Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update

Browse Source
This commit is contained in:
Hakase
2019-05-28 23:10:56 +09:00
parent 64d458de91
commit 9a23f88dc2
49 changed files with 24989 additions and 223 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crypto/kdf/hkdf.c
+99 -6
View File
@@ -28,7 +28,7 @@ static int HKDF(const EVP_MD *evp_md,
unsigned char *okm, size_t okm_len);
static int HKDF_Extract(const EVP_MD *evp_md,
const unsigned char *salt, size_t salt_len,
const unsigned char *key, size_t key_len,
const unsigned char *ikm, size_t ikm_len,
unsigned char *prk, size_t prk_len);
static int HKDF_Expand(const EVP_MD *evp_md,
const unsigned char *prk, size_t prk_len,
@@ -240,9 +240,34 @@ const EVP_KDF hkdf_kdf_meth = {
kdf_hkdf_derive
};
/*
* Refer to "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)"
* Section 2 (https://tools.ietf.org/html/rfc5869#section-2) and
* "Cryptographic Extraction and Key Derivation: The HKDF Scheme"
* Section 4.2 (https://eprint.iacr.org/2010/264.pdf).
*
* From the paper:
* The scheme HKDF is specified as:
* HKDF(XTS, SKM, CTXinfo, L) = K(1) | K(2) | ... | K(t)
*
* where:
* SKM is source key material
* XTS is extractor salt (which may be null or constant)
* CTXinfo is context information (may be null)
* L is the number of key bits to be produced by KDF
* k is the output length in bits of the hash function used with HMAC
* t = ceil(L/k)
* the value K(t) is truncated to its first d = L mod k bits.
*
* From RFC 5869:
* 2.2. Step 1: Extract
* HKDF-Extract(salt, IKM) -> PRK
* 2.3. Step 2: Expand
* HKDF-Expand(PRK, info, L) -> OKM
*/
static int HKDF(const EVP_MD *evp_md,
const unsigned char *salt, size_t salt_len,
const unsigned char *key, size_t key_len,
const unsigned char *ikm, size_t ikm_len,
const unsigned char *info, size_t info_len,
unsigned char *okm, size_t okm_len)
{
@@ -255,18 +280,44 @@ static int HKDF(const EVP_MD *evp_md,
return 0;
prk_len = (size_t)sz;
if (!HKDF_Extract(evp_md, salt, salt_len, key, key_len, prk, prk_len))
/* Step 1: HKDF-Extract(salt, IKM) -> PRK */
if (!HKDF_Extract(evp_md, salt, salt_len, ikm, ikm_len, prk, prk_len))
return 0;
/* Step 2: HKDF-Expand(PRK, info, L) -> OKM */
ret = HKDF_Expand(evp_md, prk, prk_len, info, info_len, okm, okm_len);
OPENSSL_cleanse(prk, sizeof(prk));
return ret;
}
/*
* Refer to "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)"
* Section 2.2 (https://tools.ietf.org/html/rfc5869#section-2.2).
*
* 2.2. Step 1: Extract
*
* HKDF-Extract(salt, IKM) -> PRK
*
* Options:
* Hash a hash function; HashLen denotes the length of the
* hash function output in octets
*
* Inputs:
* salt optional salt value (a non-secret random value);
* if not provided, it is set to a string of HashLen zeros.
* IKM input keying material
*
* Output:
* PRK a pseudorandom key (of HashLen octets)
*
* The output PRK is calculated as follows:
*
* PRK = HMAC-Hash(salt, IKM)
*/
static int HKDF_Extract(const EVP_MD *evp_md,
const unsigned char *salt, size_t salt_len,
const unsigned char *key, size_t key_len,
const unsigned char *ikm, size_t ikm_len,
unsigned char *prk, size_t prk_len)
{
int sz = EVP_MD_size(evp_md);
@@ -277,9 +328,49 @@ static int HKDF_Extract(const EVP_MD *evp_md,
KDFerr(KDF_F_HKDF_EXTRACT, KDF_R_WRONG_OUTPUT_BUFFER_SIZE);
return 0;
}
return HMAC(evp_md, salt, salt_len, key, key_len, prk, NULL) != NULL;
/* calc: PRK = HMAC-Hash(salt, IKM) */
return HMAC(evp_md, salt, salt_len, ikm, ikm_len, prk, NULL) != NULL;
}
/*
* Refer to "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)"
* Section 2.3 (https://tools.ietf.org/html/rfc5869#section-2.3).
