src/crypto/sha1-tlsprf.c

   1 /*
   2  * TLS PRF (SHA1 + MD5)
   3  * Copyright (c) 2003-2005, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "sha1.h"
  19 #include "md5.h"
  20 #include "crypto.h"
  21
  22
  23 /**
  24  * tls_prf - Pseudo-Random Function for TLS (TLS-PRF, RFC 2246)
  25  * @secret: Key for PRF
  26  * @secret_len: Length of the key in bytes
  27  * @label: A unique label for each purpose of the PRF
  28  * @seed: Seed value to bind into the key
  29  * @seed_len: Length of the seed
  30  * @out: Buffer for the generated pseudo-random key
  31  * @outlen: Number of bytes of key to generate
  32  * Returns: 0 on success, -1 on failure.
  33  *
  34  * This function is used to derive new, cryptographically separate keys from a
  35  * given key in TLS. This PRF is defined in RFC 2246, Chapter 5.
  36  */
  37 int tls_prf(const u8 *secret, size_t secret_len, const char *label,
  38             const u8 *seed, size_t seed_len, u8 *out, size_t outlen)
  39 {
  40         size_t L_S1, L_S2, i;
  41         const u8 *S1, *S2;
  42         u8 A_MD5[MD5_MAC_LEN], A_SHA1[SHA1_MAC_LEN];
  43         u8 P_MD5[MD5_MAC_LEN], P_SHA1[SHA1_MAC_LEN];
  44         int MD5_pos, SHA1_pos;
  45         const u8 *MD5_addr[3];
  46         size_t MD5_len[3];
  47         const unsigned char *SHA1_addr[3];
  48         size_t SHA1_len[3];
  49
  50         if (secret_len & 1)
  51                 return -1;
  52
  53         MD5_addr[0] = A_MD5;
  54         MD5_len[0] = MD5_MAC_LEN;
  55         MD5_addr[1] = (unsigned char *) label;
  56         MD5_len[1] = os_strlen(label);
  57         MD5_addr[2] = seed;
  58         MD5_len[2] = seed_len;
  59
  60         SHA1_addr[0] = A_SHA1;
  61         SHA1_len[0] = SHA1_MAC_LEN;
  62         SHA1_addr[1] = (unsigned char *) label;
  63         SHA1_len[1] = os_strlen(label);
  64         SHA1_addr[2] = seed;
  65         SHA1_len[2] = seed_len;
  66
  67         /* RFC 2246, Chapter 5
  68          * A(0) = seed, A(i) = HMAC(secret, A(i-1))
  69          * P_hash = HMAC(secret, A(1) + seed) + HMAC(secret, A(2) + seed) + ..
  70          * PRF = P_MD5(S1, label + seed) XOR P_SHA-1(S2, label + seed)
  71          */
  72
  73         L_S1 = L_S2 = (secret_len + 1) / 2;
  74         S1 = secret;
  75         S2 = secret + L_S1;
  76         if (secret_len & 1) {
  77                 /* The last byte of S1 will be shared with S2 */
  78                 S2--;
  79         }
  80
  81         hmac_md5_vector_non_fips_allow(S1, L_S1, 2, &MD5_addr[1], &MD5_len[1],
  82                                        A_MD5);
  83         hmac_sha1_vector(S2, L_S2, 2, &SHA1_addr[1], &SHA1_len[1], A_SHA1);
  84
  85         MD5_pos = MD5_MAC_LEN;
  86         SHA1_pos = SHA1_MAC_LEN;
  87         for (i = 0; i < outlen; i++) {
  88                 if (MD5_pos == MD5_MAC_LEN) {
  89                         hmac_md5_vector_non_fips_allow(S1, L_S1, 3, MD5_addr,
  90                                                        MD5_len, P_MD5);
  91                         MD5_pos = 0;
  92                         hmac_md5_non_fips_allow(S1, L_S1, A_MD5, MD5_MAC_LEN,
  93                                                 A_MD5);
  94                 }
  95                 if (SHA1_pos == SHA1_MAC_LEN) {
  96                         hmac_sha1_vector(S2, L_S2, 3, SHA1_addr, SHA1_len,
  97                                          P_SHA1);
  98                         SHA1_pos = 0;
  99                         hmac_sha1(S2, L_S2, A_SHA1, SHA1_MAC_LEN, A_SHA1);
 100                 }
 101
 102                 out[i] = P_MD5[MD5_pos] ^ P_SHA1[SHA1_pos];
 103
 104                 MD5_pos++;
 105                 SHA1_pos++;
 106         }
 107
 108         return 0;
 109 }