sha1-tlsprf.c revision 1f69aa52ea2e0a73ac502565df8c666ee49cab6a 
1/*
2 * TLS PRF (SHA1 + MD5)
3 * Copyright (c) 2003-2005, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15#include "includes.h"
16
17#include "common.h"
18#include "sha1.h"
19#include "md5.h"
20
21
22/**
23 * tls_prf_sha1_md5 - Pseudo-Random Function for TLS (TLS-PRF, RFC 2246)
24 * @secret: Key for PRF
25 * @secret_len: Length of the key in bytes
26 * @label: A unique label for each purpose of the PRF
27 * @seed: Seed value to bind into the key
28 * @seed_len: Length of the seed
29 * @out: Buffer for the generated pseudo-random key
30 * @outlen: Number of bytes of key to generate
31 * Returns: 0 on success, -1 on failure.
32 *
33 * This function is used to derive new, cryptographically separate keys from a
34 * given key in TLS. This PRF is defined in RFC 2246, Chapter 5.
35 */
36int tls_prf_sha1_md5(const u8 *secret, size_t secret_len, const char *label,
37		     const u8 *seed, size_t seed_len, u8 *out, size_t outlen)
38{
39	size_t L_S1, L_S2, i;
40	const u8 *S1, *S2;
41	u8 A_MD5[MD5_MAC_LEN], A_SHA1[SHA1_MAC_LEN];
42	u8 P_MD5[MD5_MAC_LEN], P_SHA1[SHA1_MAC_LEN];
43	int MD5_pos, SHA1_pos;
44	const u8 *MD5_addr[3];
45	size_t MD5_len[3];
46	const unsigned char *SHA1_addr[3];
47	size_t SHA1_len[3];
48
49	if (secret_len & 1)
50		return -1;
51
52	MD5_addr[0] = A_MD5;
53	MD5_len[0] = MD5_MAC_LEN;
54	MD5_addr[1] = (unsigned char *) label;
55	MD5_len[1] = os_strlen(label);
56	MD5_addr[2] = seed;
57	MD5_len[2] = seed_len;
58
59	SHA1_addr[0] = A_SHA1;
60	SHA1_len[0] = SHA1_MAC_LEN;
61	SHA1_addr[1] = (unsigned char *) label;
62	SHA1_len[1] = os_strlen(label);
63	SHA1_addr[2] = seed;
64	SHA1_len[2] = seed_len;
65
66	/* RFC 2246, Chapter 5
67	 * A(0) = seed, A(i) = HMAC(secret, A(i-1))
68	 * P_hash = HMAC(secret, A(1) + seed) + HMAC(secret, A(2) + seed) + ..
69	 * PRF = P_MD5(S1, label + seed) XOR P_SHA-1(S2, label + seed)
70	 */
71
72	L_S1 = L_S2 = (secret_len + 1) / 2;
73	S1 = secret;
74	S2 = secret + L_S1;
75	if (secret_len & 1) {
76		/* The last byte of S1 will be shared with S2 */
77		S2--;
78	}
79
80	hmac_md5_vector_non_fips_allow(S1, L_S1, 2, &MD5_addr[1], &MD5_len[1],
81				       A_MD5);
82	hmac_sha1_vector(S2, L_S2, 2, &SHA1_addr[1], &SHA1_len[1], A_SHA1);
83
84	MD5_pos = MD5_MAC_LEN;
85	SHA1_pos = SHA1_MAC_LEN;
86	for (i = 0; i < outlen; i++) {
87		if (MD5_pos == MD5_MAC_LEN) {
88			hmac_md5_vector_non_fips_allow(S1, L_S1, 3, MD5_addr,
89						       MD5_len, P_MD5);
90			MD5_pos = 0;
91			hmac_md5_non_fips_allow(S1, L_S1, A_MD5, MD5_MAC_LEN,
92						A_MD5);
93		}
94		if (SHA1_pos == SHA1_MAC_LEN) {
95			hmac_sha1_vector(S2, L_S2, 3, SHA1_addr, SHA1_len,
96					 P_SHA1);
97			SHA1_pos = 0;
98			hmac_sha1(S2, L_S2, A_SHA1, SHA1_MAC_LEN, A_SHA1);
99		}
100
101		out[i] = P_MD5[MD5_pos] ^ P_SHA1[SHA1_pos];
102
103		MD5_pos++;
104		SHA1_pos++;
105	}
106
107	return 0;
108}
109