Branch data Line data Source code
1 : : /*
2 : : * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3 : : *
4 : : * Licensed under the Apache License, Version 2.0 (the "License").
5 : : * You may not use this file except in compliance with the License.
6 : : * A copy of the License is located at
7 : : *
8 : : * http://aws.amazon.com/apache2.0
9 : : *
10 : : * or in the "license" file accompanying this file. This file is distributed
11 : : * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12 : : * express or implied. See the License for the specific language governing
13 : : * permissions and limitations under the License.
14 : : */
15 : :
16 : : #include "tls/extensions/s2n_server_key_share.h"
17 : :
18 : : #include "crypto/s2n_pq.h"
19 : : #include "tls/s2n_security_policies.h"
20 : : #include "tls/s2n_supported_group_preferences.h"
21 : : #include "tls/s2n_tls.h"
22 : : #include "tls/s2n_tls13.h"
23 : : #include "utils/s2n_safety.h"
24 : :
25 : : static int s2n_server_key_share_send(struct s2n_connection *conn, struct s2n_stuffer *out);
26 : : static int s2n_server_key_share_recv(struct s2n_connection *conn, struct s2n_stuffer *extension);
27 : :
28 : : const s2n_extension_type s2n_server_key_share_extension = {
29 : : .iana_value = TLS_EXTENSION_KEY_SHARE,
30 : : .minimum_version = S2N_TLS13,
31 : : .is_response = true,
32 : : .send = s2n_server_key_share_send,
33 : : .recv = s2n_server_key_share_recv,
34 : : .should_send = s2n_extension_always_send,
35 : : .if_missing = s2n_extension_noop_if_missing,
36 : : };
37 : :
38 : : static int s2n_server_key_share_send_hybrid_partial_ecc(struct s2n_connection *conn, struct s2n_stuffer *out)
39 : 0 : {
40 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(conn);
41 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(out);
42 : :
43 : 0 : struct s2n_kem_group_params *server_kem_group_params = &conn->kex_params.server_kem_group_params;
44 : 0 : struct s2n_kem_params *client_kem_params = &conn->kex_params.client_kem_group_params.kem_params;
45 : :
46 : 0 : struct s2n_ecc_evp_params *server_ecc_params = &server_kem_group_params->ecc_params;
47 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(server_ecc_params->negotiated_curve);
48 [ # # ]: 0 : if (client_kem_params->len_prefixed) {
49 [ # # ]: 0 : POSIX_GUARD(s2n_stuffer_write_uint16(out, server_ecc_params->negotiated_curve->share_size));
50 : 0 : }
51 [ # # ]: 0 : POSIX_GUARD(s2n_ecc_evp_generate_ephemeral_key(server_ecc_params));
52 [ # # ]: 0 : POSIX_GUARD(s2n_ecc_evp_write_params_point(server_ecc_params, out));
53 : :
54 : 0 : return S2N_SUCCESS;
55 : 0 : }
56 : :
57 : : static int s2n_server_key_share_generate_pq(struct s2n_connection *conn, struct s2n_stuffer *out)
58 : 0 : {
59 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(out);
60 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(conn);
61 : :
62 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_pq_is_enabled(), S2N_ERR_UNIMPLEMENTED);
63 : :
64 : 0 : struct s2n_kem_group_params *server_kem_group_params = &conn->kex_params.server_kem_group_params;
65 : 0 : struct s2n_kem_params *client_kem_params = &conn->kex_params.client_kem_group_params.kem_params;
66 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(client_kem_params->public_key.data);
67 : :
68 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(server_kem_group_params->kem_group);
69 [ # # ]: 0 : POSIX_GUARD(s2n_stuffer_write_uint16(out, server_kem_group_params->kem_group->iana_id));
70 : :
71 : 0 : struct s2n_stuffer_reservation total_share_size = { 0 };
72 [ # # ]: 0 : POSIX_GUARD(s2n_stuffer_reserve_uint16(out, &total_share_size));
73 : :
74 : : /* s2n_kem_send_ciphertext() will generate the PQ shared secret and use
75 : : * the client's public key to encapsulate; the PQ shared secret will be
76 : : * stored in client_kem_params, and will be used during the shared
77 : : * secret derivation. */
78 [ # # ]: 0 : if (server_kem_group_params->kem_group->curve == &s2n_ecc_curve_none) { /* Pure PQ */
79 [ # # ]: 0 : POSIX_GUARD(s2n_kem_send_ciphertext(out, client_kem_params));
