yuzu-emu/mbedtls
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Translate from mbedtls_md_type_t to psa_algorithm_t

Browse source 
Do the translation as early as possible from mbedtls_md_type_t to psa_algorithm_t.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
This commit is contained in:
Gabor Mezei 2022-03-26 17:04:19 +01:00
parent 5d9a1fe9e9
commit 07732f7015
No known key found for this signature in database
GPG key ID: 106F5A41ECC305BD
4 changed files with 285 additions and 239 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

282
library/ssl_tls13_keys.c
View file

@ -311,7 +311,7 @@ cleanup:
} }
int mbedtls_ssl_tls13_hkdf_expand_label( int mbedtls_ssl_tls13_hkdf_expand_label(
mbedtls_md_type_t hash_alg, psa_algorithm_t hash_alg,
const unsigned char *secret, size_t secret_len, const unsigned char *secret, size_t secret_len,
const unsigned char *label, size_t label_len, const unsigned char *label, size_t label_len,
const unsigned char *ctx, size_t ctx_len, const unsigned char *ctx, size_t ctx_len,
@ -320,8 +320,6 @@ int mbedtls_ssl_tls13_hkdf_expand_label(
unsigned char hkdf_label[ SSL_TLS1_3_KEY_SCHEDULE_MAX_HKDF_LABEL_LEN ]; unsigned char hkdf_label[ SSL_TLS1_3_KEY_SCHEDULE_MAX_HKDF_LABEL_LEN ];
size_t hkdf_label_len; size_t hkdf_label_len;
psa_algorithm_t alg;
if( label_len > MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_LABEL_LEN ) if( label_len > MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_LABEL_LEN )
{ {
/* Should never happen since this is an internal /* Should never happen since this is an internal
@ -342,12 +340,9 @@ int mbedtls_ssl_tls13_hkdf_expand_label(
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
} }
alg = mbedtls_psa_translate_md( hash_alg ); if( ! PSA_ALG_IS_HASH( hash_alg ) )
if( ! PSA_ALG_IS_HASH( alg ) )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
alg = PSA_ALG_HMAC( alg );
ssl_tls13_hkdf_encode_label( buf_len, ssl_tls13_hkdf_encode_label( buf_len,
label, label_len, label, label_len,
ctx, ctx_len, ctx, ctx_len,
@ -355,7 +350,7 @@ int mbedtls_ssl_tls13_hkdf_expand_label(
&hkdf_label_len ); &hkdf_label_len );
return( psa_ssl_status_to_mbedtls( return( psa_ssl_status_to_mbedtls(
mbedtls_psa_hkdf_expand( alg, mbedtls_psa_hkdf_expand( PSA_ALG_HMAC( hash_alg ),
secret, secret_len, secret, secret_len,
hkdf_label, hkdf_label_len, hkdf_label, hkdf_label_len,
buf, buf_len ) ) ); buf, buf_len ) ) );
@ -378,7 +373,7 @@ int mbedtls_ssl_tls13_hkdf_expand_label(
* keys in a single function call. * keys in a single function call.
*/ */
int mbedtls_ssl_tls13_make_traffic_keys( int mbedtls_ssl_tls13_make_traffic_keys(
mbedtls_md_type_t hash_alg, psa_algorithm_t hash_alg,
const unsigned char *client_secret, const unsigned char *client_secret,
const unsigned char *server_secret, size_t secret_len, const unsigned char *server_secret, size_t secret_len,
size_t key_len, size_t iv_len, size_t key_len, size_t iv_len,
@ -425,7 +420,7 @@ int mbedtls_ssl_tls13_make_traffic_keys(
} }
int mbedtls_ssl_tls13_derive_secret( int mbedtls_ssl_tls13_derive_secret(
mbedtls_md_type_t hash_alg, psa_algorithm_t hash_alg,
const unsigned char *secret, size_t secret_len, const unsigned char *secret, size_t secret_len,
const unsigned char *label, size_t label_len, const unsigned char *label, size_t label_len,
const unsigned char *ctx, size_t ctx_len, const unsigned char *ctx, size_t ctx_len,
@ -433,19 +428,30 @@ int mbedtls_ssl_tls13_derive_secret(
unsigned char *dstbuf, size_t dstbuf_len ) unsigned char *dstbuf, size_t dstbuf_len )
{ {
int ret; int ret;
unsigned char hashed_context[ MBEDTLS_MD_MAX_SIZE ]; unsigned char hashed_context[ PSA_HASH_MAX_SIZE ];
/*
const mbedtls_md_info_t *md_info; const mbedtls_md_info_t *md_info;
md_info = mbedtls_md_info_from_type( hash_alg ); md_info = mbedtls_md_info_from_type( hash_alg );
if( md_info == NULL ) if( md_info == NULL )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
*/
if( ctx_hashed == MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED ) if( ctx_hashed == MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED )
{ {
/*
ret = mbedtls_md( md_info, ctx, ctx_len, hashed_context ); ret = mbedtls_md( md_info, ctx, ctx_len, hashed_context );
if( ret != 0 ) if( ret != 0 )
return( ret ); return( ret );
ctx_len = mbedtls_md_get_size( md_info ); ctx_len = mbedtls_md_get_size( md_info );
*/
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
status = psa_hash_compute( hash_alg, ctx, ctx_len, hashed_context,
PSA_HASH_LENGTH( hash_alg ), &ctx_len );
if( status != PSA_SUCCESS )
{
ret = psa_ssl_status_to_mbedtls( status );
return ret;
}
} }
else else
{ {
@ -466,26 +472,25 @@ int mbedtls_ssl_tls13_derive_secret(
label, label_len, label, label_len,
hashed_context, ctx_len, hashed_context, ctx_len,
dstbuf, dstbuf_len ) ); dstbuf, dstbuf_len ) );
} }
int mbedtls_ssl_tls13_evolve_secret( int mbedtls_ssl_tls13_evolve_secret(
mbedtls_md_type_t hash_alg, psa_algorithm_t hash_alg,
const unsigned char *secret_old, const unsigned char *secret_old,
const unsigned char *input, size_t input_len, const unsigned char *input, size_t input_len,
unsigned char *secret_new ) unsigned char *secret_new )
{ {
int ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; int ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
size_t hlen, ilen; size_t hlen, ilen;
unsigned char tmp_secret[ MBEDTLS_MD_MAX_SIZE ] = { 0 }; unsigned char tmp_secret[ PSA_MAC_MAX_SIZE ] = { 0 };
unsigned char tmp_input [ MBEDTLS_ECP_MAX_BYTES ] = { 0 }; unsigned char tmp_input [ MBEDTLS_ECP_MAX_BYTES ] = { 0 };
size_t secret_len; size_t secret_len;
psa_algorithm_t alg = mbedtls_psa_translate_md( hash_alg );
if( ! PSA_ALG_IS_HASH( alg ) ) if( ! PSA_ALG_IS_HASH( hash_alg ) )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
alg = PSA_ALG_HMAC( alg ); hlen = PSA_HASH_LENGTH( hash_alg );
hlen = PSA_HASH_LENGTH( alg );
/* For non-initial runs, call Derive-Secret( ., "derived", "") /* For non-initial runs, call Derive-Secret( ., "derived", "")
* on the old secret. */ * on the old secret. */
@ -516,7 +521,7 @@ int mbedtls_ssl_tls13_evolve_secret(
* The salt is the old secret, and the input key material * The salt is the old secret, and the input key material
* is the input secret (PSK / ECDHE). */ * is the input secret (PSK / ECDHE). */
ret = psa_ssl_status_to_mbedtls( ret = psa_ssl_status_to_mbedtls(
mbedtls_psa_hkdf_extract( alg, mbedtls_psa_hkdf_extract( PSA_ALG_HMAC( hash_alg ),
tmp_secret, hlen, tmp_secret, hlen,
tmp_input, ilen, tmp_input, ilen,
secret_new, hlen, &secret_len ) ); secret_new, hlen, &secret_len ) );
@ -529,18 +534,17 @@ int mbedtls_ssl_tls13_evolve_secret(
} }
int mbedtls_ssl_tls13_derive_early_secrets( int mbedtls_ssl_tls13_derive_early_secrets(
mbedtls_md_type_t md_type, psa_algorithm_t hash_alg,
unsigned char const *early_secret, unsigned char const *early_secret,
unsigned char const *transcript, size_t transcript_len, unsigned char const *transcript, size_t transcript_len,
mbedtls_ssl_tls13_early_secrets *derived ) mbedtls_ssl_tls13_early_secrets *derived )
{ {
int ret; int ret;
mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); size_t const hash_len = PSA_HASH_LENGTH( hash_alg );
size_t const md_size = mbedtls_md_get_size( md_info );
/* We should never call this function with an unknown hash, /* We should never call this function with an unknown hash,
* but add an assertion anyway. */ * but add an assertion anyway. */
if( md_info == 0 ) if( ! PSA_ALG_IS_HASH( hash_alg ) )
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
/* /*
@ -558,24 +562,24 @@ int mbedtls_ssl_tls13_derive_early_secrets(
*/ */
/* Create client_early_traffic_secret */ /* Create client_early_traffic_secret */
ret = mbedtls_ssl_tls13_derive_secret( md_type, ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
early_secret, md_size, early_secret, hash_len,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( c_e_traffic ), MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( c_e_traffic ),
transcript, transcript_len, transcript, transcript_len,
MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
derived->client_early_traffic_secret, derived->client_early_traffic_secret,
md_size ); hash_len );
if( ret != 0 ) if( ret != 0 )
return( ret ); return( ret );
/* Create early exporter */ /* Create early exporter */
ret = mbedtls_ssl_tls13_derive_secret( md_type, ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
early_secret, md_size, early_secret, hash_len,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( e_exp_master ), MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( e_exp_master ),
transcript, transcript_len, transcript, transcript_len,
MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
derived->early_exporter_master_secret, derived->early_exporter_master_secret,
md_size ); hash_len );
if( ret != 0 ) if( ret != 0 )
return( ret ); return( ret );
@ -583,18 +587,17 @@ int mbedtls_ssl_tls13_derive_early_secrets(
} }
int mbedtls_ssl_tls13_derive_handshake_secrets( int mbedtls_ssl_tls13_derive_handshake_secrets(
mbedtls_md_type_t md_type, psa_algorithm_t hash_alg,
unsigned char const *handshake_secret, unsigned char const *handshake_secret,
unsigned char const *transcript, size_t transcript_len, unsigned char const *transcript, size_t transcript_len,
mbedtls_ssl_tls13_handshake_secrets *derived ) mbedtls_ssl_tls13_handshake_secrets *derived )
{ {
int ret; int ret;
mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); size_t const hash_len = PSA_HASH_LENGTH( hash_alg );
size_t const md_size = mbedtls_md_get_size( md_info );
/* We should never call this function with an unknown hash, /* We should never call this function with an unknown hash,
* but add an assertion anyway. */ * but add an assertion anyway. */
if( md_info == 0 ) if( ! PSA_ALG_IS_HASH( hash_alg ) )
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
/* /*
@ -616,13 +619,13 @@ int mbedtls_ssl_tls13_derive_handshake_secrets(
* Derive-Secret( ., "c hs traffic", ClientHello...ServerHello ) * Derive-Secret( ., "c hs traffic", ClientHello...ServerHello )
*/ */
ret = mbedtls_ssl_tls13_derive_secret( md_type, ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
handshake_secret, md_size, handshake_secret, hash_len,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( c_hs_traffic ), MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( c_hs_traffic ),
transcript, transcript_len, transcript, transcript_len,
MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
derived->client_handshake_traffic_secret, derived->client_handshake_traffic_secret,
md_size ); hash_len );
if( ret != 0 ) if( ret != 0 )
return( ret ); return( ret );
@ -631,13 +634,13 @@ int mbedtls_ssl_tls13_derive_handshake_secrets(
