1// Copyright 2010 The Go Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style 3// license that can be found in the LICENSE file. 4 5package runner 6 7import ( 8 "crypto" 9 "crypto/aes" 10 "crypto/cipher" 11 "crypto/des" 12 "crypto/hmac" 13 "crypto/md5" 14 "crypto/sha1" 15 "crypto/sha256" 16 "crypto/sha512" 17 "crypto/x509" 18 "hash" 19 20 "golang.org/x/crypto/chacha20poly1305" 21) 22 23// a keyAgreement implements the client and server side of a TLS key agreement 24// protocol by generating and processing key exchange messages. 25type keyAgreement interface { 26 // On the server side, the first two methods are called in order. 27 28 // In the case that the key agreement protocol doesn't use a 29 // ServerKeyExchange message, generateServerKeyExchange can return nil, 30 // nil. 31 generateServerKeyExchange(*Config, *Certificate, *clientHelloMsg, *serverHelloMsg, uint16) (*serverKeyExchangeMsg, error) 32 processClientKeyExchange(*Config, *Certificate, *clientKeyExchangeMsg, uint16) ([]byte, error) 33 34 // On the client side, the next two methods are called in order. 35 36 // This method may not be called if the server doesn't send a 37 // ServerKeyExchange message. 38 processServerKeyExchange(*Config, *clientHelloMsg, *serverHelloMsg, crypto.PublicKey, *serverKeyExchangeMsg) error 39 generateClientKeyExchange(*Config, *clientHelloMsg, *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) 40 41 // peerSignatureAlgorithm returns the signature algorithm used by the 42 // peer, or zero if not applicable. 43 peerSignatureAlgorithm() signatureAlgorithm 44} 45 46const ( 47 // suiteECDH indicates that the cipher suite involves elliptic curve 48 // Diffie-Hellman. This means that it should only be selected when the 49 // client indicates that it supports ECC with a curve and point format 50 // that we're happy with. 51 suiteECDHE = 1 << iota 52 // suiteECDSA indicates that the cipher suite involves an ECDSA 53 // signature and therefore may only be selected when the server's 54 // certificate is ECDSA. If this is not set then the cipher suite is 55 // RSA based. 56 suiteECDSA 57 // suiteTLS12 indicates that the cipher suite should only be advertised 58 // and accepted when using TLS 1.2 or greater. 59 suiteTLS12 60 // suiteTLS13 indicates that the cipher suite can be used with TLS 1.3. 61 // Cipher suites lacking this flag may not be used with TLS 1.3. 62 suiteTLS13 63 // suiteSHA384 indicates that the cipher suite uses SHA384 as the 64 // handshake hash. 65 suiteSHA384 66 // suitePSK indicates that the cipher suite authenticates with 67 // a pre-shared key rather than a server private key. 68 suitePSK 69) 70 71type tlsAead struct { 72 cipher.AEAD 73 explicitNonce bool 74} 75 76// A cipherSuite is a specific combination of key agreement, cipher and MAC 77// function. All cipher suites currently assume RSA key agreement. 78type cipherSuite struct { 79 id uint16 80 // the lengths, in bytes, of the key material needed for each component. 81 keyLen int 82 macLen int 83 ivLen func(version uint16) int 84 ka func(version uint16) keyAgreement 85 // flags is a bitmask of the suite* values, above. 