git.prognetwork.ru/x0r/utls@v1.3.3/key_agreement.go (about) 1 // Copyright 2010 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 package tls 6 7 import ( 8 "crypto" 9 "crypto/md5" 10 "crypto/rsa" 11 "crypto/sha1" 12 "crypto/x509" 13 "errors" 14 "fmt" 15 "io" 16 ) 17 18 // a keyAgreement implements the client and server side of a TLS key agreement 19 // protocol by generating and processing key exchange messages. 20 type keyAgreement interface { 21 // On the server side, the first two methods are called in order. 22 23 // In the case that the key agreement protocol doesn't use a 24 // ServerKeyExchange message, generateServerKeyExchange can return nil, 25 // nil. 26 generateServerKeyExchange(*Config, *Certificate, *clientHelloMsg, *serverHelloMsg) (*serverKeyExchangeMsg, error) 27 processClientKeyExchange(*Config, *Certificate, *clientKeyExchangeMsg, uint16) ([]byte, error) 28 29 // On the client side, the next two methods are called in order. 30 31 // This method may not be called if the server doesn't send a 32 // ServerKeyExchange message. 33 processServerKeyExchange(*Config, *clientHelloMsg, *serverHelloMsg, *x509.Certificate, *serverKeyExchangeMsg) error 34 generateClientKeyExchange(*Config, *clientHelloMsg, *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) 35 } 36 37 var errClientKeyExchange = errors.New("tls: invalid ClientKeyExchange message") 38 var errServerKeyExchange = errors.New("tls: invalid ServerKeyExchange message") 39 40 // rsaKeyAgreement implements the standard TLS key agreement where the client 41 // encrypts the pre-master secret to the server's public key. 42 type rsaKeyAgreement struct{} 43 44 func (ka rsaKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) { 45 return nil, nil 46 } 47 48 func (ka rsaKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) { 49 if len(ckx.ciphertext) < 2 { 50 return nil, errClientKeyExchange 51 } 52 ciphertextLen := int(ckx.ciphertext[0])<<8 | int(ckx.ciphertext[1]) 53 if ciphertextLen != len(ckx.ciphertext)-2 { 54 return nil, errClientKeyExchange 55 } 56 ciphertext := ckx.ciphertext[2:] 57 58 priv, ok := cert.PrivateKey.(crypto.Decrypter) 59 if !ok { 60 return nil, errors.New("tls: certificate private key does not implement crypto.Decrypter") 61 } 62 // Perform constant time RSA PKCS #1 v1.5 decryption 63 preMasterSecret, err := priv.Decrypt(config.rand(), ciphertext, &rsa.PKCS1v15DecryptOptions{SessionKeyLen: 48}) 64 if err != nil { 65 return nil, err 66 } 67 // We don't check the version number in the premaster secret. For one, 68 // by checking it, we would leak information about the validity of the 69 // encrypted pre-master secret. Secondly, it provides only a small 70 // benefit against a downgrade attack and some implementations send the 71 // wrong version anyway. See the discussion at the end of section 72 // 7.4.7.1 of RFC 4346. 73 return preMasterSecret, nil 74 } 75 76 func (ka rsaKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error { 77 return errors.New("tls: unexpected ServerKeyExchange") 78 } 79 80 func (ka rsaKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) { 81 preMasterSecret := make([]byte, 48) 82 preMasterSecret[0] = byte(clientHello.vers >> 8) 83 preMasterSecret[1] = byte(clientHello.vers) 84 _, err := io.ReadFull(config.rand(), preMasterSecret[2:]) 85 if err != nil { 86 return nil, nil, err 87 } 88 89 rsaKey, ok := cert.PublicKey.(*rsa.PublicKey) 90 if !ok { 91 return nil, nil, errors.New("tls: server certificate contains incorrect key type for selected ciphersuite") 92 } 93 encrypted, err := rsa.EncryptPKCS1v15(config.rand(), rsaKey, preMasterSecret) 94 if err != nil { 95 return nil, nil, err 96 } 97 ckx := new(clientKeyExchangeMsg) 98 ckx.ciphertext = make([]byte, len(encrypted)+2) 99 ckx.ciphertext[0] = byte(len(encrypted) >> 8) 100 ckx.ciphertext[1] = byte(len(encrypted)) 101 copy(ckx.ciphertext[2:], encrypted) 102 return preMasterSecret, ckx, nil 103 } 104 105 // sha1Hash calculates a SHA1 hash over the given byte slices. 