80 : 0 : } else { /* Hybrid PQ */
81 [ # # ]: 0 : if (server_kem_group_params->kem_group->send_kem_first) {
82 [ # # ]: 0 : POSIX_GUARD(s2n_kem_send_ciphertext(out, client_kem_params));
83 [ # # ]: 0 : POSIX_GUARD(s2n_server_key_share_send_hybrid_partial_ecc(conn, out));
84 : 0 : } else {
85 [ # # ]: 0 : POSIX_GUARD(s2n_server_key_share_send_hybrid_partial_ecc(conn, out));
86 [ # # ]: 0 : POSIX_GUARD(s2n_kem_send_ciphertext(out, client_kem_params));
87 : 0 : }
88 : 0 : }
89 : :
90 [ # # ]: 0 : POSIX_GUARD(s2n_stuffer_write_vector_size(&total_share_size));
91 : 0 : return S2N_SUCCESS;
92 : 0 : }
93 : :
94 : : /* Check that client has sent a corresponding key share for the server's KEM group */
95 : : int s2n_server_key_share_send_check_pq(struct s2n_connection *conn)
96 : 2 : {
97 [ + + ][ + - ]: 2 : POSIX_ENSURE_REF(conn);
98 : :
99 [ + - ][ + - ]: 1 : POSIX_ENSURE(s2n_pq_is_enabled(), S2N_ERR_UNIMPLEMENTED);
100 : :
101 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(conn->kex_params.server_kem_group_params.kem_group);
102 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(conn->kex_params.server_kem_group_params.kem_params.kem);
103 : :
104 : 0 : const struct s2n_kem_preferences *kem_pref = NULL;
105 [ # # ]: 0 : POSIX_GUARD(s2n_connection_get_kem_preferences(conn, &kem_pref));
106 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(kem_pref);
107 : :
108 : 0 : const struct s2n_kem_group *server_kem_group = conn->kex_params.server_kem_group_params.kem_group;
109 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_kem_preferences_includes_tls13_kem_group(kem_pref, server_kem_group->iana_id),
110 : 0 : S2N_ERR_KEM_UNSUPPORTED_PARAMS);
111 : :
112 : 0 : struct s2n_kem_group_params *client_params = &conn->kex_params.client_kem_group_params;
113 [ # # ][ # # ]: 0 : POSIX_ENSURE(client_params->kem_group == server_kem_group, S2N_ERR_BAD_KEY_SHARE);
114 : :
115 [ # # ][ # # ]: 0 : POSIX_ENSURE(client_params->kem_params.kem == server_kem_group->kem, S2N_ERR_BAD_KEY_SHARE);
116 [ # # ][ # # ]: 0 : POSIX_ENSURE(client_params->kem_params.public_key.size == server_kem_group->kem->public_key_length, S2N_ERR_BAD_KEY_SHARE);
117 [ # # ][ # # ]: 0 : POSIX_ENSURE(client_params->kem_params.public_key.data != NULL, S2N_ERR_BAD_KEY_SHARE);
118 : :
119 : 0 : return S2N_SUCCESS;
120 : 0 : }
121 : :
122 : : /* Check that client has sent a corresponding key share for the server's EC curve */
123 : : int s2n_server_key_share_send_check_ecdhe(struct s2n_connection *conn)
124 : 4739 : {
125 [ + + ][ + - ]: 4739 : POSIX_ENSURE_REF(conn);
126 : :
127 : 4738 : const struct s2n_ecc_preferences *ecc_pref = NULL;
128 [ - + ]: 4738 : POSIX_GUARD(s2n_connection_get_ecc_preferences(conn, &ecc_pref));
129 [ # # ][ - + ]: 4738 : POSIX_ENSURE_REF(ecc_pref);
130 : :
131 : 4738 : const struct s2n_ecc_named_curve *server_curve = conn->kex_params.server_ecc_evp_params.negotiated_curve;
132 [ + - ][ + + ]: 4738 : POSIX_ENSURE_REF(server_curve);
133 : :
134 : 4737 : struct s2n_ecc_evp_params *client_params = &conn->kex_params.client_ecc_evp_params;
135 [ + - ][ + + ]: 4737 : POSIX_ENSURE(client_params->negotiated_curve == server_curve, S2N_ERR_BAD_KEY_SHARE);
136 [ + + ][ + - ]: 4735 : POSIX_ENSURE(client_params->evp_pkey != NULL, S2N_ERR_BAD_KEY_SHARE);
137 : :
138 : 4729 : return S2N_SUCCESS;
139 : 4735 : }
140 : :
141 : : static int s2n_server_key_share_send(struct s2n_connection *conn, struct s2n_stuffer *out)
142 : 5398 : {
143 [ + + ][ + - ]: 5398 : POSIX_ENSURE_REF(conn);
144 [ + + ][ + - ]: 5397 : POSIX_ENSURE_REF(out);
145 : :
146 : 5396 : const struct s2n_ecc_named_curve *curve = conn->kex_params.server_ecc_evp_params.negotiated_curve;
147 : 5396 : const struct s2n_kem_group *kem_group = conn->kex_params.server_kem_group_params.kem_group;
148 : :
149 : : /* Boolean XOR: exactly one of {server_curve, server_kem_group} should be non-null. */
150 [ + - ][ + + ]: 5396 : POSIX_ENSURE((curve == NULL) != (kem_group == NULL), S2N_ERR_INVALID_SUPPORTED_GROUP_STATE);
151 : :
152 : : /* Retry requests only require the selected named group, not an actual share.
