1// Copyright 2009 The Go Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style 3// license that can be found in the LICENSE file. 4 5package tls 6 7import ( 8 "crypto" 9 "crypto/hmac" 10 "crypto/md5" 11 "crypto/sha1" 12 "crypto/sha256" 13 "crypto/sha512" 14 "errors" 15 "fmt" 16 "hash" 17) 18 19// Split a premaster secret in two as specified in RFC 4346, section 5. 20func splitPreMasterSecret(secret []byte) (s1, s2 []byte) { 21 s1 = secret[0 : (len(secret)+1)/2] 22 s2 = secret[len(secret)/2:] 23 return 24} 25 26// pHash implements the P_hash function, as defined in RFC 4346, section 5. 27func pHash(result, secret, seed []byte, hash func() hash.Hash) { 28 h := hmac.New(hash, secret) 29 h.Write(seed) 30 a := h.Sum(nil) 31 32 j := 0 33 for j < len(result) { 34 h.Reset() 35 h.Write(a) 36 h.Write(seed) 37 b := h.Sum(nil) 38 copy(result[j:], b) 39 j += len(b) 40 41 h.Reset() 42 h.Write(a) 43 a = h.Sum(nil) 44 } 45} 46 47// prf10 implements the TLS 1.0 pseudo-random function, as defined in RFC 2246, section 5. 48func prf10(result, secret, label, seed []byte) { 49 hashSHA1 := sha1.New 50 hashMD5 := md5.New 51 52 labelAndSeed := make([]byte, len(label)+len(seed)) 53 copy(labelAndSeed, label) 54 copy(labelAndSeed[len(label):], seed) 55 56 s1, s2 := splitPreMasterSecret(secret) 57 pHash(result, s1, labelAndSeed, hashMD5) 58 result2 := make([]byte, len(result)) 59 pHash(result2, s2, labelAndSeed, hashSHA1) 60 61 for i, b := range result2 { 62 result[i] ^= b 63 } 64} 65 66// prf12 implements the TLS 1.2 pseudo-random function, as defined in RFC 5246, section 5. 67func prf12(hashFunc func() hash.Hash) func(result, secret, label, seed []byte) { 68 return func(result, secret, label, seed []byte) { 69 labelAndSeed := make([]byte, len(label)+len(seed)) 70 copy(labelAndSeed, label) 71 copy(labelAndSeed[len(label):], seed) 72 73 pHash(result, secret, labelAndSeed, hashFunc) 74 } 75} 76 77// prf30 implements the SSL 3.0 pseudo-random function, as defined in 78// www.mozilla.org/projects/security/pki/nss/ssl/draft302.txt section 6. 79func prf30(result, secret, label, seed []byte) { 80 hashSHA1 := sha1.New() 81 hashMD5 := md5.New() 82 83 done := 0 84 i := 0 85 // RFC 5246 section 6.3 says that the largest PRF output needed is 128 86 // bytes. Since no more ciphersuites will be added to SSLv3, this will 87 // remain true. Each iteration gives us 16 bytes so 10 iterations will 88 // be sufficient. 89 var b [11]byte 90 for done < len(result) { 91 for j := 0; j <= i; j++ { 92 b[j] = 'A' + byte(i) 93 } 94 95 hashSHA1.Reset() 96 hashSHA1.Write(b[:i+1]) 97 hashSHA1.Write(secret) 98 hashSHA1.Write(seed) 99 digest := hashSHA1.Sum(nil) 100 101 hashMD5.Reset() 102 hashMD5.Write(secret) 103 hashMD5.Write(digest) 104 105 done += copy(result[done:], hashMD5.Sum(nil)) 106 i++ 107 } 108} 109 110const ( 111 tlsRandomLength = 32 // Length of a random nonce in TLS 1.1. 112 masterSecretLength = 48 // Length of a master secret in TLS 1.1. 113 finishedVerifyLength = 12 // Length of verify_data in a Finished message. 114) 115 116var masterSecretLabel = []byte("master secret") 117var keyExpansionLabel = []byte("key expansion") 118var clientFinishedLabel = []byte("client finished") 119var serverFinishedLabel = []byte("server finished") 120 121func prfAndHashForVersion(version uint16, suite *cipherSuite) (func(result, secret, label, seed []byte), crypto.Hash) { 122 switch version { 123 case VersionSSL30: 124 return prf30, crypto.Hash(0) 125 case VersionTLS10, VersionTLS11: 126 return prf10, crypto.Hash(0) 127 case VersionTLS12: 128 if suite.flags&suiteSHA384 != 0 { 129 return prf12(sha512.New384), crypto.SHA384 130 } 131 return prf12(sha256.New), crypto.SHA256 132 default: 133 panic("unknown version") 134 } 135} 136 137func prfForVersion(version uint16, suite *cipherSuite) func(result, secret, label, seed []byte) { 138 prf, _ := prfAndHashForVersion(version, suite) 139 return prf 140} 141 142// masterFromPreMasterSecret generates the master secret from the pre-master 143// secret. See http://tools.ietf.org/html/rfc5246#section-8.1 144func masterFromPreMasterSecret(version uint16, suite *cipherSuite, preMasterSecret, clientRandom, serverRandom []byte) []byte { 145 seed := make([]byte, 0, len(clientRandom)+len(serverRandom)) 146 seed = append(seed, clientRandom...) 