github.com/zmap/zcrypto@v0.0.0-20240512203510-0fef58d9a9db/tls/prf.go (about) 1 // Copyright 2009 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 package tls 6 7 import ( 8 "crypto" 9 "crypto/hmac" 10 "crypto/md5" 11 "crypto/sha1" 12 "crypto/sha256" 13 "crypto/sha512" 14 "errors" 15 "hash" 16 ) 17 18 // Split a premaster secret in two as specified in RFC 4346, section 5. 19 func splitPreMasterSecret(secret []byte) (s1, s2 []byte) { 20 s1 = secret[0 : (len(secret)+1)/2] 21 s2 = secret[len(secret)/2:] 22 return 23 } 24 25 // pHash implements the P_hash function, as defined in RFC 4346, section 5. 26 func pHash(result, secret, seed []byte, hash func() hash.Hash) { 27 h := hmac.New(hash, secret) 28 h.Write(seed) 29 a := h.Sum(nil) 30 31 j := 0 32 for j < len(result) { 33 h.Reset() 34 h.Write(a) 35 h.Write(seed) 36 b := h.Sum(nil) 37 todo := len(b) 38 if j+todo > len(result) { 39 todo = len(result) - j 40 } 41 copy(result[j:j+todo], b) 42 j += todo 43 44 h.Reset() 45 h.Write(a) 46 a = h.Sum(nil) 47 } 48 } 49 50 // prf10 implements the TLS 1.0 pseudo-random function, as defined in RFC 2246, section 5. 51 func prf10(result, secret, label, seed []byte) { 52 hashSHA1 := sha1.New 53 hashMD5 := md5.New 54 55 labelAndSeed := make([]byte, len(label)+len(seed)) 56 copy(labelAndSeed, label) 57 copy(labelAndSeed[len(label):], seed) 58 59 s1, s2 := splitPreMasterSecret(secret) 60 pHash(result, s1, labelAndSeed, hashMD5) 61 result2 := make([]byte, len(result)) 62 pHash(result2, s2, labelAndSeed, hashSHA1) 63 64 for i, b := range result2 { 65 result[i] ^= b 66 } 67 } 68 69 // prf12 implements the TLS 1.2 pseudo-random function, as defined in RFC 5246, section 5. 70 func prf12(hashFunc func() hash.Hash) func(result, secret, label, seed []byte) { 71 return func(result, secret, label, seed []byte) { 72 labelAndSeed := make([]byte, len(label)+len(seed)) 73 copy(labelAndSeed, label) 74 copy(labelAndSeed[len(label):], seed) 75 76 pHash(result, secret, labelAndSeed, hashFunc) 77 } 78 } 79 80 // prf30 implements the SSL 3.0 pseudo-random function, as defined in 81 // www.mozilla.org/projects/security/pki/nss/ssl/draft302.txt section 6. 82 func prf30(result, secret, label, seed []byte) { 83 hashSHA1 := sha1.New() 84 hashMD5 := md5.New() 85 86 done := 0 87 i := 0 88 // RFC5246 section 6.3 says that the largest PRF output needed is 128 89 // bytes. Since no more ciphersuites will be added to SSLv3, this will 90 // remain true. Each iteration gives us 16 bytes so 10 iterations will 91 // be sufficient. 92 var b [11]byte 93 for done < len(result) { 94 for j := 0; j <= i; j++ { 95 b[j] = 'A' + byte(i) 96 } 97 98 hashSHA1.Reset() 99 hashSHA1.Write(b[:i+1]) 100 hashSHA1.Write(secret) 101 hashSHA1.Write(seed) 102 digest := hashSHA1.Sum(nil) 103 104 hashMD5.Reset() 105 hashMD5.Write(secret) 106 hashMD5.Write(digest) 107 108 done += copy(result[done:], hashMD5.Sum(nil)) 109 i++ 110 } 111 } 112 113 func exportPRF30(result, secret, label, seed []byte) { 114 hash := md5.New() 115 hash.Write(secret) 116 hash.Write(seed) 117 copy(result, hash.Sum(nil)) 118 } 119 120 const ( 121 tlsRandomLength = 32 // Length of a random nonce in TLS 1.1. 122 masterSecretLength = 48 // Length of a master secret in TLS 1.1. 