153 : : * https://tools.ietf.org/html/rfc8446#section-4.2.8 */
154 [ + + ]: 5394 : if (s2n_is_hello_retry_message(conn)) {
155 : 661 : uint16_t named_group_id = 0;
156 [ + - ]: 661 : if (curve != NULL) {
157 : 661 : named_group_id = curve->iana_id;
158 : 661 : } else {
159 : 0 : named_group_id = kem_group->iana_id;
160 : 0 : }
161 : :
162 [ - + ]: 661 : POSIX_GUARD(s2n_stuffer_write_uint16(out, named_group_id));
163 : 661 : return S2N_SUCCESS;
164 : 661 : }
165 : :
166 [ + - ]: 4733 : if (curve != NULL) {
167 [ + + ]: 4733 : POSIX_GUARD(s2n_server_key_share_send_check_ecdhe(conn));
168 [ - + ]: 4728 : POSIX_GUARD(s2n_ecdhe_parameters_send(&conn->kex_params.server_ecc_evp_params, out));
169 : 4728 : } else {
170 [ # # ]: 0 : POSIX_GUARD(s2n_server_key_share_send_check_pq(conn));
171 [ # # ]: 0 : POSIX_GUARD(s2n_server_key_share_generate_pq(conn, out));
172 : 0 : }
173 : :
174 : 4728 : return S2N_SUCCESS;
175 : 4733 : }
176 : :
177 : : static int s2n_server_key_share_recv_hybrid_partial_ecc(struct s2n_connection *conn, struct s2n_stuffer *extension)
178 : 0 : {
179 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(conn);
180 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(extension);
181 : :
182 : 0 : struct s2n_kem_params *client_kem_params = &conn->kex_params.client_kem_group_params.kem_params;
183 : 0 : struct s2n_kem_group_params *server_kem_group_params = &conn->kex_params.server_kem_group_params;
184 : 0 : const struct s2n_kem_group *server_kem_group = server_kem_group_params->kem_group;
185 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(server_kem_group);
186 : 0 : uint16_t expected_ecc_share_size = server_kem_group->curve->share_size;
187 : :
188 : : /* Parse ECC key share */
189 [ # # ]: 0 : if (client_kem_params->len_prefixed) {
190 : 0 : uint16_t actual_ecc_share_size = 0;
191 [ # # ]: 0 : POSIX_GUARD(s2n_stuffer_read_uint16(extension, &actual_ecc_share_size));
192 [ # # ][ # # ]: 0 : POSIX_ENSURE(actual_ecc_share_size == expected_ecc_share_size, S2N_ERR_BAD_KEY_SHARE);
193 : 0 : }
194 : :
195 : 0 : struct s2n_blob point_blob = { 0 };
196 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_ecc_evp_read_params_point(extension, expected_ecc_share_size, &point_blob) == S2N_SUCCESS, S2N_ERR_BAD_KEY_SHARE);
197 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_ecc_evp_parse_params_point(&point_blob, &server_kem_group_params->ecc_params) == S2N_SUCCESS, S2N_ERR_BAD_KEY_SHARE);
198 [ # # ][ # # ]: 0 : POSIX_ENSURE(server_kem_group_params->ecc_params.evp_pkey != NULL, S2N_ERR_BAD_KEY_SHARE);
199 : :
200 : 0 : return S2N_SUCCESS;
201 : 0 : }
202 : :
203 : : static int s2n_server_key_share_recv_pq(struct s2n_connection *conn, uint16_t named_group_iana,
204 : : struct s2n_stuffer *extension)
205 : 1 : {
206 [ - + ][ # # ]: 1 : POSIX_ENSURE_REF(conn);
207 [ - + ][ # # ]: 1 : POSIX_ENSURE_REF(extension);
208 : :
209 : : /* If PQ is disabled, the client should not have sent any PQ IDs
210 : : * in the supported_groups list of the initial ClientHello */
211 [ + - ][ + - ]: 1 : POSIX_ENSURE(s2n_pq_is_enabled(), S2N_ERR_ECDHE_UNSUPPORTED_CURVE);
212 : :
213 : 0 : const struct s2n_kem_preferences *kem_pref = NULL;
214 [ # # ]: 0 : POSIX_GUARD(s2n_connection_get_kem_preferences(conn, &kem_pref));
215 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(kem_pref);
216 : :
217 : : /* This check should have been done higher up, but including it here as well for extra defense.
