1 /* 2 * Key Derivation that doesn't use PKCS11 3 * 4 * ***** BEGIN LICENSE BLOCK ***** 5 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 6 * 7 * The contents of this file are subject to the Mozilla Public License Version 8 * 1.1 (the "License"); you may not use this file except in compliance with 9 * the License. You may obtain a copy of the License at 10 * http://www.mozilla.org/MPL/ 11 * 12 * Software distributed under the License is distributed on an "AS IS" basis, 13 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License 14 * for the specific language governing rights and limitations under the 15 * License. 16 * 17 * The Original Code is the Netscape security libraries. 18 * 19 * The Initial Developer of the Original Code is 20 * Netscape Communications Corporation. 21 * Portions created by the Initial Developer are Copyright (C) 1994-2005 22 * the Initial Developer. All Rights Reserved. 23 * 24 * Contributor(s): 25 * 26 * Alternatively, the contents of this file may be used under the terms of 27 * either the GNU General Public License Version 2 or later (the "GPL"), or 28 * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), 29 * in which case the provisions of the GPL or the LGPL are applicable instead 30 * of those above. If you wish to allow use of your version of this file only 31 * under the terms of either the GPL or the LGPL, and not to allow others to 32 * use your version of this file under the terms of the MPL, indicate your 33 * decision by deleting the provisions above and replace them with the notice 34 * and other provisions required by the GPL or the LGPL. If you do not delete 35 * the provisions above, a recipient may use your version of this file under 36 * the terms of any one of the MPL, the GPL or the LGPL. 37 * 38 * ***** END LICENSE BLOCK ***** */ 39 /* $Id: derive.c,v 1.12 2008/06/06 01:16:31 wtc%google.com Exp $ */ 40 41 #include "ssl.h" /* prereq to sslimpl.h */ 42 #include "certt.h" /* prereq to sslimpl.h */ 43 #include "keythi.h" /* prereq to sslimpl.h */ 44 #include "sslimpl.h" 45 #include "blapi.h" 46 47 #include "keyhi.h" 48 #include "pk11func.h" 49 #include "secasn1.h" 50 #include "cert.h" 51 #include "secmodt.h" 52 53 #include "sslproto.h" 54 #include "sslerr.h" 55 56 /* make this a macro! */ 57 #ifdef NOT_A_MACRO 58 static void 59 buildSSLKey(unsigned char * keyBlock, unsigned int keyLen, SECItem * result, 60 const char * label) 61 { 62 result->type = siBuffer; 63 result->data = keyBlock; 64 result->len = keyLen; 65 PRINT_BUF(100, (NULL, label, keyBlock, keyLen)); 66 } 67 #else 68 #define buildSSLKey(keyBlock, keyLen, result, label) \ 69 { \ 70 (result)->type = siBuffer; \ 71 (result)->data = keyBlock; \ 72 (result)->len = keyLen; \ 73 PRINT_BUF(100, (NULL, label, keyBlock, keyLen)); \ 74 } 75 #endif 76 77 /* 78 * SSL Key generation given pre master secret 79 */ 80 #ifndef NUM_MIXERS 81 #define NUM_MIXERS 9 82 #endif 83 static const char * const mixers[NUM_MIXERS] = { 84 "A", 85 "BB", 86 "CCC", 87 "DDDD", 88 "EEEEE", 89 "FFFFFF", 90 "GGGGGGG", 91 "HHHHHHHH", 92 "IIIIIIIII" 93 }; 94 95 96 SECStatus 97 ssl3_KeyAndMacDeriveBypass( 98 ssl3CipherSpec * pwSpec, 99 const unsigned char * cr, 100 const unsigned char * sr, 101 PRBool isTLS, 102 PRBool isExport) 103 { 104 const ssl3BulkCipherDef *cipher_def = pwSpec->cipher_def; 