1 // Copyright 2010 The Go Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style
3 // license that can be found in the LICENSE file.
17 var errClientKeyExchange = errors.New("tls: invalid ClientKeyExchange message")
18 var errServerKeyExchange = errors.New("tls: invalid ServerKeyExchange message")
20 // rsaKeyAgreement implements the standard TLS key agreement where the client
21 // encrypts the pre-master secret to the server's public key.
22 type rsaKeyAgreement struct{}
24 func (ka rsaKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) {
28 func (ka rsaKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) {
29 if len(ckx.ciphertext) < 2 {
30 return nil, errClientKeyExchange
33 ciphertext := ckx.ciphertext
34 if version != VersionSSL30 {
35 ciphertextLen := int(ckx.ciphertext[0])<<8 | int(ckx.ciphertext[1])
36 if ciphertextLen != len(ckx.ciphertext)-2 {
37 return nil, errClientKeyExchange
39 ciphertext = ckx.ciphertext[2:]
41 priv, ok := cert.PrivateKey.(crypto.Decrypter)
43 return nil, errors.New("tls: certificate private key does not implement crypto.Decrypter")
45 // Perform constant time RSA PKCS#1 v1.5 decryption
46 preMasterSecret, err := priv.Decrypt(config.rand(), ciphertext, &rsa.PKCS1v15DecryptOptions{SessionKeyLen: 48})
50 // We don't check the version number in the premaster secret. For one,
51 // by checking it, we would leak information about the validity of the
52 // encrypted pre-master secret. Secondly, it provides only a small
53 // benefit against a downgrade attack and some implementations send the
54 // wrong version anyway. See the discussion at the end of section
55 // 7.4.7.1 of RFC 4346.
56 return preMasterSecret, nil
59 func (ka rsaKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error {
60 return errors.New("tls: unexpected ServerKeyExchange")
63 func (ka rsaKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) {
64 preMasterSecret := make([]byte, 48)
65 preMasterSecret[0] = byte(clientHello.vers >> 8)
66 preMasterSecret[1] = byte(clientHello.vers)
67 _, err := io.ReadFull(config.rand(), preMasterSecret[2:])
72 encrypted, err := rsa.EncryptPKCS1v15(config.rand(), cert.PublicKey.(*rsa.PublicKey), preMasterSecret)
76 ckx := new(clientKeyExchangeMsg)
77 ckx.ciphertext = make([]byte, len(encrypted)+2)
78 ckx.ciphertext[0] = byte(len(encrypted) >> 8)
79 ckx.ciphertext[1] = byte(len(encrypted))
80 copy(ckx.ciphertext[2:], encrypted)
81 return preMasterSecret, ckx, nil
84 // sha1Hash calculates a SHA1 hash over the given byte slices.
85 func sha1Hash(slices [][]byte) []byte {
87 for _, slice := range slices {
93 // md5SHA1Hash implements TLS 1.0's hybrid hash function which consists of the
94 // concatenation of an MD5 and SHA1 hash.
95 func md5SHA1Hash(slices [][]byte) []byte {
96 md5sha1 := make([]byte, md5.Size+sha1.Size)
98 for _, slice := range slices {
101 copy(md5sha1, hmd5.Sum(nil))
102 copy(md5sha1[md5.Size:], sha1Hash(slices))
106 // hashForServerKeyExchange hashes the given slices and returns their digest
107 // using the given hash function (for >= TLS 1.2) or using a default based on
108 // the sigType (for earlier TLS versions). For Ed25519 signatures, which don't
109 // do pre-hashing, it returns the concatenation of the slices.
110 func hashForServerKeyExchange(sigType uint8, hashFunc crypto.Hash, version uint16, slices ...[]byte) []byte {
111 if sigType == signatureEd25519 {
113 for _, slice := range slices {
114 signed = append(signed, slice...)
118 if version >= VersionTLS12 {
120 for _, slice := range slices {
126 if sigType == signatureECDSA {
127 return sha1Hash(slices)
129 return md5SHA1Hash(slices)
132 // ecdheKeyAgreement implements a TLS key agreement where the server
133 // generates an ephemeral EC public/private key pair and signs it. The
134 // pre-master secret is then calculated using ECDH. The signature may
135 // be ECDSA, Ed25519 or RSA.
136 type ecdheKeyAgreement struct {
139 params ecdheParameters
141 // ckx and preMasterSecret are generated in processServerKeyExchange
142 // and returned in generateClientKeyExchange.
143 ckx *clientKeyExchangeMsg
144 preMasterSecret []byte
147 func (ka *ecdheKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg) (*serverKeyExchangeMsg, error) {
148 preferredCurves := config.curvePreferences()
152 for _, candidate := range preferredCurves {
153 for _, c := range clientHello.supportedCurves {
162 return nil, errors.New("tls: no supported elliptic curves offered")
164 if _, ok := curveForCurveID(curveID); curveID != X25519 && !ok {
165 return nil, errors.New("tls: CurvePreferences includes unsupported curve")
168 params, err := generateECDHEParameters(config.rand(), curveID)
174 // See RFC 4492, Section 5.4.
