Outline of RFC 5077 session tickets

5 files changed, 170 insertions, 3 deletions

diff --git a/src/tls/tls_extensions.cpp b/src/tls/tls_extensions.cpp
index c57f7cc81..8f60b5e9b 100644
--- a/src/tls/tls_extensions.cpp
+++ b/src/tls/tls_extensions.cpp
@@ -25,6 +25,8 @@ TLS_Extension* make_extension(TLS_Data_Reader& reader,
       return new SRP_Identifier(reader, size);
    else if(code == TLSEXT_SAFE_RENEGOTIATION)
       return new Renegotation_Extension(reader, size);
+   else if(code == TLSEXT_SESSION_TICKET)
+      return new Session_Ticket(reader, size);
    else if(code == TLSEXT_NEXT_PROTOCOL)
       return new Next_Protocol_Notification(reader, size);
    else
diff --git a/src/tls/tls_extensions.h b/src/tls/tls_extensions.h
index 62f179998..526436862 100644
--- a/src/tls/tls_extensions.h
+++ b/src/tls/tls_extensions.h
@@ -1,6 +1,6 @@
 /*
 * TLS Extensions
-* (C) 2011 Jack Lloyd
+* (C) 2011-2012 Jack Lloyd
 *
 * Released under the terms of the Botan license
 */
@@ -15,6 +15,7 @@
 
 namespace Botan {
 
+class TLS_Session;
 class TLS_Data_Reader;
 
 /**
@@ -176,6 +177,40 @@ class Next_Protocol_Notification : public TLS_Extension
       std::vector<std::string> m_protocols;
    };
 
+class Session_Ticket : public TLS_Extension
+   {
+   public:
+      TLS_Handshake_Extension_Type type() const
+         { return TLSEXT_SESSION_TICKET; }
+
+      /*
+      * Decrypt the session ticket and return the session info;
+      * used by server.
+      */
+      TLS_Session decrypt(const SymmetricKey& key,
+                          const MemoryRegion<byte>& key_name);
+
+      /**
+      * Create empty extension, used by both client and server
+      */
+      Session_Ticket() {}
+
+      /**
+      * Extension with ticket, used by client
+      */
+      Session_Ticket(const MemoryRegion<byte>& session_ticket) :
+         m_contents(session_ticket);
+
+      /**
+      * Deserialize a session ticket
+      */
+      Session_Ticket(const TLS_Data_Reader& reader, u16ibt extension_size);
+
+      MemoryVector<byte> serialize() const { return m_contents; }
+   private:
+      MemoryVector<byte> m_contents;
+   };
+
 /**
 * Represents a block of extensions in a hello message
 */
diff --git a/src/tls/tls_messages.h b/src/tls/tls_messages.h
index 6c2749e42..ed8073bda 100644
--- a/src/tls/tls_messages.h
+++ b/src/tls/tls_messages.h
@@ -79,6 +79,10 @@ class Client_Hello : public Handshake_Message
 
       size_t fragment_size() const { return m_fragment_size; }
 
+      bool supports_session_ticket() const { returnm m_supports_session_ticket; }
+
+      const MemoryRegion<byte> session_ticket() const { return m_session_ticket; }
+
       Client_Hello(Record_Writer& writer,
                    TLS_Handshake_Hash& hash,
                    const TLS_Policy& policy,
@@ -431,6 +435,30 @@ class Next_Protocol : public Handshake_Message
       std::string m_protocol;
    };
 
+class New_Session_Ticket : public Handshake_Message
+   {
+   public:
+      Handshake_Type type() const { return NEW_SESSION_TICKET; }
+
+      static TLS_Session decrypt(const MemoryRegion<byte>& ctext,
+                                 const SymmetricKey& key,
+                                 const MemoryRegion<byte>& key_name);
+
+      const MemoryVector<byte>& contents() const { return m_contents; }
+
+      New_Session_Ticket(const TLS_Session& session_info,
+                         const SymmetricKey& key,
+                         const MemoryRegion<byte>& key_name,
+                         RandomNumberGenerator& rng);
+
+      New_Session_Ticket(const MemoryRegion<byte>& buf) { deserialize(buf); }
+   private:
+      MemoryVector<byte> serialize() const;
+      void deserialize(const MemoryRegion<byte>&);
+
+      MemoryVector<byte> m_contents;
+   };
+
 }
 
 #endif
diff --git a/src/tls/tls_session.cpp b/src/tls/tls_session.cpp
index deaddb227..c40e9d79e 100644
--- a/src/tls/tls_session.cpp
+++ b/src/tls/tls_session.cpp
@@ -1,6 +1,6 @@
 /*
 * TLS Session State
-* (C) 2011 Jack Lloyd
+* (C) 2011-2012 Jack Lloyd
 *
 * Released under the terms of the Botan license
 */
@@ -10,6 +10,8 @@
 #include <botan/ber_dec.h>
 #include <botan/asn1_str.h>
 #include <botan/time.h>
+#include <botan/lookup.h>
+#include <memory>
 
 namespace Botan {
 
@@ -91,4 +93,92 @@ SecureVector<byte> TLS_Session::BER_encode() const
    .get_contents();
    }
 
