| /* |
| * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved. |
| * |
| * Licensed under the Apache License 2.0 (the "License"). You may not use |
| * this file except in compliance with the License. You can obtain a copy |
| * in the file LICENSE in the source distribution or at |
| * https://www.openssl.org/source/license.html |
| */ |
| |
| /* |
| * HMAC low level APIs are deprecated for public use, but still ok for internal |
| * use. |
| */ |
| #include "internal/deprecated.h" |
| |
| #include <stdlib.h> |
| #include <stdarg.h> |
| #include <string.h> |
| #include <openssl/hmac.h> |
| #include <openssl/evp.h> |
| #include <openssl/kdf.h> |
| #include <openssl/core_names.h> |
| #include <openssl/proverr.h> |
| #include "internal/cryptlib.h" |
| #include "internal/numbers.h" |
| #include "internal/packet.h" |
| #include "crypto/evp.h" |
| #include "prov/provider_ctx.h" |
| #include "prov/providercommon.h" |
| #include "prov/implementations.h" |
| #include "prov/provider_util.h" |
| #include "internal/e_os.h" |
| |
| #define HKDF_MAXBUF 2048 |
| |
| static OSSL_FUNC_kdf_newctx_fn kdf_hkdf_new; |
| static OSSL_FUNC_kdf_dupctx_fn kdf_hkdf_dup; |
| static OSSL_FUNC_kdf_freectx_fn kdf_hkdf_free; |
| static OSSL_FUNC_kdf_reset_fn kdf_hkdf_reset; |
| static OSSL_FUNC_kdf_derive_fn kdf_hkdf_derive; |
| static OSSL_FUNC_kdf_settable_ctx_params_fn kdf_hkdf_settable_ctx_params; |
| static OSSL_FUNC_kdf_set_ctx_params_fn kdf_hkdf_set_ctx_params; |
| static OSSL_FUNC_kdf_gettable_ctx_params_fn kdf_hkdf_gettable_ctx_params; |
| static OSSL_FUNC_kdf_get_ctx_params_fn kdf_hkdf_get_ctx_params; |
| static OSSL_FUNC_kdf_derive_fn kdf_tls1_3_derive; |
| static OSSL_FUNC_kdf_settable_ctx_params_fn kdf_tls1_3_settable_ctx_params; |
| static OSSL_FUNC_kdf_set_ctx_params_fn kdf_tls1_3_set_ctx_params; |
| |
| static int HKDF(OSSL_LIB_CTX *libctx, const EVP_MD *evp_md, |
| const unsigned char *salt, size_t salt_len, |
| const unsigned char *key, size_t key_len, |
| const unsigned char *info, size_t info_len, |
| unsigned char *okm, size_t okm_len); |
| static int HKDF_Extract(OSSL_LIB_CTX *libctx, const EVP_MD *evp_md, |
| const unsigned char *salt, size_t salt_len, |
| const unsigned char *ikm, size_t ikm_len, |
| unsigned char *prk, size_t prk_len); |
| static int HKDF_Expand(const EVP_MD *evp_md, |
| const unsigned char *prk, size_t prk_len, |
| const unsigned char *info, size_t info_len, |
| unsigned char *okm, size_t okm_len); |
| |
| /* Settable context parameters that are common across HKDF and the TLS KDF */ |
| #define HKDF_COMMON_SETTABLES \ |
| OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_MODE, NULL, 0), \ |
| OSSL_PARAM_int(OSSL_KDF_PARAM_MODE, NULL), \ |
| OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_PROPERTIES, NULL, 0), \ |
| OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_DIGEST, NULL, 0), \ |
| OSSL_PARAM_octet_string(OSSL_KDF_PARAM_KEY, NULL, 0), \ |
| OSSL_PARAM_octet_string(OSSL_KDF_PARAM_SALT, NULL, 0) |
