1 // Copyright 2010 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 package tls 6 7 import ( 8 "crypto" 9 "crypto/md5" 10 "crypto/rsa" 11 "crypto/sha1" 12 "crypto/x509" 13 "errors" 14 "io" 15 ) 16 17 var errClientKeyExchange = errors.New("tls: invalid ClientKeyExchange message") 18 var errServerKeyExchange = errors.New("tls: invalid ServerKeyExchange message") 19 20 // rsaKeyAgreement implements the standard TLS key agreement where the client 21 // encrypts the pre-master secret to the server's public key. 22 type rsaKeyAgreement struct{} 23 24 func (ka rsaKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) { 25 return nil, nil 26 } 27 28 func (ka rsaKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) { 29 if len(ckx.ciphertext) < 2 { 30 return nil, errClientKeyExchange 31 } 32 33 ciphertext := ckx.ciphertext 34 if version != VersionSSL30 { 35 ciphertextLen := int(ckx.ciphertext[0])<<8 | int(ckx.ciphertext[1]) 36 if ciphertextLen != len(ckx.ciphertext)-2 { 37 return nil, errClientKeyExchange 38 } 39 ciphertext = ckx.ciphertext[2:] 40 } 41 priv, ok := cert.PrivateKey.(crypto.Decrypter) 42 if !ok { 43 return nil, errors.New("tls: certificate private key does not implement crypto.Decrypter") 44 } 45 // Perform constant time RSA PKCS#1 v1.5 decryption 46 preMasterSecret, err := priv.Decrypt(config.rand(), ciphertext, &rsa.PKCS1v15DecryptOptions{SessionKeyLen: 48}) 47 if err != nil { 48 return nil, err 49 } 50 // We don't check the version number in the premaster secret. For one, 51 // by checking it, we would leak information about the validity of the 52 // encrypted pre-master secret. Secondly, it provides only a small 53 // benefit against a downgrade attack and some implementations send the 54 // wrong version anyway. See the discussion at the end of section 55 // 7.4.7.1 of RFC 4346. 56 return preMasterSecret, nil 57 } 58 59 func (ka rsaKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error { 60 return errors.New("tls: unexpected ServerKeyExchange") 61 } 62 63 func (ka rsaKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) { 64 preMasterSecret := make([]byte, 48) 65 preMasterSecret[0] = byte(clientHello.vers >> 8) 66 preMasterSecret[1] = byte(clientHello.vers) 67 _, err := io.ReadFull(config.rand(), preMasterSecret[2:]) 68 if err != nil { 69 return nil, nil, err 70 } 71 72 encrypted, err := rsa.EncryptPKCS1v15(config.rand(), cert.PublicKey.(*rsa.PublicKey), preMasterSecret) 73 if err != nil { 74 return nil, nil, err 75 } 76 ckx := new(clientKeyExchangeMsg) 77 ckx.ciphertext = make([]byte, len(encrypted)+2) 78 ckx.ciphertext[0] = byte(len(encrypted) >> 8) 79 ckx.ciphertext[1] = byte(len(encrypted)) 80 copy(ckx.ciphertext[2:], encrypted) 81 return preMasterSecret, ckx, nil 82 } 83 84 // sha1Hash calculates a SHA1 hash over the given byte slices. 85 func sha1Hash(slices [][]byte) []byte { 86 hsha1 := sha1.New() 87 for _, slice := range slices { 88 hsha1.Write(slice) 89 } 90 return hsha1.Sum(nil) 91 } 92 93 // md5SHA1Hash implements TLS 1.0's hybrid hash function which consists of the 94 // concatenation of an MD5 and SHA1 hash. 95 func md5SHA1Hash(slices [][]byte) []byte { 96 md5sha1 := make([]byte, md5.Size+sha1.Size) 97 hmd5 := md5.New() 98 for _, slice := range slices { 99 hmd5.Write(slice) 100 } 101 copy(md5sha1, hmd5.Sum(nil)) 102 copy(md5sha1[md5.Size:], sha1Hash(slices)) 103 return md5sha1 104 } 105 106 // hashForServerKeyExchange hashes the given slices and returns their digest 107 // using the given hash function (for >= TLS 1.2) or using a default based on 108 // the sigType (for earlier TLS versions). For Ed25519 signatures, which don't 109 // do pre-hashing, it returns the concatenation of the slices. 