Branch data Line data Source code
1 : : /*
2 : : * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3 : : *
4 : : * Licensed under the Apache License, Version 2.0 (the "License").
5 : : * You may not use this file except in compliance with the License.
6 : : * A copy of the License is located at
7 : : *
8 : : * http://aws.amazon.com/apache2.0
9 : : *
10 : : * or in the "license" file accompanying this file. This file is distributed
11 : : * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12 : : * express or implied. See the License for the specific language governing
13 : : * permissions and limitations under the License.
14 : : */
15 : :
16 : : #include "tls/extensions/s2n_server_key_share.h"
17 : :
18 : : #include "crypto/s2n_pq.h"
19 : : #include "tls/s2n_security_policies.h"
20 : : #include "tls/s2n_supported_group_preferences.h"
21 : : #include "tls/s2n_tls.h"
22 : : #include "tls/s2n_tls13.h"
23 : : #include "utils/s2n_safety.h"
24 : :
25 : : static int s2n_server_key_share_send(struct s2n_connection *conn, struct s2n_stuffer *out);
26 : : static int s2n_server_key_share_recv(struct s2n_connection *conn, struct s2n_stuffer *extension);
27 : :
28 : : const s2n_extension_type s2n_server_key_share_extension = {
29 : : .iana_value = TLS_EXTENSION_KEY_SHARE,
30 : : .minimum_version = S2N_TLS13,
31 : : .is_response = true,
32 : : .send = s2n_server_key_share_send,
33 : : .recv = s2n_server_key_share_recv,
34 : : .should_send = s2n_extension_always_send,
35 : : .if_missing = s2n_extension_noop_if_missing,
36 : : };
37 : :
38 : : static int s2n_server_key_share_send_hybrid_partial_ecc(struct s2n_connection *conn, struct s2n_stuffer *out)
39 : 0 : {
40 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(conn);
41 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(out);
42 : :
43 : 0 : struct s2n_kem_group_params *server_kem_group_params = &conn->kex_params.server_kem_group_params;
44 : :
45 : 0 : struct s2n_ecc_evp_params *server_ecc_params = &server_kem_group_params->ecc_params;
46 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(server_ecc_params->negotiated_curve);
47 : :
48 [ # # ]: 0 : POSIX_GUARD(s2n_ecc_evp_generate_ephemeral_key(server_ecc_params));
49 [ # # ]: 0 : POSIX_GUARD(s2n_ecc_evp_write_params_point(server_ecc_params, out));
50 : :
51 : 0 : return S2N_SUCCESS;
52 : 0 : }
53 : :
54 : : static int s2n_server_key_share_generate_pq(struct s2n_connection *conn, struct s2n_stuffer *out)
55 : 0 : {
56 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(out);
57 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(conn);
58 : :
59 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_pq_is_enabled(), S2N_ERR_UNIMPLEMENTED);
60 : :
61 : 0 : struct s2n_kem_group_params *server_kem_group_params = &conn->kex_params.server_kem_group_params;
62 : 0 : struct s2n_kem_params *client_kem_params = &conn->kex_params.client_kem_group_params.kem_params;
63 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(client_kem_params->public_key.data);
64 : :
65 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(server_kem_group_params->kem_group);
66 [ # # ]: 0 : POSIX_GUARD(s2n_stuffer_write_uint16(out, server_kem_group_params->kem_group->iana_id));
67 : :
68 : 0 : struct s2n_stuffer_reservation total_share_size = { 0 };
69 [ # # ]: 0 : POSIX_GUARD(s2n_stuffer_reserve_uint16(out, &total_share_size));
70 : :
71 : : /* s2n_kem_send_ciphertext() will generate the PQ shared secret and use
72 : : * the client's public key to encapsulate; the PQ shared secret will be
73 : : * stored in client_kem_params, and will be used during the shared
74 : : * secret derivation. */
75 [ # # ]: 0 : if (server_kem_group_params->kem_group->curve == &s2n_ecc_curve_none) { /* Pure PQ */
76 [ # # ]: 0 : POSIX_GUARD(s2n_kem_send_ciphertext(out, client_kem_params));
77 : 0 : } else { /* Hybrid PQ */
78 [ # # ]: 0 : if (server_kem_group_params->kem_group->send_kem_first) {
