Branch data Line data Source code
1 : : /*
2 : : * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3 : : *
4 : : * Licensed under the Apache License, Version 2.0 (the "License").
5 : : * You may not use this file except in compliance with the License.
6 : : * A copy of the License is located at
7 : : *
8 : : * http://aws.amazon.com/apache2.0
9 : : *
10 : : * or in the "license" file accompanying this file. This file is distributed
11 : : * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12 : : * express or implied. See the License for the specific language governing
13 : : * permissions and limitations under the License.
14 : : */
15 : :
16 : : #include "tls/s2n_prf.h"
17 : :
18 : : #include <openssl/hmac.h>
19 : : #include <openssl/md5.h>
20 : : #include <openssl/sha.h>
21 : : #include <string.h>
22 : :
23 : : #include "crypto/s2n_fips.h"
24 : : #include "crypto/s2n_hash.h"
25 : : #include "crypto/s2n_hmac.h"
26 : : #include "crypto/s2n_prf_libcrypto.h"
27 : : #include "error/s2n_errno.h"
28 : : #include "stuffer/s2n_stuffer.h"
29 : : #include "tls/s2n_cipher_suites.h"
30 : : #include "tls/s2n_connection.h"
31 : : #include "tls/s2n_crypto_constants.h"
32 : : #include "tls/s2n_tls.h"
33 : : #include "utils/s2n_blob.h"
34 : : #include "utils/s2n_mem.h"
35 : : #include "utils/s2n_safety.h"
36 : :
37 : : /* The s2n p_hash implementation is abstracted to allow for separate implementations.
38 : : * Currently the only implementation uses s2n-tls's custom HMAC implementation.
39 : : */
40 : : struct s2n_p_hash_hmac {
41 : : int (*alloc)(struct s2n_prf_working_space *ws);
42 : : int (*init)(struct s2n_prf_working_space *ws, s2n_hmac_algorithm alg, struct s2n_blob *secret);
43 : : int (*update)(struct s2n_prf_working_space *ws, const void *data, uint32_t size);
44 : : int (*final)(struct s2n_prf_working_space *ws, void *digest, uint32_t size);
45 : : int (*reset)(struct s2n_prf_working_space *ws);
46 : : int (*cleanup)(struct s2n_prf_working_space *ws);
47 : : int (*free)(struct s2n_prf_working_space *ws);
48 : : };
49 : :
50 : : S2N_RESULT s2n_prf_get_digest_for_ems(struct s2n_connection *conn, struct s2n_blob *message,
51 : : s2n_hash_algorithm hash_alg, struct s2n_blob *output);
52 : : S2N_RESULT s2n_prf_tls_extended_master_secret(struct s2n_connection *conn,
53 : : struct s2n_blob *premaster_secret, struct s2n_blob *session_hash, struct s2n_blob *sha1_hash);
54 : :
55 : : S2N_RESULT s2n_key_material_init(struct s2n_key_material *key_material, struct s2n_connection *conn)
56 : 33378 : {
57 [ # # ][ - + ]: 33378 : RESULT_ENSURE_REF(key_material);
58 [ # # ][ - + ]: 33378 : RESULT_ENSURE_REF(conn);
59 [ - + ][ # # ]: 33378 : RESULT_ENSURE_REF(conn->secure);
60 [ - + ][ # # ]: 33378 : RESULT_ENSURE_REF(conn->secure->cipher_suite);
61 [ - + ][ # # ]: 33378 : RESULT_ENSURE_REF(conn->secure->cipher_suite->record_alg);
62 : 33378 : const struct s2n_cipher *cipher = conn->secure->cipher_suite->record_alg->cipher;
63 [ - + ][ # # ]: 33378 : RESULT_ENSURE_REF(cipher);
64 : :
65 : 33378 : uint8_t mac_size = 0;
66 : 33378 : uint32_t key_size = 0;
67 : 33378 : uint32_t iv_size = 0;
68 : :
69 : : /* MAC size */
70 [ + + ]: 33378 : if (cipher->type == S2N_COMPOSITE) {
71 : 29514 : mac_size = cipher->io.comp.mac_key_size;
72 : 29514 : } else {
73 [ - + ]: 3864 : RESULT_GUARD_POSIX(s2n_hmac_digest_size(conn->secure->cipher_suite->record_alg->hmac_alg, &mac_size));
74 : 3864 : }
75 : :
76 : : /* KEY size */
77 : 33378 : key_size = cipher->key_material_size;
78 : :
79 : : /* Only AEAD ciphers have implicit IVs for TLS >= 1.1 */
80 [ + + ][ + + ]: 33378 : if (conn->actual_protocol_version <= S2N_TLS10 || cipher->type == S2N_AEAD) {
81 : : /* IV size */
82 : 32508 : switch (cipher->type) {
83 [ + + ]: 3409 : case S2N_AEAD:
84 : 3409 : iv_size = cipher->io.aead.fixed_iv_size;
85 : 3409 : break;
86 [ + + ]: 237 : case S2N_CBC:
87 : 237 : iv_size = cipher->io.cbc.block_size;
88 : 237 : break;
89 [ + + ]: 28862 : case S2N_COMPOSITE:
90 : 28862 : iv_size = cipher->io.comp.block_size;
91 : 28862 : break;
92 : : /* No-op for stream ciphers */
93 [ - + ]: 0 : default:
94 : 0 : break;
95 : 32508 : }
96 : 32508 : }
97 : :
98 : 33378 : struct s2n_stuffer key_material_stuffer = { 0 };
99 : 33378 : struct s2n_blob key_material_blob = { 0 };
100 [ - + ]: 33378 : RESULT_GUARD_POSIX(s2n_blob_init(&key_material_blob, key_material->key_block, sizeof(key_material->key_block)));
101 [ - + ]: 33378 : RESULT_GUARD_POSIX(s2n_stuffer_init_written(&key_material_stuffer, &key_material_blob));
102 : :
103 : : /* initialize key_material blobs; incrementing ptr to point to the next slice of memory */
104 : 33378 : uint8_t *ptr = NULL;
105 : : /* MAC */
106 : 33378 : ptr = s2n_stuffer_raw_read(&key_material_stuffer, mac_size);
107 [ - + ][ # # ]: 33378 : RESULT_ENSURE_REF(ptr);
108 [ - + ]: 33378 : RESULT_GUARD_POSIX(s2n_blob_init(&key_material->client_mac, ptr, mac_size));
109 : :
110 : 33378 : ptr = s2n_stuffer_raw_read(&key_material_stuffer, mac_size);
111 [ - + ][ # # ]: 33378 : RESULT_ENSURE_REF(ptr);
112 [ - + ]: 33378 : RESULT_GUARD_POSIX(s2n_blob_init(&key_material->server_mac, ptr, mac_size));
113 : :
114 : : /* KEY */
115 : 33378 : ptr = s2n_stuffer_raw_read(&key_material_stuffer, key_size);
116 [ - + ][ # # ]: 33378 : RESULT_ENSURE_REF(ptr);
117 [ - + ]: 33378 : RESULT_GUARD_POSIX(s2n_blob_init(&key_material->client_key, ptr, key_size));
118 : :
119 : 33378 : ptr = s2n_stuffer_raw_read(&key_material_stuffer, key_size);
120 [ - + ][ # # ]: 33378 : RESULT_ENSURE_REF(ptr);
121 [ - + ]: 33378 : RESULT_GUARD_POSIX(s2n_blob_init(&key_material->server_key, ptr, key_size));
122 : :
123 : : /* IV */
124 : 33378 : ptr = s2n_stuffer_raw_read(&key_material_stuffer, iv_size);
125 [ - + ][ # # ]: 33378 : RESULT_ENSURE_REF(ptr);
126 [ - + ]: 33378 : RESULT_GUARD_POSIX(s2n_blob_init(&key_material->client_iv, ptr, iv_size));
127 : :
128 : 33378 : ptr = s2n_stuffer_raw_read(&key_material_stuffer, iv_size);
129 [ - + ][ # # ]: 33378 : RESULT_ENSURE_REF(ptr);
130 [ - + ]: 33378 : RESULT_GUARD_POSIX(s2n_blob_init(&key_material->server_iv, ptr, iv_size));
131 : :
132 : 33378 : return S2N_RESULT_OK;
133 : 33378 : }
134 : :
135 : : /* SSLv3 PRF uses MD5 and SHA-1 in a custom hash-based construction (not
136 : : * HMAC). The use of weak hash algorithms is inherent to the SSLv3 protocol
137 : : * specification. SSLv3 is disabled by default and not recommended.