218 : : * Uses S2N_ERR_ECDHE_UNSUPPORTED_CURVE for backward compatibility. */
219 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_kem_preferences_includes_tls13_kem_group(kem_pref, named_group_iana), S2N_ERR_ECDHE_UNSUPPORTED_CURVE);
220 : :
221 : 0 : size_t kem_group_index = 0;
222 : 0 : bool kem_group_found = false;
223 [ # # ]: 0 : for (size_t i = 0; i < kem_pref->tls13_kem_group_count; i++) {
224 [ # # ]: 0 : if (named_group_iana == kem_pref->tls13_kem_groups[i]->iana_id
225 [ # # ]: 0 : && s2n_kem_group_is_available(kem_pref->tls13_kem_groups[i])) {
226 : 0 : kem_group_index = i;
227 : 0 : kem_group_found = true;
228 : 0 : break;
229 : 0 : }
230 : 0 : }
231 [ # # ][ # # ]: 0 : POSIX_ENSURE(kem_group_found, S2N_ERR_ECDHE_UNSUPPORTED_CURVE);
232 : :
233 : 0 : struct s2n_kem_group_params *server_kem_group_params = &conn->kex_params.server_kem_group_params;
234 : 0 : server_kem_group_params->kem_group = kem_pref->tls13_kem_groups[kem_group_index];
235 : 0 : server_kem_group_params->kem_params.kem = kem_pref->tls13_kem_groups[kem_group_index]->kem;
236 : 0 : server_kem_group_params->ecc_params.negotiated_curve = kem_pref->tls13_kem_groups[kem_group_index]->curve;
237 : :
238 : : /* If this a HRR, the server will only have sent the named group ID. We assign the
239 : : * appropriate KEM group params above, then exit early so that the client can
240 : : * generate the correct key share. */
241 [ # # ]: 0 : if (s2n_is_hello_retry_message(conn)) {
242 : 0 : return S2N_SUCCESS;
243 : 0 : }
244 : :
245 : : /* Ensure that the server's key share corresponds with a key share previously sent by the client */
246 : 0 : struct s2n_kem_group_params *client_kem_group_params = &conn->kex_params.client_kem_group_params;
247 [ # # ][ # # ]: 0 : POSIX_ENSURE(client_kem_group_params->kem_params.private_key.data, S2N_ERR_BAD_KEY_SHARE);
248 [ # # ][ # # ]: 0 : POSIX_ENSURE(client_kem_group_params->kem_group == server_kem_group_params->kem_group, S2N_ERR_BAD_KEY_SHARE);
249 : :
250 : 0 : uint16_t actual_hybrid_share_size = 0;
251 [ # # ]: 0 : POSIX_GUARD(s2n_stuffer_read_uint16(extension, &actual_hybrid_share_size));
252 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_stuffer_data_available(extension) == actual_hybrid_share_size, S2N_ERR_BAD_KEY_SHARE);
253 : :
254 : 0 : struct s2n_kem_params *client_kem_params = &conn->kex_params.client_kem_group_params.kem_params;
255 : :
256 : : /* Don't need to set client_kem_params->len_prefixed since we are the client;
257 : : * server-side should auto-detect hybrid share size and match our behavior. */
258 : :
259 [ # # ]: 0 : if (server_kem_group_params->kem_group->curve == &s2n_ecc_curve_none) { /* Pure PQ */
260 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_kem_recv_ciphertext(extension, client_kem_params) == S2N_SUCCESS, S2N_ERR_BAD_KEY_SHARE);
261 : 0 : } else { /* Hybrid PQ */
262 [ # # ]: 0 : if (!server_kem_group_params->kem_group->send_kem_first) {
263 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_server_key_share_recv_hybrid_partial_ecc(conn, extension) == S2N_SUCCESS, S2N_ERR_BAD_KEY_SHARE);
264 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_kem_recv_ciphertext(extension, client_kem_params) == S2N_SUCCESS, S2N_ERR_BAD_KEY_SHARE);