79 [ # # ]: 0 : POSIX_GUARD(s2n_kem_send_ciphertext(out, client_kem_params));
80 [ # # ]: 0 : POSIX_GUARD(s2n_server_key_share_send_hybrid_partial_ecc(conn, out));
81 : 0 : } else {
82 [ # # ]: 0 : POSIX_GUARD(s2n_server_key_share_send_hybrid_partial_ecc(conn, out));
83 [ # # ]: 0 : POSIX_GUARD(s2n_kem_send_ciphertext(out, client_kem_params));
84 : 0 : }
85 : 0 : }
86 : :
87 [ # # ]: 0 : POSIX_GUARD(s2n_stuffer_write_vector_size(&total_share_size));
88 : 0 : return S2N_SUCCESS;
89 : 0 : }
90 : :
91 : : /* Check that client has sent a corresponding key share for the server's KEM group */
92 : : int s2n_server_key_share_send_check_pq(struct s2n_connection *conn)
93 : 2 : {
94 [ + + ][ + - ]: 2 : POSIX_ENSURE_REF(conn);
95 : :
96 [ + - ][ + - ]: 1 : POSIX_ENSURE(s2n_pq_is_enabled(), S2N_ERR_UNIMPLEMENTED);
97 : :
98 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(conn->kex_params.server_kem_group_params.kem_group);
99 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(conn->kex_params.server_kem_group_params.kem_params.kem);
100 : :
101 : 0 : const struct s2n_kem_preferences *kem_pref = NULL;
102 [ # # ]: 0 : POSIX_GUARD(s2n_connection_get_kem_preferences(conn, &kem_pref));
103 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(kem_pref);
104 : :
105 : 0 : const struct s2n_kem_group *server_kem_group = conn->kex_params.server_kem_group_params.kem_group;
106 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_kem_preferences_includes_tls13_kem_group(kem_pref, server_kem_group->iana_id),
107 : 0 : S2N_ERR_KEM_UNSUPPORTED_PARAMS);
108 : :
109 : 0 : struct s2n_kem_group_params *client_params = &conn->kex_params.client_kem_group_params;
110 [ # # ][ # # ]: 0 : POSIX_ENSURE(client_params->kem_group == server_kem_group, S2N_ERR_BAD_KEY_SHARE);
111 : :
112 [ # # ][ # # ]: 0 : POSIX_ENSURE(client_params->kem_params.kem == server_kem_group->kem, S2N_ERR_BAD_KEY_SHARE);
113 [ # # ][ # # ]: 0 : POSIX_ENSURE(client_params->kem_params.public_key.size == server_kem_group->kem->public_key_length, S2N_ERR_BAD_KEY_SHARE);
114 [ # # ][ # # ]: 0 : POSIX_ENSURE(client_params->kem_params.public_key.data != NULL, S2N_ERR_BAD_KEY_SHARE);
115 : :
116 : 0 : return S2N_SUCCESS;
117 : 0 : }
118 : :
119 : : /* Check that client has sent a corresponding key share for the server's EC curve */
120 : : int s2n_server_key_share_send_check_ecdhe(struct s2n_connection *conn)
121 : 4751 : {
122 [ + + ][ + - ]: 4751 : POSIX_ENSURE_REF(conn);
123 : :
124 : 4750 : const struct s2n_ecc_preferences *ecc_pref = NULL;
125 [ - + ]: 4750 : POSIX_GUARD(s2n_connection_get_ecc_preferences(conn, &ecc_pref));
126 [ - + ][ # # ]: 4750 : POSIX_ENSURE_REF(ecc_pref);
127 : :
128 : 4750 : const struct s2n_ecc_named_curve *server_curve = conn->kex_params.server_ecc_evp_params.negotiated_curve;
129 [ + + ][ + - ]: 4750 : POSIX_ENSURE_REF(server_curve);
130 : :
131 : 4749 : struct s2n_ecc_evp_params *client_params = &conn->kex_params.client_ecc_evp_params;
132 [ + + ][ + - ]: 4749 : POSIX_ENSURE(client_params->negotiated_curve == server_curve, S2N_ERR_BAD_KEY_SHARE);
133 [ + + ][ + - ]: 4747 : POSIX_ENSURE(client_params->evp_pkey != NULL, S2N_ERR_BAD_KEY_SHARE);
134 : :
135 : 4741 : return S2N_SUCCESS;
136 : 4747 : }
137 : :
138 : : static int s2n_server_key_share_send(struct s2n_connection *conn, struct s2n_stuffer *out)
139 : 5410 : {
140 [ + - ][ + + ]: 5410 : POSIX_ENSURE_REF(conn);
141 [ + + ][ + - ]: 5409 : POSIX_ENSURE_REF(out);
142 : :
143 : 5408 : const struct s2n_ecc_named_curve *curve = conn->kex_params.server_ecc_evp_params.negotiated_curve;
144 : 5408 : const struct s2n_kem_group *kem_group = conn->kex_params.server_kem_group_params.kem_group;
145 : :
146 : : /* Boolean XOR: exactly one of {server_curve, server_kem_group} should be non-null. */
147 [ + - ][ + + ]: 5408 : POSIX_ENSURE((curve == NULL) != (kem_group == NULL), S2N_ERR_INVALID_SUPPORTED_GROUP_STATE);
148 : :
149 : : /* Retry requests only require the selected named group, not an actual share.