86 flags int 87 cipher func(key, iv []byte, isRead bool) interface{} 88 mac func(version uint16, macKey []byte) macFunction 89 aead func(version uint16, key, fixedNonce []byte) *tlsAead 90} 91 92func (cs cipherSuite) hash() crypto.Hash { 93 if cs.flags&suiteSHA384 != 0 { 94 return crypto.SHA384 95 } 96 return crypto.SHA256 97} 98 99var cipherSuites = []*cipherSuite{ 100 {TLS_CHACHA20_POLY1305_SHA256, 32, 0, ivLenChaCha20Poly1305, nil, suiteTLS13, nil, nil, aeadCHACHA20POLY1305}, 101 {TLS_AES_128_GCM_SHA256, 16, 0, ivLenAESGCM, nil, suiteTLS13, nil, nil, aeadAESGCM}, 102 {TLS_AES_256_GCM_SHA384, 32, 0, ivLenAESGCM, nil, suiteTLS13 | suiteSHA384, nil, nil, aeadAESGCM}, 103 {TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, 32, 0, ivLenChaCha20Poly1305, ecdheECDSAKA, suiteECDHE | suiteECDSA | suiteTLS12, nil, nil, aeadCHACHA20POLY1305}, 104 {TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, 32, 0, ivLenChaCha20Poly1305, ecdheRSAKA, suiteECDHE | suiteTLS12, nil, nil, aeadCHACHA20POLY1305}, 105 {TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 16, 0, ivLenAESGCM, ecdheRSAKA, suiteECDHE | suiteTLS12, nil, nil, aeadAESGCM}, 106 {TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 16, 0, ivLenAESGCM, ecdheECDSAKA, suiteECDHE | suiteECDSA | suiteTLS12, nil, nil, aeadAESGCM}, 107 {TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, 32, 0, ivLenAESGCM, ecdheRSAKA, suiteECDHE | suiteTLS12 | suiteSHA384, nil, nil, aeadAESGCM}, 108 {TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, 32, 0, ivLenAESGCM, ecdheECDSAKA, suiteECDHE | suiteECDSA | suiteTLS12 | suiteSHA384, nil, nil, aeadAESGCM}, 109 {TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, 16, 32, ivLenAES, ecdheRSAKA, suiteECDHE | suiteTLS12, cipherAES, macSHA256, nil}, 110 {TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, 16, 32, ivLenAES, ecdheECDSAKA, suiteECDHE | suiteECDSA | suiteTLS12, cipherAES, macSHA256, nil}, 111 {TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, 16, 20, ivLenAES, ecdheRSAKA, suiteECDHE, cipherAES, macSHA1, nil}, 112 {TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, 16, 20, ivLenAES, ecdheECDSAKA, suiteECDHE | suiteECDSA, cipherAES, macSHA1, nil}, 113 {TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, 32, 48, ivLenAES, ecdheRSAKA, suiteECDHE | suiteTLS12 | suiteSHA384, cipherAES, macSHA384, nil}, 114 {TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, 32, 48, ivLenAES, ecdheECDSAKA, suiteECDHE | suiteECDSA | suiteTLS12 | suiteSHA384, cipherAES, macSHA384, nil}, 115 {TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, 32, 20, ivLenAES, ecdheRSAKA, suiteECDHE, cipherAES, macSHA1, nil}, 116 {TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, 32, 20, ivLenAES, ecdheECDSAKA, suiteECDHE | suiteECDSA, cipherAES, macSHA1, nil}, 117 {TLS_RSA_WITH_AES_128_GCM_SHA256, 16, 0, ivLenAESGCM, rsaKA, suiteTLS12, nil, nil, aeadAESGCM}, 118 {TLS_RSA_WITH_AES_256_GCM_SHA384, 32, 0, ivLenAESGCM, rsaKA, suiteTLS12 | suiteSHA384, nil, nil, aeadAESGCM}, 119 {TLS_RSA_WITH_AES_128_CBC_SHA256, 16, 32, ivLenAES, rsaKA, suiteTLS12, cipherAES, macSHA256, nil}, 120 {TLS_RSA_WITH_AES_256_CBC_SHA256, 32, 32, ivLenAES, rsaKA, suiteTLS12, cipherAES, macSHA256, nil}, 121 {TLS_RSA_WITH_AES_128_CBC_SHA, 16, 20, ivLenAES, rsaKA, 0, cipherAES, macSHA1, nil}, 122 {TLS_RSA_WITH_AES_256_CBC_SHA, 32, 20, ivLenAES, rsaKA, 0, cipherAES, macSHA1, nil}, 123 {TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, 24, 20, ivLen3DES, ecdheRSAKA, suiteECDHE, cipher3DES, macSHA1, nil}, 124 {TLS_RSA_WITH_3DES_EDE_CBC_SHA, 24, 20, ivLen3DES, rsaKA, 0, cipher3DES, macSHA1, nil}, 125 {TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256, 32, 0, ivLenChaCha20Poly1305, ecdhePSKKA, suiteECDHE | suitePSK | suiteTLS12, nil, nil, aeadCHACHA20POLY1305}, 126 {TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA, 16, 20, ivLenAES, ecdhePSKKA, suiteECDHE | suitePSK, cipherAES, macSHA1, nil}, 