1b077aed3SPierre Pronchery /*
2*e7be843bSPierre Pronchery * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
3b077aed3SPierre Pronchery *
4b077aed3SPierre Pronchery * Licensed under the Apache License 2.0 (the "License"). You may not use
5b077aed3SPierre Pronchery * this file except in compliance with the License. You can obtain a copy
6b077aed3SPierre Pronchery * in the file LICENSE in the source distribution or at
7b077aed3SPierre Pronchery * https://www.openssl.org/source/license.html
8b077aed3SPierre Pronchery */
9b077aed3SPierre Pronchery
10b077aed3SPierre Pronchery /*
11b077aed3SPierre Pronchery * Refer to "The TLS Protocol Version 1.0" Section 5
12b077aed3SPierre Pronchery * (https://tools.ietf.org/html/rfc2246#section-5) and
13b077aed3SPierre Pronchery * "The Transport Layer Security (TLS) Protocol Version 1.2" Section 5
14b077aed3SPierre Pronchery * (https://tools.ietf.org/html/rfc5246#section-5).
15b077aed3SPierre Pronchery *
16b077aed3SPierre Pronchery * For TLS v1.0 and TLS v1.1 the TLS PRF algorithm is given by:
17b077aed3SPierre Pronchery *
18b077aed3SPierre Pronchery * PRF(secret, label, seed) = P_MD5(S1, label + seed) XOR
19b077aed3SPierre Pronchery * P_SHA-1(S2, label + seed)
20b077aed3SPierre Pronchery *
21b077aed3SPierre Pronchery * where P_MD5 and P_SHA-1 are defined by P_<hash>, below, and S1 and S2 are
22b077aed3SPierre Pronchery * two halves of the secret (with the possibility of one shared byte, in the
23b077aed3SPierre Pronchery * case where the length of the original secret is odd). S1 is taken from the
24b077aed3SPierre Pronchery * first half of the secret, S2 from the second half.
25b077aed3SPierre Pronchery *
26b077aed3SPierre Pronchery * For TLS v1.2 the TLS PRF algorithm is given by:
27b077aed3SPierre Pronchery *
28b077aed3SPierre Pronchery * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
29b077aed3SPierre Pronchery *
30b077aed3SPierre Pronchery * where hash is SHA-256 for all cipher suites defined in RFC 5246 as well as
31b077aed3SPierre Pronchery * those published prior to TLS v1.2 while the TLS v1.2 protocol is in effect,
32b077aed3SPierre Pronchery * unless defined otherwise by the cipher suite.
33b077aed3SPierre Pronchery *
34b077aed3SPierre Pronchery * P_<hash> is an expansion function that uses a single hash function to expand
35b077aed3SPierre Pronchery * a secret and seed into an arbitrary quantity of output:
36b077aed3SPierre Pronchery *
37b077aed3SPierre Pronchery * P_<hash>(secret, seed) = HMAC_<hash>(secret, A(1) + seed) +
38b077aed3SPierre Pronchery * HMAC_<hash>(secret, A(2) + seed) +
39b077aed3SPierre Pronchery * HMAC_<hash>(secret, A(3) + seed) + ...
40b077aed3SPierre Pronchery *
41b077aed3SPierre Pronchery * where + indicates concatenation. P_<hash> can be iterated as many times as
42b077aed3SPierre Pronchery * is necessary to produce the required quantity of data.
43b077aed3SPierre Pronchery *
44b077aed3SPierre Pronchery * A(i) is defined as:
45b077aed3SPierre Pronchery * A(0) = seed
46b077aed3SPierre Pronchery * A(i) = HMAC_<hash>(secret, A(i-1))
47b077aed3SPierre Pronchery */
48*e7be843bSPierre Pronchery
49*e7be843bSPierre Pronchery /*
50*e7be843bSPierre Pronchery * Low level APIs (such as DH) are deprecated for public use, but still ok for
51*e7be843bSPierre Pronchery * internal use.
52*e7be843bSPierre Pronchery */
53*e7be843bSPierre Pronchery #include "internal/deprecated.h"
54*e7be843bSPierre Pronchery
55b077aed3SPierre Pronchery #include <stdio.h>
56b077aed3SPierre Pronchery #include <stdarg.h>
57b077aed3SPierre Pronchery #include <string.h>
58b077aed3SPierre Pronchery #include <openssl/evp.h>
59b077aed3SPierre Pronchery #include <openssl/kdf.h>
60b077aed3SPierre Pronchery #include <openssl/core_names.h>
61b077aed3SPierre Pronchery #include <openssl/params.h>
62b077aed3SPierre Pronchery #include <openssl/proverr.h>
63b077aed3SPierre Pronchery #include "internal/cryptlib.h"
64b077aed3SPierre Pronchery #include "internal/numbers.h"
65b077aed3SPierre Pronchery #include "crypto/evp.h"
66b077aed3SPierre Pronchery #include "prov/provider_ctx.h"
67b077aed3SPierre Pronchery #include "prov/providercommon.h"