138 : : */
139 : : static int s2n_prf_sslv3(struct s2n_connection *conn, struct s2n_blob *secret, struct s2n_blob *seed_a,
140 : : struct s2n_blob *seed_b, struct s2n_blob *seed_c, struct s2n_blob *out)
141 : 391 : {
142 [ # # ][ - + ]: 391 : POSIX_ENSURE_REF(conn);
143 [ # # ][ - + ]: 391 : POSIX_ENSURE_REF(conn->handshake.hashes);
144 : 391 : struct s2n_hash_state *workspace = &conn->handshake.hashes->hash_workspace;
145 : :
146 : 391 : uint32_t outputlen = out->size;
147 : 391 : uint8_t *output = out->data;
148 : 391 : uint8_t iteration = 1;
149 : :
150 : 391 : uint8_t md5_digest[MD5_DIGEST_LENGTH] = { 0 }, sha_digest[SHA_DIGEST_LENGTH] = { 0 };
151 : :
152 : 391 : uint8_t A = 'A';
153 [ + + ]: 2936 : while (outputlen) {
154 : 2545 : struct s2n_hash_state *sha1 = workspace;
155 [ - + ]: 2545 : POSIX_GUARD(s2n_hash_reset(sha1));
156 [ - + ]: 2545 : POSIX_GUARD(s2n_hash_init(sha1, S2N_HASH_SHA1));
157 : :
158 [ + + ]: 14495 : for (int i = 0; i < iteration; i++) {
159 [ - + ]: 11950 : POSIX_GUARD(s2n_hash_update(sha1, &A, 1));
160 : 11950 : }
161 : :
162 [ - + ]: 2545 : POSIX_GUARD(s2n_hash_update(sha1, secret->data, secret->size));
163 [ - + ]: 2545 : POSIX_GUARD(s2n_hash_update(sha1, seed_a->data, seed_a->size));
164 : :
165 [ + - ]: 2545 : if (seed_b) {
166 [ - + ]: 2545 : POSIX_GUARD(s2n_hash_update(sha1, seed_b->data, seed_b->size));
167 [ - + ]: 2545 : if (seed_c) {
168 [ # # ]: 0 : POSIX_GUARD(s2n_hash_update(sha1, seed_c->data, seed_c->size));
169 : 0 : }
170 : 2545 : }
171 : :
172 [ - + ]: 2545 : POSIX_GUARD(s2n_hash_digest(sha1, sha_digest, sizeof(sha_digest)));
173 : :
174 : 2545 : struct s2n_hash_state *md5 = workspace;
175 [ - + ]: 2545 : POSIX_GUARD(s2n_hash_reset(md5));
176 [ - + ]: 2545 : POSIX_GUARD(s2n_hash_init(md5, S2N_HASH_MD5));
177 [ - + ]: 2545 : POSIX_GUARD(s2n_hash_update(md5, secret->data, secret->size));
178 [ - + ]: 2545 : POSIX_GUARD(s2n_hash_update(md5, sha_digest, sizeof(sha_digest)));
179 [ - + ]: 2545 : POSIX_GUARD(s2n_hash_digest(md5, md5_digest, sizeof(md5_digest)));
180 : :
181 [ - + ]: 2545 : uint32_t bytes_to_copy = S2N_MIN(outputlen, sizeof(md5_digest));
182 : :
183 [ - + ][ # # ]: 2545 : POSIX_CHECKED_MEMCPY(output, md5_digest, bytes_to_copy);
[ + - ]
184 : :
185 : 2545 : outputlen -= bytes_to_copy;
186 : 2545 : output += bytes_to_copy;
187 : :
188 : : /* Increment the letter */
189 : 2545 : A++;
190 : 2545 : iteration++;
191 : 2545 : }
192 : :
193 : 391 : return 0;
194 : 391 : }
195 : :
196 : : static int s2n_hmac_p_hash_new(struct s2n_prf_working_space *ws)
197 : 127304 : {
198 [ - + ]: 127304 : POSIX_GUARD(s2n_hmac_new(&ws->p_hash.s2n_hmac));
199 : 127304 : return s2n_hmac_init(&ws->p_hash.s2n_hmac, S2N_HMAC_NONE, NULL, 0);
200 : 127304 : }
201 : :
202 : : static int s2n_hmac_p_hash_init(struct s2n_prf_working_space *ws, s2n_hmac_algorithm alg, struct s2n_blob *secret)
203 : 16197 : {
204 : 16197 : return s2n_hmac_init(&ws->p_hash.s2n_hmac, alg, secret->data, secret->size);
205 : 16197 : }
206 : :
207 : : static int s2n_hmac_p_hash_update(struct s2n_prf_working_space *ws, const void *data, uint32_t size)
208 : 241472 : {
209 : 241472 : return s2n_hmac_update(&ws->p_hash.s2n_hmac, data, size);
210 : 241472 : }
211 : :
212 : : static int s2n_hmac_p_hash_digest(struct s2n_prf_working_space *ws, void *digest, uint32_t size)
213 : 102289 : {
214 : 102289 : return s2n_hmac_digest(&ws->p_hash.s2n_hmac, digest, size);
215 : 102289 : }
216 : :
217 : : static int s2n_hmac_p_hash_reset(struct s2n_prf_working_space *ws)
218 : 3524644 : {
219 : : /* If we actually initialized s2n_hmac, wipe it.
220 : : * A valid, initialized s2n_hmac_state will have a valid block size.
221 : : */
222 [ + - ]: 3524644 : if (ws->p_hash.s2n_hmac.hash_block_size != 0) {
223 : 3524644 : return s2n_hmac_reset(&ws->p_hash.s2n_hmac);
224 : 3524644 : }
225 : 0 : return S2N_SUCCESS;
226 : 3524644 : }
227 : :
228 : : static int s2n_hmac_p_hash_cleanup(struct s2n_prf_working_space *ws)
229 : 16197 : {
230 : 16197 : return s2n_hmac_p_hash_reset(ws);
231 : 16197 : }
232 : :
233 : : static int s2n_hmac_p_hash_free(struct s2n_prf_working_space *ws)
234 : 127304 : {
235 : 127304 : return s2n_hmac_free(&ws->p_hash.s2n_hmac);
236 : 127304 : }
237 : :
238 : : static const struct s2n_p_hash_hmac s2n_internal_p_hash_hmac = {
239 : : .alloc = &s2n_hmac_p_hash_new,
240 : : .init = &s2n_hmac_p_hash_init,
241 : : .update = &s2n_hmac_p_hash_update,
242 : : .final = &s2n_hmac_p_hash_digest,
243 : : .reset = &s2n_hmac_p_hash_reset,
244 : : .cleanup = &s2n_hmac_p_hash_cleanup,
245 : : .free = &s2n_hmac_p_hash_free,
246 : : };
247 : :
248 : : /*
249 : : * For now, use the internal s2n-tls hmac abstraction.
250 : : * However, that is a custom implementation of hmac built on hashes.
