authorgravatar for jacobly@ziglang.orgJacob Young <jacobly@ziglang.org> 2024-11-06 00:14:27-05:00
committergravatar for jacobly@ziglang.orgJacob Young <jacobly@ziglang.org> 2024-11-07 20:25:26-05:00
log75adba7cb9501f33453275c187bcd7f4b11eaa9d
treed895e1c2b7e79a6390dca57407922280b062b699
parenta4e88abf042f89cf98ff0b54dfe82eb3ad6eaa0b

std.crypto.tls: add support for secp384r1 key share

1 files changed, 23 insertions(+), 8 deletions(-)

lib/std/crypto/tls/Client.zig+23-8
......@@ -191,14 +191,14 @@ pub fn init(stream: anytype, options: Options) InitError(@TypeOf(stream))!Client
191191 };
192192 const host_len: u16 = @intCast(host.len);
193193
194 var random_buffer: [128]u8 = undefined;
194 var random_buffer: [176]u8 = undefined;
195195 crypto.random.bytes(&random_buffer);
196196 const client_hello_rand = random_buffer[0..32].*;
197197 var key_seq: u64 = 0;
198198 var server_hello_rand: [32]u8 = undefined;
199199 const legacy_session_id = random_buffer[32..64].*;
200200
201 var key_share = KeyShare.init(random_buffer[64..128].*) catch |err| switch (err) {
201 var key_share = KeyShare.init(random_buffer[64..176].*) catch |err| switch (err) {
202202 // Only possible to happen if the seed is all zeroes.
203203 error.IdentityElement => return error.InsufficientEntropy,
204204 };
......@@ -223,6 +223,7 @@ pub fn init(stream: anytype, options: Options) InitError(@TypeOf(stream))!Client
223223 })) ++ tls.extension(.supported_groups, array(u16, tls.NamedGroup, .{
224224 .x25519_ml_kem768,
225225 .secp256r1,
226 .secp384r1,
226227 .x25519,
227228 })) ++ tls.extension(.psk_key_exchange_modes, array(u8, tls.PskKeyExchangeMode, .{
228229 .psk_dhe_ke,
......@@ -233,6 +234,8 @@ pub fn init(stream: anytype, options: Options) InitError(@TypeOf(stream))!Client
233234 array(u16, u8, key_share.ml_kem768_kp.public_key.toBytes() ++ key_share.x25519_kp.public_key) ++
234235 int(u16, @intFromEnum(tls.NamedGroup.secp256r1)) ++
235236 array(u16, u8, key_share.secp256r1_kp.public_key.toUncompressedSec1()) ++
237 int(u16, @intFromEnum(tls.NamedGroup.secp384r1)) ++
238 array(u16, u8, key_share.secp384r1_kp.public_key.toUncompressedSec1()) ++
236239 int(u16, @intFromEnum(tls.NamedGroup.x25519)) ++
237240 array(u16, u8, key_share.x25519_kp.public_key),
238241 ));
......@@ -1630,23 +1633,26 @@ inline fn big(x: anytype) @TypeOf(x) {
16301633}
16311634
16321635const KeyShare = struct {
1633 x25519_kp: crypto.dh.X25519.KeyPair,
1634 secp256r1_kp: crypto.sign.ecdsa.EcdsaP256Sha256.KeyPair,
16351636 ml_kem768_kp: crypto.kem.ml_kem.MLKem768.KeyPair,
1637 secp256r1_kp: crypto.sign.ecdsa.EcdsaP256Sha256.KeyPair,
1638 secp384r1_kp: crypto.sign.ecdsa.EcdsaP384Sha384.KeyPair,
1639 x25519_kp: crypto.dh.X25519.KeyPair,
16361640 sk_buf: [sk_max_len]u8,
16371641 sk_len: std.math.IntFittingRange(0, sk_max_len),
16381642
16391643 const sk_max_len = @max(
16401644 crypto.dh.X25519.shared_length + crypto.kem.ml_kem.MLKem768.shared_length,
1641 crypto.dh.X25519.shared_length,
16421645 crypto.ecc.P256.scalar.encoded_length,
1646 crypto.ecc.P384.scalar.encoded_length,
1647 crypto.dh.X25519.shared_length,
16431648 );
16441649
1645 fn init(seed: [64]u8) error{IdentityElement}!KeyShare {
1650 fn init(seed: [112]u8) error{IdentityElement}!KeyShare {
16461651 return .{
1647 .x25519_kp = try .create(seed[0..32].*),
1648 .secp256r1_kp = try .create(seed[32..64].*),
16491652 .ml_kem768_kp = try .create(null),
1653 .secp256r1_kp = try .create(seed[0..32].*),
1654 .secp384r1_kp = try .create(seed[32..80].*),
1655 .x25519_kp = try .create(seed[80..112].*),
16501656 .sk_buf = undefined,
16511657 .sk_len = 0,
16521658 };
......@@ -1680,6 +1686,15 @@ const KeyShare = struct {
16801686 @memcpy(ks.sk_buf[0..sk.len], &sk);
16811687 ks.sk_len = sk.len;
16821688 },
1689 .secp384r1 => {
1690 const PublicKey = crypto.sign.ecdsa.EcdsaP384Sha384.PublicKey;
1691 const pk = PublicKey.fromSec1(server_pub_key) catch return error.TlsDecryptFailure;
1692 const mul = pk.p.mulPublic(ks.secp384r1_kp.secret_key.bytes, .big) catch
1693 return error.TlsDecryptFailure;
1694 const sk = mul.affineCoordinates().x.toBytes(.big);
1695 @memcpy(ks.sk_buf[0..sk.len], &sk);
1696 ks.sk_len = sk.len;
1697 },
16831698 .x25519 => {
16841699 const ksl = crypto.dh.X25519.public_length;
16851700 if (server_pub_key.len != ksl) return error.TlsIllegalParameter;