1// Copyright 2010 The Go Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style 3// license that can be found in the LICENSE file. 4 5package runner 6 7import ( 8 "crypto" 9 "crypto/ecdsa" 10 "crypto/elliptic" 11 "crypto/md5" 12 "crypto/rand" 13 "crypto/rsa" 14 "crypto/sha1" 15 "crypto/subtle" 16 "crypto/x509" 17 "encoding/asn1" 18 "errors" 19 "fmt" 20 "io" 21 "math/big" 22 23 "./curve25519" 24) 25 26var errClientKeyExchange = errors.New("tls: invalid ClientKeyExchange message") 27var errServerKeyExchange = errors.New("tls: invalid ServerKeyExchange message") 28 29// rsaKeyAgreement implements the standard TLS key agreement where the client 30// encrypts the pre-master secret to the server's public key. 31type rsaKeyAgreement struct { 32 version uint16 33 clientVersion uint16 34 exportKey *rsa.PrivateKey 35} 36 37func (ka *rsaKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) { 38 // Save the client version for comparison later. 39 ka.clientVersion = versionToWire(clientHello.vers, clientHello.isDTLS) 40 41 if !config.Bugs.RSAEphemeralKey { 42 return nil, nil 43 } 44 45 // Generate an ephemeral RSA key to use instead of the real 46 // one, as in RSA_EXPORT. 47 key, err := rsa.GenerateKey(config.rand(), 512) 48 if err != nil { 49 return nil, err 50 } 51 ka.exportKey = key 52 53 modulus := key.N.Bytes() 54 exponent := big.NewInt(int64(key.E)).Bytes() 55 serverRSAParams := make([]byte, 0, 2+len(modulus)+2+len(exponent)) 56 serverRSAParams = append(serverRSAParams, byte(len(modulus)>>8), byte(len(modulus))) 57 serverRSAParams = append(serverRSAParams, modulus...) 58 serverRSAParams = append(serverRSAParams, byte(len(exponent)>>8), byte(len(exponent))) 59 serverRSAParams = append(serverRSAParams, exponent...) 60 61 var tls12HashId uint8 62 if ka.version >= VersionTLS12 { 63 if tls12HashId, err = pickTLS12HashForSignature(signatureRSA, clientHello.signatureAndHashes, config.signatureAndHashesForServer()); err != nil { 64 return nil, err 65 } 66 } 67 68 digest, hashFunc, err := hashForServerKeyExchange(signatureRSA, tls12HashId, ka.version, clientHello.random, hello.random, serverRSAParams) 69 if err != nil { 70 return nil, err 71 } 72 privKey, ok := cert.PrivateKey.(*rsa.PrivateKey) 73 if !ok { 74 return nil, errors.New("RSA ephemeral key requires an RSA server private key") 75 } 76 sig, err := rsa.SignPKCS1v15(config.rand(), privKey, hashFunc, digest) 77 if err != nil { 78 return nil, errors.New("failed to sign RSA parameters: " + err.Error()) 79 } 80 81 skx := new(serverKeyExchangeMsg) 82 sigAndHashLen := 0 83 if ka.version >= VersionTLS12 { 84 sigAndHashLen = 2 85 } 86 skx.key = make([]byte, len(serverRSAParams)+sigAndHashLen+2+len(sig)) 87 copy(skx.key, serverRSAParams) 88 k := skx.key[len(serverRSAParams):] 89 if ka.version >= VersionTLS12 { 90 k[0] = tls12HashId 91 k[1] = signatureRSA 92 k = k[2:] 93 } 94 k[0] = byte(len(sig) >> 8) 95 k[1] = byte(len(sig)) 96 copy(k[2:], sig) 97 98 return skx, nil 99} 100 101func (ka *rsaKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) { 102 preMasterSecret := make([]byte, 48) 103 _, err := io.ReadFull(config.rand(), preMasterSecret[2:]) 104 if err != nil { 105 return nil, err 106 } 107 108 if len(ckx.ciphertext) < 2 { 109 return nil, errClientKeyExchange 110 } 111 112 ciphertext := ckx.ciphertext 113 if version != VersionSSL30 { 114 ciphertextLen := int(ckx.ciphertext[0])<<8 | int(ckx.ciphertext[1]) 115 if ciphertextLen != len(ckx.ciphertext)-2 { 116 return nil, errClientKeyExchange 117 } 118 ciphertext = ckx.ciphertext[2:] 119 } 120 121 key := cert.PrivateKey.(*rsa.PrivateKey) 122 if ka.exportKey != nil { 123 key = ka.exportKey 124 } 125 err = rsa.DecryptPKCS1v15SessionKey(config.rand(), key, ciphertext, preMasterSecret) 126 if err != nil { 127 return nil, err 128 } 129 // This check should be done in constant-time, but this is a testing 130 // implementation. See the discussion at the end of section 7.4.7.1 of 131 // RFC 4346. 