68b077aed3SPierre Pronchery #include "prov/implementations.h"
69b077aed3SPierre Pronchery #include "prov/provider_util.h"
70*e7be843bSPierre Pronchery #include "prov/securitycheck.h"
71*e7be843bSPierre Pronchery #include "internal/e_os.h"
72*e7be843bSPierre Pronchery #include "internal/safe_math.h"
73*e7be843bSPierre Pronchery
74*e7be843bSPierre Pronchery OSSL_SAFE_MATH_UNSIGNED(size_t, size_t)
75b077aed3SPierre Pronchery
76b077aed3SPierre Pronchery static OSSL_FUNC_kdf_newctx_fn kdf_tls1_prf_new;
77*e7be843bSPierre Pronchery static OSSL_FUNC_kdf_dupctx_fn kdf_tls1_prf_dup;
78b077aed3SPierre Pronchery static OSSL_FUNC_kdf_freectx_fn kdf_tls1_prf_free;
79b077aed3SPierre Pronchery static OSSL_FUNC_kdf_reset_fn kdf_tls1_prf_reset;
80b077aed3SPierre Pronchery static OSSL_FUNC_kdf_derive_fn kdf_tls1_prf_derive;
81b077aed3SPierre Pronchery static OSSL_FUNC_kdf_settable_ctx_params_fn kdf_tls1_prf_settable_ctx_params;
82b077aed3SPierre Pronchery static OSSL_FUNC_kdf_set_ctx_params_fn kdf_tls1_prf_set_ctx_params;
83b077aed3SPierre Pronchery static OSSL_FUNC_kdf_gettable_ctx_params_fn kdf_tls1_prf_gettable_ctx_params;
84b077aed3SPierre Pronchery static OSSL_FUNC_kdf_get_ctx_params_fn kdf_tls1_prf_get_ctx_params;
85b077aed3SPierre Pronchery
86b077aed3SPierre Pronchery static int tls1_prf_alg(EVP_MAC_CTX *mdctx, EVP_MAC_CTX *sha1ctx,
87b077aed3SPierre Pronchery const unsigned char *sec, size_t slen,
88b077aed3SPierre Pronchery const unsigned char *seed, size_t seed_len,
89b077aed3SPierre Pronchery unsigned char *out, size_t olen);
90b077aed3SPierre Pronchery
91*e7be843bSPierre Pronchery #define TLS_MD_MASTER_SECRET_CONST "\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x74"
92*e7be843bSPierre Pronchery #define TLS_MD_MASTER_SECRET_CONST_SIZE 13
93b077aed3SPierre Pronchery
94b077aed3SPierre Pronchery /* TLS KDF kdf context structure */
95b077aed3SPierre Pronchery typedef struct {
96b077aed3SPierre Pronchery void *provctx;
97b077aed3SPierre Pronchery
98b077aed3SPierre Pronchery /* MAC context for the main digest */
99b077aed3SPierre Pronchery EVP_MAC_CTX *P_hash;
100b077aed3SPierre Pronchery /* MAC context for SHA1 for the MD5/SHA-1 combined PRF */
101b077aed3SPierre Pronchery EVP_MAC_CTX *P_sha1;
102b077aed3SPierre Pronchery
103b077aed3SPierre Pronchery /* Secret value to use for PRF */
104b077aed3SPierre Pronchery unsigned char *sec;
105b077aed3SPierre Pronchery size_t seclen;
106*e7be843bSPierre Pronchery /* Concatenated seed data */
107*e7be843bSPierre Pronchery unsigned char *seed;
108b077aed3SPierre Pronchery size_t seedlen;
109*e7be843bSPierre Pronchery
110*e7be843bSPierre Pronchery OSSL_FIPS_IND_DECLARE
111b077aed3SPierre Pronchery } TLS1_PRF;
112b077aed3SPierre Pronchery
kdf_tls1_prf_new(void * provctx)113b077aed3SPierre Pronchery static void *kdf_tls1_prf_new(void *provctx)
114b077aed3SPierre Pronchery {
115b077aed3SPierre Pronchery TLS1_PRF *ctx;
116b077aed3SPierre Pronchery
117b077aed3SPierre Pronchery if (!ossl_prov_is_running())
118b077aed3SPierre Pronchery return NULL;
119b077aed3SPierre Pronchery
120*e7be843bSPierre Pronchery if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) != NULL) {
121b077aed3SPierre Pronchery ctx->provctx = provctx;
122*e7be843bSPierre Pronchery OSSL_FIPS_IND_INIT(ctx)
123*e7be843bSPierre Pronchery }
124b077aed3SPierre Pronchery return ctx;
125b077aed3SPierre Pronchery }
126b077aed3SPierre Pronchery
kdf_tls1_prf_free(void * vctx)127b077aed3SPierre Pronchery static void kdf_tls1_prf_free(void *vctx)
128b077aed3SPierre Pronchery {
129b077aed3SPierre Pronchery TLS1_PRF *ctx = (TLS1_PRF *)vctx;
130b077aed3SPierre Pronchery
131b077aed3SPierre Pronchery if (ctx != NULL) {
132b077aed3SPierre Pronchery kdf_tls1_prf_reset(ctx);
133b077aed3SPierre Pronchery OPENSSL_free(ctx);
134b077aed3SPierre Pronchery }
135b077aed3SPierre Pronchery }
136b077aed3SPierre Pronchery
kdf_tls1_prf_reset(void * vctx)137b077aed3SPierre Pronchery static void kdf_tls1_prf_reset(void *vctx)
138b077aed3SPierre Pronchery {
139b077aed3SPierre Pronchery TLS1_PRF *ctx = (TLS1_PRF *)vctx;
140b077aed3SPierre Pronchery void *provctx = ctx->provctx;
141b077aed3SPierre Pronchery