150 : : * https://tools.ietf.org/html/rfc8446#section-4.2.8 */
151 [ + + ]: 5406 : if (s2n_is_hello_retry_message(conn)) {
152 : 661 : uint16_t named_group_id = 0;
153 [ + - ]: 661 : if (curve != NULL) {
154 : 661 : named_group_id = curve->iana_id;
155 : 661 : } else {
156 : 0 : named_group_id = kem_group->iana_id;
157 : 0 : }
158 : :
159 [ - + ]: 661 : POSIX_GUARD(s2n_stuffer_write_uint16(out, named_group_id));
160 : 661 : return S2N_SUCCESS;
161 : 661 : }
162 : :
163 [ + - ]: 4745 : if (curve != NULL) {
164 [ + + ]: 4745 : POSIX_GUARD(s2n_server_key_share_send_check_ecdhe(conn));
165 [ - + ]: 4740 : POSIX_GUARD(s2n_ecdhe_parameters_send(&conn->kex_params.server_ecc_evp_params, out));
166 : 4740 : } else {
167 [ # # ]: 0 : POSIX_GUARD(s2n_server_key_share_send_check_pq(conn));
168 [ # # ]: 0 : POSIX_GUARD(s2n_server_key_share_generate_pq(conn, out));
169 : 0 : }
170 : :
171 : 4740 : return S2N_SUCCESS;
172 : 4745 : }
173 : :
174 : : static int s2n_server_key_share_recv_hybrid_partial_ecc(struct s2n_connection *conn, struct s2n_stuffer *extension)
175 : 0 : {
176 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(conn);
177 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(extension);
178 : :
179 : 0 : struct s2n_kem_group_params *server_kem_group_params = &conn->kex_params.server_kem_group_params;
180 : 0 : const struct s2n_kem_group *server_kem_group = server_kem_group_params->kem_group;
181 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(server_kem_group);
182 : 0 : uint16_t expected_ecc_share_size = server_kem_group->curve->share_size;
183 : :
184 : : /* Parse ECC key share */
185 : :
186 : 0 : struct s2n_blob point_blob = { 0 };
187 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_ecc_evp_read_params_point(extension, expected_ecc_share_size, &point_blob) == S2N_SUCCESS, S2N_ERR_BAD_KEY_SHARE);
188 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_ecc_evp_parse_params_point(&point_blob, &server_kem_group_params->ecc_params) == S2N_SUCCESS, S2N_ERR_BAD_KEY_SHARE);
189 [ # # ][ # # ]: 0 : POSIX_ENSURE(server_kem_group_params->ecc_params.evp_pkey != NULL, S2N_ERR_BAD_KEY_SHARE);
190 : :
191 : 0 : return S2N_SUCCESS;
192 : 0 : }
193 : :
194 : : static int s2n_server_key_share_recv_pq(struct s2n_connection *conn, uint16_t named_group_iana,
195 : : struct s2n_stuffer *extension)
196 : 1 : {
197 [ - + ][ # # ]: 1 : POSIX_ENSURE_REF(conn);
198 [ - + ][ # # ]: 1 : POSIX_ENSURE_REF(extension);
199 : :
200 : : /* If PQ is disabled, the client should not have sent any PQ IDs
201 : : * in the supported_groups list of the initial ClientHello */
202 [ + - ][ + - ]: 1 : POSIX_ENSURE(s2n_pq_is_enabled(), S2N_ERR_ECDHE_UNSUPPORTED_CURVE);
203 : :
204 : 0 : const struct s2n_kem_preferences *kem_pref = NULL;
205 [ # # ]: 0 : POSIX_GUARD(s2n_connection_get_kem_preferences(conn, &kem_pref));
206 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(kem_pref);
207 : :
208 : : /* This check should have been done higher up, but including it here as well for extra defense.