175 ecdhePublic := params.PublicKey()
176 serverECDHParams := make([]byte, 1+2+1+len(ecdhePublic))
177 serverECDHParams[0] = 3 // named curve
178 serverECDHParams[1] = byte(curveID >> 8)
179 serverECDHParams[2] = byte(curveID)
180 serverECDHParams[3] = byte(len(ecdhePublic))
181 copy(serverECDHParams[4:], ecdhePublic)
183 priv, ok := cert.PrivateKey.(crypto.Signer)
185 return nil, errors.New("tls: certificate private key does not implement crypto.Signer")
188 signatureAlgorithm, sigType, hashFunc, err := pickSignatureAlgorithm(priv.Public(), clientHello.supportedSignatureAlgorithms, supportedSignatureAlgorithmsTLS12, ka.version)
192 if (sigType == signaturePKCS1v15 || sigType == signatureRSAPSS) != ka.isRSA {
193 return nil, errors.New("tls: certificate cannot be used with the selected cipher suite")
196 signed := hashForServerKeyExchange(sigType, hashFunc, ka.version, clientHello.random, hello.random, serverECDHParams)
198 signOpts := crypto.SignerOpts(hashFunc)
199 if sigType == signatureRSAPSS {
200 signOpts = &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash, Hash: hashFunc}
202 sig, err := priv.Sign(config.rand(), signed, signOpts)
204 return nil, errors.New("tls: failed to sign ECDHE parameters: " + err.Error())
207 skx := new(serverKeyExchangeMsg)
209 if ka.version >= VersionTLS12 {
212 skx.key = make([]byte, len(serverECDHParams)+sigAndHashLen+2+len(sig))
213 copy(skx.key, serverECDHParams)
214 k := skx.key[len(serverECDHParams):]
215 if ka.version >= VersionTLS12 {
216 k[0] = byte(signatureAlgorithm >> 8)
217 k[1] = byte(signatureAlgorithm)
220 k[0] = byte(len(sig) >> 8)
221 k[1] = byte(len(sig))
227 func (ka *ecdheKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) {
228 if len(ckx.ciphertext) == 0 || int(ckx.ciphertext[0]) != len(ckx.ciphertext)-1 {
229 return nil, errClientKeyExchange
232 preMasterSecret := ka.params.SharedKey(ckx.ciphertext[1:])
233 if preMasterSecret == nil {
234 return nil, errClientKeyExchange
237 return preMasterSecret, nil
240 func (ka *ecdheKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error {
241 if len(skx.key) < 4 {
242 return errServerKeyExchange
244 if skx.key[0] != 3 { // named curve
245 return errors.New("tls: server selected unsupported curve")
247 curveID := CurveID(skx.key[1])<<8 | CurveID(skx.key[2])
249 publicLen := int(skx.key[3])
250 if publicLen+4 > len(skx.key) {
251 return errServerKeyExchange
253 serverECDHParams := skx.key[:4+publicLen]
254 publicKey := serverECDHParams[4:]
256 sig := skx.key[4+publicLen:]
258 return errServerKeyExchange
261 if _, ok := curveForCurveID(curveID); curveID != X25519 && !ok {
262 return errors.New("tls: server selected unsupported curve")
265 params, err := generateECDHEParameters(config.rand(), curveID)
271 ka.preMasterSecret = params.SharedKey(publicKey)
272 if ka.preMasterSecret == nil {
273 return errServerKeyExchange
276 ourPublicKey := params.PublicKey()
277 ka.ckx = new(clientKeyExchangeMsg)
278 ka.ckx.ciphertext = make([]byte, 1+len(ourPublicKey))
279 ka.ckx.ciphertext[0] = byte(len(ourPublicKey))
280 copy(ka.ckx.ciphertext[1:], ourPublicKey)
282 var signatureAlgorithm SignatureScheme
283 if ka.version >= VersionTLS12 {
284 // handle SignatureAndHashAlgorithm
285 signatureAlgorithm = SignatureScheme(sig[0])<<8 | SignatureScheme(sig[1])
288 return errServerKeyExchange
291 _, sigType, hashFunc, err := pickSignatureAlgorithm(cert.PublicKey, []SignatureScheme{signatureAlgorithm}, clientHello.supportedSignatureAlgorithms, ka.version)
295 if (sigType == signaturePKCS1v15 || sigType == signatureRSAPSS) != ka.isRSA {
296 return errServerKeyExchange
299 sigLen := int(sig[0])<<8 | int(sig[1])
300 if sigLen+2 != len(sig) {
301 return errServerKeyExchange
305 signed := hashForServerKeyExchange(sigType, hashFunc, ka.version, clientHello.random, serverHello.random, serverECDHParams)
306 return verifyHandshakeSignature(sigType, cert.PublicKey, hashFunc, signed, sig)
309 func (ka *ecdheKeyAgreement) generateClientKeyExchange(config *Config, clientHello *clientHelloMsg, cert *x509.Certificate) ([]byte, *clientKeyExchangeMsg, error) {
311 return nil, nil, errors.New("tls: missing ServerKeyExchange message")
314 return ka.preMasterSecret, ka.ckx, nil