denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tls-hkdf: Use plugin-provided prf+

Browse Source
This commit is contained in:
Tobias Brunner
2022-04-14 19:02:56 +02:00
parent 7161c87617
commit df16d7902a
1 changed files with 17 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls_hkdf.c
+17 -15
View File
@@ -18,7 +18,6 @@
#include "tls_hkdf.h" #include "tls_hkdf.h"
#include <bio/bio_writer.h> #include <bio/bio_writer.h>
#include <crypto/prf_plus.h>
typedef struct private_tls_hkdf_t private_tls_hkdf_t; typedef struct private_tls_hkdf_t private_tls_hkdf_t;
@@ -51,6 +50,11 @@ struct private_tls_hkdf_t {
*/ */
prf_t *prf; prf_t *prf;
/**
* prf+ implementation.
*/
kdf_t *prf_plus;
/** /**
* Hasher used. * Hasher used.
*/ */
@@ -115,7 +119,6 @@ static bool extract(private_tls_hkdf_t *this, chunk_t salt, chunk_t ikm,
} }
DBG4(DBG_TLS, "PRK: %B", prk); DBG4(DBG_TLS, "PRK: %B", prk);
return TRUE; return TRUE;
} }
@@ -126,24 +129,15 @@ static bool extract(private_tls_hkdf_t *this, chunk_t salt, chunk_t ikm,
static bool expand(private_tls_hkdf_t *this, chunk_t prk, chunk_t info, static bool expand(private_tls_hkdf_t *this, chunk_t prk, chunk_t info,
size_t length, chunk_t *okm) size_t length, chunk_t *okm)
{ {
prf_plus_t *prf_plus; if (!this->prf_plus->set_param(this->prf_plus, KDF_PARAM_KEY, prk) ||
!this->prf_plus->set_param(this->prf_plus, KDF_PARAM_SALT, info) ||
if (!this->prf->set_key(this->prf, prk)) !this->prf_plus->allocate_bytes(this->prf_plus, length, okm))
{
DBG1(DBG_TLS, "unable to set PRF secret to PRK");
return FALSE;
}
prf_plus = prf_plus_create(this->prf, TRUE, info);
if (!prf_plus || !prf_plus->allocate_bytes(prf_plus, length, okm))
{ {
DBG1(DBG_TLS, "unable to allocate PRF+ result"); DBG1(DBG_TLS, "unable to allocate PRF+ result");
DESTROY_IF(prf_plus);
return FALSE; return FALSE;
} }
prf_plus->destroy(prf_plus);
DBG4(DBG_TLS, "OKM: %B", okm); DBG4(DBG_TLS, "OKM: %B", okm);
return TRUE; return TRUE;
} }
@@ -681,6 +675,7 @@ METHOD(tls_hkdf_t, destroy, void,
destroy_secrets(&this->handshake_traffic_secrets); destroy_secrets(&this->handshake_traffic_secrets);
destroy_secrets(&this->traffic_secrets); destroy_secrets(&this->traffic_secrets);
DESTROY_IF(this->prf); DESTROY_IF(this->prf);
DESTROY_IF(this->prf_plus);
DESTROY_IF(this->hasher); DESTROY_IF(this->hasher);
free(this); free(this);
} }
@@ -720,16 +715,23 @@ tls_hkdf_t *tls_hkdf_create(hash_algorithm_t hash_algorithm, chunk_t psk)
.phase = HKDF_PHASE_0, .phase = HKDF_PHASE_0,
.psk = psk.ptr ? chunk_clone(psk) : chunk_empty, .psk = psk.ptr ? chunk_clone(psk) : chunk_empty,
.prf = lib->crypto->create_prf(lib->crypto, prf_algorithm), .prf = lib->crypto->create_prf(lib->crypto, prf_algorithm),
.prf_plus = lib->crypto->create_kdf(lib->crypto, KDF_PRF_PLUS,
prf_algorithm),
.hasher = lib->crypto->create_hasher(lib->crypto, hash_algorithm), .hasher = lib->crypto->create_hasher(lib->crypto, hash_algorithm),
); );
if (!this->prf || !this->hasher) if (!this->prf || !this->prf_plus || !this->hasher)
{ {
if (!this->prf) if (!this->prf)
{ {
DBG1(DBG_TLS, "%N not supported", pseudo_random_function_names, DBG1(DBG_TLS, "%N not supported", pseudo_random_function_names,
prf_algorithm); prf_algorithm);
} }
if (!this->prf_plus)
{
DBG1(DBG_TLS, "%N (%N) not supported", key_derivation_function_names,
KDF_PRF_PLUS, pseudo_random_function_names, prf_algorithm);
}
if (!this->hasher) if (!this->hasher)
{ {
DBG1(DBG_TLS, "%N not supported", hash_algorithm_names, DBG1(DBG_TLS, "%N not supported", hash_algorithm_names,