+MemoryVector<byte>
+TLS_Session::encrypt(const SymmetricKey& master_key,
+                     const MemoryRegion<byte>& key_name,
+                     RandomNumberGenerator& rng)
+   {
+   if(key_name.size() != 16)
+      throw Encoding_Error("Bad length " + to_string(key_name.size()) +
+                           " for key_name in TLS_Session::encrypt");
+
+   if(master_key.length() == 0)
+      throw Decoding_Error("TLS_Session master_key not set");
+
+   std::auto_ptr<KDF> kdf(get_kdf("KDF2(SHA-256)"));
+
+   SymmetricKey aes_key = kdf->derive_key(16, master_key.bits_of(),
+                                          "session-ticket.cipher-key");
+
+   SymmetricKey hmac_key = kdf->derive_key(32, master_key.bits_of(),
+                                           "session-ticket.hmac-key");
+
+   InitializationVector aes_iv(rng, 16);
+
+   std::auto_ptr<MessageAuthenticationCode> mac(get_mac("HMAC(SHA-256)"));
+   mac->set_key(hmac_key);
+
+   Pipe pipe(get_cipher("AES-128/CBC", aes_key, aes_iv, ENCRYPTION));
+   pipe.process_msg(BER_encode());
+   MemoryVector<byte> ctext = pipe.read_all(0);
+
+   MemoryVector<byte> out;
+   out += key_name;
+   out += aes_iv.bits_of();
+   out += ctext;
+
+   mac->update(out);
+
+   out += mac->final();
+   return out;
+   }
+
+TLS_Session TLS_Session::decrypt(const MemoryRegion<byte>& buf,
+                                 const SymmetricKey& master_key,
+                                 const MemoryRegion<byte>& key_name)
+   {
+   try
+      {
+      if(buf.size() < (16 + 16 + 32 + 1))
+         throw Decoding_Error("Encrypted TLS_Session too short to be real");
+
+      if(master_key.length() == 0)
+         throw Decoding_Error("TLS_Session master_key not set");
+
+      if(key_name.size() != 16)
+         throw Decoding_Error("Bad length " + to_string(key_name.size()) +
+                              " for key_name");
+
+      std::auto_ptr<KDF> kdf(get_kdf("KDF2(SHA-256)"));
+
+      SymmetricKey hmac_key = kdf->derive_key(32, master_key.bits_of(),
+                                              "session-ticket.hmac-key");
+
+      std::auto_ptr<MessageAuthenticationCode> mac(get_mac("HMAC(SHA-256)"));
+      mac->set_key(hmac_key);
+
+      mac->update(&buf[0], buf.size() - 32);
+      MemoryVector<byte> computed_mac = mac->final();
+
+      if(!same_mem(&buf[buf.size() - 32], &computed_mac[0], computed_mac.size()))
+         throw Decoding_Error("MAC verification failed");
+
+      SymmetricKey aes_key = kdf->derive_key(16, master_key.bits_of(),
+                                             "session-ticket.cipher-key");
+
+      InitializationVector aes_iv(&buf[16], 16);
+
+      Pipe pipe(get_cipher("AES-128/CBC", aes_key, aes_iv, DECRYPTION));
+      pipe.process_msg(&buf[16], buf.size() - (16 + 32));
+      MemoryVector<byte> ber = pipe.read_all();
+
+      return TLS_Session(&ber[0], ber.size());
+      }
+   catch(...)
+      {
+      throw Decoding_Error("Failed to decrypt encrypted session");
+      }
+   }
+
+
 }
diff --git a/src/tls/tls_session.h b/src/tls/tls_session.h
index b4b3861ed..4a8d50e26 100644
--- a/src/tls/tls_session.h
+++ b/src/tls/tls_session.h
@@ -1,6 +1,6 @@
 /*
 * TLS Session
-* (C) 2011 Jack Lloyd
+* (C) 2011-2012 Jack Lloyd
 *
 * Released under the terms of the Botan license
 */
@@ -11,6 +11,7 @@
 #include <botan/x509cert.h>
 #include <botan/tls_magic.h>
 #include <botan/secmem.h>
+#include <botan/symkey.h>
 
 namespace Botan {
 
@@ -55,6 +56,17 @@ class BOTAN_DLL TLS_Session
       TLS_Session(const byte ber[], size_t ber_len);
 
       /**
+      * Encrypt a session (useful for serialization or session tickets)
+      */
+      MemoryVector<byte> encrypt(const SymmetricKey& key,
+                                 const MemoryRegion<byte>& key_name,
+                                 RandomNumberGenerator& rng);
+
+      static TLS_Session decrypt(const MemoryRegion<byte>& ctext,
+                                 const SymmetricKey& key,
+                                 const MemoryRegion<byte>& key_name);
+
+      /**
       * Encode this session data for storage
       * @warning if the master secret is compromised so is the
       * session traffic