* Derive-Secret( ., "s hs traffic", ClientHello...ServerHello ) * Derive-Secret( ., "s hs traffic", ClientHello...ServerHello )
*/ */
ret = mbedtls_ssl_tls13_derive_secret( md_type, ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
handshake_secret, md_size, handshake_secret, hash_len,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( s_hs_traffic ), MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( s_hs_traffic ),
transcript, transcript_len, transcript, transcript_len,
MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
derived->server_handshake_traffic_secret, derived->server_handshake_traffic_secret,
md_size ); hash_len );
if( ret != 0 ) if( ret != 0 )
return( ret ); return( ret );
@ -645,18 +648,17 @@ int mbedtls_ssl_tls13_derive_handshake_secrets(
} }
int mbedtls_ssl_tls13_derive_application_secrets( int mbedtls_ssl_tls13_derive_application_secrets(
mbedtls_md_type_t md_type, psa_algorithm_t hash_alg,
unsigned char const *application_secret, unsigned char const *application_secret,
unsigned char const *transcript, size_t transcript_len, unsigned char const *transcript, size_t transcript_len,
mbedtls_ssl_tls13_application_secrets *derived ) mbedtls_ssl_tls13_application_secrets *derived )
{ {
int ret; int ret;
mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); size_t const hash_len = PSA_HASH_LENGTH( hash_alg );
size_t const md_size = mbedtls_md_get_size( md_info );
/* We should never call this function with an unknown hash, /* We should never call this function with an unknown hash,
* but add an assertion anyway. */ * but add an assertion anyway. */
if( md_info == 0 ) if( ! PSA_ALG_IS_HASH( hash_alg ) )
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
/* Generate {client,server}_application_traffic_secret_0 /* Generate {client,server}_application_traffic_secret_0
@ -677,33 +679,33 @@ int mbedtls_ssl_tls13_derive_application_secrets(
* *
*/ */
ret = mbedtls_ssl_tls13_derive_secret( md_type, ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
application_secret, md_size, application_secret, hash_len,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( c_ap_traffic ), MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( c_ap_traffic ),
transcript, transcript_len, transcript, transcript_len,
MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
derived->client_application_traffic_secret_N, derived->client_application_traffic_secret_N,
md_size ); hash_len );
if( ret != 0 ) if( ret != 0 )
return( ret ); return( ret );
ret = mbedtls_ssl_tls13_derive_secret( md_type, ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
application_secret, md_size, application_secret, hash_len,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( s_ap_traffic ), MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( s_ap_traffic ),
transcript, transcript_len, transcript, transcript_len,
MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
derived->server_application_traffic_secret_N, derived->server_application_traffic_secret_N,
md_size ); hash_len );
if( ret != 0 ) if( ret != 0 )
return( ret ); return( ret );
ret = mbedtls_ssl_tls13_derive_secret( md_type, ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
application_secret, md_size, application_secret, hash_len,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( exp_master ), MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( exp_master ),
transcript, transcript_len, transcript, transcript_len,
MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
derived->exporter_master_secret, derived->exporter_master_secret,
md_size ); hash_len );
if( ret != 0 ) if( ret != 0 )
return( ret ); return( ret );
@ -715,27 +717,26 @@ int mbedtls_ssl_tls13_derive_application_secrets(
* This is not integrated with mbedtls_ssl_tls13_derive_application_secrets() * This is not integrated with mbedtls_ssl_tls13_derive_application_secrets()
* because it uses the transcript hash up to and including ClientFinished. */ * because it uses the transcript hash up to and including ClientFinished. */
int mbedtls_ssl_tls13_derive_resumption_master_secret( int mbedtls_ssl_tls13_derive_resumption_master_secret(
mbedtls_md_type_t md_type, psa_algorithm_t hash_alg,
unsigned char const *application_secret, unsigned char const *application_secret,
unsigned char const *transcript, size_t transcript_len, unsigned char const *transcript, size_t transcript_len,
mbedtls_ssl_tls13_application_secrets *derived ) mbedtls_ssl_tls13_application_secrets *derived )
{ {
int ret; int ret;
mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); size_t const hash_len = PSA_HASH_LENGTH( hash_alg );
size_t const md_size = mbedtls_md_get_size( md_info );
/* We should never call this function with an unknown hash, /* We should never call this function with an unknown hash,
* but add an assertion anyway. */ * but add an assertion anyway. */
if( md_info == 0 ) if( ! PSA_ALG_IS_HASH( hash_alg ) )
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
ret = mbedtls_ssl_tls13_derive_secret( md_type, ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
application_secret, md_size, application_secret, hash_len,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( res_master ), MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( res_master ),
transcript, transcript_len, transcript, transcript_len,
MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
derived->resumption_master_secret, derived->resumption_master_secret,
md_size ); hash_len );
if( ret != 0 ) if( ret != 0 )
return( ret ); return( ret );
@ -747,16 +748,13 @@ int mbedtls_ssl_tls13_key_schedule_stage_application( mbedtls_ssl_context *ssl )
{ {
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
mbedtls_ssl_handshake_params *handshake = ssl->handshake; mbedtls_ssl_handshake_params *handshake = ssl->handshake;
mbedtls_md_type_t const md_type = handshake->ciphersuite_info->mac; psa_algorithm_t const hash_alg = mbedtls_psa_translate_md(
#if defined(MBEDTLS_DEBUG_C) handshake->ciphersuite_info->mac );
mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
size_t const md_size = mbedtls_md_get_size( md_info );
#endif /* MBEDTLS_DEBUG_C */
/* /*
* Compute MasterSecret * Compute MasterSecret
*/ */
ret = mbedtls_ssl_tls13_evolve_secret( md_type, ret = mbedtls_ssl_tls13_evolve_secret( hash_alg,
handshake->tls13_master_secrets.handshake, handshake->tls13_master_secrets.handshake,
NULL, 0, NULL, 0,
handshake->tls13_master_secrets.app ); handshake->tls13_master_secrets.app );
@ -767,24 +765,28 @@ int mbedtls_ssl_tls13_key_schedule_stage_application( mbedtls_ssl_context *ssl )
} }
MBEDTLS_SSL_DEBUG_BUF( 4, "Master secret", MBEDTLS_SSL_DEBUG_BUF( 4, "Master secret",
handshake->tls13_master_secrets.app, md_size ); handshake->tls13_master_secrets.app, PSA_HASH_LENGTH( hash_alg ) );
return( 0 ); return( 0 );
} }
static int ssl_tls13_calc_finished_core( mbedtls_md_type_t md_type, static int ssl_tls13_calc_finished_core( psa_algorithm_t hash_alg,
unsigned char const *base_key, unsigned char const *base_key,
unsigned char const *transcript, unsigned char const *transcript,
unsigned char *dst ) unsigned char *dst,
size_t *dst_len )
{ {
const mbedtls_md_info_t* const md_info = mbedtls_md_info_from_type( md_type ); mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
size_t const md_size = mbedtls_md_get_size( md_info ); psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
unsigned char finished_key[MBEDTLS_MD_MAX_SIZE]; psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
size_t hash_len = PSA_HASH_LENGTH( hash_alg );
unsigned char finished_key[PSA_MAC_MAX_SIZE];
int ret; int ret;
psa_algorithm_t alg;
/* We should never call this function with an unknown hash, /* We should never call this function with an unknown hash,
* but add an assertion anyway. */ * but add an assertion anyway. */
if( md_info == 0 ) if( ! PSA_ALG_IS_HASH( hash_alg ) )
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
/* TLS 1.3 Finished message /* TLS 1.3 Finished message
@ -805,20 +807,37 @@ static int ssl_tls13_calc_finished_core( mbedtls_md_type_t md_type,
*/ */
ret = mbedtls_ssl_tls13_hkdf_expand_label( ret = mbedtls_ssl_tls13_hkdf_expand_label(
md_type, base_key, md_size, hash_alg, base_key, hash_len,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( finished ), MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( finished ),
NULL, 0, NULL, 0,
finished_key, md_size ); finished_key, hash_len );
if( ret != 0 ) if( ret != 0 )
goto exit; goto exit;
ret = mbedtls_md_hmac( md_info, finished_key, md_size, transcript, md_size, dst ); alg = PSA_ALG_HMAC( hash_alg );
if( ret != 0 ) psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_MESSAGE );
psa_set_key_algorithm( &attributes, alg );
psa_set_key_type( &attributes, PSA_KEY_TYPE_HMAC );
status = psa_import_key( &attributes, finished_key, hash_len, &key );
if( status != PSA_SUCCESS )
{
ret = psa_ssl_status_to_mbedtls( status );
goto exit; goto exit;
}
status = psa_mac_compute( key, alg, transcript, hash_len,
dst, hash_len, dst_len );
ret = psa_ssl_status_to_mbedtls( status );
exit: exit:
status = psa_destroy_key( key );
if( ret == 0 )
ret = psa_ssl_status_to_mbedtls( status );
mbedtls_platform_zeroize( finished_key, sizeof( finished_key ) ); mbedtls_platform_zeroize( finished_key, sizeof( finished_key ) );
return( ret ); return( ret );
} }
@ -839,9 +858,10 @@ int mbedtls_ssl_tls13_calculate_verify_data( mbedtls_ssl_context* ssl,
&ssl->handshake->tls13_hs_secrets; &ssl->handshake->tls13_hs_secrets;
mbedtls_md_type_t const md_type = ssl->handshake->ciphersuite_info->mac; mbedtls_md_type_t const md_type = ssl->handshake->ciphersuite_info->mac;
const mbedtls_md_info_t* const md_info =
mbedtls_md_info_from_type( md_type ); psa_algorithm_t hash_alg = mbedtls_psa_translate_md(
size_t const md_size = mbedtls_md_get_size( md_info ); ssl->handshake->ciphersuite_info->mac );
size_t const hash_lem = PSA_HASH_LENGTH( hash_alg );
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_tls13_calculate_verify_data" ) ); MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> mbedtls_ssl_tls13_calculate_verify_data" ) );
@ -856,7 +876,7 @@ int mbedtls_ssl_tls13_calculate_verify_data( mbedtls_ssl_context* ssl,
base_key_len = sizeof( tls13_hs_secrets->server_handshake_traffic_secret ); base_key_len = sizeof( tls13_hs_secrets->server_handshake_traffic_secret );
} }
if( dst_len < md_size ) if( dst_len < hash_lem )
{ {
ret = MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL; ret = MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
goto exit; goto exit;
@ -872,12 +892,11 @@ int mbedtls_ssl_tls13_calculate_verify_data( mbedtls_ssl_context* ssl,
} }
MBEDTLS_SSL_DEBUG_BUF( 4, "handshake hash", transcript, transcript_len ); MBEDTLS_SSL_DEBUG_BUF( 4, "handshake hash", transcript, transcript_len );