127 {TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA, 32, 20, ivLenAES, ecdhePSKKA, suiteECDHE | suitePSK, cipherAES, macSHA1, nil}, 128 {TLS_PSK_WITH_AES_128_CBC_SHA, 16, 20, ivLenAES, pskKA, suitePSK, cipherAES, macSHA1, nil}, 129 {TLS_PSK_WITH_AES_256_CBC_SHA, 32, 20, ivLenAES, pskKA, suitePSK, cipherAES, macSHA1, nil}, 130 {TLS_RSA_WITH_NULL_SHA, 0, 20, noIV, rsaKA, 0, cipherNull, macSHA1, nil}, 131} 132 133func noIV(vers uint16) int { 134 return 0 135} 136 137func ivLenChaCha20Poly1305(vers uint16) int { 138 return 12 139} 140 141func ivLenAESGCM(vers uint16) int { 142 if vers >= VersionTLS13 { 143 return 12 144 } 145 return 4 146} 147 148func ivLenAES(vers uint16) int { 149 return 16 150} 151 152func ivLen3DES(vers uint16) int { 153 return 8 154} 155 156type nullCipher struct{} 157 158func cipherNull(key, iv []byte, isRead bool) interface{} { 159 return nullCipher{} 160} 161 162func cipher3DES(key, iv []byte, isRead bool) interface{} { 163 block, _ := des.NewTripleDESCipher(key) 164 if isRead { 165 return cipher.NewCBCDecrypter(block, iv) 166 } 167 return cipher.NewCBCEncrypter(block, iv) 168} 169 170func cipherAES(key, iv []byte, isRead bool) interface{} { 171 block, _ := aes.NewCipher(key) 172 if isRead { 173 return cipher.NewCBCDecrypter(block, iv) 174 } 175 return cipher.NewCBCEncrypter(block, iv) 176} 177 178// macSHA1 returns a macFunction for the given protocol version. 179func macSHA1(version uint16, key []byte) macFunction { 180 if version == VersionSSL30 { 181 mac := ssl30MAC{ 182 h: sha1.New(), 183 key: make([]byte, len(key)), 184 } 185 copy(mac.key, key) 186 return mac 187 } 188 return tls10MAC{hmac.New(sha1.New, key)} 189} 190 191func macMD5(version uint16, key []byte) macFunction { 192 if version == VersionSSL30 { 193 mac := ssl30MAC{ 194 h: md5.New(), 195 key: make([]byte, len(key)), 196 } 197 copy(mac.key, key) 198 return mac 199 } 200 return tls10MAC{hmac.New(md5.New, key)} 201} 202 203func macSHA256(version uint16, key []byte) macFunction { 204 if version == VersionSSL30 { 205 mac := ssl30MAC{ 206 h: sha256.New(), 207 key: make([]byte, len(key)), 208 } 209 copy(mac.key, key) 210 return mac 211 } 212 return tls10MAC{hmac.New(sha256.New, key)} 213} 214 215func macSHA384(version uint16, key []byte) macFunction { 216 if version == VersionSSL30 { 217 mac := ssl30MAC{ 218 h: sha512.New384(), 219 key: make([]byte, len(key)), 220 } 221 copy(mac.key, key) 222 return mac 223 } 224 return tls10MAC{hmac.New(sha512.New384, key)} 225} 226 227type macFunction interface { 228 Size() int 229 MAC(digestBuf, seq, header, length, data []byte) []byte 230} 231 232// fixedNonceAEAD wraps an AEAD and prefixes a fixed portion of the nonce to 233// each call. 234type fixedNonceAEAD struct { 235 // sealNonce and openNonce are buffers where the larger nonce will be 236 // constructed. Since a seal and open operation may be running 237 // concurrently, there is a separate buffer for each. 238 sealNonce, openNonce []byte 239 aead cipher.AEAD 240} 241 242func (f *fixedNonceAEAD) NonceSize() int { return 8 } 243func (f *fixedNonceAEAD) Overhead() int { return f.aead.Overhead() } 244 245func (f *fixedNonceAEAD) Seal(out, nonce, plaintext, additionalData []byte) []byte { 246 copy(f.sealNonce[len(f.sealNonce)-8:], nonce) 247 return f.aead.Seal(out, f.sealNonce, plaintext, additionalData) 248} 249 250func (f *fixedNonceAEAD) Open(out, nonce, plaintext, additionalData []byte) ([]byte, error) { 251 copy(f.openNonce[len(f.openNonce)-8:], nonce) 252 return