209 : : * Uses S2N_ERR_ECDHE_UNSUPPORTED_CURVE for backward compatibility. */
210 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_kem_preferences_includes_tls13_kem_group(kem_pref, named_group_iana), S2N_ERR_ECDHE_UNSUPPORTED_CURVE);
211 : :
212 : 0 : size_t kem_group_index = 0;
213 : 0 : bool kem_group_found = false;
214 [ # # ]: 0 : for (size_t i = 0; i < kem_pref->tls13_kem_group_count; i++) {
215 [ # # ]: 0 : if (named_group_iana == kem_pref->tls13_kem_groups[i]->iana_id
216 [ # # ]: 0 : && s2n_kem_group_is_available(kem_pref->tls13_kem_groups[i])) {
217 : 0 : kem_group_index = i;
218 : 0 : kem_group_found = true;
219 : 0 : break;
220 : 0 : }
221 : 0 : }
222 [ # # ][ # # ]: 0 : POSIX_ENSURE(kem_group_found, S2N_ERR_ECDHE_UNSUPPORTED_CURVE);
223 : :
224 : 0 : struct s2n_kem_group_params *server_kem_group_params = &conn->kex_params.server_kem_group_params;
225 : 0 : server_kem_group_params->kem_group = kem_pref->tls13_kem_groups[kem_group_index];
226 : 0 : server_kem_group_params->kem_params.kem = kem_pref->tls13_kem_groups[kem_group_index]->kem;
227 : 0 : server_kem_group_params->ecc_params.negotiated_curve = kem_pref->tls13_kem_groups[kem_group_index]->curve;
228 : :
229 : : /* If this a HRR, the server will only have sent the named group ID. We assign the
230 : : * appropriate KEM group params above, then exit early so that the client can
231 : : * generate the correct key share. */
232 [ # # ]: 0 : if (s2n_is_hello_retry_message(conn)) {
233 : 0 : return S2N_SUCCESS;
234 : 0 : }
235 : :
236 : : /* Ensure that the server's key share corresponds with a key share previously sent by the client */
237 : 0 : struct s2n_kem_group_params *client_kem_group_params = &conn->kex_params.client_kem_group_params;
238 [ # # ][ # # ]: 0 : POSIX_ENSURE(client_kem_group_params->kem_params.private_key.data, S2N_ERR_BAD_KEY_SHARE);
239 [ # # ][ # # ]: 0 : POSIX_ENSURE(client_kem_group_params->kem_group == server_kem_group_params->kem_group, S2N_ERR_BAD_KEY_SHARE);
240 : :
241 : 0 : uint16_t actual_hybrid_share_size = 0;
242 [ # # ]: 0 : POSIX_GUARD(s2n_stuffer_read_uint16(extension, &actual_hybrid_share_size));
243 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_stuffer_data_available(extension) == actual_hybrid_share_size, S2N_ERR_BAD_KEY_SHARE);
244 : :
245 : 0 : struct s2n_kem_params *client_kem_params = &conn->kex_params.client_kem_group_params.kem_params;
246 : :
247 [ # # ]: 0 : if (server_kem_group_params->kem_group->curve == &s2n_ecc_curve_none) { /* Pure PQ */
248 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_kem_recv_ciphertext(extension, client_kem_params) == S2N_SUCCESS, S2N_ERR_BAD_KEY_SHARE);
249 : 0 : } else { /* Hybrid PQ */
250 [ # # ]: 0 : if (!server_kem_group_params->kem_group->send_kem_first) {
251 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_server_key_share_recv_hybrid_partial_ecc(conn, extension) == S2N_SUCCESS, S2N_ERR_BAD_KEY_SHARE);
252 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_kem_recv_ciphertext(extension, client_kem_params) == S2N_SUCCESS, S2N_ERR_BAD_KEY_SHARE);
253 : 0 : } else {
254 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_kem_recv_ciphertext(extension, client_kem_params) == S2N_SUCCESS, S2N_ERR_BAD_KEY_SHARE);
255 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_server_key_share_recv_hybrid_partial_ecc(conn, extension) == S2N_SUCCESS, S2N_ERR_BAD_KEY_SHARE);
256 : 0 : }
257 : 0 : }
258 : :
259 : 0 : return S2N_SUCCESS;
260 : 0 : }
261 : :
262 : : static int s2n_server_key_share_recv_ecc(struct s2n_connection *conn, uint16_t named_group_iana,
263 : : struct s2n_stuffer *extension)
264 : 5371 : {
265 [ - + ][ # # ]: 5371 : POSIX_ENSURE_REF(conn);
266 [ - + ][ # # ]: 5371 : POSIX_ENSURE_REF(extension);
267 : :
268 : 5371 : const struct s2n_ecc_preferences *ecc_pref = NULL;
269 [ - + ]: 5371 : POSIX_GUARD(s2n_connection_get_ecc_preferences(conn, &ecc_pref));
270 [ # # ][ - + ]: 5371 : POSIX_ENSURE_REF(ecc_pref);
271 : :
272 : : /* This check should have been done higher up, but including it here as well for extra defense. */