105 unsigned char * key_block = pwSpec->key_block; 106 unsigned char * key_block2 = NULL; 107 unsigned int block_bytes = 0; 108 unsigned int block_needed = 0; 109 unsigned int i; 110 unsigned int keySize; /* actual size of cipher keys */ 111 unsigned int effKeySize; /* effective size of cipher keys */ 112 unsigned int macSize; /* size of MAC secret */ 113 unsigned int IVSize; /* size of IV */ 114 SECStatus rv = SECFailure; 115 SECStatus status = SECSuccess; 116 PRBool isFIPS = PR_FALSE; 117 118 SECItem srcr; 119 SECItem crsr; 120 121 unsigned char srcrdata[SSL3_RANDOM_LENGTH * 2]; 122 unsigned char crsrdata[SSL3_RANDOM_LENGTH * 2]; 123 PRUint64 md5buf[22]; 124 PRUint64 shabuf[40]; 125 126 #define md5Ctx ((MD5Context *)md5buf) 127 #define shaCtx ((SHA1Context *)shabuf) 128 129 static const SECItem zed = { siBuffer, NULL, 0 }; 130 131 if (pwSpec->msItem.data == NULL || 132 pwSpec->msItem.len != SSL3_MASTER_SECRET_LENGTH) { 133 PORT_SetError(SEC_ERROR_INVALID_ARGS); 134 return rv; 135 } 136 137 PRINT_BUF(100, (NULL, "Master Secret", pwSpec->msItem.data, 138 pwSpec->msItem.len)); 139 140 /* figure out how much is needed */ 141 macSize = pwSpec->mac_size; 142 keySize = cipher_def->key_size; 143 effKeySize = cipher_def->secret_key_size; 144 IVSize = cipher_def->iv_size; 145 if (keySize == 0) { 146 effKeySize = IVSize = 0; /* only MACing */ 147 } 148 block_needed = 2 * (macSize + effKeySize + ((!isExport) * IVSize)); 149 150 /* 151 * clear out our returned keys so we can recover on failure 152 */ 153 pwSpec->client.write_key_item = zed; 154 pwSpec->client.write_mac_key_item = zed; 155 pwSpec->server.write_key_item = zed; 156 pwSpec->server.write_mac_key_item = zed; 157 158 /* initialize the server random, client random block */ 159 srcr.type = siBuffer; 160 srcr.data = srcrdata; 161 srcr.len = sizeof srcrdata; 162 PORT_Memcpy(srcrdata, sr, SSL3_RANDOM_LENGTH); 163 PORT_Memcpy(srcrdata + SSL3_RANDOM_LENGTH, cr, SSL3_RANDOM_LENGTH); 164 165 /* initialize the client random, server random block */ 166 crsr.type = siBuffer; 167 crsr.data = crsrdata; 168 crsr.len = sizeof crsrdata; 169 PORT_Memcpy(crsrdata, cr, SSL3_RANDOM_LENGTH); 170 PORT_Memcpy(crsrdata + SSL3_RANDOM_LENGTH, sr, SSL3_RANDOM_LENGTH); 171 PRINT_BUF(100, (NULL, "Key & MAC CRSR", crsr.data, crsr.len)); 172 173 /* 174 * generate the key material: 175 */ 176 if (isTLS) { 177 SECItem keyblk; 178 179 keyblk.type = siBuffer; 180 keyblk.data = key_block; 181 keyblk.len = block_needed; 182 183 status = TLS_PRF(&pwSpec->msItem, "key expansion", &srcr, &keyblk, 184 isFIPS); 185 if (status != SECSuccess) { 186 goto key_and_mac_derive_fail; 187 } 188 block_bytes = keyblk.len; 189 } else { 190 /* key_block = 191 * MD5(master_secret + SHA('A' + master_secret + 192 * ServerHello.random + ClientHello.random)) + 193 * MD5(master_secret + SHA('BB' + master_secret + 194 * ServerHello.random + ClientHello.random)) + 195 * MD5(master_secret + SHA('CCC' + master_secret + 196 * ServerHello.random + ClientHello.random)) + 197 * [...]; 198 */ 199 unsigned int made = 0; 200 for (i = 0; made < block_needed && i < NUM_MIXERS; ++i) { 201 unsigned int outLen; 202 unsigned char sha_out[SHA1_LENGTH]; 203 204 SHA1_Begin(shaCtx); 205 SHA1_Update(shaCtx, (unsigned char*)(mixers[i]), i+1); 206 SHA1_Update(shaCtx, pwSpec->msItem.data, pwSpec->msItem.len); 