*
* 2.3. Step 2: Expand
*
* HKDF-Expand(PRK, info, L) -> OKM
*
* Options:
* Hash a hash function; HashLen denotes the length of the
* hash function output in octets
*
* Inputs:
* PRK a pseudorandom key of at least HashLen octets
* (usually, the output from the extract step)
* info optional context and application specific information
* (can be a zero-length string)
* L length of output keying material in octets
* (<= 255*HashLen)
*
* Output:
* OKM output keying material (of L octets)
*
* The output OKM is calculated as follows:
*
* N = ceil(L/HashLen)
* T = T(1) | T(2) | T(3) | ... | T(N)
* OKM = first L octets of T
*
* where:
* T(0) = empty string (zero length)
* T(1) = HMAC-Hash(PRK, T(0) | info | 0x01)
* T(2) = HMAC-Hash(PRK, T(1) | info | 0x02)
* T(3) = HMAC-Hash(PRK, T(2) | info | 0x03)
* ...
*
* (where the constant concatenated to the end of each T(n) is a
* single octet.)
*/
static int HKDF_Expand(const EVP_MD *evp_md,
const unsigned char *prk, size_t prk_len,
const unsigned char *info, size_t info_len,
@@ -295,8 +386,9 @@ static int HKDF_Expand(const EVP_MD *evp_md,
if (sz <= 0)
return 0;
dig_len = (size_t)sz;
n = okm_len / dig_len;
/* calc: N = ceil(L/HashLen) */
n = okm_len / dig_len;
if (okm_len % dig_len)
n++;
@@ -313,6 +405,7 @@ static int HKDF_Expand(const EVP_MD *evp_md,
size_t copy_len;
const unsigned char ctr = i;
/* calc: T(i) = HMAC-Hash(PRK, T(i - 1) | info | i) */
if (i > 1) {
if (!HMAC_Init_ex(hmac, NULL, 0, NULL, NULL))
goto err;
crypto/kdf/tls1_prf.c
+117 -35
View File
@@ -7,6 +7,44 @@
* https://www.openssl.org/source/license.html
*/
/*
* Refer to "The TLS Protocol Version 1.0" Section 5
* (https://tools.ietf.org/html/rfc2246#section-5) and
* "The Transport Layer Security (TLS) Protocol Version 1.2" Section 5
* (https://tools.ietf.org/html/rfc5246#section-5).
*
* For TLS v1.0 and TLS v1.1 the TLS PRF algorithm is given by:
*
* PRF(secret, label, seed) = P_MD5(S1, label + seed) XOR
* P_SHA-1(S2, label + seed)
*
* where P_MD5 and P_SHA-1 are defined by P_<hash>, below, and S1 and S2 are
* two halves of the secret (with the possibility of one shared byte, in the
* case where the length of the original secret is odd). S1 is taken from the
* first half of the secret, S2 from the second half.
*
* For TLS v1.2 the TLS PRF algorithm is given by:
*
* PRF(secret, label, seed) = P_<hash>(secret, label + seed)
*
* where hash is SHA-256 for all cipher suites defined in RFC 5246 as well as
* those published prior to TLS v1.2 while the TLS v1.2 protocol is in effect,
* unless defined otherwise by the cipher suite.
*
* P_<hash> is an expansion function that uses a single hash function to expand
* a secret and seed into an arbitrary quantity of output:
*
* P_<hash>(secret, seed) = HMAC_<hash>(secret, A(1) + seed) +
* HMAC_<hash>(secret, A(2) + seed) +
* HMAC_<hash>(secret, A(3) + seed) + ...
*
* where + indicates concatenation. P_<hash> can be iterated as many times as
* is necessary to produce the required quantity of data.
