1// Copyright 2018 The Go Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style 3// license that can be found in the LICENSE file. 4 5package tls 6 7import ( 8 "crypto/elliptic" 9 "crypto/hmac" 10 "errors" 11 "github.com/ooni/psiphon/oopsi/golang.org/x/crypto/cryptobyte" 12 "github.com/ooni/psiphon/oopsi/golang.org/x/crypto/curve25519" 13 "github.com/ooni/psiphon/oopsi/golang.org/x/crypto/hkdf" 14 "hash" 15 "io" 16 "math/big" 17) 18 19// This file contains the functions necessary to compute the TLS 1.3 key 20// schedule. See RFC 8446, Section 7. 21 22const ( 23 resumptionBinderLabel = "res binder" 24 clientHandshakeTrafficLabel = "c hs traffic" 25 serverHandshakeTrafficLabel = "s hs traffic" 26 clientApplicationTrafficLabel = "c ap traffic" 27 serverApplicationTrafficLabel = "s ap traffic" 28 exporterLabel = "exp master" 29 resumptionLabel = "res master" 30 trafficUpdateLabel = "traffic upd" 31) 32 33// expandLabel implements HKDF-Expand-Label from RFC 8446, Section 7.1. 34func (c *cipherSuiteTLS13) expandLabel(secret []byte, label string, context []byte, length int) []byte { 35 var hkdfLabel cryptobyte.Builder 36 hkdfLabel.AddUint16(uint16(length)) 37 hkdfLabel.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) { 38 b.AddBytes([]byte("tls13 ")) 39 b.AddBytes([]byte(label)) 40 }) 41 hkdfLabel.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) { 42 b.AddBytes(context) 43 }) 44 out := make([]byte, length) 45 n, err := hkdf.Expand(c.hash.New, secret, hkdfLabel.BytesOrPanic()).Read(out) 46 if err != nil || n != length { 47 panic("tls: HKDF-Expand-Label invocation failed unexpectedly") 48 } 49 return out 50} 51 52// deriveSecret implements Derive-Secret from RFC 8446, Section 7.1. 53func (c *cipherSuiteTLS13) deriveSecret(secret []byte, label string, transcript hash.Hash) []byte { 54 if transcript == nil { 55 transcript = c.hash.New() 56 } 57 return c.expandLabel(secret, label, transcript.Sum(nil), c.hash.Size()) 58} 59 60// extract implements HKDF-Extract with the cipher suite hash. 61func (c *cipherSuiteTLS13) extract(newSecret, currentSecret []byte) []byte { 62 if newSecret == nil { 63 newSecret = make([]byte, c.hash.Size()) 64 } 65 return hkdf.Extract(c.hash.New, newSecret, currentSecret) 66} 67 68// nextTrafficSecret generates the next traffic secret, given the current one, 69// according to RFC 8446, Section 7.2. 70func (c *cipherSuiteTLS13) nextTrafficSecret(trafficSecret []byte) []byte { 71 return c.expandLabel(trafficSecret, trafficUpdateLabel, nil, c.hash.Size()) 72} 73 74// trafficKey generates traffic keys according to RFC 8446, Section 7.3. 75func (c *cipherSuiteTLS13) trafficKey(trafficSecret []byte) (key, iv []byte) { 76 key = c.expandLabel(trafficSecret, "key", nil, c.keyLen) 77 iv = c.expandLabel(trafficSecret, "iv", nil, aeadNonceLength) 78 return 79} 80 81// finishedHash generates the Finished verify_data or PskBinderEntry according 82// to RFC 8446, Section 4.4.4. See sections 4.4 and 4.2.11.2 for the baseKey 83// selection. 84func (c *cipherSuiteTLS13) finishedHash(baseKey []byte, transcript hash.Hash) []byte { 85 finishedKey := c.expandLabel(baseKey, "finished", nil, c.hash.Size()) 86 verifyData := hmac.New(c.hash.New, finishedKey) 87 verifyData.Write(transcript.Sum(nil)) 88 return verifyData.Sum(nil) 89} 90 91// exportKeyingMaterial implements RFC5705 exporters for TLS 1.3 according to 92// RFC 8446, Section 7.5. 