1 /* dtls -- a very basic DTLS implementation
3 * Copyright (C) 2011--2012 Olaf Bergmann <bergmann@tzi.org>
4 * Copyright (C) 2013 Hauke Mehrtens <hauke@hauke-m.de>
7 * Modified source code for micro-ecc porting,
9 * Following functions are removed:
10 * - dtls_ec_key_to_uint32
11 * - dtls_ec_key_from_uint32
12 * Following functions are modified:
13 * - dtls_ecdh_pre_master_secret
14 * - dtls_ecdsa_generate_key
15 * - dtls_ecdsa_create_sig_hash
16 * - dtls_ecdsa_verify_sig_hash
18 * Permission is hereby granted, free of charge, to any person
19 * obtaining a copy of this software and associated documentation
20 * files (the "Software"), to deal in the Software without
21 * restriction, including without limitation the rights to use, copy,
22 * modify, merge, publish, distribute, sublicense, and/or sell copies
23 * of the Software, and to permit persons to whom the Software is
24 * furnished to do so, subject to the following conditions:
26 * The above copyright notice and this permission notice shall be
27 * included in all copies or substantial portions of the Software.
29 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
30 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
31 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
32 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
33 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
34 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
35 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
42 #include "dtls_config.h"
57 #include "aes/rijndael.h"
58 #include "sha2/sha2.h"
67 #define HMAC_UPDATE_SEED(Context,Seed,Length) \
68 if (Seed) dtls_hmac_update(Context, (Seed), (Length))
70 static struct dtls_cipher_context_t cipher_context;
72 static pthread_mutex_t cipher_context_mutex = PTHREAD_MUTEX_INITIALIZER;
75 static struct dtls_cipher_context_t *dtls_cipher_context_get(void)
78 pthread_mutex_lock(&cipher_context_mutex);
80 return &cipher_context;
83 static void dtls_cipher_context_release(void)
86 pthread_mutex_unlock(&cipher_context_mutex);
95 static dtls_handshake_parameters_t *dtls_handshake_malloc() {
96 return malloc(sizeof(dtls_handshake_parameters_t));
99 static void dtls_handshake_dealloc(dtls_handshake_parameters_t *handshake) {
103 static dtls_security_parameters_t *dtls_security_malloc() {
104 return malloc(sizeof(dtls_security_parameters_t));
107 static void dtls_security_dealloc(dtls_security_parameters_t *security) {
110 #else /* WITH_CONTIKI */
113 MEMB(handshake_storage, dtls_handshake_parameters_t, DTLS_HANDSHAKE_MAX);
114 MEMB(security_storage, dtls_security_parameters_t, DTLS_SECURITY_MAX);
117 memb_init(&handshake_storage);
118 memb_init(&security_storage);
121 static dtls_handshake_parameters_t *dtls_handshake_malloc() {
122 return memb_alloc(&handshake_storage);
125 static void dtls_handshake_dealloc(dtls_handshake_parameters_t *handshake) {
126 memb_free(&handshake_storage, handshake);
129 static dtls_security_parameters_t *dtls_security_malloc() {