123 finishedVerifyLength = 12 // Length of verify_data in a Finished message. 124 ) 125 126 var masterSecretLabel = []byte("master secret") 127 var extendedMasterSecretLabel = []byte("extended master secret") 128 var keyExpansionLabel = []byte("key expansion") 129 var clientFinishedLabel = []byte("client finished") 130 var serverFinishedLabel = []byte("server finished") 131 var clientFinalKeyLabel = []byte("client write key") 132 var serverFinalKeyLabel = []byte("server write key") 133 var finalIVLabel = []byte("IV block") 134 135 func prfForVersion(version uint16, suite *cipherSuite) func(result, secret, label, seed []byte) { 136 switch version { 137 case VersionSSL30: 138 return prf30 139 case VersionTLS10, VersionTLS11: 140 return prf10 141 case VersionTLS12: 142 if suite.flags&suiteSHA384 != 0 { 143 return prf12(sha512.New384) 144 } 145 return prf12(sha256.New) 146 default: 147 panic("unknown version") 148 } 149 } 150 151 // masterFromPreMasterSecret generates the master secret from the pre-master 152 // secret. See http://tools.ietf.org/html/rfc5246#section-8.1 153 func masterFromPreMasterSecret(version uint16, suite *cipherSuite, preMasterSecret, clientRandom, serverRandom []byte) []byte { 154 seed := make([]byte, len(clientRandom)+len(serverRandom)) 155 copy(seed[0:len(clientRandom)], clientRandom) 156 copy(seed[len(clientRandom):], serverRandom) 157 masterSecret := make([]byte, masterSecretLength) 158 prfForVersion(version, suite)(masterSecret, preMasterSecret, masterSecretLabel, seed[0:]) 159 return masterSecret 160 } 161 162 // extendedMasterFromPreMasterSecret generates the master secret from the 163 // pre-master secret when the Triple Handshake fix is in effect. See 164 // https://tools.ietf.org/html/draft-ietf-tls-session-hash-01 165 func extendedMasterFromPreMasterSecret(version uint16, suite *cipherSuite, preMasterSecret []byte, h finishedHash) []byte { 166 masterSecret := make([]byte, masterSecretLength) 167 prfForVersion(version, suite)(masterSecret, preMasterSecret, extendedMasterSecretLabel, h.Sum()) 168 return masterSecret 169 } 170 171 // keysFromMasterSecret generates the connection keys from the master 172 // secret, given the lengths of the MAC key, cipher key and IV, as defined in 173 // RFC 2246, section 6.3. 174 func keysFromMasterSecret(version uint16, suite *cipherSuite, masterSecret, clientRandom, serverRandom []byte, macLen, keyLen, ivLen int) (clientMAC, serverMAC, clientKey, serverKey, clientIV, serverIV []byte) { 175 if suite.flags&suiteExport > 0 { 176 return exportKeysFromMasterSecret(version, suite, masterSecret, clientRandom, serverRandom, macLen, keyLen, ivLen) 177 } 178 var seed [tlsRandomLength * 2]byte 179 copy(seed[0:len(clientRandom)], serverRandom) 180 copy(seed[len(serverRandom):], clientRandom) 181 182 n := 2*macLen + 2*keyLen + 2*ivLen 183 keyMaterial := make([]byte, n) 184 prfForVersion(version, suite)(keyMaterial, masterSecret, keyExpansionLabel, seed[0:]) 185 clientMAC = keyMaterial[:macLen] 186 keyMaterial = keyMaterial[macLen:] 187 serverMAC = keyMaterial[:macLen] 188 keyMaterial = keyMaterial[macLen:] 189 clientKey = keyMaterial[:keyLen] 190 keyMaterial = keyMaterial[keyLen:] 191 serverKey = keyMaterial[:keyLen] 192 keyMaterial = keyMaterial[keyLen:] 193 clientIV = keyMaterial[:ivLen] 194 keyMaterial = keyMaterial[ivLen:] 195 serverIV = keyMaterial[:ivLen] 196 return 197 } 198 199 // The crypto wars must have been the worst 200 func exportKeysFromMasterSecret30(version uint16, suite *cipherSuite, masterSecret, clientRandom, serverRandom []byte, macLen, keyLen, ivLen int) (clientMAC, serverMAC, clientKey, serverKey, clientIV, serverIV []byte) { 201 var seed [tlsRandomLength * 2]byte 202 copy(seed[0:len(clientRandom)], serverRandom) 203 copy(seed[len(serverRandom):], clientRandom) 204 n := 2*macLen + 2*keyLen 205 keyMaterial := make([]byte, n) 206 prf30(keyMaterial, masterSecret, keyExpansionLabel, seed[0:]) 207 clientMAC = keyMaterial[:macLen] 208 keyMaterial = keyMaterial[macLen:] 209 serverMAC = keyMaterial[:macLen] 210 keyMaterial = keyMaterial[macLen:] 211 clientKey = keyMaterial[:keyLen] 212 keyMaterial = keyMaterial[keyLen:] 213 serverKey = keyMaterial[:keyLen] 214 var exportSeed [tlsRandomLength * 2]byte 215 copy(exportSeed[0:len(serverRandom)], clientRandom) 216 copy(exportSeed[len(clientRandom):], serverRandom) 217 expandedKeyLen := suite.expandedKeyLen 218 finalKeyBlock := make([]byte, 2*expandedKeyLen) 219 exportPRF30(finalKeyBlock[:expandedKeyLen], clientKey, clientFinalKeyLabel, exportSeed[0:]) 220 clientKey = finalKeyBlock[:expandedKeyLen] 221 finalKeyBlock = finalKeyBlock[expandedKeyLen:] 222 exportPRF30(finalKeyBlock[:expandedKeyLen], serverKey, serverFinalKeyLabel, seed[0:]) 223 serverKey = finalKeyBlock[:expandedKeyLen] 224 ivBlock := make([]byte, 2*ivLen) 225 clientIV = ivBlock[:ivLen] 226 exportPRF30(clientIV, []byte{}, finalIVLabel, exportSeed[0:]) 227 ivBlock = ivBlock[ivLen:] 228 serverIV = ivBlock[:ivLen] 229 exportPRF30(serverIV, []byte{}, finalIVLabel, seed[0:]) 230 return 231 } 232 233 // If a cryptographer kills me in the night, let it be known I was sorry 234 func exportKeysFromMasterSecretTLS(version uint16, suite *cipherSuite, masterSecret, clientRandom, serverRandom []byte, macLen, keyLen, ivLen int) (clientMAC, serverMAC, clientKey, serverKey, clientIV, serverIV []byte) { 235 var seed [tlsRandomLength * 2]byte 236 copy(seed[0:len(clientRandom)], serverRandom) 237 copy(seed[len(serverRandom):], clientRandom) 238 n := 2*macLen + 2*keyLen 239 keyMaterial := make([]byte, n) 240 prf := prfForVersion(version, suite) 241 prf(keyMaterial, masterSecret, keyExpansionLabel, seed[0:]) 242 clientMAC = keyMaterial[:macLen] 243 keyMaterial = keyMaterial[macLen:] 244 serverMAC = keyMaterial[:macLen] 245 keyMaterial = keyMaterial[macLen:] 246 clientKey = keyMaterial[:keyLen] 247 keyMaterial = keyMaterial[keyLen:] 248 serverKey = keyMaterial[:keyLen] 249 expandedKeyLen := suite.expandedKeyLen 250 finalKeyBlock := make([]byte, 2*expandedKeyLen) 251 var exportSeed [tlsRandomLength * 2]byte 252 copy(exportSeed[0:len(serverRandom)], clientRandom) 253 copy(exportSeed[len(clientRandom):], serverRandom) 254 prf(finalKeyBlock[:expandedKeyLen], clientKey, clientFinalKeyLabel, exportSeed[0:]) 255 clientKey = finalKeyBlock[:expandedKeyLen] 256 finalKeyBlock = finalKeyBlock[expandedKeyLen:] 257 prf(finalKeyBlock[:expandedKeyLen], serverKey, serverFinalKeyLabel, exportSeed[0:]) 258 serverKey = finalKeyBlock[:expandedKeyLen] 259 ivBlock := make([]byte, 2*ivLen) 260 