lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-29 11:41:15 +03:00
Code Activity

Add mbedtls_ssl_ticket_rotate for ticket rotation.

Browse Source 
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
This commit is contained in:
Glenn Strauss
2022-02-02 23:32:18 -05:00
parent 196a1c4256
commit a950938ff0
3 changed files with 69 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
library/ssl_ticket.c
View File

@ -121,6 +121,35 @@ static int ssl_ticket_update_keys( mbedtls_ssl_ticket_context *ctx )
return( 0 );
}
/*
* Rotate active session ticket encryption key
*/
int mbedtls_ssl_ticket_rotate( mbedtls_ssl_ticket_context *ctx,
const unsigned char *name, size_t nlength,
const unsigned char *k, size_t klength,
uint32_t lifetime )
{
const unsigned char idx = 1 - ctx->active;
mbedtls_ssl_ticket_key * const key = ctx->keys + idx;
const int bitlen = mbedtls_cipher_get_key_bitlen( &key->ctx );
int ret;
if( nlength < TICKET_KEY_NAME_BYTES || klength * 8 < (size_t)bitlen )
return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
/* With GCM and CCM, same context can encrypt & decrypt */
ret = mbedtls_cipher_setkey( &key->ctx, k, bitlen, MBEDTLS_ENCRYPT );
if( ret != 0 )
return( ret );
ctx->active = idx;
ctx->ticket_lifetime = lifetime;
memcpy( key->name, name, TICKET_KEY_NAME_BYTES );
#if defined(MBEDTLS_HAVE_TIME)
key->generation_time = (uint32_t) mbedtls_time( NULL );
#endif
return 0;
}
/*
* Setup context for actual use
*/