%% %% %CopyrightBegin% %% %% Copyright Ericsson AB 2007-2013. All Rights Reserved. %% %% The contents of this file are subject to the Erlang Public License, %% Version 1.1, (the "License"); you may not use this file except in %% compliance with the License. You should have received a copy of the %% Erlang Public License along with this software. If not, it can be %% retrieved online at http://www.erlang.org/. %% %% Software distributed under the License is distributed on an "AS IS" %% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See %% the License for the specific language governing rights and limitations %% under the License. %% %% %CopyrightEnd% %% %% %%---------------------------------------------------------------------- %% Purpose: Handles tls1 encryption. %%---------------------------------------------------------------------- -module(ssl_tls1). -include("ssl_cipher.hrl"). -include("ssl_internal.hrl"). -include("ssl_record.hrl"). -export([master_secret/4, finished/5, certificate_verify/3, mac_hash/7, setup_keys/8, suites/1, prf/5, ecc_curves/1, ec_nid2curve_id/1, ec_curve_id2nid/1]). %%==================================================================== %% Internal application API %%==================================================================== -spec master_secret(integer(), binary(), binary(), binary()) -> binary(). master_secret(PrfAlgo, PreMasterSecret, ClientRandom, ServerRandom) -> %% RFC 2246 & 4346 && RFC 5246 - 8.1 %% master_secret = PRF(pre_master_secret, %% "master secret", ClientHello.random + %% ServerHello.random)[0..47]; prf(PrfAlgo, PreMasterSecret, <<"master secret">>, [ClientRandom, ServerRandom], 48). -spec finished(client | server, integer(), integer(), binary(), [binary()]) -> binary(). finished(Role, Version, PrfAlgo, MasterSecret, Handshake) when Version == 1; Version == 2; PrfAlgo == ?MD5SHA -> %% RFC 2246 & 4346 - 7.4.9. Finished %% struct { %% opaque verify_data[12]; %% } Finished; %% %% verify_data %% PRF(master_secret, finished_label, MD5(handshake_messages) + %% SHA-1(handshake_messages)) [0..11]; MD5 = crypto:md5(Handshake), SHA = crypto:sha(Handshake), prf(?MD5SHA, MasterSecret, finished_label(Role), [MD5, SHA], 12); finished(Role, Version, PrfAlgo, MasterSecret, Handshake) when Version == 3 -> %% RFC 5246 - 7.4.9. Finished %% struct { %% opaque verify_data[12]; %% } Finished; %% %% verify_data %% PRF(master_secret, finished_label, Hash(handshake_messages)) [0..11]; Hash = crypto:hash(mac_algo(PrfAlgo), Handshake), prf(PrfAlgo, MasterSecret, finished_label(Role), Hash, 12). -spec certificate_verify(md5sha | sha, integer(), [binary()]) -> binary(). certificate_verify(md5sha, _Version, Handshake) -> MD5 = crypto:md5(Handshake), SHA = crypto:sha(Handshake), <>; certificate_verify(HashAlgo, _Version, Handshake) -> crypto:hash(HashAlgo, Handshake). -spec setup_keys(integer(), integer(), binary(), binary(), binary(), integer(), integer(), integer()) -> {binary(), binary(), binary(), binary(), binary(), binary()}. setup_keys(Version, _PrfAlgo, MasterSecret, ServerRandom, ClientRandom, HashSize, KeyMatLen, IVSize) when Version == 1 -> %% RFC 2246 - 6.3. Key calculation %% key_block = PRF(SecurityParameters.master_secret, %% "key expansion", %% SecurityParameters.server_random + %% SecurityParameters.client_random); %% Then the key_block