251 : : * Ideally we should stop using our custom implementation here and switch
252 : : * to using a libcrypto implementation. Unfortunately, what each libcrypto
253 : : * can support varies a lot for HMACs.
254 : : *
255 : : * For historical reference, there used to be two other hmac implementations:
256 : : * https://github.com/aws/s2n-tls/blob/711ee0df658cd7c44088cf7a1b20a9f3cf5296d6/tls/s2n_prf.c#L174-L337
257 : : * Both implementations have compatibility issues with one or more libcryptos.
258 : : */
259 : : const struct s2n_p_hash_hmac *s2n_get_hmac_implementation()
260 : 3693160 : {
261 : 3693160 : return &s2n_internal_p_hash_hmac;
262 : 3693160 : }
263 : :
264 : : static int s2n_p_hash(struct s2n_prf_working_space *ws, s2n_hmac_algorithm alg, struct s2n_blob *secret, struct s2n_blob *label,
265 : : struct s2n_blob *seed_a, struct s2n_blob *seed_b, struct s2n_blob *seed_c, struct s2n_blob *out)
266 : 16197 : {
267 : 16197 : uint8_t digest_size = 0;
268 [ - + ]: 16197 : POSIX_GUARD(s2n_hmac_digest_size(alg, &digest_size));
269 : :
270 : 16197 : const struct s2n_p_hash_hmac *hmac = s2n_get_hmac_implementation();
271 [ # # ][ - + ]: 16197 : POSIX_ENSURE_REF(hmac);
272 : :
273 : : /* First compute hmac(secret + A(0)) */
274 [ - + ]: 16197 : POSIX_GUARD(hmac->init(ws, alg, secret));
275 [ - + ]: 16197 : POSIX_GUARD(hmac->update(ws, label->data, label->size));
276 [ - + ]: 16197 : POSIX_GUARD(hmac->update(ws, seed_a->data, seed_a->size));
277 : :
278 [ + + ]: 16197 : if (seed_b) {
279 [ - + ]: 6890 : POSIX_GUARD(hmac->update(ws, seed_b->data, seed_b->size));
280 [ + + ]: 6890 : if (seed_c) {
281 [ - + ]: 5 : POSIX_GUARD(hmac->update(ws, seed_c->data, seed_c->size));
282 : 5 : }
283 : 6890 : }
284 [ - + ]: 16197 : POSIX_GUARD(hmac->final(ws, ws->digest0, digest_size));
285 : :
286 : 16197 : uint32_t outputlen = out->size;
287 : 16197 : uint8_t *output = out->data;
288 : :
289 [ + + ]: 59243 : while (outputlen) {
290 : : /* Now compute hmac(secret + A(N - 1) + seed) */
291 [ - + ]: 43046 : POSIX_GUARD(hmac->reset(ws));
292 [ - + ]: 43046 : POSIX_GUARD(hmac->update(ws, ws->digest0, digest_size));
293 : :
294 : : /* Add the label + seed and compute this round's A */
295 [ - + ]: 43046 : POSIX_GUARD(hmac->update(ws, label->data, label->size));
296 [ - + ]: 43046 : POSIX_GUARD(hmac->update(ws, seed_a->data, seed_a->size));
297 [ + + ]: 43046 : if (seed_b) {
298 [ - + ]: 29981 : POSIX_GUARD(hmac->update(ws, seed_b->data, seed_b->size));
299 [ + + ]: 29981 : if (seed_c) {
300 [ - + ]: 18 : POSIX_GUARD(hmac->update(ws, seed_c->data, seed_c->size));
301 : 18 : }
302 : 29981 : }
303 : :
304 [ - + ]: 43046 : POSIX_GUARD(hmac->final(ws, ws->digest1, digest_size));
305 : :
306 [ + + ]: 43046 : uint32_t bytes_to_xor = S2N_MIN(outputlen, digest_size);
307 : :
308 [ + + ]: 1112214 : for (size_t i = 0; i < bytes_to_xor; i++) {
309 : 1069168 : *output ^= ws->digest1[i];
310 : 1069168 : output++;
311 : 1069168 : outputlen--;
312 : 1069168 : }
313 : :
314 : : /* Stash a digest of A(N), in A(N), for the next round */
315 [ - + ]: 43046 : POSIX_GUARD(hmac->reset(ws));
316 [ - + ]: 43046 : POSIX_GUARD(hmac->update(ws, ws->digest0, digest_size));
317 [ - + ]: 43046 : POSIX_GUARD(hmac->final(ws, ws->digest0, digest_size));
318 : 43046 : }
319 : :
320 [ - + ]: 16197 : POSIX_GUARD(hmac->cleanup(ws));
321 : :
322 : 16197 : return 0;
323 : 16197 : }
324 : :
325 : : S2N_RESULT s2n_prf_new(struct s2n_connection *conn)
326 : 127305 : {
327 [ + + ][ + - ]: 127305 : RESULT_ENSURE_REF(conn);
328 [ # # ][ - + ]: 127304 : RESULT_ENSURE_EQ(conn->prf_space, NULL);
329 : :
330 : 127304 : DEFER_CLEANUP(struct s2n_blob mem = { 0 }, s2n_free);
331 [ - + ]: 127304 : RESULT_GUARD_POSIX(s2n_realloc(&mem, sizeof(struct s2n_prf_working_space)));
332 [ - + ]: 127304 : RESULT_GUARD_POSIX(s2n_blob_zero(&mem));
333 : 127304 : conn->prf_space = (struct s2n_prf_working_space *) (void *) mem.data;
334 : 127304 : ZERO_TO_DISABLE_DEFER_CLEANUP(mem);
335 : :
336 : : /* Allocate the hmac state */
337 : 127304 : const struct s2n_p_hash_hmac *hmac_impl = s2n_get_hmac_implementation();
338 [ # # ][ - + ]: 127304 : RESULT_ENSURE_REF(hmac_impl);
339 [ - + ]: 127304 : RESULT_GUARD_POSIX(hmac_impl->alloc(conn->prf_space));
340 : 127304 : return S2N_RESULT_OK;
341 : 127304 : }
342 : :
343 : : S2N_RESULT s2n_prf_wipe(struct s2n_connection *conn)
344 : 3422357 : {
345 [ + + ][ + - ]: 3422357 : RESULT_ENSURE_REF(conn);
346 [ + - ][ + + ]: 3422356 : RESULT_ENSURE_REF(conn->prf_space);
347 : :
348 : 3422355 : const struct s2n_p_hash_hmac *hmac_impl = s2n_get_hmac_implementation();
349 [ - + ][ # # ]: 3422355 : RESULT_ENSURE_REF(hmac_impl);
350 [ - + ]: 3422355 : RESULT_GUARD_POSIX(hmac_impl->reset(conn->prf_space));
351 : :
352 : 3422355 : return S2N_RESULT_OK;
353 : 3422355 : }
354 : :
355 : : S2N_RESULT s2n_prf_free(struct s2n_connection *conn)
356 : 127332 : {
357 [ + + ][ + - ]: 127332 : RESULT_ENSURE_REF(conn);
358 [ + + ]: 127331 : if (conn->prf_space == NULL) {
359 : 27 : return S2N_RESULT_OK;
360 : 27 : }
361 : :
362 : 127304 : const struct s2n_p_hash_hmac *hmac_impl = s2n_get_hmac_implementation();
363 [ # # ][ - + ]: 127304 : RESULT_ENSURE_REF(hmac_impl);
364 [ - + ]: 127304 : RESULT_GUARD_POSIX(hmac_impl->free(conn->prf_space));
365 : :
366 [ - + ]: 127304 : RESULT_GUARD_POSIX(s2n_free_object((uint8_t **) &conn->prf_space, sizeof(struct s2n_prf_working_space)));
367 : 127304 : return S2N_RESULT_OK;
368 : 127304 : }
369 : :
370 : : S2N_RESULT s2n_prf_custom(struct s2n_connection *conn, struct s2n_blob *secret, struct s2n_blob *label,
371 : : struct s2n_blob *seed_a, struct s2n_blob *seed_b, struct s2n_blob *seed_c, struct s2n_blob *out)
372 : 14797 : {
373 : : /* We zero the out blob because p_hash works by XOR'ing with the existing
374 : : * buffer. This is a little convoluted but means we can avoid dynamic memory
375 : : * allocation. When we call p_hash once (in the TLS1.2 case) it will produce
376 : : * the right values. When we call it twice in the regular case, the two
377 : : * outputs will be XORd just ass the TLS 1.0 and 1.1 RFCs require.