| |
| typedef struct { |
| void *provctx; |
| int mode; |
| PROV_DIGEST digest; |
| unsigned char *salt; |
| size_t salt_len; |
| unsigned char *key; |
| size_t key_len; |
| unsigned char *prefix; |
| size_t prefix_len; |
| unsigned char *label; |
| size_t label_len; |
| unsigned char *data; |
| size_t data_len; |
| unsigned char info[HKDF_MAXBUF]; |
| size_t info_len; |
| } KDF_HKDF; |
| |
| static void *kdf_hkdf_new(void *provctx) |
| { |
| KDF_HKDF *ctx; |
| |
| if (!ossl_prov_is_running()) |
| return NULL; |
| |
| if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) |
| ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE); |
| else |
| ctx->provctx = provctx; |
| return ctx; |
| } |
| |
| static void kdf_hkdf_free(void *vctx) |
| { |
| KDF_HKDF *ctx = (KDF_HKDF *)vctx; |
| |
| if (ctx != NULL) { |
| kdf_hkdf_reset(ctx); |
| OPENSSL_free(ctx); |
| } |
| } |
| |
| static void kdf_hkdf_reset(void *vctx) |
| { |
| KDF_HKDF *ctx = (KDF_HKDF *)vctx; |
| void *provctx = ctx->provctx; |
| |
| ossl_prov_digest_reset(&ctx->digest); |
| OPENSSL_free(ctx->salt); |
| OPENSSL_free(ctx->prefix); |
| OPENSSL_free(ctx->label); |
| OPENSSL_clear_free(ctx->data, ctx->data_len); |
| OPENSSL_clear_free(ctx->key, ctx->key_len); |
| OPENSSL_cleanse(ctx->info, ctx->info_len); |
| memset(ctx, 0, sizeof(*ctx)); |
| ctx->provctx = provctx; |
| } |
| |
| static void *kdf_hkdf_dup(void *vctx) |
| { |
| const KDF_HKDF *src = (const KDF_HKDF *)vctx; |
| KDF_HKDF *dest; |
| |
| dest = kdf_hkdf_new(src->provctx); |
| if (dest != NULL) { |
| if (!ossl_prov_memdup(src->salt, src->salt_len, &dest->salt, |
| &dest->salt_len) |
| || !ossl_prov_memdup(src->key, src->key_len, |
| &dest->key , &dest->key_len) |
| || !ossl_prov_memdup(src->prefix, src->prefix_len, |
| &dest->prefix, &dest->prefix_len) |
| || !ossl_prov_memdup(src->label, src->label_len, |
| &dest->label, &dest->label_len) |
| || !ossl_prov_memdup(src->data, src->data_len, |
| &dest->data, &dest->data_len) |
| || !ossl_prov_digest_copy(&dest->digest, &src->digest)) |
| goto err; |
| memcpy(dest->info, src->info, sizeof(dest->info)); |
| dest->info_len = src->info_len; |
| dest->mode = src->mode; |
| } |
| return dest; |
| |
| err: |
| kdf_hkdf_free(dest); |
| return NULL; |
| } |
| |
| static size_t kdf_hkdf_size(KDF_HKDF *ctx) |
| { |
| int sz; |
| const EVP_MD *md = ossl_prov_digest_md(&ctx->digest); |
| |
| if (ctx->mode != EVP_KDF_HKDF_MODE_EXTRACT_ONLY) |
| return SIZE_MAX; |
| |
| if (md == NULL) { |
| ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST); |
| return 0; |
| } |
| sz = EVP_MD_get_size(md); |
| if (sz < 0) |
| return 0; |
| |
| return sz; |
| } |
| |
| static int kdf_hkdf_derive(void *vctx, unsigned char *key, size_t keylen, |
| const OSSL_PARAM params[]) |
| { |
| KDF_HKDF *ctx = (KDF_HKDF *)vctx; |
| OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx); |
| const EVP_MD *md; |
| |
| if (!ossl_prov_is_running() || !kdf_hkdf_set_ctx_params(ctx, params)) |