is partitioned as follows: %% client_write_MAC_secret[SecurityParameters.hash_size] %% server_write_MAC_secret[SecurityParameters.hash_size] %% client_write_key[SecurityParameters.key_material_length] %% server_write_key[SecurityParameters.key_material_length] %% client_write_IV[SecurityParameters.IV_size] %% server_write_IV[SecurityParameters.IV_size] WantedLength = 2 * (HashSize + KeyMatLen + IVSize), KeyBlock = prf(?MD5SHA, MasterSecret, "key expansion", [ServerRandom, ClientRandom], WantedLength), <> = KeyBlock, {ClientWriteMacSecret, ServerWriteMacSecret, ClientWriteKey, ServerWriteKey, ClientIV, ServerIV}; %% TLS v1.1 setup_keys(Version, _PrfAlgo, MasterSecret, ServerRandom, ClientRandom, HashSize, KeyMatLen, IVSize) when Version == 2 -> %% RFC 4346 - 6.3. Key calculation %% key_block = PRF(SecurityParameters.master_secret, %% "key expansion", %% SecurityParameters.server_random + %% SecurityParameters.client_random); %% Then the key_block is partitioned as follows: %% client_write_MAC_secret[SecurityParameters.hash_size] %% server_write_MAC_secret[SecurityParameters.hash_size] %% client_write_key[SecurityParameters.key_material_length] %% server_write_key[SecurityParameters.key_material_length] %% %% RFC 4346 is incomplete, the client and server IVs have to %% be generated just like for TLS 1.0 WantedLength = 2 * (HashSize + KeyMatLen + IVSize), KeyBlock = prf(?MD5SHA, MasterSecret, "key expansion", [ServerRandom, ClientRandom], WantedLength), <> = KeyBlock, {ClientWriteMacSecret, ServerWriteMacSecret, ClientWriteKey, ServerWriteKey, ClientIV, ServerIV}; %% TLS v1.2 setup_keys(Version, PrfAlgo, MasterSecret, ServerRandom, ClientRandom, HashSize, KeyMatLen, IVSize) when Version == 3 -> %% RFC 5246 - 6.3. Key calculation %% key_block = PRF(SecurityParameters.master_secret, %% "key expansion", %% SecurityParameters.server_random + %% SecurityParameters.client_random); %% Then the key_block is partitioned as follows: %% client_write_MAC_secret[SecurityParameters.hash_size] %% server_write_MAC_secret[SecurityParameters.hash_size] %% client_write_key[SecurityParameters.key_material_length] %% server_write_key[SecurityParameters.key_material_length] %% client_write_IV[SecurityParameters.fixed_iv_length] %% server_write_IV[SecurityParameters.fixed_iv_length] WantedLength = 2 * (HashSize + KeyMatLen + IVSize), KeyBlock = prf(PrfAlgo, MasterSecret, "key expansion", [ServerRandom, ClientRandom], WantedLength), <> = KeyBlock, {ClientWriteMacSecret, ServerWriteMacSecret, ClientWriteKey, ServerWriteKey, ClientIV, ServerIV}. -spec mac_hash(integer(), binary(), integer(), integer(), tls_version(), integer(), binary()) -> binary(). mac_hash(Method, Mac_write_secret, Seq_num, Type, {Major, Minor}, Length, Fragment) -> %% RFC 2246 & 4346 - 6.2.3.1. %% HMAC_hash(MAC_write_secret, seq_num + TLSCompressed.type + %% TLSCompressed.version + TLSCompressed.length + %% TLSCompressed.fragment)); Mac = hmac_hash(Method, Mac_write_secret, [<>, Fragment]), Mac. -spec suites(1|2|3) -> [cipher_suite()]. suites(Minor) when Minor == 1; Minor == 2-> [ ?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, ?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA, ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA, ?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, ?