hkdf.c@ 100947

Last change on this file since 100947 was 99366, checked in by vboxsync, 22 months ago
openssl-3.1.0: Applied and adjusted our OpenSSL changes to 3.0.7. bugref:10418
File size: 26.6 KB

Line
1	/*
2	* Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
3	*
4	* Licensed under the Apache License 2.0 (the "License"). You may not use
5	* this file except in compliance with the License. You can obtain a copy
6	* in the file LICENSE in the source distribution or at
7	* https://www.openssl.org/source/license.html
8	*/
9
10	/*
11	* HMAC low level APIs are deprecated for public use, but still ok for internal
12	* use.
13	*/
14	#include "internal/deprecated.h"
15
16	#include <stdlib.h>
17	#include <stdarg.h>
18	#include <string.h>
19	#include <openssl/hmac.h>
20	#include <openssl/evp.h>
21	#include <openssl/kdf.h>
22	#include <openssl/core_names.h>
23	#include <openssl/proverr.h>
24	#include "internal/cryptlib.h"
25	#include "internal/numbers.h"
26	#include "internal/packet.h"
27	#include "crypto/evp.h"
28	#include "prov/provider_ctx.h"
29	#include "prov/providercommon.h"
30	#include "prov/implementations.h"
31	#include "prov/provider_util.h"
32	#include "internal/e_os.h"
33
34	#define HKDF_MAXBUF 2048
35	#define HKDF_MAXINFO (32*1024)
36
37	static OSSL_FUNC_kdf_newctx_fn kdf_hkdf_new;
38	static OSSL_FUNC_kdf_dupctx_fn kdf_hkdf_dup;
39	static OSSL_FUNC_kdf_freectx_fn kdf_hkdf_free;
40	static OSSL_FUNC_kdf_reset_fn kdf_hkdf_reset;
41	static OSSL_FUNC_kdf_derive_fn kdf_hkdf_derive;
42	static OSSL_FUNC_kdf_settable_ctx_params_fn kdf_hkdf_settable_ctx_params;
43	static OSSL_FUNC_kdf_set_ctx_params_fn kdf_hkdf_set_ctx_params;
44	static OSSL_FUNC_kdf_gettable_ctx_params_fn kdf_hkdf_gettable_ctx_params;
45	static OSSL_FUNC_kdf_get_ctx_params_fn kdf_hkdf_get_ctx_params;
46	static OSSL_FUNC_kdf_derive_fn kdf_tls1_3_derive;
47	static OSSL_FUNC_kdf_settable_ctx_params_fn kdf_tls1_3_settable_ctx_params;
48	static OSSL_FUNC_kdf_set_ctx_params_fn kdf_tls1_3_set_ctx_params;
49
50	static int HKDF(OSSL_LIB_CTX libctx, const EVP_MD evp_md,
51	const unsigned char *salt, size_t salt_len,
52	const unsigned char *key, size_t key_len,
53	const unsigned char *info, size_t info_len,
54	unsigned char *okm, size_t okm_len);
55	static int HKDF_Extract(OSSL_LIB_CTX libctx, const EVP_MD evp_md,
56	const unsigned char *salt, size_t salt_len,
57	const unsigned char *ikm, size_t ikm_len,
58	unsigned char *prk, size_t prk_len);
59	static int HKDF_Expand(const EVP_MD *evp_md,
60	const unsigned char *prk, size_t prk_len,
61	const unsigned char *info, size_t info_len,
62	unsigned char *okm, size_t okm_len);
63
64	/* Settable context parameters that are common across HKDF and the TLS KDF */
65	#define HKDF_COMMON_SETTABLES \
66	OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_MODE, NULL, 0), \
67	OSSL_PARAM_int(OSSL_KDF_PARAM_MODE, NULL), \
68	OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_PROPERTIES, NULL, 0), \
69	OSSL_PARAM_utf8_string(OSSL_KDF_PARAM_DIGEST, NULL, 0), \