142b077aed3SPierre Pronchery EVP_MAC_CTX_free(ctx->P_hash);
143b077aed3SPierre Pronchery EVP_MAC_CTX_free(ctx->P_sha1);
144b077aed3SPierre Pronchery OPENSSL_clear_free(ctx->sec, ctx->seclen);
145*e7be843bSPierre Pronchery OPENSSL_clear_free(ctx->seed, ctx->seedlen);
146b077aed3SPierre Pronchery memset(ctx, 0, sizeof(*ctx));
147b077aed3SPierre Pronchery ctx->provctx = provctx;
148b077aed3SPierre Pronchery }
149b077aed3SPierre Pronchery
kdf_tls1_prf_dup(void * vctx)150*e7be843bSPierre Pronchery static void *kdf_tls1_prf_dup(void *vctx)
151*e7be843bSPierre Pronchery {
152*e7be843bSPierre Pronchery const TLS1_PRF *src = (const TLS1_PRF *)vctx;
153*e7be843bSPierre Pronchery TLS1_PRF *dest;
154*e7be843bSPierre Pronchery
155*e7be843bSPierre Pronchery dest = kdf_tls1_prf_new(src->provctx);
156*e7be843bSPierre Pronchery if (dest != NULL) {
157*e7be843bSPierre Pronchery if (src->P_hash != NULL
158*e7be843bSPierre Pronchery && (dest->P_hash = EVP_MAC_CTX_dup(src->P_hash)) == NULL)
159*e7be843bSPierre Pronchery goto err;
160*e7be843bSPierre Pronchery if (src->P_sha1 != NULL
161*e7be843bSPierre Pronchery && (dest->P_sha1 = EVP_MAC_CTX_dup(src->P_sha1)) == NULL)
162*e7be843bSPierre Pronchery goto err;
163*e7be843bSPierre Pronchery if (!ossl_prov_memdup(src->sec, src->seclen, &dest->sec, &dest->seclen))
164*e7be843bSPierre Pronchery goto err;
165*e7be843bSPierre Pronchery if (!ossl_prov_memdup(src->seed, src->seedlen, &dest->seed,
166*e7be843bSPierre Pronchery &dest->seedlen))
167*e7be843bSPierre Pronchery goto err;
168*e7be843bSPierre Pronchery OSSL_FIPS_IND_COPY(dest, src)
169*e7be843bSPierre Pronchery }
170*e7be843bSPierre Pronchery return dest;
171*e7be843bSPierre Pronchery
172*e7be843bSPierre Pronchery err:
173*e7be843bSPierre Pronchery kdf_tls1_prf_free(dest);
174*e7be843bSPierre Pronchery return NULL;
175*e7be843bSPierre Pronchery }
176*e7be843bSPierre Pronchery
177*e7be843bSPierre Pronchery #ifdef FIPS_MODULE
178*e7be843bSPierre Pronchery
fips_ems_check_passed(TLS1_PRF * ctx)179*e7be843bSPierre Pronchery static int fips_ems_check_passed(TLS1_PRF *ctx)
180*e7be843bSPierre Pronchery {
181*e7be843bSPierre Pronchery OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
182*e7be843bSPierre Pronchery /*
183*e7be843bSPierre Pronchery * Check that TLS is using EMS.
184*e7be843bSPierre Pronchery *
185*e7be843bSPierre Pronchery * The seed buffer is prepended with a label.
186*e7be843bSPierre Pronchery * If EMS mode is enforced then the label "master secret" is not allowed,
187*e7be843bSPierre Pronchery * We do the check this way since the PRF is used for other purposes, as well
188*e7be843bSPierre Pronchery * as "extended master secret".
189*e7be843bSPierre Pronchery */
190*e7be843bSPierre Pronchery int ems_approved = (ctx->seedlen < TLS_MD_MASTER_SECRET_CONST_SIZE
191*e7be843bSPierre Pronchery || memcmp(ctx->seed, TLS_MD_MASTER_SECRET_CONST,
192*e7be843bSPierre Pronchery TLS_MD_MASTER_SECRET_CONST_SIZE) != 0);
193*e7be843bSPierre Pronchery
194*e7be843bSPierre Pronchery if (!ems_approved) {
195*e7be843bSPierre Pronchery if (!OSSL_FIPS_IND_ON_UNAPPROVED(ctx, OSSL_FIPS_IND_SETTABLE0,
196*e7be843bSPierre Pronchery libctx, "TLS_PRF", "EMS",
197*e7be843bSPierre Pronchery ossl_fips_config_tls1_prf_ems_check)) {
198*e7be843bSPierre Pronchery ERR_raise(ERR_LIB_PROV, PROV_R_EMS_NOT_ENABLED);
199*e7be843bSPierre Pronchery return 0;
200*e7be843bSPierre Pronchery }
201*e7be843bSPierre Pronchery }
202*e7be843bSPierre Pronchery return 1;
203*e7be843bSPierre Pronchery }
204*e7be843bSPierre Pronchery
fips_digest_check_passed(TLS1_PRF * ctx,const EVP_MD * md)205*e7be843bSPierre Pronchery static int fips_digest_check_passed(TLS1_PRF *ctx, const EVP_MD *md)
206*e7be843bSPierre Pronchery {
207*e7be843bSPierre Pronchery OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
208*e7be843bSPierre Pronchery /*
209*e7be843bSPierre Pronchery * Perform digest check
210*e7be843bSPierre Pronchery *
211*e7be843bSPierre Pronchery * According to NIST SP 800-135r1 section 5.2, the valid hash functions are
212*e7be843bSPierre Pronchery * specified in FIPS 180-3. ACVP also only lists the same set of hash
213*e7be843bSPierre Pronchery * functions.