132 vers := uint16(preMasterSecret[0])<<8 | uint16(preMasterSecret[1]) 133 if ka.clientVersion != vers { 134 return nil, errors.New("tls: invalid version in RSA premaster") 135 } 136 return preMasterSecret, nil 137} 138 139func (ka *rsaKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error { 140 return errors.New("tls: unexpected ServerKeyExchange") 141} 142 143func (ka *rsaKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) { 144 bad := config.Bugs.BadRSAClientKeyExchange 145 preMasterSecret := make([]byte, 48) 146 vers := clientHello.vers 147 if bad == RSABadValueWrongVersion { 148 vers ^= 1 149 } 150 vers = versionToWire(vers, clientHello.isDTLS) 151 preMasterSecret[0] = byte(vers >> 8) 152 preMasterSecret[1] = byte(vers) 153 _, err := io.ReadFull(config.rand(), preMasterSecret[2:]) 154 if err != nil { 155 return nil, nil, err 156 } 157 158 sentPreMasterSecret := preMasterSecret 159 if bad == RSABadValueTooLong { 160 sentPreMasterSecret = make([]byte, len(sentPreMasterSecret)+1) 161 copy(sentPreMasterSecret, preMasterSecret) 162 } else if bad == RSABadValueTooShort { 163 sentPreMasterSecret = sentPreMasterSecret[:len(sentPreMasterSecret)-1] 164 } 165 166 encrypted, err := rsa.EncryptPKCS1v15(config.rand(), cert.PublicKey.(*rsa.PublicKey), sentPreMasterSecret) 167 if err != nil { 168 return nil, nil, err 169 } 170 if bad == RSABadValueCorrupt { 171 encrypted[len(encrypted)-1] ^= 1 172 // Clear the high byte to ensure |encrypted| is still below the RSA modulus. 173 encrypted[0] = 0 174 } 175 ckx := new(clientKeyExchangeMsg) 176 if clientHello.vers != VersionSSL30 { 177 ckx.ciphertext = make([]byte, len(encrypted)+2) 178 ckx.ciphertext[0] = byte(len(encrypted) >> 8) 179 ckx.ciphertext[1] = byte(len(encrypted)) 180 copy(ckx.ciphertext[2:], encrypted) 181 } else { 182 ckx.ciphertext = encrypted 183 } 184 return preMasterSecret, ckx, nil 185} 186 187// sha1Hash calculates a SHA1 hash over the given byte slices. 188func sha1Hash(slices [][]byte) []byte { 189 hsha1 := sha1.New() 190 for _, slice := range slices { 191 hsha1.Write(slice) 192 } 193 return hsha1.Sum(nil) 194} 195 196// md5SHA1Hash implements TLS 1.0's hybrid hash function which consists of the 197// concatenation of an MD5 and SHA1 hash. 198func md5SHA1Hash(slices [][]byte) []byte { 199 md5sha1 := make([]byte, md5.Size+sha1.Size) 200 hmd5 := md5.New() 201 for _, slice := range slices { 202 hmd5.Write(slice) 203 } 204 copy(md5sha1, hmd5.Sum(nil)) 205 copy(md5sha1[md5.Size:], sha1Hash(slices)) 206 return md5sha1 207} 208 209// hashForServerKeyExchange hashes the given slices and returns their digest 210// and the identifier of the hash function used. The hashFunc argument is only 211// used for >= TLS 1.2 and precisely identifies the hash function to use. 212func hashForServerKeyExchange(sigType, hashFunc uint8, version uint16, slices ...[]byte) ([]byte, crypto.Hash, error) { 213 if version >= VersionTLS12 { 214 hash, err := lookupTLSHash(hashFunc) 215 if err != nil { 216 return nil, 0, err 217 } 218 h := hash.New() 219 for _, slice := range slices { 220 h.Write(slice) 221 } 222 return h.Sum(nil), hash, nil 223 } 224 if sigType == signatureECDSA { 225 return sha1Hash(slices), crypto.SHA1, nil 226 } 227 return md5SHA1Hash(slices), crypto.MD5SHA1, nil 228} 229 230// pickTLS12HashForSignature returns a TLS 1.2 hash identifier for signing a 231// ServerKeyExchange given the signature type being used and the client's 232// advertized list of supported signature and hash combinations. 