lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-08-01 10:06:53 +03:00
Code Activity

Merge pull request #5611 from superna9999/5318-tls-ecdhe-psk

Browse Source 
TLS ECDH 3a: ECDHE-PSK (both sides, 1.2)
This commit is contained in:
Manuel Pégourié-Gonnard
2022-04-12 13:28:02 +02:00
committed by GitHub
parent 43b0943736 1039ba5c98
commit 927410ded3
2 changed files with 271 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

112
library/ssl_tls12_server.c
View File

@ -3163,7 +3163,8 @@ curve_matching_done:
#if defined(MBEDTLS_USE_PSA_CRYPTO)
if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
{
psa_status_t status = PSA_ERROR_GENERIC_ERROR;
psa_key_attributes_t key_attributes;
@ -4142,6 +4143,115 @@ static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
}
else
#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_status_t destruction_status = PSA_ERROR_CORRUPTION_DETECTED;
uint8_t ecpoint_len;
/* Opaque PSKs are currently only supported for PSK-only. */
if( ssl_use_opaque_psk( ssl ) == 1 )
return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
mbedtls_ssl_handshake_params *handshake = ssl->handshake;
if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
{
MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
psa_destroy_key( handshake->ecdh_psa_privkey );
handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
return( ret );
}
/* Keep a copy of the peer's public key */
if( p >= end )
{
psa_destroy_key( handshake->ecdh_psa_privkey );
handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
return( MBEDTLS_ERR_SSL_DECODE_ERROR );
}
ecpoint_len = *(p++);
if( (size_t)( end - p ) < ecpoint_len ) {
psa_destroy_key( handshake->ecdh_psa_privkey );
handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
return( MBEDTLS_ERR_SSL_DECODE_ERROR );
}
if( ecpoint_len > sizeof( handshake->ecdh_psa_peerkey ) ) {
psa_destroy_key( handshake->ecdh_psa_privkey );
handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
}
memcpy( handshake->ecdh_psa_peerkey, p, ecpoint_len );
handshake->ecdh_psa_peerkey_len = ecpoint_len;
p += ecpoint_len;
/* As RFC 5489 section 2, the premaster secret is formed as follows:
* - a uint16 containing the length (in octets) of the ECDH computation
* - the octet string produced by the ECDH computation
* - a uint16 containing the length (in octets) of the PSK
* - the PSK itself
*/
unsigned char *psm = ssl->handshake->premaster;
const unsigned char* const psm_end =
psm + sizeof( ssl->handshake->premaster );
/* uint16 to store length (in octets) of the ECDH computation */
const size_t zlen_size = 2;
size_t zlen = 0;
/* Compute ECDH shared secret. */
status = psa_raw_key_agreement( PSA_ALG_ECDH,
handshake->ecdh_psa_privkey,
handshake->ecdh_psa_peerkey,
handshake->ecdh_psa_peerkey_len,
psm + zlen_size,
psm_end - ( psm + zlen_size ),
&zlen );
destruction_status = psa_destroy_key( handshake->ecdh_psa_privkey );
handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
if( status != PSA_SUCCESS )
return( psa_ssl_status_to_mbedtls( status ) );
else if( destruction_status != PSA_SUCCESS )
return( psa_ssl_status_to_mbedtls( destruction_status ) );
/* Write the ECDH computation length before the ECDH computation */
MBEDTLS_PUT_UINT16_BE( zlen, psm, 0 );
psm += zlen_size + zlen;
const unsigned char *psk = NULL;
size_t psk_len = 0;
if( mbedtls_ssl_get_psk( ssl, &psk, &psk_len )
== MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED )
/*
* This should never happen because the existence of a PSK is always
* checked before calling this function
*/
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
/* opaque psk<0..2^16-1>; */
if( (size_t)( psm_end - psm ) < ( 2 + psk_len ) )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
/* Write the PSK length as uint16 */
MBEDTLS_PUT_UINT16_BE( psk_len, psm, 0 );
psm += 2;
/* Write the PSK itself */
memcpy( psm, psk, psk_len );
psm += psk_len;
ssl->handshake->pmslen = psm - ssl->handshake->premaster;
}
else
#endif /* MBEDTLS_USE_PSA_CRYPTO &&
MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
{