70	OSSL_PARAM_octet_string(OSSL_KDF_PARAM_KEY, NULL, 0), \
71	OSSL_PARAM_octet_string(OSSL_KDF_PARAM_SALT, NULL, 0)
72
73	typedef struct {
74	void *provctx;
75	int mode;
76	PROV_DIGEST digest;
77	unsigned char *salt;
78	size_t salt_len;
79	unsigned char *key;
80	size_t key_len;
81	unsigned char *prefix;
82	size_t prefix_len;
83	unsigned char *label;
84	size_t label_len;
85	unsigned char *data;
86	size_t data_len;
87	unsigned char *info;
88	size_t info_len;
89	} KDF_HKDF;
90
91	static void kdf_hkdf_new(void provctx)
92	{
93	KDF_HKDF *ctx;
94
95	if (!ossl_prov_is_running())
96	return NULL;
97
98	if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL)
99	ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
100	else
101	ctx->provctx = provctx;
102	return ctx;
103	}
104
105	static void kdf_hkdf_free(void *vctx)
106	{
107	KDF_HKDF ctx = (KDF_HKDF )vctx;
108
109	if (ctx != NULL) {
110	kdf_hkdf_reset(ctx);
111	OPENSSL_free(ctx);
112	}
113	}
114
115	static void kdf_hkdf_reset(void *vctx)
116	{
117	KDF_HKDF ctx = (KDF_HKDF )vctx;
118	void *provctx = ctx->provctx;
119
120	ossl_prov_digest_reset(&ctx->digest);
121	OPENSSL_free(ctx->salt);
122	OPENSSL_free(ctx->prefix);
123	OPENSSL_free(ctx->label);
124	OPENSSL_clear_free(ctx->data, ctx->data_len);
125	OPENSSL_clear_free(ctx->key, ctx->key_len);
126	OPENSSL_clear_free(ctx->info, ctx->info_len);
127	memset(ctx, 0, sizeof(*ctx));
128	ctx->provctx = provctx;
129	}
130
131	static void kdf_hkdf_dup(void vctx)
132	{
133	const KDF_HKDF src = (const KDF_HKDF )vctx;
134	KDF_HKDF *dest;
135
136	dest = kdf_hkdf_new(src->provctx);
137	if (dest != NULL) {
138	if (!ossl_prov_memdup(src->salt, src->salt_len, &dest->salt,
139	&dest->salt_len)
140	\|\| !ossl_prov_memdup(src->key, src->key_len,
141	&dest->key , &dest->key_len)
142	\|\| !ossl_prov_memdup(src->prefix, src->prefix_len,
143	&dest->prefix, &dest->prefix_len)
144	\|\| !ossl_prov_memdup(src->label, src->label_len,
145	&dest->label, &dest->label_len)
146	\|\| !ossl_prov_memdup(src->data, src->data_len,
147	&dest->data, &dest->data_len)
148	\|\| !ossl_prov_memdup(src->info, src->info_len,
149	&dest->info, &dest->info_len)
150	\|\| !ossl_prov_digest_copy(&dest->digest, &src->digest))
151	goto err;
152	dest->mode = src->mode;
153	}
154	return dest;
155
156	err:
157	kdf_hkdf_free(dest);
158	return NULL;
159	}
160
161	static size_t kdf_hkdf_size(KDF_HKDF *ctx)
162	{
163	int sz;
164	const EVP_MD *md = ossl_prov_digest_md(&ctx->digest);
165
166	if (ctx->mode != EVP_KDF_HKDF_MODE_EXTRACT_ONLY)
167	return SIZE_MAX;
168
169	if (md == NULL) {
170	ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST);
171	return 0;
172	}
173	sz = EVP_MD_get_size(md);
174	if (sz < 0)
175	return 0;
176
177	return sz;
178	}
179
180	static int kdf_hkdf_derive(void vctx, unsigned char key, size_t keylen,
181	const OSSL_PARAM params[])
182	{
183	KDF_HKDF ctx = (KDF_HKDF )vctx;
184	OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
185	const EVP_MD *md;
186
187	if (!ossl_prov_is_running() \|\| !kdf_hkdf_set_ctx_params(ctx, params))