233func pickTLS12HashForSignature(sigType uint8, clientList, serverList []signatureAndHash) (uint8, error) { 234 if len(clientList) == 0 { 235 // If the client didn't specify any signature_algorithms 236 // extension then we can assume that it supports SHA1. See 237 // http://tools.ietf.org/html/rfc5246#section-7.4.1.4.1 238 return hashSHA1, nil 239 } 240 241 for _, sigAndHash := range clientList { 242 if sigAndHash.signature != sigType { 243 continue 244 } 245 if isSupportedSignatureAndHash(sigAndHash, serverList) { 246 return sigAndHash.hash, nil 247 } 248 } 249 250 return 0, errors.New("tls: client doesn't support any common hash functions") 251} 252 253// A ecdhCurve is an instance of ECDH-style key agreement for TLS. 254type ecdhCurve interface { 255 // generateKeypair generates a keypair using rand. It returns the 256 // encoded public key. 257 generateKeypair(rand io.Reader) (publicKey []byte, err error) 258 259 // computeSecret performs a key exchange against peerKey and returns 260 // the resulting shared secret. 261 computeSecret(peerKey []byte) (preMasterSecret []byte, err error) 262} 263 264// ellipticECDHCurve implements ecdhCurve with an elliptic.Curve. 265type ellipticECDHCurve struct { 266 curve elliptic.Curve 267 privateKey []byte 268} 269 270func (e *ellipticECDHCurve) generateKeypair(rand io.Reader) (publicKey []byte, err error) { 271 var x, y *big.Int 272 e.privateKey, x, y, err = elliptic.GenerateKey(e.curve, rand) 273 if err != nil { 274 return nil, err 275 } 276 return elliptic.Marshal(e.curve, x, y), nil 277} 278 279func (e *ellipticECDHCurve) computeSecret(peerKey []byte) (preMasterSecret []byte, err error) { 280 x, y := elliptic.Unmarshal(e.curve, peerKey) 281 if x == nil { 282 return nil, errors.New("tls: invalid peer key") 283 } 284 x, _ = e.curve.ScalarMult(x, y, e.privateKey) 285 preMasterSecret = make([]byte, (e.curve.Params().BitSize+7)>>3) 286 xBytes := x.Bytes() 287 copy(preMasterSecret[len(preMasterSecret)-len(xBytes):], xBytes) 288 289 return preMasterSecret, nil 290} 291 292// x25519ECDHCurve implements ecdhCurve with X25519. 293type x25519ECDHCurve struct { 294 privateKey [32]byte 295} 296 297func (e *x25519ECDHCurve) generateKeypair(rand io.Reader) (publicKey []byte, err error) { 298 _, err = io.ReadFull(rand, e.privateKey[:]) 299 if err != nil { 300 return 301 } 302 var out [32]byte 303 curve25519.ScalarBaseMult(&out, &e.privateKey) 304 return out[:], nil 305} 306 307func (e *x25519ECDHCurve) computeSecret(peerKey []byte) (preMasterSecret []byte, err error) { 308 if len(peerKey) != 32 { 309 return nil, errors.New("tls: invalid peer key") 310 } 311 var out, peerKeyCopy [32]byte 312 copy(peerKeyCopy[:], peerKey) 313 curve25519.ScalarMult(&out, &e.privateKey, &peerKeyCopy) 314 315 // Per draft-irtf-cfrg-curves-11, reject the all-zero value in constant 316 // time. 317 var zeros [32]byte 318 if subtle.ConstantTimeCompare(zeros[:], out[:]) == 1 { 319 return nil, errors.New("tls: X25519 value with wrong order") 320 } 321 322 return out[:], nil 323} 324 325func curveForCurveID(id CurveID) (ecdhCurve, bool) { 326 switch id { 327 case CurveP224: 328 return &ellipticECDHCurve{curve: elliptic.P224()}, true 329 case CurveP256: 330 return &ellipticECDHCurve{curve: elliptic.P256()}, true 331 case CurveP384: 332 return &ellipticECDHCurve{curve: elliptic.P384()}, true 333 case CurveP521: 334 return &ellipticECDHCurve{curve: elliptic.P521()}, true 335 case CurveX25519: 336 return &x25519ECDHCurve{}, true 337 default: 338 return nil, false 339 } 340 341} 342 343// keyAgreementAuthentication is a helper interface that specifies how 344// to authenticate the ServerKeyExchange parameters. 345type keyAgreementAuthentication interface { 346 signParameters(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg, params []byte) (*serverKeyExchangeMsg, error) 347 verifyParameters(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, params []byte, sig []byte) error 348} 349 350// nilKeyAgreementAuthentication does not authenticate the key 351// agreement parameters. 