aboutsummaryrefslogtreecommitdiffstats
path: root/src/lib/tls
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/tls')
-rw-r--r--src/lib/tls/msg_cert_verify.cpp7
-rw-r--r--src/lib/tls/msg_client_kex.cpp10
-rw-r--r--src/lib/tls/msg_server_kex.cpp7
-rw-r--r--src/lib/tls/tls_client.cpp2
-rw-r--r--src/lib/tls/tls_messages.h6
-rw-r--r--src/lib/tls/tls_server.cpp2
6 files changed, 19 insertions, 15 deletions
diff --git a/src/lib/tls/msg_cert_verify.cpp b/src/lib/tls/msg_cert_verify.cpp
index 6b59e703f..cc162f8a0 100644
--- a/src/lib/tls/msg_cert_verify.cpp
+++ b/src/lib/tls/msg_cert_verify.cpp
@@ -28,7 +28,7 @@ Certificate_Verify::Certificate_Verify(Handshake_IO& io,
std::pair<std::string, Signature_Format> format =
state.choose_sig_format(*priv_key, m_hash_algo, m_sig_algo, true, policy);
- PK_Signer signer(*priv_key, format.first, format.second);
+ PK_Signer signer(*priv_key, rng, format.first, format.second);
m_signature = signer.sign_message(state.hash().get_contents(), rng);
@@ -78,7 +78,8 @@ std::vector<byte> Certificate_Verify::serialize() const
*/
bool Certificate_Verify::verify(const X509_Certificate& cert,
const Handshake_State& state,
- const Policy& policy) const
+ const Policy& policy,
+ RandomNumberGenerator& rng) const
{
std::unique_ptr<Public_Key> key(cert.subject_public_key());
@@ -88,7 +89,7 @@ bool Certificate_Verify::verify(const X509_Certificate& cert,
state.parse_sig_format(*key.get(), m_hash_algo, m_sig_algo,
true, policy);
- PK_Verifier verifier(*key, format.first, format.second);
+ PK_Verifier verifier(*key, rng, format.first, format.second);
return verifier.verify_message(state.hash().get_contents(), m_signature);
}
diff --git a/src/lib/tls/msg_client_kex.cpp b/src/lib/tls/msg_client_kex.cpp
index 0eceadb3b..02ebcc2c8 100644
--- a/src/lib/tls/msg_client_kex.cpp
+++ b/src/lib/tls/msg_client_kex.cpp
@@ -114,7 +114,7 @@ Client_Key_Exchange::Client_Key_Exchange(Handshake_IO& io,
DH_PrivateKey priv_key(rng, group);
- PK_Key_Agreement ka(priv_key, "Raw");
+ PK_Key_Agreement ka(priv_key, rng, "Raw");
secure_vector<byte> dh_secret = CT::strip_leading_zeros(
ka.derive_key(0, counterparty_key.public_value()).bits_of());
@@ -159,7 +159,7 @@ Client_Key_Exchange::Client_Key_Exchange(Handshake_IO& io,
ECDH_PrivateKey priv_key(rng, group);
- PK_Key_Agreement ka(priv_key, "Raw");
+ PK_Key_Agreement ka(priv_key, rng, "Raw");
secure_vector<byte> ecdh_secret =
ka.derive_key(0, counterparty_key.public_value()).bits_of();
@@ -232,7 +232,7 @@ Client_Key_Exchange::Client_Key_Exchange(Handshake_IO& io,
m_pre_master[0] = offered_version.major_version();
m_pre_master[1] = offered_version.minor_version();
- PK_Encryptor_EME encryptor(*rsa_pub, "PKCS1v15");
+ PK_Encryptor_EME encryptor(*rsa_pub, rng, "PKCS1v15");
const std::vector<byte> encrypted_key = encryptor.encrypt(m_pre_master, rng);
@@ -273,7 +273,7 @@ Client_Key_Exchange::Client_Key_Exchange(const std::vector<byte>& contents,
TLS_Data_Reader reader("ClientKeyExchange", contents);
const std::vector<byte> encrypted_pre_master = reader.get_range<byte>(2, 0, 65535);
- PK_Decryptor_EME decryptor(*server_rsa_kex_key, "PKCS1v15");
+ PK_Decryptor_EME decryptor(*server_rsa_kex_key, rng, "PKCS1v15");
const byte client_major = state.client_hello()->version().major_version();
const byte client_minor = state.client_hello()->version().minor_version();
@@ -350,7 +350,7 @@ Client_Key_Exchange::Client_Key_Exchange(const std::vector<byte>& contents,
try
{