188	return 0;
189
190	md = ossl_prov_digest_md(&ctx->digest);
191	if (md == NULL) {
192	ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST);
193	return 0;
194	}
195	if (ctx->key == NULL) {
196	ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_KEY);
197	return 0;
198	}
199	if (keylen == 0) {
200	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
201	return 0;
202	}
203
204	switch (ctx->mode) {
205	case EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND:
206	default:
207	return HKDF(libctx, md, ctx->salt, ctx->salt_len,
208	ctx->key, ctx->key_len, ctx->info, ctx->info_len, key, keylen);
209
210	case EVP_KDF_HKDF_MODE_EXTRACT_ONLY:
211	return HKDF_Extract(libctx, md, ctx->salt, ctx->salt_len,
212	ctx->key, ctx->key_len, key, keylen);
213
214	case EVP_KDF_HKDF_MODE_EXPAND_ONLY:
215	return HKDF_Expand(md, ctx->key, ctx->key_len, ctx->info,
216	ctx->info_len, key, keylen);
217	}
218	}
219
220	static int hkdf_common_set_ctx_params(KDF_HKDF *ctx, const OSSL_PARAM params[])
221	{
222	OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(ctx->provctx);
223	const OSSL_PARAM *p;
224	int n;
225
226	if (params == NULL)
227	return 1;
228
229	if (!ossl_prov_digest_load_from_params(&ctx->digest, params, libctx))
230	return 0;
231
232	if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_MODE)) != NULL) {
233	if (p->data_type == OSSL_PARAM_UTF8_STRING) {
234	if (OPENSSL_strcasecmp(p->data, "EXTRACT_AND_EXPAND") == 0) {
235	ctx->mode = EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND;
236	} else if (OPENSSL_strcasecmp(p->data, "EXTRACT_ONLY") == 0) {
237	ctx->mode = EVP_KDF_HKDF_MODE_EXTRACT_ONLY;
238	} else if (OPENSSL_strcasecmp(p->data, "EXPAND_ONLY") == 0) {
239	ctx->mode = EVP_KDF_HKDF_MODE_EXPAND_ONLY;
240	} else {
241	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE);
242	return 0;
243	}
244	} else if (OSSL_PARAM_get_int(p, &n)) {
245	if (n != EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND
246	&& n != EVP_KDF_HKDF_MODE_EXTRACT_ONLY
247	&& n != EVP_KDF_HKDF_MODE_EXPAND_ONLY) {
248	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE);
249	return 0;
250	}
251	ctx->mode = n;
252	} else {
253	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE);
254	return 0;
255	}
256	}
257
258	if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_KEY)) != NULL) {
259	OPENSSL_clear_free(ctx->key, ctx->key_len);
260	ctx->key = NULL;
261	if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->key, 0,
262	&ctx->key_len))
263	return 0;
264	}
265
266	if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_SALT)) != NULL) {
267	if (p->data_size != 0 && p->data != NULL) {
268	OPENSSL_free(ctx->salt);
269	ctx->salt = NULL;
270	if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->salt, 0,
271	&ctx->salt_len))
272	return 0;
273	}
274	}
275
276	return 1;
277	}
278
279	/*
280	* Use WPACKET to concat one or more OSSL_KDF_PARAM_INFO fields into a fixed
281	* out buffer of size *outlen.
282	* If out is NULL then outlen is used to return the required buffer size.