352type nilKeyAgreementAuthentication struct{} 353 354func (ka *nilKeyAgreementAuthentication) signParameters(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg, params []byte) (*serverKeyExchangeMsg, error) { 355 skx := new(serverKeyExchangeMsg) 356 skx.key = params 357 return skx, nil 358} 359 360func (ka *nilKeyAgreementAuthentication) verifyParameters(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, params []byte, sig []byte) error { 361 return nil 362} 363 364func maybeCorruptECDSAValue(n *big.Int, typeOfCorruption BadValue, limit *big.Int) *big.Int { 365 switch typeOfCorruption { 366 case BadValueNone: 367 return n 368 case BadValueNegative: 369 return new(big.Int).Neg(n) 370 case BadValueZero: 371 return big.NewInt(0) 372 case BadValueLimit: 373 return limit 374 case BadValueLarge: 375 bad := new(big.Int).Set(limit) 376 return bad.Lsh(bad, 20) 377 default: 378 panic("unknown BadValue type") 379 } 380} 381 382// signedKeyAgreement signs the ServerKeyExchange parameters with the 383// server's private key. 384type signedKeyAgreement struct { 385 version uint16 386 sigType uint8 387} 388 389func (ka *signedKeyAgreement) signParameters(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg, params []byte) (*serverKeyExchangeMsg, error) { 390 var tls12HashId uint8 391 var err error 392 if ka.version >= VersionTLS12 { 393 if tls12HashId, err = pickTLS12HashForSignature(ka.sigType, clientHello.signatureAndHashes, config.signatureAndHashesForServer()); err != nil { 394 return nil, err 395 } 396 } 397 398 digest, hashFunc, err := hashForServerKeyExchange(ka.sigType, tls12HashId, ka.version, clientHello.random, hello.random, params) 399 if err != nil { 400 return nil, err 401 } 402 403 if config.Bugs.InvalidSKXSignature { 404 digest[0] ^= 0x80 405 } 406 407 var sig []byte 408 switch ka.sigType { 409 case signatureECDSA: 410 privKey, ok := cert.PrivateKey.(*ecdsa.PrivateKey) 411 if !ok { 412 return nil, errors.New("ECDHE ECDSA requires an ECDSA server private key") 413 } 414 r, s, err := ecdsa.Sign(config.rand(), privKey, digest) 415 if err != nil { 416 return nil, errors.New("failed to sign ECDHE parameters: " + err.Error()) 417 } 418 order := privKey.Curve.Params().N 419 r = maybeCorruptECDSAValue(r, config.Bugs.BadECDSAR, order) 420 s = maybeCorruptECDSAValue(s, config.Bugs.BadECDSAS, order) 421 sig, err = asn1.Marshal(ecdsaSignature{r, s}) 422 case signatureRSA: 423 privKey, ok := cert.PrivateKey.(*rsa.PrivateKey) 424 if !ok { 425 return nil, errors.New("ECDHE RSA requires a RSA server private key") 426 } 427 sig, err = rsa.SignPKCS1v15(config.rand(), privKey, hashFunc, digest) 428 if err != nil { 429 return nil, errors.New("failed to sign ECDHE parameters: " + err.Error()) 430 } 431 default: 432 return nil, errors.New("unknown ECDHE signature algorithm") 433 } 434 435 skx := new(serverKeyExchangeMsg) 436 if config.Bugs.UnauthenticatedECDH { 437 skx.key = params 438 } else { 439 sigAndHashLen := 0 440 if ka.version >= VersionTLS12 { 441 sigAndHashLen = 2 442 } 443 skx.key = make([]byte, len(params)+sigAndHashLen+2+len(sig)) 444 copy(skx.key, params) 445 k := skx.key[len(params):] 446 if ka.version >= VersionTLS12 { 447 k[0] = tls12HashId 448 k[1] = ka.sigType 449 k = k[2:] 450 } 451 k[0] = byte(len(sig) >> 8) 452 k[1] = byte(len(sig)) 453 copy(k[2:], sig) 454 } 455 456 return skx, nil 457} 458 459func (ka *signedKeyAgreement) verifyParameters(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, params []byte, sig []byte) error { 460 if len(sig) < 2 { 461 return errServerKeyExchange 462 } 463 464 var tls12HashId uint8 465 if ka.version >= VersionTLS12 { 466 // handle SignatureAndHashAlgorithm 467 var sigAndHash []uint8 468 sigAndHash, sig = sig[:2], sig[2:] 469 if sigAndHash[1] != ka.sigType { 470 return errServerKeyExchange 471 } 472 tls12HashId = sigAndHash[0] 473 if len(sig) < 2 { 474 return errServerKeyExchange 475 } 476 477 if !isSupportedSignatureAndHash(signatureAndHash{ka.sigType, tls12HashId}, config.signatureAndHashesForClient()) { 478 return errors.New("tls: unsupported hash function for ServerKeyExchange") 479 } 480 } 481 sigLen := int(sig[0])<<8 | int(sig[1]) 482 if sigLen+2 != len(sig) { 483 return errServerKeyExchange 484 } 485 sig = sig[2:] 486 487 digest, hashFunc, err := hashForServerKeyExchange(ka.sigType, tls12HashId, ka.version, clientHello.random, serverHello.random, params) 488 if err != nil { 489 return err 490 } 491 switch ka.sigType { 492 case signatureECDSA: 493 pubKey, ok := cert.PublicKey.