| return 0; |
| |
| md = ossl_prov_digest_md(&ctx->digest); |
| if (md == NULL) { |
| ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST); |
| return 0; |
| } |
| if (ctx->key == NULL) { |
| ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_KEY); |
| return 0; |
| } |
| if (keylen == 0) { |
| ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH); |
| return 0; |
| } |
| |
| switch (ctx->mode) { |
| case EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND: |
| default: |
| return HKDF(libctx, md, ctx->salt, ctx->salt_len, |
| ctx->key, ctx->key_len, ctx->info, ctx->info_len, key, keylen); |
| |
| case EVP_KDF_HKDF_MODE_EXTRACT_ONLY: |
| return HKDF_Extract(libctx, md, ctx->salt, ctx->salt_len, |
| ctx->key, ctx->key_len, key, keylen); |
| |
| case EVP_KDF_HKDF_MODE_EXPAND_ONLY: |
| return HKDF_Expand(md, ctx->key, ctx->key_len, ctx->info, |
| ctx->info_len, key, keylen); |
| } |
| } |
| |
| static int hkdf_common_set_ctx_params(KDF_HKDF *ctx, const OSSL_PARAM params[]) |
| { |
| OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx); |
| const OSSL_PARAM *p; |
| int n; |
| |
| if (params == NULL) |
| return 1; |
| |
| if (!ossl_prov_digest_load_from_params(&ctx->digest, params, libctx)) |
| return 0; |
| |
| if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_MODE)) != NULL) { |
| if (p->data_type == OSSL_PARAM_UTF8_STRING) { |
| if (OPENSSL_strcasecmp(p->data, "EXTRACT_AND_EXPAND") == 0) { |
| ctx->mode = EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND; |
| } else if (OPENSSL_strcasecmp(p->data, "EXTRACT_ONLY") == 0) { |
| ctx->mode = EVP_KDF_HKDF_MODE_EXTRACT_ONLY; |
| } else if (OPENSSL_strcasecmp(p->data, "EXPAND_ONLY") == 0) { |
| ctx->mode = EVP_KDF_HKDF_MODE_EXPAND_ONLY; |
| } else { |
| ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE); |
| return 0; |
| } |
| } else if (OSSL_PARAM_get_int(p, &n)) { |
| if (n != EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND |
| && n != EVP_KDF_HKDF_MODE_EXTRACT_ONLY |
| && n != EVP_KDF_HKDF_MODE_EXPAND_ONLY) { |
| ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE); |
| return 0; |
| } |
| ctx->mode = n; |
| } else { |
| ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE); |
| return 0; |
| } |
| } |
| |
| if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_KEY)) != NULL) { |
| OPENSSL_clear_free(ctx->key, ctx->key_len); |
| ctx->key = NULL; |
| if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->key, 0, |
| &ctx->key_len)) |
| return 0; |
| } |
| |
| if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_SALT)) != NULL) { |
| if (p->data_size != 0 && p->data != NULL) { |
| OPENSSL_free(ctx->salt); |
| ctx->salt = NULL; |
| if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->salt, 0, |
| &ctx->salt_len)) |
| return 0; |
| } |
| } |
| |
| return 1; |
| } |
| |
| static int kdf_hkdf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) |
| { |
| const OSSL_PARAM *p; |
| KDF_HKDF *ctx = vctx; |
| |
