diff options
author | lloyd <[email protected]> | 2015-01-08 12:57:15 +0000 |
---|---|---|
committer | lloyd <[email protected]> | 2015-01-08 12:57:15 +0000 |
commit | e1d118f4973e2d5f58971acfb8aa28f4fc3085e2 (patch) | |
tree | 27f6b90c8e87ed000ce2c0540e4bcab63891a730 /src | |
parent | a62473b5f0a893db620d8658d75374a50a67e496 (diff) |
Change TLS session encryption to use AES-256/GCM instead of CBC+HMAC
Diffstat (limited to 'src')
-rw-r--r-- | src/lib/constructs/cryptobox_psk/cryptobox_psk.cpp | 133 | ||||
-rw-r--r-- | src/lib/constructs/cryptobox_psk/cryptobox_psk.h | 47 | ||||
-rw-r--r-- | src/lib/constructs/cryptobox_psk/info.txt | 10 | ||||
-rw-r--r-- | src/lib/tls/info.txt | 2 | ||||
-rw-r--r-- | src/lib/tls/tls_session.cpp | 36 |
5 files changed, 26 insertions, 202 deletions
diff --git a/src/lib/constructs/cryptobox_psk/cryptobox_psk.cpp b/src/lib/constructs/cryptobox_psk/cryptobox_psk.cpp deleted file mode 100644 index 8fb3a9aae..000000000 --- a/src/lib/constructs/cryptobox_psk/cryptobox_psk.cpp +++ /dev/null @@ -1,133 +0,0 @@ -/* -* Cryptobox Message Routines -* (C) 2013 Jack Lloyd -* -* Distributed under the terms of the Botan license -*/ - -#include <botan/cryptobox_psk.h> -#include <botan/pipe.h> -#include <botan/lookup.h> -#include <botan/loadstor.h> - -namespace Botan { - -namespace CryptoBox { - -namespace { - -const u32bit CRYPTOBOX_MAGIC = 0x571B0E4F; -const std::string CRYPTOBOX_CIPHER = "AES-256/CBC"; -const std::string CRYPTOBOX_MAC = "HMAC(SHA-256)"; -const std::string CRYPTOBOX_KDF = "KDF2(SHA-256)"; - -const size_t MAGIC_LENGTH = 4; -const size_t KEY_KDF_SALT_LENGTH = 10; -const size_t MAC_KEY_LENGTH = 32; -const size_t CIPHER_KEY_LENGTH = 32; -const size_t CIPHER_IV_LENGTH = 16; -const size_t MAC_OUTPUT_LENGTH = 32; - -} - -std::vector<byte> encrypt(const byte input[], size_t input_len, - const SymmetricKey& master_key, - RandomNumberGenerator& rng) - { - std::unique_ptr<KDF> kdf(get_kdf(CRYPTOBOX_KDF)); - - const secure_vector<byte> cipher_key_salt = - rng.random_vec(KEY_KDF_SALT_LENGTH); - - const secure_vector<byte> mac_key_salt = - rng.random_vec(KEY_KDF_SALT_LENGTH); - - SymmetricKey cipher_key = - kdf->derive_key(CIPHER_KEY_LENGTH, - master_key.bits_of(), - cipher_key_salt); - - SymmetricKey mac_key = - kdf->derive_key(MAC_KEY_LENGTH, - master_key.bits_of(), - mac_key_salt); - - InitializationVector cipher_iv(rng, 16); - - std::unique_ptr<MessageAuthenticationCode> mac(get_mac(CRYPTOBOX_MAC)); - mac->set_key(mac_key); - - Pipe pipe(get_cipher(CRYPTOBOX_CIPHER, cipher_key, cipher_iv, ENCRYPTION)); - pipe.process_msg(input, input_len); - secure_vector<byte> ctext = pipe.read_all(0); - - std::vector<byte> out(MAGIC_LENGTH); - store_be(CRYPTOBOX_MAGIC, &out[0]); - out += cipher_key_salt; - out += mac_key_salt; - out += cipher_iv.bits_of(); - out += ctext; - - mac->update(out); - - out += mac->final(); - return out; - } - -secure_vector<byte> decrypt(const byte input[], size_t input_len, - const SymmetricKey& master_key) - { - const size_t MIN_CTEXT_SIZE = 16; // due to using CBC with padding - - const size_t MIN_POSSIBLE_LENGTH = - MAGIC_LENGTH + - 2 * KEY_KDF_SALT_LENGTH + - CIPHER_IV_LENGTH + - MIN_CTEXT_SIZE + - MAC_OUTPUT_LENGTH; - - if(input_len < MIN_POSSIBLE_LENGTH) - throw Decoding_Error("Encrypted input too short to be valid"); - - if(load_be<u32bit>(input, 0) != CRYPTOBOX_MAGIC) - throw Decoding_Error("Unknown header value in cryptobox"); - - std::unique_ptr<KDF> kdf(get_kdf(CRYPTOBOX_KDF)); - - const byte* cipher_key_salt = &input[MAGIC_LENGTH]; - - const byte* mac_key_salt = &input[MAGIC_LENGTH + KEY_KDF_SALT_LENGTH]; - - SymmetricKey mac_key = kdf->derive_key(MAC_KEY_LENGTH, - master_key.bits_of(), - mac_key_salt, - KEY_KDF_SALT_LENGTH); - - std::unique_ptr<MessageAuthenticationCode> mac(get_mac(CRYPTOBOX_MAC)); - mac->set_key(mac_key); - - mac->update(&input[0], input_len - MAC_OUTPUT_LENGTH); - secure_vector<byte> computed_mac = mac->final(); - - if(!same_mem(&input[input_len - MAC_OUTPUT_LENGTH], &computed_mac[0], computed_mac.size())) - throw Decoding_Error("MAC verification failed"); - - SymmetricKey cipher_key = - kdf->derive_key(CIPHER_KEY_LENGTH, - master_key.bits_of(), - cipher_key_salt, KEY_KDF_SALT_LENGTH); - - InitializationVector cipher_iv(&input[MAGIC_LENGTH+2*KEY_KDF_SALT_LENGTH], - CIPHER_IV_LENGTH); - - const