130 return memb_alloc(&security_storage);
133 static void dtls_security_dealloc(dtls_security_parameters_t *security) {
134 memb_free(&security_storage, security);
136 #endif /* WITH_CONTIKI */
138 dtls_handshake_parameters_t *dtls_handshake_new()
140 dtls_handshake_parameters_t *handshake;
142 handshake = dtls_handshake_malloc();
144 dtls_crit("can not allocate a handshake struct\n");
148 memset(handshake, 0, sizeof(*handshake));
151 /* initialize the handshake hash wrt. the hard-coded DTLS version */
152 dtls_debug("DTLSv12: initialize HASH_SHA256\n");
153 /* TLS 1.2: PRF(secret, label, seed) = P_<hash>(secret, label + seed) */
154 /* FIXME: we use the default SHA256 here, might need to support other
155 hash functions as well */
156 dtls_hash_init(&handshake->hs_state.hs_hash);
161 void dtls_handshake_free(dtls_handshake_parameters_t *handshake)
166 netq_delete_all(handshake->reorder_queue);
167 dtls_handshake_dealloc(handshake);
170 dtls_security_parameters_t *dtls_security_new()
172 dtls_security_parameters_t *security;
174 security = dtls_security_malloc();
176 dtls_crit("can not allocate a security struct\n");
180 memset(security, 0, sizeof(*security));
183 security->cipher = TLS_NULL_WITH_NULL_NULL;
184 security->compression = TLS_COMPRESSION_NULL;
189 void dtls_security_free(dtls_security_parameters_t *security)
194 dtls_security_dealloc(security);
198 dtls_p_hash(dtls_hashfunc_t h,
199 const unsigned char *key, size_t keylen,
200 const unsigned char *label, size_t labellen,
201 const unsigned char *random1, size_t random1len,
202 const unsigned char *random2, size_t random2len,
203 unsigned char *buf, size_t buflen) {
204 dtls_hmac_context_t *hmac_a, *hmac_p;
206 unsigned char A[DTLS_HMAC_DIGEST_SIZE];
207 unsigned char tmp[DTLS_HMAC_DIGEST_SIZE];
208 size_t dlen; /* digest length */
209 size_t len = 0; /* result length */
211 hmac_a = dtls_hmac_new(key, keylen);
215 /* calculate A(1) from A(0) == seed */
216 HMAC_UPDATE_SEED(hmac_a, label, labellen);
217 HMAC_UPDATE_SEED(hmac_a, random1, random1len);
218 HMAC_UPDATE_SEED(hmac_a, random2, random2len);
220 dlen = dtls_hmac_finalize(hmac_a, A);
222 hmac_p = dtls_hmac_new(key, keylen);
226 while (len + dlen < buflen) {
228 /* FIXME: rewrite loop to avoid superflous call to dtls_hmac_init() */
229 dtls_hmac_init(hmac_p, key, keylen);
230 dtls_hmac_update(hmac_p, A, dlen);
232 HMAC_UPDATE_SEED(hmac_p, label, labellen);
233 HMAC_UPDATE_SEED(hmac_p, random1, random1len);
234 HMAC_UPDATE_SEED(hmac_p, random2, random2len);
236 len += dtls_hmac_finalize(hmac_p, tmp);
237 memcpy(buf, tmp, dlen);
240 /* calculate A(i+1) */
241 dtls_hmac_init(hmac_a, key, keylen);
242 dtls_hmac_update(hmac_a, A, dlen);
243 dtls_hmac_finalize(hmac_a, A);
246 dtls_hmac_init(hmac_p, key, keylen);
247 dtls_hmac_update(hmac_p, A, dlen);
249 HMAC_UPDATE_SEED(hmac_p, label, labellen);
250 HMAC_UPDATE_SEED(hmac_p, random1, random1len);
251 HMAC_UPDATE_SEED(hmac_p, random2, random2len);
253 dtls_hmac_finalize(hmac_p, tmp);
254 memcpy(buf, tmp, buflen - len);