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, ?TLS_RSA_WITH_AES_256_CBC_SHA, ?TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, ?TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA, ?TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA, ?TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, ?TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, ?TLS_RSA_WITH_3DES_EDE_CBC_SHA, ?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, ?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA, ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA, ?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, ?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, ?TLS_RSA_WITH_AES_128_CBC_SHA, %%?TLS_RSA_WITH_IDEA_CBC_SHA, ?TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ?TLS_ECDHE_RSA_WITH_RC4_128_SHA, ?TLS_RSA_WITH_RC4_128_SHA, ?TLS_RSA_WITH_RC4_128_MD5, ?TLS_DHE_RSA_WITH_DES_CBC_SHA, ?TLS_ECDH_ECDSA_WITH_RC4_128_SHA, ?TLS_ECDH_RSA_WITH_RC4_128_SHA, ?TLS_RSA_WITH_DES_CBC_SHA ]; suites(Minor) when Minor == 3 -> [ ?TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, ?TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, ?TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, ?TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, ?TLS_RSA_WITH_AES_256_CBC_SHA256, ?TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ?TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ?TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, ?TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, ?TLS_RSA_WITH_AES_128_CBC_SHA256 %% ?TLS_DH_anon_WITH_AES_128_CBC_SHA256, %% ?TLS_DH_anon_WITH_AES_256_CBC_SHA256 ] ++ suites(2). %%-------------------------------------------------------------------- %%% Internal functions %%-------------------------------------------------------------------- %%%% HMAC and the Pseudorandom Functions RFC 2246 & 4346 - 5.%%%% hmac_hash(?NULL, _, _) -> <<>>; hmac_hash(?MD5, Key, Value) -> crypto:md5_mac(Key, Value); hmac_hash(?SHA, Key, Value) -> crypto:sha_mac(Key, Value); hmac_hash(?SHA256, Key, Value) -> crypto:sha256_mac(Key, Value); hmac_hash(?SHA384, Key, Value) -> crypto:sha384_mac(Key, Value); hmac_hash(?SHA512, Key, Value) -> crypto:sha512_mac(Key, Value). mac_algo(?MD5) -> md5; mac_algo(?SHA) -> sha; mac_algo(?SHA256) -> sha256; mac_algo(?SHA384) -> sha384; mac_algo(?SHA512) -> sha512. % First, we define a data expansion function, P_hash(secret, data) that % uses a single hash function to expand a secret and seed into an % arbitrary quantity of output: %% P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) + %% HMAC_hash(secret, A(2) + seed) + %% HMAC_hash(secret, A(3) + seed) + ... p_hash(Secret, Seed, WantedLength, Method) -> p_hash(Secret, Seed, WantedLength, Method, 0, []). p_hash(_Secret, _Seed, WantedLength, _Method, _N, []) when WantedLength =< 0 -> []; p_hash(_Secret, _Seed, WantedLength, _Method, _N, [Last | Acc]) when WantedLength =< 0 -> Keep = byte_size(Last) + WantedLength, <> = Last, list_to_binary(lists:reverse(Acc, [B])); p_hash(Secret, Seed, WantedLength, Method, N, Acc) -> N1 = N+1, Bin = hmac_hash(Method, Secret, [a(N1, Secret, Seed, Method), Seed]), p_hash(Secret, Seed, WantedLength - byte_size(Bin), Method, N1, [Bin|Acc]). %% ... Where A(0) = seed %% A(i) = HMAC_hash(secret, A(i-1)) %% a(0, _Secret, Seed, _Method) -> %% Seed. %% a(N, Secret, Seed, Method) -> %% hmac_hash(Method, Secret, a(N-1, Secret, Seed, Method)). a(0, _Secret, Seed, _Method) -> Seed; a(N, Secret, Seed0, Method) -> Seed = hmac_hash(Method, Secret, Seed0), a(N-1, Secret, Seed, Method). split_secret(BinSecret) -> %% L_S = length in bytes of secret; %% L_S1 = L_S2 = ceil(L_S / 2); %% The secret is partitioned into two halves (with the possibility of %% one shared byte) as described above, S1 taking the first L_S1 bytes, %% and S2 the last L_S2 bytes. Length = byte_size(BinSecret), Div = Length div 2, EvenLength = Length - Div, <> = BinSecret, <<_:Div/binary, Secret2:EvenLength/binary>> = BinSecret, {Secret1, Secret2}. prf(?MD5SHA, Secret, Label, Seed, WantedLength) -> %% PRF(secret, label, seed) = P_MD5(S1, label + seed) XOR %% P_SHA-1(S2, label + seed); {S1, S2} = split_secret(Secret), LS = list_to_binary([Label, Seed]), crypto:exor(p_hash(S1, LS, WantedLength, ?MD5), p_hash(S2, LS, WantedLength, ?SHA)); prf(MAC, Secret, Label, Seed, WantedLength) -> %% PRF(secret, label, seed) = P_SHA256(secret, label + seed); LS = list_to_binary([Label, Seed]), p_hash(Secret, LS, WantedLength, MAC). %%%% Misc help functions %%%% finished_label(client) -> <<"client finished">>; finished_label(server) -> <<"server finished">>. %% list ECC curves in prefered order ecc_curves(_Minor) -> [sect571r1,sect571k1,secp521r1,sect409k1,sect409r1, secp384r1,sect283k1,sect283r1,secp256k1,secp256r1, sect239k1,sect233k1,sect233r1,secp224k1,secp224r1, sect193r1,sect193r2,secp192k1,secp192r1,sect163k1, sect163r1,sect163r2,secp160k1,secp160r1,secp160r2]. %% ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) ec_nid2curve_id(sect163k1) -> 1; ec_nid2curve_id(sect163r1) -> 2; ec_nid2curve_id(sect163r2) -> 3; ec_nid2curve_id(sect193r1) -> 4; ec_nid2curve_id(sect193r2) -> 5; ec_nid2curve_id(sect233k1) -> 6; ec_nid2curve_id(sect233r1) -> 7; ec_nid2curve_id(sect239k1) -> 8; ec_nid2curve_id(sect283k1) -> 9; ec_nid2curve_id(sect283r1) -> 10; ec_nid2curve_id(sect409k1) -> 11; ec_nid2curve_id(sect409r1) -> 12; ec_nid2curve_id(sect571k1) -> 13; ec_nid2curve_id(sect571r1) -> 14; ec_nid2curve_id(secp160k1) -> 15; ec_nid2curve_id(secp160r1) -> 16; ec_nid2curve_id(secp160r2) -> 17; ec_nid2curve_id(secp192k1) -> 18; ec_nid2curve_id(secp192r1) -> 19; ec_nid2curve_id(secp224k1) -> 20; ec_nid2curve_id(secp224r1) -> 21; ec_nid2curve_id(secp256k1) -> 22; ec_nid2curve_id(secp256r1) -> 23; ec_nid2curve_id(secp384r1) -> 24; ec_nid2curve_id(secp521r1) -> 25. ec_curve_id2nid(1) -> sect163k1; ec_curve_id2nid(2) -> sect163r1; ec_curve_id2nid(3) -> sect163r2; ec_curve_id2nid(4) -> sect193r1; ec_curve_id2nid(5) -> sect193r2; ec_curve_id2nid(6) -> sect233k1; ec_curve_id2nid(7) -> sect233r1; ec_curve_id2nid(8) -> sect239k1; ec_curve_id2nid(9) -> sect283k1; ec_curve_id2nid(10) -> sect283r1; ec_curve_id2nid(11) -> sect409k1; ec_curve_id2nid(12) -> sect409r1; ec_curve_id2nid(13) -> sect571k1; ec_curve_id2nid(14) -> sect571r1; ec_curve_id2nid(15) -> secp160k1; ec_curve_id2nid(16) -> secp160r1; ec_curve_id2nid(17) -> secp160r2; ec_curve_id2nid(18) -> secp192k1; ec_curve_id2nid(19) -> secp192r1; ec_curve_id2nid(20) -> secp224k1; ec_curve_id2nid(21) -> secp224r1; ec_curve_id2nid(22) -> secp256k1; ec_curve_id2nid(23) -> secp256r1; ec_curve_id2nid(24) -> secp384r1; ec_curve_id2nid(25) -> secp521r1.