283	*/
284	static int setinfo_fromparams(const OSSL_PARAM p, unsigned char out, size_t *outlen)
285	{
286	int ret = 0;
287	WPACKET pkt;
288
289	if (out == NULL) {
290	if (!WPACKET_init_null(&pkt, 0))
291	return 0;
292	} else {
293	if (!WPACKET_init_static_len(&pkt, out, *outlen, 0))
294	return 0;
295	}
296
297	for (; p != NULL; p = OSSL_PARAM_locate_const(p + 1, OSSL_KDF_PARAM_INFO)) {
298	if (p->data_type != OSSL_PARAM_OCTET_STRING)
299	goto err;
300	if (p->data != NULL
301	&& p->data_size != 0
302	&& !WPACKET_memcpy(&pkt, p->data, p->data_size))
303	goto err;
304	}
305	if (!WPACKET_get_total_written(&pkt, outlen)
306	\|\| !WPACKET_finish(&pkt))
307	goto err;
308	ret = 1;
309	err:
310	WPACKET_cleanup(&pkt);
311	return ret;
312	}
313
314	static int kdf_hkdf_set_ctx_params(void *vctx, const OSSL_PARAM params[])
315	{
316	const OSSL_PARAM *p;
317	KDF_HKDF *ctx = vctx;
318
319	if (params == NULL)
320	return 1;
321
322	if (!hkdf_common_set_ctx_params(ctx, params))
323	return 0;
324
325	/* The info fields concatenate, so process them all */
326	if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_INFO)) != NULL) {
327	size_t sz = 0;
328
329	/* calculate the total size */
330	if (!setinfo_fromparams(p, NULL, &sz))
331	return 0;
332	if (sz > HKDF_MAXINFO)
333	return 0;
334
335	OPENSSL_clear_free(ctx->info, ctx->info_len);
336	ctx->info = NULL;
337	if (sz == 0)
338	return 1;
339	/* Alloc the buffer */
340	ctx->info = OPENSSL_malloc(sz);
341	if (ctx->info == NULL)
342	return 0;
343	ctx->info_len = sz;
344	/* Concat one or more OSSL_KDF_PARAM_INFO fields */
345	if (!setinfo_fromparams(p, ctx->info, &sz))
346	return 0;
347	}
348	return 1;
349	}
350
351	static const OSSL_PARAM kdf_hkdf_settable_ctx_params(ossl_unused void ctx,
352	ossl_unused void *provctx)
353	{
354	static const OSSL_PARAM known_settable_ctx_params[] = {
355	HKDF_COMMON_SETTABLES,
356	OSSL_PARAM_octet_string(OSSL_KDF_PARAM_INFO, NULL, 0),
357	OSSL_PARAM_END
358	};
359	return known_settable_ctx_params;
360	}
361
362	static int kdf_hkdf_get_ctx_params(void *vctx, OSSL_PARAM params[])
363	{
364	KDF_HKDF ctx = (KDF_HKDF )vctx;
365	OSSL_PARAM *p;
366
367	if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_SIZE)) != NULL) {
368	size_t sz = kdf_hkdf_size(ctx);
369
370	if (sz == 0)
371	return 0;
372	return OSSL_PARAM_set_size_t(p, sz);
373	}
374	return -2;
375	}
376
377	static const OSSL_PARAM kdf_hkdf_gettable_ctx_params(ossl_unused void ctx,
378	ossl_unused void *provctx)
379	{
380	static const OSSL_PARAM known_gettable_ctx_params[] = {
381	OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL),
382	OSSL_PARAM_END
383	};
384	return known_gettable_ctx_params;
385	}
386
387	const OSSL_DISPATCH ossl_kdf_hkdf_functions[] = {
388	{ OSSL_FUNC_KDF_NEWCTX, (void(*)(void))kdf_hkdf_new },
389	{ OSSL_FUNC_KDF_DUPCTX, (void(*)(void))kdf_hkdf_dup },
390	{ OSSL_FUNC_KDF_FREECTX, (void(*)(void))kdf_hkdf_free },
391	{ OSSL_FUNC_KDF_RESET, (void(*)(void))kdf_hkdf_reset },
392	{ OSSL_FUNC_KDF_DERIVE, (void(*)(void))kdf_hkdf_derive },
393	{ OSSL_FUNC_KDF_SETTABLE_CTX_PARAMS,
394	(void(*)(void))kdf_hkdf_settable_ctx_params },
395	{ OSSL_FUNC_KDF_SET_CTX_PARAMS, (void(*)(void))kdf_hkdf_set_ctx_params },
396	{ OSSL_FUNC_KDF_GETTABLE_CTX_PARAMS,
397	(void(*)(void))kdf_hkdf_gettable_ctx_params },
398	{ OSSL_FUNC_KDF_GET_CTX_PARAMS, (void(*)(void))kdf_hkdf_get_ctx_params },
399	{ 0, NULL }
400	};
401
402	/*
403	* Refer to "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)"
404	* Section 2 (https://tools.ietf.org/html/rfc5869#section-2) and
405	* "Cryptographic Extraction and Key Derivation: The HKDF Scheme"
406	* Section 4.2 (https://eprint.iacr.org/2010/264.pdf).