214*e7be843bSPierre Pronchery */
215*e7be843bSPierre Pronchery int digest_unapproved = !EVP_MD_is_a(md, SN_sha256)
216*e7be843bSPierre Pronchery && !EVP_MD_is_a(md, SN_sha384)
217*e7be843bSPierre Pronchery && !EVP_MD_is_a(md, SN_sha512);
218*e7be843bSPierre Pronchery
219*e7be843bSPierre Pronchery if (digest_unapproved) {
220*e7be843bSPierre Pronchery if (!OSSL_FIPS_IND_ON_UNAPPROVED(ctx, OSSL_FIPS_IND_SETTABLE1,
221*e7be843bSPierre Pronchery libctx, "TLS_PRF", "Digest",
222*e7be843bSPierre Pronchery ossl_fips_config_tls1_prf_digest_check)) {
223*e7be843bSPierre Pronchery ERR_raise(ERR_LIB_PROV, PROV_R_DIGEST_NOT_ALLOWED);
224*e7be843bSPierre Pronchery return 0;
225*e7be843bSPierre Pronchery }
226*e7be843bSPierre Pronchery }
227*e7be843bSPierre Pronchery return 1;
228*e7be843bSPierre Pronchery }
229*e7be843bSPierre Pronchery
fips_key_check_passed(TLS1_PRF * ctx)230*e7be843bSPierre Pronchery static int fips_key_check_passed(TLS1_PRF *ctx)
231*e7be843bSPierre Pronchery {
232*e7be843bSPierre Pronchery OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
233*e7be843bSPierre Pronchery int key_approved = ossl_kdf_check_key_size(ctx->seclen);
234*e7be843bSPierre Pronchery
235*e7be843bSPierre Pronchery if (!key_approved) {
236*e7be843bSPierre Pronchery if (!OSSL_FIPS_IND_ON_UNAPPROVED(ctx, OSSL_FIPS_IND_SETTABLE2,
237*e7be843bSPierre Pronchery libctx, "TLS_PRF", "Key size",
238*e7be843bSPierre Pronchery ossl_fips_config_tls1_prf_key_check)) {
239*e7be843bSPierre Pronchery ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
240*e7be843bSPierre Pronchery return 0;
241*e7be843bSPierre Pronchery }
242*e7be843bSPierre Pronchery }
243*e7be843bSPierre Pronchery return 1;
244*e7be843bSPierre Pronchery }
245*e7be843bSPierre Pronchery #endif
246*e7be843bSPierre Pronchery
kdf_tls1_prf_derive(void * vctx,unsigned char * key,size_t keylen,const OSSL_PARAM params[])247b077aed3SPierre Pronchery static int kdf_tls1_prf_derive(void *vctx, unsigned char *key, size_t keylen,
248b077aed3SPierre Pronchery const OSSL_PARAM params[])
249b077aed3SPierre Pronchery {
250b077aed3SPierre Pronchery TLS1_PRF *ctx = (TLS1_PRF *)vctx;
251b077aed3SPierre Pronchery
252b077aed3SPierre Pronchery if (!ossl_prov_is_running() || !kdf_tls1_prf_set_ctx_params(ctx, params))
253b077aed3SPierre Pronchery return 0;
254b077aed3SPierre Pronchery
255b077aed3SPierre Pronchery if (ctx->P_hash == NULL) {
256b077aed3SPierre Pronchery ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST);
257b077aed3SPierre Pronchery return 0;
258b077aed3SPierre Pronchery }
259b077aed3SPierre Pronchery if (ctx->sec == NULL) {
260b077aed3SPierre Pronchery ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_SECRET);
261b077aed3SPierre Pronchery return 0;
262b077aed3SPierre Pronchery }
263b077aed3SPierre Pronchery if (ctx->seedlen == 0) {
264b077aed3SPierre Pronchery ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_SEED);
265b077aed3SPierre Pronchery return 0;
266b077aed3SPierre Pronchery }
267b077aed3SPierre Pronchery if (keylen == 0) {
268b077aed3SPierre Pronchery ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
269b077aed3SPierre Pronchery return 0;
270b077aed3SPierre Pronchery }
271b077aed3SPierre Pronchery
272*e7be843bSPierre Pronchery #ifdef FIPS_MODULE
273*e7be843bSPierre Pronchery if (!fips_ems_check_passed(ctx))
274*e7be843bSPierre Pronchery return 0;
275*e7be843bSPierre Pronchery #endif
276*e7be843bSPierre Pronchery
277b077aed3SPierre Pronchery return tls1_prf_alg(ctx->P_hash, ctx->P_sha1,
278b077aed3SPierre Pronchery ctx->sec, ctx->seclen,
279b077aed3SPierre Pronchery ctx->seed, ctx->seedlen,
280b077aed3SPierre Pronchery key, keylen);
281b077aed3SPierre Pronchery }
282b077aed3SPierre Pronchery
kdf_tls1_prf_set_ctx_params(void * vctx,const OSSL_PARAM params[])283b077aed3SPierre Pronchery static int kdf_tls1_prf_set_ctx_params(void *vctx, const OSSL_PARAM params[])
284b077aed3SPierre Pronchery {
285b077aed3SPierre Pronchery const OSSL_PARAM *p;
286b077aed3SPierre Pronchery TLS1_PRF *ctx = vctx;
287b077aed3SPierre Pronchery OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
288b077aed3SPierre Pronchery
289*e7be843bSPierre Pronchery if (ossl_param_is_empty(params))
290b077aed3SPierre Pronchery return 1;
291b077aed3SPierre Pronchery
292*e7be843bSPierre Pronchery if (!OSSL_FIPS_IND_SET_CTX_PARAM(ctx, OSSL_FIPS_IND_SETTABLE0, params,
293*e7be843bSPierre Pronchery OSSL_KDF_PARAM_FIPS_EMS_CHECK))
294*e7be843bSPierre Pronchery return 0;
295*e7be843bSPierre Pronchery if (!OSSL_FIPS_IND_SET_CTX_PARAM(ctx, OSSL_FIPS_IND_SETTABLE1, params,
