FilesExpand file tree

main

/

key_schedule.go

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

85 lines (72 loc) · 2.62 KB

main

/

key_schedule.go

Copy path

Top

File metadata and controls

• Code
• Blame

85 lines (72 loc) · 2.62 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

// Copyright 2018 The Go Authors. All rights reserved.

// Use of this source code is governed by a BSD-style

// license that can be found in the LICENSE-Go file.

package reality

import (

"crypto/ecdh"

"crypto/hmac"

"crypto/mlkem"

"errors"

"hash"

"io"

"github.com/xtls/reality/tls13"

)

// This file contains the functions necessary to compute the TLS 1.3 key

// schedule. See RFC 8446, Section 7.

// nextTrafficSecret generates the next traffic secret, given the current one,

// according to RFC 8446, Section 7.2.

func (c *cipherSuiteTLS13) nextTrafficSecret(trafficSecret []byte) []byte {

return tls13.ExpandLabel(c.hash.New, trafficSecret, "traffic upd", nil, c.hash.Size())

}

// trafficKey generates traffic keys according to RFC 8446, Section 7.3.

func (c *cipherSuiteTLS13) trafficKey(trafficSecret []byte) (key, iv []byte) {

key = tls13.ExpandLabel(c.hash.New, trafficSecret, "key", nil, c.keyLen)

iv = tls13.ExpandLabel(c.hash.New, trafficSecret, "iv", nil, aeadNonceLength)

return

}

// finishedHash generates the Finished verify_data or PskBinderEntry according

// to RFC 8446, Section 4.4.4. See sections 4.4 and 4.2.11.2 for the baseKey

// selection.

func (c *cipherSuiteTLS13) finishedHash(baseKey []byte, transcript hash.Hash) []byte {

finishedKey := tls13.ExpandLabel(c.hash.New, baseKey, "finished", nil, c.hash.Size())

verifyData := hmac.New(c.hash.New, finishedKey)

verifyData.Write(transcript.Sum(nil))

return verifyData.Sum(nil)

}

// exportKeyingMaterial implements RFC5705 exporters for TLS 1.3 according to

// RFC 8446, Section 7.5.

func (c *cipherSuiteTLS13) exportKeyingMaterial(s *tls13.MasterSecret, transcript hash.Hash) func(string, []byte, int) ([]byte, error) {

expMasterSecret := s.ExporterMasterSecret(transcript)

return func(label string, context []byte, length int) ([]byte, error) {

return expMasterSecret.Exporter(label, context, length), nil

}

}

type keySharePrivateKeys struct {

curveID CurveID

ecdhe *ecdh.PrivateKey

mlkem *mlkem.DecapsulationKey768

}

const x25519PublicKeySize = 32

// generateECDHEKey returns a PrivateKey that implements Diffie-Hellman

// according to RFC 8446, Section 4.2.8.2.

func generateECDHEKey(rand io.Reader, curveID CurveID) (*ecdh.PrivateKey, error) {

curve, ok := curveForCurveID(curveID)

if !ok {

return nil, errors.New("tls: internal error: unsupported curve")

}

return curve.GenerateKey(rand)

}

func curveForCurveID(id CurveID) (ecdh.Curve, bool) {

switch id {

case X25519:

return ecdh.X25519(), true

case CurveP256:

return ecdh.P256(), true

case CurveP384:

return ecdh.P384(), true

case CurveP521:

return ecdh.P521(), true

default:

return nil, false

}

}