(*ecdsa.PublicKey) 494 if !ok { 495 return errors.New("ECDHE ECDSA requires a ECDSA server public key") 496 } 497 ecdsaSig := new(ecdsaSignature) 498 if _, err := asn1.Unmarshal(sig, ecdsaSig); err != nil { 499 return err 500 } 501 if ecdsaSig.R.Sign() <= 0 || ecdsaSig.S.Sign() <= 0 { 502 return errors.New("ECDSA signature contained zero or negative values") 503 } 504 if !ecdsa.Verify(pubKey, digest, ecdsaSig.R, ecdsaSig.S) { 505 return errors.New("ECDSA verification failure") 506 } 507 case signatureRSA: 508 pubKey, ok := cert.PublicKey.(*rsa.PublicKey) 509 if !ok { 510 return errors.New("ECDHE RSA requires a RSA server public key") 511 } 512 if err := rsa.VerifyPKCS1v15(pubKey, hashFunc, digest, sig); err != nil { 513 return err 514 } 515 default: 516 return errors.New("unknown ECDHE signature algorithm") 517 } 518 519 return nil 520} 521 522// ecdheRSAKeyAgreement implements a TLS key agreement where the server 523// generates a ephemeral EC public/private key pair and signs it. The 524// pre-master secret is then calculated using ECDH. The signature may 525// either be ECDSA or RSA. 526type ecdheKeyAgreement struct { 527 auth keyAgreementAuthentication 528 curve ecdhCurve 529 peerKey []byte 530} 531 532func (ka *ecdheKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) { 533 var curveid CurveID 534 preferredCurves := config.curvePreferences() 535 536NextCandidate: 537 for _, candidate := range preferredCurves { 538 for _, c := range clientHello.supportedCurves { 539 if candidate == c { 540 curveid = c 541 break NextCandidate 542 } 543 } 544 } 545 546 if curveid == 0 { 547 return nil, errors.New("tls: no supported elliptic curves offered") 548 } 549 550 var ok bool 551 if ka.curve, ok = curveForCurveID(curveid); !ok { 552 return nil, errors.New("tls: preferredCurves includes unsupported curve") 553 } 554 555 publicKey, err := ka.curve.generateKeypair(config.rand()) 556 if err != nil { 557 return nil, err 558 } 559 560 // http://tools.ietf.org/html/rfc4492#section-5.4 561 serverECDHParams := make([]byte, 1+2+1+len(publicKey)) 562 serverECDHParams[0] = 3 // named curve 563 serverECDHParams[1] = byte(curveid >> 8) 564 serverECDHParams[2] = byte(curveid) 565 if config.Bugs.InvalidSKXCurve { 566 serverECDHParams[2] ^= 0xff 567 } 568 serverECDHParams[3] = byte(len(publicKey)) 569 copy(serverECDHParams[4:], publicKey) 570 571 return ka.auth.signParameters(config, cert, clientHello, hello, serverECDHParams) 572} 573 574func (ka *ecdheKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) { 575 if len(ckx.ciphertext) == 0 || int(ckx.ciphertext[0]) != len(ckx.ciphertext)-1 { 576 return nil, errClientKeyExchange 577 } 578 return ka.curve.computeSecret(ckx.ciphertext[1:]) 579} 580 581func (ka *ecdheKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error { 582 if len(skx.key) < 4 { 583 return errServerKeyExchange 584 } 585 if skx.key[0] != 3 { // named curve 586 return errors.New("tls: server selected unsupported curve") 587 } 588 curveid := CurveID(skx.key[1])<<8 | CurveID(skx.key[2]) 589 590 var ok bool 591 if ka.curve, ok = curveForCurveID(curveid); !ok { 592 return errors.New("tls: server selected unsupported curve") 593 } 594 595 publicLen := int(skx.key[3]) 596 if publicLen+4 > len(skx.key) { 597 return errServerKeyExchange 598 } 599 // Save the peer key for later. 600 ka.peerKey = skx.key[4 : 4+publicLen] 601 602 // Check the signature. 