407	*
408	* From the paper:
409	* The scheme HKDF is specified as:
410	* HKDF(XTS, SKM, CTXinfo, L) = K(1) \| K(2) \| ... \| K(t)
411	*
412	* where:
413	* SKM is source key material
414	* XTS is extractor salt (which may be null or constant)
415	* CTXinfo is context information (may be null)
416	* L is the number of key bits to be produced by KDF
417	* k is the output length in bits of the hash function used with HMAC
418	* t = ceil(L/k)
419	* the value K(t) is truncated to its first d = L mod k bits.
420	*
421	* From RFC 5869:
422	* 2.2. Step 1: Extract
423	* HKDF-Extract(salt, IKM) -> PRK
424	* 2.3. Step 2: Expand
425	* HKDF-Expand(PRK, info, L) -> OKM
426	*/
427	static int HKDF(OSSL_LIB_CTX libctx, const EVP_MD evp_md,
428	const unsigned char *salt, size_t salt_len,
429	const unsigned char *ikm, size_t ikm_len,
430	const unsigned char *info, size_t info_len,
431	unsigned char *okm, size_t okm_len)
432	{
433	unsigned char prk[EVP_MAX_MD_SIZE];
434	int ret, sz;
435	size_t prk_len;
436
437	sz = EVP_MD_get_size(evp_md);
438	if (sz < 0)
439	return 0;
440	prk_len = (size_t)sz;
441
442	/* Step 1: HKDF-Extract(salt, IKM) -> PRK */
443	if (!HKDF_Extract(libctx, evp_md,
444	salt, salt_len, ikm, ikm_len, prk, prk_len))
445	return 0;
446
447	/* Step 2: HKDF-Expand(PRK, info, L) -> OKM */
448	ret = HKDF_Expand(evp_md, prk, prk_len, info, info_len, okm, okm_len);
449	OPENSSL_cleanse(prk, sizeof(prk));
450
451	return ret;
452	}
453
454	/*
455	* Refer to "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)"
456	* Section 2.2 (https://tools.ietf.org/html/rfc5869#section-2.2).
457	*
458	* 2.2. Step 1: Extract
459	*
460	* HKDF-Extract(salt, IKM) -> PRK
461	*
462	* Options:
463	* Hash a hash function; HashLen denotes the length of the
464	* hash function output in octets
465	*
466	* Inputs:
467	* salt optional salt value (a non-secret random value);
468	* if not provided, it is set to a string of HashLen zeros.
469	* IKM input keying material
470	*
471	* Output:
472	* PRK a pseudorandom key (of HashLen octets)
473	*
474	* The output PRK is calculated as follows:
475	*
476	* PRK = HMAC-Hash(salt, IKM)
477	*/
478	static int HKDF_Extract(OSSL_LIB_CTX libctx, const EVP_MD evp_md,
479	const unsigned char *salt, size_t salt_len,
480	const unsigned char *ikm, size_t ikm_len,
481	unsigned char *prk, size_t prk_len)
482	{
483	int sz = EVP_MD_get_size(evp_md);
484
485	if (sz < 0)
486	return 0;
487	if (prk_len != (size_t)sz) {
488	ERR_raise(ERR_LIB_PROV, PROV_R_WRONG_OUTPUT_BUFFER_SIZE);
489	return 0;
490	}
491	/* calc: PRK = HMAC-Hash(salt, IKM) */
492	return
493	EVP_Q_mac(libctx, "HMAC", NULL, EVP_MD_get0_name(evp_md), NULL, salt,
494	salt_len, ikm, ikm_len, prk, EVP_MD_get_size(evp_md), NULL)
495	!= NULL;
496	}
497
498	/*
499	* Refer to "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)"
500	* Section 2.3 (https://tools.ietf.org/html/rfc5869#section-2.3).