265 : 0 : } else {
266 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_kem_recv_ciphertext(extension, client_kem_params) == S2N_SUCCESS, S2N_ERR_BAD_KEY_SHARE);
267 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_server_key_share_recv_hybrid_partial_ecc(conn, extension) == S2N_SUCCESS, S2N_ERR_BAD_KEY_SHARE);
268 : 0 : }
269 : 0 : }
270 : :
271 : 0 : return S2N_SUCCESS;
272 : 0 : }
273 : :
274 : : static int s2n_server_key_share_recv_ecc(struct s2n_connection *conn, uint16_t named_group_iana,
275 : : struct s2n_stuffer *extension)
276 : 5359 : {
277 [ - + ][ # # ]: 5359 : POSIX_ENSURE_REF(conn);
278 [ - + ][ # # ]: 5359 : POSIX_ENSURE_REF(extension);
279 : :
280 : 5359 : const struct s2n_ecc_preferences *ecc_pref = NULL;
281 [ - + ]: 5359 : POSIX_GUARD(s2n_connection_get_ecc_preferences(conn, &ecc_pref));
282 [ - + ][ # # ]: 5359 : POSIX_ENSURE_REF(ecc_pref);
283 : :
284 : : /* This check should have been done higher up, but including it here as well for extra defense. */
285 [ - + ][ # # ]: 5359 : POSIX_ENSURE(s2n_ecc_preferences_includes_curve(ecc_pref, named_group_iana),
286 : 5359 : S2N_ERR_ECDHE_UNSUPPORTED_CURVE);
287 : :
288 : 5359 : size_t supported_curve_index = 0;
289 : :
290 [ + - ]: 7876 : for (size_t i = 0; i < ecc_pref->count; i++) {
291 [ + + ]: 7876 : if (named_group_iana == ecc_pref->ecc_curves[i]->iana_id) {
292 : 5359 : supported_curve_index = i;
293 : 5359 : break;
294 : 5359 : }
295 : 7876 : }
296 : :
297 : 5359 : struct s2n_ecc_evp_params *server_ecc_evp_params = &conn->kex_params.server_ecc_evp_params;
298 : 5359 : const struct s2n_ecc_named_curve *negotiated_curve = ecc_pref->ecc_curves[supported_curve_index];
299 : :
300 : : /**
301 : : *= https://www.rfc-editor.org/rfc/rfc8446#4.2.8
302 : : *# If using (EC)DHE key establishment and a HelloRetryRequest containing a
303 : : *# "key_share" extension was received by the client, the client MUST
304 : : *# verify that the selected NamedGroup in the ServerHello is the same as
305 : : *# that in the HelloRetryRequest. If this check fails, the client MUST
306 : : *# abort the handshake with an "illegal_parameter" alert.
307 : : **/
308 [ + + ][ + + ]: 5359 : if (s2n_is_hello_retry_handshake(conn) && !s2n_is_hello_retry_message(conn)) {
309 [ - + ][ # # ]: 623 : POSIX_ENSURE_REF(server_ecc_evp_params->negotiated_curve);
310 : 623 : const struct s2n_ecc_named_curve *previous_negotiated_curve = server_ecc_evp_params->negotiated_curve;
311 [ + + ][ + - ]: 623 : POSIX_ENSURE(negotiated_curve == previous_negotiated_curve,
312 : 623 : S2N_ERR_BAD_MESSAGE);
313 : 623 : }
314 : :
315 : 5358 : server_ecc_evp_params->negotiated_curve = negotiated_curve;
316 : :
317 : : /* Now that ECC has been negotiated, null out this connection's preferred Hybrid KEMs. They will not be used any
318 : : * more during this TLS connection, but can still be printed by s2nc's client debugging output. */
319 : 5358 : conn->kex_params.client_kem_group_params.kem_group = NULL;
320 : 5358 : conn->kex_params.server_kem_group_params.ecc_params.negotiated_curve = NULL;
321 : 5358 : conn->kex_params.client_kem_group_params.kem_params.kem = NULL;
322 : :
323 : : /* If this is a HelloRetryRequest, we won't have a key share. We just have the selected group.