f.aead.Open(out, f.openNonce, plaintext, additionalData) 253} 254 255func aeadAESGCM(version uint16, key, fixedNonce []byte) *tlsAead { 256 aes, err := aes.NewCipher(key) 257 if err != nil { 258 panic(err) 259 } 260 aead, err := cipher.NewGCM(aes) 261 if err != nil { 262 panic(err) 263 } 264 265 nonce1, nonce2 := make([]byte, 12), make([]byte, 12) 266 copy(nonce1, fixedNonce) 267 copy(nonce2, fixedNonce) 268 269 if version >= VersionTLS13 { 270 return &tlsAead{&xorNonceAEAD{nonce1, nonce2, aead}, false} 271 } 272 273 return &tlsAead{&fixedNonceAEAD{nonce1, nonce2, aead}, true} 274} 275 276func xorSlice(out, in []byte) { 277 for i := range out { 278 out[i] ^= in[i] 279 } 280} 281 282// xorNonceAEAD wraps an AEAD and XORs a fixed portion of the nonce, left-padded 283// if necessary, each call. 284type xorNonceAEAD struct { 285 // sealNonce and openNonce are buffers where the larger nonce will be 286 // constructed. Since a seal and open operation may be running 287 // concurrently, there is a separate buffer for each. 288 sealNonce, openNonce []byte 289 aead cipher.AEAD 290} 291 292func (x *xorNonceAEAD) NonceSize() int { return 8 } 293func (x *xorNonceAEAD) Overhead() int { return x.aead.Overhead() } 294 295func (x *xorNonceAEAD) Seal(out, nonce, plaintext, additionalData []byte) []byte { 296 xorSlice(x.sealNonce[len(x.sealNonce)-len(nonce):], nonce) 297 ret := x.aead.Seal(out, x.sealNonce, plaintext, additionalData) 298 xorSlice(x.sealNonce[len(x.sealNonce)-len(nonce):], nonce) 299 return ret 300} 301 302func (x *xorNonceAEAD) Open(out, nonce, plaintext, additionalData []byte) ([]byte, error) { 303 xorSlice(x.openNonce[len(x.openNonce)-len(nonce):], nonce) 304 ret, err := x.aead.Open(out, x.openNonce, plaintext, additionalData) 305 xorSlice(x.openNonce[len(x.openNonce)-len(nonce):], nonce) 306 return ret, err 307} 308 309func aeadCHACHA20POLY1305(version uint16, key, fixedNonce []byte) *tlsAead { 310 aead, err := chacha20poly1305.New(key) 311 if err != nil { 312 panic(err) 313 } 314 315 nonce1, nonce2 := make([]byte, len(fixedNonce)), make([]byte, len(fixedNonce)) 316 copy(nonce1, fixedNonce) 317 copy(nonce2, fixedNonce) 318 319 return &tlsAead{&xorNonceAEAD{nonce1, nonce2, aead}, false} 320} 321 322// ssl30MAC implements the SSLv3 MAC function, as defined in 323// www.mozilla.org/projects/security/pki/nss/ssl/draft302.txt section 5.2.3.1 324type ssl30MAC struct { 325 h hash.Hash 326 key []byte 327} 328 329func (s ssl30MAC) Size() int { 330 return s.h.Size() 331} 332 333var ssl30Pad1 = [48]byte{0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36} 334 335var ssl30Pad2 = [48]byte{0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c} 336 337func (s ssl30MAC) MAC(digestBuf, seq, header, length, data []byte) []byte { 338 padLength := 48 339 if s.h.Size() == 20 { 340 padLength = 40 341 } 342 343 s.h.Reset() 344 s.h.Write(s.key) 345 s.h.Write(ssl30Pad1[:padLength]) 346 s.h.Write(seq) 347 s.h.Write(header[:1]) 348 s.h.Write(length) 349 s.h.Write(data) 350 digestBuf = s.h.Sum(digestBuf[:0]) 351 352 s.h.Reset() 353 s.h.Write(s.key) 354 s.h.Write(ssl30Pad2[:padLength]) 355 s.h.Write(digestBuf) 356 return s.h.Sum(digestBuf[:0]) 357} 358 359// tls10MAC implements the TLS 1.0 MAC function. RFC 2246, section 6.2.3. 