key_agreement.go

     1  // Copyright 2010 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package tls
     6  
     7  import (
     8  	"crypto"
     9  	"crypto/md5"
    10  	"crypto/rsa"
    11  	"crypto/sha1"
    12  	"crypto/x509"
    13  	"errors"
    14  	"fmt"
    15  	"io"
    16  )
    17  
    18  // a keyAgreement implements the client and server side of a TLS key agreement
    19  // protocol by generating and processing key exchange messages.
    20  type keyAgreement interface {
    21  	// On the server side, the first two methods are called in order.
    22  
    23  	// In the case that the key agreement protocol doesn't use a
    24  	// ServerKeyExchange message, generateServerKeyExchange can return nil,
    25  	// nil.
    26  	generateServerKeyExchange(*Config, *Certificate, *clientHelloMsg, *serverHelloMsg) (*serverKeyExchangeMsg, error)
    27  	processClientKeyExchange(*Config, *Certificate, *clientKeyExchangeMsg, uint16) ([]byte, error)
    28  
    29  	// On the client side, the next two methods are called in order.
    30  
    31  	// This method may not be called if the server doesn't send a
    32  	// ServerKeyExchange message.
    33  	processServerKeyExchange(*Config, *clientHelloMsg, *serverHelloMsg, *x509.Certificate, *serverKeyExchangeMsg) error
    34  	generateClientKeyExchange(*Config, *clientHelloMsg, *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error)
    35  }
    36  
    37  var errClientKeyExchange = errors.New("tls: invalid ClientKeyExchange message")
    38  var errServerKeyExchange = errors.New("tls: invalid ServerKeyExchange message")
    39  
    40  // rsaKeyAgreement implements the standard TLS key agreement where the client
    41  // encrypts the pre-master secret to the server's public key.
    42  type rsaKeyAgreement struct{}
    43  
    44  func (ka rsaKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) {
    45  	return nil, nil
    46  }
    47  
    48  func (ka rsaKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) {
    49  	if len(ckx.ciphertext) < 2 {
    50  		return nil, errClientKeyExchange
    51  	}
    52  	ciphertextLen := int(ckx.ciphertext[0])<<8 | int(ckx.ciphertext[1])
    53  	if ciphertextLen != len(ckx.ciphertext)-2 {
    54  		return nil, errClientKeyExchange
    55  	}
    56  	ciphertext := ckx.ciphertext[2:]
    57  
    58  	priv, ok := cert.PrivateKey.(crypto.Decrypter)
    59  	if !ok {
    60  		return nil, errors.New("tls: certificate private key does not implement crypto.Decrypter")
    61  	}
    62  	// Perform constant time RSA PKCS #1 v1.5 decryption
    63  	preMasterSecret, err := priv.Decrypt(config.rand(), ciphertext, &rsa.PKCS1v15DecryptOptions{SessionKeyLen: 48})
    64  	if err != nil {
    65  		return nil, err
    66  	}
    67  	// We don't check the version number in the premaster secret. For one,
    68  	// by checking it, we would leak information about the validity of the
    69  	// encrypted pre-master secret. Secondly, it provides only a small
    70  	// benefit against a downgrade attack and some implementations send the
    71  	// wrong version anyway. See the discussion at the end of section
    72  	// 7.4.7.1 of RFC 4346.