296*e7be843bSPierre Pronchery OSSL_KDF_PARAM_FIPS_DIGEST_CHECK))
297*e7be843bSPierre Pronchery return 0;
298*e7be843bSPierre Pronchery if (!OSSL_FIPS_IND_SET_CTX_PARAM(ctx, OSSL_FIPS_IND_SETTABLE2, params,
299*e7be843bSPierre Pronchery OSSL_KDF_PARAM_FIPS_KEY_CHECK))
300*e7be843bSPierre Pronchery return 0;
301*e7be843bSPierre Pronchery
302b077aed3SPierre Pronchery if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_DIGEST)) != NULL) {
303*e7be843bSPierre Pronchery PROV_DIGEST digest;
304*e7be843bSPierre Pronchery const EVP_MD *md = NULL;
305*e7be843bSPierre Pronchery
306b077aed3SPierre Pronchery if (OPENSSL_strcasecmp(p->data, SN_md5_sha1) == 0) {
307b077aed3SPierre Pronchery if (!ossl_prov_macctx_load_from_params(&ctx->P_hash, params,
308b077aed3SPierre Pronchery OSSL_MAC_NAME_HMAC,
309b077aed3SPierre Pronchery NULL, SN_md5, libctx)
310b077aed3SPierre Pronchery || !ossl_prov_macctx_load_from_params(&ctx->P_sha1, params,
311b077aed3SPierre Pronchery OSSL_MAC_NAME_HMAC,
312b077aed3SPierre Pronchery NULL, SN_sha1, libctx))
313b077aed3SPierre Pronchery return 0;
314b077aed3SPierre Pronchery } else {
315b077aed3SPierre Pronchery EVP_MAC_CTX_free(ctx->P_sha1);
316b077aed3SPierre Pronchery if (!ossl_prov_macctx_load_from_params(&ctx->P_hash, params,
317b077aed3SPierre Pronchery OSSL_MAC_NAME_HMAC,
318b077aed3SPierre Pronchery NULL, NULL, libctx))
319b077aed3SPierre Pronchery return 0;
320b077aed3SPierre Pronchery }
321*e7be843bSPierre Pronchery
322*e7be843bSPierre Pronchery memset(&digest, 0, sizeof(digest));
323*e7be843bSPierre Pronchery if (!ossl_prov_digest_load_from_params(&digest, params, libctx))
324*e7be843bSPierre Pronchery return 0;
325*e7be843bSPierre Pronchery
326*e7be843bSPierre Pronchery md = ossl_prov_digest_md(&digest);
327*e7be843bSPierre Pronchery if (EVP_MD_xof(md)) {
328*e7be843bSPierre Pronchery ERR_raise(ERR_LIB_PROV, PROV_R_XOF_DIGESTS_NOT_ALLOWED);
329*e7be843bSPierre Pronchery ossl_prov_digest_reset(&digest);
330*e7be843bSPierre Pronchery return 0;
331*e7be843bSPierre Pronchery }
332*e7be843bSPierre Pronchery
333*e7be843bSPierre Pronchery #ifdef FIPS_MODULE
334*e7be843bSPierre Pronchery if (!fips_digest_check_passed(ctx, md)) {
335*e7be843bSPierre Pronchery ossl_prov_digest_reset(&digest);
336*e7be843bSPierre Pronchery return 0;
337*e7be843bSPierre Pronchery }
338*e7be843bSPierre Pronchery #endif
339*e7be843bSPierre Pronchery
340*e7be843bSPierre Pronchery ossl_prov_digest_reset(&digest);
341b077aed3SPierre Pronchery }
342b077aed3SPierre Pronchery
343b077aed3SPierre Pronchery if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_SECRET)) != NULL) {
344b077aed3SPierre Pronchery OPENSSL_clear_free(ctx->sec, ctx->seclen);
345b077aed3SPierre Pronchery ctx->sec = NULL;
346b077aed3SPierre Pronchery if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->sec, 0, &ctx->seclen))
347b077aed3SPierre Pronchery return 0;
348*e7be843bSPierre Pronchery
349*e7be843bSPierre Pronchery #ifdef FIPS_MODULE
350*e7be843bSPierre Pronchery if (!fips_key_check_passed(ctx))
351*e7be843bSPierre Pronchery return 0;
352*e7be843bSPierre Pronchery #endif
353b077aed3SPierre Pronchery }
354b077aed3SPierre Pronchery /* The seed fields concatenate, so process them all */
355b077aed3SPierre Pronchery if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_SEED)) != NULL) {
356b077aed3SPierre Pronchery for (; p != NULL; p = OSSL_PARAM_locate_const(p + 1,
357b077aed3SPierre Pronchery OSSL_KDF_PARAM_SEED)) {
358*e7be843bSPierre Pronchery if (p->data_size != 0 && p->data != NULL) {
359*e7be843bSPierre Pronchery const void *val = NULL;
360b077aed3SPierre Pronchery size_t sz = 0;
361*e7be843bSPierre Pronchery unsigned char *seed;
362*e7be843bSPierre Pronchery size_t seedlen;
363*e7be843bSPierre Pronchery int err = 0;
364b077aed3SPierre Pronchery
365*e7be843bSPierre Pronchery if (!OSSL_PARAM_get_octet_string_ptr(p, &val, &sz))
366b077aed3SPierre Pronchery return 0;
367*e7be843bSPierre Pronchery
368*e7be843bSPierre Pronchery seedlen = safe_add_size_t(ctx->seedlen, sz, &err);
369*e7be843bSPierre Pronchery if (err)
370*e7be843bSPierre Pronchery return 0;
371*e7be843bSPierre Pronchery
372*e7be843bSPierre Pronchery seed = OPENSSL_clear_realloc(ctx->seed, ctx->seedlen, seedlen);
373*e7be843bSPierre Pronchery if (!seed)
374*e7be843bSPierre Pronchery return 0;
375*e7be843bSPierre Pronchery
376*e7be843bSPierre Pronchery ctx->seed = seed;
377*e7be843bSPierre Pronchery if (ossl_assert(sz != 0))
378*e7be843bSPierre Pronchery memcpy(ctx->seed + ctx->seedlen, val, sz);