207 SHA1_Update(shaCtx, srcr.data, srcr.len); 208 SHA1_End(shaCtx, sha_out, &outLen, SHA1_LENGTH); 209 PORT_Assert(outLen == SHA1_LENGTH); 210 211 MD5_Begin(md5Ctx); 212 MD5_Update(md5Ctx, pwSpec->msItem.data, pwSpec->msItem.len); 213 MD5_Update(md5Ctx, sha_out, outLen); 214 MD5_End(md5Ctx, key_block + made, &outLen, MD5_LENGTH); 215 PORT_Assert(outLen == MD5_LENGTH); 216 made += MD5_LENGTH; 217 } 218 block_bytes = made; 219 } 220 PORT_Assert(block_bytes >= block_needed); 221 PORT_Assert(block_bytes <= sizeof pwSpec->key_block); 222 PRINT_BUF(100, (NULL, "key block", key_block, block_bytes)); 223 224 /* 225 * Put the key material where it goes. 226 */ 227 key_block2 = key_block + block_bytes; 228 i = 0; /* now shows how much consumed */ 229 230 /* 231 * The key_block is partitioned as follows: 232 * client_write_MAC_secret[CipherSpec.hash_size] 233 */ 234 buildSSLKey(&key_block[i],macSize, &pwSpec->client.write_mac_key_item, \ 235 "Client Write MAC Secret"); 236 i += macSize; 237 238 /* 239 * server_write_MAC_secret[CipherSpec.hash_size] 240 */ 241 buildSSLKey(&key_block[i],macSize, &pwSpec->server.write_mac_key_item, \ 242 "Server Write MAC Secret"); 243 i += macSize; 244 245 if (!keySize) { 246 /* only MACing */ 247 buildSSLKey(NULL, 0, &pwSpec->client.write_key_item, \ 248 "Client Write Key (MAC only)"); 249 buildSSLKey(NULL, 0, &pwSpec->server.write_key_item, \ 250 "Server Write Key (MAC only)"); 251 buildSSLKey(NULL, 0, &pwSpec->client.write_iv_item, \ 252 "Client Write IV (MAC only)"); 253 buildSSLKey(NULL, 0, &pwSpec->server.write_iv_item, \ 254 "Server Write IV (MAC only)"); 255 } else if (!isExport) { 256 /* 257 ** Generate Domestic write keys and IVs. 258 ** client_write_key[CipherSpec.key_material] 259 */ 260 buildSSLKey(&key_block[i], keySize, &pwSpec->client.write_key_item, \ 261 "Domestic Client Write Key"); 262 i += keySize; 263 264 /* 265 ** server_write_key[CipherSpec.key_material] 266 */ 267 buildSSLKey(&key_block[i], keySize, &pwSpec->server.write_key_item, \ 268 "Domestic Server Write Key"); 269 i += keySize; 270 271 if (IVSize > 0) { 272 /* 273 ** client_write_IV[CipherSpec.IV_size] 274 */ 275 buildSSLKey(&key_block[i], IVSize, &pwSpec->client.write_iv_item, \ 276 "Domestic Client Write IV"); 277 i += IVSize; 278 279 /* 280 ** server_write_IV[CipherSpec.IV_size] 281 */ 282 buildSSLKey(&key_block[i], IVSize, &pwSpec->server.write_iv_item, \ 283 "Domestic Server Write IV"); 284 i += IVSize; 285 } 286 PORT_Assert(i <= block_bytes); 287 288 } else if (!isTLS) { 289 /* 290 ** Generate SSL3 Export write keys and IVs. 291 */ 292 unsigned int outLen; 293 294 /* 295 ** client_write_key[CipherSpec.key_material] 296 ** final_client_write_key = MD5(client_write_key + 297 ** ClientHello.random + ServerHello.random); 298 */ 299 MD5_Begin(md5Ctx); 300 MD5_Update(md5Ctx, &key_block[i], effKeySize); 301 MD5_Update(md5Ctx, crsr.data, crsr.len); 302 MD5_End(md5Ctx, key_block2, &outLen, MD5_LENGTH); 303 i += effKeySize; 304 buildSSLKey(key_block2, keySize, &pwSpec->client.write_key_item, \ 305 "SSL3 Export Client Write Key"); 306 key_block2 += keySize; 307 308 /* 309 ** server_write_key[CipherSpec.key_material] 310 ** final_server_write_key = MD5(server_write_key + 311 ** ServerHello.random + ClientHello.random); 312 */ 313 MD5_Begin(md5Ctx); 314 