    73  	return preMasterSecret, nil
    74  }
    75  
    76  func (ka rsaKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error {
    77  	return errors.New("tls: unexpected ServerKeyExchange")
    78  }
    79  
    80  func (ka rsaKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) {
    81  	preMasterSecret := make([]byte, 48)
    82  	preMasterSecret[0] = byte(clientHello.vers >> 8)
    83  	preMasterSecret[1] = byte(clientHello.vers)
    84  	_, err := io.ReadFull(config.rand(), preMasterSecret[2:])
    85  	if err != nil {
    86  		return nil, nil, err
    87  	}
    88  
    89  	rsaKey, ok := cert.PublicKey.(*rsa.PublicKey)
    90  	if !ok {
    91  		return nil, nil, errors.New("tls: server certificate contains incorrect key type for selected ciphersuite")
    92  	}
    93  	encrypted, err := rsa.EncryptPKCS1v15(config.rand(), rsaKey, preMasterSecret)
    94  	if err != nil {
    95  		return nil, nil, err
    96  	}
    97  	ckx := new(clientKeyExchangeMsg)
    98  	ckx.ciphertext = make([]byte, len(encrypted)+2)
    99  	ckx.ciphertext[0] = byte(len(encrypted) >> 8)
   100  	ckx.ciphertext[1] = byte(len(encrypted))
   101  	copy(ckx.ciphertext[2:], encrypted)
   102  	return preMasterSecret, ckx, nil
   103  }
   104  
   105  // sha1Hash calculates a SHA1 hash over the given byte slices.
   106  func sha1Hash(slices [][]byte) []byte {
   107  	hsha1 := sha1.New()
   108  	for _, slice := range slices {
   109  		hsha1.Write(slice)
   110  	}
   111  	return hsha1.Sum(nil)
   112  }
   113  
   114  // md5SHA1Hash implements TLS 1.0's hybrid hash function which consists of the
   115  // concatenation of an MD5 and SHA1 hash.
   116  func md5SHA1Hash(slices [][]byte) []byte {
   117  	md5sha1 := make([]byte, md5.Size+sha1.Size)
   118  	hmd5 := md5.New()
   119  	for _, slice := range slices {
   120  		hmd5.Write(slice)
   121  	}
   122  	copy(md5sha1, hmd5.Sum(nil))
   123  	copy(md5sha1[md5.Size:], sha1Hash(slices))
   124  	return md5sha1
   125  }
   126  
   127  // hashForServerKeyExchange hashes the given slices and returns their digest
   128  // using the given hash function (for >= TLS 1.2) or using a default based on
   129  // the sigType (for earlier TLS versions). For Ed25519 signatures, which don't
   130  // do pre-hashing, it returns the concatenation of the slices.
   131  func hashForServerKeyExchange(sigType uint8, hashFunc crypto.Hash, version uint16, slices ...[]byte) []byte {
   132  	if sigType == signatureEd25519 {
   133  		var signed []byte
   134  		for _, slice := range slices {
   135  			signed = append(signed, slice...)
   136  		}
   137  		return signed
   138  	}
   139  	if version >= VersionTLS12 {
   140  		h := hashFunc.New()
   141  		for _, slice := range slices {
   142  			h.Write(slice)
   143  		}
   144  		digest := h.Sum(nil)
   145  		return digest
   146  	}
   147  	if sigType == signatureECDSA {
   148  		return sha1Hash(slices)
   149  	}
   150  	return md5SHA1Hash(slices)
   151  }
   152  
   153  // ecdheKeyAgreement implements a TLS key agreement where the server
   154  // generates an ephemeral EC public/private key pair and signs it. The
   155  // pre-master secret is then calculated using ECDH. The signature may
   156  // be ECDSA, Ed25519 or RSA.
   157  type ecdheKeyAgreement struct {
   158  	version uint16
   159  	isRSA   bool
   160  	params  ecdheParameters
   161  
   162  	// ckx and preMasterSecret are generated in processServerKeyExchange
   163  	// and returned in generateClientKeyExchange.
   164  	ckx             *clientKeyExchangeMsg
   165  	preMasterSecret []byte
   166  }
   167  
   168  func (ka *ecdheKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) {
   169  	var curveID CurveID
   170  	for _, c := range clientHello.supportedCurves {
   171  		if config.supportsCurve(c) {
   172  			curveID = c
   173  			break
   174  		}
   175  	}
   176  
   177  	if curveID == 0 {
   178  		return nil, errors.New("tls: no supported elliptic curves offered")
   179  	}
   180  	if _, ok := curveForCurveID(curveID); curveID != X25519 && !ok {
   181  		return nil, errors.New("tls: CurvePreferences includes unsupported curve")
   182  	}
   183  
   184  	params, err := generateECDHEParameters(config.rand(), curveID)
   185  	if err != nil {
   186  		return nil, err
   187  	}
   188  	ka.params = params
   189  
   190  	// See RFC 4492, Section 5.4.
