Change TLS session encryption to use AES-256/GCM instead of CBC+HMAC

5 files changed, 26 insertions, 202 deletions

diff --git a/src/lib/constructs/cryptobox_psk/cryptobox_psk.cpp b/src/lib/constructs/cryptobox_psk/cryptobox_psk.cpp
deleted file mode 100644
index 8fb3a9aae..000000000
--- a/src/lib/constructs/cryptobox_psk/cryptobox_psk.cpp
+++ /dev/null
@@ -1,133 +0,0 @@
-/*
-* Cryptobox Message Routines
-* (C) 2013 Jack Lloyd
-*
-* Distributed under the terms of the Botan license
-*/
-
-#include <botan/cryptobox_psk.h>
-#include <botan/pipe.h>
-#include <botan/lookup.h>
-#include <botan/loadstor.h>
-
-namespace Botan {
-
-namespace CryptoBox {
-
-namespace {
-
-const u32bit CRYPTOBOX_MAGIC = 0x571B0E4F;
-const std::string CRYPTOBOX_CIPHER = "AES-256/CBC";
-const std::string CRYPTOBOX_MAC = "HMAC(SHA-256)";
-const std::string CRYPTOBOX_KDF = "KDF2(SHA-256)";
-
-const size_t MAGIC_LENGTH = 4;
-const size_t KEY_KDF_SALT_LENGTH = 10;
-const size_t MAC_KEY_LENGTH = 32;
-const size_t CIPHER_KEY_LENGTH = 32;
-const size_t CIPHER_IV_LENGTH = 16;
-const size_t MAC_OUTPUT_LENGTH = 32;
-
-}
-
-std::vector<byte> encrypt(const byte input[], size_t input_len,
-                          const SymmetricKey& master_key,
-                          RandomNumberGenerator& rng)
-   {
-   std::unique_ptr<KDF> kdf(get_kdf(CRYPTOBOX_KDF));
-
-   const secure_vector<byte> cipher_key_salt =
-      rng.random_vec(KEY_KDF_SALT_LENGTH);
-
-   const secure_vector<byte> mac_key_salt =
-      rng.random_vec(KEY_KDF_SALT_LENGTH);
-
-   SymmetricKey cipher_key =
-      kdf->derive_key(CIPHER_KEY_LENGTH,
-                      master_key.bits_of(),
-                      cipher_key_salt);
-
-   SymmetricKey mac_key =
-      kdf->derive_key(MAC_KEY_LENGTH,
-                      master_key.bits_of(),
-                      mac_key_salt);
-
-   InitializationVector cipher_iv(rng, 16);
-
-   std::unique_ptr<MessageAuthenticationCode> mac(get_mac(CRYPTOBOX_MAC));
-   mac->set_key(mac_key);
-
-   Pipe pipe(get_cipher(CRYPTOBOX_CIPHER, cipher_key, cipher_iv, ENCRYPTION));
-   pipe.process_msg(input, input_len);
-   secure_vector<byte> ctext = pipe.read_all(0);
-
-   std::vector<byte> out(MAGIC_LENGTH);
-   store_be(CRYPTOBOX_MAGIC, &out[0]);
-   out += cipher_key_salt;
-   out += mac_key_salt;
-   out += cipher_iv.bits_of();
-   out += ctext;
-
-   mac->update(out);
-
-   out += mac->final();
-   return out;
-   }
-
-secure_vector<byte> decrypt(const byte input[], size_t input_len,
-                            const SymmetricKey& master_key)
-   {
-   const size_t MIN_CTEXT_SIZE = 16; // due to using CBC with padding
-
-   const size_t MIN_POSSIBLE_LENGTH =
-      MAGIC_LENGTH +
-      2 * KEY_KDF_SALT_LENGTH +
-      CIPHER_IV_LENGTH +
-      MIN_CTEXT_SIZE +
-      MAC_OUTPUT_LENGTH;
-
-   if(input_len < MIN_POSSIBLE_LENGTH)
-      throw Decoding_Error("Encrypted input too short to be valid");
-
-   if(load_be<u32bit>(input, 0) != CRYPTOBOX_MAGIC)
-      throw Decoding_Error("Unknown header value in cryptobox");
-
-   std::unique_ptr<KDF> kdf(get_kdf(CRYPTOBOX_KDF));
-
-   const byte* cipher_key_salt = &input[MAGIC_LENGTH];
-
-   const byte* mac_key_salt = &input[MAGIC_LENGTH + KEY_KDF_SALT_LENGTH];
-
-   SymmetricKey mac_key = kdf->derive_key(MAC_KEY_LENGTH,
-                                          master_key.bits_of(),
-                                          mac_key_salt,
-                                          KEY_KDF_SALT_LENGTH);
-
-   std::unique_ptr<MessageAuthenticationCode> mac(get_mac(CRYPTOBOX_MAC));
-   mac->set_key(mac_key);
-
-   mac->update(&input[0], input_len - MAC_OUTPUT_LENGTH);
-   secure_vector<byte> computed_mac = mac->final();
-
-   if(!same_mem(&input[input_len - MAC_OUTPUT_LENGTH], &computed_mac[0], computed_mac.size()))
-      throw Decoding_Error("MAC verification failed");
-
-   SymmetricKey cipher_key =
-      kdf->derive_key(CIPHER_KEY_LENGTH,
-                      master_key.bits_of(),
-                      cipher_key_salt, KEY_KDF_SALT_LENGTH);
-
-   InitializationVector cipher_iv(&input[MAGIC_LENGTH+2*KEY_KDF_SALT_LENGTH],
-                                  CIPHER_IV_LENGTH);
-
-   const size_t CTEXT_OFFSET = MAGIC_LENGTH + 2 * KEY_KDF_SALT_LENGTH + CIPHER_IV_LENGTH;
-
-   Pipe pipe(get_cipher(CRYPTOBOX_CIPHER, cipher_key, cipher_iv, DECRYPTION));
-   pipe.process_msg(&input[CTEXT_OFFSET],
-                    input_len - (MAC_OUTPUT_LENGTH + CTEXT_OFFSET));
-   return pipe.read_all();
-   }
-
-}
-
-}
diff --git a/src/lib/constructs/cryptobox_psk/cryptobox_psk.h b/src/lib/constructs/cryptobox_psk/cryptobox_psk.h
deleted file mode 100644
index 2f16ee461..000000000
--- a/src/lib/constructs/cryptobox_psk/cryptobox_psk.h
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
-* Cryptobox Message Routines
-* (C) 2009,2013 Jack Lloyd
-*
-* Distributed under the terms of the Botan license
-*/
-
-#ifndef BOTAN_CRYPTOBOX_PSK_H__
-#define BOTAN_CRYPTOBOX_PSK_H__
-
-#include <string>
-#include <botan/rng.h>
-#include <botan/symkey.h>
-
-namespace Botan {
-
-/**
-* This namespace holds various high-level crypto functions
-*/
-namespace CryptoBox {
-
-/**
-* Encrypt a message using a shared secret key
-* @param input the input data
-* @param input_len the length of input in bytes
-* @param key the key used to encrypt the message
-* @param rng a ref to a random number generator, such as AutoSeeded_RNG
-*/
-BOTAN_DLL std::vector<byte> encrypt(const byte input[], size_t input_len,
-                                    const SymmetricKey& key,
-                                    RandomNumberGenerator& rng);
-
-/**
-* Encrypt a message using a shared secret key
-* @param input the input data
-* @param input_len the length of input in bytes
-* @param key the key used to encrypt the message
-* @param rng a ref to a random number generator, such as AutoSeeded_RNG
-*/
-BOTAN_DLL secure_vector<byte> decrypt(const byte input[], size_t input_len,
-                                      const SymmetricKey& key);
-
-}
-
-}
-
-#endif
diff --git a/src/lib/constructs/cryptobox_psk/info.txt b/src/lib/constructs/cryptobox_psk/info.txt
deleted file mode 100644
index 03f7525f5..000000000
--- a/src/lib/constructs/cryptobox_psk/info.txt
+++ /dev/null
@@ -1,10 +0,0 @@
-define CRYPTOBOX_PSK 20131128
-
-<requires>
-aes
-cbc
-hmac
-kdf2
-rng
-sha2_64
-</requires>
diff --git a/src/lib/tls/info.txt b/src/lib/tls/info.txt
index b3d9066b6..530ee1121 100644
--- a/src/lib/tls/info.txt
+++ b/src/lib/tls/info.txt
@@ -68,9 +68,7 @@ tls_version.cpp
 aead
 aes
 asn1
-cbc
 credentials
-cryptobox_psk
 dh
 ecdh
 ecdsa
diff --git a/src/lib/tls/tls_session.cpp b/src/lib/tls/tls_session.cpp
index 5080d9f79..1891e6e4e 100644
--- a/src/lib/tls/tls_session.cpp
+++ b/src/lib/tls/tls_session.cpp
@@ -10,7 +10,7 @@
 #include <botan/ber_dec.h>
 #include <botan/asn1_str.h>
 #include <botan/pem.h>
-#include <botan/cryptobox_psk.h>
+#include <botan/aead.h>
 
