#include <openssl/ssl.h>
#include <assert.h>
#include <string.h>
#include <algorithm>
#include <utility>
#include <openssl/aead.h>
#include <openssl/bytestring.h>
#include <openssl/digest.h>
#include <openssl/hkdf.h>
#include <openssl/hmac.h>
#include <openssl/mem.h>
#include "../crypto/internal.h"
#include "internal.h"

Include dependency graph for tls13_enc.cc:

Functions
static bool	derive_secret (SSL_HANDSHAKE *hs, Span< uint8_t > out, Span< const char > label)

static bool	derive_secret_with_transcript (const SSL_HANDSHAKE *hs, Span< uint8_t > out, const SSLTranscript &transcript, Span< const char > label)

static bool	hkdf_expand_label (Span< uint8_t > out, const EVP_MD *digest, Span< const uint8_t > secret, Span< const char > label, Span< const uint8_t > hash)

static bool	hkdf_extract_to_secret (SSL_HANDSHAKE *hs, const SSLTranscript &transcript, Span< const uint8_t > in)

static BSSL_NAMESPACE_BEGIN bool	init_key_schedule (SSL_HANDSHAKE hs, SSLTranscript transcript, uint16_t version, const SSL_CIPHER *cipher)

static Span< const char >	label_to_span (const char *label)

bool	ssl_ech_accept_confirmation (const SSL_HANDSHAKE *hs, Span< uint8_t > out, Span< const uint8_t > client_random, const SSLTranscript &transcript, bool is_hrr, Span< const uint8_t > msg, size_t offset)

size_t	ssl_ech_confirmation_signal_hello_offset (const SSL *ssl)

bool	tls13_advance_key_schedule (SSL_HANDSHAKE *hs, Span< const uint8_t > in)

bool	tls13_derive_application_secrets (SSL_HANDSHAKE *hs)

bool	tls13_derive_early_secret (SSL_HANDSHAKE *hs)

bool	tls13_derive_handshake_secrets (SSL_HANDSHAKE *hs)

bool	tls13_derive_resumption_secret (SSL_HANDSHAKE *hs)

bool	tls13_derive_session_psk (SSL_SESSION *session, Span< const uint8_t > nonce)

bool	tls13_export_keying_material (SSL *ssl, Span< uint8_t > out, Span< const uint8_t > secret, Span< const char > label, Span< const uint8_t > context)

bool	tls13_finished_mac (SSL_HANDSHAKE hs, uint8_t out, size_t *out_len, bool is_server)

bool	tls13_init_early_key_schedule (SSL_HANDSHAKE hs, const SSL_SESSION session)

bool	tls13_init_key_schedule (SSL_HANDSHAKE *hs, Span< const uint8_t > psk)

static bool	tls13_psk_binder (uint8_t out, size_t out_len, const SSL_SESSION *session, const SSLTranscript &transcript, Span< const uint8_t > client_hello, size_t binders_len)

bool	tls13_rotate_traffic_key (SSL *ssl, enum evp_aead_direction_t direction)

bool	tls13_set_traffic_key (SSL ssl, enum ssl_encryption_level_t level, enum evp_aead_direction_t direction, const SSL_SESSION session, Span< const uint8_t > traffic_secret)

static bool	tls13_verify_data (uint8_t out, size_t out_len, const EVP_MD *digest, uint16_t version, Span< const uint8_t > secret, Span< const uint8_t > context)

bool	tls13_verify_psk_binder (const SSL_HANDSHAKE hs, const SSL_SESSION session, const SSLMessage &msg, CBS *binders)

bool	tls13_write_psk_binder (const SSL_HANDSHAKE hs, const SSLTranscript &transcript, Span< uint8_t > msg, size_t out_binder_len)

Variables
static const char	kTLS13LabelApplicationTraffic [] = "traffic upd"

static const char	kTLS13LabelClientApplicationTraffic [] = "c ap traffic"

static const char	kTLS13LabelClientEarlyTraffic [] = "c e traffic"

static const char	kTLS13LabelClientHandshakeTraffic [] = "c hs traffic"

static const char	kTLS13LabelDerived [] = "derived"

static const char	kTLS13LabelExporter [] = "exp master"

static const char	kTLS13LabelExportKeying [] = "exporter"

static const char	kTLS13LabelFinished [] = "finished"

static const char	kTLS13LabelPSKBinder [] = "res binder"

static const char	kTLS13LabelResumption [] = "res master"

static const char	kTLS13LabelResumptionPSK [] = "resumption"

static const char	kTLS13LabelServerApplicationTraffic [] = "s ap traffic"

static const char	kTLS13LabelServerHandshakeTraffic [] = "s hs traffic"

Function Documentation

◆ derive_secret()

static bool derive_secret	(	SSL_HANDSHAKE *	hs,
		Span< uint8_t >	out,
		Span< const char >	label
	)

static

Definition at line 151 of file tls13_enc.cc.