- PK_Key_Agreement ka(*ka_key, "Raw");
+ PK_Key_Agreement ka(*ka_key, rng, "Raw");
std::vector<byte> client_pubkey;
diff --git a/src/lib/tls/msg_server_kex.cpp b/src/lib/tls/msg_server_kex.cpp
index 33b980ba9..3df23955b 100644
--- a/src/lib/tls/msg_server_kex.cpp
+++ b/src/lib/tls/msg_server_kex.cpp
@@ -133,7 +133,7 @@ Server_Key_Exchange::Server_Key_Exchange(Handshake_IO& io,
std::pair<std::string, Signature_Format> format =
state.choose_sig_format(*signing_key, m_hash_algo, m_sig_algo, false, policy);
- PK_Signer signer(*signing_key, format.first, format.second);
+ PK_Signer signer(*signing_key, rng, format.first, format.second);
signer.update(state.client_hello()->random());
signer.update(state.server_hello()->random());
@@ -237,7 +237,8 @@ std::vector<byte> Server_Key_Exchange::serialize() const
*/
bool Server_Key_Exchange::verify(const Public_Key& server_key,
const Handshake_State& state,
- const Policy& policy) const
+ const Policy& policy,
+ RandomNumberGenerator& rng) const
{
policy.check_peer_key_acceptable(server_key);
@@ -245,7 +246,7 @@ bool Server_Key_Exchange::verify(const Public_Key& server_key,
state.parse_sig_format(server_key, m_hash_algo, m_sig_algo,
false, policy);
- PK_Verifier verifier(server_key, format.first, format.second);
+ PK_Verifier verifier(server_key, rng, format.first, format.second);
verifier.update(state.client_hello()->random());
verifier.update(state.server_hello()->random());
diff --git a/src/lib/tls/tls_client.cpp b/src/lib/tls/tls_client.cpp
index 0e72b9a28..6bfbdc008 100644
--- a/src/lib/tls/tls_client.cpp
+++ b/src/lib/tls/tls_client.cpp
@@ -415,7 +415,7 @@ void Client::process_handshake_msg(const Handshake_State* active_state,
{
const Public_Key& server_key = state.get_server_public_Key();
- if(!state.server_kex()->verify(server_key, state, policy()))
+ if(!state.server_kex()->verify(server_key, state, policy(), rng()))
{
throw TLS_Exception(Alert::DECRYPT_ERROR,
"Bad signature on server key exchange");
diff --git a/src/lib/tls/tls_messages.h b/src/lib/tls/tls_messages.h
index 25228c865..76421bf4a 100644
--- a/src/lib/tls/tls_messages.h
+++ b/src/lib/tls/tls_messages.h
@@ -482,7 +482,8 @@ class BOTAN_DLL Certificate_Verify final : public Handshake_Message
*/
bool verify(const X509_Certificate& cert,
const Handshake_State& state,
- const Policy& policy) const;
+ const Policy& policy,
+ RandomNumberGenerator& rng) const;
Certificate_Verify(Handshake_IO& io,
Handshake_State& state,
@@ -551,7 +552,8 @@ class Server_Key_Exchange final : public Handshake_Message
bool verify(const Public_Key& server_key,
const Handshake_State& state,
- const Policy& policy) const;
+ const Policy& policy,
+ RandomNumberGenerator& rng) const;
// Only valid for certain kex types
const Private_Key& server_kex_key() const;
diff --git a/src/lib/tls/tls_server.cpp b/src/lib/tls/tls_server.cpp
index 1676ef659..510a30421 100644
--- a/src/lib/tls/tls_server.cpp
+++ b/src/lib/tls/tls_server.cpp
@@ -509,7 +509,7 @@ void Server::process_certificate_verify_msg(Server_Handshake_State& pending_stat
pending_state.client_certs()->cert_chain();
const bool sig_valid =
- pending_state.client_verify()->verify ( client_certs[0], pending_state, policy() );
+ pending_state.client_verify()->verify ( client_certs[0], pending_state, policy(), rng() );
pending_state.hash().update ( pending_state.handshake_io().format ( contents, type ) );
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-20 08:44:04 +0000