3 * The TLS pseudo-random function
5 * (c) 2001 Straylight/Edgeware
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of Catacomb.
12 * Catacomb is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU Library General Public License as
14 * published by the Free Software Foundation; either version 2 of the
15 * License, or (at your option) any later version.
17 * Catacomb is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU Library General Public License for more details.
22 * You should have received a copy of the GNU Library General Public
23 * License along with Catacomb; if not, write to the Free
24 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
28 /*----- Header files ------------------------------------------------------*/
30 #include <mLib/alloc.h>
31 #include <mLib/dstr.h>
40 /*----- The data expansion function ---------------------------------------*/
42 /* --- @tlsdx_init@ --- *
44 * Arguments: @tlsdx_ctx *c@ = pointer to a context
45 * @gmac *m@ = pointer to a generic MAC instance
46 * @const void *sd@ = pointer to the seed block
47 * @size_t sdsz@ = size of the seed block
51 * Use: Initializes a context for the TLS data expansion function.
52 * This doesn't take ownership of the MAC instance or the seed
53 * memory, nor does it allocate copies.
56 void tlsdx_init(tlsdx_ctx
*c
, gmac
*m
, const void *sd
, size_t sdsz
)
59 c
->hashsz
= GM_CLASS(c
->k
)->hashsz
;
60 c
->sd
= sd
; c
->sdsz
= sdsz
;
63 GH_HASH(c
->i
, sd
, sdsz
);
64 c
->ai
= GH_DONE(c
->i
, 0);
66 GH_HASH(c
->o
, c
->ai
, c
->hashsz
);
67 GH_HASH(c
->o
, sd
, sdsz
);
68 c
->p
= GH_DONE(c
->o
, 0);
72 /* --- @tlsdx_encrypt@ --- *
74 * Arguments: @tlsdx_ctx *c@ = pointer to a context
75 * @const void *src@ = pointer to source data
76 * @void *dest@ = pointer to destination buffer
77 * @size_t sz@ = size of buffer
81 * Use: Encrypts data using the TLS data expansion function. If the
82 * destination pointer is null, the generator is spun and no
83 * output is produced; if the source pointer is null, raw output
84 * from the generator is written; otherwise, the source data is
85 * XORed with the generator output.
88 void tlsdx_encrypt(tlsdx_ctx
*c
, const void *src
, void *dest
, size_t sz
)
101 GH_HASH(h
, c
->ai
, c
->hashsz
);
102 c
->ai
= GH_DONE(h
, 0);
106 h
= c
->o
= GM_INIT(c
->k
);
107 GH_HASH(h
, c
->ai
, c
->hashsz
);
108 GH_HASH(h
, c
->sd
, c
->sdsz
);
109 c
->p
= GH_DONE(h
, 0);
110 c
->sz
= n
= c
->hashsz
;
118 for (i
= 0; i
< n
; i
++) d
[i
] = s
[i
] ^ c
->p
[i
];
129 /* --- @tlsdx_free@ --- *
131 * Arguments: @tlsdx_ctx *c@ = pointer to the context block
135 * Use: Frees a context for the TLS data expansion function
138 void tlsdx_free(tlsdx_ctx
*c
)
144 /* --- Generic random number generator --- */
146 typedef struct dx_grctx
{
152 static void dx_grdestroy(grand
*r
)
154 dx_grctx
*g
= (dx_grctx
*)r
;
155 xfree((char *)g
->ops
.name
);
156 xfree((octet
*)g
->dx
.sd
);
157 g
->dx
.k
->ops
->destroy(g
->dx
.k
);
163 static void dx_seed(dx_grctx
*g
, const void *p
, size_t sz
)
166 xfree((octet
*)g
->dx
.sd
);
167 g
->dx
.sd
= q
= xmalloc(sz
);
172 static int dx_grmisc(grand
*r
, unsigned op
, ...)