MD5_Update(md5Ctx, &key_block[i], effKeySize); 315 MD5_Update(md5Ctx, srcr.data, srcr.len); 316 MD5_End(md5Ctx, key_block2, &outLen, MD5_LENGTH); 317 i += effKeySize; 318 buildSSLKey(key_block2, keySize, &pwSpec->server.write_key_item, \ 319 "SSL3 Export Server Write Key"); 320 key_block2 += keySize; 321 PORT_Assert(i <= block_bytes); 322 323 if (IVSize) { 324 /* 325 ** client_write_IV = 326 ** MD5(ClientHello.random + ServerHello.random); 327 */ 328 MD5_Begin(md5Ctx); 329 MD5_Update(md5Ctx, crsr.data, crsr.len); 330 MD5_End(md5Ctx, key_block2, &outLen, MD5_LENGTH); 331 buildSSLKey(key_block2, IVSize, &pwSpec->client.write_iv_item, \ 332 "SSL3 Export Client Write IV"); 333 key_block2 += IVSize; 334 335 /* 336 ** server_write_IV = 337 ** MD5(ServerHello.random + ClientHello.random); 338 */ 339 MD5_Begin(md5Ctx); 340 MD5_Update(md5Ctx, srcr.data, srcr.len); 341 MD5_End(md5Ctx, key_block2, &outLen, MD5_LENGTH); 342 buildSSLKey(key_block2, IVSize, &pwSpec->server.write_iv_item, \ 343 "SSL3 Export Server Write IV"); 344 key_block2 += IVSize; 345 } 346 347 PORT_Assert(key_block2 - key_block <= sizeof pwSpec->key_block); 348 } else { 349 /* 350 ** Generate TLS Export write keys and IVs. 351 */ 352 SECItem secret ; 353 SECItem keyblk ; 354 355 secret.type = siBuffer; 356 keyblk.type = siBuffer; 357 /* 358 ** client_write_key[CipherSpec.key_material] 359 ** final_client_write_key = PRF(client_write_key, 360 ** "client write key", 361 ** client_random + server_random); 362 */ 363 secret.data = &key_block[i]; 364 secret.len = effKeySize; 365 i += effKeySize; 366 keyblk.data = key_block2; 367 keyblk.len = keySize; 368 status = TLS_PRF(&secret, "client write key", &crsr, &keyblk, isFIPS); 369 if (status != SECSuccess) { 370 goto key_and_mac_derive_fail; 371 } 372 buildSSLKey(key_block2, keySize, &pwSpec->client.write_key_item, \ 373 "TLS Export Client Write Key"); 374 key_block2 += keySize; 375 376 /* 377 ** server_write_key[CipherSpec.key_material] 378 ** final_server_write_key = PRF(server_write_key, 379 ** "server write key", 380 ** client_random + server_random); 381 */ 382 secret.data = &key_block[i]; 383 secret.len = effKeySize; 384 i += effKeySize; 385 keyblk.data = key_block2; 386 keyblk.len = keySize; 387 status = TLS_PRF(&secret, "server write key", &crsr, &keyblk, isFIPS); 388 if (status != SECSuccess) { 389 goto key_and_mac_derive_fail; 390 } 391 buildSSLKey(key_block2, keySize, &pwSpec->server.write_key_item, \ 392 "TLS Export Server Write Key"); 393 key_block2 += keySize; 394 395 /* 396 ** iv_block = PRF("", "IV block", client_random + server_random); 397 ** client_write_IV[SecurityParameters.IV_size] 398 ** server_write_IV[SecurityParameters.IV_size] 399 */ 400 if (IVSize) { 401 secret.data = NULL; 402 secret.len = 0; 403 keyblk.data = key_block2; 404 keyblk.len = 2 * IVSize; 405 status = TLS_PRF(&secret, "IV block", &crsr, &keyblk, isFIPS); 406 if (status != SECSuccess) { 407 goto key_and_mac_derive_fail; 408 } 409 buildSSLKey(key_block2, IVSize, \ 410 &pwSpec->client.write_iv_item, \ 411 "TLS Export Client Write IV"); 412 buildSSLKey(key_block2 + IVSize, IVSize, \ 413 &pwSpec->server.write_iv_item, \ 414 "TLS Export Server Write IV"); 415 key_block2 += 2 * IVSize; 416 } 417 PORT_Assert(key_block2 - key_block <= sizeof pwSpec->key_block); 418 } 419 rv = SECSuccess; 420 421 