1 /*

     2  * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.  Oracle designates this

     8  * particular file as subject to the "Classpath" exception as provided

     9  * by Oracle in the LICENSE file that accompanied this code.

    10  *

    11  * This code is distributed in the hope that it will be useful, but WITHOUT

    12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    14  * version 2 for more details (a copy is included in the LICENSE file that

    15  * accompanied this code).

    16  *

    17  * You should have received a copy of the GNU General Public License version

    18  * 2 along with this work; if not, write to the Free Software Foundation,

    19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    20  *

    21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    22  * or visit www.oracle.com if you need additional information or have any

    23  * questions.

    24  */

    25 

    26 package sun.security.ssl;

    27 

    28 import java.io.IOException;

    29 import java.nio.ByteBuffer;

    30 import java.security.GeneralSecurityException;

    31 import java.security.ProviderException;

    32 import java.security.spec.AlgorithmParameterSpec;

    33 import javax.crypto.KeyGenerator;

    34 import javax.crypto.SecretKey;

    35 import javax.crypto.spec.IvParameterSpec;

    36 import javax.crypto.spec.SecretKeySpec;

    37 import javax.net.ssl.SSLHandshakeException;

    38 import sun.security.internal.spec.TlsKeyMaterialParameterSpec;

    39 import sun.security.internal.spec.TlsKeyMaterialSpec;

    40 import sun.security.ssl.CipherSuite.HashAlg;

    41 import static sun.security.ssl.CipherSuite.HashAlg.H_NONE;

    42 

    43 enum SSLTrafficKeyDerivation implements SSLKeyDerivationGenerator {

    44     SSL30       ("kdf_ssl30", new S30TrafficKeyDerivationGenerator()),

    45     TLS10       ("kdf_tls10", new T10TrafficKeyDerivationGenerator()),

    46     TLS12       ("kdf_tls12", new T12TrafficKeyDerivationGenerator()),

    47     TLS13       ("kdf_tls13", new T13TrafficKeyDerivationGenerator());

    48 

    49     final String name;

    50     final SSLKeyDerivationGenerator keyDerivationGenerator;

    51 

    52     SSLTrafficKeyDerivation(String name,

    53             SSLKeyDerivationGenerator keyDerivationGenerator) {

    54         this.name = name;

    55         this.keyDerivationGenerator = keyDerivationGenerator;

    56     }

    57 

    58     static SSLTrafficKeyDerivation valueOf(ProtocolVersion protocolVersion) {

    59         switch (protocolVersion) {

    60             case SSL30:

    61                 return SSLTrafficKeyDerivation.SSL30;

    62             case TLS10:

    63             case TLS11:

    64             case DTLS10:

    65                 return SSLTrafficKeyDerivation.TLS10;

    66             case TLS12:

    67             case DTLS12:

    68                 return SSLTrafficKeyDerivation.TLS12;

    69             case TLS13:

    70                 return SSLTrafficKeyDerivation.TLS13;

    71         }

    72 

    73         return null;

    74     }

    75 

    76     @Override

    77     public SSLKeyDerivation createKeyDerivation(HandshakeContext context,

    78             SecretKey secretKey) throws IOException {

    79         return keyDerivationGenerator.createKeyDerivation(context, secretKey);

    80     }

    81 

    82     private static final class S30TrafficKeyDerivationGenerator

    83             implements SSLKeyDerivationGenerator {

    84         private S30TrafficKeyDerivationGenerator() {

    85             // blank

    86         }

    87 

    88         @Override

    89         public SSLKeyDerivation createKeyDerivation(

    90             HandshakeContext context, SecretKey secretKey) throws IOException {

    91             return new LegacyTrafficKeyDerivation(context, secretKey);

    92         }

    93     }

    94 

    95     private static final class T10TrafficKeyDerivationGenerator

    96             implements SSLKeyDerivationGenerator {

    97         private T10TrafficKeyDerivationGenerator() {

    98             // blank

    99         }

   100 

   101         @Override

   102         public SSLKeyDerivation createKeyDerivation(

   103             HandshakeContext context, SecretKey secretKey) throws IOException {

   104             return new LegacyTrafficKeyDerivation(context, secretKey);

   105         }

   106     }

   107 

   108     private static final class T12TrafficKeyDerivationGenerator

   109             implements SSLKeyDerivationGenerator {

   110         private T12TrafficKeyDerivationGenerator() {

   111             // blank

   112         }

   113 

   114         @Override

   115         public SSLKeyDerivation createKeyDerivation(

   116             HandshakeContext context, SecretKey secretKey) throws IOException {

   117             return new LegacyTrafficKeyDerivation(context, secretKey);