 namespace Botan {
 
@@ -151,26 +151,42 @@ std::chrono::seconds Session::session_age() const
    }
 
 std::vector<byte>
-Session::encrypt(const SymmetricKey& master_key,
-                 RandomNumberGenerator& rng) const
+Session::encrypt(const SymmetricKey& key, RandomNumberGenerator& rng) const
    {
-   const auto der = this->DER_encode();
+   std::unique_ptr<AEAD_Mode> aead(get_aead("AES-256/GCM", ENCRYPTION));
+   const size_t nonce_len = aead->default_nonce_length();
+   aead->set_key(key);
 
-   return CryptoBox::encrypt(&der[0], der.size(), master_key, rng);
+   const secure_vector<byte> nonce = rng.random_vec(nonce_len);
+
+   secure_vector<byte> buf = rng.random_vec(nonce_len);
+   buf += this->DER_encode();
+   aead->start(&buf[0], nonce_len);
+   aead->finish(buf, nonce_len);
+   return unlock(buf);
    }
 
-Session Session::decrypt(const byte buf[], size_t buf_len,
-                         const SymmetricKey& master_key)
+Session Session::decrypt(const byte in[], size_t in_len, const SymmetricKey& key)
    {
    try
       {
-      const auto ber = CryptoBox::decrypt(buf, buf_len, master_key);
+      std::unique_ptr<AEAD_Mode> aead(get_aead("AES-256/GCM", DECRYPTION));
+      const size_t nonce_len = aead->default_nonce_length();
+
+      if(in_len < nonce_len + aead->tag_size())
+         throw Decoding_Error("Encrypted session too short to be valid");
+
+      aead->set_key(key);
+
+      aead->start(in, nonce_len);
+      secure_vector<byte> buf(in + nonce_len, in + in_len);
+      aead->finish(buf, 0);
 
-      return Session(&ber[0], ber.size());
+      return Session(&buf[0], buf.size());
       }
    catch(std::exception& e)
       {
-      throw Decoding_Error("Failed to decrypt encrypted session -" +
+      throw Decoding_Error("Failed to decrypt serialized TLS session: " +
                            std::string(e.what()));
       }
    }