ret = ssl_tls13_calc_finished_core( md_type, base_key, transcript, dst ); ret = ssl_tls13_calc_finished_core( hash_alg, base_key, transcript, dst, actual_len );
if( ret != 0 ) if( ret != 0 )
goto exit; goto exit;
*actual_len = md_size;
MBEDTLS_SSL_DEBUG_BUF( 3, "verify_data for finished message", dst, md_size ); MBEDTLS_SSL_DEBUG_BUF( 3, "verify_data for finished message", dst, hash_lem );
MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_tls13_calculate_verify_data" ) ); MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_tls13_calculate_verify_data" ) );
exit: exit:
@ -888,7 +907,7 @@ exit:
} }
int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl, int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl,
const mbedtls_md_type_t md_type, const psa_algorithm_t hash_alg,
unsigned char const *psk, size_t psk_len, unsigned char const *psk, size_t psk_len,
int psk_type, int psk_type,
unsigned char const *transcript, unsigned char const *transcript,
@ -897,8 +916,8 @@ int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl,
int ret = 0; int ret = 0;
unsigned char binder_key[MBEDTLS_MD_MAX_SIZE]; unsigned char binder_key[MBEDTLS_MD_MAX_SIZE];
unsigned char early_secret[MBEDTLS_MD_MAX_SIZE]; unsigned char early_secret[MBEDTLS_MD_MAX_SIZE];
mbedtls_md_info_t const *md_info = mbedtls_md_info_from_type( md_type ); size_t const hash_len = PSA_HASH_LENGTH( hash_alg );
size_t const md_size = mbedtls_md_get_size( md_info ); size_t actual_len;
#if !defined(MBEDTLS_DEBUG_C) #if !defined(MBEDTLS_DEBUG_C)
ssl = NULL; /* make sure we don't use it except for debug */ ssl = NULL; /* make sure we don't use it except for debug */
@ -907,7 +926,7 @@ int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl,
/* We should never call this function with an unknown hash, /* We should never call this function with an unknown hash,
* but add an assertion anyway. */ * but add an assertion anyway. */
if( md_info == 0 ) if( ! PSA_ALG_IS_HASH( hash_alg ) )
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
/* /*
@ -921,7 +940,7 @@ int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl,
* v * v
*/ */
ret = mbedtls_ssl_tls13_evolve_secret( md_type, ret = mbedtls_ssl_tls13_evolve_secret( hash_alg,
NULL, /* Old secret */ NULL, /* Old secret */
psk, psk_len, /* Input */ psk, psk_len, /* Input */
early_secret ); early_secret );
@ -933,20 +952,20 @@ int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl,
if( psk_type == MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION ) if( psk_type == MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION )
{ {
ret = mbedtls_ssl_tls13_derive_secret( md_type, ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
early_secret, md_size, early_secret, hash_len,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( res_binder ), MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( res_binder ),
NULL, 0, MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED, NULL, 0, MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED,
binder_key, md_size ); binder_key, hash_len );
MBEDTLS_SSL_DEBUG_MSG( 4, ( "Derive Early Secret with 'res binder'" ) ); MBEDTLS_SSL_DEBUG_MSG( 4, ( "Derive Early Secret with 'res binder'" ) );
} }
else else
{ {
ret = mbedtls_ssl_tls13_derive_secret( md_type, ret = mbedtls_ssl_tls13_derive_secret( hash_alg,
early_secret, md_size, early_secret, hash_len,
MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( ext_binder ), MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( ext_binder ),
NULL, 0, MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED, NULL, 0, MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED,
binder_key, md_size ); binder_key, hash_len );
MBEDTLS_SSL_DEBUG_MSG( 4, ( "Derive Early Secret with 'ext binder'" ) ); MBEDTLS_SSL_DEBUG_MSG( 4, ( "Derive Early Secret with 'ext binder'" ) );
} }
@ -961,11 +980,12 @@ int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl,
* but with the BaseKey being the binder_key. * but with the BaseKey being the binder_key.
*/ */
ret = ssl_tls13_calc_finished_core( md_type, binder_key, transcript, result ); ret = ssl_tls13_calc_finished_core( hash_alg, binder_key, transcript,
result, &actual_len );
if( ret != 0 ) if( ret != 0 )
goto exit; goto exit;
MBEDTLS_SSL_DEBUG_BUF( 3, "psk binder", result, md_size ); MBEDTLS_SSL_DEBUG_BUF( 3, "psk binder", result, actual_len );
exit: exit:
@ -1155,7 +1175,7 @@ int mbedtls_ssl_tls13_populate_transform( mbedtls_ssl_transform *transform,
int mbedtls_ssl_tls13_key_schedule_stage_early( mbedtls_ssl_context *ssl ) int mbedtls_ssl_tls13_key_schedule_stage_early( mbedtls_ssl_context *ssl )
{ {
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
mbedtls_md_type_t md_type; psa_algorithm_t hash_alg;
mbedtls_ssl_handshake_params *handshake = ssl->handshake; mbedtls_ssl_handshake_params *handshake = ssl->handshake;
if( handshake->ciphersuite_info == NULL ) if( handshake->ciphersuite_info == NULL )
@ -1164,9 +1184,9 @@ int mbedtls_ssl_tls13_key_schedule_stage_early( mbedtls_ssl_context *ssl )
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
} }
md_type = handshake->ciphersuite_info->mac; hash_alg = mbedtls_psa_translate_md( handshake->ciphersuite_info->mac );
ret = mbedtls_ssl_tls13_evolve_secret( md_type, NULL, NULL, 0, ret = mbedtls_ssl_tls13_evolve_secret( hash_alg, NULL, NULL, 0,
handshake->tls13_master_secrets.early ); handshake->tls13_master_secrets.early );
if( ret != 0 ) if( ret != 0 )
{ {
@ -1185,8 +1205,9 @@ int mbedtls_ssl_tls13_generate_handshake_keys( mbedtls_ssl_context *ssl,
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
mbedtls_md_type_t md_type; mbedtls_md_type_t md_type;
mbedtls_md_info_t const *md_info;
size_t md_size; psa_algorithm_t hash_alg;
size_t hash_len;
unsigned char transcript[MBEDTLS_TLS1_3_MD_MAX_SIZE]; unsigned char transcript[MBEDTLS_TLS1_3_MD_MAX_SIZE];
size_t transcript_len; size_t transcript_len;
@ -1205,8 +1226,9 @@ int mbedtls_ssl_tls13_generate_handshake_keys( mbedtls_ssl_context *ssl,
iv_len = cipher_info->iv_size; iv_len = cipher_info->iv_size;
md_type = ciphersuite_info->mac; md_type = ciphersuite_info->mac;
md_info = mbedtls_md_info_from_type( md_type );
md_size = mbedtls_md_get_size( md_info ); hash_alg = mbedtls_psa_translate_md( ciphersuite_info->mac );
hash_len = PSA_HASH_LENGTH( hash_alg );
ret = mbedtls_ssl_get_handshake_transcript( ssl, md_type, ret = mbedtls_ssl_get_handshake_transcript( ssl, md_type,
transcript, transcript,
@ -1220,7 +1242,7 @@ int mbedtls_ssl_tls13_generate_handshake_keys( mbedtls_ssl_context *ssl,
return( ret ); return( ret );
} }
ret = mbedtls_ssl_tls13_derive_handshake_secrets( md_type, ret = mbedtls_ssl_tls13_derive_handshake_secrets( hash_alg,
handshake->tls13_master_secrets.handshake, handshake->tls13_master_secrets.handshake,
transcript, transcript_len, tls13_hs_secrets ); transcript, transcript_len, tls13_hs_secrets );
if( ret != 0 ) if( ret != 0 )
@ -1232,10 +1254,10 @@ int mbedtls_ssl_tls13_generate_handshake_keys( mbedtls_ssl_context *ssl,
MBEDTLS_SSL_DEBUG_BUF( 4, "Client handshake traffic secret", MBEDTLS_SSL_DEBUG_BUF( 4, "Client handshake traffic secret",
tls13_hs_secrets->client_handshake_traffic_secret, tls13_hs_secrets->client_handshake_traffic_secret,
md_size ); hash_len );
MBEDTLS_SSL_DEBUG_BUF( 4, "Server handshake traffic secret", MBEDTLS_SSL_DEBUG_BUF( 4, "Server handshake traffic secret",
tls13_hs_secrets->server_handshake_traffic_secret, tls13_hs_secrets->server_handshake_traffic_secret,
md_size ); hash_len );
/* /*
* Export client handshake traffic secret * Export client handshake traffic secret
@ -1245,7 +1267,7 @@ int mbedtls_ssl_tls13_generate_handshake_keys( mbedtls_ssl_context *ssl,
ssl->f_export_keys( ssl->p_export_keys, ssl->f_export_keys( ssl->p_export_keys,
MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_HANDSHAKE_TRAFFIC_SECRET, MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_HANDSHAKE_TRAFFIC_SECRET,
tls13_hs_secrets->client_handshake_traffic_secret, tls13_hs_secrets->client_handshake_traffic_secret,
md_size, hash_len,
handshake->randbytes, handshake->randbytes,
handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN, handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN,
MBEDTLS_SSL_TLS_PRF_NONE /* TODO: FIX! */ ); MBEDTLS_SSL_TLS_PRF_NONE /* TODO: FIX! */ );
@ -1253,16 +1275,16 @@ int mbedtls_ssl_tls13_generate_handshake_keys( mbedtls_ssl_context *ssl,
ssl->f_export_keys( ssl->p_export_keys, ssl->f_export_keys( ssl->p_export_keys,
MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_HANDSHAKE_TRAFFIC_SECRET, MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_HANDSHAKE_TRAFFIC_SECRET,
tls13_hs_secrets->server_handshake_traffic_secret, tls13_hs_secrets->server_handshake_traffic_secret,
md_size, hash_len,
handshake->randbytes, handshake->randbytes,
handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN, handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN,
MBEDTLS_SSL_TLS_PRF_NONE /* TODO: FIX! */ ); MBEDTLS_SSL_TLS_PRF_NONE /* TODO: FIX! */ );
} }
ret = mbedtls_ssl_tls13_make_traffic_keys( md_type, ret = mbedtls_ssl_tls13_make_traffic_keys( hash_alg,
tls13_hs_secrets->client_handshake_traffic_secret, tls13_hs_secrets->client_handshake_traffic_secret,
tls13_hs_secrets->server_handshake_traffic_secret, tls13_hs_secrets->server_handshake_traffic_secret,
md_size, key_len, iv_len, traffic_keys ); hash_len, key_len, iv_len, traffic_keys );
if( ret != 0 ) if( ret != 0 )
{ {
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_make_traffic_keys", ret ); MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_make_traffic_keys", ret );
@ -1299,11 +1321,8 @@ int mbedtls_ssl_tls13_key_schedule_stage_handshake( mbedtls_ssl_context *ssl )
psa_status_t status = PSA_ERROR_GENERIC_ERROR; psa_status_t status = PSA_ERROR_GENERIC_ERROR;
#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED && MBEDTLS_ECDH_C */ #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED && MBEDTLS_ECDH_C */
mbedtls_ssl_handshake_params *handshake = ssl->handshake; mbedtls_ssl_handshake_params *handshake = ssl->handshake;
mbedtls_md_type_t const md_type = handshake->ciphersuite_info->mac; psa_algorithm_t const hash_alg = mbedtls_psa_translate_md(
#if defined(MBEDTLS_DEBUG_C) handshake->ciphersuite_info->mac );
mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
size_t const md_size = mbedtls_md_get_size( md_info );
#endif /* MBEDTLS_DEBUG_C */
#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED)
/* /*
@ -1353,7 +1372,7 @@ int mbedtls_ssl_tls13_key_schedule_stage_handshake( mbedtls_ssl_context *ssl )
/* /*
* Compute the Handshake Secret * Compute the Handshake Secret
*/ */
ret = mbedtls_ssl_tls13_evolve_secret( md_type, ret = mbedtls_ssl_tls13_evolve_secret( hash_alg,
handshake->tls13_master_secrets.early, handshake->tls13_master_secrets.early,
