tls: simplify hmac_begin()
function old new delta hmac_begin 196 158 -38 Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
This commit is contained in:
parent
ca7cdd4b03
commit
d4681c7293
@ -224,7 +224,7 @@ enum {
|
||||
OUTBUF_PFX = 8 + AES_BLOCK_SIZE, /* header + IV */
|
||||
OUTBUF_SFX = TLS_MAX_MAC_SIZE + TLS_MAX_CRYPTBLOCK_SIZE, /* MAC + padding */
|
||||
|
||||
// RFC 5246
|
||||
// RFC 5246:
|
||||
// | 6.2.1. Fragmentation
|
||||
// | The record layer fragments information blocks into TLSPlaintext
|
||||
// | records carrying data in chunks of 2^14 bytes or less. Client
|
||||
@ -405,7 +405,7 @@ static void hash_handshake(tls_state_t *tls, const char *fmt, const void *buffer
|
||||
#endif
|
||||
}
|
||||
|
||||
// RFC 2104
|
||||
// RFC 2104:
|
||||
// HMAC(key, text) based on a hash H (say, sha256) is:
|
||||
// ipad = [0x36 x INSIZE]
|
||||
// opad = [0x5c x INSIZE]
|
||||
@ -448,7 +448,7 @@ static void hmac_begin(hmac_precomputed_t *pre, uint8_t *key, unsigned key_size,
|
||||
{
|
||||
uint8_t key_xor_ipad[SHA_INSIZE];
|
||||
uint8_t key_xor_opad[SHA_INSIZE];
|
||||
uint8_t tempkey[SHA1_OUTSIZE < SHA256_OUTSIZE ? SHA256_OUTSIZE : SHA1_OUTSIZE];
|
||||
// uint8_t tempkey[SHA1_OUTSIZE < SHA256_OUTSIZE ? SHA256_OUTSIZE : SHA1_OUTSIZE];
|
||||
unsigned i;
|
||||
|
||||
// "The authentication key can be of any length up to INSIZE, the
|
||||
@ -456,10 +456,18 @@ static void hmac_begin(hmac_precomputed_t *pre, uint8_t *key, unsigned key_size,
|
||||
// than INSIZE bytes will first hash the key using H and then use the
|
||||
// resultant OUTSIZE byte string as the actual key to HMAC."
|
||||
if (key_size > SHA_INSIZE) {
|
||||
md5sha_ctx_t ctx;
|
||||
begin(&ctx);
|
||||
md5sha_hash(&ctx, key, key_size);
|
||||
key_size = sha_end(&ctx, tempkey);
|
||||
bb_error_msg_and_die("HMAC key>64"); //does not happen (yet?)
|
||||
// md5sha_ctx_t ctx;
|
||||
// begin(&ctx);
|
||||
// md5sha_hash(&ctx, key, key_size);
|
||||
// key_size = sha_end(&ctx, tempkey);
|
||||
// //key = tempkey; - right? RIGHT? why does it work without this?
|
||||
// // because SHA_INSIZE is 64, but hmac() is always called with
|
||||
// // key_size = tls->MAC_size = SHA1/256_OUTSIZE (20 or 32),
|
||||
// // and prf_hmac_sha256() -> hmac_sha256() key sizes are:
|
||||
// // - RSA_PREMASTER_SIZE is 48
|
||||
// // - CURVE25519_KEYSIZE is 32
|
||||
// // - master_secret[] is 48
|
||||
}
|
||||
|
||||
for (i = 0; i < key_size; i++) {
|
||||
@ -519,8 +527,9 @@ static unsigned hmac_sha256(/*tls_state_t *tls,*/ uint8_t *out, uint8_t *key, un
|
||||
// document and in TLS documents published prior to this document when
|
||||
// TLS 1.2 is negotiated.
|
||||
// ^^^^^^^^^^^^^ IMPORTANT!
|
||||
// PRF uses sha256 regardless of cipher (at least for all ciphers
|
||||
// defined by RFC5246). It's not sha1 for AES_128_CBC_SHA!
|
||||
// PRF uses sha256 regardless of cipher for all ciphers
|
||||
// defined by RFC 5246. It's not sha1 for AES_128_CBC_SHA!
|
||||
// However, for _SHA384 ciphers, it's sha384. See RFC 5288,5289.
|
||||
//...
|
||||
// P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
|
||||
// HMAC_hash(secret, A(2) + seed) +
|
||||
@ -542,6 +551,12 @@ static unsigned hmac_sha256(/*tls_state_t *tls,*/ uint8_t *out, uint8_t *key, un
|
||||
// PRF(secret, label, seed) = P_<hash>(secret, label + seed)
|
||||
//
|
||||
// The label is an ASCII string.
|
||||
//
|
||||
// RFC 5288:
|
||||
// For cipher suites ending with _SHA256, the PRF is the TLS PRF
|
||||
// with SHA-256 as the hash function.
|
||||
// For cipher suites ending with _SHA384, the PRF is the TLS PRF
|
||||
// with SHA-384 as the hash function.
|
||||
static void prf_hmac_sha256(/*tls_state_t *tls,*/
|
||||
uint8_t *outbuf, unsigned outbuf_size,
|
||||
uint8_t *secret, unsigned secret_size,
|
||||
@ -675,7 +690,7 @@ static void xwrite_encrypted_and_hmac_signed(tls_state_t *tls, unsigned size, un
|
||||
|
||||
size += tls->MAC_size;
|
||||
|
||||
// RFC 5246
|
||||
// RFC 5246:
|
||||
// 6.2.3.1. Null or Standard Stream Cipher
|
||||
//
|
||||
// Stream ciphers (including BulkCipherAlgorithm.null; see Appendix A.6)
|
||||
@ -1467,6 +1482,7 @@ static void send_client_hello_and_alloc_hsd(tls_state_t *tls, const char *sni)
|
||||
// 0xC0,0x28, // TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 - can't do SHA384 yet
|
||||
0xC0,0x2B, // 6 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - ok: wget https://is.gd/
|
||||
// 0xC0,0x2C, // TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - wget https://is.gd/: "TLS error from peer (alert code 20): bad MAC"
|
||||
//TODO: GCM_SHA384 ciphers can be supported, only need sha384-based PRF?
|
||||
0xC0,0x2F, // 7 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - ok: openssl s_server ... -cipher ECDHE-RSA-AES128-GCM-SHA256
|
||||
// 0xC0,0x30, // TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - openssl s_server ... -cipher ECDHE-RSA-AES256-GCM-SHA384: "decryption failed or bad record mac"
|
||||
//possibly these too:
|
||||
@ -1489,7 +1505,7 @@ static void send_client_hello_and_alloc_hsd(tls_state_t *tls, const char *sni)
|
||||
0x00,0x0a, //extension_type: "supported_groups"
|
||||
0x00,0x04, //ext len
|
||||
0x00,0x02, //list len
|
||||
0x00,0x1d, //curve_x25519 (rfc7748)
|
||||
0x00,0x1d, //curve_x25519 (RFC 7748)
|
||||
//0x00,0x17, //curve_secp256r1
|
||||
//0x00,0x18, //curve_secp384r1
|
||||
//0x00,0x19, //curve_secp521r1
|
||||
|
Loading…
Reference in New Issue
Block a user