378 : : */
379 [ - + ]: 14797 : RESULT_GUARD_POSIX(s2n_blob_zero(out));
380 : :
381 [ + + ]: 14797 : if (conn->actual_protocol_version == S2N_TLS12) {
382 [ - + ]: 13397 : RESULT_GUARD_POSIX(s2n_p_hash(conn->prf_space, conn->secure->cipher_suite->prf_alg, secret, label, seed_a,
383 : 13397 : seed_b, seed_c, out));
384 : 13397 : return S2N_RESULT_OK;
385 : 13397 : }
386 : :
387 : 1400 : struct s2n_blob half_secret = { 0 };
388 [ - + ]: 1400 : RESULT_GUARD_POSIX(s2n_blob_init(&half_secret, secret->data, (secret->size + 1) / 2));
389 : :
390 [ - + ]: 1400 : RESULT_GUARD_POSIX(s2n_p_hash(conn->prf_space, S2N_HMAC_MD5, &half_secret, label, seed_a, seed_b, seed_c, out));
391 : 1400 : half_secret.data += secret->size - half_secret.size;
392 [ - + ]: 1400 : RESULT_GUARD_POSIX(s2n_p_hash(conn->prf_space, S2N_HMAC_SHA1, &half_secret, label, seed_a, seed_b, seed_c, out));
393 : :
394 : 1400 : return S2N_RESULT_OK;
395 : 1400 : }
396 : :
397 : : int s2n_prf(struct s2n_connection *conn, struct s2n_blob *secret, struct s2n_blob *label, struct s2n_blob *seed_a,
398 : : struct s2n_blob *seed_b, struct s2n_blob *seed_c, struct s2n_blob *out)
399 : 15195 : {
400 [ + - ][ + + ]: 15195 : POSIX_ENSURE_REF(conn);
401 [ - + ][ # # ]: 15194 : POSIX_ENSURE_REF(conn->secure);
402 [ - + ][ # # ]: 15194 : POSIX_ENSURE_REF(conn->secure->cipher_suite);
403 [ + + ][ + - ]: 15194 : POSIX_ENSURE_REF(conn->prf_space);
404 [ + - ][ + + ]: 15193 : POSIX_ENSURE_REF(secret);
405 [ + + ][ + - ]: 15192 : POSIX_ENSURE_REF(label);
406 [ + + ][ + - ]: 15191 : POSIX_ENSURE_REF(out);
407 : :
408 : : /* seed_a is always required, seed_b is optional, if seed_c is provided seed_b must also be provided */
409 [ + + ][ + - ]: 15190 : POSIX_ENSURE(seed_a != NULL, S2N_ERR_PRF_INVALID_SEED);
410 [ + - ][ + + ]: 15189 : POSIX_ENSURE(S2N_IMPLIES(seed_c != NULL, seed_b != NULL), S2N_ERR_PRF_INVALID_SEED);
[ + + ]
411 : :
412 [ + + ]: 15188 : if (conn->actual_protocol_version == S2N_SSLv3) {
413 [ - + ]: 391 : POSIX_GUARD(s2n_prf_sslv3(conn, secret, seed_a, seed_b, seed_c, out));
414 : 391 : return S2N_SUCCESS;
415 : 391 : }
416 : :
417 : : /* By default, s2n-tls uses a custom PRF implementation. When operating in FIPS mode, the
418 : : * FIPS-validated libcrypto implementation is used instead, if an implementation is provided.
419 : : */
420 [ - + ]: 14797 : if (s2n_is_in_fips_mode()) {
421 [ # # ]: 0 : POSIX_GUARD_RESULT(s2n_prf_libcrypto(conn, secret, label, seed_a, seed_b, seed_c, out));
422 : 0 : return S2N_SUCCESS;
423 : 0 : }
424 : :
425 [ - + ]: 14797 : POSIX_GUARD_RESULT(s2n_prf_custom(conn, secret, label, seed_a, seed_b, seed_c, out));
426 : :
427 : 14797 : return S2N_SUCCESS;
428 : 14797 : }
429 : :
430 : : int s2n_prf_tls_master_secret(struct s2n_connection *conn, struct s2n_blob *premaster_secret)
431 : 35 : {
432 [ - + ][ # # ]: 35 : POSIX_ENSURE_REF(conn);
433 : :
434 : 35 : struct s2n_blob client_random = { 0 };
435 [ - + ]: 35 : POSIX_GUARD(s2n_blob_init(&client_random, conn->client_hello.random, sizeof(conn->client_hello.random)));
436 : 35 : struct s2n_blob server_random = { 0 };
437 [ - + ]: 35 : POSIX_GUARD(s2n_blob_init(&server_random, conn->handshake_params.server_random, sizeof(conn->handshake_params.server_random)));
438 : 35 : struct s2n_blob master_secret = { 0 };
439 [ - + ]: 35 : POSIX_GUARD(s2n_blob_init(&master_secret, conn->secrets.version.tls12.master_secret, sizeof(conn->secrets.version.tls12.master_secret)));
440 : :
441 : 35 : uint8_t master_secret_label[] = "master secret";
442 : 35 : struct s2n_blob label = { 0 };
443 [ - + ]: 35 : POSIX_GUARD(s2n_blob_init(&label, master_secret_label, sizeof(master_secret_label) - 1));
444 : :
445 : 35 : return s2n_prf(conn, premaster_secret, &label, &client_random, &server_random, NULL, &master_secret);
446 : 35 : }
447 : :
448 : : int s2n_prf_hybrid_master_secret(struct s2n_connection *conn, struct s2n_blob *premaster_secret)
449 : 0 : {
450 [ # # ][ # # ]: 0 : POSIX_ENSURE_REF(conn);
451 : :
452 : 0 : struct s2n_blob client_random = { 0 };
453 [ # # ]: 0 : POSIX_GUARD(s2n_blob_init(&client_random, conn->client_hello.random, sizeof(conn->client_hello.random)));
454 : 0 : struct s2n_blob server_random = { 0 };
455 [ # # ]: 0 : POSIX_GUARD(s2n_blob_init(&server_random, conn->handshake_params.server_random, sizeof(conn->handshake_params.server_random)));
456 : 0 : struct s2n_blob master_secret = { 0 };
457 [ # # ]: 0 : POSIX_GUARD(s2n_blob_init(&master_secret, conn->secrets.version.tls12.master_secret, sizeof(conn->secrets.version.tls12.master_secret)));
458 : :
459 : 0 : uint8_t master_secret_label[] = "hybrid master secret";
460 : 0 : struct s2n_blob label = { 0 };
461 [ # # ]: 0 : POSIX_GUARD(s2n_blob_init(&label, master_secret_label, sizeof(master_secret_label) - 1));
462 : :
463 : 0 : return s2n_prf(conn, premaster_secret, &label, &client_random, &server_random, &conn->kex_params.client_key_exchange_message, &master_secret);
464 : 0 : }
465 : :
466 : : int s2n_prf_calculate_master_secret(struct s2n_connection *conn, struct s2n_blob *premaster_secret)
467 : 4528 : {
468 [ - + ][ # # ]: 4528 : POSIX_ENSURE_REF(conn);
469 [ - + ][ # # ]: 4528 : POSIX_ENSURE_REF(conn->secure);
470 : :
471 [ + + ][ + - ]: 4528 : POSIX_ENSURE_EQ(s2n_conn_get_current_message_type(conn), CLIENT_KEY);
472 : :
473 [ + + ]: 4527 : if (!conn->ems_negotiated) {