| if (params == NULL) |
| return 1; |
| |
| if (!hkdf_common_set_ctx_params(ctx, params)) |
| return 0; |
| |
| /* The info fields concatenate, so process them all */ |
| if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_INFO)) != NULL) { |
| ctx->info_len = 0; |
| for (; p != NULL; p = OSSL_PARAM_locate_const(p + 1, |
| OSSL_KDF_PARAM_INFO)) { |
| const void *q = ctx->info + ctx->info_len; |
| size_t sz = 0; |
| |
| if (p->data_size != 0 |
| && p->data != NULL |
| && !OSSL_PARAM_get_octet_string(p, (void **)&q, |
| HKDF_MAXBUF - ctx->info_len, |
| &sz)) |
| return 0; |
| ctx->info_len += sz; |
| } |
| } |
| return 1; |
| } |
| |
| static const OSSL_PARAM *kdf_hkdf_settable_ctx_params(ossl_unused void *ctx, |
| ossl_unused void *provctx) |
| { |
| static const OSSL_PARAM known_settable_ctx_params[] = { |
| HKDF_COMMON_SETTABLES, |
| OSSL_PARAM_octet_string(OSSL_KDF_PARAM_INFO, NULL, 0), |
| OSSL_PARAM_END |
| }; |
| return known_settable_ctx_params; |
| } |
| |
| static int kdf_hkdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) |
| { |
| KDF_HKDF *ctx = (KDF_HKDF *)vctx; |
| OSSL_PARAM *p; |
| |
| if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_SIZE)) != NULL) { |
| size_t sz = kdf_hkdf_size(ctx); |
| |
| if (sz == 0) |
| return 0; |
| return OSSL_PARAM_set_size_t(p, sz); |
| } |
| return -2; |
| } |
| |
| static const OSSL_PARAM *kdf_hkdf_gettable_ctx_params(ossl_unused void *ctx, |
| ossl_unused void *provctx) |
| { |
| static const OSSL_PARAM known_gettable_ctx_params[] = { |
| OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL), |
| OSSL_PARAM_END |
| }; |
| return known_gettable_ctx_params; |
| } |
| |
| const OSSL_DISPATCH ossl_kdf_hkdf_functions[] = { |
| { OSSL_FUNC_KDF_NEWCTX, (void(*)(void))kdf_hkdf_new }, |
| { OSSL_FUNC_KDF_DUPCTX, (void(*)(void))kdf_hkdf_dup }, |
| { OSSL_FUNC_KDF_FREECTX, (void(*)(void))kdf_hkdf_free }, |
| { OSSL_FUNC_KDF_RESET, (void(*)(void))kdf_hkdf_reset }, |
| { OSSL_FUNC_KDF_DERIVE, (void(*)(void))kdf_hkdf_derive }, |
| { OSSL_FUNC_KDF_SETTABLE_CTX_PARAMS, |
| (void(*)(void))kdf_hkdf_settable_ctx_params }, |
| { OSSL_FUNC_KDF_SET_CTX_PARAMS, (void(*)(void))kdf_hkdf_set_ctx_params }, |
| { OSSL_FUNC_KDF_GETTABLE_CTX_PARAMS, |
| (void(*)(void))kdf_hkdf_gettable_ctx_params }, |
| { OSSL_FUNC_KDF_GET_CTX_PARAMS, (void(*)(void))kdf_hkdf_get_ctx_params }, |
| { 0, NULL } |
| }; |
| |
| /* |
| * Refer to "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)" |
| * Section 2 (https://tools.ietf.org/html/rfc5869#section-2) and |
| * "Cryptographic Extraction and Key Derivation: The HKDF Scheme" |
| * Section 4.2 (https://eprint.iacr.org/2010/264.pdf). |
| * |
| * From the paper: |
| * The scheme HKDF is specified as: |
| * HKDF(XTS, SKM, CTXinfo, L) = K(1) | K(2) | ... | K(t) |
| * |
| * where: |
| * SKM is source key material |
| * XTS is extractor salt (which may be null or constant) |
| * CTXinfo is context information (may be null) |
| * L is the number of key bits to be produced by KDF |
