diff options
Diffstat (limited to 'lib/ssl/src')
| -rw-r--r-- | lib/ssl/src/ssl_connection.erl | 8 | ||||
| -rw-r--r-- | lib/ssl/src/ssl_handshake.erl | 11 | ||||
| -rw-r--r-- | lib/ssl/src/ssl_tls1.erl | 114 |
3 files changed, 65 insertions, 68 deletions
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl index 4d64cd8523..2a32bdf066 100644 --- a/lib/ssl/src/ssl_connection.erl +++ b/lib/ssl/src/ssl_connection.erl @@ -1647,7 +1647,7 @@ key_exchange(#state{role = server, key_algorithm = Algo, when Algo == ecdhe_ecdsa; Algo == ecdhe_rsa; Algo == ecdh_anon -> - ECDHKeys = public_key:generate_key({curve, default_curve(State)}), + ECDHKeys = public_key:generate_key(select_curve(State)), ConnectionState = ssl_record:pending_connection_state(ConnectionStates0, read), SecParams = ConnectionState#connection_state.security_parameters, @@ -2050,7 +2050,7 @@ server_master_secret(#server_dh_params{dh_p = P, dh_g = G, dh_y = ServerPublicDh server_master_secret(#server_ecdh_params{curve = ECCurve, public = ECServerPubKey}, State) -> - ECDHKeys = public_key:generate_key({curve, ECCurve}), + ECDHKeys = public_key:generate_key(ECCurve), ec_dh_master_secret(ECDHKeys, #'ECPoint'{point = ECServerPubKey}, State#state{diffie_hellman_keys = ECDHKeys}); server_master_secret(#server_psk_params{ @@ -3084,6 +3084,6 @@ handle_close_alert(Data, StateName, State0) -> ok end. -default_curve(_) -> +select_curve(_) -> %%TODO: select prefered curve from extension - secp256k1. + {namedCurve, ?secp256k1}. diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl index cde3e6fc66..b40f944d28 100644 --- a/lib/ssl/src/ssl_handshake.erl +++ b/lib/ssl/src/ssl_handshake.erl @@ -1243,7 +1243,7 @@ dec_server_key(<<?BYTE(?NAMED_CURVE), ?UINT16(CurveID), ?BYTE(PointLen), ECPoint:PointLen/binary, _/binary>> = KeyStruct, ?KEY_EXCHANGE_EC_DIFFIE_HELLMAN, Version) -> - Params = #server_ecdh_params{curve = ssl_tls1:ec_curve_id2nid(CurveID), + Params = #server_ecdh_params{curve = {namedCurve, ssl_tls1:enum_to_oid(CurveID)}, public = ECPoint}, {BinMsg, HashSign, Signature} = dec_ske_params(PointLen + 4, KeyStruct, Version), #server_key_params{params = Params, @@ -1330,7 +1330,7 @@ dec_hello_extensions(<<?UINT16(?ELLIPTIC_CURVES_EXT), ?UINT16(Len), ExtData:Len/binary, Rest/binary>>, Acc) -> EllipticCurveListLen = Len - 2, <<?UINT16(EllipticCurveListLen), EllipticCurveList/binary>> = ExtData, - EllipticCurves = [ssl_tls1:ec_curve_id2nid(X) || <<X:16>> <= EllipticCurveList], + EllipticCurves = [ssl_tls1:enum_to_oid(X) || <<X:16>> <= EllipticCurveList], dec_hello_extensions(Rest, [{elliptic_curves, #elliptic_curves{elliptic_curve_list = EllipticCurves}} | Acc]); @@ -1517,7 +1517,7 @@ enc_server_key(#server_dh_params{dh_p = P, dh_g = G, dh_y = Y}) -> enc_server_key(#server_ecdh_params{curve = {namedCurve, ECCurve}, public = ECPubKey}) -> %%TODO: support arbitrary keys KLen = size(ECPubKey), - <<?BYTE(?NAMED_CURVE_TYPE), ?UINT16((ssl_tls1:ec_nid2curve_id(pubkey_cert_records:namedCurves(ECCurve)))), + <<?BYTE(?NAMED_CURVE_TYPE), ?UINT16((ssl_tls1:oid_to_enum(ECCurve))), ?BYTE(KLen), ECPubKey/binary>>; enc_server_key(#server_psk_params{hint = PskIdentityHint}) -> Len = byte_size(PskIdentityHint), @@ -1601,7 +1601,7 @@ enc_hello_extensions([#renegotiation_info{renegotiated_connection = Info} | Rest Len = InfoLen +1, enc_hello_extensions(Rest, <<?UINT16(?RENEGOTIATION_EXT), ?UINT16(Len), ?BYTE(InfoLen), Info/binary, Acc/binary>>); enc_hello_extensions([#elliptic_curves{elliptic_curve_list = EllipticCurves} | Rest], Acc) -> - EllipticCurveList = << <<(ssl_tls1:ec_nid2curve_id(X)):16>> || X <- EllipticCurves>>, + EllipticCurveList = << <<(ssl_tls1:oid_to_enum(X)):16>> || X <- EllipticCurves>>, ListLen = byte_size(EllipticCurveList), Len = ListLen + 2, enc_hello_extensions(Rest, <<?UINT16(?ELLIPTIC_CURVES_EXT), @@ -1675,9 +1675,6 @@ certificate_authorities(CertDbHandle, CertDbRef) -> Enc = fun(#'OTPCertificate'{tbsCertificate=TBSCert}) -> OTPSubj = TBSCert#'OTPTBSCertificate'.subject, DNEncodedBin = public_key:pkix_encode('Name', OTPSubj, otp), - %%Subj = public_key:pkix_transform(OTPSubj, encode), - %% {ok, DNEncoded} = 'OTP-PUB-KEY':encode('Name', Subj), - %% DNEncodedBin = iolist_to_binary(DNEncoded), DNEncodedLen = byte_size(DNEncodedBin), <<?UINT16(DNEncodedLen), DNEncodedBin/binary>> end, diff --git a/lib/ssl/src/ssl_tls1.erl b/lib/ssl/src/ssl_tls1.erl index 507b1de904..f8fd9efd07 100644 --- a/lib/ssl/src/ssl_tls1.erl +++ b/lib/ssl/src/ssl_tls1.erl @@ -30,7 +30,7 @@ -export([master_secret/4, finished/5, certificate_verify/3, mac_hash/7, setup_keys/8, suites/1, prf/5, - ecc_curves/1, ec_nid2curve_id/1, ec_curve_id2nid/1]). + ecc_curves/1, oid_to_enum/1, enum_to_oid/1]). %%==================================================================== %% Internal application API @@ -328,61 +328,61 @@ finished_label(server) -> %% list ECC curves in prefered order ecc_curves(_Minor) -> - [sect571r1,sect571k1,secp521r1,sect409k1,sect409r1, - secp384r1,sect283k1,sect283r1,secp256k1,secp256r1, - sect239k1,sect233k1,sect233r1,secp224k1,secp224r1, - sect193r1,sect193r2,secp192k1,secp192r1,sect163k1, - sect163r1,sect163r2,secp160k1,secp160r1,secp160r2]. + [?sect571r1,?sect571k1,?secp521r1,?sect409k1,?sect409r1, + ?secp384r1,?sect283k1,?sect283r1,?secp256k1,?secp256r1, + ?sect239k1,?sect233k1,?sect233r1,?secp224k1,?secp224r1, + ?sect193r1,?sect193r2,?secp192k1,?secp192r1,?sect163k1, + ?sect163r1,?sect163r2,?secp160k1,?secp160r1,?secp160r2]. %% ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) -ec_nid2curve_id(sect163k1) -> 1; -ec_nid2curve_id(sect163r1) -> 2; -ec_nid2curve_id(sect163r2) -> 3; -ec_nid2curve_id(sect193r1) -> 4; -ec_nid2curve_id(sect193r2) -> 5; -ec_nid2curve_id(sect233k1) -> 6; -ec_nid2curve_id(sect233r1) -> 7; -ec_nid2curve_id(sect239k1) -> 8; -ec_nid2curve_id(sect283k1) -> 9; -ec_nid2curve_id(sect283r1) -> 10; -ec_nid2curve_id(sect409k1) -> 