257 dtls_hmac_free(hmac_a);
258 dtls_hmac_free(hmac_p);
264 dtls_prf(const unsigned char *key, size_t keylen,
265 const unsigned char *label, size_t labellen,
266 const unsigned char *random1, size_t random1len,
267 const unsigned char *random2, size_t random2len,
268 unsigned char *buf, size_t buflen) {
270 /* Clear the result buffer */
271 memset(buf, 0, buflen);
272 return dtls_p_hash(HASH_SHA256,
281 dtls_mac(dtls_hmac_context_t *hmac_ctx,
282 const unsigned char *record,
283 const unsigned char *packet, size_t length,
284 unsigned char *buf) {
286 dtls_int_to_uint16(L, length);
289 dtls_hmac_update(hmac_ctx, record +3, sizeof(uint16) + sizeof(uint48));
290 dtls_hmac_update(hmac_ctx, record, sizeof(uint8) + sizeof(uint16));
291 dtls_hmac_update(hmac_ctx, L, sizeof(uint16));
292 dtls_hmac_update(hmac_ctx, packet, length);
294 dtls_hmac_finalize(hmac_ctx, buf);
298 dtls_ccm_encrypt(aes128_t *ccm_ctx, const unsigned char *src, size_t srclen,
300 unsigned char *nounce,
301 const unsigned char *aad, size_t la) {
306 len = dtls_ccm_encrypt_message(&ccm_ctx->ctx, 8 /* M */,
307 max(2, 15 - DTLS_CCM_NONCE_SIZE),
315 dtls_ccm_decrypt(aes128_t *ccm_ctx, const unsigned char *src,
316 size_t srclen, unsigned char *buf,
317 unsigned char *nounce,
318 const unsigned char *aad, size_t la) {
323 len = dtls_ccm_decrypt_message(&ccm_ctx->ctx, 8 /* M */,
324 max(2, 15 - DTLS_CCM_NONCE_SIZE),
332 dtls_cbc_encrypt(aes128_t *aes_ctx,
333 unsigned char *key, size_t keylen,
334 const unsigned char *iv,
335 const unsigned char *src, size_t srclen,
336 unsigned char *buf) {
338 unsigned char cbc[DTLS_BLK_LENGTH];
339 unsigned char tmp[DTLS_BLK_LENGTH];
341 const unsigned char *dtls_hdr = NULL;
344 dtls_hmac_context_t* hmac_ctx = NULL;
349 dtls_hdr = src - DTLS_CBC_IV_LENGTH - sizeof(dtls_record_header_t);
351 //Calculate MAC : Append the MAC code to end of content
352 hmac_ctx = dtls_hmac_new(key, keylen);
357 dtls_hmac_free(hmac_ctx);
359 dtls_debug_dump("[MAC]",
361 DTLS_HMAC_DIGEST_SIZE);
363 paddinglen = DTLS_BLK_LENGTH - ((srclen + DTLS_HMAC_DIGEST_SIZE) % DTLS_BLK_LENGTH);
366 memset(buf + (srclen + DTLS_HMAC_DIGEST_SIZE), paddinglen - 1, paddinglen);
368 memcpy(cbc, iv, DTLS_BLK_LENGTH);
369 blocks = (srclen + DTLS_HMAC_DIGEST_SIZE + paddinglen) / DTLS_BLK_LENGTH;
371 for (i = 0; i < blocks; i++) {
372 for (j = 0; j < DTLS_BLK_LENGTH; j++) {
376 rijndael_encrypt(&aes_ctx->ctx, cbc, tmp);
377 memcpy(cbc, tmp, DTLS_BLK_LENGTH);
378 memcpy(pos, cbc, DTLS_BLK_LENGTH);
379 pos += DTLS_BLK_LENGTH;
382 dtls_debug_dump("[Encrypted Data]",
384 srclen + DTLS_HMAC_DIGEST_SIZE + paddinglen);
386 return srclen + DTLS_HMAC_DIGEST_SIZE + paddinglen;
391 dtls_cbc_decrypt(aes128_t *aes_ctx,
392 unsigned char *key, size_t keylen,
393 const unsigned char *iv,
394 const unsigned char *src, size_t srclen,
395 unsigned char *buf) {
397 unsigned char cbc[DTLS_BLK_LENGTH];
398 unsigned char tmp[DTLS_BLK_LENGTH];
399 unsigned char tmp2[DTLS_BLK_LENGTH];
400 unsigned char mac_buf[DTLS_HMAC_DIGEST_SIZE] = {0,};