   191  	ecdhePublic := params.PublicKey()
   192  	serverECDHEParams := make([]byte, 1+2+1+len(ecdhePublic))
   193  	serverECDHEParams[0] = 3 // named curve
   194  	serverECDHEParams[1] = byte(curveID >> 8)
   195  	serverECDHEParams[2] = byte(curveID)
   196  	serverECDHEParams[3] = byte(len(ecdhePublic))
   197  	copy(serverECDHEParams[4:], ecdhePublic)
   198  
   199  	priv, ok := cert.PrivateKey.(crypto.Signer)
   200  	if !ok {
   201  		return nil, fmt.Errorf("tls: certificate private key of type %T does not implement crypto.Signer", cert.PrivateKey)
   202  	}
   203  
   204  	var signatureAlgorithm SignatureScheme
   205  	var sigType uint8
   206  	var sigHash crypto.Hash
   207  	if ka.version >= VersionTLS12 {
   208  		signatureAlgorithm, err = selectSignatureScheme(ka.version, cert, clientHello.supportedSignatureAlgorithms)
   209  		if err != nil {
   210  			return nil, err
   211  		}
   212  		sigType, sigHash, err = typeAndHashFromSignatureScheme(signatureAlgorithm)
   213  		if err != nil {
   214  			return nil, err
   215  		}
   216  	} else {
   217  		sigType, sigHash, err = legacyTypeAndHashFromPublicKey(priv.Public())
   218  		if err != nil {
   219  			return nil, err
   220  		}
   221  	}
   222  	if (sigType == signaturePKCS1v15 || sigType == signatureRSAPSS) != ka.isRSA {
   223  		return nil, errors.New("tls: certificate cannot be used with the selected cipher suite")
   224  	}
   225  
   226  	signed := hashForServerKeyExchange(sigType, sigHash, ka.version, clientHello.random, hello.random, serverECDHEParams)
   227  
   228  	signOpts := crypto.SignerOpts(sigHash)
   229  	if sigType == signatureRSAPSS {
   230  		signOpts = &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash, Hash: sigHash}
   231  	}
   232  	sig, err := priv.Sign(config.rand(), signed, signOpts)
   233  	if err != nil {
   234  		return nil, errors.New("tls: failed to sign ECDHE parameters: " + err.Error())
   235  	}
   236  
   237  	skx := new(serverKeyExchangeMsg)
   238  	sigAndHashLen := 0
   239  	if ka.version >= VersionTLS12 {
   240  		sigAndHashLen = 2
   241  	}
   242  	skx.key = make([]byte, len(serverECDHEParams)+sigAndHashLen+2+len(sig))
   243  	copy(skx.key, serverECDHEParams)
   244  	k := skx.key[len(serverECDHEParams):]
   245  	if ka.version >= VersionTLS12 {
   246  		k[0] = byte(signatureAlgorithm >> 8)
   247  		k[1] = byte(signatureAlgorithm)
   248  		k = k[2:]
   249  	}
   250  	k[0] = byte(len(sig) >> 8)
   251  	k[1] = byte(len(sig))
   252  	copy(k[2:], sig)
   253  
   254  	return skx, nil
   255  }
   256  
   257  func (ka *ecdheKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) {
   258  	if len(ckx.ciphertext) == 0 || int(ckx.ciphertext[0]) != len(ckx.ciphertext)-1 {
   259  		return nil, errClientKeyExchange
   260  	}
   261  
   262  	preMasterSecret := ka.params.SharedKey(ckx.ciphertext[1:])
   263  	if preMasterSecret == nil {
   264  		return nil, errClientKeyExchange
   265  	}
   266  
   267  	return preMasterSecret, nil
   268  }
   269  
   270  func (ka *ecdheKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error {
   271  	if len(skx.key) < 4 {