273 [ - + ][ # # ]: 5371 : POSIX_ENSURE(s2n_ecc_preferences_includes_curve(ecc_pref, named_group_iana),
274 : 5371 : S2N_ERR_ECDHE_UNSUPPORTED_CURVE);
275 : :
276 : 5371 : size_t supported_curve_index = 0;
277 : :
278 [ + - ]: 7888 : for (size_t i = 0; i < ecc_pref->count; i++) {
279 [ + + ]: 7888 : if (named_group_iana == ecc_pref->ecc_curves[i]->iana_id) {
280 : 5371 : supported_curve_index = i;
281 : 5371 : break;
282 : 5371 : }
283 : 7888 : }
284 : :
285 : 5371 : struct s2n_ecc_evp_params *server_ecc_evp_params = &conn->kex_params.server_ecc_evp_params;
286 : 5371 : const struct s2n_ecc_named_curve *negotiated_curve = ecc_pref->ecc_curves[supported_curve_index];
287 : :
288 : : /**
289 : : *= https://www.rfc-editor.org/rfc/rfc8446#4.2.8
290 : : *# If using (EC)DHE key establishment and a HelloRetryRequest containing a
291 : : *# "key_share" extension was received by the client, the client MUST
292 : : *# verify that the selected NamedGroup in the ServerHello is the same as
293 : : *# that in the HelloRetryRequest. If this check fails, the client MUST
294 : : *# abort the handshake with an "illegal_parameter" alert.
295 : : **/
296 [ + + ][ + + ]: 5371 : if (s2n_is_hello_retry_handshake(conn) && !s2n_is_hello_retry_message(conn)) {
297 [ - + ][ # # ]: 623 : POSIX_ENSURE_REF(server_ecc_evp_params->negotiated_curve);
298 : 623 : const struct s2n_ecc_named_curve *previous_negotiated_curve = server_ecc_evp_params->negotiated_curve;
299 [ + + ][ + - ]: 623 : POSIX_ENSURE(negotiated_curve == previous_negotiated_curve,
300 : 623 : S2N_ERR_BAD_MESSAGE);
301 : 623 : }
302 : :
303 : 5370 : server_ecc_evp_params->negotiated_curve = negotiated_curve;
304 : :
305 : : /* Now that ECC has been negotiated, null out this connection's preferred Hybrid KEMs. They will not be used any
306 : : * more during this TLS connection, but can still be printed by s2nc's client debugging output. */
307 : 5370 : conn->kex_params.client_kem_group_params.kem_group = NULL;
308 : 5370 : conn->kex_params.server_kem_group_params.ecc_params.negotiated_curve = NULL;
309 : 5370 : conn->kex_params.client_kem_group_params.kem_params.kem = NULL;
310 : :
311 : : /* If this is a HelloRetryRequest, we won't have a key share. We just have the selected group.
312 : : * Set the server negotiated curve and exit early so a proper keyshare can be generated. */
313 [ + + ]: 5370 : if (s2n_is_hello_retry_message(conn)) {
314 : 654 : return S2N_SUCCESS;
315 : 654 : }
316 : :
317 : : /* Verify key share sent by client */
318 : 4716 : struct s2n_ecc_evp_params *client_ecc_evp_params = &conn->kex_params.client_ecc_evp_params;
319 [ + + ][ + - ]: 4716 : POSIX_ENSURE(client_ecc_evp_params->negotiated_curve == server_ecc_evp_params->negotiated_curve, S2N_ERR_BAD_KEY_SHARE);
320 [ - + ][ # # ]: 4714 : POSIX_ENSURE(client_ecc_evp_params->evp_pkey, S2N_ERR_BAD_KEY_SHARE);
321 : :
322 : 4714 : uint16_t share_size = 0;
323 [ - + ][ # # ]: 4714 : S2N_ERROR_IF(s2n_stuffer_data_available(extension) < sizeof(share_size), S2N_ERR_BAD_KEY_SHARE);
324 [ - + ]: 4714 : POSIX_GUARD(s2n_stuffer_read_uint16(extension, &share_size));
325 [ - + ][ # # ]: 4714 : S2N_ERROR_IF(s2n_stuffer_data_available(extension) < share_size, S2N_ERR_BAD_KEY_SHARE);
326 : :
327 : : /* Proceed to parse share */
328 : 4714 : struct s2n_blob point_blob = { 0 };
329 [ - + ][ # # ]: 4714 : S2N_ERROR_IF(s2n_ecc_evp_read_params_point(extension, share_size, &point_blob) < 0, S2N_ERR_BAD_KEY_SHARE);
330 [ - + ][ # # ]: 4714 : S2N_ERROR_IF(s2n_ecc_evp_parse_params_point(&point_blob, server_ecc_evp_params) < 0, S2N_ERR_BAD_KEY_SHARE);
331 [ - + ][ # # ]: 4714 : S2N_ERROR_IF(server_ecc_evp_params->evp_pkey == NULL, S2N_ERR_BAD_KEY_SHARE);
332 : :
333 : 4714 : return S2N_SUCCESS;
334 : 4714 : }
335 : :
336 : : /*
337 : : * From https://tools.ietf.org/html/rfc8446#section-4.2.8
338 : : *
339 : : * If using (EC)DHE key establishment, servers offer exactly one
340 : : * KeyShareEntry in the ServerHello. This value MUST be in the same
341 : : * group as the KeyShareEntry value offered by the client that the
342 : : * server has selected for the negotiated key exchange.
