gr1ffon/quic-go
1
0
Fork 0
forked from quic-go/quic-go
Code Pull Requests Activity

rename the current key derivation function

Browse Source 
TLS will use a completely different key derivation function.
This commit is contained in:
Marten Seemann
2017-09-03 21:33:59 +08:00
parent fd780e3eab
commit 8df2cb3b1d
4 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
crypto/key_derivation.go → crypto/key_derivation_quic_crypto.go
View File

@@ -20,8 +20,8 @@ import (
// return NewAEADChacha20Poly1305(otherKey, myKey, otherIV, myIV) // return NewAEADChacha20Poly1305(otherKey, myKey, otherIV, myIV)
// } // }
// DeriveKeysAESGCM derives the client and server keys and creates a matching AES-GCM AEAD instance // DeriveQuicCryptoAESKeys derives the client and server keys and creates a matching AES-GCM AEAD instance
func DeriveKeysAESGCM(forwardSecure bool, sharedSecret, nonces []byte, connID protocol.ConnectionID, chlo []byte, scfg []byte, cert []byte, divNonce []byte, pers protocol.Perspective) (AEAD, error) { func DeriveQuicCryptoAESKeys(forwardSecure bool, sharedSecret, nonces []byte, connID protocol.ConnectionID, chlo []byte, scfg []byte, cert []byte, divNonce []byte, pers protocol.Perspective) (AEAD, error) {
var swap bool var swap bool
if pers == protocol.PerspectiveClient { if pers == protocol.PerspectiveClient {
swap = true swap = true

14
crypto/key_derivation_test.go → crypto/key_derivation_quic_crypto_test.go
View File

@@ -7,7 +7,7 @@ import (
. "github.com/onsi/gomega" . "github.com/onsi/gomega"
) )
var _ = Describe("KeyDerivation", func() { var _ = Describe("QUIC Crypto Key Derivation", func() {
// Context("chacha20poly1305", func() { // Context("chacha20poly1305", func() {
// It("derives non-fs keys", func() { // It("derives non-fs keys", func() {
// aead, err := DeriveKeysChacha20( // aead, err := DeriveKeysChacha20(
@@ -88,7 +88,7 @@ var _ = Describe("KeyDerivation", func() {
Context("AES-GCM", func() { Context("AES-GCM", func() {
It("derives non-forward secure keys", func() { It("derives non-forward secure keys", func() {
aead, err := DeriveKeysAESGCM( aead, err := DeriveQuicCryptoAESKeys(
false, false,
[]byte("0123456789012345678901"), []byte("0123456789012345678901"),
[]byte("nonce"), []byte("nonce"),
@@ -107,7 +107,7 @@ var _ = Describe("KeyDerivation", func() {
}) })
It("uses the diversification nonce when generating non-forwared secure keys", func() { It("uses the diversification nonce when generating non-forwared secure keys", func() {
aead1, err := DeriveKeysAESGCM( aead1, err := DeriveQuicCryptoAESKeys(
false, false,
[]byte("0123456789012345678901"), []byte("0123456789012345678901"),
[]byte("nonce"), []byte("nonce"),
@@ -119,7 +119,7 @@ var _ = Describe("KeyDerivation", func() {
protocol.PerspectiveServer, protocol.PerspectiveServer,
) )
Expect(err).ToNot(HaveOccurred()) Expect(err).ToNot(HaveOccurred())
aead2, err := DeriveKeysAESGCM( aead2, err := DeriveQuicCryptoAESKeys(
false, false,
[]byte("0123456789012345678901"), []byte("0123456789012345678901"),
[]byte("nonce"), []byte("nonce"),
@@ -138,7 +138,7 @@ var _ = Describe("KeyDerivation", func() {
}) })
It("derives non-forward secure keys, for the other side", func() { It("derives non-forward secure keys, for the other side", func() {
aead, err := DeriveKeysAESGCM( aead, err := DeriveQuicCryptoAESKeys(
false, false,
[]byte("0123456789012345678901"), []byte("0123456789012345678901"),
[]byte("nonce"), []byte("nonce"),
@@ -157,7 +157,7 @@ var _ = Describe("KeyDerivation", func() {
}) })
It("derives forward secure keys", func() { It("derives forward secure keys", func() {
aead, err := DeriveKeysAESGCM( aead, err := DeriveQuicCryptoAESKeys(
true, true,
[]byte("0123456789012345678901"), []byte("0123456789012345678901"),
[]byte("nonce"), []byte("nonce"),
@@ -176,7 +176,7 @@ var _ = Describe("KeyDerivation", func() {
}) })
It("does not use div-nonce for FS key derivation", func() { It("does not use div-nonce for FS key derivation", func() {
aead, err := DeriveKeysAESGCM( aead, err := DeriveQuicCryptoAESKeys(
true, true,
[]byte("0123456789012345678901"), []byte("0123456789012345678901"),
[]byte("nonce"), []byte("nonce"),