prf(ivBlock, []byte{}, finalIVLabel, exportSeed[0:]) 261 clientIV = ivBlock[:ivLen] 262 ivBlock = ivBlock[ivLen:] 263 serverIV = ivBlock[:ivLen] 264 return 265 } 266 267 func exportKeysFromMasterSecret(version uint16, suite *cipherSuite, masterSecret, clientRandom, serverRandom []byte, macLen, keyLen, ivLen int) (clientMAC, serverMAC, clientKey, serverKey, clientIV, serverIV []byte) { 268 switch version { 269 case VersionSSL30: 270 return exportKeysFromMasterSecret30(version, suite, masterSecret, clientRandom, serverRandom, macLen, keyLen, ivLen) 271 case VersionTLS10, VersionTLS11, VersionTLS12: 272 return exportKeysFromMasterSecretTLS(version, suite, masterSecret, clientRandom, serverRandom, macLen, keyLen, ivLen) 273 default: 274 panic("unknown version") 275 } 276 } 277 278 // lookupTLSHash looks up the corresponding crypto.Hash for a given 279 // TLS hash identifier. 280 func lookupTLSHash(hash uint8) (crypto.Hash, error) { 281 switch hash { 282 case hashMD5: 283 return crypto.MD5, nil 284 case hashSHA1: 285 return crypto.SHA1, nil 286 case hashSHA224: 287 return crypto.SHA224, nil 288 case hashSHA256: 289 return crypto.SHA256, nil 290 case hashSHA384: 291 return crypto.SHA384, nil 292 case hashSHA512: 293 return crypto.SHA512, nil 294 default: 295 return 0, errors.New("tls: unsupported hash algorithm") 296 } 297 } 298 299 func newFinishedHash(version uint16, cipherSuite *cipherSuite) finishedHash { 300 if version >= VersionTLS12 { 301 newHash := sha256.New 302 if cipherSuite != nil && cipherSuite.flags&suiteSHA384 != 0 { 303 newHash = sha512.New384 304 } 305 306 return finishedHash{newHash(), newHash(), nil, nil, []byte{}, version, prf12(newHash)} 307 } 308 return finishedHash{sha1.New(), sha1.New(), md5.New(), md5.New(), []byte{}, version, prf10} 309 } 310 311 // A finishedHash calculates the hash of a set of handshake messages suitable 312 // for including in a Finished message. 313 type finishedHash struct { 314 client hash.Hash 315 server hash.Hash 316 317 // Prior to TLS 1.2, an additional MD5 hash is required. 318 clientMD5 hash.Hash 319 serverMD5 hash.Hash 320 321 // In TLS 1.2 (and SSL 3 for implementation convenience), a 322 // full buffer is required. 323 buffer []byte 324 325 version uint16 326 prf func(result, secret, label, seed []byte) 327 } 328 329 func (h *finishedHash) Write(msg []byte) (n int, err error) { 330 h.client.Write(msg) 331 h.server.Write(msg) 332 333 if h.version < VersionTLS12 { 334 h.clientMD5.Write(msg) 335 h.serverMD5.Write(msg) 336 } 337 338 if h.buffer != nil { 339 h.buffer = append(h.buffer, msg...) 340 } 341 342 return len(msg), nil 343 } 344 345 func (h finishedHash) Sum() []byte { 346 if h.version >= VersionTLS12 { 347 return h.client.Sum(nil) 348 } 349 350 out := make([]byte, 0, md5.Size+sha1.Size) 351 out = h.clientMD5.Sum(out) 352 return h.client.Sum(out) 353 } 354 355 // finishedSum30 calculates the contents of the verify_data member of a SSLv3 356 // Finished message given the MD5 and SHA1 hashes of a set of handshake 357 // messages. 