◆ derive_secret_with_transcript()

static bool derive_secret_with_transcript	(	const SSL_HANDSHAKE *	hs,
		Span< uint8_t >	out,
		const SSLTranscript &	transcript,
		Span< const char >	label
	)

static

Definition at line 137 of file tls13_enc.cc.

◆ hkdf_expand_label()

static bool hkdf_expand_label	(	Span< uint8_t >	out,
		const EVP_MD *	digest,
		Span< const uint8_t >	secret,
		Span< const char >	label,
		Span< const uint8_t >	hash
	)

static

Definition at line 94 of file tls13_enc.cc.

◆ hkdf_extract_to_secret()

static bool hkdf_extract_to_secret	(	SSL_HANDSHAKE *	hs,
		const SSLTranscript &	transcript,
		Span< const uint8_t >	in
	)

static

Definition at line 49 of file tls13_enc.cc.

◆ init_key_schedule()

static BSSL_NAMESPACE_BEGIN bool init_key_schedule	(	SSL_HANDSHAKE *	hs,
		SSLTranscript *	transcript,
		uint16_t	version,
		const SSL_CIPHER *	cipher
	)

static

Definition at line 36 of file tls13_enc.cc.

◆ label_to_span()

static Span<const char> label_to_span ( const char * label )

static

Definition at line 90 of file tls13_enc.cc.

◆ ssl_ech_accept_confirmation()

bool ssl_ech_accept_confirmation	(	const SSL_HANDSHAKE *	hs,
		Span< uint8_t >	out,
		Span< const uint8_t >	client_random,
		const SSLTranscript &	transcript,
		bool	is_hrr,
		Span< const uint8_t >	msg,
		size_t	offset
	)

Definition at line 540 of file tls13_enc.cc.

◆ ssl_ech_confirmation_signal_hello_offset()

size_t ssl_ech_confirmation_signal_hello_offset ( const SSL * ssl )

Definition at line 531 of file tls13_enc.cc.

◆ tls13_advance_key_schedule()

bool tls13_advance_key_schedule	(	SSL_HANDSHAKE *	hs,
		Span< const uint8_t >	in
	)

Definition at line 123 of file tls13_enc.cc.

◆ tls13_derive_application_secrets()

bool tls13_derive_application_secrets ( SSL_HANDSHAKE * hs )

Definition at line 278 of file tls13_enc.cc.

◆ tls13_derive_early_secret()

bool tls13_derive_early_secret ( SSL_HANDSHAKE * hs )

Definition at line 245 of file tls13_enc.cc.

◆ tls13_derive_handshake_secrets()

bool tls13_derive_handshake_secrets ( SSL_HANDSHAKE * hs )

Definition at line 262 of file tls13_enc.cc.

◆ tls13_derive_resumption_secret()

bool tls13_derive_resumption_secret ( SSL_HANDSHAKE * hs )

Definition at line 323 of file tls13_enc.cc.

◆ tls13_derive_session_psk()

bool tls13_derive_session_psk	(	SSL_SESSION *	session,
		Span< const uint8_t >	nonce
	)

Definition at line 374 of file tls13_enc.cc.

◆ tls13_export_keying_material()

bool tls13_export_keying_material	(	SSL *	ssl,
		Span< uint8_t >	out,
		Span< const uint8_t >	secret,
		Span< const char >	label,
		Span< const uint8_t >	context
	)

Definition at line 385 of file tls13_enc.cc.

◆ tls13_finished_mac()

bool tls13_finished_mac	(	SSL_HANDSHAKE *	hs,
		uint8_t *	out,
		size_t *	out_len,
		bool	is_server
	)

Definition at line 356 of file tls13_enc.cc.

◆ tls13_init_early_key_schedule()

bool tls13_init_early_key_schedule	(	SSL_HANDSHAKE *	hs,
		const SSL_SESSION *	session
	)

Definition at line 75 of file tls13_enc.cc.

◆ tls13_init_key_schedule()

bool tls13_init_key_schedule	(	SSL_HANDSHAKE *	hs,
		Span< const uint8_t >	psk
	)

Definition at line 61 of file tls13_enc.cc.

◆ tls13_psk_binder()

static bool tls13_psk_binder	(	uint8_t *	out,
		size_t *	out_len,
		const SSL_SESSION *	session,
		const SSLTranscript &	transcript,
		Span< const uint8_t >	client_hello,
		size_t	binders_len
	)

static

Definition at line 420 of file tls13_enc.cc.

◆ tls13_rotate_traffic_key()

bool tls13_rotate_traffic_key	(	SSL *	ssl,
		enum evp_aead_direction_t	direction
	)

Definition at line 303 of file tls13_enc.cc.

◆ tls13_set_traffic_key()

bool tls13_set_traffic_key	(	SSL *	ssl,
		enum ssl_encryption_level_t	level,
		enum evp_aead_direction_t	direction,
		const SSL_SESSION *	session,
		Span< const uint8_t >	traffic_secret
	)

Definition at line 156 of file tls13_enc.cc.

◆ tls13_verify_data()

static bool tls13_verify_data	(	uint8_t *	out,
		size_t *	out_len,
		const EVP_MD *	digest,
		uint16_t	version,
		Span< const uint8_t >	secret,
		Span< const uint8_t >	context
	)

static

Definition at line 339 of file tls13_enc.cc.

◆ tls13_verify_psk_binder()

bool tls13_verify_psk_binder	(	const SSL_HANDSHAKE *	hs,
		const SSL_SESSION *	session,
		const SSLMessage &	msg,
		CBS *	binders
	)

Definition at line 500 of file tls13_enc.cc.

◆ tls13_write_psk_binder()

bool tls13_write_psk_binder	(	const SSL_HANDSHAKE *	hs,
		const SSLTranscript &	transcript,
		Span< uint8_t >	msg,
		size_t *	out_binder_len
	)

Definition at line 473 of file tls13_enc.cc.

Variable Documentation

◆ kTLS13LabelApplicationTraffic

const char kTLS13LabelApplicationTraffic[] = "traffic upd"

static

Definition at line 301 of file tls13_enc.cc.

◆ kTLS13LabelClientApplicationTraffic

const char kTLS13LabelClientApplicationTraffic[] = "c ap traffic"

static

Definition at line 242 of file tls13_enc.cc.

◆ kTLS13LabelClientEarlyTraffic

const char kTLS13LabelClientEarlyTraffic[] = "c e traffic"

static

Definition at line 239 of file tls13_enc.cc.

◆ kTLS13LabelClientHandshakeTraffic

const char kTLS13LabelClientHandshakeTraffic[] = "c hs traffic"

static

Definition at line 240 of file tls13_enc.cc.

◆ kTLS13LabelDerived

const char kTLS13LabelDerived[] = "derived"

static

Definition at line 121 of file tls13_enc.cc.

◆ kTLS13LabelExporter

const char kTLS13LabelExporter[] = "exp master"

static

Definition at line 237 of file tls13_enc.cc.

◆ kTLS13LabelExportKeying

const char kTLS13LabelExportKeying[] = "exporter"

static

Definition at line 383 of file tls13_enc.cc.

◆ kTLS13LabelFinished

const char kTLS13LabelFinished[] = "finished"

static

Definition at line 334 of file tls13_enc.cc.

◆ kTLS13LabelPSKBinder

const char kTLS13LabelPSKBinder[] = "res binder"

static

Definition at line 418 of file tls13_enc.cc.

◆ kTLS13LabelResumption

const char kTLS13LabelResumption[] = "res master"

static

Definition at line 321 of file tls13_enc.cc.

◆ kTLS13LabelResumptionPSK

const char kTLS13LabelResumptionPSK[] = "resumption"

static

Definition at line 372 of file tls13_enc.cc.

◆ kTLS13LabelServerApplicationTraffic

const char kTLS13LabelServerApplicationTraffic[] = "s ap traffic"

static

Definition at line 243 of file tls13_enc.cc.

◆ kTLS13LabelServerHandshakeTraffic

const char kTLS13LabelServerHandshakeTraffic[] = "s hs traffic"

static

Definition at line 241 of file tls13_enc.cc.

Functions

Variables

Function Documentation

◆ derive_secret()

◆ derive_secret_with_transcript()

◆ hkdf_expand_label()

◆ hkdf_extract_to_secret()

◆ init_key_schedule()

◆ label_to_span()

◆ ssl_ech_accept_confirmation()

◆ ssl_ech_confirmation_signal_hello_offset()

◆ tls13_advance_key_schedule()

◆ tls13_derive_application_secrets()

◆ tls13_derive_early_secret()

◆ tls13_derive_handshake_secrets()

◆ tls13_derive_resumption_secret()

◆ tls13_derive_session_psk()

◆ tls13_export_keying_material()

◆ tls13_finished_mac()

◆ tls13_init_early_key_schedule()

◆ tls13_init_key_schedule()

◆ tls13_psk_binder()

◆ tls13_rotate_traffic_key()

◆ tls13_set_traffic_key()

◆ tls13_verify_data()

◆ tls13_verify_psk_binder()

◆ tls13_write_psk_binder()

Variable Documentation

◆ kTLS13LabelApplicationTraffic

◆ kTLS13LabelClientApplicationTraffic

◆ kTLS13LabelClientEarlyTraffic

◆ kTLS13LabelClientHandshakeTraffic

◆ kTLS13LabelDerived

◆ kTLS13LabelExporter

◆ kTLS13LabelExportKeying

◆ kTLS13LabelFinished

◆ kTLS13LabelPSKBinder

◆ kTLS13LabelResumption

◆ kTLS13LabelResumptionPSK

◆ kTLS13LabelServerApplicationTraffic

◆ kTLS13LabelServerHandshakeTraffic