| * k is the output length in bits of the hash function used with HMAC |
| * t = ceil(L/k) |
| * the value K(t) is truncated to its first d = L mod k bits. |
| * |
| * From RFC 5869: |
| * 2.2. Step 1: Extract |
| * HKDF-Extract(salt, IKM) -> PRK |
| * 2.3. Step 2: Expand |
| * HKDF-Expand(PRK, info, L) -> OKM |
| */ |
| static int HKDF(OSSL_LIB_CTX *libctx, const EVP_MD *evp_md, |
| const unsigned char *salt, size_t salt_len, |
| const unsigned char *ikm, size_t ikm_len, |
| const unsigned char *info, size_t info_len, |
| unsigned char *okm, size_t okm_len) |
| { |
| unsigned char prk[EVP_MAX_MD_SIZE]; |
| int ret, sz; |
| size_t prk_len; |
| |
| sz = EVP_MD_get_size(evp_md); |
| if (sz < 0) |
| return 0; |
| prk_len = (size_t)sz; |
| |
| /* Step 1: HKDF-Extract(salt, IKM) -> PRK */ |
| if (!HKDF_Extract(libctx, evp_md, |
| salt, salt_len, ikm, ikm_len, prk, prk_len)) |
| return 0; |
| |
| /* Step 2: HKDF-Expand(PRK, info, L) -> OKM */ |
| ret = HKDF_Expand(evp_md, prk, prk_len, info, info_len, okm, okm_len); |
| OPENSSL_cleanse(prk, sizeof(prk)); |
| |
| return ret; |
| } |
| |
| /* |
| * Refer to "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)" |
| * Section 2.2 (https://tools.ietf.org/html/rfc5869#section-2.2). |
| * |
| * 2.2. Step 1: Extract |
| * |
| * HKDF-Extract(salt, IKM) -> PRK |
| * |
| * Options: |
| * Hash a hash function; HashLen denotes the length of the |
| * hash function output in octets |
| * |
| * Inputs: |
| * salt optional salt value (a non-secret random value); |
| * if not provided, it is set to a string of HashLen zeros. |
| * IKM input keying material |
| * |
| * Output: |
| * PRK a pseudorandom key (of HashLen octets) |
| * |
| * The output PRK is calculated as follows: |
| * |
| * PRK = HMAC-Hash(salt, IKM) |
| */ |
| static int HKDF_Extract(OSSL_LIB_CTX *libctx, const EVP_MD *evp_md, |
| const unsigned char *salt, size_t salt_len, |
| const unsigned char *ikm, size_t ikm_len, |
| unsigned char *prk, size_t prk_len) |
| { |
| int sz = EVP_MD_get_size(evp_md); |
| |
| if (sz < 0) |
| return 0; |
| if (prk_len != (size_t)sz) { |
| ERR_raise(ERR_LIB_PROV, PROV_R_WRONG_OUTPUT_BUFFER_SIZE); |
| return 0; |
| } |
| /* calc: PRK = HMAC-Hash(salt, IKM) */ |
| return |
| EVP_Q_mac(libctx, "HMAC", NULL, EVP_MD_get0_name(evp_md), NULL, salt, |
| salt_len, ikm, ikm_len, prk, EVP_MD_get_size(evp_md), NULL) |
| != NULL; |
| } |
| |
| /* |
| * Refer to "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)" |
| * Section 2.3 (https://tools.ietf.org/html/rfc5869#section-2.3). |
| * |
| * 2.3. Step 2: Expand |
| * |
| * HKDF-Expand(PRK, info, L) -> OKM |
| * |
| * Options: |
| * Hash a hash function; HashLen denotes the length of the |
| * hash function output in octets |
| * |
| * Inputs: |
| * PRK a pseudorandom key of at least HashLen octets |
| * (usually, the output from the extract step) |
| * info optional context and application specific information |
| * (can be a zero-length string) |