501	*
502	* 2.3. Step 2: Expand
503	*
504	* HKDF-Expand(PRK, info, L) -> OKM
505	*
506	* Options:
507	* Hash a hash function; HashLen denotes the length of the
508	* hash function output in octets
509	*
510	* Inputs:
511	* PRK a pseudorandom key of at least HashLen octets
512	* (usually, the output from the extract step)
513	* info optional context and application specific information
514	* (can be a zero-length string)
515	* L length of output keying material in octets
516	* (<= 255*HashLen)
517	*
518	* Output:
519	* OKM output keying material (of L octets)
520	*
521	* The output OKM is calculated as follows:
522	*
523	* N = ceil(L/HashLen)
524	* T = T(1) \| T(2) \| T(3) \| ... \| T(N)
525	* OKM = first L octets of T
526	*
527	* where:
528	* T(0) = empty string (zero length)
529	* T(1) = HMAC-Hash(PRK, T(0) \| info \| 0x01)
530	* T(2) = HMAC-Hash(PRK, T(1) \| info \| 0x02)
531	* T(3) = HMAC-Hash(PRK, T(2) \| info \| 0x03)
532	* ...
533	*
534	* (where the constant concatenated to the end of each T(n) is a
535	* single octet.)
536	*/
537	static int HKDF_Expand(const EVP_MD *evp_md,
538	const unsigned char *prk, size_t prk_len,
539	const unsigned char *info, size_t info_len,
540	unsigned char *okm, size_t okm_len)
541	{
542	HMAC_CTX *hmac;
543	int ret = 0, sz;
544	unsigned int i;
545	unsigned char prev[EVP_MAX_MD_SIZE];
546	size_t done_len = 0, dig_len, n;
547
548	sz = EVP_MD_get_size(evp_md);
549	if (sz <= 0)
550	return 0;
551	dig_len = (size_t)sz;
552
553	/* calc: N = ceil(L/HashLen) */
554	n = okm_len / dig_len;
555	if (okm_len % dig_len)
556	n++;
557
558	if (n > 255 \|\| okm == NULL)
559	return 0;
560
561	if ((hmac = HMAC_CTX_new()) == NULL)
562	return 0;
563
564	if (!HMAC_Init_ex(hmac, prk, prk_len, evp_md, NULL))
565	goto err;
566
567	for (i = 1; i <= n; i++) {
568	size_t copy_len;
569	const unsigned char ctr = i;
570
571	/* calc: T(i) = HMAC-Hash(PRK, T(i - 1) \| info \| i) */
572	if (i > 1) {
573	if (!HMAC_Init_ex(hmac, NULL, 0, NULL, NULL))
574	goto err;
575
576	if (!HMAC_Update(hmac, prev, dig_len))
577	goto err;
578	}
579
580	if (!HMAC_Update(hmac, info, info_len))
581	goto err;
582
583	if (!HMAC_Update(hmac, &ctr, 1))
584	goto err;
585
586	if (!HMAC_Final(hmac, prev, NULL))
587	goto err;
588
589	copy_len = (done_len + dig_len > okm_len) ?
590	okm_len - done_len :
591	dig_len;
592
593	memcpy(okm + done_len, prev, copy_len);
594
595	done_len += copy_len;
596	}
597	ret = 1;
598
599	err:
600	OPENSSL_cleanse(prev, sizeof(prev));
601	HMAC_CTX_free(hmac);
602	return ret;
603	}
604
605	/*
606	* TLS uses slight variations of the above and for FIPS validation purposes,
607	* they need to be present here.
608	* Refer to RFC 8446 section 7 for specific details.
609	*/
610
611	/*
612	* Given a \|secret\|; a \|label\| of length \|labellen\|; and \|data\| of length
613	* \|datalen\| (e.g. typically a hash of the handshake messages), derive a new
614	* secret \|outlen\| bytes long and store it in the location pointed to be \|out\|.
615	* The \|data\| value may be zero length. Returns 1 on success and 0 on failure.
616	*/
617	static int prov_tls13_hkdf_expand(const EVP_MD *md,
618	const unsigned char *key, size_t keylen,
619	const unsigned char *prefix, size_t prefixlen,
620	const unsigned char *label, size_t labellen,
621	const unsigned char *data, size_t datalen,
622	unsigned char *out, size_t outlen)
623	{
624	size_t hkdflabellen;
625	unsigned char hkdflabel[HKDF_MAXBUF];
626	WPACKET pkt;
627
628	/*
629	* 2 bytes for length of derived secret + 1 byte for length of combined
630	* prefix and label + bytes for the label itself + 1 byte length of hash
631	* + bytes for the hash itself. We've got the maximum the KDF can handle
632	* which should always be sufficient.