93func (c *cipherSuiteTLS13) exportKeyingMaterial(masterSecret []byte, transcript hash.Hash) func(string, []byte, int) ([]byte, error) { 94 expMasterSecret := c.deriveSecret(masterSecret, exporterLabel, transcript) 95 return func(label string, context []byte, length int) ([]byte, error) { 96 secret := c.deriveSecret(expMasterSecret, label, nil) 97 h := c.hash.New() 98 h.Write(context) 99 return c.expandLabel(secret, "exporter", h.Sum(nil), length), nil 100 } 101} 102 103// ecdheParameters implements Diffie-Hellman with either NIST curves or X25519, 104// according to RFC 8446, Section 4.2.8.2. 105type ecdheParameters interface { 106 CurveID() CurveID 107 PublicKey() []byte 108 SharedKey(peerPublicKey []byte) []byte 109} 110 111func generateECDHEParameters(rand io.Reader, curveID CurveID) (ecdheParameters, error) { 112 if curveID == X25519 { 113 p := &x25519Parameters{} 114 if _, err := io.ReadFull(rand, p.privateKey[:]); err != nil { 115 return nil, err 116 } 117 curve25519.ScalarBaseMult(&p.publicKey, &p.privateKey) 118 return p, nil 119 } 120 121 curve, ok := curveForCurveID(curveID) 122 if !ok { 123 return nil, errors.New("tls: internal error: unsupported curve") 124 } 125 126 p := &nistParameters{curveID: curveID} 127 var err error 128 p.privateKey, p.x, p.y, err = elliptic.GenerateKey(curve, rand) 129 if err != nil { 130 return nil, err 131 } 132 return p, nil 133} 134 135func curveForCurveID(id CurveID) (elliptic.Curve, bool) { 136 switch id { 137 case CurveP256: 138 return elliptic.P256(), true 139 case CurveP384: 140 return elliptic.P384(), true 141 case CurveP521: 142 return elliptic.P521(), true 143 default: 144 return nil, false 145 } 146} 147 148type nistParameters struct { 149 privateKey []byte 150 x, y *big.Int // public key 151 curveID CurveID 152} 153 154func (p *nistParameters) CurveID() CurveID { 155 return p.curveID 156} 157 158func (p *nistParameters) PublicKey() []byte { 159 curve, _ := curveForCurveID(p.curveID) 160 return elliptic.Marshal(curve, p.x, p.y) 161} 162 163func (p *nistParameters) SharedKey(peerPublicKey []byte) []byte { 164 curve, _ := curveForCurveID(p.curveID) 165 // Unmarshal also checks whether the given point is on the curve. 166 x, y := elliptic.Unmarshal(curve, peerPublicKey) 167 if x == nil { 168 return nil 169 } 170 171 xShared, _ := curve.ScalarMult(x, y, p.privateKey) 172 sharedKey := make([]byte, (curve.Params().BitSize+7)>>3) 173 xBytes := xShared.Bytes() 174 copy(sharedKey[len(sharedKey)-len(xBytes):], xBytes) 175 176 return sharedKey 177} 178 179type x25519Parameters struct { 180 privateKey [32]byte 181 publicKey [32]byte 182} 183 184func (p *x25519Parameters) CurveID() CurveID { 185 return X25519 186} 187 188func (p *x25519Parameters) PublicKey() []byte { 189 return p.publicKey[:] 190} 191 192func (p *x25519Parameters) SharedKey(peerPublicKey []byte) []byte { 193 if len(peerPublicKey) != 32 { 194 return nil 195 } 196 var theirPublicKey, sharedKey [32]byte 197 copy(theirPublicKey[:], peerPublicKey) 198 curve25519.ScalarMult(&sharedKey, &p.privateKey, &theirPublicKey) 199 return sharedKey[:] 200} 201