| * L length of output keying material in octets |
| * (<= 255*HashLen) |
| * |
| * Output: |
| * OKM output keying material (of L octets) |
| * |
| * The output OKM is calculated as follows: |
| * |
| * N = ceil(L/HashLen) |
| * T = T(1) | T(2) | T(3) | ... | T(N) |
| * OKM = first L octets of T |
| * |
| * where: |
| * T(0) = empty string (zero length) |
| * T(1) = HMAC-Hash(PRK, T(0) | info | 0x01) |
| * T(2) = HMAC-Hash(PRK, T(1) | info | 0x02) |
| * T(3) = HMAC-Hash(PRK, T(2) | info | 0x03) |
| * ... |
| * |
| * (where the constant concatenated to the end of each T(n) is a |
| * single octet.) |
| */ |
| static int HKDF_Expand(const EVP_MD *evp_md, |
| const unsigned char *prk, size_t prk_len, |
| const unsigned char *info, size_t info_len, |
| unsigned char *okm, size_t okm_len) |
| { |
| HMAC_CTX *hmac; |
| int ret = 0, sz; |
| unsigned int i; |
| unsigned char prev[EVP_MAX_MD_SIZE]; |
| size_t done_len = 0, dig_len, n; |
| |
| sz = EVP_MD_get_size(evp_md); |
| if (sz <= 0) |
| return 0; |
| dig_len = (size_t)sz; |
| |
| /* calc: N = ceil(L/HashLen) */ |
| n = okm_len / dig_len; |
| if (okm_len % dig_len) |
| n++; |
| |
| if (n > 255 || okm == NULL) |
| return 0; |
| |
| if ((hmac = HMAC_CTX_new()) == NULL) |
| return 0; |
| |
| if (!HMAC_Init_ex(hmac, prk, prk_len, evp_md, NULL)) |
| goto err; |
| |
| for (i = 1; i <= n; i++) { |
| size_t copy_len; |
| const unsigned char ctr = i; |
| |
| /* calc: T(i) = HMAC-Hash(PRK, T(i - 1) | info | i) */ |
| if (i > 1) { |
| if (!HMAC_Init_ex(hmac, NULL, 0, NULL, NULL)) |
| goto err; |
| |
| if (!HMAC_Update(hmac, prev, dig_len)) |
| goto err; |
| } |
| |
| if (!HMAC_Update(hmac, info, info_len)) |
| goto err; |
| |
| if (!HMAC_Update(hmac, &ctr, 1)) |
| goto err; |
| |
| if (!HMAC_Final(hmac, prev, NULL)) |
| goto err; |
| |
| copy_len = (done_len + dig_len > okm_len) ? |
| okm_len - done_len : |
| dig_len; |
| |
| memcpy(okm + done_len, prev, copy_len); |
| |
| done_len += copy_len; |
| } |
| ret = 1; |
| |
| err: |
| OPENSSL_cleanse(prev, sizeof(prev)); |
| HMAC_CTX_free(hmac); |
| return ret; |
| } |
| |
| /* |
| * TLS uses slight variations of the above and for FIPS validation purposes, |
| * they need to be present here. |
| * Refer to RFC 8446 section 7 for specific details. |
| */ |
| |
| /* |
| * Given a |secret|; a |label| of length |labellen|; and |data| of length |
| * |datalen| (e.g. typically a hash of the handshake messages), derive a new |
| * secret |outlen| bytes long and store it in the location pointed to be |out|. |
| * The |data| value may be zero length. Returns 1 on success and 0 on failure. |
| */ |
| static int prov_tls13_hkdf_expand(const EVP_MD *md, |
| const unsigned char *key, size_t keylen, |
| const unsigned char *prefix, size_t prefixlen, |
| const unsigned char *label, size_t labellen, |
| const unsigned char *data, size_t datalen, |
| unsigned char *out, size_t outlen) |
| { |
| size_t hkdflabellen; |
| unsigned char hkdflabel[HKDF_MAXBUF]; |