603 serverECDHParams := skx.key[:4+publicLen] 604 sig := skx.key[4+publicLen:] 605 return ka.auth.verifyParameters(config, clientHello, serverHello, cert, serverECDHParams, sig) 606} 607 608func (ka *ecdheKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) { 609 if ka.curve == nil { 610 return nil, nil, errors.New("missing ServerKeyExchange message") 611 } 612 613 publicKey, err := ka.curve.generateKeypair(config.rand()) 614 if err != nil { 615 return nil, nil, err 616 } 617 preMasterSecret, err := ka.curve.computeSecret(ka.peerKey) 618 if err != nil { 619 return nil, nil, err 620 } 621 622 ckx := new(clientKeyExchangeMsg) 623 ckx.ciphertext = make([]byte, 1+len(publicKey)) 624 ckx.ciphertext[0] = byte(len(publicKey)) 625 copy(ckx.ciphertext[1:], publicKey) 626 627 return preMasterSecret, ckx, nil 628} 629 630// dheRSAKeyAgreement implements a TLS key agreement where the server generates 631// an ephemeral Diffie-Hellman public/private key pair and signs it. The 632// pre-master secret is then calculated using Diffie-Hellman. 633type dheKeyAgreement struct { 634 auth keyAgreementAuthentication 635 p, g *big.Int 636 yTheirs *big.Int 637 xOurs *big.Int 638} 639 640func (ka *dheKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) { 641 var q *big.Int 642 if p := config.Bugs.DHGroupPrime; p != nil { 643 ka.p = p 644 ka.g = big.NewInt(2) 645 q = p 646 } else { 647 // 2048-bit MODP Group with 256-bit Prime Order Subgroup (RFC 648 // 5114, Section 2.3) 649 ka.p, _ = new(big.Int).SetString("87A8E61DB4B6663CFFBBD19C651959998CEEF608660DD0F25D2CEED4435E3B00E00DF8F1D61957D4FAF7DF4561B2AA3016C3D91134096FAA3BF4296D830E9A7C209E0C6497517ABD5A8A9D306BCF67ED91F9E6725B4758C022E0B1EF4275BF7B6C5BFC11D45F9088B941F54EB1E59BB8BC39A0BF12307F5C4FDB70C581B23F76B63ACAE1CAA6B7902D52526735488A0EF13C6D9A51BFA4AB3AD8347796524D8EF6A167B5A41825D967E144E5140564251CCACB83E6B486F6B3CA3F7971506026C0B857F689962856DED4010ABD0BE621C3A3960A54E710C375F26375D7014103A4B54330C198AF126116D2276E11715F693877FAD7EF09CADB094AE91E1A1597", 16) 650 ka.g, _ = new(big.Int).SetString("3FB32C9B73134D0B2E77506660EDBD484CA7B18F21EF205407F4793A1A0BA12510DBC15077BE463FFF4FED4AAC0BB555BE3A6C1B0C6B47B1BC3773BF7E8C6F62901228F8C28CBB18A55AE31341000A650196F931C77A57F2DDF463E5E9EC144B777DE62AAAB8A8628AC376D282D6ED3864E67982428EBC831D14348F6F2F9193B5045AF2767164E1DFC967C1FB3F2E55A4BD1BFFE83B9C80D052B985D182EA0ADB2A3B7313D3FE14C8484B1E052588B9B7D2BBD2DF016199ECD06E1557CD0915B3353BBB64E0EC377FD028370DF92B52C7891428CDC67EB6184B523D1DB246C32F63078490F00EF8D647D148D47954515E2327CFEF98C582664B4C0F6CC41659", 16) 651 q, _ = new(big.Int).SetString("8CF83642A709A097B447997640129DA299B1A47D1EB3750BA308B0FE64F5FBD3", 16) 652 } 653 654 var err error 655 ka.xOurs, err = rand.Int(config.rand(), q) 656 if err != nil { 657 return nil, err 658 } 659 yOurs := new(big.Int).Exp(ka.g, ka.xOurs, ka.p) 660 661 // http://tools.ietf.org/html/rfc5246#section-7.4.3 662 pBytes := ka.p.Bytes() 663 gBytes := ka.g.Bytes() 664 yBytes := yOurs.Bytes() 665 serverDHParams := make([]byte, 0, 2+len(pBytes)+2+len(gBytes)+2+len(yBytes)) 666 serverDHParams = append(serverDHParams, byte(len(pBytes)>>8), byte(len(pBytes))) 667 serverDHParams = append(serverDHParams, pBytes...) 668 serverDHParams = append(serverDHParams, byte(len(gBytes)>>8), byte(len(gBytes))) 669 serverDHParams = append(serverDHParams, gBytes...) 670 serverDHParams = append(serverDHParams, byte(len(yBytes)>>8), byte(len(yBytes))) 671 serverDHParams = append(serverDHParams, yBytes...) 672 673 return ka.auth.signParameters(config, cert, clientHello, hello, serverDHParams) 674} 675 676func (ka *dheKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) { 677 if len(ckx.ciphertext) < 2 { 678 return nil, errClientKeyExchange 679 } 680 yLen := (int(ckx.ciphertext[0]) << 8) | int(ckx.ciphertext[1]) 681 if yLen != len(ckx.ciphertext)-2 { 682 return nil, errClientKeyExchange 683 } 684 yTheirs := new(big.Int).SetBytes(ckx.ciphertext[2:]) 685 if yTheirs.Sign() <= 0 || yTheirs.Cmp(ka.p) >= 0 { 686 return nil, errClientKeyExchange 687 } 688 return new(big.Int).Exp(yTheirs, ka.xOurs, ka.p).Bytes(), nil 