implement the recent key schedule changes

internal/crypto/key_derivation.go

@@ -1,13 +1,16 @@
 package crypto
 
 import (
+	"crypto"
+	"encoding/binary"
+
 	"github.com/bifurcation/mint"
 	"github.com/lucas-clemente/quic-go/internal/protocol"
 )
 
 const (
-	clientExporterLabel = "EXPORTER-QUIC client 1-RTT Secret"
+	clientExporterLabel = "EXPORTER-QUIC client 1rtt"
-	serverExporterLabel = "EXPORTER-QUIC server 1-RTT Secret"
+	serverExporterLabel = "EXPORTER-QUIC server 1rtt"
 )
 
 // A TLSExporter gets the negotiated ciphersuite and computes exporter
@@ -16,6 +19,16 @@ type TLSExporter interface {
 	ComputeExporter(label string, context []byte, keyLength int) ([]byte, error)
 }
 
+func qhkdfExpand(secret []byte, label string, length int) []byte {
+	// The last byte should be 0x0.
+	// Since Go initializes the slice to 0, we don't need to set it explicitly.
+	qlabel := make([]byte, 2+1+5+len(label)+1)
+	binary.BigEndian.PutUint16(qlabel[0:2], uint16(length))
+	qlabel[2] = uint8(5 + len(label))
+	copy(qlabel[3:], []byte("QUIC "+label))
+	return mint.HkdfExpand(crypto.SHA256, secret, qlabel, length)
+}
+
 // DeriveAESKeys derives the AES keys and creates a matching AES-GCM AEAD instance
 func DeriveAESKeys(tls TLSExporter, pers protocol.Perspective) (AEAD, error) {
 	var myLabel, otherLabel string
@@ -43,7 +56,7 @@ func computeKeyAndIV(tls TLSExporter, label string) (key, iv []byte, err error)
 	if err != nil {
 		return nil, nil, err
 	}
-	key = mint.HkdfExpandLabel(cs.Hash, secret, "key", nil, cs.KeyLen)
+	key = qhkdfExpand(secret, "key", cs.KeyLen)
-	iv = mint.HkdfExpandLabel(cs.Hash, secret, "iv", nil, cs.IvLen)
+	iv = qhkdfExpand(secret, "iv", cs.IvLen)
 	return key, iv, nil
 }

internal/crypto/key_derivation_test.go

@@ -46,16 +46,6 @@ var _ = Describe("Key Derivation", func() {
 		Expect(data).To(Equal([]byte("foobar")))
 	})
 
-	It("fails when different hash functions are used", func() {
-		clientAEAD, err := DeriveAESKeys(&mockTLSExporter{hash: crypto.SHA256}, protocol.PerspectiveClient)
-		Expect(err).ToNot(HaveOccurred())
-		serverAEAD, err := DeriveAESKeys(&mockTLSExporter{hash: crypto.SHA512}, protocol.PerspectiveServer)
-		Expect(err).ToNot(HaveOccurred())
-		ciphertext := clientAEAD.Seal(nil, []byte("foobar"), 0, []byte("aad"))
-		_, err = serverAEAD.Open(nil, ciphertext, 0, []byte("aad"))
-		Expect(err).To(MatchError("cipher: message authentication failed"))
-	})
-
 	It("fails when computing the exporter fails", func() {
 		testErr := errors.New("test error")
 		_, err := DeriveAESKeys(&mockTLSExporter{hash: crypto.SHA256, computerError: testErr}, protocol.PerspectiveClient)

internal/crypto/null_aead_aesgcm.go

@@ -31,14 +31,14 @@ func newNullAEADAESGCM(connectionID protocol.ConnectionID, pers protocol.Perspec
 func computeSecrets(connectionID protocol.ConnectionID) (clientSecret, serverSecret []byte) {
 	connID := make([]byte, 8)
 	binary.BigEndian.PutUint64(connID, uint64(connectionID))
-	cleartextSecret := mint.HkdfExtract(crypto.SHA256, []byte(quicVersion1Salt), connID)
+	handshakeSecret := mint.HkdfExtract(crypto.SHA256, quicVersion1Salt, connID)
-	clientSecret = mint.HkdfExpandLabel(crypto.SHA256, cleartextSecret, "QUIC client cleartext Secret", []byte{}, crypto.SHA256.Size())
+	clientSecret = qhkdfExpand(handshakeSecret, "client hs", crypto.SHA256.Size())
-	serverSecret = mint.HkdfExpandLabel(crypto.SHA256, cleartextSecret, "QUIC server cleartext Secret", []byte{}, crypto.SHA256.Size())
+	serverSecret = qhkdfExpand(handshakeSecret, "server hs", crypto.SHA256.Size())
 	return
 }
 