key_and_mac_derive_fail: 422 423 MD5_DestroyContext(md5Ctx, PR_FALSE); 424 SHA1_DestroyContext(shaCtx, PR_FALSE); 425 426 if (rv != SECSuccess) { 427 PORT_SetError(SSL_ERROR_SESSION_KEY_GEN_FAILURE); 428 } 429 430 return rv; 431 } 432 433 434 /* derive the Master Secret from the PMS */ 435 /* Presently, this is only done wtih RSA PMS, and only on the server side, 436 * so isRSA is always true. 437 */ 438 SECStatus 439 ssl3_MasterKeyDeriveBypass( 440 ssl3CipherSpec * pwSpec, 441 const unsigned char * cr, 442 const unsigned char * sr, 443 const SECItem * pms, 444 PRBool isTLS, 445 PRBool isRSA) 446 { 447 unsigned char * key_block = pwSpec->key_block; 448 SECStatus rv = SECSuccess; 449 PRBool isFIPS = PR_FALSE; 450 451 SECItem crsr; 452 453 unsigned char crsrdata[SSL3_RANDOM_LENGTH * 2]; 454 PRUint64 md5buf[22]; 455 PRUint64 shabuf[40]; 456 457 #define md5Ctx ((MD5Context *)md5buf) 458 #define shaCtx ((SHA1Context *)shabuf) 459 460 /* first do the consistancy checks */ 461 if (isRSA) { 462 PORT_Assert(pms->len == SSL3_RSA_PMS_LENGTH); 463 if (pms->len != SSL3_RSA_PMS_LENGTH) { 464 PORT_SetError(SEC_ERROR_INVALID_ARGS); 465 return SECFailure; 466 } 467 /* caller must test PMS version for rollback */ 468 } 469 470 /* initialize the client random, server random block */ 471 crsr.type = siBuffer; 472 crsr.data = crsrdata; 473 crsr.len = sizeof crsrdata; 474 PORT_Memcpy(crsrdata, cr, SSL3_RANDOM_LENGTH); 475 PORT_Memcpy(crsrdata + SSL3_RANDOM_LENGTH, sr, SSL3_RANDOM_LENGTH); 476 PRINT_BUF(100, (NULL, "Master Secret CRSR", crsr.data, crsr.len)); 477 478 /* finally do the key gen */ 479 if (isTLS) { 480 SECItem master = { siBuffer, NULL, 0 }; 481 482 master.data = key_block; 483 master.len = SSL3_MASTER_SECRET_LENGTH; 484 485 rv = TLS_PRF(pms, "master secret", &crsr, &master, isFIPS); 486 if (rv != SECSuccess) { 487 PORT_SetError(SSL_ERROR_SESSION_KEY_GEN_FAILURE); 488 } 489 } else { 490 int i; 491 unsigned int made = 0; 492 for (i = 0; i < 3; i++) { 493 unsigned int outLen; 494 unsigned char sha_out[SHA1_LENGTH]; 495 496 SHA1_Begin(shaCtx); 497 SHA1_Update(shaCtx, (unsigned char*) mixers[i], i+1); 498 SHA1_Update(shaCtx, pms->data, pms->len); 499 SHA1_Update(shaCtx, crsr.data, crsr.len); 500 SHA1_End(shaCtx, sha_out, &outLen, SHA1_LENGTH); 501 PORT_Assert(outLen == SHA1_LENGTH); 502 503 MD5_Begin(md5Ctx); 504 MD5_Update(md5Ctx, pms->data, pms->len); 505 MD5_Update(md5Ctx, sha_out, outLen); 506 MD5_End(md5Ctx, key_block + made, &outLen, MD5_LENGTH); 507 PORT_Assert(outLen == MD5_LENGTH); 508 made += outLen; 509 } 510 } 511 512 /* store the results */ 513 PORT_Memcpy(pwSpec->raw_master_secret, key_block, 514 SSL3_MASTER_SECRET_LENGTH); 515 pwSpec->msItem.data = pwSpec->raw_master_secret; 516 pwSpec->msItem.len = SSL3_MASTER_SECRET_LENGTH; 517 PRINT_BUF(100, (NULL, "Master Secret", pwSpec->msItem.data, 518 pwSpec->msItem.len)); 519 520 return rv; 521 } 522 523 static SECStatus 524 ssl_canExtractMS(PK11SymKey *pms, PRBool isTLS, PRBool isDH, PRBool *pcbp) 525 { SECStatus rv; 526 PK11SymKey * ms = NULL; 527 SECItem params = {siBuffer, NULL, 0}; 528 CK_SSL3_MASTER_KEY_DERIVE_PARAMS master_params; 529 unsigned char rand[SSL3_RANDOM_LENGTH]; 530 CK_VERSION pms_version; 531 CK_MECHANISM_TYPE master_derive; 532 CK_MECHANISM_TYPE key_derive; 533 CK_FLAGS keyFlags; 534 535 if (pms == NULL) 536 