handshake->premaster, handshake->pmslen, handshake->premaster, handshake->pmslen,
handshake->tls13_master_secrets.handshake ); handshake->tls13_master_secrets.handshake );
@ -1364,7 +1383,8 @@ int mbedtls_ssl_tls13_key_schedule_stage_handshake( mbedtls_ssl_context *ssl )
} }
MBEDTLS_SSL_DEBUG_BUF( 4, "Handshake secret", MBEDTLS_SSL_DEBUG_BUF( 4, "Handshake secret",
handshake->tls13_master_secrets.handshake, md_size ); handshake->tls13_master_secrets.handshake,
PSA_HASH_LENGTH( hash_alg ) );
#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED)
mbedtls_platform_zeroize( handshake->premaster, sizeof( handshake->premaster ) ); mbedtls_platform_zeroize( handshake->premaster, sizeof( handshake->premaster ) );
@ -1392,8 +1412,9 @@ int mbedtls_ssl_tls13_generate_application_keys(
/* Variables relating to the hash for the chosen ciphersuite. */ /* Variables relating to the hash for the chosen ciphersuite. */
mbedtls_md_type_t md_type; mbedtls_md_type_t md_type;
mbedtls_md_info_t const *md_info;
size_t md_size; psa_algorithm_t hash_alg;
size_t hash_len;
/* Variables relating to the cipher for the chosen ciphersuite. */ /* Variables relating to the cipher for the chosen ciphersuite. */
mbedtls_cipher_info_t const *cipher_info; mbedtls_cipher_info_t const *cipher_info;
@ -1409,8 +1430,9 @@ int mbedtls_ssl_tls13_generate_application_keys(
iv_len = cipher_info->iv_size; iv_len = cipher_info->iv_size;
md_type = handshake->ciphersuite_info->mac; md_type = handshake->ciphersuite_info->mac;
md_info = mbedtls_md_info_from_type( md_type );
md_size = mbedtls_md_get_size( md_info ); hash_alg = mbedtls_psa_translate_md( handshake->ciphersuite_info->mac );
hash_len = PSA_HASH_LENGTH( hash_alg );
/* Compute current handshake transcript. It's the caller's responsiblity /* Compute current handshake transcript. It's the caller's responsiblity
* to call this at the right time, that is, after the ServerFinished. */ * to call this at the right time, that is, after the ServerFinished. */
@ -1423,7 +1445,7 @@ int mbedtls_ssl_tls13_generate_application_keys(
/* Compute application secrets from master secret and transcript hash. */ /* Compute application secrets from master secret and transcript hash. */
ret = mbedtls_ssl_tls13_derive_application_secrets( md_type, ret = mbedtls_ssl_tls13_derive_application_secrets( hash_alg,
handshake->tls13_master_secrets.app, handshake->tls13_master_secrets.app,
transcript, transcript_len, transcript, transcript_len,
app_secrets ); app_secrets );
@ -1439,10 +1461,10 @@ int mbedtls_ssl_tls13_generate_application_keys(
/* Derive first epoch of IV + Key for application traffic. */ /* Derive first epoch of IV + Key for application traffic. */
ret = mbedtls_ssl_tls13_make_traffic_keys( md_type, ret = mbedtls_ssl_tls13_make_traffic_keys( hash_alg,
app_secrets->client_application_traffic_secret_N, app_secrets->client_application_traffic_secret_N,
app_secrets->server_application_traffic_secret_N, app_secrets->server_application_traffic_secret_N,
md_size, key_len, iv_len, traffic_keys ); hash_len, key_len, iv_len, traffic_keys );
if( ret != 0 ) if( ret != 0 )
{ {
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_make_traffic_keys", ret ); MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_make_traffic_keys", ret );
@ -1451,11 +1473,11 @@ int mbedtls_ssl_tls13_generate_application_keys(
MBEDTLS_SSL_DEBUG_BUF( 4, "Client application traffic secret", MBEDTLS_SSL_DEBUG_BUF( 4, "Client application traffic secret",
app_secrets->client_application_traffic_secret_N, app_secrets->client_application_traffic_secret_N,
md_size ); hash_len );
MBEDTLS_SSL_DEBUG_BUF( 4, "Server application traffic secret", MBEDTLS_SSL_DEBUG_BUF( 4, "Server application traffic secret",
app_secrets->server_application_traffic_secret_N, app_secrets->server_application_traffic_secret_N,
md_size ); hash_len );
/* /*
* Export client/server application traffic secret 0 * Export client/server application traffic secret 0
@ -1464,7 +1486,7 @@ int mbedtls_ssl_tls13_generate_application_keys(
{ {
ssl->f_export_keys( ssl->p_export_keys, ssl->f_export_keys( ssl->p_export_keys,
MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_APPLICATION_TRAFFIC_SECRET, MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_APPLICATION_TRAFFIC_SECRET,
app_secrets->client_application_traffic_secret_N, md_size, app_secrets->client_application_traffic_secret_N, hash_len,
handshake->randbytes, handshake->randbytes,
handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN, handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN,
MBEDTLS_SSL_TLS_PRF_NONE /* TODO: this should be replaced by MBEDTLS_SSL_TLS_PRF_NONE /* TODO: this should be replaced by
@ -1472,7 +1494,7 @@ int mbedtls_ssl_tls13_generate_application_keys(
ssl->f_export_keys( ssl->p_export_keys, ssl->f_export_keys( ssl->p_export_keys,
MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_APPLICATION_TRAFFIC_SECRET, MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_APPLICATION_TRAFFIC_SECRET,
app_secrets->server_application_traffic_secret_N, md_size, app_secrets->server_application_traffic_secret_N, hash_len,
handshake->randbytes, handshake->randbytes,
handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN, handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN,
MBEDTLS_SSL_TLS_PRF_NONE /* TODO: this should be replaced by MBEDTLS_SSL_TLS_PRF_NONE /* TODO: this should be replaced by

44
library/ssl_tls13_keys.h
View file

@ -114,7 +114,7 @@ extern const struct mbedtls_ssl_tls13_labels_struct mbedtls_ssl_tls13_labels;
*/ */
int mbedtls_ssl_tls13_hkdf_expand_label( int mbedtls_ssl_tls13_hkdf_expand_label(
mbedtls_md_type_t hash_alg, psa_algorithm_t hash_alg,
const unsigned char *secret, size_t secret_len, const unsigned char *secret, size_t secret_len,
const unsigned char *label, size_t label_len, const unsigned char *label, size_t label_len,
const unsigned char *ctx, size_t ctx_len, const unsigned char *ctx, size_t ctx_len,
@ -152,7 +152,7 @@ int mbedtls_ssl_tls13_hkdf_expand_label(
*/ */
int mbedtls_ssl_tls13_make_traffic_keys( int mbedtls_ssl_tls13_make_traffic_keys(
mbedtls_md_type_t hash_alg, psa_algorithm_t hash_alg,
const unsigned char *client_secret, const unsigned char *client_secret,
const unsigned char *server_secret, size_t secret_len, const unsigned char *server_secret, size_t secret_len,
size_t key_len, size_t iv_len, size_t key_len, size_t iv_len,
@ -202,7 +202,7 @@ int mbedtls_ssl_tls13_make_traffic_keys(
* \returns A negative error code on failure. * \returns A negative error code on failure.
*/ */
int mbedtls_ssl_tls13_derive_secret( int mbedtls_ssl_tls13_derive_secret(
mbedtls_md_type_t hash_alg, psa_algorithm_t hash_alg,
const unsigned char *secret, size_t secret_len, const unsigned char *secret, size_t secret_len,
const unsigned char *label, size_t label_len, const unsigned char *label, size_t label_len,
const unsigned char *ctx, size_t ctx_len, const unsigned char *ctx, size_t ctx_len,
@ -235,14 +235,14 @@ int mbedtls_ssl_tls13_derive_secret(
* is omitted here. Its calculation is part of the separate routine * is omitted here. Its calculation is part of the separate routine
* mbedtls_ssl_tls13_create_psk_binder(). * mbedtls_ssl_tls13_create_psk_binder().
* *
* \param md_type The hash algorithm associated with the PSK for which * \param hash_alg The hash algorithm associated with the PSK for which
* early data key material is being derived. * early data key material is being derived.
* \param early_secret The early secret from which the early data key material * \param early_secret The early secret from which the early data key material
* should be derived. This must be a readable buffer whose * should be derived. This must be a readable buffer whose
* length is the digest size of the hash algorithm * length is the digest size of the hash algorithm
* represented by \p md_size. * represented by \p md_size.
* \param transcript The transcript of the handshake so far, calculated with * \param transcript The transcript of the handshake so far, calculated with
* respect to \p md_type. This must be a readable buffer * respect to \p hash_alg. This must be a readable buffer
* whose length is the digest size of the hash algorithm * whose length is the digest size of the hash algorithm
* represented by \p md_size. * represented by \p md_size.
* \param derived The address of the structure in which to store * \param derived The address of the structure in which to store
@ -252,7 +252,7 @@ int mbedtls_ssl_tls13_derive_secret(
* \returns A negative error code on failure. * \returns A negative error code on failure.
*/ */
int mbedtls_ssl_tls13_derive_early_secrets( int mbedtls_ssl_tls13_derive_early_secrets(
mbedtls_md_type_t md_type, psa_algorithm_t hash_alg,
unsigned char const *early_secret, unsigned char const *early_secret,
unsigned char const *transcript, size_t transcript_len, unsigned char const *transcript, size_t transcript_len,
mbedtls_ssl_tls13_early_secrets *derived ); mbedtls_ssl_tls13_early_secrets *derived );
@ -280,14 +280,14 @@ int mbedtls_ssl_tls13_derive_early_secrets(
* the client and server secret derived by this function need to be * the client and server secret derived by this function need to be
* further processed by mbedtls_ssl_tls13_make_traffic_keys(). * further processed by mbedtls_ssl_tls13_make_traffic_keys().
* *
* \param md_type The hash algorithm associated with the ciphersuite * \param hash_alg The hash algorithm associated with the ciphersuite
* that's being used for the connection. * that's being used for the connection.
* \param handshake_secret The handshake secret from which the handshake key * \param handshake_secret The handshake secret from which the handshake key
* material should be derived. This must be a readable * material should be derived. This must be a readable
* buffer whose length is the digest size of the hash * buffer whose length is the digest size of the hash
* algorithm represented by \p md_size. * algorithm represented by \p md_size.
* \param transcript The transcript of the handshake so far, calculated * \param transcript The transcript of the handshake so far, calculated
* with respect to \p md_type. This must be a readable * with respect to \p hash_alg. This must be a readable
* buffer whose length is the digest size of the hash * buffer whose length is the digest size of the hash
* algorithm represented by \p md_size. * algorithm represented by \p md_size.
* \param derived The address of the structure in which to * \param derived The address of the structure in which to
@ -297,7 +297,7 @@ int mbedtls_ssl_tls13_derive_early_secrets(
* \returns A negative error code on failure. * \returns A negative error code on failure.