689} 690 691func (ka *dheKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error { 692 // Read dh_p 693 k := skx.key 694 if len(k) < 2 { 695 return errServerKeyExchange 696 } 697 pLen := (int(k[0]) << 8) | int(k[1]) 698 k = k[2:] 699 if len(k) < pLen { 700 return errServerKeyExchange 701 } 702 ka.p = new(big.Int).SetBytes(k[:pLen]) 703 k = k[pLen:] 704 705 // Read dh_g 706 if len(k) < 2 { 707 return errServerKeyExchange 708 } 709 gLen := (int(k[0]) << 8) | int(k[1]) 710 k = k[2:] 711 if len(k) < gLen { 712 return errServerKeyExchange 713 } 714 ka.g = new(big.Int).SetBytes(k[:gLen]) 715 k = k[gLen:] 716 717 // Read dh_Ys 718 if len(k) < 2 { 719 return errServerKeyExchange 720 } 721 yLen := (int(k[0]) << 8) | int(k[1]) 722 k = k[2:] 723 if len(k) < yLen { 724 return errServerKeyExchange 725 } 726 ka.yTheirs = new(big.Int).SetBytes(k[:yLen]) 727 k = k[yLen:] 728 if ka.yTheirs.Sign() <= 0 || ka.yTheirs.Cmp(ka.p) >= 0 { 729 return errServerKeyExchange 730 } 731 732 if l := config.Bugs.RequireDHPublicValueLen; l != 0 && l != yLen { 733 return fmt.Errorf("RequireDHPublicValueLen set to %d, but server's public value was %d bytes on the wire and %d bytes if minimal", l, yLen, (ka.yTheirs.BitLen()+7)/8) 734 } 735 736 sig := k 737 serverDHParams := skx.key[:len(skx.key)-len(sig)] 738 739 return ka.auth.verifyParameters(config, clientHello, serverHello, cert, serverDHParams, sig) 740} 741 742func (ka *dheKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) { 743 if ka.p == nil || ka.g == nil || ka.yTheirs == nil { 744 return nil, nil, errors.New("missing ServerKeyExchange message") 745 } 746 747 xOurs, err := rand.Int(config.rand(), ka.p) 748 if err != nil { 749 return nil, nil, err 750 } 751 preMasterSecret := new(big.Int).Exp(ka.yTheirs, xOurs, ka.p).Bytes() 752 753 yOurs := new(big.Int).Exp(ka.g, xOurs, ka.p) 754 yBytes := yOurs.Bytes() 755 ckx := new(clientKeyExchangeMsg) 756 ckx.ciphertext = make([]byte, 2+len(yBytes)) 757 ckx.ciphertext[0] = byte(len(yBytes) >> 8) 758 ckx.ciphertext[1] = byte(len(yBytes)) 759 copy(ckx.ciphertext[2:], yBytes) 760 761 return preMasterSecret, ckx, nil 762} 763 764// nilKeyAgreement is a fake key agreement used to implement the plain PSK key 765// exchange. 766type nilKeyAgreement struct{} 767 768func (ka *nilKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) { 769 return nil, nil 770} 771 772func (ka *nilKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) { 773 if len(ckx.ciphertext) != 0 { 774 return nil, errClientKeyExchange 775 } 776 777 // Although in plain PSK, otherSecret is all zeros, the base key 778 // agreement does not access to the length of the pre-shared 779 // key. pskKeyAgreement instead interprets nil to mean to use all zeros 780 // of the appropriate length. 781 return nil, nil 782} 783 784func (ka *nilKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error { 785 if len(skx.key) != 0 { 786 return errServerKeyExchange 787 } 788 return nil 789} 790 791func (ka *nilKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) { 792 // Although in plain PSK, otherSecret is all zeros, the base key 793 // agreement does not access to the length of the pre-shared 794 // key. pskKeyAgreement instead interprets nil to mean to use all zeros 795 // of the appropriate length. 796 return nil, &clientKeyExchangeMsg{}, nil 797} 798 799// makePSKPremaster formats a PSK pre-master secret based on otherSecret from 800// the base key exchange and psk. 801func makePSKPremaster(otherSecret, psk []byte) []byte { 802 out := make([]byte, 0, 2+len(otherSecret)+2+len(psk)) 803 out = append(out, byte(len(otherSecret)>>8), byte(len(otherSecret))) 804 out = append(out, otherSecret...) 805 out = append(out, byte(len(psk)>>8), byte(len(psk))) 806 out = append(out, psk...) 807 return out 808} 809 810// pskKeyAgreement implements the PSK key agreement. 