147 seed = append(seed, serverRandom...) 148 149 masterSecret := make([]byte, masterSecretLength) 150 prfForVersion(version, suite)(masterSecret, preMasterSecret, masterSecretLabel, seed) 151 return masterSecret 152} 153 154// keysFromMasterSecret generates the connection keys from the master 155// secret, given the lengths of the MAC key, cipher key and IV, as defined in 156// RFC 2246, section 6.3. 157func keysFromMasterSecret(version uint16, suite *cipherSuite, masterSecret, clientRandom, serverRandom []byte, macLen, keyLen, ivLen int) (clientMAC, serverMAC, clientKey, serverKey, clientIV, serverIV []byte) { 158 seed := make([]byte, 0, len(serverRandom)+len(clientRandom)) 159 seed = append(seed, serverRandom...) 160 seed = append(seed, clientRandom...) 161 162 n := 2*macLen + 2*keyLen + 2*ivLen 163 keyMaterial := make([]byte, n) 164 prfForVersion(version, suite)(keyMaterial, masterSecret, keyExpansionLabel, seed) 165 clientMAC = keyMaterial[:macLen] 166 keyMaterial = keyMaterial[macLen:] 167 serverMAC = keyMaterial[:macLen] 168 keyMaterial = keyMaterial[macLen:] 169 clientKey = keyMaterial[:keyLen] 170 keyMaterial = keyMaterial[keyLen:] 171 serverKey = keyMaterial[:keyLen] 172 keyMaterial = keyMaterial[keyLen:] 173 clientIV = keyMaterial[:ivLen] 174 keyMaterial = keyMaterial[ivLen:] 175 serverIV = keyMaterial[:ivLen] 176 return 177} 178 179// lookupTLSHash looks up the corresponding crypto.Hash for a given 180// hash from a TLS SignatureScheme. 181func lookupTLSHash(signatureAlgorithm SignatureScheme) (crypto.Hash, error) { 182 switch signatureAlgorithm { 183 case PKCS1WithSHA1, ECDSAWithSHA1: 184 return crypto.SHA1, nil 185 case PKCS1WithSHA256, PSSWithSHA256, ECDSAWithP256AndSHA256: 186 return crypto.SHA256, nil 187 case PKCS1WithSHA384, PSSWithSHA384, ECDSAWithP384AndSHA384: 188 return crypto.SHA384, nil 189 case PKCS1WithSHA512, PSSWithSHA512, ECDSAWithP521AndSHA512: 190 return crypto.SHA512, nil 191 default: 192 return 0, fmt.Errorf("tls: unsupported signature algorithm: %#04x", signatureAlgorithm) 193 } 194} 195 196func newFinishedHash(version uint16, cipherSuite *cipherSuite) finishedHash { 197 var buffer []byte 198 if version == VersionSSL30 || version >= VersionTLS12 { 199 buffer = []byte{} 200 } 201 202 prf, hash := prfAndHashForVersion(version, cipherSuite) 203 if hash != 0 { 204 return finishedHash{hash.New(), hash.New(), nil, nil, buffer, version, prf} 205 } 206 207 return finishedHash{sha1.New(), sha1.New(), md5.New(), md5.New(), buffer, version, prf} 208} 209 210// A finishedHash calculates the hash of a set of handshake messages suitable 211// for including in a Finished message. 212type finishedHash struct { 213 client hash.Hash 214 server hash.Hash 215 216 // Prior to TLS 1.2, an additional MD5 hash is required. 217 clientMD5 hash.Hash 218 serverMD5 hash.Hash 219 220 // In TLS 1.2, a full buffer is sadly required. 221 buffer []byte 222 223 version uint16 224 prf func(result, secret, label, seed []byte) 225} 226 227func (h *finishedHash) Write(msg []byte) (n int, err error) { 228 h.client.Write(msg) 229 h.server.Write(msg) 230 231 if h.version < VersionTLS12 { 232 h.clientMD5.Write(msg) 233 h.serverMD5.Write(msg) 234 } 235 236 if h.buffer != nil { 237 h.buffer = append(h.buffer, msg...) 238 } 239 240 return len(msg), nil 241} 242 243func (h finishedHash) Sum() []byte { 244 if h.version >= VersionTLS12 { 245 return h.client.Sum(nil) 246 } 247 248 out := make([]byte, 0, md5.Size+sha1.Size) 249 out = h.clientMD5.Sum(out) 250 return h.client.Sum(out) 251} 252 253// finishedSum30 calculates the contents of the verify_data member of a SSLv3 254// Finished message given the MD5 and SHA1 hashes of a set of handshake 255// messages. 