*/ */
int mbedtls_ssl_tls13_derive_handshake_secrets( int mbedtls_ssl_tls13_derive_handshake_secrets(
mbedtls_md_type_t md_type, psa_algorithm_t hash_alg,
unsigned char const *handshake_secret, unsigned char const *handshake_secret,
unsigned char const *transcript, size_t transcript_len, unsigned char const *transcript, size_t transcript_len,
mbedtls_ssl_tls13_handshake_secrets *derived ); mbedtls_ssl_tls13_handshake_secrets *derived );
@ -329,7 +329,7 @@ int mbedtls_ssl_tls13_derive_handshake_secrets(
* the client and server secret derived by this function need to be * the client and server secret derived by this function need to be
* further processed by mbedtls_ssl_tls13_make_traffic_keys(). * further processed by mbedtls_ssl_tls13_make_traffic_keys().
* *
* \param md_type The hash algorithm associated with the ciphersuite * \param hash_alg The hash algorithm associated with the ciphersuite
* that's being used for the connection. * that's being used for the connection.
* \param master_secret The master secret from which the application key * \param master_secret The master secret from which the application key
* material should be derived. This must be a readable * material should be derived. This must be a readable
@ -337,9 +337,9 @@ int mbedtls_ssl_tls13_derive_handshake_secrets(
* algorithm represented by \p md_size. * algorithm represented by \p md_size.
* \param transcript The transcript of the handshake up to and including * \param transcript The transcript of the handshake up to and including
* the ServerFinished message, calculated with respect * the ServerFinished message, calculated with respect
* to \p md_type. This must be a readable buffer whose * to \p hash_alg. This must be a readable buffer whose
* length is the digest size of the hash algorithm * length is the digest size of the hash algorithm
* represented by \p md_type. * represented by \p hash_alg.
* \param derived The address of the structure in which to * \param derived The address of the structure in which to
* store the application key material. * store the application key material.
* *
@ -347,7 +347,7 @@ int mbedtls_ssl_tls13_derive_handshake_secrets(
* \returns A negative error code on failure. * \returns A negative error code on failure.
*/ */
int mbedtls_ssl_tls13_derive_application_secrets( int mbedtls_ssl_tls13_derive_application_secrets(
mbedtls_md_type_t md_type, psa_algorithm_t hash_alg,
unsigned char const *master_secret, unsigned char const *master_secret,
unsigned char const *transcript, size_t transcript_len, unsigned char const *transcript, size_t transcript_len,
mbedtls_ssl_tls13_application_secrets *derived ); mbedtls_ssl_tls13_application_secrets *derived );
@ -358,7 +358,7 @@ int mbedtls_ssl_tls13_derive_application_secrets(
* This is a small wrapper invoking mbedtls_ssl_tls13_derive_secret() * This is a small wrapper invoking mbedtls_ssl_tls13_derive_secret()
* with the appropriate labels from the standard. * with the appropriate labels from the standard.
* *
* \param md_type The hash algorithm used in the application for which * \param hash_alg The hash algorithm used in the application for which
* key material is being derived. * key material is being derived.
* \param application_secret The application secret from which the resumption master * \param application_secret The application secret from which the resumption master
* secret should be derived. This must be a readable * secret should be derived. This must be a readable
@ -366,9 +366,9 @@ int mbedtls_ssl_tls13_derive_application_secrets(
* algorithm represented by \p md_size. * algorithm represented by \p md_size.
* \param transcript The transcript of the handshake up to and including * \param transcript The transcript of the handshake up to and including
* the ClientFinished message, calculated with respect * the ClientFinished message, calculated with respect
* to \p md_type. This must be a readable buffer whose * to \p hash_alg. This must be a readable buffer whose
* length is the digest size of the hash algorithm * length is the digest size of the hash algorithm
* represented by \p md_type. * represented by \p hash_alg.
* \param transcript_len The length of \p transcript in Bytes. * \param transcript_len The length of \p transcript in Bytes.
* \param derived The address of the structure in which to * \param derived The address of the structure in which to
* store the resumption master secret. * store the resumption master secret.
@ -377,7 +377,7 @@ int mbedtls_ssl_tls13_derive_application_secrets(
* \returns A negative error code on failure. * \returns A negative error code on failure.
*/ */
int mbedtls_ssl_tls13_derive_resumption_master_secret( int mbedtls_ssl_tls13_derive_resumption_master_secret(
mbedtls_md_type_t md_type, psa_algorithm_t hash_alg,
unsigned char const *application_secret, unsigned char const *application_secret,
unsigned char const *transcript, size_t transcript_len, unsigned char const *transcript, size_t transcript_len,
mbedtls_ssl_tls13_application_secrets *derived ); mbedtls_ssl_tls13_application_secrets *derived );
@ -450,7 +450,7 @@ int mbedtls_ssl_tls13_derive_resumption_master_secret(
*/ */
int mbedtls_ssl_tls13_evolve_secret( int mbedtls_ssl_tls13_evolve_secret(
mbedtls_md_type_t hash_alg, psa_algorithm_t hash_alg,
const unsigned char *secret_old, const unsigned char *secret_old,
const unsigned char *input, size_t input_len, const unsigned char *input, size_t input_len,
unsigned char *secret_new ); unsigned char *secret_new );
@ -463,7 +463,7 @@ int mbedtls_ssl_tls13_evolve_secret(
* *
* \param ssl The SSL context. This is used for debugging only and may * \param ssl The SSL context. This is used for debugging only and may
* be \c NULL if MBEDTLS_DEBUG_C is disabled. * be \c NULL if MBEDTLS_DEBUG_C is disabled.
* \param md_type The hash algorithm associated to the PSK \p psk. * \param hash_alg The hash algorithm associated to the PSK \p psk.
* \param psk The buffer holding the PSK for which to create a binder. * \param psk The buffer holding the PSK for which to create a binder.
* \param psk_len The size of \p psk in bytes. * \param psk_len The size of \p psk in bytes.
* \param psk_type This indicates whether the PSK \p psk is externally * \param psk_type This indicates whether the PSK \p psk is externally
@ -472,17 +472,17 @@ int mbedtls_ssl_tls13_evolve_secret(
* \param transcript The handshake transcript up to the point where the * \param transcript The handshake transcript up to the point where the
* PSK binder calculation happens. This must be readable, * PSK binder calculation happens. This must be readable,
* and its size must be equal to the digest size of * and its size must be equal to the digest size of
* the hash algorithm represented by \p md_type. * the hash algorithm represented by \p hash_alg.
* \param result The address at which to store the PSK binder on success. * \param result The address at which to store the PSK binder on success.
* This must be writable, and its size must be equal to the * This must be writable, and its size must be equal to the
* digest size of the hash algorithm represented by * digest size of the hash algorithm represented by
* \p md_type. * \p hash_alg.
* *
* \returns \c 0 on success. * \returns \c 0 on success.
* \returns A negative error code on failure. * \returns A negative error code on failure.
*/ */
int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl, int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl,
const mbedtls_md_type_t md_type, const psa_algorithm_t hash_alg,
unsigned char const *psk, size_t psk_len, unsigned char const *psk, size_t psk_len,
int psk_type, int psk_type,
unsigned char const *transcript, unsigned char const *transcript,

91
tests/suites/test_suite_ssl.data
View file

@ -4379,18 +4379,20 @@ ssl_decrypt_non_etm_cbc:MBEDTLS_CIPHER_CAMELLIA_128_CBC:MBEDTLS_MD_SHA384:1:255
SSL TLS 1.3 Key schedule: Secret evolution #1 SSL TLS 1.3 Key schedule: Secret evolution #1
# Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
# Initial secret to Early Secret # Initial secret to Early Secret
depends_on:MBEDTLS_SSL_PROTO_TLS1_3 depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_key_evolution:MBEDTLS_MD_SHA256:"":"":"33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a" ssl_tls13_key_evolution:PSA_ALG_SHA_256:"":"":"33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a"
SSL TLS 1.3 Key schedule: Secret evolution #2 SSL TLS 1.3 Key schedule: Secret evolution #2
# Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
# Early secret to Handshake Secret # Early secret to Handshake Secret
ssl_tls13_key_evolution:MBEDTLS_MD_SHA256:"33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a":"df4a291baa1eb7cfa6934b29b474baad2697e29f1f920dcc77c8a0a088447624":"fb9fc80689b3a5d02c33243bf69a1b1b20705588a794304a6e7120155edf149a" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_key_evolution:PSA_ALG_SHA_256:"33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a":"df4a291baa1eb7cfa6934b29b474baad2697e29f1f920dcc77c8a0a088447624":"fb9fc80689b3a5d02c33243bf69a1b1b20705588a794304a6e7120155edf149a"
SSL TLS 1.3 Key schedule: Secret evolution #3 SSL TLS 1.3 Key schedule: Secret evolution #3
# Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
# Handshake secret to Master Secret # Handshake secret to Master Secret
ssl_tls13_key_evolution:MBEDTLS_MD_SHA256:"fb9fc80689b3a5d02c33243bf69a1b1b20705588a794304a6e7120155edf149a":"":"7f2882bb9b9a46265941653e9c2f19067118151e21d12e57a7b6aca1f8150c8d" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_key_evolution:PSA_ALG_SHA_256:"fb9fc80689b3a5d02c33243bf69a1b1b20705588a794304a6e7120155edf149a":"":"7f2882bb9b9a46265941653e9c2f19067118151e21d12e57a7b6aca1f8150c8d"
SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #1 Extract SSL TLS 1.3 Key schedule: HKDF RFC5869 Test Vector #1 Extract
depends_on:PSA_WANT_ALG_SHA_256 depends_on:PSA_WANT_ALG_SHA_256
@ -4477,120 +4479,144 @@ SSL TLS 1.3 Key schedule: HKDF Expand Label #1
# Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