*
* A(i) is defined as:
* A(0) = seed
* A(i) = HMAC_<hash>(secret, A(i-1))
*/
#include <stdio.h>
#include <stdarg.h>
#include <string.h>
@@ -82,7 +120,7 @@ static int kdf_tls1_prf_ctrl(EVP_KDF_IMPL *impl, int cmd, va_list args)
if (impl->sec == NULL)
return 0;
impl->seclen = len;
impl->seclen = len;
return 1;
case EVP_KDF_CTRL_RESET_TLS_SEED:
@@ -168,25 +206,41 @@ const EVP_KDF tls1_prf_kdf_meth = {
kdf_tls1_prf_derive
};
/*
* Refer to "The TLS Protocol Version 1.0" Section 5
* (https://tools.ietf.org/html/rfc2246#section-5) and
* "The Transport Layer Security (TLS) Protocol Version 1.2" Section 5
* (https://tools.ietf.org/html/rfc5246#section-5).
*
* P_<hash> is an expansion function that uses a single hash function to expand
* a secret and seed into an arbitrary quantity of output:
*
* P_<hash>(secret, seed) = HMAC_<hash>(secret, A(1) + seed) +
* HMAC_<hash>(secret, A(2) + seed) +
* HMAC_<hash>(secret, A(3) + seed) + ...
*
* where + indicates concatenation. P_<hash> can be iterated as many times as
* is necessary to produce the required quantity of data.
*
* A(i) is defined as:
* A(0) = seed
* A(i) = HMAC_<hash>(secret, A(i-1))
*/
static int tls1_prf_P_hash(const EVP_MD *md,
const unsigned char *sec, size_t sec_len,
const unsigned char *seed, size_t seed_len,
unsigned char *out, size_t olen)
{
int chunk;
EVP_MAC_CTX *ctx = NULL, *ctx_tmp = NULL, *ctx_init = NULL;
unsigned char A1[EVP_MAX_MD_SIZE];
size_t A1_len;
size_t chunk;
EVP_MAC_CTX *ctx = NULL, *ctx_Ai = NULL, *ctx_init = NULL;
unsigned char Ai[EVP_MAX_MD_SIZE];
size_t Ai_len;
int ret = 0;
chunk = EVP_MD_size(md);
if (!ossl_assert(chunk > 0))
goto err;
ctx = EVP_MAC_CTX_new_id(EVP_MAC_HMAC);
ctx_tmp = EVP_MAC_CTX_new_id(EVP_MAC_HMAC);
ctx_Ai = EVP_MAC_CTX_new_id(EVP_MAC_HMAC);
ctx_init = EVP_MAC_CTX_new_id(EVP_MAC_HMAC);
if (ctx == NULL || ctx_tmp == NULL || ctx_init == NULL)
if (ctx == NULL || ctx_Ai == NULL || ctx_init == NULL)
goto err;
if (EVP_MAC_ctrl(ctx_init, EVP_MAC_CTRL_SET_FLAGS, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW) != 1)
goto err;
@@ -196,59 +250,85 @@ static int tls1_prf_P_hash(const EVP_MD *md,
goto err;
if (!EVP_MAC_init(ctx_init))
goto err;
if (!EVP_MAC_CTX_copy(ctx, ctx_init))
chunk = EVP_MAC_size(ctx_init);
if (chunk == 0)
goto err;
if (seed != NULL && !EVP_MAC_update(ctx, seed, seed_len))
/* A(0) = seed */
if (!EVP_MAC_CTX_copy(ctx_Ai, ctx_init))
goto err;
if (!EVP_MAC_final(ctx, A1, &A1_len))
if (seed != NULL && !EVP_MAC_update(ctx_Ai, seed, seed_len))
goto err;
for (;;) {
/* Reinit mac contexts */
/* calc: A(i) = HMAC_<hash>(secret, A(i-1)) */
if (!EVP_MAC_final(ctx_Ai, Ai, &Ai_len))
goto err;
/* calc next chunk: HMAC_<hash>(secret, A(i) + seed) */