size_t CTEXT_OFFSET = MAGIC_LENGTH + 2 * KEY_KDF_SALT_LENGTH + CIPHER_IV_LENGTH; - - Pipe pipe(get_cipher(CRYPTOBOX_CIPHER, cipher_key, cipher_iv, DECRYPTION)); - pipe.process_msg(&input[CTEXT_OFFSET], - input_len - (MAC_OUTPUT_LENGTH + CTEXT_OFFSET)); - return pipe.read_all(); - } - -} - -} diff --git a/src/lib/constructs/cryptobox_psk/cryptobox_psk.h b/src/lib/constructs/cryptobox_psk/cryptobox_psk.h deleted file mode 100644 index 2f16ee461..000000000 --- a/src/lib/constructs/cryptobox_psk/cryptobox_psk.h +++ /dev/null @@ -1,47 +0,0 @@ -/* -* Cryptobox Message Routines -* (C) 2009,2013 Jack Lloyd -* -* Distributed under the terms of the Botan license -*/ - -#ifndef BOTAN_CRYPTOBOX_PSK_H__ -#define BOTAN_CRYPTOBOX_PSK_H__ - -#include <string> -#include <botan/rng.h> -#include <botan/symkey.h> - -namespace Botan { - -/** -* This namespace holds various high-level crypto functions -*/ -namespace CryptoBox { - -/** -* Encrypt a message using a shared secret key -* @param input the input data -* @param input_len the length of input in bytes -* @param key the key used to encrypt the message -* @param rng a ref to a random number generator, such as AutoSeeded_RNG -*/ -BOTAN_DLL std::vector<byte> encrypt(const byte input[], size_t input_len, - const SymmetricKey& key, - RandomNumberGenerator& rng); - -/** -* Encrypt a message using a shared secret key -* @param input the input data -* @param input_len the length of input in bytes -* @param key the key used to encrypt the message -* @param rng a ref to a random number generator, such as AutoSeeded_RNG -*/ -BOTAN_DLL secure_vector<byte> decrypt(const byte input[], size_t input_len, - const SymmetricKey& key); - -} - -} - -#endif diff --git a/src/lib/constructs/cryptobox_psk/info.txt b/src/lib/constructs/cryptobox_psk/info.txt deleted file mode 100644 index 03f7525f5..000000000 --- a/src/lib/constructs/cryptobox_psk/info.txt +++ /dev/null @@ -1,10 +0,0 @@ -define CRYPTOBOX_PSK 20131128 - -<requires> -aes -cbc -hmac -kdf2 -rng -sha2_64 -</requires> diff --git a/src/lib/tls/info.txt b/src/lib/tls/info.txt index b3d9066b6..530ee1121 100644 --- a/src/lib/tls/info.txt +++ b/src/lib/tls/info.txt @@ -68,9 +68,7 @@ tls_version.cpp aead aes asn1 -cbc credentials -cryptobox_psk dh ecdh ecdsa diff --git a/src/lib/tls/tls_session.cpp b/src/lib/tls/tls_session.cpp index 5080d9f79..1891e6e4e 100644 --- a/src/lib/tls/tls_session.cpp +++ b/src/lib/tls/tls_session.cpp @@ -10,7 +10,7 @@ #include <botan/ber_dec.h> #include <botan/asn1_str.h> #include <botan/pem.h> -#include <botan/cryptobox_psk.h> +#include <botan/aead.h> namespace Botan { @@ -151,26 +151,42 @@ std::chrono::seconds Session::session_age() const } std::vector<byte> -Session::encrypt(const SymmetricKey& master_key, - RandomNumberGenerator& rng) const +Session::encrypt(const SymmetricKey& key, RandomNumberGenerator& rng) const { - const auto der = this->DER_encode(); + std::unique_ptr<AEAD_Mode> aead(get_aead("AES-256/GCM", ENCRYPTION)); + const size_t nonce_len = aead->default_nonce_length(); + aead->set_key(key); - return CryptoBox::encrypt(&der[0], der.size(), master_key, rng); + const secure_vector<byte> nonce = rng.random_vec(nonce_len); + + secure_vector<byte> buf = rng.random_vec(nonce_len); + buf += this->DER_encode(); + aead->start(&buf[0], nonce_len); + aead->finish(buf, nonce_len); + return unlock(buf); } -Session Session::decrypt(const byte buf[], size_t buf_len, - const SymmetricKey& master_key) +Session Session::decrypt(const byte in[], size_t in_len, const SymmetricKey& key) { try { - const auto ber = CryptoBox::decrypt(buf, buf_len, master_key); + std::unique_ptr<AEAD_Mode> aead(get_aead("AES-256/GCM", DECRYPTION)); + const size_t nonce_len = aead->default_nonce_length(); + + if(in_len < nonce_len + aead->tag_size()) + throw Decoding_Error("Encrypted session too short to be valid"); + + aead->set_key(key); + + aead->start(in, nonce_len); + secure_vector<byte> buf(in + nonce_len, in + in_len); + aead->finish(buf, 0); - return Session(&ber[0], ber.size()); + return Session(&buf[0], buf.size()); } catch(std::exception& e) { - throw Decoding_Error("Failed to decrypt encrypted session -" + + throw Decoding_Error("Failed to decrypt serialized TLS session: " + std::string(e.what())); } } |