// Copyright 2018 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package tls import ( "crypto/ecdh" "crypto/hmac" "errors" "fmt" "hash" "io" "golang.org/x/crypto/cryptobyte" "golang.org/x/crypto/hkdf" ) // This file contains the functions necessary to compute the TLS 1.3 key // schedule. See RFC 8446, Section 7. const ( resumptionBinderLabel = "res binder" clientEarlyTrafficLabel = "c e traffic" clientHandshakeTrafficLabel = "c hs traffic" serverHandshakeTrafficLabel = "s hs traffic" clientApplicationTrafficLabel = "c ap traffic" serverApplicationTrafficLabel = "s ap traffic" exporterLabel = "exp master" resumptionLabel = "res master" trafficUpdateLabel = "traffic upd" ) // expandLabel implements HKDF-Expand-Label from RFC 8446, Section 7.1. func (c *cipherSuiteTLS13) expandLabel(secret []byte, label string, context []byte, length int) []byte { var hkdfLabel cryptobyte.Builder hkdfLabel.AddUint16(uint16(length)) hkdfLabel.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) { b.AddBytes([]byte("tls13 ")) b.AddBytes([]byte(label)) }) hkdfLabel.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) { b.AddBytes(context) }) hkdfLabelBytes, err := hkdfLabel.Bytes() if err != nil { // Rather than calling BytesOrPanic, we explicitly handle this error, in // order to provide a reasonable error message. It should be basically // impossible for this to panic, and routing errors back through the // tree rooted in this function is quite painful. The labels are fixed // size, and the context is either a fixed-length computed hash, or // parsed from a field which has the same length limitation. As such, an // error here is likely to only be caused during development. // // NOTE: another reasonable approach here might be to return a // randomized slice if we encounter an error, which would break the // connection, but avoid panicking. This would perhaps be safer but // significantly more confusing to users. panic(fmt.Errorf("failed to construct HKDF label: %s", err)) } out := make([]byte, length) n, err := hkdf.Expand(c.hash.New, secret, hkdfLabelBytes).Read(out) if err != nil || n != length { panic("tls: HKDF-Expand-Label invocation failed unexpectedly") } return out } // deriveSecret implements Derive-Secret from RFC 8446, Section 7.1. func (c *cipherSuiteTLS13) deriveSecret(secret []byte, label string, transcript hash.Hash) []byte { if transcript == nil { transcript = c.hash.New() } return c.expandLabel(secret, label, transcript.Sum(nil), c.hash.Size()) } // extract implements HKDF-Extract with the cipher suite hash. func (c *cipherSuiteTLS13) extract(newSecret, currentSecret []byte) []byte { if newSecret == nil { newSecret = make([]byte, c.hash.Size()) } return hkdf.Extract(c.hash.New, newSecret, currentSecret) } // nextTrafficSecret generates the next traffic secret, given the current one, // according to RFC 8446, Section 7.2. func (c *cipherSuiteTLS13) nextTrafficSecret(trafficSecret []byte) []byte { return c.expandLabel(trafficSecret, trafficUpdateLabel, nil, c.hash.Size()) } // trafficKey generates traffic keys according to RFC 8446, Section 7.3. func (c *cipherSuiteTLS13) trafficKey(trafficSecret []byte) (key, iv []byte) { key = c.expandLabel(trafficSecret, "key", nil, c.keyLen) iv = c.expandLabel(trafficSecret, "iv", nil, aeadNonceLength) return } // finishedHash generates the Finished verify_data or PskBinderEntry according // to RFC 8446, Section 4.4.4. See sections 4.4 and 4.2.11.2 for the baseKey // selection. func (c *cipherSuiteTLS13) finishedHash(baseKey []byte, transcript hash.Hash) []byte { finishedKey := c.expandLabel(baseKey, "finished", nil, c.hash.Size()) verifyData := hmac.New(c.hash.New, finishedKey) verifyData.Write(transcript.Sum(nil)) return verifyData.Sum(nil) } // exportKeyingMaterial implements RFC5705 exporters for TLS 1.3 according to // RFC 8446, Section 7.5. func (c *cipherSuiteTLS13) exportKeyingMaterial(masterSecret []byte, transcript hash.Hash) func(string, []byte, int) ([]byte, error) { expMasterSecret := c.deriveSecret(masterSecret, exporterLabel, transcript) return func(label string, context []byte, length int) ([]byte, error) { secret := c.deriveSecret(expMasterSecret, label, nil) h := c.hash.New() h.Write(context) return c.expandLabel(secret, "exporter", h.Sum(nil), length), nil } } // generateECDHEKey returns a PrivateKey that implements Diffie-Hellman // according to RFC 8446, Section 4.2.8.2. func generateECDHEKey(rand io.Reader, curveID CurveID) (*ecdh.PrivateKey, error) { curve, ok := curveForCurveID(curveID) if !ok { return nil, errors.New("tls: internal error: unsupported curve") } return curve.GenerateKey(rand) } func curveForCurveID(id CurveID) (ecdh.Curve, bool) { switch id { case X25519: return ecdh.X25519(), true case CurveP256: return ecdh.P256(), true case CurveP384: return ecdh.P384(), true case CurveP521: return ecdh.P521(), true default: return nil, false } } func curveIDForCurve(curve ecdh.Curve) (CurveID, bool) { switch curve { case ecdh.X25519(): return X25519, true case ecdh.P256(): return CurveP256, true case ecdh.P384(): return CurveP384, true case ecdh.P521(): return CurveP521, true default: return 0, false } }