Source file src/crypto/tls/key_agreement.go

Documentation: crypto/tls

     1  // Copyright 2010 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package tls
     6  
     7  import (
     8  	"crypto"
     9  	"crypto/md5"
    10  	"crypto/rsa"
    11  	"crypto/sha1"
    12  	"crypto/x509"
    13  	"errors"
    14  	"io"
    15  )
    16  
    17  var errClientKeyExchange = errors.New("tls: invalid ClientKeyExchange message")
    18  var errServerKeyExchange = errors.New("tls: invalid ServerKeyExchange message")
    19  
    20  // rsaKeyAgreement implements the standard TLS key agreement where the client
    21  // encrypts the pre-master secret to the server's public key.
    22  type rsaKeyAgreement struct{}
    23  
    24  func (ka rsaKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) {
    25  	return nil, nil
    26  }
    27  
    28  func (ka rsaKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) {
    29  	if len(ckx.ciphertext) < 2 {
    30  		return nil, errClientKeyExchange
    31  	}
    32  
    33  	ciphertext := ckx.ciphertext
    34  	if version != VersionSSL30 {
    35  		ciphertextLen := int(ckx.ciphertext[0])<<8 | int(ckx.ciphertext[1])
    36  		if ciphertextLen != len(ckx.ciphertext)-2 {
    37  			return nil, errClientKeyExchange
    38  		}
    39  		ciphertext = ckx.ciphertext[2:]
    40  	}
    41  	priv, ok := cert.PrivateKey.(crypto.Decrypter)
    42  	if !ok {
    43  		return nil, errors.New("tls: certificate private key does not implement crypto.Decrypter")
    44  	}
    45  	// Perform constant time RSA PKCS#1 v1.5 decryption
    46  	preMasterSecret, err := priv.Decrypt(config.rand(), ciphertext, &rsa.PKCS1v15DecryptOptions{SessionKeyLen: 48})
    47  	if err != nil {
    48  		return nil, err
    49  	}
    50  	// We don't check the version number in the premaster secret. For one,
    51  	// by checking it, we would leak information about the validity of the
    52  	// encrypted pre-master secret. Secondly, it provides only a small
    53  	// benefit against a downgrade attack and some implementations send the
    54  	// wrong version anyway. See the discussion at the end of section
    55  	// 7.4.7.1 of RFC 4346.
    56  	return preMasterSecret, nil
    57  }
    58  
    59  func (ka rsaKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error {
    60  	return errors.New("tls: unexpected ServerKeyExchange")
    61  }
    62  
    63  func (ka rsaKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) {
    64  	preMasterSecret := make([]byte, 48)
    65  	preMasterSecret[0] = byte(clientHello.vers >> 8)
    66  	preMasterSecret[1] = byte(clientHello.vers)
    67  	_, err := io.ReadFull(config.rand(), preMasterSecret[2:])
    68  	if err != nil {
    69  		return nil, nil, err
    70  	}
    71  
    72  	encrypted, err := rsa.EncryptPKCS1v15(config.rand(), cert.PublicKey.(*rsa.PublicKey), preMasterSecret)
    73  	if err != nil {
    74  		return nil, nil, err
    75  	}
    76  	ckx := new(clientKeyExchangeMsg)
    77  	ckx.ciphertext = make([]byte, len(encrypted)+2)
    78  	ckx.ciphertext[0] = byte(len(encrypted) >> 8)
    79  	ckx.ciphertext[1] = byte(len(encrypted))
    80  	copy(ckx.ciphertext[2:], encrypted)
    81  	return preMasterSecret, ckx, nil
    82  }
    83  
    84  // sha1Hash calculates a SHA1 hash over the given byte slices.
    85  func sha1Hash(slices [][]byte) []byte {
    86  	hsha1 := sha1.New()
    87  	for _, slice := range slices {
    88  		hsha1.Write(slice)
    89  	}
    90  	return hsha1.Sum(nil)
    91  }
    92  
    93  // md5SHA1Hash implements TLS 1.0's hybrid hash function which consists of the
    94  // concatenation of an MD5 and SHA1 hash.
    95  func md5SHA1Hash(slices [][]byte) []byte {
    96  	md5sha1 := make([]byte, md5.Size+sha1.Size)
    97  	hmd5 := md5.New()
    98  	for _, slice := range slices {
    99  		hmd5.Write(slice)
   100  	}
   101  	copy(md5sha1, hmd5.Sum(nil))
   102  	copy(md5sha1[md5.Size:], sha1Hash(slices))
   103  	return md5sha1
   104  }
   105  
   106  // hashForServerKeyExchange hashes the given slices and returns their digest
   107  // using the given hash function (for >= TLS 1.2) or using a default based on
   108  // the sigType (for earlier TLS versions). For Ed25519 signatures, which don't
   109  // do pre-hashing, it returns the concatenation of the slices.
