Subversion Repositories openrisc

// Copyright 2010 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package tls

import (
        "crypto"
        "crypto/elliptic"
        "crypto/md5"
        "crypto/rsa"
        "crypto/sha1"
        "crypto/x509"
        "errors"
        "io"
        "math/big"
)

// rsaKeyAgreement implements the standard TLS key agreement where the client
// encrypts the pre-master secret to the server's public key.
type rsaKeyAgreement struct{}

func (ka rsaKeyAgreement) generateServerKeyExchange(config *Config, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) {
        return nil, nil
}

func (ka rsaKeyAgreement) processClientKeyExchange(config *Config, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) {
        preMasterSecret := make([]byte, 48)
        _, err := io.ReadFull(config.rand(), preMasterSecret[2:])
        if err != nil {
                return nil, err
        }

        if len(ckx.ciphertext) < 2 {
                return nil, errors.New("bad ClientKeyExchange")
        }

        ciphertext := ckx.ciphertext
        if version != versionSSL30 {
                ciphertextLen := int(ckx.ciphertext[0])<<8 | int(ckx.ciphertext[1])
                if ciphertextLen != len(ckx.ciphertext)-2 {
                        return nil, errors.New("bad ClientKeyExchange")
                }
                ciphertext = ckx.ciphertext[2:]
        }

        err = rsa.DecryptPKCS1v15SessionKey(config.rand(), config.Certificates[0].PrivateKey.(*rsa.PrivateKey), ciphertext, preMasterSecret)
        if err != nil {
                return nil, err
        }
        // We don't check the version number in the premaster secret.  For one,
        // by checking it, we would leak information about the validity of the
        // encrypted pre-master secret. Secondly, it provides only a small
        // benefit against a downgrade attack and some implementations send the
        // wrong version anyway. See the discussion at the end of section
        // 7.4.7.1 of RFC 4346.
        return preMasterSecret, nil
}

func (ka rsaKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error {
        return errors.New("unexpected ServerKeyExchange")
}

func (ka rsaKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) {
        preMasterSecret := make([]byte, 48)
        preMasterSecret[0] = byte(clientHello.vers >> 8)
        preMasterSecret[1] = byte(clientHello.vers)
        _, err := io.ReadFull(config.rand(), preMasterSecret[2:])
        if err != nil {
                return nil, nil, err
        }

        encrypted, err := rsa.EncryptPKCS1v15(config.rand(), cert.PublicKey.(*rsa.PublicKey), preMasterSecret)
        if err != nil {
                return nil, nil, err
        }
        ckx := new(clientKeyExchangeMsg)
        ckx.ciphertext = make([]byte, len(encrypted)+2)
        ckx.ciphertext[0] = byte(len(encrypted) >> 8)
        ckx.ciphertext[1] = byte(len(encrypted))
        copy(ckx.ciphertext[2:], encrypted)
        return preMasterSecret, ckx, nil
}

// md5SHA1Hash implements TLS 1.0's hybrid hash function which consists of the
// concatenation of an MD5 and SHA1 hash.
func md5SHA1Hash(slices ...[]byte) []byte {
        md5sha1 := make([]byte, md5.Size+sha1.Size)
        hmd5 := md5.New()
        for _, slice := range slices {
                hmd5.Write(slice)
        }
        copy(md5sha1, hmd5.Sum(nil))

        hsha1 := sha1.New()
        for _, slice := range slices {
                hsha1.Write(slice)
        }
        copy(md5sha1[md5.Size:], hsha1.Sum(nil))
        return md5sha1
}

// ecdheRSAKeyAgreement implements a TLS key agreement where the server
// generates a ephemeral EC public/private key pair and signs it. The
// pre-master secret is then calculated using ECDH.
type ecdheRSAKeyAgreement struct {
        privateKey []byte
        curve      elliptic.Curve
        x, y       *big.Int
}

func (ka *ecdheRSAKeyAgreement) generateServerKeyExchange(config *Config, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) {
        var curveid uint16

Curve:
        for _, c := range clientHello.supportedCurves {
                switch c {
                case curveP256:
                        ka.curve = elliptic.P256()
                        curveid = c
                        break Curve
                case curveP384:
                        ka.curve = elliptic.P384()
                        curveid = c
                        break Curve
                case curveP521:
                        ka.curve = elliptic.P521()
                        curveid = c
                        break Curve
                }
        }

        var x, y *big.Int
        var err error
        ka.privateKey, x, y, err = elliptic.GenerateKey(ka.curve, config.rand())
        if err != nil {
                return nil, err
        }
        ecdhePublic := elliptic.Marshal(ka.curve, x, y)