 func computeNullAEADKeyAndIV(secret []byte) (key, iv []byte) {
-	key = mint.HkdfExpandLabel(crypto.SHA256, secret, "key", nil, 16)
+	key = qhkdfExpand(secret, "key", 16)
-	iv = mint.HkdfExpandLabel(crypto.SHA256, secret, "iv", nil, 12)
+	iv = qhkdfExpand(secret, "iv", 12)
 	return
 }

internal/crypto/null_aead_aesgcm_test.go

@@ -14,16 +14,16 @@ var _ = Describe("NullAEAD using AES-GCM", func() {
 		It("computes the secrets", func() {
 			clientSecret, serverSecret := computeSecrets(connID)
 			Expect(clientSecret).To(Equal([]byte{
-				0x31, 0xba, 0x96, 0x68, 0x73, 0xf7, 0xf4, 0x53,
+				0x8e, 0x28, 0x6a, 0x27, 0x38, 0xe6, 0x66, 0x50,
-				0xe6, 0xc8, 0xa1, 0xbf, 0x78, 0xed, 0x70, 0x13,
+				0xb4, 0xf8, 0x8f, 0xac, 0x5d, 0xc5, 0xd0, 0xef,
-				0xfa, 0xd8, 0x3f, 0xfc, 0xee, 0xfc, 0x95, 0x68,
+				0x7d, 0x36, 0x9b, 0x07, 0xd4, 0x74, 0x42, 0x99,
-				0x81, 0xcd, 0x24, 0x1c, 0x0a, 0xe3, 0xa7, 0xa6,
+				0x1a, 0x00, 0x0c, 0x55, 0xac, 0xc4, 0x0c, 0xf4,
 			}))
 			Expect(serverSecret).To(Equal([]byte{
-				0x91, 0xa9, 0xe4, 0x22, 0x2c, 0xcb, 0xb9, 0xa9,
+				0xfa, 0xb5, 0xb7, 0xf5, 0x26, 0xec, 0xaf, 0xaf,
-				0x8f, 0x14, 0xc8, 0xe1, 0xbe, 0xfd, 0x6a, 0x79,
+				0x74, 0x71, 0x52, 0xdd, 0xaa, 0x88, 0x28, 0x56,
-				0xf0, 0x4e, 0x42, 0xa2, 0x4f, 0xbe, 0xb4, 0x83,
+				0xf9, 0xbe, 0xd7, 0x48, 0x81, 0x1e, 0x37, 0xff,
-				0x1f, 0x50, 0x26, 0x80, 0x7a, 0xe8, 0x4c, 0xc3,
+				0xe1, 0xcb, 0xb1, 0x55, 0xe1, 0xc9, 0x91, 0xad,
 			}))
 		})
 
@@ -31,12 +31,12 @@ var _ = Describe("NullAEAD using AES-GCM", func() {
 			clientSecret, _ := computeSecrets(connID)
 			key, iv := computeNullAEADKeyAndIV(clientSecret)
 			Expect(key).To(Equal([]byte{
-				0x2e, 0xbd, 0x78, 0x00, 0xdb, 0xed, 0x20, 0x10,
+				0x6b, 0x6a, 0xbc, 0x50, 0xf7, 0xac, 0x46, 0xd1,
-				0xe5, 0xa2, 0x1c, 0x4a, 0xd2, 0x4b, 0x4e, 0xc3,
+				0x10, 0x8c, 0x19, 0xcc, 0x63, 0x64, 0xbd, 0xe3,
 			}))
 			Expect(iv).To(Equal([]byte{
-				0x55, 0x44, 0x0d, 0x5f, 0xf7, 0x50, 0x3d, 0xe4,
+				0xb1, 0xf9, 0xa7, 0xe2, 0x7c, 0xc2, 0x33, 0xbb,
-				0x99, 0x7b, 0xfd, 0x6b,
+				0x99, 0xe2, 0x03, 0x71,
 			}))
 		})
 
@@ -44,12 +44,12 @@ var _ = Describe("NullAEAD using AES-GCM", func() {
 			_, serverSecret := computeSecrets(connID)
 			key, iv := computeNullAEADKeyAndIV(serverSecret)
 			Expect(key).To(Equal([]byte{
-				0xc8, 0xea, 0x1b, 0xc1, 0x71, 0xe5, 0x2b, 0xae,
+				0x9e, 0xe7, 0xe8, 0x57, 0x72, 0x00, 0x59, 0xaf,
-				0x71, 0xfb, 0x78, 0x39, 0x52, 0xc7, 0xb8, 0xfc,
+				0x30, 0x11, 0xfb, 0x26, 0xe1, 0x21, 0x42, 0xc9,
 			}))
 			Expect(iv).To(Equal([]byte{
-				0x57, 0x82, 0x3b, 0x85, 0x2c, 0x7e, 0xf9, 0xe3,
+				0xd5, 0xee, 0xe8, 0xb5, 0x7c, 0x9e, 0xc7, 0xc4,
-				0x80, 0x2b, 0x69, 0x0b,
+				0xbe, 0x98, 0x4a, 0xa5,
 			}))
 		})
 	})