474 [ - + ]: 30 : POSIX_GUARD(s2n_prf_tls_master_secret(conn, premaster_secret));
475 : 30 : return S2N_SUCCESS;
476 : 30 : }
477 : :
478 : : /* Only the client writes the Client Key Exchange message */
479 [ + + ]: 4497 : if (conn->mode == S2N_CLIENT) {
480 [ - + ]: 2234 : POSIX_GUARD(s2n_handshake_finish_header(&conn->handshake.io));
481 : 2234 : }
482 : 4497 : struct s2n_stuffer client_key_message = conn->handshake.io;
483 [ - + ]: 4497 : POSIX_GUARD(s2n_stuffer_reread(&client_key_message));
484 : 4497 : uint32_t client_key_message_size = s2n_stuffer_data_available(&client_key_message);
485 : 4497 : struct s2n_blob client_key_blob = { 0 };
486 [ - + ]: 4497 : POSIX_GUARD(s2n_blob_init(&client_key_blob, client_key_message.blob.data, client_key_message_size));
487 : :
488 : 4497 : uint8_t data[S2N_MAX_DIGEST_LEN] = { 0 };
489 : 4497 : struct s2n_blob digest = { 0 };
490 [ - + ]: 4497 : POSIX_GUARD(s2n_blob_init(&digest, data, sizeof(data)));
491 [ + + ]: 4497 : if (conn->actual_protocol_version < S2N_TLS12) {
492 : 541 : uint8_t sha1_data[S2N_MAX_DIGEST_LEN] = { 0 };
493 : 541 : struct s2n_blob sha1_digest = { 0 };
494 [ - + ]: 541 : POSIX_GUARD(s2n_blob_init(&sha1_digest, sha1_data, sizeof(sha1_data)));
495 [ - + ]: 541 : POSIX_GUARD_RESULT(s2n_prf_get_digest_for_ems(conn, &client_key_blob, S2N_HASH_MD5, &digest));
496 [ - + ]: 541 : POSIX_GUARD_RESULT(s2n_prf_get_digest_for_ems(conn, &client_key_blob, S2N_HASH_SHA1, &sha1_digest));
497 [ - + ]: 541 : POSIX_GUARD_RESULT(s2n_prf_tls_extended_master_secret(conn, premaster_secret, &digest, &sha1_digest));
498 : 3956 : } else {
499 : 3956 : s2n_hmac_algorithm prf_alg = conn->secure->cipher_suite->prf_alg;
500 : 3956 : s2n_hash_algorithm hash_alg = 0;
501 [ - + ]: 3956 : POSIX_GUARD(s2n_hmac_hash_alg(prf_alg, &hash_alg));
502 [ - + ]: 3956 : POSIX_GUARD_RESULT(s2n_prf_get_digest_for_ems(conn, &client_key_blob, hash_alg, &digest));
503 [ - + ]: 3956 : POSIX_GUARD_RESULT(s2n_prf_tls_extended_master_secret(conn, premaster_secret, &digest, NULL));
504 : 3956 : }
505 : 4497 : return S2N_SUCCESS;
506 : 4497 : }
507 : :
508 : : /**
509 : : *= https://www.rfc-editor.org/rfc/rfc7627#section-4
510 : : *# When the extended master secret extension is negotiated in a full
511 : : *# handshake, the "master_secret" is computed as
512 : : *#
513 : : *# master_secret = PRF(pre_master_secret, "extended master secret",
514 : : *# session_hash)
515 : : *# [0..47];
516 : : */
517 : : S2N_RESULT s2n_prf_tls_extended_master_secret(struct s2n_connection *conn, struct s2n_blob *premaster_secret, struct s2n_blob *session_hash, struct s2n_blob *sha1_hash)
518 : 4498 : {
519 [ - + ][ # # ]: 4498 : RESULT_ENSURE_REF(conn);
520 : :
521 : 4498 : struct s2n_blob extended_master_secret = { 0 };
522 [ - + ]: 4498 : RESULT_GUARD_POSIX(s2n_blob_init(&extended_master_secret, conn->secrets.version.tls12.master_secret, sizeof(conn->secrets.version.tls12.master_secret)));
523 : :
524 : 4498 : uint8_t extended_master_secret_label[] = "extended master secret";
525 : : /* Subtract one from the label size to remove the "\0" */
526 : 4498 : struct s2n_blob label = { 0 };
527 [ - + ]: 4498 : RESULT_GUARD_POSIX(s2n_blob_init(&label, extended_master_secret_label, sizeof(extended_master_secret_label) - 1));
528 : :
529 [ - + ]: 4498 : RESULT_GUARD_POSIX(s2n_prf(conn, premaster_secret, &label, session_hash, sha1_hash, NULL, &extended_master_secret));
530 : :
531 : 4498 : return S2N_RESULT_OK;
532 : 4498 : }
533 : :
534 : : S2N_RESULT s2n_prf_get_digest_for_ems(struct s2n_connection *conn, struct s2n_blob *message, s2n_hash_algorithm hash_alg, struct s2n_blob *output)
535 : 5039 : {
536 [ # # ][ - + ]: 5039 : RESULT_ENSURE_REF(conn);
537 [ # # ][ - + ]: 5039 : RESULT_ENSURE_REF(conn->handshake.hashes);
538 [ - + ][ # # ]: 5039 : RESULT_ENSURE_REF(message);
539 [ - + ][ # # ]: 5039 : RESULT_ENSURE_REF(output);
540 : :
541 : 5039 : struct s2n_hash_state *hash_state = &conn->handshake.hashes->hash_workspace;
542 [ - + ]: 5039 : RESULT_GUARD(s2n_handshake_copy_hash_state(conn, hash_alg, hash_state));
543 [ - + ]: 5039 : RESULT_GUARD_POSIX(s2n_hash_update(hash_state, message->data, message->size));
544 : :
545 : 5039 : uint8_t digest_size = 0;
546 [ - + ]: 5039 : RESULT_GUARD_POSIX(s2n_hash_digest_size(hash_alg, &digest_size));
547 [ - + ][ # # ]: 5039 : RESULT_ENSURE_GTE(output->size, digest_size);
548 [ - + ]: 5039 : RESULT_GUARD_POSIX(s2n_hash_digest(hash_state, output->data, digest_size));
549 : 5039 : output->size = digest_size;
550 : :
551 : 5039 : return S2N_RESULT_OK;
552 : 5039 : }
553 : :
554 : : static int s2n_prf_sslv3_finished(struct s2n_connection *conn, uint8_t prefix[4], struct s2n_hash_state *hash_workspace, uint8_t *out)
555 : 389 : {
556 [ - + ][ # # ]: 389 : POSIX_ENSURE_REF(conn);
557 [ - + ][ # # ]: 389 : POSIX_ENSURE_REF(conn->handshake.hashes);
558 : :
559 : 389 : uint8_t xorpad1[48] = { 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
560 : 389 : 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36 };
561 : 389 : uint8_t xorpad2[48] = { 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
562 : 389 : 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c };
563 : 389 : uint8_t *md5_digest = out;
564 : 389 : uint8_t *sha_digest = out + MD5_DIGEST_LENGTH;
565 : :
566 [ - + ]: 389 : POSIX_GUARD_RESULT(s2n_handshake_set_finished_len(conn, MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH));