358 func finishedSum30(md5, sha1 hash.Hash, masterSecret []byte, magic []byte) []byte { 359 md5.Write(magic) 360 md5.Write(masterSecret) 361 md5.Write(ssl30Pad1[:]) 362 md5Digest := md5.Sum(nil) 363 364 md5.Reset() 365 md5.Write(masterSecret) 366 md5.Write(ssl30Pad2[:]) 367 md5.Write(md5Digest) 368 md5Digest = md5.Sum(nil) 369 370 sha1.Write(magic) 371 sha1.Write(masterSecret) 372 sha1.Write(ssl30Pad1[:40]) 373 sha1Digest := sha1.Sum(nil) 374 375 sha1.Reset() 376 sha1.Write(masterSecret) 377 sha1.Write(ssl30Pad2[:40]) 378 sha1.Write(sha1Digest) 379 sha1Digest = sha1.Sum(nil) 380 381 ret := make([]byte, len(md5Digest)+len(sha1Digest)) 382 copy(ret, md5Digest) 383 copy(ret[len(md5Digest):], sha1Digest) 384 return ret 385 } 386 387 var ssl3ClientFinishedMagic = [4]byte{0x43, 0x4c, 0x4e, 0x54} 388 var ssl3ServerFinishedMagic = [4]byte{0x53, 0x52, 0x56, 0x52} 389 390 // clientSum returns the contents of the verify_data member of a client's 391 // Finished message. 392 func (h finishedHash) clientSum(masterSecret []byte) []byte { 393 if h.version == VersionSSL30 { 394 return finishedSum30(h.clientMD5, h.client, masterSecret, ssl3ClientFinishedMagic[:]) 395 } 396 397 out := make([]byte, finishedVerifyLength) 398 h.prf(out, masterSecret, clientFinishedLabel, h.Sum()) 399 return out 400 } 401 402 // serverSum returns the contents of the verify_data member of a server's 403 // Finished message. 404 func (h finishedHash) serverSum(masterSecret []byte) []byte { 405 if h.version == VersionSSL30 { 406 return finishedSum30(h.serverMD5, h.server, masterSecret, ssl3ServerFinishedMagic[:]) 407 } 408 409 out := make([]byte, finishedVerifyLength) 410 h.prf(out, masterSecret, serverFinishedLabel, h.Sum()) 411 return out 412 } 413 414 // selectClientCertSignatureAlgorithm returns a SigAndHash to sign a 415 // client's CertificateVerify with, or an error if none can be found. 416 func (h finishedHash) selectClientCertSignatureAlgorithm(serverList, clientList []SigAndHash, sigType uint8) (SigAndHash, error) { 417 if h.version < VersionTLS12 { 418 // Nothing to negotiate before TLS 1.2. 419 return SigAndHash{Signature: sigType}, nil 420 } 421 422 for _, v := range serverList { 423 if v.Signature == sigType && isSupportedSignatureAndHash(v, clientList) { 424 return v, nil 425 } 426 } 427 return SigAndHash{}, errors.New("tls: no supported signature algorithm found for signing client certificate") 428 } 429 430 // hashForClientCertificate returns a digest, hash function, and TLS 1.2 hash 431 // id suitable for signing by a TLS client certificate. 432 func (h finishedHash) hashForClientCertificate(signatureAndHash SigAndHash, masterSecret []byte) ([]byte, crypto.Hash, error) { 433 if h.version == VersionSSL30 { 434 if signatureAndHash.Signature != signatureRSA { 435 return nil, 0, errors.New("tls: unsupported signature type for client certificate") 436 } 437 438 md5Hash := md5.New() 439 md5Hash.Write(h.buffer) 440 sha1Hash := sha1.New() 441 sha1Hash.Write(h.buffer) 442 return finishedSum30(md5Hash, sha1Hash, masterSecret, nil), crypto.MD5SHA1, nil 443 } 444 if h.version >= VersionTLS12 { 445 hashAlg, err := lookupTLSHash(signatureAndHash.Hash) 446 if err != nil { 447 return nil, 0, err 448 } 449 hash := hashAlg.New() 450 hash.Write(h.buffer) 451 return hash.Sum(nil), hashAlg, nil 452 } 453 if signatureAndHash.Signature == signatureECDSA { 454 return h.server.Sum(nil), crypto.SHA1, nil 455 } 456 457 return h.Sum(), crypto.MD5SHA1, nil 458 }