   110  func hashForServerKeyExchange(sigType uint8, hashFunc crypto.Hash, version uint16, slices ...[]byte) []byte {
   111  	if sigType == signatureEd25519 {
   112  		var signed []byte
   113  		for _, slice := range slices {
   114  			signed = append(signed, slice...)
   115  		}
   116  		return signed
   117  	}
   118  	if version >= VersionTLS12 {
   119  		h := hashFunc.New()
   120  		for _, slice := range slices {
   121  			h.Write(slice)
   122  		}
   123  		digest := h.Sum(nil)
   124  		return digest
   125  	}
   126  	if sigType == signatureECDSA {
   127  		return sha1Hash(slices)
   128  	}
   129  	return md5SHA1Hash(slices)
   130  }
   131  
   132  // ecdheKeyAgreement implements a TLS key agreement where the server
   133  // generates an ephemeral EC public/private key pair and signs it. The
   134  // pre-master secret is then calculated using ECDH. The signature may
   135  // be ECDSA, Ed25519 or RSA.
   136  type ecdheKeyAgreement struct {
   137  	version uint16
   138  	isRSA   bool
   139  	params  ecdheParameters
   140  
   141  	// ckx and preMasterSecret are generated in processServerKeyExchange
   142  	// and returned in generateClientKeyExchange.
   143  	ckx             *clientKeyExchangeMsg
   144  	preMasterSecret []byte
   145  }
   146  
   147  func (ka *ecdheKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) {
   148  	preferredCurves := config.curvePreferences()
   149  
   150  	var curveID CurveID
   151  NextCandidate:
   152  	for _, candidate := range preferredCurves {
   153  		for _, c := range clientHello.supportedCurves {
   154  			if candidate == c {
   155  				curveID = c
   156  				break NextCandidate
   157  			}
   158  		}
   159  	}
   160  
   161  	if curveID == 0 {
   162  		return nil, errors.New("tls: no supported elliptic curves offered")
   163  	}
   164  	if _, ok := curveForCurveID(curveID); curveID != X25519 && !ok {
   165  		return nil, errors.New("tls: CurvePreferences includes unsupported curve")
   166  	}
   167  
   168  	params, err := generateECDHEParameters(config.rand(), curveID)
   169  	if err != nil {
   170  		return nil, err
   171  	}
   172  	ka.params = params
   173  
   174  	// See RFC 4492, Section 5.4.
   175  	ecdhePublic := params.PublicKey()
   176  	serverECDHParams := make([]byte, 1+2+1+len(ecdhePublic))
   177  	serverECDHParams[0] = 3 // named curve
   178  	serverECDHParams[1] = byte(curveID >> 8)
   179  	serverECDHParams[2] = byte(curveID)
   180  	serverECDHParams[3] = byte(len(ecdhePublic))
   181  	copy(serverECDHParams[4:], ecdhePublic)
   182  
   183  	priv, ok := cert.PrivateKey.(crypto.Signer)
   184  	if !ok {
   185  		return nil, errors.New("tls: certificate private key does not implement crypto.Signer")
   186  	}
   187  
   188  	signatureAlgorithm, sigType, hashFunc, err := pickSignatureAlgorithm(priv.Public(), clientHello.supportedSignatureAlgorithms, supportedSignatureAlgorithmsTLS12, ka.version)
   189  	if err != nil {
   190  		return nil, err
   191  	}
   192  	if (sigType == signaturePKCS1v15 || sigType == signatureRSAPSS) != ka.isRSA {
   193  		return nil, errors.New("tls: certificate cannot be used with the selected cipher suite")
   194  	}
   195  
   196  	signed := hashForServerKeyExchange(sigType, hashFunc, ka.version, clientHello.random, hello.random, serverECDHParams)
   197  
   198  	signOpts := crypto.SignerOpts(hashFunc)
   199  	if sigType == signatureRSAPSS {
   200  		signOpts = &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash, Hash: hashFunc}
   201  	}
   202  	sig, err := priv.Sign(config.rand(), signed, signOpts)
   203  	if err != nil {
   204  		return nil, errors.New("tls: failed to sign ECDHE parameters: " + err.Error())
   205  	}
   206  
   207  	skx := new(serverKeyExchangeMsg)
   208  	sigAndHashLen := 0
