diff --git a/internal/crypto/key_derivation.go b/internal/crypto/key_derivation.go index 316bd1b3b..5cffba590 100644 --- a/internal/crypto/key_derivation.go +++ b/internal/crypto/key_derivation.go @@ -1,13 +1,16 @@ package crypto import ( + "crypto" + "encoding/binary" + "github.com/bifurcation/mint" "github.com/lucas-clemente/quic-go/internal/protocol" ) const ( - clientExporterLabel = "EXPORTER-QUIC client 1-RTT Secret" - serverExporterLabel = "EXPORTER-QUIC server 1-RTT Secret" + clientExporterLabel = "EXPORTER-QUIC client 1rtt" + serverExporterLabel = "EXPORTER-QUIC server 1rtt" ) // A TLSExporter gets the negotiated ciphersuite and computes exporter @@ -16,6 +19,16 @@ type TLSExporter interface { ComputeExporter(label string, context []byte, keyLength int) ([]byte, error) } +func qhkdfExpand(secret []byte, label string, length int) []byte { + // The last byte should be 0x0. + // Since Go initializes the slice to 0, we don't need to set it explicitly. + qlabel := make([]byte, 2+1+5+len(label)+1) + binary.BigEndian.PutUint16(qlabel[0:2], uint16(length)) + qlabel[2] = uint8(5 + len(label)) + copy(qlabel[3:], []byte("QUIC "+label)) + return mint.HkdfExpand(crypto.SHA256, secret, qlabel, length) +} + // DeriveAESKeys derives the AES keys and creates a matching AES-GCM AEAD instance func DeriveAESKeys(tls TLSExporter, pers protocol.Perspective) (AEAD, error) { var myLabel, otherLabel string @@ -43,7 +56,7 @@ func computeKeyAndIV(tls TLSExporter, label string) (key, iv []byte, err error) if err != nil { return nil, nil, err } - key = mint.HkdfExpandLabel(cs.Hash, secret, "key", nil, cs.KeyLen) - iv = mint.HkdfExpandLabel(cs.Hash, secret, "iv", nil, cs.IvLen) + key = qhkdfExpand(secret, "key", cs.KeyLen) + iv = qhkdfExpand(secret, "iv", cs.IvLen) return key, iv, nil } diff --git a/internal/crypto/key_derivation_test.go b/internal/crypto/key_derivation_test.go index 6b2499d75..ab4be762d 100644 --- a/internal/crypto/key_derivation_test.go +++ b/internal/crypto/key_derivation_test.go @@ -46,16 +46,6 @@ var _ = Describe("Key Derivation", func() { Expect(data).To(Equal([]byte("foobar"))) }) - It("fails when different hash functions are used", func() { - clientAEAD, err := DeriveAESKeys(&mockTLSExporter{hash: crypto.SHA256}, protocol.PerspectiveClient) - Expect(err).ToNot(HaveOccurred()) - serverAEAD, err := DeriveAESKeys(&mockTLSExporter{hash: crypto.SHA512}, protocol.PerspectiveServer) - Expect(err).ToNot(HaveOccurred()) - ciphertext := clientAEAD.Seal(nil, []byte("foobar"), 0, []byte("aad")) - _, err = serverAEAD.Open(nil, ciphertext, 0, []byte("aad")) - Expect(err).To(MatchError("cipher: message authentication failed")) - }) - It("fails when computing the exporter fails", func() { testErr := errors.New("test error") _, err := DeriveAESKeys(&mockTLSExporter{hash: crypto.SHA256, computerError: testErr}, protocol.PerspectiveClient) diff --git a/internal/crypto/null_aead_aesgcm.go b/internal/crypto/null_aead_aesgcm.go index a647ad7f6..0b192b52b 100644 --- a/internal/crypto/null_aead_aesgcm.go +++ b/internal/crypto/null_aead_aesgcm.go @@ -31,14 +31,14 @@ func newNullAEADAESGCM(connectionID protocol.ConnectionID, pers protocol.Perspec func computeSecrets(connectionID protocol.ConnectionID) (clientSecret, serverSecret []byte) { connID := make([]byte, 8) binary.BigEndian.PutUint64(connID, uint64(connectionID)) - cleartextSecret := mint.HkdfExtract(crypto.SHA256, []byte(quicVersion1Salt), connID) - clientSecret = mint.HkdfExpandLabel(crypto.SHA256, cleartextSecret, "QUIC client cleartext Secret", []byte{}, crypto.SHA256.Size()) - serverSecret = mint.HkdfExpandLabel(crypto.SHA256, cleartextSecret, "QUIC server cleartext Secret", []byte{}, crypto.SHA256.Size()) + handshakeSecret := mint.HkdfExtract(crypto.SHA256, quicVersion1Salt, connID) + clientSecret = qhkdfExpand(handshakeSecret, "client hs", crypto.SHA256.Size()) + serverSecret = qhkdfExpand(handshakeSecret, "server hs", crypto.SHA256.Size()) return } func computeNullAEADKeyAndIV(secret []byte) (key, iv []byte) { - key = mint.HkdfExpandLabel(crypto.SHA256, secret, "key", nil, 16) - iv = mint.HkdfExpandLabel(crypto.SHA256, secret, "iv", nil, 12) + key = qhkdfExpand(secret, "key", 16) + iv = qhkdfExpand(secret, "iv", 12) return } diff --git a/internal/crypto/null_aead_aesgcm_test.go b/internal/crypto/null_aead_aesgcm_test.go index f5d8a49ed..e5090b55b 100644 --- a/internal/crypto/null_aead_aesgcm_test.go +++ b/internal/crypto/null_aead_aesgcm_test.go @@ -14,16 +14,16 @@ var _ = Describe("NullAEAD using AES-GCM", func() { It("computes the secrets", func() { clientSecret, serverSecret := computeSecrets(connID) Expect(clientSecret).To(Equal([]byte{ - 0x31, 0xba, 0x96, 0x68, 0x73, 0xf7, 0xf4, 0x53, - 0xe6, 0xc8, 0xa1, 0xbf, 0x78, 0xed, 0x70, 0x13, - 0xfa, 0xd8, 0x3f, 0xfc, 0xee, 0xfc, 0x95, 0x68, - 0x81, 0xcd, 0x24, 0x1c, 0x0a, 0xe3, 0xa7, 0xa6, + 0x8e, 0x28, 0x6a, 0x27, 0x38, 0xe6, 0x66, 0x50, + 0xb4, 0xf8, 0x8f, 0xac, 0x5d, 0xc5, 0xd0, 0xef, + 0x7d, 0x36, 0x9b, 0x07, 0xd4, 0x74, 0x42, 0x99, + 0x1a, 0x00, 0x0c, 0x55, 0xac, 0xc4, 0x0c, 0xf4, })) Expect(serverSecret).To(Equal([]byte{ - 0x91, 0xa9, 0xe4, 0x22, 0x2c, 0xcb, 0xb9, 0xa9, - 0x8f, 0x14, 0xc8, 0xe1, 0xbe, 0xfd, 0x6a, 0x79, - 0xf0, 0x4e, 0x42, 0xa2, 0x4f, 0xbe, 0xb4, 0x83, - 0x1f, 0x50, 0x26, 0x80, 0x7a, 0xe8, 0x4c, 0xc3, + 0xfa, 0xb5, 0xb7, 0xf5, 0x26, 0xec, 0xaf, 0xaf, + 0x74, 0x71, 0x52, 0xdd, 0xaa, 0x88, 0x28, 0x56, + 0xf9, 0xbe, 0xd7, 0x48, 0x81, 0x1e, 0x37, 0xff, + 0xe1, 0xcb, 0xb1, 0x55, 0xe1, 0xc9, 0x91, 0xad, })) }) @@ -31,12 +31,12 @@ var _ = Describe("NullAEAD using AES-GCM", func() { clientSecret, _ := computeSecrets(connID) key, iv := computeNullAEADKeyAndIV(clientSecret) Expect(key).To(Equal([]byte{ - 0x2e, 0xbd, 0x78, 0x00, 0xdb, 0xed, 0x20, 0x10, - 0xe5, 0xa2, 0x1c, 0x4a, 0xd2, 0x4b, 0x4e, 0xc3, + 0x6b, 0x6a, 0xbc, 0x50, 0xf7, 0xac, 0x46, 0xd1, + 0x10, 0x8c, 0x19, 0xcc, 0x63, 0x64, 0xbd, 0xe3, })) Expect(iv).To(Equal([]byte{ - 0x55, 0x44, 0x0d, 0x5f, 0xf7, 0x50, 0x3d, 0xe4, - 0x99, 0x7b, 0xfd, 0x6b, + 0xb1, 0xf9, 0xa7, 0xe2, 0x7c, 0xc2, 0x33, 0xbb, + 0x99, 0xe2, 0x03, 0x71, })) }) @@ -44,12 +44,12 @@ var _ = Describe("NullAEAD using AES-GCM", func() { _, serverSecret := computeSecrets(connID) key, iv := computeNullAEADKeyAndIV(serverSecret) Expect(key).To(Equal([]byte{ - 0xc8, 0xea, 0x1b, 0xc1, 0x71, 0xe5, 0x2b, 0xae, - 0x71, 0xfb, 0x78, 0x39, 0x52, 0xc7, 0xb8, 0xfc, + 0x9e, 0xe7, 0xe8, 0x57, 0x72, 0x00, 0x59, 0xaf, + 0x30, 0x11, 0xfb, 0x26, 0xe1, 0x21, 0x42, 0xc9, })) Expect(iv).To(Equal([]byte{ - 0x57, 0x82, 0x3b, 0x85, 0x2c, 0x7e, 0xf9, 0xe3, - 0x80, 0x2b, 0x69, 0x0b, + 0xd5, 0xee, 0xe8, 0xb5, 0x7c, 0x9e, 0xc7, 0xc4, + 0xbe, 0x98, 0x4a, 0xa5, })) }) })