gr1ffon/quic-go
1
0
Fork 0
forked from quic-go/quic-go
Code Pull Requests Activity

implement the recent key schedule changes

Browse Source
This commit is contained in:
Marten Seemann
2018-02-21 12:58:21 +08:00
parent c65b1aca4e
commit dcd2659925
4 changed files with 38 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
internal/crypto/key_derivation.go
View File

@@ -1,13 +1,16 @@
package crypto
import (
"crypto"
"encoding/binary"
"github.com/bifurcation/mint"
"github.com/lucas-clemente/quic-go/internal/protocol"
)
const (
clientExporterLabel = "EXPORTER-QUIC client 1-RTT Secret"
serverExporterLabel = "EXPORTER-QUIC server 1-RTT Secret"
clientExporterLabel = "EXPORTER-QUIC client 1rtt"
serverExporterLabel = "EXPORTER-QUIC server 1rtt"
)
// A TLSExporter gets the negotiated ciphersuite and computes exporter
@@ -16,6 +19,16 @@ type TLSExporter interface {
ComputeExporter(label string, context []byte, keyLength int) ([]byte, error)
}
func qhkdfExpand(secret []byte, label string, length int) []byte {
// The last byte should be 0x0.
// Since Go initializes the slice to 0, we don't need to set it explicitly.
qlabel := make([]byte, 2+1+5+len(label)+1)
binary.BigEndian.PutUint16(qlabel[0:2], uint16(length))
qlabel[2] = uint8(5 + len(label))
copy(qlabel[3:], []byte("QUIC "+label))
return mint.HkdfExpand(crypto.SHA256, secret, qlabel, length)
}
// DeriveAESKeys derives the AES keys and creates a matching AES-GCM AEAD instance
func DeriveAESKeys(tls TLSExporter, pers protocol.Perspective) (AEAD, error) {
var myLabel, otherLabel string
@@ -43,7 +56,7 @@ func computeKeyAndIV(tls TLSExporter, label string) (key, iv []byte, err error)
if err != nil {
return nil, nil, err
}
key = mint.HkdfExpandLabel(cs.Hash, secret, "key", nil, cs.KeyLen)
iv = mint.HkdfExpandLabel(cs.Hash, secret, "iv", nil, cs.IvLen)
key = qhkdfExpand(secret, "key", cs.KeyLen)
iv = qhkdfExpand(secret, "iv", cs.IvLen)
return key, iv, nil
}

10
internal/crypto/key_derivation_test.go
View File

@@ -46,16 +46,6 @@ var _ = Describe("Key Derivation", func() {
Expect(data).To(Equal([]byte("foobar")))
})
It("fails when different hash functions are used", func() {
clientAEAD, err := DeriveAESKeys(&mockTLSExporter{hash: crypto.SHA256}, protocol.PerspectiveClient)
Expect(err).ToNot(HaveOccurred())
serverAEAD, err := DeriveAESKeys(&mockTLSExporter{hash: crypto.SHA512}, protocol.PerspectiveServer)
Expect(err).ToNot(HaveOccurred())
ciphertext := clientAEAD.Seal(nil, []byte("foobar"), 0, []byte("aad"))
_, err = serverAEAD.Open(nil, ciphertext, 0, []byte("aad"))
Expect(err).To(MatchError("cipher: message authentication failed"))
})
It("fails when computing the exporter fails", func() {
testErr := errors.New("test error")
_, err := DeriveAESKeys(&mockTLSExporter{hash: crypto.SHA256, computerError: testErr}, protocol.PerspectiveClient)

10
internal/crypto/null_aead_aesgcm.go
View File

@@ -31,14 +31,14 @@ func newNullAEADAESGCM(connectionID protocol.ConnectionID, pers protocol.Perspec
func computeSecrets(connectionID protocol.ConnectionID) (clientSecret, serverSecret []byte) {
connID := make([]byte, 8)
binary.BigEndian.PutUint64(connID, uint64(connectionID))
cleartextSecret := mint.HkdfExtract(crypto.SHA256, []byte(quicVersion1Salt), connID)
clientSecret = mint.HkdfExpandLabel(crypto.SHA256, cleartextSecret, "QUIC client cleartext Secret", []byte{}, crypto.SHA256.Size())
serverSecret = mint.HkdfExpandLabel(crypto.SHA256, cleartextSecret, "QUIC server cleartext Secret", []byte{}, crypto.SHA256.Size())
handshakeSecret := mint.HkdfExtract(crypto.SHA256, quicVersion1Salt, connID)
clientSecret = qhkdfExpand(handshakeSecret, "client hs", crypto.SHA256.Size())
serverSecret = qhkdfExpand(handshakeSecret, "server hs", crypto.SHA256.Size())
return
}
func computeNullAEADKeyAndIV(secret []byte) (key, iv []byte) {
key = mint.HkdfExpandLabel(crypto.SHA256, secret, "key", nil, 16)
iv = mint.HkdfExpandLabel(crypto.SHA256, secret, "iv", nil, 12)
key = qhkdfExpand(secret, "key", 16)
iv = qhkdfExpand(secret, "iv", 12)
return
}