   118         }

   119     }

   120 

   121     private static final class T13TrafficKeyDerivationGenerator

   122             implements SSLKeyDerivationGenerator {

   123         private T13TrafficKeyDerivationGenerator() {

   124             // blank

   125         }

   126 

   127         @Override

   128         public SSLKeyDerivation createKeyDerivation(

   129                 HandshakeContext context,

   130                 SecretKey secretKey) throws IOException {

   131             return new T13TrafficKeyDerivation(context, secretKey);

   132         }

   133     }

   134 

   135     static final class T13TrafficKeyDerivation implements SSLKeyDerivation {

   136         private final CipherSuite cs;

   137         private final SecretKey secret;

   138 

   139         T13TrafficKeyDerivation(

   140                 HandshakeContext context, SecretKey secret) {

   141             this.secret = secret;

   142             this.cs = context.negotiatedCipherSuite;

   143         }

   144 

   145         @Override

   146         public SecretKey deriveKey(String algorithm,

   147                 AlgorithmParameterSpec params) throws IOException {

   148             KeySchedule ks = KeySchedule.valueOf(algorithm);

   149             try {

   150                 HKDF hkdf = new HKDF(cs.hashAlg.name);

   151                 byte[] hkdfInfo =

   152                         createHkdfInfo(ks.label, ks.getKeyLength(cs));

   153                 return hkdf.expand(secret, hkdfInfo,

   154                         ks.getKeyLength(cs),

   155                         ks.getAlgorithm(cs, algorithm));

   156             } catch (GeneralSecurityException gse) {

   157                 throw (SSLHandshakeException)(new SSLHandshakeException(

   158                     "Could not generate secret").initCause(gse));

   159             }

   160         }

   161 

   162         private static byte[] createHkdfInfo(

   163                 byte[] label, int length) throws IOException {

   164             byte[] info = new byte[4 + label.length];

   165             ByteBuffer m = ByteBuffer.wrap(info);

   166             try {

   167                 Record.putInt16(m, length);

   168                 Record.putBytes8(m, label);

   169                 Record.putInt8(m, 0x00);    // zero-length context

   170             } catch (IOException ioe) {

   171                 // unlikely

   172                 throw new RuntimeException("Unexpected exception", ioe);

   173             }

   174 

   175             return info;

   176         }

   177     }

   178 

   179     private enum KeySchedule {

   180         // Note that we use enum name as the key/ name.

   181         TlsKey              ("key", false),

   182         TlsIv               ("iv",  true),

   183         TlsUpdateNplus1     ("traffic upd", false);

   184 

   185         private final byte[] label;

   186         private final boolean isIv;

   187 

   188         private KeySchedule(String label, boolean isIv) {

   189             this.label = ("tls13 " + label).getBytes();

   190             this.isIv = isIv;

   191         }

   192 

   193         int getKeyLength(CipherSuite cs) {

   194             if (this == KeySchedule.TlsUpdateNplus1)

   195                 return cs.hashAlg.hashLength;

   196             return isIv ? cs.bulkCipher.ivSize : cs.bulkCipher.keySize;

   197         }

   198 

   199         String getAlgorithm(CipherSuite cs, String algorithm) {

   200             return isIv ? algorithm : cs.bulkCipher.algorithm;

   201         }

   202     }

   203 

   204     @SuppressWarnings("deprecation")

   205     static final class LegacyTrafficKeyDerivation implements SSLKeyDerivation {

   206         private final HandshakeContext context;

   207         private final SecretKey masterSecret;

   208         private final TlsKeyMaterialSpec keyMaterialSpec;

   209 

   210         LegacyTrafficKeyDerivation(

   211                 HandshakeContext context, SecretKey masterSecret) {

   212             this.context = context;

   213             this.masterSecret = masterSecret;

   214 

   215             CipherSuite cipherSuite = context.negotiatedCipherSuite;

   216             ProtocolVersion protocolVersion = context.negotiatedProtocol;

   217 

   218             /*

   219              * For both the read and write sides of the protocol, we use the

   220              * master to generate MAC secrets and cipher keying material.  Block

   221              * ciphers need initialization vectors, which we also generate.

   222              *

   223              * First we figure out how much keying material is needed.

   224              */

   225             int hashSize = cipherSuite.macAlg.size;

   226             boolean is_exportable = cipherSuite.exportable;

   227             SSLCipher cipher = cipherSuite.bulkCipher;

   228             int expandedKeySize = is_exportable ? cipher.expandedKeySize : 0;

   229 

   230             // Which algs/params do we need to use?