110 func hashForServerKeyExchange(sigType uint8, hashFunc crypto.Hash, version uint16, slices ...[]byte) []byte { 111 if sigType == signatureEd25519 { 112 var signed []byte 113 for _, slice := range slices { 114 signed = append(signed, slice...) 115 } 116 return signed 117 } 118 if version >= VersionTLS12 { 119 h := hashFunc.New() 120 for _, slice := range slices { 121 h.Write(slice) 122 } 123 digest := h.Sum(nil) 124 return digest 125 } 126 if sigType == signatureECDSA { 127 return sha1Hash(slices) 128 } 129 return md5SHA1Hash(slices) 130 } 131 132 // ecdheKeyAgreement implements a TLS key agreement where the server 133 // generates an ephemeral EC public/private key pair and signs it. The 134 // pre-master secret is then calculated using ECDH. The signature may 135 // be ECDSA, Ed25519 or RSA. 136 type ecdheKeyAgreement struct { 137 version uint16 138 isRSA bool 139 params ecdheParameters 140 141 // ckx and preMasterSecret are generated in processServerKeyExchange 142 // and returned in generateClientKeyExchange. 143 ckx *clientKeyExchangeMsg 144 preMasterSecret []byte 145 } 146 147 func (ka *ecdheKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) { 148 preferredCurves := config.curvePreferences() 149 150 var curveID CurveID 151 NextCandidate: 152 for _, candidate := range preferredCurves { 153 for _, c := range clientHello.supportedCurves { 154 if candidate == c { 155 curveID = c 156 break NextCandidate 157 } 158 } 159 } 160 161 if curveID == 0 { 162 return nil, errors.New("tls: no supported elliptic curves offered") 163 } 164 if _, ok := curveForCurveID(curveID); curveID != X25519 && !ok { 165 return nil, errors.New("tls: CurvePreferences includes unsupported curve") 166 } 167 168 params, err := generateECDHEParameters(config.rand(), curveID) 169 if err != nil { 170 return nil, err 171 } 172 ka.params = params 173 174 // See RFC 4492, Section 5.4. 175 ecdhePublic := params.PublicKey() 176 serverECDHParams := make([]byte, 1+2+1+len(ecdhePublic)) 177 serverECDHParams[0] = 3 // named curve 178 serverECDHParams[1] = byte(curveID >> 8) 179 serverECDHParams[2] = byte(curveID) 180 serverECDHParams[3] = byte(len(ecdhePublic)) 181 copy(serverECDHParams[4:], ecdhePublic) 182 183 priv, ok := cert.PrivateKey.(crypto.Signer) 184 if !ok { 185 return nil, errors.New("tls: certificate private key does not implement crypto.Signer") 186 } 187 188 signatureAlgorithm, sigType, hashFunc, err := pickSignatureAlgorithm(priv.Public(), clientHello.supportedSignatureAlgorithms, supportedSignatureAlgorithmsTLS12, ka.version) 189 if err != nil { 190 return nil, err 191 } 192 if (sigType == signaturePKCS1v15 || sigType == signatureRSAPSS) != ka.isRSA { 193 return nil, errors.New("tls: certificate cannot be used with the selected cipher suite") 194 } 195 196 signed := hashForServerKeyExchange(sigType, hashFunc, ka.version, clientHello.random, hello.random, serverECDHParams) 197 198 signOpts := crypto.SignerOpts(hashFunc) 199 if sigType == signatureRSAPSS { 200 signOpts = &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash, Hash: hashFunc} 201 } 202 sig, err := priv.Sign(config.rand(), signed, signOpts) 203 if err != nil { 204 return nil, errors.New("tls: failed to sign ECDHE parameters: " + err.Error()) 205 } 206 207 skx := new(serverKeyExchangeMsg) 208 sigAndHashLen := 0 209 if ka.version >= VersionTLS12 { 210 sigAndHashLen = 2 211 } 212 skx.key = make([]byte, len(serverECDHParams)+sigAndHashLen+2+len(sig)) 213 copy(skx.key, serverECDHParams) 214 k := skx.key[len(serverECDHParams):] 215 if ka.version >= VersionTLS12 { 216 k[0] = byte(signatureAlgorithm >> 8) 217 k[1] = byte(signatureAlgorithm) 218 k = k[2:] 219 } 220 k[0] = byte(len(sig) >> 8) 221 k[1] = byte(len(sig)) 222 copy(k[2:], sig) 223 224 return skx, nil 225 } 226 227 func (ka *ecdheKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) { 228 if len(ckx.ciphertext) == 0 || int(ckx.ciphertext[0]) != len(ckx.ciphertext)-1 { 229 return nil, errClientKeyExchange 230 } 231 232 preMasterSecret := ka.params.SharedKey(ckx.ciphertext[1:]) 233 if preMasterSecret == nil { 234 return nil, errClientKeyExchange 235 } 236 237 return preMasterSecret, nil 238 } 239 240 func (ka *ecdheKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error { 241 if len(skx.key) < 4 { 242 return errServerKeyExchange 243 } 244 if skx.key[0] != 3 { // named curve 245 return errors.New("tls: server selected unsupported curve") 246 } 247 curveID := CurveID(skx.key[1])<<8 | CurveID(skx.key[2]) 248 249 publicLen := int(skx.key[3]) 250 if publicLen+4 > len(skx.key) { 251 return errServerKeyExchange 252 } 253 serverECDHParams := skx.key[:4+publicLen] 254 publicKey := serverECDHParams[4:] 255 256 sig := skx.key[4+publicLen:] 257 if len(sig) < 2 { 258 return errServerKeyExchange 259 } 260 261 if _, ok := curveForCurveID(curveID); curveID != X25519 && !ok { 262 return errors.New("tls: server selected unsupported curve") 263 } 264 265 params, err := generateECDHEParameters(config.rand(), curveID) 266 if err != nil { 267 return err 268 } 269 ka.params = params 270 271 ka.preMasterSecret = params.SharedKey(publicKey) 272 if ka.preMasterSecret == nil { 273 return errServerKeyExchange 274 } 275 276 ourPublicKey := params.PublicKey() 277 ka.ckx = new(clientKeyExchangeMsg) 278 ka.ckx.ciphertext = make([]byte, 1+len(ourPublicKey)) 279 ka.ckx.ciphertext[0] = byte(len(ourPublicKey)) 280 copy(ka.ckx.ciphertext[1:], ourPublicKey) 281 282 var signatureAlgorithm SignatureScheme 283 if ka.version >= VersionTLS12 { 284 // handle SignatureAndHashAlgorithm 285 signatureAlgorithm = SignatureScheme(sig[0])<<8 | SignatureScheme(sig[1]) 286 sig = sig[2:] 287 if len(sig) < 2 { 288 return errServerKeyExchange 289 } 290 } 291 _, sigType, hashFunc, err := pickSignatureAlgorithm(cert.PublicKey, []SignatureScheme{signatureAlgorithm}, clientHello.supportedSignatureAlgorithms, ka.version) 292 if err != nil { 293 return err 294 } 295 if (sigType == signaturePKCS1v15 || sigType == signatureRSAPSS) != ka.isRSA { 296 return errServerKeyExchange 297 } 298 299 sigLen := int(sig[0])<<8 | int(sig[1]) 300 if sigLen+2 != len(sig) { 301 return errServerKeyExchange 302 } 303 sig = sig[2:] 304 305 signed := hashForServerKeyExchange(sigType, hashFunc, ka.version, clientHello.random, serverHello.random, serverECDHParams) 306 return verifyHandshakeSignature(sigType, cert.PublicKey, hashFunc, signed, sig) 307 } 308 309 func (ka *ecdheKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) { 310 if ka.ckx == nil { 311 return nil, nil, errors.New("tls: missing ServerKeyExchange message") 312 } 313 314 return ka.preMasterSecret, ka.ckx, nil 315 } 316
View as plain text