32
internal/crypto/null_aead_aesgcm_test.go
View File

@@ -14,16 +14,16 @@ var _ = Describe("NullAEAD using AES-GCM", func() {
It("computes the secrets", func() {
clientSecret, serverSecret := computeSecrets(connID)
Expect(clientSecret).To(Equal([]byte{
0x31, 0xba, 0x96, 0x68, 0x73, 0xf7, 0xf4, 0x53,
0xe6, 0xc8, 0xa1, 0xbf, 0x78, 0xed, 0x70, 0x13,
0xfa, 0xd8, 0x3f, 0xfc, 0xee, 0xfc, 0x95, 0x68,
0x81, 0xcd, 0x24, 0x1c, 0x0a, 0xe3, 0xa7, 0xa6,
0x8e, 0x28, 0x6a, 0x27, 0x38, 0xe6, 0x66, 0x50,
0xb4, 0xf8, 0x8f, 0xac, 0x5d, 0xc5, 0xd0, 0xef,
0x7d, 0x36, 0x9b, 0x07, 0xd4, 0x74, 0x42, 0x99,
0x1a, 0x00, 0x0c, 0x55, 0xac, 0xc4, 0x0c, 0xf4,
}))
Expect(serverSecret).To(Equal([]byte{
0x91, 0xa9, 0xe4, 0x22, 0x2c, 0xcb, 0xb9, 0xa9,
0x8f, 0x14, 0xc8, 0xe1, 0xbe, 0xfd, 0x6a, 0x79,
0xf0, 0x4e, 0x42, 0xa2, 0x4f, 0xbe, 0xb4, 0x83,
0x1f, 0x50, 0x26, 0x80, 0x7a, 0xe8, 0x4c, 0xc3,
0xfa, 0xb5, 0xb7, 0xf5, 0x26, 0xec, 0xaf, 0xaf,
0x74, 0x71, 0x52, 0xdd, 0xaa, 0x88, 0x28, 0x56,
0xf9, 0xbe, 0xd7, 0x48, 0x81, 0x1e, 0x37, 0xff,
0xe1, 0xcb, 0xb1, 0x55, 0xe1, 0xc9, 0x91, 0xad,
}))
})
@@ -31,12 +31,12 @@ var _ = Describe("NullAEAD using AES-GCM", func() {
clientSecret, _ := computeSecrets(connID)
key, iv := computeNullAEADKeyAndIV(clientSecret)
Expect(key).To(Equal([]byte{
0x2e, 0xbd, 0x78, 0x00, 0xdb, 0xed, 0x20, 0x10,
0xe5, 0xa2, 0x1c, 0x4a, 0xd2, 0x4b, 0x4e, 0xc3,
0x6b, 0x6a, 0xbc, 0x50, 0xf7, 0xac, 0x46, 0xd1,
0x10, 0x8c, 0x19, 0xcc, 0x63, 0x64, 0xbd, 0xe3,
}))
Expect(iv).To(Equal([]byte{
0x55, 0x44, 0x0d, 0x5f, 0xf7, 0x50, 0x3d, 0xe4,
0x99, 0x7b, 0xfd, 0x6b,
0xb1, 0xf9, 0xa7, 0xe2, 0x7c, 0xc2, 0x33, 0xbb,
0x99, 0xe2, 0x03, 0x71,
}))
})
@@ -44,12 +44,12 @@ var _ = Describe("NullAEAD using AES-GCM", func() {
_, serverSecret := computeSecrets(connID)
key, iv := computeNullAEADKeyAndIV(serverSecret)
Expect(key).To(Equal([]byte{
0xc8, 0xea, 0x1b, 0xc1, 0x71, 0xe5, 0x2b, 0xae,
0x71, 0xfb, 0x78, 0x39, 0x52, 0xc7, 0xb8, 0xfc,
0x9e, 0xe7, 0xe8, 0x57, 0x72, 0x00, 0x59, 0xaf,
0x30, 0x11, 0xfb, 0x26, 0xe1, 0x21, 0x42, 0xc9,
}))
Expect(iv).To(Equal([]byte{
0x57, 0x82, 0x3b, 0x85, 0x2c, 0x7e, 0xf9, 0xe3,
0x80, 0x2b, 0x69, 0x0b,
0xd5, 0xee, 0xe8, 0xb5, 0x7c, 0x9e, 0xc7, 0xc4,
0xbe, 0x98, 0x4a, 0xa5,
}))
})
})