401 const unsigned char *dtls_hdr = NULL;
405 int depaddinglen = 0;
406 dtls_hmac_context_t* hmac_ctx = NULL;
410 dtls_hdr = src - DTLS_CBC_IV_LENGTH - sizeof(dtls_record_header_t);
412 memcpy(cbc, iv, DTLS_BLK_LENGTH);
413 blocks = srclen / DTLS_BLK_LENGTH;
415 for (i = 0; i < blocks; i++)
417 memcpy(tmp, pos, DTLS_BLK_LENGTH);
418 rijndael_decrypt(&aes_ctx->ctx, pos, tmp2);
419 memcpy(pos, tmp2, DTLS_BLK_LENGTH);
421 for (j = 0; j < DTLS_BLK_LENGTH; j++) {
425 memcpy(cbc, tmp, DTLS_BLK_LENGTH);
426 pos += DTLS_BLK_LENGTH;
430 depaddinglen = buf[srclen -1];
433 hmac_ctx = dtls_hmac_new(key, keylen);
437 dtls_mac(hmac_ctx, dtls_hdr, buf,
438 srclen - DTLS_HMAC_DIGEST_SIZE - depaddinglen - 1,
440 dtls_hmac_free(hmac_ctx);
442 dtls_debug_dump("[MAC]",
444 DTLS_HMAC_DIGEST_SIZE);
445 dtls_debug_dump("[Decrypted data]",
447 srclen - DTLS_HMAC_DIGEST_SIZE - depaddinglen - 1);
451 buf + (srclen - DTLS_HMAC_DIGEST_SIZE - depaddinglen - 1),
452 DTLS_HMAC_DIGEST_SIZE) != 0)
454 dtls_crit("Failed to verification of MAC\n");
458 //verify the padding bytes
459 for (i =0; i < depaddinglen; i++)
461 if (buf[srclen - depaddinglen - 1 + i] != depaddinglen)
463 dtls_crit("Failed to verify padding bytes\n");
468 return srclen - DTLS_HMAC_DIGEST_SIZE - depaddinglen - 1;
473 dtls_psk_pre_master_secret(unsigned char *key, size_t keylen,
474 unsigned char *result, size_t result_len) {
475 unsigned char *p = result;
477 if (result_len < (2 * (sizeof(uint16) + keylen))) {
481 dtls_int_to_uint16(p, keylen);
484 memset(p, 0, keylen);
487 memcpy(p, result, sizeof(uint16));
490 memcpy(p, key, keylen);
492 return 2 * (sizeof(uint16) + keylen);
494 #endif /* DTLS_PSK */
496 #if defined(DTLS_ECC) || defined(DTLS_X509)
498 int dtls_ec_key_from_uint32_asn1(const uint32_t *key, size_t key_size,
499 unsigned char *buf) {
501 unsigned char *buf_orig = buf;
504 for (i = (key_size / sizeof(uint32_t)) - 1; i >= 0 ; i--) {
507 /* the first bit has to be set to zero, to indicate a poritive integer */
508 if (first && key[i] & 0x80000000) {
511 dtls_int_to_uint32(buf, key[i]);
513 } else if (first && !(key[i] & 0xFF800000)) {
514 buf[0] = (key[i] >> 16) & 0xff;
515 buf[1] = (key[i] >> 8) & 0xff;
516 buf[2] = key[i] & 0xff;
518 } else if (first && !(key[i] & 0xFFFF8000)) {
519 buf[0] = (key[i] >> 8) & 0xff;
520 buf[1] = key[i] & 0xff;
522 } else if (first && !(key[i] & 0xFFFFFF80)) {
523 buf[0] = key[i] & 0xff;
526 dtls_int_to_uint32(buf, key[i]);
531 return buf - buf_orig;
534 int dtls_ecdh_pre_master_secret(unsigned char *priv_key,
535 unsigned char *pub_key_x,
536 unsigned char *pub_key_y,
538 unsigned char *result,
541 uint8_t publicKey[64];
542 uint8_t privateKey[32];
544 if (result_len < key_size) {
549 memcpy(publicKey, pub_key_x, 32);
550 memcpy(publicKey + 32, pub_key_y, 32);
551 memcpy(privateKey, priv_key, 32);
552 uECC_shared_secret(publicKey, privateKey, result);
558 dtls_ecdsa_generate_key(unsigned char *priv_key,
559 unsigned char *pub_key_x,
560 unsigned char *pub_key_y,