if (!EVP_MAC_CTX_copy(ctx, ctx_init))
goto err;
if (!EVP_MAC_update(ctx, A1, A1_len))
if (!EVP_MAC_update(ctx, Ai, Ai_len))
goto err;
if (olen > (size_t)chunk && !EVP_MAC_CTX_copy(ctx_tmp, ctx))
/* save state for calculating next A(i) value */
if (olen > chunk && !EVP_MAC_CTX_copy(ctx_Ai, ctx))
goto err;
if (seed != NULL && !EVP_MAC_update(ctx, seed, seed_len))
goto err;
if (olen > (size_t)chunk) {
size_t mac_len;
if (!EVP_MAC_final(ctx, out, &mac_len))
if (olen <= chunk) {
/* last chunk - use Ai as temp bounce buffer */
if (!EVP_MAC_final(ctx, Ai, &Ai_len))
goto err;
out += mac_len;
olen -= mac_len;
/* calc the next A1 value */
if (!EVP_MAC_final(ctx_tmp, A1, &A1_len))
goto err;
} else { /* last one */
if (!EVP_MAC_final(ctx, A1, &A1_len))
goto err;
memcpy(out, A1, olen);
memcpy(out, Ai, olen);
break;
}
if (!EVP_MAC_final(ctx, out, NULL))
goto err;
out += chunk;
olen -= chunk;
}
ret = 1;
err:
EVP_MAC_CTX_free(ctx);
EVP_MAC_CTX_free(ctx_tmp);
EVP_MAC_CTX_free(ctx_Ai);
EVP_MAC_CTX_free(ctx_init);
OPENSSL_cleanse(A1, sizeof(A1));
OPENSSL_cleanse(Ai, sizeof(Ai));
return ret;
}
/*
* Refer to "The TLS Protocol Version 1.0" Section 5
* (https://tools.ietf.org/html/rfc2246#section-5) and
* "The Transport Layer Security (TLS) Protocol Version 1.2" Section 5
* (https://tools.ietf.org/html/rfc5246#section-5).
*
* For TLS v1.0 and TLS v1.1:
*
* PRF(secret, label, seed) = P_MD5(S1, label + seed) XOR
* P_SHA-1(S2, label + seed)
*
* S1 is taken from the first half of the secret, S2 from the second half.
*
* L_S = length in bytes of secret;
* L_S1 = L_S2 = ceil(L_S / 2);
*
* For TLS v1.2:
*
* PRF(secret, label, seed) = P_<hash>(secret, label + seed)
*/
static int tls1_prf_alg(const EVP_MD *md,
const unsigned char *sec, size_t slen,
const unsigned char *seed, size_t seed_len,
unsigned char *out, size_t olen)
{
if (EVP_MD_type(md) == NID_md5_sha1) {
/* TLS v1.0 and TLS v1.1 */
size_t i;
unsigned char *tmp;
if (!tls1_prf_P_hash(EVP_md5(), sec, slen/2 + (slen & 1),
/* calc: L_S1 = L_S2 = ceil(L_S / 2) */
size_t L_S1 = (slen + 1) / 2;
size_t L_S2 = L_S1;
if (!tls1_prf_P_hash(EVP_md5(), sec, L_S1,
seed, seed_len, out, olen))
return 0;
@@ -256,7 +336,7 @@ static int tls1_prf_alg(const EVP_MD *md,
KDFerr(KDF_F_TLS1_PRF_ALG, ERR_R_MALLOC_FAILURE);
return 0;
}
if (!tls1_prf_P_hash(EVP_sha1(), sec + slen/2, slen/2 + (slen & 1),
if (!tls1_prf_P_hash(EVP_sha1(), sec + slen - L_S2, L_S2,
seed, seed_len, tmp, olen)) {
OPENSSL_clear_free(tmp, olen);
return 0;
@@ -266,6 +346,8 @@ static int tls1_prf_alg(const EVP_MD *md,
OPENSSL_clear_free(tmp, olen);
return 1;
}
/* TLS v1.2 */
if (!tls1_prf_P_hash(md, sec, slen, seed, seed_len, out, olen))
return 0;