return(SECFailure); 537 538 PORT_Memset(rand, 0, SSL3_RANDOM_LENGTH); 539 540 if (isTLS) { 541 if(isDH) master_derive = CKM_TLS_MASTER_KEY_DERIVE_DH; 542 else master_derive = CKM_TLS_MASTER_KEY_DERIVE; 543 key_derive = CKM_TLS_KEY_AND_MAC_DERIVE; 544 keyFlags = CKF_SIGN | CKF_VERIFY; 545 } else { 546 if (isDH) master_derive = CKM_SSL3_MASTER_KEY_DERIVE_DH; 547 else master_derive = CKM_SSL3_MASTER_KEY_DERIVE; 548 key_derive = CKM_SSL3_KEY_AND_MAC_DERIVE; 549 keyFlags = 0; 550 } 551 552 master_params.pVersion = &pms_version; 553 master_params.RandomInfo.pClientRandom = rand; 554 master_params.RandomInfo.ulClientRandomLen = SSL3_RANDOM_LENGTH; 555 master_params.RandomInfo.pServerRandom = rand; 556 master_params.RandomInfo.ulServerRandomLen = SSL3_RANDOM_LENGTH; 557 558 params.data = (unsigned char *) &master_params; 559 params.len = sizeof master_params; 560 561 ms = PK11_DeriveWithFlags(pms, master_derive, ¶ms, key_derive, 562 CKA_DERIVE, 0, keyFlags); 563 if (ms == NULL) 564 return(SECFailure); 565 566 rv = PK11_ExtractKeyValue(ms); 567 *pcbp = (rv == SECSuccess); 568 PK11_FreeSymKey(ms); 569 570 return(rv); 571 572 } 573 574 /* Check the key exchange algorithm for each cipher in the list to see if 575 * a master secret key can be extracted. If the KEA will use keys from the 576 * specified cert make sure the extract operation is attempted from the slot 577 * where the private key resides. 578 * If MS can be extracted for all ciphers, (*pcanbypass) is set to TRUE and 579 * SECSuccess is returned. In all other cases but one (*pcanbypass) is 580 * set to FALSE and SECFailure is returned. 581 * In that last case Derive() has been called successfully but the MS is null, 582 * CanBypass sets (*pcanbypass) to FALSE and returns SECSuccess indicating the 583 * arguments were all valid but the slot cannot be bypassed. 584 */ 585 586 SECStatus 587 SSL_CanBypass(CERTCertificate *cert, SECKEYPrivateKey *srvPrivkey, 588 PRUint32 protocolmask, PRUint16 *ciphersuites, int nsuites, 589 PRBool *pcanbypass, void *pwArg) 590 { SECStatus rv; 591 int i; 592 PRUint16 suite; 593 PK11SymKey * pms = NULL; 594 SECKEYPublicKey * srvPubkey = NULL; 595 KeyType privKeytype; 596 PK11SlotInfo * slot = NULL; 597 SECItem param; 598 CK_VERSION version; 599 CK_MECHANISM_TYPE mechanism_array[2]; 600 SECItem enc_pms = {siBuffer, NULL, 0}; 601 PRBool isTLS = PR_FALSE; 602 SSLCipherSuiteInfo csdef; 603 PRBool testrsa = PR_FALSE; 604 PRBool testrsa_export = PR_FALSE; 605 PRBool testecdh = PR_FALSE; 606 PRBool testecdhe = PR_FALSE; 607 608 if (!cert || !srvPrivkey || !ciphersuites || !pcanbypass) { 609 PORT_SetError(SEC_ERROR_INVALID_ARGS); 610 return SECFailure; 611 } 612 613 srvPubkey = CERT_ExtractPublicKey(cert); 614 if (!srvPubkey) 615 return SECFailure; 616 617 *pcanbypass = PR_TRUE; 618 rv = SECFailure; 619 620 /* determine which KEAs to test */ 621 /* 0 (SSL_NULL_WITH_NULL_NULL) is used as a list terminator because 622 * SSL3 and TLS specs forbid negotiating that cipher suite number. 