324 : : * Set the server negotiated curve and exit early so a proper keyshare can be generated. */
325 [ + + ]: 5358 : if (s2n_is_hello_retry_message(conn)) {
326 : 654 : return S2N_SUCCESS;
327 : 654 : }
328 : :
329 : : /* Verify key share sent by client */
330 : 4704 : struct s2n_ecc_evp_params *client_ecc_evp_params = &conn->kex_params.client_ecc_evp_params;
331 [ + + ][ + - ]: 4704 : POSIX_ENSURE(client_ecc_evp_params->negotiated_curve == server_ecc_evp_params->negotiated_curve, S2N_ERR_BAD_KEY_SHARE);
332 [ # # ][ - + ]: 4702 : POSIX_ENSURE(client_ecc_evp_params->evp_pkey, S2N_ERR_BAD_KEY_SHARE);
333 : :
334 : 4702 : uint16_t share_size = 0;
335 [ - + ][ # # ]: 4702 : S2N_ERROR_IF(s2n_stuffer_data_available(extension) < sizeof(share_size), S2N_ERR_BAD_KEY_SHARE);
336 [ - + ]: 4702 : POSIX_GUARD(s2n_stuffer_read_uint16(extension, &share_size));
337 [ - + ][ # # ]: 4702 : S2N_ERROR_IF(s2n_stuffer_data_available(extension) < share_size, S2N_ERR_BAD_KEY_SHARE);
338 : :
339 : : /* Proceed to parse share */
340 : 4702 : struct s2n_blob point_blob = { 0 };
341 [ - + ][ # # ]: 4702 : S2N_ERROR_IF(s2n_ecc_evp_read_params_point(extension, share_size, &point_blob) < 0, S2N_ERR_BAD_KEY_SHARE);
342 [ - + ][ # # ]: 4702 : S2N_ERROR_IF(s2n_ecc_evp_parse_params_point(&point_blob, server_ecc_evp_params) < 0, S2N_ERR_BAD_KEY_SHARE);
343 [ - + ][ # # ]: 4702 : S2N_ERROR_IF(server_ecc_evp_params->evp_pkey == NULL, S2N_ERR_BAD_KEY_SHARE);
344 : :
345 : 4702 : return S2N_SUCCESS;
346 : 4702 : }
347 : :
348 : : /*
349 : : * From https://tools.ietf.org/html/rfc8446#section-4.2.8
350 : : *
351 : : * If using (EC)DHE key establishment, servers offer exactly one
352 : : * KeyShareEntry in the ServerHello. This value MUST be in the same
353 : : * group as the KeyShareEntry value offered by the client that the
354 : : * server has selected for the negotiated key exchange.
355 : : */
356 : : static int s2n_server_key_share_recv(struct s2n_connection *conn, struct s2n_stuffer *extension)
357 : 5362 : {
358 [ # # ][ - + ]: 5362 : POSIX_ENSURE_REF(conn);
359 [ # # ][ - + ]: 5362 : POSIX_ENSURE_REF(extension);
360 : :
361 : 5362 : uint16_t negotiated_named_group_iana = 0;
362 [ - + ][ # # ]: 5362 : S2N_ERROR_IF(s2n_stuffer_data_available(extension) < sizeof(negotiated_named_group_iana), S2N_ERR_BAD_KEY_SHARE);
363 [ - + ]: 5362 : POSIX_GUARD(s2n_stuffer_read_uint16(extension, &negotiated_named_group_iana));
364 : :
365 : 5362 : const struct s2n_kem_preferences *kem_pref = NULL;
366 [ - + ]: 5362 : POSIX_GUARD(s2n_connection_get_kem_preferences(conn, &kem_pref));
367 [ - + ][ # # ]: 5362 : POSIX_ENSURE_REF(kem_pref);
368 : :
369 : 5362 : const struct s2n_ecc_preferences *ecc_pref = NULL;
370 [ - + ]: 5362 : POSIX_GUARD(s2n_connection_get_ecc_preferences(conn, &ecc_pref));
371 [ - + ][ # # ]: 5362 : POSIX_ENSURE_REF(ecc_pref);
372 : :
373 [ + + ]: 5362 : if (s2n_ecc_preferences_includes_curve(ecc_pref, negotiated_named_group_iana)) {
374 [ + + ]: 5359 : POSIX_GUARD(s2n_server_key_share_recv_ecc(conn, negotiated_named_group_iana, extension));
375 [ + + ]: 5359 : } else if (s2n_kem_preferences_includes_tls13_kem_group(kem_pref, negotiated_named_group_iana)) {
376 [ + - ]: 1 : POSIX_GUARD(s2n_server_key_share_recv_pq(conn, negotiated_named_group_iana, extension));
377 : 2 : } else {
378 [ + - ]: 2 : POSIX_BAIL(S2N_ERR_ECDHE_UNSUPPORTED_CURVE);
379 : 2 : }
380 : :
381 : 5356 : return S2N_SUCCESS;
382 : 5362 : }
383 : :
384 : : /* Selects highest priority mutually supported key share, or indicates need for HRR */
385 : : int s2n_extensions_server_key_share_select(struct s2n_connection *conn)
386 : 5397 : {
387 [ # # ][ - + ]: 5397 : POSIX_ENSURE_REF(conn);
388 : :
389 : : /* Our most preferred mutually supported KeyShares that are negotiable in 1-RTT */
390 : 5397 : const struct s2n_ecc_named_curve *client_curve = conn->kex_params.client_ecc_evp_params.negotiated_curve;
391 : 5397 : const struct s2n_kem_group *client_kem_group = conn->kex_params.client_kem_group_params.kem_group;
392 : :