567 : :
568 : 389 : struct s2n_hash_state *md5 = hash_workspace;
569 [ - + ]: 389 : POSIX_GUARD(s2n_hash_copy(md5, &conn->handshake.hashes->md5));
570 [ - + ]: 389 : POSIX_GUARD(s2n_hash_update(md5, prefix, 4));
571 [ - + ]: 389 : POSIX_GUARD(s2n_hash_update(md5, conn->secrets.version.tls12.master_secret, sizeof(conn->secrets.version.tls12.master_secret)));
572 [ - + ]: 389 : POSIX_GUARD(s2n_hash_update(md5, xorpad1, 48));
573 [ - + ]: 389 : POSIX_GUARD(s2n_hash_digest(md5, md5_digest, MD5_DIGEST_LENGTH));
574 [ - + ]: 389 : POSIX_GUARD(s2n_hash_reset(md5));
575 [ - + ]: 389 : POSIX_GUARD(s2n_hash_update(md5, conn->secrets.version.tls12.master_secret, sizeof(conn->secrets.version.tls12.master_secret)));
576 [ - + ]: 389 : POSIX_GUARD(s2n_hash_update(md5, xorpad2, 48));
577 [ - + ]: 389 : POSIX_GUARD(s2n_hash_update(md5, md5_digest, MD5_DIGEST_LENGTH));
578 [ - + ]: 389 : POSIX_GUARD(s2n_hash_digest(md5, md5_digest, MD5_DIGEST_LENGTH));
579 [ - + ]: 389 : POSIX_GUARD(s2n_hash_reset(md5));
580 : :
581 : 389 : struct s2n_hash_state *sha1 = hash_workspace;
582 [ - + ]: 389 : POSIX_GUARD(s2n_hash_copy(sha1, &conn->handshake.hashes->sha1));
583 [ - + ]: 389 : POSIX_GUARD(s2n_hash_update(sha1, prefix, 4));
584 [ - + ]: 389 : POSIX_GUARD(s2n_hash_update(sha1, conn->secrets.version.tls12.master_secret, sizeof(conn->secrets.version.tls12.master_secret)));
585 [ - + ]: 389 : POSIX_GUARD(s2n_hash_update(sha1, xorpad1, 40));
586 [ - + ]: 389 : POSIX_GUARD(s2n_hash_digest(sha1, sha_digest, SHA_DIGEST_LENGTH));
587 [ - + ]: 389 : POSIX_GUARD(s2n_hash_reset(sha1));
588 [ - + ]: 389 : POSIX_GUARD(s2n_hash_update(sha1, conn->secrets.version.tls12.master_secret, sizeof(conn->secrets.version.tls12.master_secret)));
589 [ - + ]: 389 : POSIX_GUARD(s2n_hash_update(sha1, xorpad2, 40));
590 [ - + ]: 389 : POSIX_GUARD(s2n_hash_update(sha1, sha_digest, SHA_DIGEST_LENGTH));
591 [ - + ]: 389 : POSIX_GUARD(s2n_hash_digest(sha1, sha_digest, SHA_DIGEST_LENGTH));
592 [ - + ]: 389 : POSIX_GUARD(s2n_hash_reset(sha1));
593 : :
594 : 389 : return 0;
595 : 389 : }
596 : :
597 : : static int s2n_prf_sslv3_client_finished(struct s2n_connection *conn)
598 : 194 : {
599 [ # # ][ - + ]: 194 : POSIX_ENSURE_REF(conn);
600 [ - + ][ # # ]: 194 : POSIX_ENSURE_REF(conn->handshake.hashes);
601 : :
602 : 194 : uint8_t prefix[4] = { 0x43, 0x4c, 0x4e, 0x54 };
603 : :
604 : 194 : return s2n_prf_sslv3_finished(conn, prefix, &conn->handshake.hashes->hash_workspace, conn->handshake.client_finished);
605 : 194 : }
606 : :
607 : : static int s2n_prf_sslv3_server_finished(struct s2n_connection *conn)
608 : 195 : {
609 [ - + ][ # # ]: 195 : POSIX_ENSURE_REF(conn);
610 [ - + ][ # # ]: 195 : POSIX_ENSURE_REF(conn->handshake.hashes);
611 : :
612 : 195 : uint8_t prefix[4] = { 0x53, 0x52, 0x56, 0x52 };
613 : :
614 : 195 : return s2n_prf_sslv3_finished(conn, prefix, &conn->handshake.hashes->hash_workspace, conn->handshake.server_finished);
615 : 195 : }
616 : :
617 : : int s2n_prf_client_finished(struct s2n_connection *conn)
618 : 3674 : {
619 [ - + ][ # # ]: 3674 : POSIX_ENSURE_REF(conn);
620 [ # # ][ - + ]: 3674 : POSIX_ENSURE_REF(conn->secure);
621 [ - + ][ # # ]: 3674 : POSIX_ENSURE_REF(conn->handshake.hashes);
622 : :
623 : 3674 : struct s2n_blob master_secret = { 0 };
624 : 3674 : struct s2n_blob md5 = { 0 };
625 : 3674 : struct s2n_blob sha = { 0 };
626 : 3674 : uint8_t md5_digest[MD5_DIGEST_LENGTH] = { 0 };
627 : 3674 : uint8_t sha_digest[SHA384_DIGEST_LENGTH] = { 0 };
628 : 3674 : uint8_t client_finished_label[] = "client finished";
629 : 3674 : struct s2n_blob client_finished = { 0 };
630 : 3674 : struct s2n_blob label = { 0 };
631 : :
632 [ + + ]: 3674 : if (conn->actual_protocol_version == S2N_SSLv3) {
633 : 194 : return s2n_prf_sslv3_client_finished(conn);
634 : 194 : }
635 : :
636 : 3480 : client_finished.data = conn->handshake.client_finished;
637 : 3480 : client_finished.size = S2N_TLS_FINISHED_LEN;
638 [ + + ]: 3480 : POSIX_GUARD_RESULT(s2n_handshake_set_finished_len(conn, client_finished.size));
639 : 3478 : label.data = client_finished_label;
640 : 3478 : label.size = sizeof(client_finished_label) - 1;
641 : :
642 : 3478 : master_secret.data = conn->secrets.version.tls12.master_secret;
643 : 3478 : master_secret.size = sizeof(conn->secrets.version.tls12.master_secret);
644 [ + + ]: 3478 : if (conn->actual_protocol_version == S2N_TLS12) {
645 : 3132 : switch (conn->secure->cipher_suite->prf_alg) {
646 [ + + ]: 2910 : case S2N_HMAC_SHA256:
647 [ - + ]: 2910 : POSIX_GUARD(s2n_hash_copy(&conn->handshake.hashes->hash_workspace, &conn->handshake.hashes->sha256));
648 [ - + ]: 2910 : POSIX_GUARD(s2n_hash_digest(&conn->handshake.hashes->hash_workspace, sha_digest, SHA256_DIGEST_LENGTH));
649 : 2910 : sha.size = SHA256_DIGEST_LENGTH;
650 : 2910 : break;
651 [ + + ]: 222 : case S2N_HMAC_SHA384:
652 [ - + ]: 222 : POSIX_GUARD(s2n_hash_copy(&conn->handshake.hashes->hash_workspace, &conn->handshake.hashes->sha384));
653 [ - + ]: 222 : POSIX_GUARD(s2n_hash_digest(&conn->handshake.hashes->hash_workspace, sha_digest, SHA384_DIGEST_LENGTH));
654 : 222 : sha.size = SHA384_DIGEST_LENGTH;
655 : 222 : break;
656 [ - + ]: 0 : default:
657 [ # # ]: 0 : POSIX_BAIL(S2N_ERR_PRF_INVALID_ALGORITHM);
658 : 3132 : }
659 : :
660 : 3132 : sha.data = sha_digest;
661 : 3132 : return s2n_prf(conn, &master_secret, &label, &sha, NULL, NULL, &client_finished);
