ARMmbed/mbedtls
1
0
Fork 0
mirror of https://github.com/ARMmbed/mbedtls.git synced 2025-06-24 22:29:04 +08:00
Code Issues Releases Wiki Activity

Merge pull request #6773 from yanrayw/6675-change-early_secrets-to-local

Browse Source 
TLS 1.3: Key Generation: Change tls13_early_secrets to local variable
This commit is contained in:
Ronald Cron 2023-02-14 09:03:32 +01:00 committed by GitHub
commit 70341c17b7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 7 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
library/ssl_misc.h
View File

@ -986,7 +986,6 @@ struct mbedtls_ssl_handshake_params {
mbedtls_ssl_tls13_handshake_secrets tls13_hs_secrets; mbedtls_ssl_tls13_handshake_secrets tls13_hs_secrets;
#if defined(MBEDTLS_SSL_EARLY_DATA) #if defined(MBEDTLS_SSL_EARLY_DATA)
mbedtls_ssl_tls13_early_secrets tls13_early_secrets;
/** TLS 1.3 transform for early data and handshake messages. */ /** TLS 1.3 transform for early data and handshake messages. */
mbedtls_ssl_transform *transform_earlydata; mbedtls_ssl_transform *transform_earlydata;
#endif #endif

14
library/ssl_tls13_keys.c
View File

@ -1127,10 +1127,10 @@ static int ssl_tls13_generate_early_key(mbedtls_ssl_context *ssl,
size_t transcript_len; size_t transcript_len;
size_t key_len; size_t key_len;
size_t iv_len; size_t iv_len;
mbedtls_ssl_tls13_early_secrets tls13_early_secrets;
mbedtls_ssl_handshake_params *handshake = ssl->handshake; mbedtls_ssl_handshake_params *handshake = ssl->handshake;
const mbedtls_ssl_ciphersuite_t *ciphersuite_info = handshake->ciphersuite_info; const mbedtls_ssl_ciphersuite_t *ciphersuite_info = handshake->ciphersuite_info;
mbedtls_ssl_tls13_early_secrets *tls13_early_secrets = &handshake->tls13_early_secrets;
MBEDTLS_SSL_DEBUG_MSG(2, ("=> ssl_tls13_generate_early_key")); MBEDTLS_SSL_DEBUG_MSG(2, ("=> ssl_tls13_generate_early_key"));
@ -1158,7 +1158,7 @@ static int ssl_tls13_generate_early_key(mbedtls_ssl_context *ssl,
ret = mbedtls_ssl_tls13_derive_early_secrets( ret = mbedtls_ssl_tls13_derive_early_secrets(
hash_alg, handshake->tls13_master_secrets.early, hash_alg, handshake->tls13_master_secrets.early,
transcript, transcript_len, tls13_early_secrets); transcript, transcript_len, &tls13_early_secrets);
if (ret != 0) { if (ret != 0) {
MBEDTLS_SSL_DEBUG_RET( MBEDTLS_SSL_DEBUG_RET(
1, "mbedtls_ssl_tls13_derive_early_secrets", ret); 1, "mbedtls_ssl_tls13_derive_early_secrets", ret);
@ -1167,7 +1167,7 @@ static int ssl_tls13_generate_early_key(mbedtls_ssl_context *ssl,
MBEDTLS_SSL_DEBUG_BUF( MBEDTLS_SSL_DEBUG_BUF(
4, "Client early traffic secret", 4, "Client early traffic secret",
tls13_early_secrets->client_early_traffic_secret, hash_len); tls13_early_secrets.client_early_traffic_secret, hash_len);
/* /*
* Export client handshake traffic secret * Export client handshake traffic secret
@ -1176,7 +1176,7 @@ static int ssl_tls13_generate_early_key(mbedtls_ssl_context *ssl,
ssl->f_export_keys( ssl->f_export_keys(
ssl->p_export_keys, ssl->p_export_keys,
MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_EARLY_SECRET, MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_EARLY_SECRET,
tls13_early_secrets->client_early_traffic_secret, tls13_early_secrets.client_early_traffic_secret,
hash_len, hash_len,
handshake->randbytes, handshake->randbytes,
handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN, handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN,
@ -1185,7 +1185,7 @@ static int ssl_tls13_generate_early_key(mbedtls_ssl_context *ssl,
ret = ssl_tls13_make_traffic_key( ret = ssl_tls13_make_traffic_key(
hash_alg, hash_alg,
tls13_early_secrets->client_early_traffic_secret, tls13_early_secrets.client_early_traffic_secret,
hash_len, traffic_keys->client_write_key, key_len, hash_len, traffic_keys->client_write_key, key_len,
traffic_keys->client_write_iv, iv_len); traffic_keys->client_write_iv, iv_len);
if (ret != 0) { if (ret != 0) {
@ -1206,9 +1206,9 @@ static int ssl_tls13_generate_early_key(mbedtls_ssl_context *ssl,
MBEDTLS_SSL_DEBUG_MSG(2, ("<= ssl_tls13_generate_early_key")); MBEDTLS_SSL_DEBUG_MSG(2, ("<= ssl_tls13_generate_early_key"));
cleanup: cleanup:
/* Erase secret and transcript */ /* Erase early secrets and transcript */
mbedtls_platform_zeroize( mbedtls_platform_zeroize(
tls13_early_secrets, sizeof(mbedtls_ssl_tls13_early_secrets)); &tls13_early_secrets, sizeof(mbedtls_ssl_tls13_early_secrets));
mbedtls_platform_zeroize(transcript, sizeof(transcript)); mbedtls_platform_zeroize(transcript, sizeof(transcript));
return ret; return ret;
} }