   272  		return errServerKeyExchange
   273  	}
   274  	if skx.key[0] != 3 { // named curve
   275  		return errors.New("tls: server selected unsupported curve")
   276  	}
   277  	curveID := CurveID(skx.key[1])<<8 | CurveID(skx.key[2])
   278  
   279  	publicLen := int(skx.key[3])
   280  	if publicLen+4 > len(skx.key) {
   281  		return errServerKeyExchange
   282  	}
   283  	serverECDHEParams := skx.key[:4+publicLen]
   284  	publicKey := serverECDHEParams[4:]
   285  
   286  	sig := skx.key[4+publicLen:]
   287  	if len(sig) < 2 {
   288  		return errServerKeyExchange
   289  	}
   290  
   291  	if _, ok := curveForCurveID(curveID); curveID != X25519 && !ok {
   292  		return errors.New("tls: server selected unsupported curve")
   293  	}
   294  
   295  	params, err := generateECDHEParameters(config.rand(), curveID)
   296  	if err != nil {
   297  		return err
   298  	}
   299  	ka.params = params
   300  
   301  	ka.preMasterSecret = params.SharedKey(publicKey)
   302  	if ka.preMasterSecret == nil {
   303  		return errServerKeyExchange
   304  	}
   305  
   306  	ourPublicKey := params.PublicKey()
   307  	ka.ckx = new(clientKeyExchangeMsg)
   308  	ka.ckx.ciphertext = make([]byte, 1+len(ourPublicKey))
   309  	ka.ckx.ciphertext[0] = byte(len(ourPublicKey))
   310  	copy(ka.ckx.ciphertext[1:], ourPublicKey)
   311  
   312  	var sigType uint8
   313  	var sigHash crypto.Hash
   314  	if ka.version >= VersionTLS12 {
   315  		signatureAlgorithm := SignatureScheme(sig[0])<<8 | SignatureScheme(sig[1])
   316  		sig = sig[2:]
   317  		if len(sig) < 2 {
   318  			return errServerKeyExchange
   319  		}
   320  
   321  		if !isSupportedSignatureAlgorithm(signatureAlgorithm, clientHello.supportedSignatureAlgorithms) {
   322  			return errors.New("tls: certificate used with invalid signature algorithm")
   323  		}
   324  		sigType, sigHash, err = typeAndHashFromSignatureScheme(signatureAlgorithm)
   325  		if err != nil {
   326  			return err
   327  		}
   328  	} else {
   329  		sigType, sigHash, err = legacyTypeAndHashFromPublicKey(cert.PublicKey)
   330  		if err != nil {
   331  			return err
   332  		}
   333  	}
   334  	if (sigType == signaturePKCS1v15 || sigType == signatureRSAPSS) != ka.isRSA {
   335  		return errServerKeyExchange
   336  	}
   337  
   338  	sigLen := int(sig[0])<<8 | int(sig[1])
   339  	if sigLen+2 != len(sig) {
   340  		return errServerKeyExchange
   341  	}
   342  	sig = sig[2:]
   343  
   344  	signed := hashForServerKeyExchange(sigType, sigHash, ka.version, clientHello.random, serverHello.random, serverECDHEParams)
   345  	if err := verifyHandshakeSignature(sigType, cert.PublicKey, sigHash, signed, sig); err != nil {
   346  		return errors.New("tls: invalid signature by the server certificate: " + err.Error())
   347  	}
   348  	return nil
   349  }
   350  
   351  func (ka *ecdheKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) {
   352  	if ka.ckx == nil {
   353  		return nil, nil, errors.New("tls: missing ServerKeyExchange message")
   354  	}
   355  
   356  	return ka.preMasterSecret, ka.ckx, nil
   357  }
   358
View as plain text