623 */ 624 for (i=0; i < nsuites && (suite = *ciphersuites++) != 0; i++) { 625 /* skip SSL2 cipher suites and ones NSS doesn't support */ 626 if (SSL_GetCipherSuiteInfo(suite, &csdef, sizeof(csdef)) != SECSuccess 627 || SSL_IS_SSL2_CIPHER(suite) ) 628 continue; 629 switch (csdef.keaType) { 630 case ssl_kea_rsa: 631 switch (csdef.cipherSuite) { 632 case TLS_RSA_EXPORT1024_WITH_RC4_56_SHA: 633 case TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA: 634 case SSL_RSA_EXPORT_WITH_RC4_40_MD5: 635 case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5: 636 testrsa_export = PR_TRUE; 637 } 638 if (!testrsa_export) 639 testrsa = PR_TRUE; 640 break; 641 case ssl_kea_ecdh: 642 if (strcmp(csdef.keaTypeName, "ECDHE") == 0) /* ephemeral? */ 643 testecdhe = PR_TRUE; 644 else 645 testecdh = PR_TRUE; 646 break; 647 case ssl_kea_dh: 648 /* this is actually DHE */ 649 default: 650 continue; 651 } 652 } 653 654 /* For each protocol try to derive and extract an MS. 655 * Failure of function any function except MS extract means 656 * continue with the next cipher test. Stop testing when the list is 657 * exhausted or when the first MS extract--not derive--fails. 658 */ 659 privKeytype = SECKEY_GetPrivateKeyType(srvPrivkey); 660 protocolmask &= SSL_CBP_SSL3|SSL_CBP_TLS1_0; 661 while (protocolmask) { 662 if (protocolmask & SSL_CBP_SSL3) { 663 isTLS = PR_FALSE; 664 protocolmask ^= SSL_CBP_SSL3; 665 } else { 666 isTLS = PR_TRUE; 667 protocolmask ^= SSL_CBP_TLS1_0; 668 } 669 670 if (privKeytype == rsaKey && testrsa_export) { 671 if (PK11_GetPrivateModulusLen(srvPrivkey) > EXPORT_RSA_KEY_LENGTH) { 672 *pcanbypass = PR_FALSE; 673 rv = SECSuccess; 674 break; 675 } else 676 testrsa = PR_TRUE; 677 } 678 for (; privKeytype == rsaKey && testrsa; ) { 679 /* TLS_RSA */ 680 unsigned char rsaPmsBuf[SSL3_RSA_PMS_LENGTH]; 681 unsigned int outLen = 0; 682 CK_MECHANISM_TYPE target; 683 SECStatus irv; 684 685 mechanism_array[0] = CKM_SSL3_PRE_MASTER_KEY_GEN; 686 mechanism_array[1] = CKM_RSA_PKCS; 687 688 slot = PK11_GetBestSlotMultiple(mechanism_array, 2, pwArg); 689 if (slot == NULL) { 690 PORT_SetError(SSL_ERROR_TOKEN_SLOT_NOT_FOUND); 691 break; 692 } 693 694 /* Generate the pre-master secret ... (client side) */ 695 version.major = 3 /*MSB(clientHelloVersion)*/; 696 version.minor = 0 /*LSB(clientHelloVersion)*/; 697 param.data = (unsigned char *)&version; 698 param.len = sizeof version; 699 pms = PK11_KeyGen(slot, CKM_SSL3_PRE_MASTER_KEY_GEN, ¶m, 0, pwArg); 700 PK11_FreeSlot(slot); 701 if (!pms) 702 break; 703 /* now wrap it */ 704 enc_pms.len = SECKEY_PublicKeyStrength(srvPubkey); 705 enc_pms.data = (unsigned char*)PORT_Alloc(enc_pms.len); 706 irv = PK11_PubWrapSymKey(CKM_RSA_PKCS, srvPubkey, pms, &enc_pms); 707 if (irv != SECSuccess) 708 break; 709 PK11_FreeSymKey(pms); 710 /* now do the server side--check the triple bypass first */ 711 rv = PK11_PrivDecryptPKCS1(srvPrivkey, rsaPmsBuf, &outLen, 712 sizeof rsaPmsBuf, 713 (unsigned char *)enc_pms.data, 714 enc_pms.len); 715 /* if decrypt worked we're done with the RSA test */ 716 if (rv == SECSuccess) { 717 *pcanbypass = PR_TRUE; 718 break; 719 } 720 /* check for fallback to double bypass */ 721 target = isTLS ? CKM_TLS_MASTER_KEY_DERIVE 722 : CKM_SSL3_MASTER_KEY_DERIVE; 723 pms = PK11_PubUnwrapSymKey(srvPrivkey, &enc_pms, 724 target, CKA_DERIVE, 0); 725 rv = ssl_canExtractMS(pms, isTLS, PR_FALSE, pcanbypass); 726 if (rv == SECSuccess && *pcanbypass == PR_FALSE) 727 goto done; 728 break; 729 } 730 #ifdef NSS_ENABLE_ECC 731 for (; (privKeytype == ecKey && ( testecdh || testecdhe)) || 732 (privKeytype == rsaKey && testecdhe); ) { 733 CK_MECHANISM_TYPE target; 734 SECKEYPublicKey *keapub = NULL; 735 SECKEYPrivateKey *keapriv; 736 SECKEYPublicKey *cpub = NULL; /* client's ephemeral ECDH keys */ 737 SECKEYPrivateKey *cpriv = NULL; 738 SECKEYECParams ecParams = { siBuffer, NULL, 0 }, 739 *pecParams; 740 741 if (privKeytype == ecKey && testecdhe) { 742 /* TLS_ECDHE_ECDSA */ 743 pecParams = &srvPubkey->u.ec.DEREncodedParams; 744 } else if (privKeytype == rsaKey && testecdhe) { 745 /* TLS_ECDHE_RSA */ 746 ECName ec_curve; 747 int serverKeyStrengthInBits; 748 int signatureKeyStrength; 749 int requiredECCbits; 750 751 /* find a curve of equivalent strength to the RSA key's */ 752 requiredECCbits = PK11_GetPrivateModulusLen(srvPrivkey); 753 if (requiredECCbits < 0) 754 break; 755 requiredECCbits *= BPB; 756 serverKeyStrengthInBits = srvPubkey->u.rsa.modulus.len; 757 if (srvPubkey->u.rsa.modulus.data[0] == 0) { 758 serverKeyStrengthInBits--; 759 } 760 /* convert to strength in bits */ 761 serverKeyStrengthInBits *= BPB; 762 763 signatureKeyStrength = 764 SSL_RSASTRENGTH_TO_ECSTRENGTH(serverKeyStrengthInBits); 765 766 if ( requiredECCbits > signatureKeyStrength ) 767 requiredECCbits = signatureKeyStrength; 768 769 ec_curve = 770 ssl3_GetCurveWithECKeyStrength(SSL3_SUPPORTED_CURVES_MASK, 771 requiredECCbits); 772 rv = ssl3_ECName2Params(NULL, ec_curve, &ecParams); 773 if (rv == SECFailure) { 774 break; 775 } 776 pecParams = &ecParams; 777 } 778 779 if (testecdhe) { 780 /* generate server's ephemeral keys */ 781 keapriv = SECKEY_CreateECPrivateKey(pecParams, &keapub, NULL); 782 if (!keapriv || !keapub) { 783 if (keapriv) 784 SECKEY_DestroyPrivateKey(keapriv); 785 if (keapub) 786 SECKEY_DestroyPublicKey(keapub); 787 PORT_SetError(SEC_ERROR_KEYGEN_FAIL); 788 rv = SECFailure; 789 break; 790 } 791 } else { 792 /* TLS_ECDH_ECDSA */ 793 keapub = srvPubkey; 794 keapriv = srvPrivkey; 795 pecParams = &srvPubkey->u.ec.DEREncodedParams; 796 } 797 798 /* perform client side ops */ 799 /* generate a pair of ephemeral keys using server's parms */ 800 cpriv = SECKEY_CreateECPrivateKey(pecParams, &cpub, NULL); 801 if (!cpriv || !cpub) { 802 if (testecdhe) { 803 SECKEY_DestroyPrivateKey(keapriv); 804 SECKEY_DestroyPublicKey(keapub); 805 } 806 PORT_SetError(SEC_ERROR_KEYGEN_FAIL); 807 rv = SECFailure; 808 break; 809 } 810 /* now do the server side */ 811 /* determine the PMS using client's public value */ 812 target = isTLS ? CKM_TLS_MASTER_KEY_DERIVE_DH 813 : CKM_SSL3_MASTER_KEY_DERIVE_DH; 814 pms = PK11_PubDeriveWithKDF(keapriv, cpub, PR_FALSE, NULL, NULL, 815 CKM_ECDH1_DERIVE, 816 target, 817 CKA_DERIVE, 0, CKD_NULL, NULL, NULL); 818 rv = ssl_canExtractMS(pms, isTLS, PR_TRUE, pcanbypass); 819 SECKEY_DestroyPrivateKey(cpriv); 820 SECKEY_DestroyPublicKey(cpub); 821 if (testecdhe) { 822 SECKEY_DestroyPrivateKey(keapriv); 823 SECKEY_DestroyPublicKey(keapub); 824 if (privKeytype == rsaKey) 825 PORT_Free(ecParams.data); 826 } 827 if (rv == SECSuccess && *pcanbypass == PR_FALSE) 828 goto done; 829 break; 830 } 831 #endif /* NSS_ENABLE_ECC */ 832 if (pms) 833 PK11_FreeSymKey(pms); 834 } 835 836 /* *pcanbypass has been set */ 837 rv = SECSuccess; 838 839 done: 840 if (pms) 841 PK11_FreeSymKey(pms); 842 843 SECITEM_FreeItem(&enc_pms, PR_FALSE); 844 845 if (srvPubkey) { 846 SECKEY_DestroyPublicKey(srvPubkey); 847 srvPubkey = NULL; 848 } 849 850 851 return rv; 852 } 853 854
