mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-02-26 12:39:55 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Change mbedtls_ssl_tls13_key_schedule_stage_handshake() to use psa_raw_key_agreement()

Browse Source 
Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
This commit is contained in:
Przemyslaw Stekiel 2022-02-10 10:37:15 +01:00
parent 6d6aabdb0d
commit c0824bfb11
1 changed files with 27 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
library/ssl_tls13_keys.c
View File

@ -1116,10 +1116,11 @@ exit:
int mbedtls_ssl_tls13_key_schedule_stage_handshake( mbedtls_ssl_context *ssl ) int mbedtls_ssl_tls13_key_schedule_stage_handshake( mbedtls_ssl_context *ssl )
{ {
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) && defined(MBEDTLS_ECDH_C)
psa_status_t status = PSA_ERROR_GENERIC_ERROR;
#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED && MBEDTLS_ECDH_C */
mbedtls_ssl_handshake_params *handshake = ssl->handshake; mbedtls_ssl_handshake_params *handshake = ssl->handshake;
mbedtls_md_type_t const md_type = handshake->ciphersuite_info->mac; mbedtls_md_type_t const md_type = handshake->ciphersuite_info->mac;
size_t ephemeral_len = 0;
unsigned char ecdhe[MBEDTLS_ECP_MAX_BYTES];
#if defined(MBEDTLS_DEBUG_C) #if defined(MBEDTLS_DEBUG_C)
mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
size_t const md_size = mbedtls_md_get_size( md_info ); size_t const md_size = mbedtls_md_get_size( md_info );
@ -1136,15 +1137,28 @@ int mbedtls_ssl_tls13_key_schedule_stage_handshake( mbedtls_ssl_context *ssl )
if( mbedtls_ssl_tls13_named_group_is_ecdhe( handshake->offered_group_id ) ) if( mbedtls_ssl_tls13_named_group_is_ecdhe( handshake->offered_group_id ) )
{ {
#if defined(MBEDTLS_ECDH_C) #if defined(MBEDTLS_ECDH_C)
ret = mbedtls_ecdh_calc_secret( &handshake->ecdh_ctx, /* Compute ECDH shared secret. */
&ephemeral_len, ecdhe, sizeof( ecdhe ), status = psa_raw_key_agreement(
ssl->conf->f_rng, PSA_ALG_ECDH, handshake->ecdh_psa_privkey,
ssl->conf->p_rng ); handshake->ecdh_psa_peerkey, handshake->ecdh_psa_peerkey_len,
if( ret != 0 ) handshake->premaster, sizeof( handshake->premaster ),
{ &handshake->pmslen );
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret ); if( status != PSA_SUCCESS )
return( ret ); {
} ret = psa_ssl_status_to_mbedtls( status );
MBEDTLS_SSL_DEBUG_RET( 1, "psa_raw_key_agreement", ret );
return( ret );
}
status = psa_destroy_key( handshake->ecdh_psa_privkey );
if( status != PSA_SUCCESS )
{
ret = psa_ssl_status_to_mbedtls( status );
MBEDTLS_SSL_DEBUG_RET( 1, "psa_destroy_key", ret );
return( ret );
}
handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
#endif /* MBEDTLS_ECDH_C */ #endif /* MBEDTLS_ECDH_C */
} }
else if( mbedtls_ssl_tls13_named_group_is_dhe( handshake->offered_group_id ) ) else if( mbedtls_ssl_tls13_named_group_is_dhe( handshake->offered_group_id ) )
@ -1162,7 +1176,7 @@ int mbedtls_ssl_tls13_key_schedule_stage_handshake( mbedtls_ssl_context *ssl )
*/ */
ret = mbedtls_ssl_tls13_evolve_secret( md_type, ret = mbedtls_ssl_tls13_evolve_secret( md_type,
handshake->tls13_master_secrets.early, handshake->tls13_master_secrets.early,
ecdhe, ephemeral_len, handshake->premaster, handshake->pmslen,
handshake->tls13_master_secrets.handshake ); handshake->tls13_master_secrets.handshake );
if( ret != 0 ) if( ret != 0 )
{ {
@ -1174,7 +1188,7 @@ int mbedtls_ssl_tls13_key_schedule_stage_handshake( mbedtls_ssl_context *ssl )
handshake->tls13_master_secrets.handshake, md_size ); handshake->tls13_master_secrets.handshake, md_size );
#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED)
mbedtls_platform_zeroize( ecdhe, sizeof( ecdhe ) ); mbedtls_platform_zeroize( handshake->premaster, sizeof( handshake->premaster ) );
#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED */ #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED */
return( 0 ); return( 0 );
} }