# Server handshake traffic secret -> Server traffic key # Server handshake traffic secret -> Server traffic key
# HKDF-Expand-Label(server_handshake_secret, "key", "", 16) # HKDF-Expand-Label(server_handshake_secret, "key", "", 16)
ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":tls13_label_key:"":16:"844780a7acad9f980fa25c114e43402a" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":tls13_label_key:"":16:"844780a7acad9f980fa25c114e43402a"
SSL TLS 1.3 Key schedule: HKDF Expand Label #2 SSL TLS 1.3 Key schedule: HKDF Expand Label #2
# Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
# Server handshake traffic secret -> Server traffic IV # Server handshake traffic secret -> Server traffic IV
# HKDF-Expand-Label(server_handshake_secret, "iv", "", 12) # HKDF-Expand-Label(server_handshake_secret, "iv", "", 12)
ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":tls13_label_iv:"":12:"4c042ddc120a38d1417fc815" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":tls13_label_iv:"":12:"4c042ddc120a38d1417fc815"
SSL TLS 1.3 Key schedule: HKDF Expand Label #3 SSL TLS 1.3 Key schedule: HKDF Expand Label #3
# Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
# Client handshake traffic secret -> Client traffic key # Client handshake traffic secret -> Client traffic key
# HKDF-Expand-Label(client_handshake_secret, "key", "", 16) # HKDF-Expand-Label(client_handshake_secret, "key", "", 16)
ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":tls13_label_key:"":16:"7154f314e6be7dc008df2c832baa1d39" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":tls13_label_key:"":16:"7154f314e6be7dc008df2c832baa1d39"
SSL TLS 1.3 Key schedule: HKDF Expand Label #4 SSL TLS 1.3 Key schedule: HKDF Expand Label #4
# Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
# Client handshake traffic secret -> Client traffic IV # Client handshake traffic secret -> Client traffic IV
# HKDF-Expand-Label(client_handshake_secret, "iv", "", 12) # HKDF-Expand-Label(client_handshake_secret, "iv", "", 12)
ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":tls13_label_iv:"":12:"71abc2cae4c699d47c600268" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":tls13_label_iv:"":12:"71abc2cae4c699d47c600268"
SSL TLS 1.3 Key schedule: HKDF Expand Label #5 (RFC 8448) SSL TLS 1.3 Key schedule: HKDF Expand Label #5 (RFC 8448)
# Vector from RFC 8448 # Vector from RFC 8448
# Server handshake traffic secret -> Server traffic IV # Server handshake traffic secret -> Server traffic IV
# HKDF-Expand-Label(server_handshake_secret, "iv", "", 12) # HKDF-Expand-Label(server_handshake_secret, "iv", "", 12)
ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"b67b7d690cc16c4e75e54213cb2d37b4e9c912bcded9105d42befd59d391ad38":tls13_label_iv:"":12:"5d313eb2671276ee13000b30" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"b67b7d690cc16c4e75e54213cb2d37b4e9c912bcded9105d42befd59d391ad38":tls13_label_iv:"":12:"5d313eb2671276ee13000b30"
SSL TLS 1.3 Key schedule: HKDF Expand Label #6 (RFC 8448) SSL TLS 1.3 Key schedule: HKDF Expand Label #6 (RFC 8448)
# Vector from RFC 8448 # Vector from RFC 8448
# Server handshake traffic secret -> Server traffic Key # Server handshake traffic secret -> Server traffic Key
# HKDF-Expand-Label(server_handshake_secret, "key", "", 16) # HKDF-Expand-Label(server_handshake_secret, "key", "", 16)
ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"b67b7d690cc16c4e75e54213cb2d37b4e9c912bcded9105d42befd59d391ad38":tls13_label_key:"":16:"3fce516009c21727d0f2e4e86ee403bc" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"b67b7d690cc16c4e75e54213cb2d37b4e9c912bcded9105d42befd59d391ad38":tls13_label_key:"":16:"3fce516009c21727d0f2e4e86ee403bc"
SSL TLS 1.3 Key schedule: HKDF Expand Label #7 (RFC 8448) SSL TLS 1.3 Key schedule: HKDF Expand Label #7 (RFC 8448)
# Vector from RFC 8448 # Vector from RFC 8448
# Client handshake traffic secret -> Client traffic IV # Client handshake traffic secret -> Client traffic IV
# HKDF-Expand-Label(client_handshake_secret, "iv", "", 12) # HKDF-Expand-Label(client_handshake_secret, "iv", "", 12)
ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"b3eddb126e067f35a780b3abf45e2d8f3b1a950738f52e9600746a0e27a55a21":tls13_label_iv:"":12:"5bd3c71b836e0b76bb73265f" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"b3eddb126e067f35a780b3abf45e2d8f3b1a950738f52e9600746a0e27a55a21":tls13_label_iv:"":12:"5bd3c71b836e0b76bb73265f"
SSL TLS 1.3 Key schedule: HKDF Expand Label #8 (RFC 8448) SSL TLS 1.3 Key schedule: HKDF Expand Label #8 (RFC 8448)
# Vector from RFC 8448 # Vector from RFC 8448
# Client handshake traffic secret -> Client traffic Key # Client handshake traffic secret -> Client traffic Key
# HKDF-Expand-Label(client_handshake_secret, "key", "", 16) # HKDF-Expand-Label(client_handshake_secret, "key", "", 16)
ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"b3eddb126e067f35a780b3abf45e2d8f3b1a950738f52e9600746a0e27a55a21":tls13_label_key:"":16:"dbfaa693d1762c5b666af5d950258d01" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"b3eddb126e067f35a780b3abf45e2d8f3b1a950738f52e9600746a0e27a55a21":tls13_label_key:"":16:"dbfaa693d1762c5b666af5d950258d01"
SSL TLS 1.3 Key schedule: HKDF Expand Label #9 (RFC 8448) SSL TLS 1.3 Key schedule: HKDF Expand Label #9 (RFC 8448)
# Calculation of finished_key # Calculation of finished_key
ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"2faac08f851d35fea3604fcb4de82dc62c9b164a70974d0462e27f1ab278700f":tls13_label_finished:"":32:"5ace394c26980d581243f627d1150ae27e37fa52364e0a7f20ac686d09cd0e8e" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"2faac08f851d35fea3604fcb4de82dc62c9b164a70974d0462e27f1ab278700f":tls13_label_finished:"":32:"5ace394c26980d581243f627d1150ae27e37fa52364e0a7f20ac686d09cd0e8e"
SSL TLS 1.3 Key schedule: HKDF Expand Label #10 (RFC 8448) SSL TLS 1.3 Key schedule: HKDF Expand Label #10 (RFC 8448)
# Calculation of resumption key # Calculation of resumption key
ssl_tls13_hkdf_expand_label:MBEDTLS_MD_SHA256:"7df235f2031d2a051287d02b0241b0bfdaf86cc856231f2d5aba46c434ec196c":tls13_label_resumption:"0000":32:"4ecd0eb6ec3b4d87f5d6028f922ca4c5851a277fd41311c9e62d2c9492e1c4f3" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_hkdf_expand_label:PSA_ALG_SHA_256:"7df235f2031d2a051287d02b0241b0bfdaf86cc856231f2d5aba46c434ec196c":tls13_label_resumption:"0000":32:"4ecd0eb6ec3b4d87f5d6028f922ca4c5851a277fd41311c9e62d2c9492e1c4f3"
SSL TLS 1.3 Key schedule: Traffic key generation #1 SSL TLS 1.3 Key schedule: Traffic key generation #1
# Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
# Client/Server handshake traffic secrets -> Client/Server traffic {Key,IV} # Client/Server handshake traffic secrets -> Client/Server traffic {Key,IV}
ssl_tls13_traffic_key_generation:MBEDTLS_MD_SHA256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":12:16:"844780a7acad9f980fa25c114e43402a":"4c042ddc120a38d1417fc815":"7154f314e6be7dc008df2c832baa1d39":"71abc2cae4c699d47c600268" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_traffic_key_generation:PSA_ALG_SHA_256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":12:16:"844780a7acad9f980fa25c114e43402a":"4c042ddc120a38d1417fc815":"7154f314e6be7dc008df2c832baa1d39":"71abc2cae4c699d47c600268"
SSL TLS 1.3 Key schedule: Traffic key generation #2 (RFC 8448) SSL TLS 1.3 Key schedule: Traffic key generation #2 (RFC 8448)
# Vector RFC 8448 # Vector RFC 8448
# Client/Server handshake traffic secrets -> Client/Server traffic {Key,IV} # Client/Server handshake traffic secrets -> Client/Server traffic {Key,IV}
ssl_tls13_traffic_key_generation:MBEDTLS_MD_SHA256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":12:16:"844780a7acad9f980fa25c114e43402a":"4c042ddc120a38d1417fc815":"7154f314e6be7dc008df2c832baa1d39":"71abc2cae4c699d47c600268" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_traffic_key_generation:PSA_ALG_SHA_256:"a2067265e7f0652a923d5d72ab0467c46132eeb968b6a32d311c805868548814":"ff0e5b965291c608c1e8cd267eefc0afcc5e98a2786373f0db47b04786d72aea":12:16:"844780a7acad9f980fa25c114e43402a":"4c042ddc120a38d1417fc815":"7154f314e6be7dc008df2c832baa1d39":"71abc2cae4c699d47c600268"
SSL TLS 1.3 Key schedule: Derive-Secret( ., "derived", "") SSL TLS 1.3 Key schedule: Derive-Secret( ., "derived", "")
# Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
# Derive-Secret( Early-Secret, "derived", "") # Derive-Secret( Early-Secret, "derived", "")
# Tests the case where context isn't yet hashed (empty string here, # Tests the case where context isn't yet hashed (empty string here,
# but still needs to be hashed) # but still needs to be hashed)
ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a":tls13_label_derived:"":32:MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED:"6f2615a108c702c5678f54fc9dbab69716c076189c48250cebeac3576c3611ba" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_derive_secret:PSA_ALG_SHA_256:"33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a":tls13_label_derived:"":32:MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED:"6f2615a108c702c5678f54fc9dbab69716c076189c48250cebeac3576c3611ba"
SSL TLS 1.3 Key schedule: Derive-Secret( ., "s ap traffic", hash) #1 SSL TLS 1.3 Key schedule: Derive-Secret( ., "s ap traffic", hash) #1
# Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/) # Vector from TLS 1.3 Byte by Byte (https://tls13.ulfheim.net/)
# Derive-Secret( MasterSecret, "s ap traffic", hash) # Derive-Secret( MasterSecret, "s ap traffic", hash)
# Tests the case where context is already hashed # Tests the case where context is already hashed
ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"7f2882bb9b9a46265941653e9c2f19067118151e21d12e57a7b6aca1f8150c8d":tls13_label_s_ap_traffic:"22844b930e5e0a59a09d5ac35fc032fc91163b193874a265236e568077378d8b":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"3fc35ea70693069a277956afa23b8f4543ce68ac595f2aace05cd7a1c92023d5" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_derive_secret:PSA_ALG_SHA_256:"7f2882bb9b9a46265941653e9c2f19067118151e21d12e57a7b6aca1f8150c8d":tls13_label_s_ap_traffic:"22844b930e5e0a59a09d5ac35fc032fc91163b193874a265236e568077378d8b":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"3fc35ea70693069a277956afa23b8f4543ce68ac595f2aace05cd7a1c92023d5"
SSL TLS 1.3 Key schedule: Derive-Secret( ., "c e traffic", hash) SSL TLS 1.3 Key schedule: Derive-Secret( ., "c e traffic", hash)