662 : 3132 : }
663 : :
664 [ - + ]: 346 : POSIX_GUARD(s2n_hash_copy(&conn->handshake.hashes->hash_workspace, &conn->handshake.hashes->md5));
665 [ - + ]: 346 : POSIX_GUARD(s2n_hash_digest(&conn->handshake.hashes->hash_workspace, md5_digest, MD5_DIGEST_LENGTH));
666 : 346 : md5.data = md5_digest;
667 : 346 : md5.size = MD5_DIGEST_LENGTH;
668 : :
669 [ - + ]: 346 : POSIX_GUARD(s2n_hash_copy(&conn->handshake.hashes->hash_workspace, &conn->handshake.hashes->sha1));
670 [ - + ]: 346 : POSIX_GUARD(s2n_hash_digest(&conn->handshake.hashes->hash_workspace, sha_digest, SHA_DIGEST_LENGTH));
671 : 346 : sha.data = sha_digest;
672 : 346 : sha.size = SHA_DIGEST_LENGTH;
673 : :
674 : 346 : return s2n_prf(conn, &master_secret, &label, &md5, &sha, NULL, &client_finished);
675 : 346 : }
676 : :
677 : : int s2n_prf_server_finished(struct s2n_connection *conn)
678 : 2753 : {
679 [ # # ][ - + ]: 2753 : POSIX_ENSURE_REF(conn);
680 [ - + ][ # # ]: 2753 : POSIX_ENSURE_REF(conn->secure);
681 [ # # ][ - + ]: 2753 : POSIX_ENSURE_REF(conn->handshake.hashes);
682 : :
683 : 2753 : struct s2n_blob master_secret = { 0 };
684 : 2753 : struct s2n_blob md5 = { 0 };
685 : 2753 : struct s2n_blob sha = { 0 };
686 : 2753 : uint8_t md5_digest[MD5_DIGEST_LENGTH] = { 0 };
687 : 2753 : uint8_t sha_digest[SHA384_DIGEST_LENGTH] = { 0 };
688 : 2753 : uint8_t server_finished_label[] = "server finished";
689 : 2753 : struct s2n_blob server_finished = { 0 };
690 : 2753 : struct s2n_blob label = { 0 };
691 : :
692 [ + + ]: 2753 : if (conn->actual_protocol_version == S2N_SSLv3) {
693 : 195 : return s2n_prf_sslv3_server_finished(conn);
694 : 195 : }
695 : :
696 : 2558 : server_finished.data = conn->handshake.server_finished;
697 : 2558 : server_finished.size = S2N_TLS_FINISHED_LEN;
698 [ - + ]: 2558 : POSIX_GUARD_RESULT(s2n_handshake_set_finished_len(conn, server_finished.size));
699 : 2558 : label.data = server_finished_label;
700 : 2558 : label.size = sizeof(server_finished_label) - 1;
701 : :
702 : 2558 : master_secret.data = conn->secrets.version.tls12.master_secret;
703 : 2558 : master_secret.size = sizeof(conn->secrets.version.tls12.master_secret);
704 [ + + ]: 2558 : if (conn->actual_protocol_version == S2N_TLS12) {
705 : 2212 : switch (conn->secure->cipher_suite->prf_alg) {
706 [ + + ]: 1993 : case S2N_HMAC_SHA256:
707 [ - + ]: 1993 : POSIX_GUARD(s2n_hash_copy(&conn->handshake.hashes->hash_workspace, &conn->handshake.hashes->sha256));
708 [ - + ]: 1993 : POSIX_GUARD(s2n_hash_digest(&conn->handshake.hashes->hash_workspace, sha_digest, SHA256_DIGEST_LENGTH));
709 : 1993 : sha.size = SHA256_DIGEST_LENGTH;
710 : 1993 : break;
711 [ + + ]: 219 : case S2N_HMAC_SHA384:
712 [ - + ]: 219 : POSIX_GUARD(s2n_hash_copy(&conn->handshake.hashes->hash_workspace, &conn->handshake.hashes->sha384));
713 [ - + ]: 219 : POSIX_GUARD(s2n_hash_digest(&conn->handshake.hashes->hash_workspace, sha_digest, SHA384_DIGEST_LENGTH));
714 : 219 : sha.size = SHA384_DIGEST_LENGTH;
715 : 219 : break;
716 [ - + ]: 0 : default:
717 [ # # ]: 0 : POSIX_BAIL(S2N_ERR_PRF_INVALID_ALGORITHM);
718 : 2212 : }
719 : :
720 : 2212 : sha.data = sha_digest;
721 : 2212 : return s2n_prf(conn, &master_secret, &label, &sha, NULL, NULL, &server_finished);
722 : 2212 : }
723 : :
724 [ - + ]: 346 : POSIX_GUARD(s2n_hash_copy(&conn->handshake.hashes->hash_workspace, &conn->handshake.hashes->md5));
725 [ - + ]: 346 : POSIX_GUARD(s2n_hash_digest(&conn->handshake.hashes->hash_workspace, md5_digest, MD5_DIGEST_LENGTH));
726 : 346 : md5.data = md5_digest;
727 : 346 : md5.size = MD5_DIGEST_LENGTH;
728 : :
729 [ - + ]: 346 : POSIX_GUARD(s2n_hash_copy(&conn->handshake.hashes->hash_workspace, &conn->handshake.hashes->sha1));
730 [ - + ]: 346 : POSIX_GUARD(s2n_hash_digest(&conn->handshake.hashes->hash_workspace, sha_digest, SHA_DIGEST_LENGTH));
731 : 346 : sha.data = sha_digest;
732 : 346 : sha.size = SHA_DIGEST_LENGTH;
733 : :
734 : 346 : return s2n_prf(conn, &master_secret, &label, &md5, &sha, NULL, &server_finished);
735 : 346 : }
736 : :
737 : : static int s2n_prf_make_client_key(struct s2n_connection *conn, struct s2n_key_material *key_material)
738 : 4589 : {
739 [ - + ][ # # ]: 4589 : POSIX_ENSURE_REF(conn);
740 [ - + ][ # # ]: 4589 : POSIX_ENSURE_REF(conn->secure);
741 [ - + ][ # # ]: 4589 : POSIX_ENSURE_REF(conn->secure->cipher_suite);
742 [ - + ][ # # ]: 4589 : POSIX_ENSURE_REF(conn->secure->cipher_suite->record_alg);
743 : 4589 : const struct s2n_cipher *cipher = conn->secure->cipher_suite->record_alg->cipher;
744 [ - + ][ # # ]: 4589 : POSIX_ENSURE_REF(cipher);
745 [ - + ][ # # ]: 4589 : POSIX_ENSURE_REF(cipher->set_encryption_key);
746 [ - + ][ # # ]: 4589 : POSIX_ENSURE_REF(cipher->set_decryption_key);
747 : :
748 [ + + ]: 4589 : if (conn->mode == S2N_CLIENT) {
749 [ - + ]: 2272 : POSIX_GUARD_RESULT(cipher->set_encryption_key(&conn->secure->client_key, &key_material->client_key));
750 : 2317 : } else {
751 [ - + ]: 2317 : POSIX_GUARD_RESULT(cipher->set_decryption_key(&conn->secure->client_key, &key_material->client_key));
752 : 2317 : }
753 : :
754 : 4589 : return 0;
755 : 4589 : }
756 : :
757 : : static int s2n_prf_make_server_key(struct s2n_connection *conn, struct s2n_key_material *key_material)
758 : 4589 : {
759 [ - + ][ # # ]: 4589 : POSIX_ENSURE_REF(conn);
760 [ # # ][ - + ]: 4589 : POSIX_ENSURE_REF(conn->secure);
761 [ - + ][ # # ]: 4589 : POSIX_ENSURE_REF(conn->secure->cipher_suite);