563 uint8_t publicKey[64];
564 uint8_t privateKey[32];
566 uECC_make_key(publicKey, privateKey);
567 memcpy(pub_key_x, publicKey, 32);
568 memcpy(pub_key_y, publicKey + 32, 32);
569 memcpy(priv_key, privateKey, 32);
573 /* rfc4492#section-5.4 */
575 dtls_ecdsa_create_sig_hash(const unsigned char *priv_key, size_t key_size,
576 const unsigned char *sign_hash, size_t sign_hash_size,
577 uint32_t point_r[9], uint32_t point_s[9])
582 if (priv_key == NULL || key_size < 32)
584 if (sign_hash == NULL || sign_hash_size < 32)
587 uECC_sign(priv_key, sign_hash, sign);
590 for (i = 0; i < 32; i++)
592 ((uint8_t *) point_r)[i] = sign[31 - i];
593 ((uint8_t *) point_s)[i] = sign[63 - i];
598 dtls_ecdsa_create_sig(const unsigned char *priv_key, size_t key_size,
599 const unsigned char *client_random, size_t client_random_size,
600 const unsigned char *server_random, size_t server_random_size,
601 const unsigned char *keyx_params, size_t keyx_params_size,
602 uint32_t point_r[9], uint32_t point_s[9]) {
604 unsigned char sha256hash[DTLS_HMAC_DIGEST_SIZE];
606 dtls_hash_init(&data);
607 dtls_hash_update(&data, client_random, client_random_size);
608 dtls_hash_update(&data, server_random, server_random_size);
609 dtls_hash_update(&data, keyx_params, keyx_params_size);
610 dtls_hash_finalize(sha256hash, &data);
612 dtls_ecdsa_create_sig_hash(priv_key, key_size, sha256hash,
613 sizeof(sha256hash), point_r, point_s);
616 /* rfc4492#section-5.4 */
618 dtls_ecdsa_verify_sig_hash(const unsigned char *pub_key_x,
619 const unsigned char *pub_key_y, size_t key_size,
620 const unsigned char *sign_hash, size_t sign_hash_size,
621 unsigned char *result_r, unsigned char *result_s)
623 uint8_t publicKey[64];
627 if (pub_key_x == NULL || pub_key_y == NULL || key_size < 32)
629 if (sign_hash == NULL || sign_hash_size < 32)
631 if (result_r == NULL || result_s == NULL)
634 // Copy the public key into a single buffer
635 memcpy(publicKey, pub_key_x, 32);
636 memcpy(publicKey + 32, pub_key_y, 32);
638 // Copy the signature into a single buffer
639 memcpy(sign, result_r, 32);
640 memcpy(sign + 32, result_s, 32);
642 return uECC_verify(publicKey, sign_hash, sign);
646 dtls_ecdsa_verify_sig(const unsigned char *pub_key_x,
647 const unsigned char *pub_key_y, size_t key_size,
648 const unsigned char *client_random, size_t client_random_size,
649 const unsigned char *server_random, size_t server_random_size,
650 const unsigned char *keyx_params, size_t keyx_params_size,
651 unsigned char *result_r, unsigned char *result_s) {
653 unsigned char sha256hash[DTLS_HMAC_DIGEST_SIZE];
655 dtls_hash_init(&data);
656 dtls_hash_update(&data, client_random, client_random_size);
657 dtls_hash_update(&data, server_random, server_random_size);
658 dtls_hash_update(&data, keyx_params, keyx_params_size);
659 dtls_hash_finalize(sha256hash, &data);
661 return dtls_ecdsa_verify_sig_hash(pub_key_x, pub_key_y, key_size, sha256hash,
662 sizeof(sha256hash), result_r, result_s);
664 #endif /* DTLS_ECC */
666 #if defined(DTLS_PSK) && defined(DTLS_ECC)
