1*c1d255d3SCy Schubert /*
2*c1d255d3SCy Schubert * TLS PRF P_SHA384
3*c1d255d3SCy Schubert * Copyright (c) 2011-2019, Jouni Malinen <j@w1.fi>
4*c1d255d3SCy Schubert *
5*c1d255d3SCy Schubert * This software may be distributed under the terms of the BSD license.
6*c1d255d3SCy Schubert * See README for more details.
7*c1d255d3SCy Schubert */
8*c1d255d3SCy Schubert
9*c1d255d3SCy Schubert #include "includes.h"
10*c1d255d3SCy Schubert
11*c1d255d3SCy Schubert #include "common.h"
12*c1d255d3SCy Schubert #include "sha384.h"
13*c1d255d3SCy Schubert
14*c1d255d3SCy Schubert
15*c1d255d3SCy Schubert /**
16*c1d255d3SCy Schubert * tls_prf_sha384 - Pseudo-Random Function for TLS v1.2 (P_SHA384, RFC 5246)
17*c1d255d3SCy Schubert * @secret: Key for PRF
18*c1d255d3SCy Schubert * @secret_len: Length of the key in bytes
19*c1d255d3SCy Schubert * @label: A unique label for each purpose of the PRF
20*c1d255d3SCy Schubert * @seed: Seed value to bind into the key
21*c1d255d3SCy Schubert * @seed_len: Length of the seed
22*c1d255d3SCy Schubert * @out: Buffer for the generated pseudo-random key
23*c1d255d3SCy Schubert * @outlen: Number of bytes of key to generate
24*c1d255d3SCy Schubert * Returns: 0 on success, -1 on failure.
25*c1d255d3SCy Schubert *
26*c1d255d3SCy Schubert * This function is used to derive new, cryptographically separate keys from a
27*c1d255d3SCy Schubert * given key in TLS. This PRF is defined in RFC 5246, Chapter 5.
28*c1d255d3SCy Schubert */
tls_prf_sha384(const u8 * secret,size_t secret_len,const char * label,const u8 * seed,size_t seed_len,u8 * out,size_t outlen)29*c1d255d3SCy Schubert int tls_prf_sha384(const u8 *secret, size_t secret_len, const char *label,
30*c1d255d3SCy Schubert const u8 *seed, size_t seed_len, u8 *out, size_t outlen)
31*c1d255d3SCy Schubert {
32*c1d255d3SCy Schubert size_t clen;
33*c1d255d3SCy Schubert u8 A[SHA384_MAC_LEN];
34*c1d255d3SCy Schubert u8 P[SHA384_MAC_LEN];
35*c1d255d3SCy Schubert size_t pos;
36*c1d255d3SCy Schubert const unsigned char *addr[3];
37*c1d255d3SCy Schubert size_t len[3];
38*c1d255d3SCy Schubert
39*c1d255d3SCy Schubert addr[0] = A;
40*c1d255d3SCy Schubert len[0] = SHA384_MAC_LEN;
41*c1d255d3SCy Schubert addr[1] = (unsigned char *) label;
42*c1d255d3SCy Schubert len[1] = os_strlen(label);
43*c1d255d3SCy Schubert addr[2] = seed;
44*c1d255d3SCy Schubert len[2] = seed_len;
45*c1d255d3SCy Schubert
46*c1d255d3SCy Schubert /*
47*c1d255d3SCy Schubert * RFC 5246, Chapter 5
48*c1d255d3SCy Schubert * A(0) = seed, A(i) = HMAC(secret, A(i-1))
49*c1d255d3SCy Schubert * P_hash = HMAC(secret, A(1) + seed) + HMAC(secret, A(2) + seed) + ..
50*c1d255d3SCy Schubert * PRF(secret, label, seed) = P_SHA384(secret, label + seed)
51*c1d255d3SCy Schubert */
52*c1d255d3SCy Schubert
53*c1d255d3SCy Schubert if (hmac_sha384_vector(secret, secret_len, 2, &addr[1], &len[1], A) < 0)
54*c1d255d3SCy Schubert return -1;
55*c1d255d3SCy Schubert
56*c1d255d3SCy Schubert pos = 0;
57*c1d255d3SCy Schubert while (pos < outlen) {
58*c1d255d3SCy Schubert if (hmac_sha384_vector(secret, secret_len, 3, addr, len, P) <
59*c1d255d3SCy Schubert 0 ||
60*c1d255d3SCy Schubert hmac_sha384(secret, secret_len, A, SHA384_MAC_LEN, A) < 0)
61*c1d255d3SCy Schubert return -1;
62*c1d255d3SCy Schubert
63*c1d255d3SCy Schubert clen = outlen - pos;
64*c1d255d3SCy Schubert if (clen > SHA384_MAC_LEN)
65*c1d255d3SCy Schubert clen = SHA384_MAC_LEN;
66*c1d255d3SCy Schubert os_memcpy(out + pos, P, clen);
67*c1d255d3SCy Schubert pos += clen;
68*c1d255d3SCy Schubert }
69*c1d255d3SCy Schubert
70*c1d255d3SCy Schubert return 0;
71*c1d255d3SCy Schubert }
72