343 : : */
344 : : static int s2n_server_key_share_recv(struct s2n_connection *conn, struct s2n_stuffer *extension)
345 : 5374 : {
346 [ - + ][ # # ]: 5374 : POSIX_ENSURE_REF(conn);
347 [ # # ][ - + ]: 5374 : POSIX_ENSURE_REF(extension);
348 : :
349 : 5374 : uint16_t negotiated_named_group_iana = 0;
350 [ - + ][ # # ]: 5374 : S2N_ERROR_IF(s2n_stuffer_data_available(extension) < sizeof(negotiated_named_group_iana), S2N_ERR_BAD_KEY_SHARE);
351 [ - + ]: 5374 : POSIX_GUARD(s2n_stuffer_read_uint16(extension, &negotiated_named_group_iana));
352 : :
353 : 5374 : const struct s2n_kem_preferences *kem_pref = NULL;
354 [ - + ]: 5374 : POSIX_GUARD(s2n_connection_get_kem_preferences(conn, &kem_pref));
355 [ - + ][ # # ]: 5374 : POSIX_ENSURE_REF(kem_pref);
356 : :
357 : 5374 : const struct s2n_ecc_preferences *ecc_pref = NULL;
358 [ - + ]: 5374 : POSIX_GUARD(s2n_connection_get_ecc_preferences(conn, &ecc_pref));
359 [ - + ][ # # ]: 5374 : POSIX_ENSURE_REF(ecc_pref);
360 : :
361 [ + + ]: 5374 : if (s2n_ecc_preferences_includes_curve(ecc_pref, negotiated_named_group_iana)) {
362 [ + + ]: 5371 : POSIX_GUARD(s2n_server_key_share_recv_ecc(conn, negotiated_named_group_iana, extension));
363 [ + + ]: 5371 : } else if (s2n_kem_preferences_includes_tls13_kem_group(kem_pref, negotiated_named_group_iana)) {
364 [ + - ]: 1 : POSIX_GUARD(s2n_server_key_share_recv_pq(conn, negotiated_named_group_iana, extension));
365 : 2 : } else {
366 [ + - ]: 2 : POSIX_BAIL(S2N_ERR_ECDHE_UNSUPPORTED_CURVE);
367 : 2 : }
368 : :
369 : 5368 : return S2N_SUCCESS;
370 : 5374 : }
371 : :
372 : : /* Selects highest priority mutually supported key share, or indicates need for HRR */
373 : : int s2n_extensions_server_key_share_select(struct s2n_connection *conn)
374 : 5409 : {
375 [ # # ][ - + ]: 5409 : POSIX_ENSURE_REF(conn);
376 : :
377 : : /* Our most preferred mutually supported KeyShares that are negotiable in 1-RTT */
378 : 5409 : const struct s2n_ecc_named_curve *client_curve = conn->kex_params.client_ecc_evp_params.negotiated_curve;
379 : 5409 : const struct s2n_kem_group *client_kem_group = conn->kex_params.client_kem_group_params.kem_group;
380 : :
381 : : /* Our most preferred mutually supported KeyShares that negotiable in 1 or 2 round trips (which may or may not have been sent in the KeyShare by the client) */
382 : 5409 : const struct s2n_ecc_named_curve *server_curve = conn->kex_params.server_ecc_evp_params.negotiated_curve;
383 : 5409 : const struct s2n_kem_group *server_kem_group = conn->kex_params.server_kem_group_params.kem_group;
384 : :
385 : : /* Boolean XOR check. When receiving the supported_groups extension, s2n server
386 : : * should (exclusively) set either server_curve or server_kem_group based on the
387 : : * set of mutually supported groups. If both server_curve and server_kem_group
388 : : * are NULL, it is because client and server do not share any mutually supported
389 : : * groups; key negotiation is not possible and the handshake should be aborted
390 : : * without sending HRR. (The case of both being non-NULL should never occur, and
391 : : * is an error.) */
392 [ # # ][ - + ]: 5409 : POSIX_ENSURE((server_curve == NULL) != (server_kem_group == NULL), S2N_ERR_INVALID_SUPPORTED_GROUP_STATE);
393 : :
394 : 5409 : const struct s2n_security_policy *policy = NULL;
395 [ - + ]: 5409 : POSIX_GUARD(s2n_connection_get_security_policy(conn, &policy));
396 [ # # ][ - + ]: 5409 : POSIX_ENSURE_REF(policy);
397 : :