| WPACKET pkt; |
| |
| /* |
| * 2 bytes for length of derived secret + 1 byte for length of combined |
| * prefix and label + bytes for the label itself + 1 byte length of hash |
| * + bytes for the hash itself. We've got the maximum the KDF can handle |
| * which should always be sufficient. |
| */ |
| if (!WPACKET_init_static_len(&pkt, hkdflabel, sizeof(hkdflabel), 0) |
| || !WPACKET_put_bytes_u16(&pkt, outlen) |
| || !WPACKET_start_sub_packet_u8(&pkt) |
| || !WPACKET_memcpy(&pkt, prefix, prefixlen) |
| || !WPACKET_memcpy(&pkt, label, labellen) |
| || !WPACKET_close(&pkt) |
| || !WPACKET_sub_memcpy_u8(&pkt, data, (data == NULL) ? 0 : datalen) |
| || !WPACKET_get_total_written(&pkt, &hkdflabellen) |
| || !WPACKET_finish(&pkt)) { |
| WPACKET_cleanup(&pkt); |
| return 0; |
| } |
| |
| return HKDF_Expand(md, key, keylen, hkdflabel, hkdflabellen, |
| out, outlen); |
| } |
| |
| static int prov_tls13_hkdf_generate_secret(OSSL_LIB_CTX *libctx, |
| const EVP_MD *md, |
| const unsigned char *prevsecret, |
| size_t prevsecretlen, |
| const unsigned char *insecret, |
| size_t insecretlen, |
| const unsigned char *prefix, |
| size_t prefixlen, |
| const unsigned char *label, |
| size_t labellen, |
| unsigned char *out, size_t outlen) |
| { |
| size_t mdlen; |
| int ret; |
| unsigned char preextractsec[EVP_MAX_MD_SIZE]; |
| /* Always filled with zeros */ |
| static const unsigned char default_zeros[EVP_MAX_MD_SIZE]; |
| |
| ret = EVP_MD_get_size(md); |
| /* Ensure cast to size_t is safe */ |
| if (ret <= 0) |
| return 0; |
| mdlen = (size_t)ret; |
| |
| if (insecret == NULL) { |
| insecret = default_zeros; |
| insecretlen = mdlen; |
| } |
| if (prevsecret == NULL) { |
| prevsecret = default_zeros; |
| prevsecretlen = 0; |
| } else { |
| EVP_MD_CTX *mctx = EVP_MD_CTX_new(); |
| unsigned char hash[EVP_MAX_MD_SIZE]; |
| |
| /* The pre-extract derive step uses a hash of no messages */ |
| if (mctx == NULL |
| || EVP_DigestInit_ex(mctx, md, NULL) <= 0 |
| || EVP_DigestFinal_ex(mctx, hash, NULL) <= 0) { |
| EVP_MD_CTX_free(mctx); |
| return 0; |
| } |
| EVP_MD_CTX_free(mctx); |
| |
| /* Generate the pre-extract secret */ |
| if (!prov_tls13_hkdf_expand(md, prevsecret, mdlen, |
| prefix, prefixlen, label, labellen, |
| hash, mdlen, preextractsec, mdlen)) |
| return 0; |
| prevsecret = preextractsec; |
| prevsecretlen = mdlen; |
| } |
| |
| ret = HKDF_Extract(libctx, md, prevsecret, prevsecretlen, |
| insecret, insecretlen, out, outlen); |
| |
| if (prevsecret == preextractsec) |
| OPENSSL_cleanse(preextractsec, mdlen); |
| return ret; |
| } |
| |
| static int kdf_tls1_3_derive(void *vctx, unsigned char *key, size_t keylen, |
| const OSSL_PARAM params[]) |
| { |
| KDF_HKDF *ctx = (KDF_HKDF *)vctx; |
| const EVP_MD *md; |
| |
| if (!ossl_prov_is_running() || !kdf_tls1_3_set_ctx_params(ctx, params)) |
| return 0; |
| |
| md = ossl_prov_digest_md(&ctx->digest); |
| if (md == NULL) { |
| ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST); |