633	*/
634	if (!WPACKET_init_static_len(&pkt, hkdflabel, sizeof(hkdflabel), 0)
635	\|\| !WPACKET_put_bytes_u16(&pkt, outlen)
636	\|\| !WPACKET_start_sub_packet_u8(&pkt)
637	\|\| !WPACKET_memcpy(&pkt, prefix, prefixlen)
638	\|\| !WPACKET_memcpy(&pkt, label, labellen)
639	\|\| !WPACKET_close(&pkt)
640	\|\| !WPACKET_sub_memcpy_u8(&pkt, data, (data == NULL) ? 0 : datalen)
641	\|\| !WPACKET_get_total_written(&pkt, &hkdflabellen)
642	\|\| !WPACKET_finish(&pkt)) {
643	WPACKET_cleanup(&pkt);
644	return 0;
645	}
646
647	return HKDF_Expand(md, key, keylen, hkdflabel, hkdflabellen,
648	out, outlen);
649	}
650
651	static int prov_tls13_hkdf_generate_secret(OSSL_LIB_CTX *libctx,
652	const EVP_MD *md,
653	const unsigned char *prevsecret,
654	size_t prevsecretlen,
655	const unsigned char *insecret,
656	size_t insecretlen,
657	const unsigned char *prefix,
658	size_t prefixlen,
659	const unsigned char *label,
660	size_t labellen,
661	unsigned char *out, size_t outlen)
662	{
663	size_t mdlen;
664	int ret;
665	unsigned char preextractsec[EVP_MAX_MD_SIZE];
666	/* Always filled with zeros */
667	static const unsigned char default_zeros[EVP_MAX_MD_SIZE];
668
669	ret = EVP_MD_get_size(md);
670	/* Ensure cast to size_t is safe */
671	if (ret <= 0)
672	return 0;
673	mdlen = (size_t)ret;
674
675	if (insecret == NULL) {
676	insecret = default_zeros;
677	insecretlen = mdlen;
678	}
679	if (prevsecret == NULL) {
680	prevsecret = default_zeros;
681	prevsecretlen = 0;
682	} else {
683	EVP_MD_CTX *mctx = EVP_MD_CTX_new();
684	unsigned char hash[EVP_MAX_MD_SIZE];
685
686	/* The pre-extract derive step uses a hash of no messages */
687	if (mctx == NULL
688	\|\| EVP_DigestInit_ex(mctx, md, NULL) <= 0
689	\|\| EVP_DigestFinal_ex(mctx, hash, NULL) <= 0) {
690	EVP_MD_CTX_free(mctx);
691	return 0;
692	}
693	EVP_MD_CTX_free(mctx);
694
695	/* Generate the pre-extract secret */
696	if (!prov_tls13_hkdf_expand(md, prevsecret, mdlen,
697	prefix, prefixlen, label, labellen,
698	hash, mdlen, preextractsec, mdlen))
699	return 0;
700	prevsecret = preextractsec;
701	prevsecretlen = mdlen;
702	}
703
704	ret = HKDF_Extract(libctx, md, prevsecret, prevsecretlen,
705	insecret, insecretlen, out, outlen);
706
707	if (prevsecret == preextractsec)
708	OPENSSL_cleanse(preextractsec, mdlen);
709	return ret;
710	}
711
712	static int kdf_tls1_3_derive(void vctx, unsigned char key, size_t keylen,
713	const OSSL_PARAM params[])
714	{
715	KDF_HKDF ctx = (KDF_HKDF )vctx;
716	const EVP_MD *md;
717
718	if (!ossl_prov_is_running() \|\| !kdf_tls1_3_set_ctx_params(ctx, params))
719	return 0;
720
721	md = ossl_prov_digest_md(&ctx->digest);
722	if (md == NULL) {
723	ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_MESSAGE_DIGEST);
724	return 0;
725	}
726
727	switch (ctx->mode) {
728	default:
729	return 0;
730
731	case EVP_KDF_HKDF_MODE_EXTRACT_ONLY:
732	return prov_tls13_hkdf_generate_secret(PROV_LIBCTX_OF(ctx->provctx),