174 dx_grctx
*g
= (dx_grctx
*)r
;
183 switch (va_arg(ap
, unsigned)) {
186 case GRAND_SEEDUINT32
:
187 case GRAND_SEEDBLOCK
:
197 i
= va_arg(ap
, unsigned);
199 dx_seed(g
, buf
, sizeof(buf
));
201 case GRAND_SEEDUINT32
:
202 i
= va_arg(ap
, uint32
);
204 dx_seed(g
, buf
, sizeof(buf
));
206 case GRAND_SEEDBLOCK
: {
207 const void *p
= va_arg(ap
, const void *);
208 size_t sz
= va_arg(ap
, size_t);
211 case GRAND_SEEDRAND
: {
212 grand
*rr
= va_arg(ap
, grand
*);
214 rr
->ops
->fill(rr
, buf
, sizeof(buf
));
215 dx_seed(g
, buf
, sizeof(buf
));
226 static octet
dx_grbyte(grand
*r
)
228 dx_grctx
*g
= (dx_grctx
*)r
;
230 tlsdx_encrypt(&g
->dx
, 0, &o
, 1);
234 static uint32
dx_grword(grand
*r
)
236 dx_grctx
*g
= (dx_grctx
*)r
;
238 tlsdx_encrypt(&g
->dx
, 0, &b
, sizeof(b
));
242 static void dx_grfill(grand
*r
, void *p
, size_t sz
)
244 dx_grctx
*g
= (dx_grctx
*)r
;
245 tlsdx_encrypt(&g
->dx
, 0, p
, sz
);
248 static const grand_ops dx_grops
= {
251 dx_grmisc
, dx_grdestroy
,
252 dx_grword
, dx_grbyte
, dx_grword
, grand_defaultrange
, dx_grfill
255 /* ---@tlsdx_rand@ --- *
257 * Arguments: @const gcmac *mc@ = MAC function to use
258 * @const void *k@ = pointer to the key material
259 * @size_t ksz@ = size of the key material
260 * @const void *sd@ = pointer to the seed material
261 * @size_t sdsz@ = size of the seed material
263 * Returns: Pointer to generic random number generator interface.
265 * Use: Creates a generic generator which does TLS data expansion.
268 grand
*tlsdx_rand(const gcmac
*mc
, const void *k
, size_t ksz
,
269 const void *sd
, size_t sdsz
)
271 dx_grctx
*g
= S_CREATE(dx_grctx
);
273 gmac
*m
= GM_KEY(mc
, k
, ksz
);
274 octet
*q
= xmalloc(sdsz
);
276 dstr_putf(&d
, "tlsdx(%s)", mc
->name
);
278 g
->ops
.name
= xstrdup(d
.buf
);
281 tlsdx_init(&g
->dx
, m
, q
, sdsz
);
285 /* --- The actual very paranoid PRF ---------------------------------------*/
287 /* --- @tlsprf_init@ --- *
289 * Arguments: @tlsprf_ctx *c@ = pointer to context block
290 * @const gcmac *mcx, *mcy@ = left and right MAC functions
291 * @const void *k@ = pointer to the key material
292 * @size_t ksz@ = size of the key material
293 * @const void *sd@ = pointer to the seed material
294 * @size_t sdsz@ = size of the seed material
298 * Use: Initializes a TLS PRF context.
301 void tlsprf_init(tlsprf_ctx
*c
, const gcmac
*mcx
, const gcmac
*mcy
,
302 const void *k
, size_t ksz
, const void *sd
, size_t sdsz
)
304 size_t n
= (ksz
+ 1)/2;
306 tlsdx_init(&c
->px
, mcx
->key(kk
, n
), sd
, sdsz
);
307 tlsdx_init(&c
->py
, mcy
->key(kk
+ ksz
- n
, n
), sd
, sdsz
);
310 /* --- @tlsprf_encrypt@ --- *
312 * Arguments: @tlsprf_ctx *c@ = pointer to a context
313 * @const void *src@ = pointer to source data
314 * @void *dest@ = pointer to destination buffer
315 * @size_t sz@ = size of buffer
319 * Use: Encrypts data using the TLS pseudo-random function. If the
320 * destination pointer is null, the generator is spun and no
321 * output is produced; if the source pointer is null, raw output
322 * from the generator is written; otherwise, the source data is
323 * XORed with the generator output.
326 void tlsprf_encrypt(tlsprf_ctx
*c
, const void *src
, void *dest
, size_t sz
)
328 tlsdx_encrypt(&c
->px
, src
, dest
, sz
);
329 tlsdx_encrypt(&c
->py
, dest
, dest
, sz
);
332 /* --- @tlsprf_free@ --- *
334 * Arguments: @tlsprf_ctx *c@ = pointer to a context
338 * Use: Frees a TLS PRF context.
341 void tlsprf_free(tlsprf_ctx
*c
)
343 c
->px
.k
->ops
->destroy(c
->px
.k
);
344 c
->py
.k
->ops
->destroy(c
->py
.k
);
349 /* --- Generic random number generator --- */
351 typedef struct prf_grctx
{
357 static void prf_grdestroy(grand
*r
)
359 prf_grctx
*g
= (prf_grctx
*)r
;
360 xfree((char *)g
->ops
.name
);
361 xfree((octet
*)g
->prf
.px
.sd
);
362 tlsprf_free(&g
->prf
);
367 static void prf_seed(prf_grctx
*g
, const void *p
, size_t sz
)
371 xfree((octet
*)g
->prf
.px
.sz
);
372 g
->prf
.px
.sd
= g
->prf
.py
.sd
= q
= xmalloc(sz
);
374 g
->prf
.px
.sdsz
= g
->prf
.py
.sdsz
= sz
;
377 static int prf_grmisc(grand
*r
, unsigned op
, ...)