379*e7be843bSPierre Pronchery ctx->seedlen = seedlen;
380*e7be843bSPierre Pronchery }
381b077aed3SPierre Pronchery }
382b077aed3SPierre Pronchery }
383b077aed3SPierre Pronchery return 1;
384b077aed3SPierre Pronchery }
385b077aed3SPierre Pronchery
kdf_tls1_prf_settable_ctx_params(ossl_unused void * ctx,ossl_unused void * provctx)386b077aed3SPierre Pronchery static const OSSL_PARAM *kdf_tls1_prf_settable_ctx_params(
387b077aed3SPierre Pronchery ossl_unused void *ctx, ossl_unused void *provctx)
388b077aed3SPierre Pronchery {
389b077aed3SPierre Pronchery static const OSSL_PARAM known_settable_ctx_params[] = {
390b077aed3SPierre Pronchery OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_PROPERTIES, NULL, 0),
391b077aed3SPierre Pronchery OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_DIGEST, NULL, 0),
392b077aed3SPierre Pronchery OSSL_PARAM_octet_string(OSSL_KDF_PARAM_SECRET, NULL, 0),
393b077aed3SPierre Pronchery OSSL_PARAM_octet_string(OSSL_KDF_PARAM_SEED, NULL, 0),
394*e7be843bSPierre Pronchery OSSL_FIPS_IND_SETTABLE_CTX_PARAM(OSSL_KDF_PARAM_FIPS_EMS_CHECK)
395*e7be843bSPierre Pronchery OSSL_FIPS_IND_SETTABLE_CTX_PARAM(OSSL_KDF_PARAM_FIPS_DIGEST_CHECK)
396*e7be843bSPierre Pronchery OSSL_FIPS_IND_SETTABLE_CTX_PARAM(OSSL_KDF_PARAM_FIPS_KEY_CHECK)
397b077aed3SPierre Pronchery OSSL_PARAM_END
398b077aed3SPierre Pronchery };
399b077aed3SPierre Pronchery return known_settable_ctx_params;
400b077aed3SPierre Pronchery }
401b077aed3SPierre Pronchery
kdf_tls1_prf_get_ctx_params(void * vctx,OSSL_PARAM params[])402b077aed3SPierre Pronchery static int kdf_tls1_prf_get_ctx_params(void *vctx, OSSL_PARAM params[])
403b077aed3SPierre Pronchery {
404b077aed3SPierre Pronchery OSSL_PARAM *p;
405b077aed3SPierre Pronchery
406*e7be843bSPierre Pronchery if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_SIZE)) != NULL) {
407*e7be843bSPierre Pronchery if (!OSSL_PARAM_set_size_t(p, SIZE_MAX))
408*e7be843bSPierre Pronchery return 0;
409*e7be843bSPierre Pronchery }
410*e7be843bSPierre Pronchery if (!OSSL_FIPS_IND_GET_CTX_PARAM(((TLS1_PRF *)vctx), params))
411*e7be843bSPierre Pronchery return 0;
412*e7be843bSPierre Pronchery return 1;
413b077aed3SPierre Pronchery }
414b077aed3SPierre Pronchery
kdf_tls1_prf_gettable_ctx_params(ossl_unused void * ctx,ossl_unused void * provctx)415b077aed3SPierre Pronchery static const OSSL_PARAM *kdf_tls1_prf_gettable_ctx_params(
416b077aed3SPierre Pronchery ossl_unused void *ctx, ossl_unused void *provctx)
417b077aed3SPierre Pronchery {
418b077aed3SPierre Pronchery static const OSSL_PARAM known_gettable_ctx_params[] = {
419b077aed3SPierre Pronchery OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL),
420*e7be843bSPierre Pronchery OSSL_FIPS_IND_GETTABLE_CTX_PARAM()
421b077aed3SPierre Pronchery OSSL_PARAM_END
422b077aed3SPierre Pronchery };
423b077aed3SPierre Pronchery return known_gettable_ctx_params;
424b077aed3SPierre Pronchery }
425b077aed3SPierre Pronchery
426b077aed3SPierre Pronchery const OSSL_DISPATCH ossl_kdf_tls1_prf_functions[] = {
427b077aed3SPierre Pronchery { OSSL_FUNC_KDF_NEWCTX, (void(*)(void))kdf_tls1_prf_new },
428*e7be843bSPierre Pronchery { OSSL_FUNC_KDF_DUPCTX, (void(*)(void))kdf_tls1_prf_dup },
429b077aed3SPierre Pronchery { OSSL_FUNC_KDF_FREECTX, (void(*)(void))kdf_tls1_prf_free },
430b077aed3SPierre Pronchery { OSSL_FUNC_KDF_RESET, (void(*)(void))kdf_tls1_prf_reset },
431b077aed3SPierre Pronchery { OSSL_FUNC_KDF_DERIVE, (void(*)(void))kdf_tls1_prf_derive },
432b077aed3SPierre Pronchery { OSSL_FUNC_KDF_SETTABLE_CTX_PARAMS,
433b077aed3SPierre Pronchery (void(*)(void))kdf_tls1_prf_settable_ctx_params },
434b077aed3SPierre Pronchery { OSSL_FUNC_KDF_SET_CTX_PARAMS,
435b077aed3SPierre Pronchery (void(*)(void))kdf_tls1_prf_set_ctx_params },
436b077aed3SPierre Pronchery { OSSL_FUNC_KDF_GETTABLE_CTX_PARAMS,
437b077aed3SPierre Pronchery (void(*)(void))kdf_tls1_prf_gettable_ctx_params },
438b077aed3SPierre Pronchery { OSSL_FUNC_KDF_GET_CTX_PARAMS,
439b077aed3SPierre Pronchery (void(*)(void))kdf_tls1_prf_get_ctx_params },
440*e7be843bSPierre Pronchery OSSL_DISPATCH_END
441b077aed3SPierre Pronchery };
442b077aed3SPierre Pronchery
443b077aed3SPierre Pronchery /*
444b077aed3SPierre Pronchery * Refer to "The TLS Protocol Version 1.0" Section 5
445b077aed3SPierre Pronchery * (https://tools.ietf.org/html/rfc2246#section-5) and
446b077aed3SPierre Pronchery * "The Transport Layer Security (TLS) Protocol Version 1.2" Section 5
447b077aed3SPierre Pronchery * (https://tools.ietf.org/html/rfc5246#section-5).
