULL, NULL,
		0,
		(unsigned char *)&s->early_secret);
		rv = rv && tls13_generate_handshake_secret(s, pms, pmslen);
		} else {
		/* Generate master secret and discard premaster */
		rv = ssl_generate_master_secret(s, pms, pmslen, 1);

ssl/ssl_err.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -300,6 +300,7 @@ static ERR_STRING_DATA SSL_str_functs[] = {
		{ERR_FUNC(SSL_F_TLS_CONSTRUCT_CTOS_NPN), "tls_construct_ctos_npn"},
		{ERR_FUNC(SSL_F_TLS_CONSTRUCT_CTOS_PADDING),
		"tls_construct_ctos_padding"},
		{ERR_FUNC(SSL_F_TLS_CONSTRUCT_CTOS_PSK), "tls_construct_ctos_psk"},
		{ERR_FUNC(SSL_F_TLS_CONSTRUCT_CTOS_PSK_KEX_MODES),
		"tls_construct_ctos_psk_kex_modes"},
		{ERR_FUNC(SSL_F_TLS_CONSTRUCT_CTOS_RENEGOTIATE),

ssl/ssl_locl.h

+25 −6

Original line number	Diff line number	Diff line
		@@ -510,6 +510,11 @@ struct ssl_session_st {
		int ssl_version; /* what ssl version session info is being kept
		* in here? */
		size_t master_key_length;

		/*
		* For <=TLS1.2 this is the master_key. For TLS1.3 this is the resumption
		* master secret
		*/
		unsigned char master_key[SSL_MAX_MASTER_KEY_LENGTH];
		/* session_id - valid? */
		size_t session_id_length;
		@@ -569,6 +574,7 @@ struct ssl_session_st {
		size_t ticklen; /* Session ticket length */
		/* Session lifetime hint in seconds */
		unsigned long tick_lifetime_hint;
		int tick_identity;
		} ext;
		# ifndef OPENSSL_NO_SRP
		char *srp_username;
		@@ -956,11 +962,12 @@ struct ssl_st {
		*/
		uint32_t mac_flags;
		/*
		* The TLS1.3 early_secret and handshake_secret. The master_secret is stored
		* in the session.
		* The TLS1.3 secrets. The resumption master secret is stored in the
		* session.
		*/
		unsigned char early_secret[EVP_MAX_MD_SIZE];
		unsigned char handshake_secret[EVP_MAX_MD_SIZE];
		unsigned char master_secret[EVP_MAX_MD_SIZE];
		unsigned char client_finished_secret[EVP_MAX_MD_SIZE];
		unsigned char server_finished_secret[EVP_MAX_MD_SIZE];
		unsigned char server_finished_hash[EVP_MAX_MD_SIZE];
		@@ -1686,7 +1693,8 @@ typedef enum tlsext_index_en {
		TLSEXT_IDX_psk_kex_modes,
		TLSEXT_IDX_key_share,
		TLSEXT_IDX_cryptopro_bug,
		TLSEXT_IDX_padding
		TLSEXT_IDX_padding,
		TLSEXT_IDX_psk
		} TLSEXT_INDEX;

		/*
		@@ -1726,6 +1734,9 @@ typedef enum tlsext_index_en {
		#define TLSEXT_KEX_MODE_FLAG_KE 1
		#define TLSEXT_KEX_MODE_FLAG_KE_DHE 2

		/* An invalid index into the TLSv1.3 PSK identities */
		#define TLSEXT_PSK_BAD_IDENTITY -1

		#define SIGID_IS_PSS(sigid) ((sigid) == TLSEXT_SIGALG_rsa_pss_sha256 \
		\|\| (sigid) == TLSEXT_SIGALG_rsa_pss_sha384 \
		\|\| (sigid) == TLSEXT_SIGALG_rsa_pss_sha512)
		@@ -1986,6 +1997,7 @@ __owur int ssl_derive(SSL s, EVP_PKEY privkey, EVP_PKEY *pubkey,
		int genmaster);
		__owur EVP_PKEY ssl_dh_to_pkey(DH dh);

		__owur const SSL_CIPHER *ssl3_get_cipher_by_id(uint32_t id);
		__owur const SSL_CIPHER ssl3_get_cipher_by_char(const unsigned char p);
		__owur int ssl3_put_cipher_by_char(const SSL_CIPHER c, WPACKET pkt,
		size_t *len);
		@@ -2110,7 +2122,8 @@ __owur int tls13_setup_key_block(SSL *s);
		__owur size_t tls13_final_finish_mac(SSL s, const char str, size_t slen,
		unsigned char *p);
		__owur int tls13_change_cipher_state(SSL *s, int which);
		__owur int tls13_hkdf_expand(SSL s, const unsigned char secret,
		__owur int tls13_hkdf_expand(SSL s, const EVP_MD md,
		const unsigned char *secret,
		const unsigned char *label, size_t labellen,
		const unsigned char *hash,
		unsigned char *out, size_t outlen);
		@@ -2118,8 +2131,14 @@ __owur int tls13_derive_key(SSL s, const unsigned char secret,
		unsigned char *key, size_t keylen);
		__owur int tls13_derive_iv(SSL s, const unsigned char secret,
		unsigned char *iv, size_t ivlen);
		__owur int tls13_generate_early_secret(SSL s, const unsigned char insecret,
		size_t insecretlen);
		__owur int tls13_derive_finishedkey(SSL s, const EVP_MD md,
		const unsigned char *secret,
		unsigned char *fin, size_t finlen);
		int tls13_generate_secret(SSL s, const EVP_MD md,
		const unsigned char *prevsecret,
		const unsigned char *insecret,
		size_t insecretlen,
		unsigned char *outsecret);
		__owur int tls13_generate_handshake_secret(SSL *s,
		const unsigned char *insecret,
		size_t insecretlen);