762 [ - + ][ # # ]: 4589 : POSIX_ENSURE_REF(conn->secure->cipher_suite->record_alg);
763 : 4589 : const struct s2n_cipher *cipher = conn->secure->cipher_suite->record_alg->cipher;
764 [ - + ][ # # ]: 4589 : POSIX_ENSURE_REF(cipher);
765 [ - + ][ # # ]: 4589 : POSIX_ENSURE_REF(cipher->set_encryption_key);
766 [ # # ][ - + ]: 4589 : POSIX_ENSURE_REF(cipher->set_decryption_key);
767 : :
768 [ + + ]: 4589 : if (conn->mode == S2N_SERVER) {
769 [ - + ]: 2317 : POSIX_GUARD_RESULT(cipher->set_encryption_key(&conn->secure->server_key, &key_material->server_key));
770 : 2317 : } else {
771 [ - + ]: 2272 : POSIX_GUARD_RESULT(cipher->set_decryption_key(&conn->secure->server_key, &key_material->server_key));
772 : 2272 : }
773 : :
774 : 4589 : return 0;
775 : 4589 : }
776 : :
777 : : S2N_RESULT s2n_prf_generate_key_material(struct s2n_connection *conn, struct s2n_key_material *key_material)
778 : 4612 : {
779 [ # # ][ - + ]: 4612 : RESULT_ENSURE_REF(conn);
780 [ - + ][ # # ]: 4612 : RESULT_ENSURE_REF(key_material);
781 : :
782 : 4612 : struct s2n_blob client_random = { 0 };
783 [ - + ]: 4612 : RESULT_GUARD_POSIX(s2n_blob_init(&client_random, conn->client_hello.random, sizeof(conn->client_hello.random)));
784 : 4612 : struct s2n_blob server_random = { 0 };
785 [ - + ]: 4612 : RESULT_GUARD_POSIX(s2n_blob_init(&server_random, conn->handshake_params.server_random, sizeof(conn->handshake_params.server_random)));
786 : 4612 : struct s2n_blob master_secret = { 0 };
787 [ - + ]: 4612 : RESULT_GUARD_POSIX(s2n_blob_init(&master_secret, conn->secrets.version.tls12.master_secret, sizeof(conn->secrets.version.tls12.master_secret)));
788 : :
789 : 4612 : struct s2n_blob label = { 0 };
790 : 4612 : uint8_t key_expansion_label[] = "key expansion";
791 [ - + ]: 4612 : RESULT_GUARD_POSIX(s2n_blob_init(&label, key_expansion_label, sizeof(key_expansion_label) - 1));
792 : :
793 [ - + ]: 4612 : RESULT_GUARD(s2n_key_material_init(key_material, conn));
794 : 4612 : struct s2n_blob prf_out = { 0 };
795 [ - + ]: 4612 : RESULT_GUARD_POSIX(s2n_blob_init(&prf_out, key_material->key_block, sizeof(key_material->key_block)));
796 [ - + ]: 4612 : RESULT_GUARD_POSIX(s2n_prf(conn, &master_secret, &label, &server_random, &client_random, NULL, &prf_out));
797 : :
798 : 4612 : return S2N_RESULT_OK;
799 : 4612 : }
800 : :
801 : : int s2n_prf_key_expansion(struct s2n_connection *conn)
802 : 4589 : {
803 [ - + ][ # # ]: 4589 : POSIX_ENSURE_REF(conn);
804 [ - + ][ # # ]: 4589 : POSIX_ENSURE_REF(conn->secure);
805 : 4589 : struct s2n_cipher_suite *cipher_suite = conn->secure->cipher_suite;
806 [ # # ][ - + ]: 4589 : POSIX_ENSURE_REF(cipher_suite);
807 [ - + ][ # # ]: 4589 : POSIX_ENSURE_REF(cipher_suite->record_alg);
808 : 4589 : const struct s2n_cipher *cipher = cipher_suite->record_alg->cipher;
809 [ - + ][ # # ]: 4589 : POSIX_ENSURE_REF(cipher);
810 : :
811 : 4589 : struct s2n_key_material key_material = { 0 };
812 [ - + ]: 4589 : POSIX_GUARD_RESULT(s2n_prf_generate_key_material(conn, &key_material));
813 : :
814 [ - + ][ # # ]: 4589 : POSIX_ENSURE(cipher_suite->available, S2N_ERR_PRF_INVALID_ALGORITHM);
815 [ - + ]: 4589 : POSIX_GUARD_RESULT(cipher->init(&conn->secure->client_key));
816 [ - + ]: 4589 : POSIX_GUARD_RESULT(cipher->init(&conn->secure->server_key));
817 : :
818 : : /* Seed the client MAC */
819 [ - + ]: 4589 : POSIX_GUARD(s2n_hmac_reset(&conn->secure->client_record_mac));
820 [ - + ]: 4589 : POSIX_GUARD(s2n_hmac_init(
821 : 4589 : &conn->secure->client_record_mac,
822 : 4589 : cipher_suite->record_alg->hmac_alg,
823 : 4589 : key_material.client_mac.data,
824 : 4589 : key_material.client_mac.size));
825 : :
826 : : /* Seed the server MAC */
827 [ - + ]: 4589 : POSIX_GUARD(s2n_hmac_reset(&conn->secure->server_record_mac));
828 [ - + ]: 4589 : POSIX_GUARD(s2n_hmac_init(
829 : 4589 : &conn->secure->server_record_mac,
830 : 4589 : conn->secure->cipher_suite->record_alg->hmac_alg,
831 : 4589 : key_material.server_mac.data,
832 : 4589 : key_material.server_mac.size));
833 : :
834 : : /* Make the client key */
835 [ - + ]: 4589 : POSIX_GUARD(s2n_prf_make_client_key(conn, &key_material));
836 : :
837 : : /* Make the server key */
838 [ - + ]: 4589 : POSIX_GUARD(s2n_prf_make_server_key(conn, &key_material));
839 : :
840 : : /* Composite CBC does MAC inside the cipher, pass it the MAC key.
841 : : * Must happen after setting encryption/decryption keys.
842 : : */
843 [ + + ]: 4589 : if (cipher->type == S2N_COMPOSITE) {
844 [ - + ]: 770 : POSIX_GUARD(cipher->io.comp.set_mac_write_key(&conn->secure->client_key, key_material.client_mac.data, key_material.client_mac.size));
845 [ - + ]: 770 : POSIX_GUARD(cipher->io.comp.set_mac_write_key(&conn->secure->server_key, key_material.server_mac.data, key_material.server_mac.size));
846 : 770 : }
847 : :
848 : : /* set IV */
849 [ - + ][ # # ]: 4589 : POSIX_ENSURE_EQ(key_material.client_iv.size, key_material.server_iv.size);
850 [ - + ][ # # ]: 4589 : POSIX_ENSURE_LTE(key_material.client_iv.size, S2N_TLS_MAX_IV_LEN);
851 [ - + ][ # # ]: 4589 : POSIX_CHECKED_MEMCPY(conn->secure->client_implicit_iv, key_material.client_iv.data, key_material.client_iv.size);
[ + + ]
852 [ - + ][ # # ]: 4589 : POSIX_CHECKED_MEMCPY(conn->secure->server_implicit_iv, key_material.server_iv.data, key_material.server_iv.size);
[ + + ]
853 : :
854 : 4589 : return 0;
855 : 4589 : }
|