   231             String keyMaterialAlg;

   232             HashAlg hashAlg;

   233 

   234             byte majorVersion = protocolVersion.major;

   235             byte minorVersion = protocolVersion.minor;

   236             if (protocolVersion.isDTLS) {

   237                 // Use TLS version number for DTLS key calculation

   238                 if (protocolVersion.id == ProtocolVersion.DTLS10.id) {

   239                     majorVersion = ProtocolVersion.TLS11.major;

   240                     minorVersion = ProtocolVersion.TLS11.minor;

   241 

   242                     keyMaterialAlg = "SunTlsKeyMaterial";

   243                     hashAlg = H_NONE;

   244                 } else {    // DTLS 1.2+

   245                     majorVersion = ProtocolVersion.TLS12.major;

   246                     minorVersion = ProtocolVersion.TLS12.minor;

   247 

   248                     keyMaterialAlg = "SunTls12KeyMaterial";

   249                     hashAlg = cipherSuite.hashAlg;

   250                 }

   251             } else {

   252                 if (protocolVersion.id >= ProtocolVersion.TLS12.id) {

   253                     keyMaterialAlg = "SunTls12KeyMaterial";

   254                     hashAlg = cipherSuite.hashAlg;

   255                 } else {

   256                     keyMaterialAlg = "SunTlsKeyMaterial";

   257                     hashAlg = H_NONE;

   258                 }

   259             }

   260 

   261             // TLS v1.1+ and DTLS use an explicit IV in CBC cipher suites to

   262             // protect against the CBC attacks.  AEAD/GCM cipher suites in

   263             // TLS v1.2 or later use a fixed IV as the implicit part of the

   264             // partially implicit nonce technique described in RFC 5116.

   265             int ivSize = cipher.ivSize;

   266             if (cipher.cipherType == CipherType.AEAD_CIPHER) {

   267                 ivSize = cipher.fixedIvSize;

   268             } else if (

   269                     cipher.cipherType == CipherType.BLOCK_CIPHER &&

   270                     protocolVersion.useTLS11PlusSpec()) {

   271                 ivSize = 0;

   272             }

   273 

   274             TlsKeyMaterialParameterSpec spec = new TlsKeyMaterialParameterSpec(

   275                     masterSecret, (majorVersion & 0xFF), (minorVersion & 0xFF),

   276                     context.clientHelloRandom.randomBytes,

   277                     context.serverHelloRandom.randomBytes,

   278                     cipher.algorithm, cipher.keySize, expandedKeySize,

   279                     ivSize, hashSize,

   280                     hashAlg.name, hashAlg.hashLength, hashAlg.blockSize);

   281 

   282             try {

   283                 KeyGenerator kg = JsseJce.getKeyGenerator(keyMaterialAlg);

   284                 kg.init(spec);

   285 

   286                 this.keyMaterialSpec = (TlsKeyMaterialSpec)kg.generateKey();

   287             } catch (GeneralSecurityException e) {

   288                 throw new ProviderException(e);

   289             }

   290         }

   291 

   292         SecretKey getTrafficKey(String algorithm) {

   293             switch (algorithm) {

   294                 case "clientMacKey":

   295                     return keyMaterialSpec.getClientMacKey();

   296                 case "serverMacKey":

   297                     return keyMaterialSpec.getServerMacKey();

   298                 case "clientWriteKey":

   299                     return keyMaterialSpec.getClientCipherKey();

   300                 case "serverWriteKey":

   301                     return keyMaterialSpec.getServerCipherKey();

   302                 case "clientWriteIv":

   303                     IvParameterSpec cliIvSpec = keyMaterialSpec.getClientIv();

   304                     return  (cliIvSpec == null) ? null :

   305                             new SecretKeySpec(cliIvSpec.getIV(), "TlsIv");

   306                 case "serverWriteIv":

   307                     IvParameterSpec srvIvSpec = keyMaterialSpec.getServerIv();

   308                     return  (srvIvSpec == null) ? null :

   309                             new SecretKeySpec(srvIvSpec.getIV(), "TlsIv");

   310             }

   311 

   312             return null;

   313         }

   314 

   315         @Override

   316         public SecretKey deriveKey(String algorithm,

   317                 AlgorithmParameterSpec params) throws IOException {

   318             return getTrafficKey(algorithm);

   319         }

   320     }

   321 }

   322