393 : : /* Our most preferred mutually supported KeyShares that negotiable in 1 or 2 round trips (which may or may not have been sent in the KeyShare by the client) */
394 : 5397 : const struct s2n_ecc_named_curve *server_curve = conn->kex_params.server_ecc_evp_params.negotiated_curve;
395 : 5397 : const struct s2n_kem_group *server_kem_group = conn->kex_params.server_kem_group_params.kem_group;
396 : :
397 : : /* Boolean XOR check. When receiving the supported_groups extension, s2n server
398 : : * should (exclusively) set either server_curve or server_kem_group based on the
399 : : * set of mutually supported groups. If both server_curve and server_kem_group
400 : : * are NULL, it is because client and server do not share any mutually supported
401 : : * groups; key negotiation is not possible and the handshake should be aborted
402 : : * without sending HRR. (The case of both being non-NULL should never occur, and
403 : : * is an error.) */
404 [ - + ][ # # ]: 5397 : POSIX_ENSURE((server_curve == NULL) != (server_kem_group == NULL), S2N_ERR_INVALID_SUPPORTED_GROUP_STATE);
405 : :
406 : 5397 : const struct s2n_security_policy *policy = NULL;
407 [ - + ]: 5397 : POSIX_GUARD(s2n_connection_get_security_policy(conn, &policy));
408 [ - + ][ # # ]: 5397 : POSIX_ENSURE_REF(policy);
409 : :
410 : : /* Option 1: Select the best mutually supported PQ KEM Group that can be negotiated in 1-RTT */
411 [ - + ]: 5397 : if (client_kem_group != NULL) {
412 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(conn->kex_params.client_kem_group_params.kem_params.kem);
413 : :
414 : 0 : conn->kex_params.server_kem_group_params.kem_group = conn->kex_params.client_kem_group_params.kem_group;
415 : 0 : conn->kex_params.server_kem_group_params.ecc_params.negotiated_curve = conn->kex_params.client_kem_group_params.ecc_params.negotiated_curve;
416 : 0 : conn->kex_params.server_kem_group_params.kem_params.kem = conn->kex_params.client_kem_group_params.kem_params.kem;
417 : 0 : conn->kex_params.server_ecc_evp_params.negotiated_curve = NULL;
418 : 0 : return S2N_SUCCESS;
419 : 0 : }
420 : :
421 : : /* Option 2: Otherwise, if any PQ KEM Groups can be negotiated in 2-RTT's select that one. This ensures that
422 : : * clients who offer PQ (and presumably therefore have concerns about quantum computing impacting the long term
423 : : * confidentiality of their data), have their choice to offer PQ respected, even if they predict the server-side
424 : : * supports a different PQ KeyShare algorithms. This ensures clients with PQ support are never downgraded to non-PQ
425 : : * algorithms. */
426 [ - + ]: 5397 : if (server_kem_group != NULL) {
427 : : /* Null out any available ECC curves so that they won't be sent in the ClientHelloRetry */
428 : 0 : conn->kex_params.server_ecc_evp_params.negotiated_curve = NULL;
429 [ # # ]: 0 : POSIX_GUARD(s2n_set_hello_retry_required(conn));
430 : 0 : return S2N_SUCCESS;
431 : 0 : }
432 : :
433 : : /* Check if there are any strongly preferred ECC groups worth performing a 2-RTT upgrade for.
434 : : * This check is performed after PQ negotiation to ensure PQ-capable clients are never
435 : : * downgraded to a classical group due to a strongly preferred ECC curve. */
436 : 5397 : const struct s2n_ecc_named_curve *strongly_preferred_curve = NULL;
437 : 5397 : bool matched_strongly_preferred_iana = false;
438 : 5397 : bool need_hrr_for_strongly_preferred_group = false;
439 : :
440 [ + + ][ + + ]: 5405 : for (size_t i = 0; policy->strongly_preferred_groups != NULL && i < policy->strongly_preferred_groups->count && !matched_strongly_preferred_iana; i++) {
[ + - ]
441 : 8 : uint16_t strongly_preferred_iana = policy->strongly_preferred_groups->iana_ids[i];
442 : :
443 [ + - ][ + + ]: 16 : for (int j = 0; j < S2N_ECC_EVP_SUPPORTED_CURVES_COUNT && !matched_strongly_preferred_iana; j++) {
444 : 8 : const struct s2n_ecc_named_curve *mutually_supported_curve = conn->kex_params.mutually_supported_curves[j];
445 [ - + ]: 8 : if (mutually_supported_curve == NULL) {
446 : 0 : break; /* Reached end of mutually supported ECC curves */
447 : 0 : }