379 prf_grctx
*g
= (prf_grctx
*)r
;
388 switch (va_arg(ap
, unsigned)) {
391 case GRAND_SEEDUINT32
:
392 case GRAND_SEEDBLOCK
:
402 i
= va_arg(ap
, unsigned);
404 prf_seed(g
, buf
, sizeof(buf
));
406 case GRAND_SEEDUINT32
:
407 i
= va_arg(ap
, uint32
);
409 prf_seed(g
, buf
, sizeof(buf
));
411 case GRAND_SEEDBLOCK
: {
412 const void *p
= va_arg(ap
, const void *);
413 size_t sz
= va_arg(ap
, size_t);
416 case GRAND_SEEDRAND
: {
417 grand
*rr
= va_arg(ap
, grand
*);
419 rr
->ops
->fill(rr
, buf
, sizeof(buf
));
420 prf_seed(g
, buf
, sizeof(buf
));
431 static octet
prf_grbyte(grand
*r
)
433 prf_grctx
*g
= (prf_grctx
*)r
;
435 tlsprf_encrypt(&g
->prf
, 0, &o
, 1);
439 static uint32
prf_grword(grand
*r
)
441 prf_grctx
*g
= (prf_grctx
*)r
;
443 tlsprf_encrypt(&g
->prf
, 0, &b
, sizeof(b
));
447 static void prf_grfill(grand
*r
, void *p
, size_t sz
)
449 prf_grctx
*g
= (prf_grctx
*)r
;
450 tlsprf_encrypt(&g
->prf
, 0, p
, sz
);
453 static const grand_ops prf_grops
= {
456 prf_grmisc
, prf_grdestroy
,
457 prf_grword
, prf_grbyte
, prf_grword
, grand_defaultrange
, prf_grfill
460 /* ---@tlsprf_rand@ --- *
462 * Arguments: @const gcmac *mcx, *mcy@ = MAC function to use
463 * @const void *k@ = pointer to the key material
464 * @size_t ksz@ = size of the key material
465 * @const void *sd@ = pointer to the seed material
466 * @size_t sdsz@ = size of the seed material
468 * Returns: Pointer to generic random number generator interface.
470 * Use: Creates a generic generator which does TLS data expansion.
473 grand
*tlsprf_rand(const gcmac
*mcx
, const gcmac
*mcy
,
474 const void *k
, size_t ksz
, const void *sd
, size_t sdsz
)
476 prf_grctx
*g
= S_CREATE(prf_grctx
);
478 octet
*q
= xmalloc(sdsz
);
480 dstr_putf(&d
, "tlsprf(%s,%s)", mcx
->name
, mcy
->name
);
482 g
->ops
.name
= xstrdup(d
.buf
);
485 tlsprf_init(&g
->prf
, mcx
, mcy
, k
, ksz
, q
, sdsz
);
489 /*----- Test rig ----------------------------------------------------------*/
496 #include <mLib/quis.h>
497 #include <mLib/testrig.h>
499 #include "sha-hmac.h"
500 #include "md5-hmac.h"
502 static int v_generate(dstr
*v
)
508 g
= tlsprf_rand(&md5_hmac
, &sha_hmac
,
509 v
[0].buf
, v
[0].len
, v
[1].buf
, v
[1].len
);
510 dstr_ensure(&d
, v
[2].len
);
512 g
->ops
->fill(g
, d
.buf
, d
.len
);
514 if (memcmp(v
[2].buf
, d
.buf
, d
.len
) != 0) {
516 printf("\nfail tlsprf:"
518 type_hex
.dump(&v
[0], stdout
);
519 printf("\n\tseed = "); type_hex
.dump(&v
[1], stdout
);
520 printf("\n\texpected = "); type_hex
.dump(&v
[2], stdout
);
521 printf("\n\tcalculated = "); type_hex
.dump(&d
, stdout
);
527 static test_chunk defs
[] = {
528 { "tlsprf", v_generate
, { &type_hex
, &type_hex
, &type_hex
, 0 } },
532 int main(int argc
, char *argv
[])
534 test_run(argc
, argv
, defs
, SRCDIR
"/t/tlsprf");
540 /*----- That's all, folks -------------------------------------------------*/