398 : : /* Option 1: Select the best mutually supported PQ KEM Group that can be negotiated in 1-RTT */
399 [ - + ]: 5409 : if (client_kem_group != NULL) {
400 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(conn->kex_params.client_kem_group_params.kem_params.kem);
401 : :
402 : 0 : conn->kex_params.server_kem_group_params.kem_group = conn->kex_params.client_kem_group_params.kem_group;
403 : 0 : conn->kex_params.server_kem_group_params.ecc_params.negotiated_curve = conn->kex_params.client_kem_group_params.ecc_params.negotiated_curve;
404 : 0 : conn->kex_params.server_kem_group_params.kem_params.kem = conn->kex_params.client_kem_group_params.kem_params.kem;
405 : 0 : conn->kex_params.server_ecc_evp_params.negotiated_curve = NULL;
406 : 0 : return S2N_SUCCESS;
407 : 0 : }
408 : :
409 : : /* Option 2: Otherwise, if any PQ KEM Groups can be negotiated in 2-RTT's select that one. This ensures that
410 : : * clients who offer PQ (and presumably therefore have concerns about quantum computing impacting the long term
411 : : * confidentiality of their data), have their choice to offer PQ respected, even if they predict the server-side
412 : : * supports a different PQ KeyShare algorithms. This ensures clients with PQ support are never downgraded to non-PQ
413 : : * algorithms. */
414 [ - + ]: 5409 : if (server_kem_group != NULL) {
415 : : /* Null out any available ECC curves so that they won't be sent in the ClientHelloRetry */
416 : 0 : conn->kex_params.server_ecc_evp_params.negotiated_curve = NULL;
417 [ # # ]: 0 : POSIX_GUARD(s2n_set_hello_retry_required(conn));
418 : 0 : return S2N_SUCCESS;
419 : 0 : }
420 : :
421 : : /* Check if there are any strongly preferred ECC groups worth performing a 2-RTT upgrade for.
422 : : * This check is performed after PQ negotiation to ensure PQ-capable clients are never
423 : : * downgraded to a classical group due to a strongly preferred ECC curve. */
424 : 5409 : const struct s2n_ecc_named_curve *strongly_preferred_curve = NULL;
425 : 5409 : bool matched_strongly_preferred_iana = false;
426 : 5409 : bool need_hrr_for_strongly_preferred_group = false;
427 : :
428 [ + + ][ + + ]: 5417 : for (size_t i = 0; policy->strongly_preferred_groups != NULL && i < policy->strongly_preferred_groups->count && !matched_strongly_preferred_iana; i++) {
[ + - ]
429 : 8 : uint16_t strongly_preferred_iana = policy->strongly_preferred_groups->iana_ids[i];
430 : :
431 [ + - ][ + + ]: 16 : for (int j = 0; j < S2N_ECC_EVP_SUPPORTED_CURVES_COUNT && !matched_strongly_preferred_iana; j++) {
432 : 8 : const struct s2n_ecc_named_curve *mutually_supported_curve = conn->kex_params.mutually_supported_curves[j];
433 [ - + ]: 8 : if (mutually_supported_curve == NULL) {
434 : 0 : break; /* Reached end of mutually supported ECC curves */
435 : 0 : }
436 [ + - ]: 8 : if (strongly_preferred_iana == mutually_supported_curve->iana_id) {
437 : 8 : matched_strongly_preferred_iana = true;
438 : 8 : strongly_preferred_curve = mutually_supported_curve;
439 : :
440 : : /* Check if we can negotiate our strongly preferred ECC Curve in 1-RTT */
441 [ + - ][ + + ]: 8 : if (client_curve != NULL && (strongly_preferred_iana == client_curve->iana_id)) {
442 : 4 : need_hrr_for_strongly_preferred_group = false;
443 : 4 : } else {
444 : 4 : need_hrr_for_strongly_preferred_group = true;
445 : 4 : }
446 : 8 : }
447 : 8 : }
448 : 8 : }
449 : :
450 : : /* Option 3: Perform a 2-RTT handshake if there is a strongly-preferred ECC group that requires it. */