448b077aed3SPierre Pronchery *
449b077aed3SPierre Pronchery * P_<hash> is an expansion function that uses a single hash function to expand
450b077aed3SPierre Pronchery * a secret and seed into an arbitrary quantity of output:
451b077aed3SPierre Pronchery *
452b077aed3SPierre Pronchery * P_<hash>(secret, seed) = HMAC_<hash>(secret, A(1) + seed) +
453b077aed3SPierre Pronchery * HMAC_<hash>(secret, A(2) + seed) +
454b077aed3SPierre Pronchery * HMAC_<hash>(secret, A(3) + seed) + ...
455b077aed3SPierre Pronchery *
456b077aed3SPierre Pronchery * where + indicates concatenation. P_<hash> can be iterated as many times as
457b077aed3SPierre Pronchery * is necessary to produce the required quantity of data.
458b077aed3SPierre Pronchery *
459b077aed3SPierre Pronchery * A(i) is defined as:
460b077aed3SPierre Pronchery * A(0) = seed
461b077aed3SPierre Pronchery * A(i) = HMAC_<hash>(secret, A(i-1))
462b077aed3SPierre Pronchery */
tls1_prf_P_hash(EVP_MAC_CTX * ctx_init,const unsigned char * sec,size_t sec_len,const unsigned char * seed,size_t seed_len,unsigned char * out,size_t olen)463b077aed3SPierre Pronchery static int tls1_prf_P_hash(EVP_MAC_CTX *ctx_init,
464b077aed3SPierre Pronchery const unsigned char *sec, size_t sec_len,
465b077aed3SPierre Pronchery const unsigned char *seed, size_t seed_len,
466b077aed3SPierre Pronchery unsigned char *out, size_t olen)
467b077aed3SPierre Pronchery {
468b077aed3SPierre Pronchery size_t chunk;
469b077aed3SPierre Pronchery EVP_MAC_CTX *ctx = NULL, *ctx_Ai = NULL;
470b077aed3SPierre Pronchery unsigned char Ai[EVP_MAX_MD_SIZE];
471b077aed3SPierre Pronchery size_t Ai_len;
472b077aed3SPierre Pronchery int ret = 0;
473b077aed3SPierre Pronchery
474b077aed3SPierre Pronchery if (!EVP_MAC_init(ctx_init, sec, sec_len, NULL))
475b077aed3SPierre Pronchery goto err;
476b077aed3SPierre Pronchery chunk = EVP_MAC_CTX_get_mac_size(ctx_init);
477b077aed3SPierre Pronchery if (chunk == 0)
478b077aed3SPierre Pronchery goto err;
479b077aed3SPierre Pronchery /* A(0) = seed */
480b077aed3SPierre Pronchery ctx_Ai = EVP_MAC_CTX_dup(ctx_init);
481b077aed3SPierre Pronchery if (ctx_Ai == NULL)
482b077aed3SPierre Pronchery goto err;
483b077aed3SPierre Pronchery if (seed != NULL && !EVP_MAC_update(ctx_Ai, seed, seed_len))
484b077aed3SPierre Pronchery goto err;
485b077aed3SPierre Pronchery
486b077aed3SPierre Pronchery for (;;) {
487b077aed3SPierre Pronchery /* calc: A(i) = HMAC_<hash>(secret, A(i-1)) */
488b077aed3SPierre Pronchery if (!EVP_MAC_final(ctx_Ai, Ai, &Ai_len, sizeof(Ai)))
489b077aed3SPierre Pronchery goto err;
490b077aed3SPierre Pronchery EVP_MAC_CTX_free(ctx_Ai);
491b077aed3SPierre Pronchery ctx_Ai = NULL;
492b077aed3SPierre Pronchery
493b077aed3SPierre Pronchery /* calc next chunk: HMAC_<hash>(secret, A(i) + seed) */
494b077aed3SPierre Pronchery ctx = EVP_MAC_CTX_dup(ctx_init);
495b077aed3SPierre Pronchery if (ctx == NULL)
496b077aed3SPierre Pronchery goto err;
497b077aed3SPierre Pronchery if (!EVP_MAC_update(ctx, Ai, Ai_len))
498b077aed3SPierre Pronchery goto err;
499b077aed3SPierre Pronchery /* save state for calculating next A(i) value */
500b077aed3SPierre Pronchery if (olen > chunk) {
501b077aed3SPierre Pronchery ctx_Ai = EVP_MAC_CTX_dup(ctx);
502b077aed3SPierre Pronchery if (ctx_Ai == NULL)
503b077aed3SPierre Pronchery goto err;
504b077aed3SPierre Pronchery }
505b077aed3SPierre Pronchery if (seed != NULL && !EVP_MAC_update(ctx, seed, seed_len))
506b077aed3SPierre Pronchery goto err;
507b077aed3SPierre Pronchery if (olen <= chunk) {
508b077aed3SPierre Pronchery /* last chunk - use Ai as temp bounce buffer */
509b077aed3SPierre Pronchery if (!EVP_MAC_final(ctx, Ai, &Ai_len, sizeof(Ai)))
510b077aed3SPierre Pronchery goto err;
511b077aed3SPierre Pronchery memcpy(out, Ai, olen);
512b077aed3SPierre Pronchery break;
513b077aed3SPierre Pronchery }