733	md,
734	ctx->salt, ctx->salt_len,
735	ctx->key, ctx->key_len,
736	ctx->prefix, ctx->prefix_len,
737	ctx->label, ctx->label_len,
738	key, keylen);
739
740	case EVP_KDF_HKDF_MODE_EXPAND_ONLY:
741	return prov_tls13_hkdf_expand(md, ctx->key, ctx->key_len,
742	ctx->prefix, ctx->prefix_len,
743	ctx->label, ctx->label_len,
744	ctx->data, ctx->data_len,
745	key, keylen);
746	}
747	}
748
749	static int kdf_tls1_3_set_ctx_params(void *vctx, const OSSL_PARAM params[])
750	{
751	const OSSL_PARAM *p;
752	KDF_HKDF *ctx = vctx;
753
754	if (params == NULL)
755	return 1;
756
757	if (!hkdf_common_set_ctx_params(ctx, params))
758	return 0;
759
760	if (ctx->mode == EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND) {
761	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_MODE);
762	return 0;
763	}
764
765	if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_PREFIX)) != NULL) {
766	OPENSSL_free(ctx->prefix);
767	ctx->prefix = NULL;
768	if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->prefix, 0,
769	&ctx->prefix_len))
770	return 0;
771	}
772
773	if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_LABEL)) != NULL) {
774	OPENSSL_free(ctx->label);
775	ctx->label = NULL;
776	if (!OSSL_PARAM_get_octet_string(p, (void **)&ctx->label, 0,
777	&ctx->label_len))
778	return 0;
779	}
780
781	OPENSSL_clear_free(ctx->data, ctx->data_len);
782	ctx->data = NULL;
783	if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_DATA)) != NULL
784	&& !OSSL_PARAM_get_octet_string(p, (void **)&ctx->data, 0,
785	&ctx->data_len))
786	return 0;
787	return 1;
788	}
789
790	static const OSSL_PARAM kdf_tls1_3_settable_ctx_params(ossl_unused void ctx,
791	ossl_unused void *provctx)
792	{
793	static const OSSL_PARAM known_settable_ctx_params[] = {
794	HKDF_COMMON_SETTABLES,
795	OSSL_PARAM_octet_string(OSSL_KDF_PARAM_PREFIX, NULL, 0),
796	OSSL_PARAM_octet_string(OSSL_KDF_PARAM_LABEL, NULL, 0),
797	OSSL_PARAM_octet_string(OSSL_KDF_PARAM_DATA, NULL, 0),
798	OSSL_PARAM_END
799	};
800	return known_settable_ctx_params;
801	}
802
803	const OSSL_DISPATCH ossl_kdf_tls1_3_kdf_functions[] = {
804	{ OSSL_FUNC_KDF_NEWCTX, (void(*)(void))kdf_hkdf_new },
805	{ OSSL_FUNC_KDF_DUPCTX, (void(*)(void))kdf_hkdf_dup },
806	{ OSSL_FUNC_KDF_FREECTX, (void(*)(void))kdf_hkdf_free },
807	{ OSSL_FUNC_KDF_RESET, (void(*)(void))kdf_hkdf_reset },
808	{ OSSL_FUNC_KDF_DERIVE, (void(*)(void))kdf_tls1_3_derive },
809	{ OSSL_FUNC_KDF_SETTABLE_CTX_PARAMS,
810	(void(*)(void))kdf_tls1_3_settable_ctx_params },
811	{ OSSL_FUNC_KDF_SET_CTX_PARAMS, (void(*)(void))kdf_tls1_3_set_ctx_params },
812	{ OSSL_FUNC_KDF_GETTABLE_CTX_PARAMS,
813	(void(*)(void))kdf_hkdf_gettable_ctx_params },
814	{ OSSL_FUNC_KDF_GET_CTX_PARAMS, (void(*)(void))kdf_hkdf_get_ctx_params },
815	{ 0, NULL }
816	};

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/libs/openssl-3.1.0/providers/implementations/kdfs/hkdf.c@ 100947

Download in other formats: