Skip to content

Commit ba47950

Browse files
Christian J. DietrichPeterMosmans
Christian J. Dietrich
authored and
PeterMosmans
committed
Added experimental TLS-RSA-PSK ciphersuites
Original patch by Christian J. Dietrich <dietrich@internet-sicherheit.de> Modified patch by Giuseppe D'Angelo <giuseppe.dangelo@kdab.com> RT: 2464
1 parent e5c8e70 commit ba47950

File tree

10 files changed

+438
-35
lines changed

10 files changed

+438
-35
lines changed

‎CHANGES

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22
OpenSSL CHANGES
33
_______________
44

5+
*) Support for TLS-RSA-PSK ciphersuites has been added.
6+
[Giuseppe D'Angelo, Christian J. Dietrich]
7+
58
Changes between 1.0.1j and 1.0.2 [xx XXX xxxx]
69

710
*) SRTP Memory Leak.

‎doc/apps/ciphers.pod

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -587,6 +587,10 @@ Note: these ciphers can also be used in SSL v3.
587587

588588
=head2 Pre shared keying (PSK) ciphersuites
589589

590+
TLS_RSA_PSK_WITH_RC4_128_SHA RSA-PSK-RC4-SHA
591+
TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA RSA-PSK-3DES-EDE-CBC-SHA
592+
TLS_RSA_PSK_WITH_AES_128_CBC_SHA RSA-PSK-AES128-CBC-SHA
593+
TLS_RSA_PSK_WITH_AES_256_CBC_SHA RSA-PSK-AES256-CBC-SHA
590594
TLS_PSK_WITH_RC4_128_SHA PSK-RC4-SHA
591595
TLS_PSK_WITH_3DES_EDE_CBC_SHA PSK-3DES-EDE-CBC-SHA
592596
TLS_PSK_WITH_AES_128_CBC_SHA PSK-AES128-CBC-SHA

‎ssl/s3_clnt.c

Lines changed: 111 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -336,7 +336,7 @@ int ssl3_connect(SSL *s)
336336
}
337337
#endif
338338
/* Check if it is anon DH/ECDH, SRP auth */
339-
/* or PSK */
339+
/* or plain PSK */
340340
if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL|SSL_aSRP)) &&
341341
!(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK))
342342
{
@@ -1402,9 +1402,9 @@ int ssl3_get_key_exchange(SSL *s)
14021402
if (s->s3->tmp.message_type != SSL3_MT_SERVER_KEY_EXCHANGE)
14031403
{
14041404
#ifndef OPENSSL_NO_PSK
1405-
/* In plain PSK ciphersuite, ServerKeyExchange can be
1405+
/* In PSK ciphersuites, ServerKeyExchange can be
14061406
omitted if no identity hint is sent. Set
1407-
session->sess_cert anyway to avoid problems
1407+
session->sess_cert for plain PSK anyway to avoid problems
14081408
later.*/
14091409
if (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)
14101410
{
@@ -1458,7 +1458,12 @@ int ssl3_get_key_exchange(SSL *s)
14581458
al=SSL_AD_DECODE_ERROR;
14591459

14601460
#ifndef OPENSSL_NO_PSK
1461-
if (alg_k & SSL_kPSK)
1461+
/* handle PSK identity hint */
1462+
if (alg_k & (SSL_kPSK
1463+
#ifndef OPENSSL_NO_RSA
1464+
|SSL_kRSAPSK
1465+
#endif
1466+
))
14621467
{
14631468
char tmp_id_hint[PSK_MAX_IDENTITY_LEN+1];
14641469

@@ -1635,7 +1640,11 @@ int ssl3_get_key_exchange(SSL *s)
16351640
else
16361641
#endif /* !OPENSSL_NO_SRP */
16371642
#ifndef OPENSSL_NO_RSA
1638-
if (alg_k & SSL_kRSA)
1643+
if (alg_k & (SSL_kRSA
1644+
#ifndef OPENSSL_NO_PSK
1645+
|SSL_kRSAPSK
1646+
#endif
1647+
))
16391648
{
16401649
if ((rsa=RSA_new()) == NULL)
16411650
{
@@ -2038,8 +2047,16 @@ fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_name(md));
20382047
}
20392048
else
20402049
{
2041-
/* aNULL, aSRP or kPSK do not need public keys */
2042-
if (!(alg_a & (SSL_aNULL|SSL_aSRP)) && !(alg_k & SSL_kPSK))
2050+
/* aNULL, aSRP, kPSK or kRSAPSK do not need public keys */
2051+
if (!(alg_a & (SSL_aNULL|SSL_aSRP))
2052+
#ifndef OPENSSL_NO_PSK
2053+
&& !(alg_k & (SSL_kPSK
2054+
#ifndef OPENSSL_NO_RSA
2055+
|SSL_kRSAPSK
2056+
#endif
2057+
))
2058+
#endif
2059+
)
20432060
{
20442061
/* Might be wrong key type, check it */
20452062
if (ssl3_check_cert_and_algorithm(s))
@@ -3109,15 +3126,19 @@ int ssl3_send_client_key_exchange(SSL *s)
31093126
}
31103127
#endif
31113128
#ifndef OPENSSL_NO_PSK
3112-
else if (alg_k & SSL_kPSK)
3129+
else if (alg_k & SSL_kPSK
3130+
#ifndef OPENSSL_NO_RSA
3131+
|| alg_k & SSL_kRSAPSK
3132+
#endif
3133+
)
31133134
{
31143135
/* The callback needs PSK_MAX_IDENTITY_LEN + 1 bytes
31153136
* to return a \0-terminated identity. The last byte
31163137
* is for us for simulating strnlen. */
31173138
char identity[PSK_MAX_IDENTITY_LEN + 2];
31183139
size_t identity_len;
3119-
unsigned char *t = NULL;
31203140
unsigned char psk_or_pre_ms[PSK_MAX_PSK_LEN*2+4];
3141+
unsigned char *t = psk_or_pre_ms;
31213142
unsigned int pre_ms_len = 0, psk_len = 0;
31223143
int psk_err = 1;
31233144

@@ -3153,14 +3174,36 @@ int ssl3_send_client_key_exchange(SSL *s)
31533174
ERR_R_INTERNAL_ERROR);
31543175
goto psk_err;
31553176
}
3156-
/* create PSK pre_master_secret */
3157-
pre_ms_len = 2+psk_len+2+psk_len;
3158-
t = psk_or_pre_ms;
3159-
memmove(psk_or_pre_ms+psk_len+4, psk_or_pre_ms, psk_len);
3160-
s2n(psk_len, t);
3161-
memset(t, 0, psk_len);
3162-
t+=psk_len;
3163-
s2n(psk_len, t);
3177+
3178+
if (alg_k & SSL_kPSK)
3179+
{
3180+
/* create PSK pre_master_secret */
3181+
pre_ms_len = 2+psk_len+2+psk_len;
3182+
memmove(psk_or_pre_ms+psk_len+4, psk_or_pre_ms, psk_len);
3183+
s2n(psk_len, t);
3184+
memset(t, 0, psk_len);
3185+
t+=psk_len;
3186+
s2n(psk_len, t);
3187+
}
3188+
#ifndef OPENSSL_NO_RSA
3189+
else if (alg_k & SSL_kRSAPSK)
3190+
{
3191+
const unsigned int pre_ms_prefix = 48;
3192+
3193+
pre_ms_len = 2 + 2 + 46 + 2 + psk_len;
3194+
memmove(psk_or_pre_ms + 52, psk_or_pre_ms, psk_len);
3195+
s2n(pre_ms_prefix, t);
3196+
3197+
psk_or_pre_ms[2] = s->client_version >> 8;
3198+
psk_or_pre_ms[3] = s->client_version & 0xff;
3199+
t += 2;
3200+
3201+
if (RAND_bytes(psk_or_pre_ms + 4, 46) <= 0)
3202+
goto psk_err;
3203+
t += 46;
3204+
s2n(psk_len, t);
3205+
}
3206+
#endif
31643207

31653208
if (s->session->psk_identity_hint != NULL)
31663209
OPENSSL_free(s->session->psk_identity_hint);
@@ -3187,10 +3230,51 @@ int ssl3_send_client_key_exchange(SSL *s)
31873230
s->method->ssl3_enc->generate_master_secret(s,
31883231
s->session->master_key,
31893232
psk_or_pre_ms, pre_ms_len);
3233+
31903234
s2n(identity_len, p);
31913235
memcpy(p, identity, identity_len);
3236+
p += identity_len;
3237+
31923238
n = 2 + identity_len;
3239+
3240+
#ifndef OPENSSL_NO_RSA
3241+
if (alg_k & SSL_kRSAPSK)
3242+
{
3243+
RSA *rsa;
3244+
int enc_n;
3245+
3246+
if (s->session->sess_cert->peer_rsa_tmp != NULL)
3247+
{
3248+
rsa = s->session->sess_cert->peer_rsa_tmp;
3249+
}
3250+
else
3251+
{
3252+
pkey = X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
3253+
if ((pkey == NULL) ||
3254+
(pkey->type != EVP_PKEY_RSA) ||
3255+
(pkey->pkey.rsa == NULL))
3256+
{
3257+
SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
3258+
goto psk_err;
3259+
}
3260+
rsa = pkey->pkey.rsa;
3261+
EVP_PKEY_free(pkey);
3262+
}
3263+
3264+
enc_n = RSA_public_encrypt(48, psk_or_pre_ms + 2, p + 2, rsa, RSA_PKCS1_PADDING);
3265+
if (enc_n <= 0)
3266+
{
3267+
SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, SSL_R_BAD_RSA_ENCRYPT);
3268+
goto psk_err;
3269+
}
3270+
n += enc_n;
3271+
3272+
s2n(enc_n, p);
3273+
n += 2;
3274+
}
3275+
#endif
31933276
psk_err = 0;
3277+
31943278
psk_err:
31953279
OPENSSL_cleanse(identity, sizeof(identity));
31963280
OPENSSL_cleanse(psk_or_pre_ms, sizeof(psk_or_pre_ms));
@@ -3597,7 +3681,11 @@ int ssl3_check_cert_and_algorithm(SSL *s)
35973681
}
35983682
#endif
35993683
#ifndef OPENSSL_NO_RSA
3600-
if ((alg_k & SSL_kRSA) &&
3684+
if ((alg_k & (SSL_kRSA
3685+
#ifndef OPENSSL_NO_PSK
3686+
|SSL_kRSAPSK
3687+
#endif
3688+
)) &&
36013689
!(has_bits(i,EVP_PK_RSA|EVP_PKT_ENC) || (rsa != NULL)))
36023690
{
36033691
SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_RSA_ENCRYPTING_CERT);
@@ -3630,7 +3718,11 @@ int ssl3_check_cert_and_algorithm(SSL *s)
36303718
if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && !has_bits(i,EVP_PKT_EXP))
36313719
{
36323720
#ifndef OPENSSL_NO_RSA
3633-
if (alg_k & SSL_kRSA)
3721+
if (alg_k & (SSL_kRSA
3722+
#ifndef OPENSSL_NO_PSK
3723+
|SSL_kRSAPSK
3724+
#endif
3725+
))
36343726
{
36353727
if (rsa == NULL
36363728
|| RSA_size(rsa)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))

‎ssl/s3_lib.c

Lines changed: 68 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1720,6 +1720,73 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
17201720
256,
17211721
256,
17221722
},
1723+
1724+
#ifndef OPENSSL_NO_RSA
1725+
/* RSA-PSK ciphersuites */
1726+
/* Cipher 92 */
1727+
{
1728+
1,
1729+
TLS1_TXT_RSA_PSK_WITH_RC4_128_SHA,
1730+
TLS1_CK_RSA_PSK_WITH_RC4_128_SHA,
1731+
SSL_kRSAPSK,
1732+
SSL_aRSA,
1733+
SSL_RC4,
1734+
SSL_SHA1,
1735+
SSL_TLSV1,
1736+
SSL_NOT_EXP|SSL_MEDIUM,
1737+
SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1738+
128,
1739+
128,
1740+
},
1741+
1742+
/* Cipher 93 */
1743+
{
1744+
1,
1745+
TLS1_TXT_RSA_PSK_WITH_3DES_EDE_CBC_SHA,
1746+
TLS1_CK_RSA_PSK_WITH_3DES_EDE_CBC_SHA,
1747+
SSL_kRSAPSK,
1748+
SSL_aRSA,
1749+
SSL_3DES,
1750+
SSL_SHA1,
1751+
SSL_TLSV1,
1752+
SSL_NOT_EXP|SSL_HIGH,
1753+
SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1754+
112,
1755+
168,
1756+
},
1757+
1758+
/* Cipher 94 */
1759+
{
1760+
1,
1761+
TLS1_TXT_RSA_PSK_WITH_AES_128_CBC_SHA,
1762+
TLS1_CK_RSA_PSK_WITH_AES_128_CBC_SHA,
1763+
SSL_kRSAPSK,
1764+
SSL_aRSA,
1765+
SSL_AES128,
1766+
SSL_SHA1,
1767+
SSL_TLSV1,
1768+
SSL_NOT_EXP|SSL_HIGH,
1769+
SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1770+
128,
1771+
128,
1772+
},
1773+
1774+
/* Cipher 95 */
1775+
{
1776+
1,
1777+
TLS1_TXT_RSA_PSK_WITH_AES_256_CBC_SHA,
1778+
TLS1_CK_RSA_PSK_WITH_AES_256_CBC_SHA,
1779+
SSL_kRSAPSK,
1780+
SSL_aRSA,
1781+
SSL_AES256,
1782+
SSL_SHA1,
1783+
SSL_TLSV1,
1784+
SSL_NOT_EXP|SSL_HIGH,
1785+
SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1786+
256,
1787+
256,
1788+
},
1789+
#endif /* OPENSSL_NO_RSA */
17231790
#endif /* OPENSSL_NO_PSK */
17241791

17251792
#ifndef OPENSSL_NO_SEED
@@ -4553,7 +4620,7 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
45534620
#endif /* OPENSSL_NO_KRB5 */
45544621
#ifndef OPENSSL_NO_PSK
45554622
/* with PSK there must be server callback set */
4556-
if ((alg_k & SSL_kPSK) && s->psk_server_callback == NULL)
4623+
if ((alg_k & (SSL_kPSK|SSL_kRSAPSK)) && s->psk_server_callback == NULL)
45574624
continue;
45584625
#endif /* OPENSSL_NO_PSK */
45594626

0 commit comments

Comments
 (0)