667 int dtls_ecdhe_psk_pre_master_secret(unsigned char *psk, size_t psklen,
668 unsigned char *ecc_priv_key,
669 unsigned char *ecc_pub_key_x,
670 unsigned char *ecc_pub_key_y,
672 unsigned char *result,
675 uint8_t eccPublicKey[64];
676 uint8_t eccPrivateKey[32];
677 unsigned char *p = result;
679 if (result_len < uECC_BYTES + psklen + (sizeof(uint16) * 2)) {
683 dtls_int_to_uint16(p, uECC_BYTES);
686 memcpy(eccPublicKey, ecc_pub_key_x, 32);
687 memcpy(eccPublicKey + 32, ecc_pub_key_y, 32);
688 memcpy(eccPrivateKey, ecc_priv_key, 32);
689 uECC_shared_secret(eccPublicKey, eccPrivateKey, p);
692 dtls_int_to_uint16(p, psklen);
695 memcpy(p, psk, psklen);
697 return uECC_BYTES + psklen + (sizeof(uint16) * 2);
699 #endif /* defined(DTLS_PSK) && defined(DTLS_ECC) */
702 dtls_encrypt(const unsigned char *src, size_t length,
704 unsigned char *nounce,
705 unsigned char *key, size_t keylen,
706 const unsigned char *aad, size_t la,
707 const dtls_cipher_t cipher)
710 struct dtls_cipher_context_t *ctx = dtls_cipher_context_get();
712 if(cipher == TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 ||
713 cipher == TLS_PSK_WITH_AES_128_CCM_8) {
714 ret = rijndael_set_key_enc_only(&ctx->data.ctx, key, 8 * keylen);
716 /* cleanup everything in case the key has the wrong size */
717 dtls_warn("cannot set rijndael key\n");
722 memmove(buf, src, length);
723 ret = dtls_ccm_encrypt(&ctx->data, src, length, buf, nounce, aad, la);
725 if(cipher == TLS_ECDH_anon_WITH_AES_128_CBC_SHA_256 ||
726 cipher == TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA_256) {
727 ret = rijndael_set_key(&ctx->data.ctx, key, 8 * keylen);
729 /* cleanup everything in case the key has the wrong size */
730 dtls_warn("cannot set rijndael key\n");
735 memmove(buf, src, length);
736 ret = dtls_cbc_encrypt(&ctx->data, key, keylen, nounce, src, length, buf);
740 dtls_cipher_context_release();
745 dtls_decrypt(const unsigned char *src, size_t length,
747 unsigned char *nounce,
748 unsigned char *key, size_t keylen,
749 const unsigned char *aad, size_t la,
750 const dtls_cipher_t cipher)
753 struct dtls_cipher_context_t *ctx = dtls_cipher_context_get();
755 if(cipher == TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 ||
756 cipher == TLS_PSK_WITH_AES_128_CCM_8) {
757 ret = rijndael_set_key_enc_only(&ctx->data.ctx, key, 8 * keylen);
759 /* cleanup everything in case the key has the wrong size */
760 dtls_warn("cannot set rijndael key\n");
765 memmove(buf, src, length);
766 ret = dtls_ccm_decrypt(&ctx->data, src, length, buf, nounce, aad, la);
769 if(cipher == TLS_ECDH_anon_WITH_AES_128_CBC_SHA_256 ||
770 cipher == TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA_256) {
771 ret = rijndael_set_key(&ctx->data.ctx, key, 8 * keylen);
773 /* cleanup everything in case the key has the wrong size */
774 dtls_warn("cannot set rijndael key\n");
779 memmove(buf, src, length);
780 ret = dtls_cbc_decrypt(&ctx->data, key, keylen, nounce, src, length, buf);
784 dtls_cipher_context_release();