| return 0; |
| } |
| |
| switch (ctx->mode) { |
| default: |
| return 0; |
| |
| case EVP_KDF_HKDF_MODE_EXTRACT_ONLY: |
| return prov_tls13_hkdf_generate_secret(PROV_LIBCTX_OF(ctx->provctx), |
| md, |
| ctx->salt, ctx->salt_len, |
| ctx->key, ctx->key_len, |
| ctx->prefix, ctx->prefix_len, |
| ctx->label, ctx->label_len, |
| key, keylen); |
| |
| case EVP_KDF_HKDF_MODE_EXPAND_ONLY: |
| return prov_tls13_hkdf_expand(md, ctx->key, ctx->key_len, |
| ctx->prefix, ctx->prefix_len, |
| ctx->label, ctx->label_len, |
| ctx->data, ctx->data_len, |
| key, keylen); |
| } |
| } |
| |
| static int kdf_tls1_3_set_ctx_params(void *vctx, const OSSL_PARAM params[]) |
| { |
| const OSSL_PARAM *p; |
| KDF_HKDF *ctx = vctx; |
| |
| if (params == NULL) |
| return 1; |
| |
| if (!hkdf_common_set_ctx_params(ctx, params)) |
| return 0; |
| |
| if (ctx->mode == EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND) { |
| ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE); |
| return 0; |
| } |
| |
| if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_PREFIX)) != NULL) { |
| OPENSSL_free(ctx->prefix); |
| ctx->prefix = NULL; |
| if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->prefix, 0, |
| &ctx->prefix_len)) |
| return 0; |
| } |
| |
| if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_LABEL)) != NULL) { |
| OPENSSL_free(ctx->label); |
| ctx->label = NULL; |
| if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->label, 0, |
| &ctx->label_len)) |
| return 0; |
| } |
| |
| OPENSSL_clear_free(ctx->data, ctx->data_len); |
| ctx->data = NULL; |
| if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_DATA)) != NULL |
| && !OSSL_PARAM_get_octet_string(p, (void **)&ctx->data, 0, |
| &ctx->data_len)) |
| return 0; |
| return 1; |
| } |
| |
| static const OSSL_PARAM *kdf_tls1_3_settable_ctx_params(ossl_unused void *ctx, |
| ossl_unused void *provctx) |
| { |
| static const OSSL_PARAM known_settable_ctx_params[] = { |
| HKDF_COMMON_SETTABLES, |
| OSSL_PARAM_octet_string(OSSL_KDF_PARAM_PREFIX, NULL, 0), |
| OSSL_PARAM_octet_string(OSSL_KDF_PARAM_LABEL, NULL, 0), |
| OSSL_PARAM_octet_string(OSSL_KDF_PARAM_DATA, NULL, 0), |
| OSSL_PARAM_END |
| }; |
| return known_settable_ctx_params; |
| } |
| |
| const OSSL_DISPATCH ossl_kdf_tls1_3_kdf_functions[] = { |
| { OSSL_FUNC_KDF_NEWCTX, (void(*)(void))kdf_hkdf_new }, |
| { OSSL_FUNC_KDF_DUPCTX, (void(*)(void))kdf_hkdf_dup }, |
| { OSSL_FUNC_KDF_FREECTX, (void(*)(void))kdf_hkdf_free }, |
| { OSSL_FUNC_KDF_RESET, (void(*)(void))kdf_hkdf_reset }, |
| { OSSL_FUNC_KDF_DERIVE, (void(*)(void))kdf_tls1_3_derive }, |
| { OSSL_FUNC_KDF_SETTABLE_CTX_PARAMS, |
| (void(*)(void))kdf_tls1_3_settable_ctx_params }, |
| { OSSL_FUNC_KDF_SET_CTX_PARAMS, (void(*)(void))kdf_tls1_3_set_ctx_params }, |
| { OSSL_FUNC_KDF_GETTABLE_CTX_PARAMS, |
| (void(*)(void))kdf_hkdf_gettable_ctx_params }, |
| { OSSL_FUNC_KDF_GET_CTX_PARAMS, (void(*)(void))kdf_hkdf_get_ctx_params }, |
| { 0, NULL } |
| }; |