360type tls10MAC struct { 361 h hash.Hash 362} 363 364func (s tls10MAC) Size() int { 365 return s.h.Size() 366} 367 368func (s tls10MAC) MAC(digestBuf, seq, header, length, data []byte) []byte { 369 s.h.Reset() 370 s.h.Write(seq) 371 s.h.Write(header) 372 s.h.Write(length) 373 s.h.Write(data) 374 return s.h.Sum(digestBuf[:0]) 375} 376 377func rsaKA(version uint16) keyAgreement { 378 return &rsaKeyAgreement{version: version} 379} 380 381func ecdheECDSAKA(version uint16) keyAgreement { 382 return &ecdheKeyAgreement{ 383 auth: &signedKeyAgreement{ 384 keyType: keyTypeECDSA, 385 version: version, 386 }, 387 } 388} 389 390func ecdheRSAKA(version uint16) keyAgreement { 391 return &ecdheKeyAgreement{ 392 auth: &signedKeyAgreement{ 393 keyType: keyTypeRSA, 394 version: version, 395 }, 396 } 397} 398 399func pskKA(version uint16) keyAgreement { 400 return &pskKeyAgreement{ 401 base: &nilKeyAgreement{}, 402 } 403} 404 405func ecdhePSKKA(version uint16) keyAgreement { 406 return &pskKeyAgreement{ 407 base: &ecdheKeyAgreement{ 408 auth: &nilKeyAgreementAuthentication{}, 409 }, 410 } 411} 412 413// mutualCipherSuite returns a cipherSuite given a list of supported 414// ciphersuites and the id requested by the peer. 415func mutualCipherSuite(have []uint16, want uint16) *cipherSuite { 416 for _, id := range have { 417 if id == want { 418 return cipherSuiteFromID(id) 419 } 420 } 421 return nil 422} 423 424func cipherSuiteFromID(id uint16) *cipherSuite { 425 for _, suite := range cipherSuites { 426 if suite.id == id { 427 return suite 428 } 429 } 430 return nil 431} 432 433// A list of the possible cipher suite ids. Taken from 434// http://www.iana.org/assignments/tls-parameters/tls-parameters.xml 435const ( 436 TLS_RSA_WITH_NULL_SHA uint16 = 0x0002 437 TLS_RSA_WITH_3DES_EDE_CBC_SHA uint16 = 0x000a 438 TLS_RSA_WITH_AES_128_CBC_SHA uint16 = 0x002f 439 TLS_RSA_WITH_AES_256_CBC_SHA uint16 = 0x0035 440 TLS_RSA_WITH_AES_128_CBC_SHA256 uint16 = 0x003c 441 TLS_RSA_WITH_AES_256_CBC_SHA256 uint16 = 0x003d 442 TLS_PSK_WITH_AES_128_CBC_SHA uint16 = 0x008c 443 TLS_PSK_WITH_AES_256_CBC_SHA uint16 = 0x008d 444 TLS_RSA_WITH_AES_128_GCM_SHA256 uint16 = 0x009c 445 TLS_RSA_WITH_AES_256_GCM_SHA384 uint16 = 0x009d 446 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA uint16 = 0xc009 447 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA uint16 = 0xc00a 448 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA uint16 = 0xc012 449 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA uint16 = 0xc013 450 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA uint16 = 0xc014 451 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 uint16 = 0xc023 452 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 uint16 = 0xc024 453 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 uint16 = 0xc027 454 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 uint16 = 0xc028 455 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 uint16 = 0xc02b 456 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 uint16 = 0xc02c 457 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 uint16 = 0xc02f 458 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 uint16 = 0xc030 459 TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA uint16 = 0xc035 460 TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA uint16 = 0xc036 461 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 uint16 = 0xcca8 462 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 uint16 = 0xcca9 463 TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 uint16 = 0xccac 464 renegotiationSCSV uint16 = 0x00ff 465 fallbackSCSV uint16 = 0x5600 466) 467 468// Additional cipher suite IDs, not IANA-assigned. 469const ( 470 TLS_AES_128_GCM_SHA256 uint16 = 0x1301 471 TLS_AES_256_GCM_SHA384 uint16 = 0x1302 472 TLS_CHACHA20_POLY1305_SHA256 uint16 = 0x1303 473) 474