4
handshake/crypto_setup_client.go
View File

@@ -42,7 +42,7 @@ type cryptoSetupClient struct {
clientHelloCounter int clientHelloCounter int
serverVerified bool // has the certificate chain and the proof already been verified serverVerified bool // has the certificate chain and the proof already been verified
keyDerivation KeyDerivationFunction keyDerivation QuicCryptoKeyDerivationFunction
keyExchange KeyExchangeFunction keyExchange KeyExchangeFunction
receivedSecurePacket bool receivedSecurePacket bool
@@ -82,7 +82,7 @@ func NewCryptoSetupClient(
cryptoStream: cryptoStream, cryptoStream: cryptoStream,
certManager: crypto.NewCertManager(tlsConfig), certManager: crypto.NewCertManager(tlsConfig),
connectionParameters: connectionParameters, connectionParameters: connectionParameters,
keyDerivation: crypto.DeriveKeysAESGCM, keyDerivation: crypto.DeriveQuicCryptoAESKeys,
keyExchange: getEphermalKEX, keyExchange: getEphermalKEX,
nullAEAD: crypto.NewNullAEAD(protocol.PerspectiveClient, version), nullAEAD: crypto.NewNullAEAD(protocol.PerspectiveClient, version),
aeadChanged: aeadChanged, aeadChanged: aeadChanged,

8
handshake/crypto_setup_server.go
View File

@@ -15,8 +15,8 @@ import (
"github.com/lucas-clemente/quic-go/qerr" "github.com/lucas-clemente/quic-go/qerr"
) )
// KeyDerivationFunction is used for key derivation // QuicCryptoKeyDerivationFunction is used for key derivation
type KeyDerivationFunction func(forwardSecure bool, sharedSecret, nonces []byte, connID protocol.ConnectionID, chlo []byte, scfg []byte, cert []byte, divNonce []byte, pers protocol.Perspective) (crypto.AEAD, error) type QuicCryptoKeyDerivationFunction func(forwardSecure bool, sharedSecret, nonces []byte, connID protocol.ConnectionID, chlo []byte, scfg []byte, cert []byte, divNonce []byte, pers protocol.Perspective) (crypto.AEAD, error)
// KeyExchangeFunction is used to make a new KEX // KeyExchangeFunction is used to make a new KEX
type KeyExchangeFunction func() crypto.KeyExchange type KeyExchangeFunction func() crypto.KeyExchange
@@ -42,7 +42,7 @@ type cryptoSetupServer struct {
sentSHLO chan struct{} // this channel is closed as soon as the SHLO has been written sentSHLO chan struct{} // this channel is closed as soon as the SHLO has been written
aeadChanged chan<- protocol.EncryptionLevel aeadChanged chan<- protocol.EncryptionLevel
keyDerivation KeyDerivationFunction keyDerivation QuicCryptoKeyDerivationFunction
keyExchange KeyExchangeFunction keyExchange KeyExchangeFunction
cryptoStream io.ReadWriter cryptoStream io.ReadWriter
@@ -87,7 +87,7 @@ func NewCryptoSetup(
supportedVersions: supportedVersions, supportedVersions: supportedVersions,
scfg: scfg, scfg: scfg,
stkGenerator: stkGenerator, stkGenerator: stkGenerator,
keyDerivation: crypto.DeriveKeysAESGCM, keyDerivation: crypto.DeriveQuicCryptoAESKeys,
keyExchange: getEphermalKEX, keyExchange: getEphermalKEX,
nullAEAD: crypto.NewNullAEAD(protocol.PerspectiveServer, version), nullAEAD: crypto.NewNullAEAD(protocol.PerspectiveServer, version),
cryptoStream: cryptoStream, cryptoStream: cryptoStream,