1 /*
2 * TLS PRF (SHA1 + MD5)
3 * Copyright (c) 2003-2005, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10
11 #include "common.h"
12 #include "sha1.h"
13 #include "md5.h"
14
15
16 /**
17 * tls_prf_sha1_md5 - Pseudo-Random Function for TLS (TLS-PRF, RFC 2246)
18 * @secret: Key for PRF
19 * @secret_len: Length of the key in bytes
20 * @label: A unique label for each purpose of the PRF
21 * @seed: Seed value to bind into the key
22 * @seed_len: Length of the seed
23 * @out: Buffer for the generated pseudo-random key
24 * @outlen: Number of bytes of key to generate
25 * Returns: 0 on success, -1 on failure.
26 *
27 * This function is used to derive new, cryptographically separate keys from a
28 * given key in TLS. This PRF is defined in RFC 2246, Chapter 5.
29 */
tls_prf_sha1_md5(const u8 * secret,size_t secret_len,const char * label,const u8 * seed,size_t seed_len,u8 * out,size_t outlen)30 int tls_prf_sha1_md5(const u8 *secret, size_t secret_len, const char *label,
31 const u8 *seed, size_t seed_len, u8 *out, size_t outlen)
32 {
33 size_t L_S1, L_S2, i;
34 const u8 *S1, *S2;
35 u8 A_MD5[MD5_MAC_LEN], A_SHA1[SHA1_MAC_LEN];
36 u8 P_MD5[MD5_MAC_LEN], P_SHA1[SHA1_MAC_LEN];
37 int MD5_pos, SHA1_pos;
38 const u8 *MD5_addr[3];
39 size_t MD5_len[3];
40 const unsigned char *SHA1_addr[3];
41 size_t SHA1_len[3];
42
43 if (secret_len & 1)
44 return -1;
45
46 MD5_addr[0] = A_MD5;
47 MD5_len[0] = MD5_MAC_LEN;
48 MD5_addr[1] = (unsigned char *) label;
49 MD5_len[1] = os_strlen(label);
50 MD5_addr[2] = seed;
51 MD5_len[2] = seed_len;
52
53 SHA1_addr[0] = A_SHA1;
54 SHA1_len[0] = SHA1_MAC_LEN;
55 SHA1_addr[1] = (unsigned char *) label;
56 SHA1_len[1] = os_strlen(label);
57 SHA1_addr[2] = seed;
58 SHA1_len[2] = seed_len;
59
60 /* RFC 2246, Chapter 5
61 * A(0) = seed, A(i) = HMAC(secret, A(i-1))
62 * P_hash = HMAC(secret, A(1) + seed) + HMAC(secret, A(2) + seed) + ..
63 * PRF = P_MD5(S1, label + seed) XOR P_SHA-1(S2, label + seed)
64 */
65
66 L_S1 = L_S2 = (secret_len + 1) / 2;
67 S1 = secret;
68 S2 = secret + L_S1;
69 if (secret_len & 1) {
70 /* The last byte of S1 will be shared with S2 */
71 S2--;
72 }
73
74 hmac_md5_vector(S1, L_S1, 2, &MD5_addr[1], &MD5_len[1], A_MD5);
75 hmac_sha1_vector(S2, L_S2, 2, &SHA1_addr[1], &SHA1_len[1], A_SHA1);
76
77 MD5_pos = MD5_MAC_LEN;
78 SHA1_pos = SHA1_MAC_LEN;
79 for (i = 0; i < outlen; i++) {
80 if (MD5_pos == MD5_MAC_LEN) {
81 hmac_md5_vector(S1, L_S1, 3, MD5_addr, MD5_len, P_MD5);
82 MD5_pos = 0;
83 hmac_md5(S1, L_S1, A_MD5, MD5_MAC_LEN, A_MD5);
84 }
85 if (SHA1_pos == SHA1_MAC_LEN) {
86 hmac_sha1_vector(S2, L_S2, 3, SHA1_addr, SHA1_len,
87 P_SHA1);
88 SHA1_pos = 0;
89 hmac_sha1(S2, L_S2, A_SHA1, SHA1_MAC_LEN, A_SHA1);
90 }
91
92 out[i] = P_MD5[MD5_pos] ^ P_SHA1[SHA1_pos];
93
94 MD5_pos++;
95 SHA1_pos++;
96 }
97
98 os_memset(A_MD5, 0, MD5_MAC_LEN);
99 os_memset(P_MD5, 0, MD5_MAC_LEN);
100 os_memset(A_SHA1, 0, SHA1_MAC_LEN);
101 os_memset(P_SHA1, 0, SHA1_MAC_LEN);
102
103 return 0;
104 }
105