448 [ + - ]: 8 : if (strongly_preferred_iana == mutually_supported_curve->iana_id) {
449 : 8 : matched_strongly_preferred_iana = true;
450 : 8 : strongly_preferred_curve = mutually_supported_curve;
451 : :
452 : : /* Check if we can negotiate our strongly preferred ECC Curve in 1-RTT */
453 [ + - ][ + + ]: 8 : if (client_curve != NULL && (strongly_preferred_iana == client_curve->iana_id)) {
454 : 4 : need_hrr_for_strongly_preferred_group = false;
455 : 4 : } else {
456 : 4 : need_hrr_for_strongly_preferred_group = true;
457 : 4 : }
458 : 8 : }
459 : 8 : }
460 : 8 : }
461 : :
462 : : /* Option 3: Perform a 2-RTT handshake if there is a strongly-preferred ECC group that requires it. */
463 [ + + ][ + + ]: 5397 : if (matched_strongly_preferred_iana && need_hrr_for_strongly_preferred_group) {
464 : 4 : conn->kex_params.server_kem_group_params.kem_group = NULL;
465 : 4 : conn->kex_params.server_ecc_evp_params.negotiated_curve = strongly_preferred_curve;
466 [ - + ]: 4 : POSIX_GUARD(s2n_set_hello_retry_required(conn));
467 : 4 : return S2N_SUCCESS;
468 : 4 : }
469 : :
470 : : /* Option 4: Otherwise, if there is a mutually supported classical ECDHE-only group can be negotiated in 1-RTT, select that one */
471 [ + + ]: 5393 : if (client_curve) {
472 : 4745 : conn->kex_params.server_ecc_evp_params.negotiated_curve = conn->kex_params.client_ecc_evp_params.negotiated_curve;
473 : 4745 : conn->kex_params.server_kem_group_params.kem_group = NULL;
474 : 4745 : conn->kex_params.server_kem_group_params.ecc_params.negotiated_curve = NULL;
475 : 4745 : conn->kex_params.server_kem_group_params.kem_params.kem = NULL;
476 : 4745 : return S2N_SUCCESS;
477 : 4745 : }
478 : :
479 : : /* Option 5: Server and client have at least 1 mutually supported group, but the client did not send key shares for
480 : : * any of them. Send a HelloRetryRequest indicating the server's preference. */
481 [ - + ]: 648 : POSIX_GUARD(s2n_set_hello_retry_required(conn));
482 : 648 : return S2N_SUCCESS;
483 : 648 : }
484 : :
485 : : /* Old-style extension functions -- remove after extensions refactor is complete */
486 : :
487 : : /*
488 : : * Calculate the data length for Server Key Share extension
489 : : * based on negotiated_curve selected in server_ecc_evp_params.
490 : : *
491 : : * Retry requests have a different key share format,
492 : : * https://tools.ietf.org/html/rfc8446#section-4.2.8
493 : : *
494 : : * This functions does not error, but s2n_extensions_server_key_share_send() would
495 : : */
496 : : int s2n_extensions_server_key_share_send_size(struct s2n_connection *conn)
497 : 11 : {
498 : 11 : const struct s2n_ecc_named_curve *curve = conn->kex_params.server_ecc_evp_params.negotiated_curve;
499 : 11 : int key_share_size = S2N_SIZE_OF_EXTENSION_TYPE
500 : 11 : + S2N_SIZE_OF_EXTENSION_DATA_SIZE
501 : 11 : + S2N_SIZE_OF_NAMED_GROUP;
502 : :
503 : : /* If this is a KeyShareHelloRetryRequest we don't include the share size */
504 [ + + ]: 11 : if (s2n_is_hello_retry_message(conn)) {
505 : 3 : return key_share_size;
506 : 3 : }
507 : :
508 [ + + ]: 8 : if (curve == NULL) {
509 : 2 : return 0;
510 : 2 : }
511 : :
512 : : /* If this is a full KeyShareEntry, include the share size */
513 : 6 : key_share_size += (S2N_SIZE_OF_KEY_SHARE_SIZE + curve->share_size);
514 : :
515 : 6 : return key_share_size;
516 : 8 : }
517 : :
518 : : /*
519 : : * Sends Key Share extension in Server Hello.
520 : : *
521 : : * Expects negotiated_curve to be set and generates a ephemeral key for key sharing
522 : : */
523 : : int s2n_extensions_server_key_share_send(struct s2n_connection *conn, struct s2n_stuffer *out)
524 : 1 : {
525 : 1 : return s2n_extension_send(&s2n_server_key_share_extension, conn, out);
526 : 1 : }
527 : :
528 : : /*
529 : : * Client receives a Server Hello key share.
530 : : *
531 : : * If the curve is supported, conn->kex_params.server_ecc_evp_params will be set.
532 : : */
533 : : int s2n_extensions_server_key_share_recv(struct s2n_connection *conn, struct s2n_stuffer *extension)
534 : 1 : {
535 : 1 : return s2n_extension_recv(&s2n_server_key_share_extension, conn, extension);
536 : 1 : }
|