# Vector from RFC 8448 # Vector from RFC 8448
ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"9b2188e9b2fc6d64d71dc329900e20bb41915000f678aa839cbb797cb7d8332c":tls13_label_c_e_traffic:"08ad0fa05d7c7233b1775ba2ff9f4c5b8b59276b7f227f13a976245f5d960913":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"3fbbe6a60deb66c30a32795aba0eff7eaa10105586e7be5c09678d63b6caab62" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_derive_secret:PSA_ALG_SHA_256:"9b2188e9b2fc6d64d71dc329900e20bb41915000f678aa839cbb797cb7d8332c":tls13_label_c_e_traffic:"08ad0fa05d7c7233b1775ba2ff9f4c5b8b59276b7f227f13a976245f5d960913":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"3fbbe6a60deb66c30a32795aba0eff7eaa10105586e7be5c09678d63b6caab62"
SSL TLS 1.3 Key schedule: Derive-Secret( ., "e exp master", hash) SSL TLS 1.3 Key schedule: Derive-Secret( ., "e exp master", hash)
# Vector from RFC 8448 # Vector from RFC 8448
ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"9b2188e9b2fc6d64d71dc329900e20bb41915000f678aa839cbb797cb7d8332c":tls13_label_e_exp_master:"08ad0fa05d7c7233b1775ba2ff9f4c5b8b59276b7f227f13a976245f5d960913":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"b2026866610937d7423e5be90862ccf24c0e6091186d34f812089ff5be2ef7df" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_derive_secret:PSA_ALG_SHA_256:"9b2188e9b2fc6d64d71dc329900e20bb41915000f678aa839cbb797cb7d8332c":tls13_label_e_exp_master:"08ad0fa05d7c7233b1775ba2ff9f4c5b8b59276b7f227f13a976245f5d960913":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"b2026866610937d7423e5be90862ccf24c0e6091186d34f812089ff5be2ef7df"
SSL TLS 1.3 Key schedule: Derive-Secret( ., "c hs traffic", hash) SSL TLS 1.3 Key schedule: Derive-Secret( ., "c hs traffic", hash)
# Vector from RFC 8448 # Vector from RFC 8448
ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"005cb112fd8eb4ccc623bb88a07c64b3ede1605363fc7d0df8c7ce4ff0fb4ae6":tls13_label_c_hs_traffic:"f736cb34fe25e701551bee6fd24c1cc7102a7daf9405cb15d97aafe16f757d03":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"2faac08f851d35fea3604fcb4de82dc62c9b164a70974d0462e27f1ab278700f" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_derive_secret:PSA_ALG_SHA_256:"005cb112fd8eb4ccc623bb88a07c64b3ede1605363fc7d0df8c7ce4ff0fb4ae6":tls13_label_c_hs_traffic:"f736cb34fe25e701551bee6fd24c1cc7102a7daf9405cb15d97aafe16f757d03":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"2faac08f851d35fea3604fcb4de82dc62c9b164a70974d0462e27f1ab278700f"
SSL TLS 1.3 Key schedule: Derive-Secret( ., "s hs traffic", hash) SSL TLS 1.3 Key schedule: Derive-Secret( ., "s hs traffic", hash)
# Vector from RFC 8448 # Vector from RFC 8448
ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"005cb112fd8eb4ccc623bb88a07c64b3ede1605363fc7d0df8c7ce4ff0fb4ae6":tls13_label_s_hs_traffic:"f736cb34fe25e701551bee6fd24c1cc7102a7daf9405cb15d97aafe16f757d03":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"fe927ae271312e8bf0275b581c54eef020450dc4ecffaa05a1a35d27518e7803" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_derive_secret:PSA_ALG_SHA_256:"005cb112fd8eb4ccc623bb88a07c64b3ede1605363fc7d0df8c7ce4ff0fb4ae6":tls13_label_s_hs_traffic:"f736cb34fe25e701551bee6fd24c1cc7102a7daf9405cb15d97aafe16f757d03":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"fe927ae271312e8bf0275b581c54eef020450dc4ecffaa05a1a35d27518e7803"
SSL TLS 1.3 Key schedule: Derive-Secret( ., "c ap traffic", hash) SSL TLS 1.3 Key schedule: Derive-Secret( ., "c ap traffic", hash)
# Vector from RFC 8448 # Vector from RFC 8448
ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_c_ap_traffic:"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"2abbf2b8e381d23dbebe1dd2a7d16a8bf484cb4950d23fb7fb7fa8547062d9a1" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_derive_secret:PSA_ALG_SHA_256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_c_ap_traffic:"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"2abbf2b8e381d23dbebe1dd2a7d16a8bf484cb4950d23fb7fb7fa8547062d9a1"
SSL TLS 1.3 Key schedule: Derive-Secret( ., "s ap traffic", hash) #2 SSL TLS 1.3 Key schedule: Derive-Secret( ., "s ap traffic", hash) #2
# Vector from RFC 8448 # Vector from RFC 8448
ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_s_ap_traffic:"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"cc21f1bf8feb7dd5fa505bd9c4b468a9984d554a993dc49e6d285598fb672691" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_derive_secret:PSA_ALG_SHA_256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_s_ap_traffic:"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"cc21f1bf8feb7dd5fa505bd9c4b468a9984d554a993dc49e6d285598fb672691"
SSL TLS 1.3 Key schedule: Derive-Secret( ., "exp master", hash) SSL TLS 1.3 Key schedule: Derive-Secret( ., "exp master", hash)
# Vector from RFC 8448 # Vector from RFC 8448
ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_exp_master:"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"3fd93d4ffddc98e64b14dd107aedf8ee4add23f4510f58a4592d0b201bee56b4" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_derive_secret:PSA_ALG_SHA_256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_exp_master:"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"3fd93d4ffddc98e64b14dd107aedf8ee4add23f4510f58a4592d0b201bee56b4"
SSL TLS 1.3 Key schedule: Derive-Secret( ., "res master", hash) SSL TLS 1.3 Key schedule: Derive-Secret( ., "res master", hash)
# Vector from RFC 8448 # Vector from RFC 8448
ssl_tls13_derive_secret:MBEDTLS_MD_SHA256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_res_master:"c3c122e0bd907a4a3ff6112d8fd53dbf89c773d9552e8b6b9d56d361b3a97bf6":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"5e95bdf1f89005ea2e9aa0ba85e728e3c19c5fe0c699e3f5bee59faebd0b5406" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_derive_secret:PSA_ALG_SHA_256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":tls13_label_res_master:"c3c122e0bd907a4a3ff6112d8fd53dbf89c773d9552e8b6b9d56d361b3a97bf6":32:MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED:"5e95bdf1f89005ea2e9aa0ba85e728e3c19c5fe0c699e3f5bee59faebd0b5406"
SSL TLS 1.3 Key schedule: Early secrets derivation helper SSL TLS 1.3 Key schedule: Early secrets derivation helper
# Vector from RFC 8448 # Vector from RFC 8448
ssl_tls13_derive_early_secrets:MBEDTLS_MD_SHA256:"9b2188e9b2fc6d64d71dc329900e20bb41915000f678aa839cbb797cb7d8332c":"08ad0fa05d7c7233b1775ba2ff9f4c5b8b59276b7f227f13a976245f5d960913":"3fbbe6a60deb66c30a32795aba0eff7eaa10105586e7be5c09678d63b6caab62":"b2026866610937d7423e5be90862ccf24c0e6091186d34f812089ff5be2ef7df" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_derive_early_secrets:PSA_ALG_SHA_256:"9b2188e9b2fc6d64d71dc329900e20bb41915000f678aa839cbb797cb7d8332c":"08ad0fa05d7c7233b1775ba2ff9f4c5b8b59276b7f227f13a976245f5d960913":"3fbbe6a60deb66c30a32795aba0eff7eaa10105586e7be5c09678d63b6caab62":"b2026866610937d7423e5be90862ccf24c0e6091186d34f812089ff5be2ef7df"
SSL TLS 1.3 Key schedule: Handshake secrets derivation helper SSL TLS 1.3 Key schedule: Handshake secrets derivation helper
# Vector from RFC 8448 # Vector from RFC 8448
ssl_tls13_derive_handshake_secrets:MBEDTLS_MD_SHA256:"005cb112fd8eb4ccc623bb88a07c64b3ede1605363fc7d0df8c7ce4ff0fb4ae6":"f736cb34fe25e701551bee6fd24c1cc7102a7daf9405cb15d97aafe16f757d03":"2faac08f851d35fea3604fcb4de82dc62c9b164a70974d0462e27f1ab278700f":"fe927ae271312e8bf0275b581c54eef020450dc4ecffaa05a1a35d27518e7803" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_derive_handshake_secrets:PSA_ALG_SHA_256:"005cb112fd8eb4ccc623bb88a07c64b3ede1605363fc7d0df8c7ce4ff0fb4ae6":"f736cb34fe25e701551bee6fd24c1cc7102a7daf9405cb15d97aafe16f757d03":"2faac08f851d35fea3604fcb4de82dc62c9b164a70974d0462e27f1ab278700f":"fe927ae271312e8bf0275b581c54eef020450dc4ecffaa05a1a35d27518e7803"
SSL TLS 1.3 Record Encryption, tls13.ulfheim.net Example #1 SSL TLS 1.3 Record Encryption, tls13.ulfheim.net Example #1
# - Server App Key: 0b6d22c8ff68097ea871c672073773bf # - Server App Key: 0b6d22c8ff68097ea871c672073773bf
@ -4650,17 +4676,20 @@ ssl_tls13_record_protection:MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:MBED
SSL TLS 1.3 Key schedule: Application secrets derivation helper SSL TLS 1.3 Key schedule: Application secrets derivation helper
# Vector from RFC 8448 # Vector from RFC 8448
ssl_tls13_derive_application_secrets:MBEDTLS_MD_SHA256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":"2abbf2b8e381d23dbebe1dd2a7d16a8bf484cb4950d23fb7fb7fa8547062d9a1":"cc21f1bf8feb7dd5fa505bd9c4b468a9984d554a993dc49e6d285598fb672691":"3fd93d4ffddc98e64b14dd107aedf8ee4add23f4510f58a4592d0b201bee56b4" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_derive_application_secrets:PSA_ALG_SHA_256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":"b0aeffc46a2cfe33114e6fd7d51f9f04b1ca3c497dab08934a774a9d9ad7dbf3":"2abbf2b8e381d23dbebe1dd2a7d16a8bf484cb4950d23fb7fb7fa8547062d9a1":"cc21f1bf8feb7dd5fa505bd9c4b468a9984d554a993dc49e6d285598fb672691":"3fd93d4ffddc98e64b14dd107aedf8ee4add23f4510f58a4592d0b201bee56b4"
SSL TLS 1.3 Key schedule: Resumption secrets derivation helper SSL TLS 1.3 Key schedule: Resumption secrets derivation helper
# Vector from RFC 8448 # Vector from RFC 8448
ssl_tls13_derive_resumption_secrets:MBEDTLS_MD_SHA256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":"c3c122e0bd907a4a3ff6112d8fd53dbf89c773d9552e8b6b9d56d361b3a97bf6":"5e95bdf1f89005ea2e9aa0ba85e728e3c19c5fe0c699e3f5bee59faebd0b5406" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_derive_resumption_secrets:PSA_ALG_SHA_256:"e2d32d4ed66dd37897a0e80c84107503ce58bf8aad4cb55a5002d77ecb890ece":"c3c122e0bd907a4a3ff6112d8fd53dbf89c773d9552e8b6b9d56d361b3a97bf6":"5e95bdf1f89005ea2e9aa0ba85e728e3c19c5fe0c699e3f5bee59faebd0b5406"
SSL TLS 1.3 Key schedule: PSK binder SSL TLS 1.3 Key schedule: PSK binder
# Vector from RFC 8448 # Vector from RFC 8448
# For the resumption PSK, see Section 3, 'generate resumption secret "tls13 resumption"' # For the resumption PSK, see Section 3, 'generate resumption secret "tls13 resumption"'
# For all other data, see Section 4, 'construct a ClientHello handshake message:' # For all other data, see Section 4, 'construct a ClientHello handshake message:'
ssl_tls13_create_psk_binder:MBEDTLS_MD_SHA256:"4ecd0eb6ec3b4d87f5d6028f922ca4c5851a277fd41311c9e62d2c9492e1c4f3":MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION:"63224b2e4573f2d3454ca84b9d009a04f6be9e05711a8396473aefa01e924a14":"3add4fb2d8fdf822a0ca3cf7678ef5e88dae990141c5924d57bb6fa31b9e5f9d" depends_on:PSA_WANT_ALG_SHA_256