106 func sha1Hash(slices [][]byte) []byte { 107 hsha1 := sha1.New() 108 for _, slice := range slices { 109 hsha1.Write(slice) 110 } 111 return hsha1.Sum(nil) 112 } 113 114 // md5SHA1Hash implements TLS 1.0's hybrid hash function which consists of the 115 // concatenation of an MD5 and SHA1 hash. 116 func md5SHA1Hash(slices [][]byte) []byte { 117 md5sha1 := make([]byte, md5.Size+sha1.Size) 118 hmd5 := md5.New() 119 for _, slice := range slices { 120 hmd5.Write(slice) 121 } 122 copy(md5sha1, hmd5.Sum(nil)) 123 copy(md5sha1[md5.Size:], sha1Hash(slices)) 124 return md5sha1 125 } 126 127 // hashForServerKeyExchange hashes the given slices and returns their digest 128 // using the given hash function (for >= TLS 1.2) or using a default based on 129 // the sigType (for earlier TLS versions). For Ed25519 signatures, which don't 130 // do pre-hashing, it returns the concatenation of the slices. 131 func hashForServerKeyExchange(sigType uint8, hashFunc crypto.Hash, version uint16, slices ...[]byte) []byte { 132 if sigType == signatureEd25519 { 133 var signed []byte 134 for _, slice := range slices { 135 signed = append(signed, slice...) 136 } 137 return signed 138 } 139 if version >= VersionTLS12 { 140 h := hashFunc.New() 141 for _, slice := range slices { 142 h.Write(slice) 143 } 144 digest := h.Sum(nil) 145 return digest 146 } 147 if sigType == signatureECDSA { 148 return sha1Hash(slices) 149 } 150 return md5SHA1Hash(slices) 151 } 152 153 // ecdheKeyAgreement implements a TLS key agreement where the server 154 // generates an ephemeral EC public/private key pair and signs it. The 155 // pre-master secret is then calculated using ECDH. The signature may 156 // be ECDSA, Ed25519 or RSA. 157 type ecdheKeyAgreement struct { 158 version uint16 159 isRSA bool 160 params ecdheParameters 161 162 // ckx and preMasterSecret are generated in processServerKeyExchange 163 // and returned in generateClientKeyExchange. 164 ckx *clientKeyExchangeMsg 165 preMasterSecret []byte 166 } 167 168 func (ka *ecdheKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) { 169 var curveID CurveID 170 for _, c := range clientHello.supportedCurves { 171 if config.supportsCurve(c) { 172 curveID = c 173 break 174 } 175 } 176 177 if curveID == 0 { 178 return nil, errors.New("tls: no supported elliptic curves offered") 179 } 180 if _, ok := curveForCurveID(curveID); curveID != X25519 && !ok { 181 return nil, errors.New("tls: CurvePreferences includes unsupported curve") 182 } 183 184 params, err := generateECDHEParameters(config.rand(), curveID) 185 if err != nil { 186 return nil, err 187 } 188 ka.params = params 189 190 // See RFC 4492, Section 5.4. 191 ecdhePublic := params.PublicKey() 192 serverECDHEParams := make([]byte, 1+2+1+len(ecdhePublic)) 193 serverECDHEParams[0] = 3 // named curve 194 serverECDHEParams[1] = byte(curveID >> 8) 195 serverECDHEParams[2] = byte(curveID) 196 serverECDHEParams[3] = byte(len(ecdhePublic)) 197 copy(serverECDHEParams[4:], ecdhePublic) 198 199 priv, ok := cert.PrivateKey.(crypto.Signer) 200 if !ok { 201 return nil, fmt.Errorf("tls: certificate private key of type %T does not implement crypto.Signer", cert.PrivateKey) 202 } 203 204 var signatureAlgorithm SignatureScheme 205 var sigType uint8 206 var sigHash crypto.Hash 207 if ka.version >= VersionTLS12 { 208 signatureAlgorithm, err = selectSignatureScheme(ka.version, cert, clientHello.supportedSignatureAlgorithms) 209 if err != nil { 210 return nil, err 211 } 212 sigType, sigHash, err = typeAndHashFromSignatureScheme(signatureAlgorithm) 213 if err != nil { 214 return nil, err 215 } 216 } else { 217 sigType, sigHash, err = legacyTypeAndHashFromPublicKey(priv.Public()) 218 if err != nil { 219 return nil, err 220 } 221 } 222 if (sigType == signaturePKCS1v15 || sigType == signatureRSAPSS) != ka.isRSA { 223 return nil, errors.New("tls: certificate cannot be used with the selected cipher suite") 224 } 225 226 signed := hashForServerKeyExchange(sigType, sigHash, ka.version, clientHello.random, hello.random, serverECDHEParams) 227 228 signOpts := crypto.SignerOpts(sigHash) 229 if sigType == signatureRSAPSS { 230 signOpts = &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash, Hash: sigHash} 231 } 232 sig, err := priv.Sign(config.rand(), signed, signOpts) 233 if err != nil { 234 return nil, errors.New("tls: failed to sign ECDHE parameters: " + err.Error()) 235 } 236 237 skx := new(serverKeyExchangeMsg) 238 sigAndHashLen := 0 239 if ka.version >= VersionTLS12 { 240 sigAndHashLen = 2 241 } 242 skx.key = make([]byte, len(serverECDHEParams)+sigAndHashLen+2+len(sig)) 243 copy(skx.key, serverECDHEParams) 244 k := skx.key[len(serverECDHEParams):] 245 if ka.version >= VersionTLS12 { 246 k[0] = byte(signatureAlgorithm >> 8) 247 k[1] = byte(signatureAlgorithm) 248 k = k[2:] 249 } 250 k[0] = byte(len(sig) >> 8) 251 k[1] = byte(len(sig)) 252 copy(k[2:], sig) 253 254 return skx, nil 255 } 256 257 func (ka *ecdheKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) { 258 if len(ckx.ciphertext) == 0 || int(ckx.ciphertext[0]) != len(ckx.ciphertext)-1 { 259 return nil, errClientKeyExchange 260 } 261 262 preMasterSecret := ka.params.SharedKey(ckx.ciphertext[1:]) 263 if preMasterSecret == nil { 264 return nil, errClientKeyExchange 265 } 266 267 return preMasterSecret, nil 268 } 269 270 func (ka *ecdheKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error { 271 if len(skx.key) < 4 { 272 return errServerKeyExchange 273 } 274 if skx.key[0] != 3 { // named curve 275 return errors.New("tls: server selected unsupported curve") 276 } 277 curveID := CurveID(skx.key[1])<<8 | CurveID(skx.key[2]) 278 279 publicLen := int(skx.key[3]) 280 if publicLen+4 > len(skx.key) { 281 return errServerKeyExchange 282 } 283 serverECDHEParams := skx.key[:4+publicLen] 284 publicKey := serverECDHEParams[4:] 285 286 sig := skx.key[4+publicLen:] 287 if len(sig) < 2 { 288 return errServerKeyExchange 289 } 290 291 if _, ok := curveForCurveID(curveID); curveID != X25519 && !ok { 292 return errors.New("tls: server selected unsupported curve") 293 } 294 295 params, err := generateECDHEParameters(config.rand(), curveID) 296 if err != nil { 297 return err 298 } 299 ka.params = params 300 301 ka.preMasterSecret = params.SharedKey(publicKey) 302 if ka.preMasterSecret == nil { 303 return errServerKeyExchange 304 } 305 306 ourPublicKey := params.PublicKey() 307 ka.ckx = new(clientKeyExchangeMsg) 308 ka.ckx.ciphertext = make([]byte, 1+len(ourPublicKey)) 309 ka.ckx.ciphertext[0] = byte(len(ourPublicKey)) 310 copy(ka.ckx.ciphertext[1:], ourPublicKey) 311 312 var sigType uint8 313 var sigHash crypto.Hash 314 if ka.version >= VersionTLS12 { 315 signatureAlgorithm := SignatureScheme(sig[0])<<8 | SignatureScheme(sig[1]) 316 sig = sig[2:] 317 if len(sig) < 2 { 318 return errServerKeyExchange 319 } 320 321 if !isSupportedSignatureAlgorithm(signatureAlgorithm, clientHello.supportedSignatureAlgorithms) { 322 return errors.New("tls: certificate used with invalid signature algorithm") 323 } 324 sigType, sigHash, err = typeAndHashFromSignatureScheme(signatureAlgorithm) 325 if err != nil { 326 return err 327 } 328 } else { 329 sigType, sigHash, err = legacyTypeAndHashFromPublicKey(cert.PublicKey) 330 if err != nil { 331 return err 332 } 333 } 334 if (sigType == signaturePKCS1v15 || sigType == signatureRSAPSS) != ka.isRSA { 335 return errServerKeyExchange 336 } 337 338 sigLen := int(sig[0])<<8 | int(sig[1]) 339 if sigLen+2 != len(sig) { 340 return errServerKeyExchange 341 } 342 sig = sig[2:] 343 344 signed := hashForServerKeyExchange(sigType, sigHash, ka.version, clientHello.random, serverHello.random, serverECDHEParams) 345 if err := verifyHandshakeSignature(sigType, cert.PublicKey, sigHash, signed, sig); err != nil { 346 return errors.New("tls: invalid signature by the server certificate: " + err.Error()) 347 } 348 return nil 349 } 350 351 func (ka *ecdheKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) { 352 if ka.ckx == nil { 353 return nil, nil, errors.New("tls: missing ServerKeyExchange message") 354 } 355 356 return ka.preMasterSecret, ka.ckx, nil 357 }