11; -ec_nid2curve_id(sect409r1) -> 12; -ec_nid2curve_id(sect571k1) -> 13; -ec_nid2curve_id(sect571r1) -> 14; -ec_nid2curve_id(secp160k1) -> 15; -ec_nid2curve_id(secp160r1) -> 16; -ec_nid2curve_id(secp160r2) -> 17; -ec_nid2curve_id(secp192k1) -> 18; -ec_nid2curve_id(secp192r1) -> 19; -ec_nid2curve_id(secp224k1) -> 20; -ec_nid2curve_id(secp224r1) -> 21; -ec_nid2curve_id(secp256k1) -> 22; -ec_nid2curve_id(secp256r1) -> 23; -ec_nid2curve_id(secp384r1) -> 24; -ec_nid2curve_id(secp521r1) -> 25. - -ec_curve_id2nid(1) -> sect163k1; -ec_curve_id2nid(2) -> sect163r1; -ec_curve_id2nid(3) -> sect163r2; -ec_curve_id2nid(4) -> sect193r1; -ec_curve_id2nid(5) -> sect193r2; -ec_curve_id2nid(6) -> sect233k1; -ec_curve_id2nid(7) -> sect233r1; -ec_curve_id2nid(8) -> sect239k1; -ec_curve_id2nid(9) -> sect283k1; -ec_curve_id2nid(10) -> sect283r1; -ec_curve_id2nid(11) -> sect409k1; -ec_curve_id2nid(12) -> sect409r1; -ec_curve_id2nid(13) -> sect571k1; -ec_curve_id2nid(14) -> sect571r1; -ec_curve_id2nid(15) -> secp160k1; -ec_curve_id2nid(16) -> secp160r1; -ec_curve_id2nid(17) -> secp160r2; -ec_curve_id2nid(18) -> secp192k1; -ec_curve_id2nid(19) -> secp192r1; -ec_curve_id2nid(20) -> secp224k1; -ec_curve_id2nid(21) -> secp224r1; -ec_curve_id2nid(22) -> secp256k1; -ec_curve_id2nid(23) -> secp256r1; -ec_curve_id2nid(24) -> secp384r1; -ec_curve_id2nid(25) -> secp521r1. +oid_to_enum(?sect163k1) -> 1; +oid_to_enum(?sect163r1) -> 2; +oid_to_enum(?sect163r2) -> 3; +oid_to_enum(?sect193r1) -> 4; +oid_to_enum(?sect193r2) -> 5; +oid_to_enum(?sect233k1) -> 6; +oid_to_enum(?sect233r1) -> 7; +oid_to_enum(?sect239k1) -> 8; +oid_to_enum(?sect283k1) -> 9; +oid_to_enum(?sect283r1) -> 10; +oid_to_enum(?sect409k1) -> 11; +oid_to_enum(?sect409r1) -> 12; +oid_to_enum(?sect571k1) -> 13; +oid_to_enum(?sect571r1) -> 14; +oid_to_enum(?secp160k1) -> 15; +oid_to_enum(?secp160r1) -> 16; +oid_to_enum(?secp160r2) -> 17; +oid_to_enum(?secp192k1) -> 18; +oid_to_enum(?secp192r1) -> 19; +oid_to_enum(?secp224k1) -> 20; +oid_to_enum(?secp224r1) -> 21; +oid_to_enum(?secp256k1) -> 22; +oid_to_enum(?secp256r1) -> 23; +oid_to_enum(?secp384r1) -> 24; +oid_to_enum(?secp521r1) -> 25. + +enum_to_oid(1) -> ?sect163k1; +enum_to_oid(2) -> ?sect163r1; +enum_to_oid(3) -> ?sect163r2; +enum_to_oid(4) -> ?sect193r1; +enum_to_oid(5) -> ?sect193r2; +enum_to_oid(6) -> ?sect233k1; +enum_to_oid(7) -> ?sect233r1; +enum_to_oid(8) -> ?sect239k1; +enum_to_oid(9) -> ?sect283k1; +enum_to_oid(10) -> ?sect283r1; +enum_to_oid(11) -> ?sect409k1; +enum_to_oid(12) -> ?sect409r1; +enum_to_oid(13) -> ?sect571k1; +enum_to_oid(14) -> ?sect571r1; +enum_to_oid(15) -> ?secp160k1; +enum_to_oid(16) -> ?secp160r1; +enum_to_oid(17) -> ?secp160r2; +enum_to_oid(18) -> ?secp192k1; +enum_to_oid(19) -> ?secp192r1; +enum_to_oid(20) -> ?secp224k1; +enum_to_oid(21) -> ?secp224r1; +enum_to_oid(22) -> ?secp256k1; +enum_to_oid(23) -> ?secp256r1; +enum_to_oid(24) -> ?secp384r1; +enum_to_oid(25) -> ?secp521r1. |