ssl_tls13_create_psk_binder:PSA_ALG_SHA_256:"4ecd0eb6ec3b4d87f5d6028f922ca4c5851a277fd41311c9e62d2c9492e1c4f3":MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION:"63224b2e4573f2d3454ca84b9d009a04f6be9e05711a8396473aefa01e924a14":"3add4fb2d8fdf822a0ca3cf7678ef5e88dae990141c5924d57bb6fa31b9e5f9d"
SSL TLS_PRF MBEDTLS_SSL_TLS_PRF_NONE SSL TLS_PRF MBEDTLS_SSL_TLS_PRF_NONE
ssl_tls_prf:MBEDTLS_SSL_TLS_PRF_NONE:"":"":"test tls_prf label":"":MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ssl_tls_prf:MBEDTLS_SSL_TLS_PRF_NONE:"":"":"test tls_prf label":"":MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE

107
tests/suites/test_suite_ssl.function
View file

@ -4065,7 +4065,7 @@ MBEDTLS_SSL_TLS1_3_LABEL_LIST
PSA_INIT( ); PSA_INIT( );
TEST_ASSERT( mbedtls_ssl_tls13_hkdf_expand_label( TEST_ASSERT( mbedtls_ssl_tls13_hkdf_expand_label(
(mbedtls_md_type_t) hash_alg, (psa_algorithm_t) hash_alg,
secret->x, secret->len, secret->x, secret->len,
lbl, lbl_len, lbl, lbl_len,
ctx->x, ctx->len, ctx->x, ctx->len,
@ -4101,7 +4101,7 @@ void ssl_tls13_traffic_key_generation( int hash_alg,
PSA_INIT( ); PSA_INIT( );
TEST_ASSERT( mbedtls_ssl_tls13_make_traffic_keys( TEST_ASSERT( mbedtls_ssl_tls13_make_traffic_keys(
(mbedtls_md_type_t) hash_alg, (psa_algorithm_t) hash_alg,
client_secret->x, client_secret->x,
server_secret->x, server_secret->x,
client_secret->len /* == server_secret->len */, client_secret->len /* == server_secret->len */,
@ -4159,7 +4159,7 @@ MBEDTLS_SSL_TLS1_3_LABEL_LIST
PSA_INIT( ); PSA_INIT( );
TEST_ASSERT( mbedtls_ssl_tls13_derive_secret( TEST_ASSERT( mbedtls_ssl_tls13_derive_secret(
(mbedtls_md_type_t) hash_alg, (psa_algorithm_t) hash_alg,
secret->x, secret->len, secret->x, secret->len,
lbl, lbl_len, lbl, lbl_len,
ctx->x, ctx->len, ctx->x, ctx->len,
@ -4183,24 +4183,23 @@ void ssl_tls13_derive_early_secrets( int hash_alg,
mbedtls_ssl_tls13_early_secrets secrets; mbedtls_ssl_tls13_early_secrets secrets;
/* Double-check that we've passed sane parameters. */ /* Double-check that we've passed sane parameters. */
mbedtls_md_type_t md_type = (mbedtls_md_type_t) hash_alg; psa_algorithm_t alg = (psa_algorithm_t) hash_alg;
mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); size_t const hash_len = PSA_HASH_LENGTH( alg );
size_t const md_size = mbedtls_md_get_size( md_info ); TEST_ASSERT( PSA_ALG_IS_HASH( alg ) &&
TEST_ASSERT( md_info != 0 && secret->len == hash_len &&
secret->len == md_size && transcript->len == hash_len &&
transcript->len == md_size && traffic_expected->len == hash_len &&
traffic_expected->len == md_size && exporter_expected->len == hash_len );
exporter_expected->len == md_size );
PSA_INIT( ); PSA_INIT( );
TEST_ASSERT( mbedtls_ssl_tls13_derive_early_secrets( TEST_ASSERT( mbedtls_ssl_tls13_derive_early_secrets(
md_type, secret->x, transcript->x, transcript->len, alg, secret->x, transcript->x, transcript->len,
&secrets ) == 0 ); &secrets ) == 0 );
ASSERT_COMPARE( secrets.client_early_traffic_secret, md_size, ASSERT_COMPARE( secrets.client_early_traffic_secret, hash_len,
traffic_expected->x, traffic_expected->len ); traffic_expected->x, traffic_expected->len );
ASSERT_COMPARE( secrets.early_exporter_master_secret, md_size, ASSERT_COMPARE( secrets.early_exporter_master_secret, hash_len,
exporter_expected->x, exporter_expected->len ); exporter_expected->x, exporter_expected->len );
PSA_DONE( ); PSA_DONE( );
@ -4217,24 +4216,23 @@ void ssl_tls13_derive_handshake_secrets( int hash_alg,
mbedtls_ssl_tls13_handshake_secrets secrets; mbedtls_ssl_tls13_handshake_secrets secrets;
/* Double-check that we've passed sane parameters. */ /* Double-check that we've passed sane parameters. */
mbedtls_md_type_t md_type = (mbedtls_md_type_t) hash_alg; psa_algorithm_t alg = (psa_algorithm_t) hash_alg;
mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); size_t const hash_len = PSA_HASH_LENGTH( alg );
size_t const md_size = mbedtls_md_get_size( md_info ); TEST_ASSERT( PSA_ALG_IS_HASH( alg ) &&
TEST_ASSERT( md_info != 0 && secret->len == hash_len &&
secret->len == md_size && transcript->len == hash_len &&
transcript->len == md_size && client_expected->len == hash_len &&
client_expected->len == md_size && server_expected->len == hash_len );
server_expected->len == md_size );
PSA_INIT( ); PSA_INIT( );
TEST_ASSERT( mbedtls_ssl_tls13_derive_handshake_secrets( TEST_ASSERT( mbedtls_ssl_tls13_derive_handshake_secrets(
md_type, secret->x, transcript->x, transcript->len, alg, secret->x, transcript->x, transcript->len,
&secrets ) == 0 ); &secrets ) == 0 );
ASSERT_COMPARE( secrets.client_handshake_traffic_secret, md_size, ASSERT_COMPARE( secrets.client_handshake_traffic_secret, hash_len,
client_expected->x, client_expected->len ); client_expected->x, client_expected->len );
ASSERT_COMPARE( secrets.server_handshake_traffic_secret, md_size, ASSERT_COMPARE( secrets.server_handshake_traffic_secret, hash_len,
server_expected->x, server_expected->len ); server_expected->x, server_expected->len );
PSA_DONE( ); PSA_DONE( );
@ -4252,27 +4250,26 @@ void ssl_tls13_derive_application_secrets( int hash_alg,
mbedtls_ssl_tls13_application_secrets secrets; mbedtls_ssl_tls13_application_secrets secrets;
/* Double-check that we've passed sane parameters. */ /* Double-check that we've passed sane parameters. */
mbedtls_md_type_t md_type = (mbedtls_md_type_t) hash_alg; psa_algorithm_t alg = (psa_algorithm_t) hash_alg;
mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); size_t const hash_len = PSA_HASH_LENGTH( alg );
size_t const md_size = mbedtls_md_get_size( md_info ); TEST_ASSERT( PSA_ALG_IS_HASH( alg ) &&
TEST_ASSERT( md_info != 0 && secret->len == hash_len &&
secret->len == md_size && transcript->len == hash_len &&
transcript->len == md_size && client_expected->len == hash_len &&
client_expected->len == md_size && server_expected->len == hash_len &&
server_expected->len == md_size && exporter_expected->len == hash_len );
exporter_expected->len == md_size );
PSA_INIT( ); PSA_INIT( );
TEST_ASSERT( mbedtls_ssl_tls13_derive_application_secrets( TEST_ASSERT( mbedtls_ssl_tls13_derive_application_secrets(
md_type, secret->x, transcript->x, transcript->len, alg, secret->x, transcript->x, transcript->len,
&secrets ) == 0 ); &secrets ) == 0 );
ASSERT_COMPARE( secrets.client_application_traffic_secret_N, md_size, ASSERT_COMPARE( secrets.client_application_traffic_secret_N, hash_len,
client_expected->x, client_expected->len ); client_expected->x, client_expected->len );
ASSERT_COMPARE( secrets.server_application_traffic_secret_N, md_size, ASSERT_COMPARE( secrets.server_application_traffic_secret_N, hash_len,
server_expected->x, server_expected->len ); server_expected->x, server_expected->len );
ASSERT_COMPARE( secrets.exporter_master_secret, md_size, ASSERT_COMPARE( secrets.exporter_master_secret, hash_len,
exporter_expected->x, exporter_expected->len ); exporter_expected->x, exporter_expected->len );
PSA_DONE( ); PSA_DONE( );
@ -4288,21 +4285,20 @@ void ssl_tls13_derive_resumption_secrets( int hash_alg,
mbedtls_ssl_tls13_application_secrets secrets; mbedtls_ssl_tls13_application_secrets secrets;
/* Double-check that we've passed sane parameters. */ /* Double-check that we've passed sane parameters. */
mbedtls_md_type_t md_type = (mbedtls_md_type_t) hash_alg; psa_algorithm_t alg = (psa_algorithm_t) hash_alg;
mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); size_t const hash_len = PSA_HASH_LENGTH( alg );
size_t const md_size = mbedtls_md_get_size( md_info ); TEST_ASSERT( PSA_ALG_IS_HASH( alg ) &&
TEST_ASSERT( md_info != 0 && secret->len == hash_len &&
secret->len == md_size && transcript->len == hash_len &&
transcript->len == md_size && resumption_expected->len == hash_len );
resumption_expected->len == md_size );
PSA_INIT( ); PSA_INIT( );
TEST_ASSERT( mbedtls_ssl_tls13_derive_resumption_master_secret( TEST_ASSERT( mbedtls_ssl_tls13_derive_resumption_master_secret(
md_type, secret->x, transcript->x, transcript->len, alg, secret->x, transcript->x, transcript->len,
&secrets ) == 0 ); &secrets ) == 0 );
ASSERT_COMPARE( secrets.resumption_master_secret, md_size, ASSERT_COMPARE( secrets.resumption_master_secret, hash_len,
resumption_expected->x, resumption_expected->len ); resumption_expected->x, resumption_expected->len );
PSA_DONE( ); PSA_DONE( );
@ -4319,24 +4315,23 @@ void ssl_tls13_create_psk_binder( int hash_alg,
unsigned char binder[ MBEDTLS_MD_MAX_SIZE ]; unsigned char binder[ MBEDTLS_MD_MAX_SIZE ];
/* Double-check that we've passed sane parameters. */ /* Double-check that we've passed sane parameters. */
mbedtls_md_type_t md_type = (mbedtls_md_type_t) hash_alg; psa_algorithm_t alg = (psa_algorithm_t) hash_alg;
mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); size_t const hash_len = PSA_HASH_LENGTH( alg );
size_t const md_size = mbedtls_md_get_size( md_info ); TEST_ASSERT( PSA_ALG_IS_HASH( alg ) &&
TEST_ASSERT( md_info != 0 && transcript->len == hash_len &&
transcript->len == md_size && binder_expected->len == hash_len );
binder_expected->len == md_size );
PSA_INIT( ); PSA_INIT( );
TEST_ASSERT( mbedtls_ssl_tls13_create_psk_binder( TEST_ASSERT( mbedtls_ssl_tls13_create_psk_binder(
NULL, /* SSL context for debugging only */ NULL, /* SSL context for debugging only */
md_type, alg,
psk->x, psk->len, psk->x, psk->len,
psk_type, psk_type,
transcript->x, transcript->x,
binder ) == 0 ); binder ) == 0 );
ASSERT_COMPARE( binder, md_size, ASSERT_COMPARE( binder, hash_len,
binder_expected->x, binder_expected->len ); binder_expected->x, binder_expected->len );
PSA_DONE( ); PSA_DONE( );
@ -4455,7 +4450,7 @@ void ssl_tls13_key_evolution( int hash_alg,
PSA_INIT(); PSA_INIT();
TEST_ASSERT( mbedtls_ssl_tls13_evolve_secret( TEST_ASSERT( mbedtls_ssl_tls13_evolve_secret(
(mbedtls_md_type_t) hash_alg, (psa_algorithm_t) hash_alg,
secret->len ? secret->x : NULL, secret->len ? secret->x : NULL,
input->len ? input->x : NULL, input->len, input->len ? input->x : NULL, input->len,
secret_new ) == 0 ); secret_new ) == 0 );