811type pskKeyAgreement struct { 812 base keyAgreement 813 identityHint string 814} 815 816func (ka *pskKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) { 817 // Assemble the identity hint. 818 bytes := make([]byte, 2+len(config.PreSharedKeyIdentity)) 819 bytes[0] = byte(len(config.PreSharedKeyIdentity) >> 8) 820 bytes[1] = byte(len(config.PreSharedKeyIdentity)) 821 copy(bytes[2:], []byte(config.PreSharedKeyIdentity)) 822 823 // If there is one, append the base key agreement's 824 // ServerKeyExchange. 825 baseSkx, err := ka.base.generateServerKeyExchange(config, cert, clientHello, hello) 826 if err != nil { 827 return nil, err 828 } 829 830 if baseSkx != nil { 831 bytes = append(bytes, baseSkx.key...) 832 } else if config.PreSharedKeyIdentity == "" { 833 // ServerKeyExchange is optional if the identity hint is empty 834 // and there would otherwise be no ServerKeyExchange. 835 return nil, nil 836 } 837 838 skx := new(serverKeyExchangeMsg) 839 skx.key = bytes 840 return skx, nil 841} 842 843func (ka *pskKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) { 844 // First, process the PSK identity. 845 if len(ckx.ciphertext) < 2 { 846 return nil, errClientKeyExchange 847 } 848 identityLen := (int(ckx.ciphertext[0]) << 8) | int(ckx.ciphertext[1]) 849 if 2+identityLen > len(ckx.ciphertext) { 850 return nil, errClientKeyExchange 851 } 852 identity := string(ckx.ciphertext[2 : 2+identityLen]) 853 854 if identity != config.PreSharedKeyIdentity { 855 return nil, errors.New("tls: unexpected identity") 856 } 857 858 if config.PreSharedKey == nil { 859 return nil, errors.New("tls: pre-shared key not configured") 860 } 861 862 // Process the remainder of the ClientKeyExchange to compute the base 863 // pre-master secret. 864 newCkx := new(clientKeyExchangeMsg) 865 newCkx.ciphertext = ckx.ciphertext[2+identityLen:] 866 otherSecret, err := ka.base.processClientKeyExchange(config, cert, newCkx, version) 867 if err != nil { 868 return nil, err 869 } 870 871 if otherSecret == nil { 872 // Special-case for the plain PSK key exchanges. 873 otherSecret = make([]byte, len(config.PreSharedKey)) 874 } 875 return makePSKPremaster(otherSecret, config.PreSharedKey), nil 876} 877 878func (ka *pskKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error { 879 if len(skx.key) < 2 { 880 return errServerKeyExchange 881 } 882 identityLen := (int(skx.key[0]) << 8) | int(skx.key[1]) 883 if 2+identityLen > len(skx.key) { 884 return errServerKeyExchange 885 } 886 ka.identityHint = string(skx.key[2 : 2+identityLen]) 887 888 // Process the remainder of the ServerKeyExchange. 889 newSkx := new(serverKeyExchangeMsg) 890 newSkx.key = skx.key[2+identityLen:] 891 return ka.base.processServerKeyExchange(config, clientHello, serverHello, cert, newSkx) 892} 893 894func (ka *pskKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) { 895 // The server only sends an identity hint but, for purposes of 896 // test code, the server always sends the hint and it is 897 // required to match. 898 if ka.identityHint != config.PreSharedKeyIdentity { 899 return nil, nil, errors.New("tls: unexpected identity") 900 } 901 902 // Serialize the identity. 903 bytes := make([]byte, 2+len(config.PreSharedKeyIdentity)) 904 bytes[0] = byte(len(config.PreSharedKeyIdentity) >> 8) 905 bytes[1] = byte(len(config.PreSharedKeyIdentity)) 906 copy(bytes[2:], []byte(config.PreSharedKeyIdentity)) 907 908 // Append the base key exchange's ClientKeyExchange. 909 otherSecret, baseCkx, err := ka.base.generateClientKeyExchange(config, clientHello, cert) 910 if err != nil { 911 return nil, nil, err 912 } 913 ckx := new(clientKeyExchangeMsg) 914 ckx.ciphertext = append(bytes, baseCkx.ciphertext...) 915 916 if config.PreSharedKey == nil { 917 return nil, nil, errors.New("tls: pre-shared key not configured") 918 } 919 if otherSecret == nil { 920 otherSecret = make([]byte, len(config.PreSharedKey)) 921 } 922 return makePSKPremaster(otherSecret, config.PreSharedKey), ckx, nil 923} 924