514b077aed3SPierre Pronchery if (!EVP_MAC_final(ctx, out, NULL, olen))
515b077aed3SPierre Pronchery goto err;
516b077aed3SPierre Pronchery EVP_MAC_CTX_free(ctx);
517b077aed3SPierre Pronchery ctx = NULL;
518b077aed3SPierre Pronchery out += chunk;
519b077aed3SPierre Pronchery olen -= chunk;
520b077aed3SPierre Pronchery }
521b077aed3SPierre Pronchery ret = 1;
522b077aed3SPierre Pronchery err:
523b077aed3SPierre Pronchery EVP_MAC_CTX_free(ctx);
524b077aed3SPierre Pronchery EVP_MAC_CTX_free(ctx_Ai);
525b077aed3SPierre Pronchery OPENSSL_cleanse(Ai, sizeof(Ai));
526b077aed3SPierre Pronchery return ret;
527b077aed3SPierre Pronchery }
528b077aed3SPierre Pronchery
529b077aed3SPierre Pronchery /*
530b077aed3SPierre Pronchery * Refer to "The TLS Protocol Version 1.0" Section 5
531b077aed3SPierre Pronchery * (https://tools.ietf.org/html/rfc2246#section-5) and
532b077aed3SPierre Pronchery * "The Transport Layer Security (TLS) Protocol Version 1.2" Section 5
533b077aed3SPierre Pronchery * (https://tools.ietf.org/html/rfc5246#section-5).
534b077aed3SPierre Pronchery *
535b077aed3SPierre Pronchery * For TLS v1.0 and TLS v1.1:
536b077aed3SPierre Pronchery *
537b077aed3SPierre Pronchery * PRF(secret, label, seed) = P_MD5(S1, label + seed) XOR
538b077aed3SPierre Pronchery * P_SHA-1(S2, label + seed)
539b077aed3SPierre Pronchery *
540b077aed3SPierre Pronchery * S1 is taken from the first half of the secret, S2 from the second half.
541b077aed3SPierre Pronchery *
542b077aed3SPierre Pronchery * L_S = length in bytes of secret;
543b077aed3SPierre Pronchery * L_S1 = L_S2 = ceil(L_S / 2);
544b077aed3SPierre Pronchery *
545b077aed3SPierre Pronchery * For TLS v1.2:
546b077aed3SPierre Pronchery *
547b077aed3SPierre Pronchery * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
548b077aed3SPierre Pronchery */
tls1_prf_alg(EVP_MAC_CTX * mdctx,EVP_MAC_CTX * sha1ctx,const unsigned char * sec,size_t slen,const unsigned char * seed,size_t seed_len,unsigned char * out,size_t olen)549b077aed3SPierre Pronchery static int tls1_prf_alg(EVP_MAC_CTX *mdctx, EVP_MAC_CTX *sha1ctx,
550b077aed3SPierre Pronchery const unsigned char *sec, size_t slen,
551b077aed3SPierre Pronchery const unsigned char *seed, size_t seed_len,
552b077aed3SPierre Pronchery unsigned char *out, size_t olen)
553b077aed3SPierre Pronchery {
554b077aed3SPierre Pronchery if (sha1ctx != NULL) {
555b077aed3SPierre Pronchery /* TLS v1.0 and TLS v1.1 */
556b077aed3SPierre Pronchery size_t i;
557b077aed3SPierre Pronchery unsigned char *tmp;
558b077aed3SPierre Pronchery /* calc: L_S1 = L_S2 = ceil(L_S / 2) */
559b077aed3SPierre Pronchery size_t L_S1 = (slen + 1) / 2;
560b077aed3SPierre Pronchery size_t L_S2 = L_S1;
561b077aed3SPierre Pronchery
562b077aed3SPierre Pronchery if (!tls1_prf_P_hash(mdctx, sec, L_S1,
563b077aed3SPierre Pronchery seed, seed_len, out, olen))
564b077aed3SPierre Pronchery return 0;
565b077aed3SPierre Pronchery
566*e7be843bSPierre Pronchery if ((tmp = OPENSSL_malloc(olen)) == NULL)
567b077aed3SPierre Pronchery return 0;
568b077aed3SPierre Pronchery
569b077aed3SPierre Pronchery if (!tls1_prf_P_hash(sha1ctx, sec + slen - L_S2, L_S2,
570b077aed3SPierre Pronchery seed, seed_len, tmp, olen)) {
571b077aed3SPierre Pronchery OPENSSL_clear_free(tmp, olen);
572b077aed3SPierre Pronchery return 0;
573b077aed3SPierre Pronchery }
574b077aed3SPierre Pronchery for (i = 0; i < olen; i++)
575b077aed3SPierre Pronchery out[i] ^= tmp[i];
576b077aed3SPierre Pronchery OPENSSL_clear_free(tmp, olen);
577b077aed3SPierre Pronchery return 1;
578b077aed3SPierre Pronchery }
579b077aed3SPierre Pronchery
580b077aed3SPierre Pronchery /* TLS v1.2 */
581b077aed3SPierre Pronchery if (!tls1_prf_P_hash(mdctx, sec, slen, seed, seed_len, out, olen))
582b077aed3SPierre Pronchery return 0;
583b077aed3SPierre Pronchery
584b077aed3SPierre Pronchery return 1;
585b077aed3SPierre Pronchery }
586