   209  	if ka.version >= VersionTLS12 {
   210  		sigAndHashLen = 2
   211  	}
   212  	skx.key = make([]byte, len(serverECDHParams)+sigAndHashLen+2+len(sig))
   213  	copy(skx.key, serverECDHParams)
   214  	k := skx.key[len(serverECDHParams):]
   215  	if ka.version >= VersionTLS12 {
   216  		k[0] = byte(signatureAlgorithm >> 8)
   217  		k[1] = byte(signatureAlgorithm)
   218  		k = k[2:]
   219  	}
   220  	k[0] = byte(len(sig) >> 8)
   221  	k[1] = byte(len(sig))
   222  	copy(k[2:], sig)
   223  
   224  	return skx, nil
   225  }
   226  
   227  func (ka *ecdheKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) {
   228  	if len(ckx.ciphertext) == 0 || int(ckx.ciphertext[0]) != len(ckx.ciphertext)-1 {
   229  		return nil, errClientKeyExchange
   230  	}
   231  
   232  	preMasterSecret := ka.params.SharedKey(ckx.ciphertext[1:])
   233  	if preMasterSecret == nil {
   234  		return nil, errClientKeyExchange
   235  	}
   236  
   237  	return preMasterSecret, nil
   238  }
   239  
   240  func (ka *ecdheKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error {
   241  	if len(skx.key) < 4 {
   242  		return errServerKeyExchange
   243  	}
   244  	if skx.key[0] != 3 { // named curve
   245  		return errors.New("tls: server selected unsupported curve")
   246  	}
   247  	curveID := CurveID(skx.key[1])<<8 | CurveID(skx.key[2])
   248  
   249  	publicLen := int(skx.key[3])
   250  	if publicLen+4 > len(skx.key) {
   251  		return errServerKeyExchange
   252  	}
   253  	serverECDHParams := skx.key[:4+publicLen]
   254  	publicKey := serverECDHParams[4:]
   255  
   256  	sig := skx.key[4+publicLen:]
   257  	if len(sig) < 2 {
   258  		return errServerKeyExchange
   259  	}
   260  
   261  	if _, ok := curveForCurveID(curveID); curveID != X25519 && !ok {
   262  		return errors.New("tls: server selected unsupported curve")
   263  	}
   264  
   265  	params, err := generateECDHEParameters(config.rand(), curveID)
   266  	if err != nil {
   267  		return err
   268  	}
   269  	ka.params = params
   270  
   271  	ka.preMasterSecret = params.SharedKey(publicKey)
   272  	if ka.preMasterSecret == nil {
   273  		return errServerKeyExchange
   274  	}
   275  
   276  	ourPublicKey := params.PublicKey()
   277  	ka.ckx = new(clientKeyExchangeMsg)
   278  	ka.ckx.ciphertext = make([]byte, 1+len(ourPublicKey))
   279  	ka.ckx.ciphertext[0] = byte(len(ourPublicKey))
   280  	copy(ka.ckx.ciphertext[1:], ourPublicKey)
   281  
   282  	var signatureAlgorithm SignatureScheme
   283  	if ka.version >= VersionTLS12 {
   284  		// handle SignatureAndHashAlgorithm
   285  		signatureAlgorithm = SignatureScheme(sig[0])<<8 | SignatureScheme(sig[1])
   286  		sig = sig[2:]
   287  		if len(sig) < 2 {
   288  			return errServerKeyExchange
   289  		}
   290  	}
   291  	_, sigType, hashFunc, err := pickSignatureAlgorithm(cert.PublicKey, []SignatureScheme{signatureAlgorithm}, clientHello.supportedSignatureAlgorithms, ka.version)
   292  	if err != nil {
   293  		return err
   294  	}
   295  	if (sigType == signaturePKCS1v15 || sigType == signatureRSAPSS) != ka.isRSA {
   296  		return errServerKeyExchange
   297  	}
   298  
   299  	sigLen := int(sig[0])<<8 | int(sig[1])
   300  	if sigLen+2 != len(sig) {
   301  		return errServerKeyExchange
   302  	}
   303  	sig = sig[2:]
   304  
   305  	signed := hashForServerKeyExchange(sigType, hashFunc, ka.version, clientHello.random, serverHello.random, serverECDHParams)
   306  	return verifyHandshakeSignature(sigType, cert.PublicKey, hashFunc, signed, sig)
   307  }
   308  
   309  func (ka *ecdheKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) {
   310  	if ka.ckx == nil {
   311  		return nil, nil, errors.New("tls: missing ServerKeyExchange message")
   312  	}
   313  
   314  	return ka.preMasterSecret, ka.ckx, nil
   315  }
   316  

View as plain text