256func finishedSum30(md5, sha1 hash.Hash, masterSecret []byte, magic []byte) []byte { 257 md5.Write(magic) 258 md5.Write(masterSecret) 259 md5.Write(ssl30Pad1[:]) 260 md5Digest := md5.Sum(nil) 261 262 md5.Reset() 263 md5.Write(masterSecret) 264 md5.Write(ssl30Pad2[:]) 265 md5.Write(md5Digest) 266 md5Digest = md5.Sum(nil) 267 268 sha1.Write(magic) 269 sha1.Write(masterSecret) 270 sha1.Write(ssl30Pad1[:40]) 271 sha1Digest := sha1.Sum(nil) 272 273 sha1.Reset() 274 sha1.Write(masterSecret) 275 sha1.Write(ssl30Pad2[:40]) 276 sha1.Write(sha1Digest) 277 sha1Digest = sha1.Sum(nil) 278 279 ret := make([]byte, len(md5Digest)+len(sha1Digest)) 280 copy(ret, md5Digest) 281 copy(ret[len(md5Digest):], sha1Digest) 282 return ret 283} 284 285var ssl3ClientFinishedMagic = [4]byte{0x43, 0x4c, 0x4e, 0x54} 286var ssl3ServerFinishedMagic = [4]byte{0x53, 0x52, 0x56, 0x52} 287 288// clientSum returns the contents of the verify_data member of a client's 289// Finished message. 290func (h finishedHash) clientSum(masterSecret []byte) []byte { 291 if h.version == VersionSSL30 { 292 return finishedSum30(h.clientMD5, h.client, masterSecret, ssl3ClientFinishedMagic[:]) 293 } 294 295 out := make([]byte, finishedVerifyLength) 296 h.prf(out, masterSecret, clientFinishedLabel, h.Sum()) 297 return out 298} 299 300// serverSum returns the contents of the verify_data member of a server's 301// Finished message. 302func (h finishedHash) serverSum(masterSecret []byte) []byte { 303 if h.version == VersionSSL30 { 304 return finishedSum30(h.serverMD5, h.server, masterSecret, ssl3ServerFinishedMagic[:]) 305 } 306 307 out := make([]byte, finishedVerifyLength) 308 h.prf(out, masterSecret, serverFinishedLabel, h.Sum()) 309 return out 310} 311 312// selectClientCertSignatureAlgorithm returns a SignatureScheme to sign a 313// client's CertificateVerify with, or an error if none can be found. 314func (h finishedHash) selectClientCertSignatureAlgorithm(serverList []SignatureScheme, sigType uint8) (SignatureScheme, error) { 315 for _, v := range serverList { 316 if signatureFromSignatureScheme(v) == sigType && isSupportedSignatureAlgorithm(v, supportedSignatureAlgorithms) { 317 return v, nil 318 } 319 } 320 return 0, errors.New("tls: no supported signature algorithm found for signing client certificate") 321} 322 323// hashForClientCertificate returns a digest, hash function, and TLS 1.2 hash 324// id suitable for signing by a TLS client certificate. 325func (h finishedHash) hashForClientCertificate(sigType uint8, signatureAlgorithm SignatureScheme, masterSecret []byte) ([]byte, crypto.Hash, error) { 326 if (h.version == VersionSSL30 || h.version >= VersionTLS12) && h.buffer == nil { 327 panic("a handshake hash for a client-certificate was requested after discarding the handshake buffer") 328 } 329 330 if h.version == VersionSSL30 { 331 if sigType != signatureRSA { 332 return nil, 0, errors.New("tls: unsupported signature type for client certificate") 333 } 334 335 md5Hash := md5.New() 336 md5Hash.Write(h.buffer) 337 sha1Hash := sha1.New() 338 sha1Hash.Write(h.buffer) 339 return finishedSum30(md5Hash, sha1Hash, masterSecret, nil), crypto.MD5SHA1, nil 340 } 341 if h.version >= VersionTLS12 { 342 hashAlg, err := lookupTLSHash(signatureAlgorithm) 343 if err != nil { 344 return nil, 0, err 345 } 346 hash := hashAlg.New() 347 hash.Write(h.buffer) 348 return hash.Sum(nil), hashAlg, nil 349 } 350 351 if sigType == signatureECDSA { 352 return h.server.Sum(nil), crypto.SHA1, nil 353 } 354 355 return h.Sum(), crypto.MD5SHA1, nil 356} 357 358// discardHandshakeBuffer is called when there is no more need to 359// buffer the entirety of the handshake messages. 360func (h *finishedHash) discardHandshakeBuffer() { 361 h.buffer = nil 362} 363