tlspuffin/tls/
key_exchange.rs

1use puffin::algebra::error::FnError;
2use ring::test::rand::FixedByteRandom;
3
4use super::rustls::suites::SupportedCipherSuite;
5use crate::tls::rustls::conn::ConnectionRandoms;
6use crate::tls::rustls::kx::{KeyExchange, SupportedKxGroup, ALL_KX_GROUPS};
7use crate::tls::rustls::msgs::enums::NamedGroup;
8use crate::tls::rustls::msgs::handshake::Random;
9use crate::tls::rustls::tls12::ConnectionSecrets;
10
11fn deterministic_key_exchange(skxg: &'static SupportedKxGroup) -> Result<KeyExchange, FnError> {
12    let random = FixedByteRandom { byte: 42 };
13    let ours = ring::agreement::EphemeralPrivateKey::generate(skxg.agreement_algorithm, &random)
14        .map_err(|_err| FnError::Crypto("Failed to generate ephemeral key".to_string()))?;
15
16    let pubkey = ours
17        .compute_public_key()
18        .map_err(|_err| FnError::Crypto("Failed to compute public key".to_string()))?;
19
20    Ok(KeyExchange {
21        skxg,
22        privkey: ours,
23        pubkey,
24    })
25}
26
27pub fn deterministic_key_share(group: &NamedGroup) -> Result<Vec<u8>, FnError> {
28    if let Some(supported_group) = ALL_KX_GROUPS
29        .iter()
30        .find(|supported| supported.name == *group)
31    {
32        Ok(Vec::from(
33            deterministic_key_exchange(supported_group)?.pubkey.as_ref(),
34        ))
35    } else {
36        Err(FnError::Crypto("Unable to find named group".to_string()))
37    }
38}
39
40pub fn tls13_key_exchange(server_key_share: &[u8], group: &NamedGroup) -> Result<Vec<u8>, FnError> {
41    // Shared Secret
42    let skxg = KeyExchange::choose(*group, &ALL_KX_GROUPS)
43        .ok_or_else(|| FnError::Malformed("Failed to choose group in key exchange".to_string()))?;
44    let kx: KeyExchange = deterministic_key_exchange(skxg)?;
45    let shared_secret = kx
46        .complete(server_key_share, |secret| Ok(Vec::from(secret)))
47        .map_err(|_err| FnError::Crypto("Failed to compute shared secret".to_string()))?;
48    Ok(shared_secret)
49}
50
51pub fn tls12_key_exchange(group: &NamedGroup) -> Result<KeyExchange, FnError> {
52    let skxg = KeyExchange::choose(*group, &ALL_KX_GROUPS)
53        .ok_or_else(|| FnError::Malformed("Failed to find key exchange group".to_string()))?;
54    let kx: KeyExchange = deterministic_key_exchange(skxg)?;
55    Ok(kx)
56}
57
58pub fn tls12_new_secrets(
59    server_random: &Random,
60    peer_ecdh_pubkey: &[u8],
61    group: &NamedGroup,
62    client_random: &Random,
63    suite: SupportedCipherSuite,
64) -> Result<ConnectionSecrets, FnError> {
65    let randoms = ConnectionRandoms {
66        client: client_random.0,
67        server: server_random.0,
68    };
69    let kx = tls12_key_exchange(group)?;
70    let suite = suite
71        .tls12()
72        .ok_or_else(|| FnError::Malformed("VersionNotCompatibleError".to_string()))?;
73    let secrets = ConnectionSecrets::from_key_exchange(kx, peer_ecdh_pubkey, None, randoms, suite)
74        .map_err(|_err| FnError::Crypto("Failed to shared secrets for TLS 1.2".to_string()))?;
75    // master_secret is: 01 40 26 dd 53 3c 0a...
76    Ok(secrets)
77}
78
79#[cfg(test)]
80mod tests {
81    use crate::tls::key_exchange::deterministic_key_exchange;
82    use crate::tls::rustls::kx::SECP384R1;
83
84    #[test_log::test]
85    fn test_deterministic_key() {
86        let a = deterministic_key_exchange(&SECP384R1).unwrap();
87        let b = deterministic_key_exchange(&SECP384R1).unwrap();
88
89        assert_eq!(a.pubkey.as_ref(), b.pubkey.as_ref())
90    }
91}
tlspuffin/tls/key_exchange.rs

tlspuffin/tls/
key_exchange.rs