        // http://tools.ietf.org/html/rfc4492#section-5.4
        serverECDHParams := make([]byte, 1+2+1+len(ecdhePublic))
        serverECDHParams[0] = 3 // named curve
        serverECDHParams[1] = byte(curveid >> 8)
        serverECDHParams[2] = byte(curveid)
        serverECDHParams[3] = byte(len(ecdhePublic))
        copy(serverECDHParams[4:], ecdhePublic)

        md5sha1 := md5SHA1Hash(clientHello.random, hello.random, serverECDHParams)
        sig, err := rsa.SignPKCS1v15(config.rand(), config.Certificates[0].PrivateKey.(*rsa.PrivateKey), crypto.MD5SHA1, md5sha1)
        if err != nil {
                return nil, errors.New("failed to sign ECDHE parameters: " + err.Error())
        }

        skx := new(serverKeyExchangeMsg)
        skx.key = make([]byte, len(serverECDHParams)+2+len(sig))
        copy(skx.key, serverECDHParams)
        k := skx.key[len(serverECDHParams):]
        k[0] = byte(len(sig) >> 8)
        k[1] = byte(len(sig))
        copy(k[2:], sig)

        return skx, nil
}

func (ka *ecdheRSAKeyAgreement) processClientKeyExchange(config *Config, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) {
        if len(ckx.ciphertext) == 0 || int(ckx.ciphertext[0]) != len(ckx.ciphertext)-1 {
                return nil, errors.New("bad ClientKeyExchange")
        }
        x, y := elliptic.Unmarshal(ka.curve, ckx.ciphertext[1:])
        if x == nil {
                return nil, errors.New("bad ClientKeyExchange")
        }
        x, _ = ka.curve.ScalarMult(x, y, ka.privateKey)
        preMasterSecret := make([]byte, (ka.curve.Params().BitSize+7)>>3)
        xBytes := x.Bytes()
        copy(preMasterSecret[len(preMasterSecret)-len(xBytes):], xBytes)

        return preMasterSecret, nil
}

var errServerKeyExchange = errors.New("invalid ServerKeyExchange")

func (ka *ecdheRSAKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error {
        if len(skx.key) < 4 {
                return errServerKeyExchange
        }
        if skx.key[0] != 3 { // named curve
                return errors.New("server selected unsupported curve")
        }
        curveid := uint16(skx.key[1])<<8 | uint16(skx.key[2])

        switch curveid {
        case curveP256:
                ka.curve = elliptic.P256()
        case curveP384:
                ka.curve = elliptic.P384()
        case curveP521:
                ka.curve = elliptic.P521()
        default:
                return errors.New("server selected unsupported curve")
        }

        publicLen := int(skx.key[3])
        if publicLen+4 > len(skx.key) {
                return errServerKeyExchange
        }
        ka.x, ka.y = elliptic.Unmarshal(ka.curve, skx.key[4:4+publicLen])
        if ka.x == nil {
                return errServerKeyExchange
        }
        serverECDHParams := skx.key[:4+publicLen]

        sig := skx.key[4+publicLen:]
        if len(sig) < 2 {
                return errServerKeyExchange
        }
        sigLen := int(sig[0])<<8 | int(sig[1])
        if sigLen+2 != len(sig) {
                return errServerKeyExchange
        }
        sig = sig[2:]

        md5sha1 := md5SHA1Hash(clientHello.random, serverHello.random, serverECDHParams)
        return rsa.VerifyPKCS1v15(cert.PublicKey.(*rsa.PublicKey), crypto.MD5SHA1, md5sha1, sig)
}

func (ka *ecdheRSAKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) {
        if ka.curve == nil {
                return nil, nil, errors.New("missing ServerKeyExchange message")
        }
        priv, mx, my, err := elliptic.GenerateKey(ka.curve, config.rand())
        if err != nil {
                return nil, nil, err
        }
        x, _ := ka.curve.ScalarMult(ka.x, ka.y, priv)
        preMasterSecret := make([]byte, (ka.curve.Params().BitSize+7)>>3)
        xBytes := x.Bytes()
        copy(preMasterSecret[len(preMasterSecret)-len(xBytes):], xBytes)

        serialized := elliptic.Marshal(ka.curve, mx, my)

        ckx := new(clientKeyExchangeMsg)
        ckx.ciphertext = make([]byte, 1+len(serialized))
        ckx.ciphertext[0] = byte(len(serialized))
        copy(ckx.ciphertext[1:], serialized)

        return preMasterSecret, ckx, nil
}