451 [ + + ][ + + ]: 5409 : if (matched_strongly_preferred_iana && need_hrr_for_strongly_preferred_group) {
452 : 4 : conn->kex_params.server_kem_group_params.kem_group = NULL;
453 : 4 : conn->kex_params.server_ecc_evp_params.negotiated_curve = strongly_preferred_curve;
454 [ - + ]: 4 : POSIX_GUARD(s2n_set_hello_retry_required(conn));
455 : 4 : return S2N_SUCCESS;
456 : 4 : }
457 : :
458 : : /* Option 4: Otherwise, if there is a mutually supported classical ECDHE-only group can be negotiated in 1-RTT, select that one */
459 [ + + ]: 5405 : if (client_curve) {
460 : 4757 : conn->kex_params.server_ecc_evp_params.negotiated_curve = conn->kex_params.client_ecc_evp_params.negotiated_curve;
461 : 4757 : conn->kex_params.server_kem_group_params.kem_group = NULL;
462 : 4757 : conn->kex_params.server_kem_group_params.ecc_params.negotiated_curve = NULL;
463 : 4757 : conn->kex_params.server_kem_group_params.kem_params.kem = NULL;
464 : 4757 : return S2N_SUCCESS;
465 : 4757 : }
466 : :
467 : : /* Option 5: Server and client have at least 1 mutually supported group, but the client did not send key shares for
468 : : * any of them. Send a HelloRetryRequest indicating the server's preference. */
469 [ - + ]: 648 : POSIX_GUARD(s2n_set_hello_retry_required(conn));
470 : 648 : return S2N_SUCCESS;
471 : 648 : }
472 : :
473 : : /* Old-style extension functions -- remove after extensions refactor is complete */
474 : :
475 : : /*
476 : : * Calculate the data length for Server Key Share extension
477 : : * based on negotiated_curve selected in server_ecc_evp_params.
478 : : *
479 : : * Retry requests have a different key share format,
480 : : * https://tools.ietf.org/html/rfc8446#section-4.2.8
481 : : *
482 : : * This functions does not error, but s2n_extensions_server_key_share_send() would
483 : : */
484 : : int s2n_extensions_server_key_share_send_size(struct s2n_connection *conn)
485 : 11 : {
486 : 11 : const struct s2n_ecc_named_curve *curve = conn->kex_params.server_ecc_evp_params.negotiated_curve;
487 : 11 : int key_share_size = S2N_SIZE_OF_EXTENSION_TYPE
488 : 11 : + S2N_SIZE_OF_EXTENSION_DATA_SIZE
489 : 11 : + S2N_SIZE_OF_NAMED_GROUP;
490 : :
491 : : /* If this is a KeyShareHelloRetryRequest we don't include the share size */
492 [ + + ]: 11 : if (s2n_is_hello_retry_message(conn)) {
493 : 3 : return key_share_size;
494 : 3 : }
495 : :
496 [ + + ]: 8 : if (curve == NULL) {
497 : 2 : return 0;
498 : 2 : }
499 : :
500 : : /* If this is a full KeyShareEntry, include the share size */
501 : 6 : key_share_size += (S2N_SIZE_OF_KEY_SHARE_SIZE + curve->share_size);
502 : :
503 : 6 : return key_share_size;
504 : 8 : }
505 : :
506 : : /*
507 : : * Sends Key Share extension in Server Hello.
508 : : *
509 : : * Expects negotiated_curve to be set and generates a ephemeral key for key sharing
510 : : */
511 : : int s2n_extensions_server_key_share_send(struct s2n_connection *conn, struct s2n_stuffer *out)
512 : 1 : {
513 : 1 : return s2n_extension_send(&s2n_server_key_share_extension, conn, out);
514 : 1 : }
515 : :
516 : : /*
517 : : * Client receives a Server Hello key share.
518 : : *
519 : : * If the curve is supported, conn->kex_params.server_ecc_evp_params will be set.
520 : : */
521 : : int s2n_extensions_server_key_share_recv(struct s2n_connection *conn, struct s2n_stuffer *extension)
522 : 1 : {
523 : 1 : return s2n_extension_recv(&s2n_server_key_share_extension, conn, extension);
524 : 1 : }
|
