Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mandatory parts of TLS 1.3 #174

Merged
merged 19 commits into from
Mar 16, 2018
Merged

Mandatory parts of TLS 1.3 #174

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
351c62a
psk support in tls.py script on server side
tomato42 Feb 16, 2018
7ce663c
simple PSK integration test
tomato42 Feb 16, 2018
d9e855b
session obj TLS 1.3 exporter and resumption data
tomato42 Feb 16, 2018
6c28b6b
save the time when ticket was received
tomato42 Feb 19, 2018
7b44f57
keep reference to tickets in session
tomato42 Feb 19, 2018
31400ea
handshake helpers for client resumption
tomato42 Feb 19, 2018
1ee4c1b
TLS1.3 resumption support in client
tomato42 Feb 19, 2018
2e9f66b
resumption test in tls.py script
tomato42 Feb 19, 2018
e059118
handshake settings for server side support of session tickets
tomato42 Feb 19, 2018
daf8f52
session ticket payload
tomato42 Feb 19, 2018
fe471d6
add support for sending TLS 1.3 tickets in server
tomato42 Feb 19, 2018
2507236
restoring session from session ticket
tomato42 Feb 19, 2018
6296421
ticket support in tls.py server
tomato42 Feb 19, 2018
578f38f
clean up handshakesettings
tomato42 Feb 21, 2018
9a53913
don't try to negotiate TLS 1.3 with client_version
tomato42 Mar 6, 2018
5bbf1b3
handle FALLBACK_SCSV for TLS 1.3 too
tomato42 Mar 6, 2018
12aaaa1
draft-25: include record layer into AEAD additional data
tomato42 Mar 15, 2018
dc07b02
draft-26: update version number
tomato42 Mar 15, 2018
58a705e
verify TLS 1.3 record header
tomato42 Mar 16, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions tlslite/recordlayer.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -465,7 +465,12 @@ def _encryptThenSeal(self, buf, contentType):
len(buf)//256,
len(buf)%256])
else: # TLS 1.3
authData = bytearray(0)
out_len = len(buf) + self._writeState.encContext.tagLength
# this is just recreated Record Layer header
authData = bytearray([contentType,
self._recordSocket.version[0],
self._recordSocket.version[1],
out_len // 256, out_len % 256])

nonce = self._getNonce(self._writeState, seqNumBytes)

Expand Down Expand Up @@ -694,7 +699,7 @@ def _macThenDecrypt(self, recordType, buf):
def _decryptAndUnseal(self, recordType, buf):
"""Decrypt AEAD encrypted data"""
seqnumBytes = self._readState.getSeqNumBytes()
#AES-GCM, has an explicit variable nonce.
# AES-GCM has an explicit variable nonce in TLS 1.2
if "aes" in self._readState.encContext.name and \
not self._is_tls13_plus():
explicitNonceLength = 8
Expand All @@ -704,6 +709,8 @@ def _decryptAndUnseal(self, recordType, buf):
nonce = self._readState.fixedNonce + buf[:explicitNonceLength]
buf = buf[8:]
else:
# for TLS 1.3 and Chacha20 in TLS 1.2 share nonce generation
# algorithm
nonce = self._getNonce(self._readState, seqnumBytes)

if self._readState.encContext.tagLength > len(buf):
Expand All @@ -717,7 +724,9 @@ def _decryptAndUnseal(self, recordType, buf):
plaintextLen//256,
plaintextLen%256])
else: # TLS 1.3
authData = bytearray(0)
# this is essentially a Record Layer header
authData = bytearray([recordType, 3, 3,
len(buf) // 256, len(buf) % 256])
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I understand that this is probably easier to recreate the record layer header, but wouldn't it be more future-proof to carry it over from the actual data received?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this has the side-effect of enforcing them to those values, and I want to be strict on receiving

(on sending side I'm setting them to configured values as I want to be able to test this in other implementations)

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But on the receiving side you then do not authenticate what was sent over the wire. I do not know whether there is any theoretical attack possible this way though. The enforcing to the expected values should be done explicitly I think.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed: 58a705e


buf = self._readState.encContext.open(nonce, buf, authData)
if buf is None:
Expand Down
22 changes: 12 additions & 10 deletions unit_tests/test_tlslite_recordlayer.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -547,8 +547,8 @@ def test_sendRecord_with_encryption_tls1_3_aes_128_gcm(self):
b'\x00\x15' # length
))
self.assertEqual(sock.sent[0][5:], bytearray(
b'\xe1\x90\x2d\xd1\xfd\x24\xc8\x47\x70\xd4'
b'\x8c\x36\xf3\x2c\x93\x04\x39\x1f\x6f\x42\xeb'
b"\xe1\x90\x2d\xd1\xfd"
b'u\xdd\xa0\xb1VYB&\xe8\x05\xb1~\xe5u\x9a\x0f'
))

def test_recvRecord_with_encryption_tls1_3_aes_128_gcm(self):
Expand All @@ -562,8 +562,8 @@ def test_recvRecord_with_encryption_tls1_3_aes_128_gcm(self):
b'\x17' # application_data
b'\x03\x01' # hidden protocol version - TLS 1.x
b'\x00\x15' # length
b'\xe1\x90\x2d\xd1\xfd\x24\xc8\x47\x70\xd4'
b'\x8c\x36\xf3\x2c\x93\x04\x39\x1f\x6f\x42\xeb'
b"\xe1\x90\x2d\xd1\xfd"
b'u\xdd\xa0\xb1VYB&\xe8\x05\xb1~\xe5u\x9a\x0f'
))

recordLayer = RecordLayer(sock)
Expand Down Expand Up @@ -621,7 +621,8 @@ def test_sendRecord_with_encryption_tls1_3_aes_256_gcm(self):
b'\x00\x15' # length
))
self.assertEqual(sock.sent[0][5:], bytearray(
b'}\x17w_#\xf0\xf2R\xaa*s\xe2\xca\xab\x9d\xea\x9d\xf3\xc1-\xd2'
b'}\x17w_#'
b'\xfc\\\xaf\x1ef6\x03X\xd2\xe3\x1c\xe4]\xcb\xb7\xbb'
))

def test_sendRecord_with_encryption_tls1_3_chacha20(self):
Expand Down Expand Up @@ -657,7 +658,8 @@ def test_sendRecord_with_encryption_tls1_3_chacha20(self):
b'\x00\x15' # length
))
self.assertEqual(sock.sent[0][5:], bytearray(
b'o\x9fO\x16\x07\x878]GV\xa5l\x12\xb6\x85\xb5@\x83\x94\x06\xd6'
b'o\x9fO\x16\x07'
b'\xbdUy\x17E6\n\xd9\x9cT\xec\xdav\x1f\xb4$'
))

def test_sendRecord_with_padding_tls1_3(self):
Expand Down Expand Up @@ -707,9 +709,8 @@ def padding_cb(length, contenttype, max_padding):
b"\xf6\x10\xe5}\xb1T\x85om\xa4\xfa\x1aS\x1f\xab\xc6b\'\xe6f" +
b"\xb3\xbe\xac\xfd\xed\x06\x93\xadbGMD\xd9\xb9\xca\xf6\x8b" +
b"\xac\x07\x96\xe8\xd13)r\xbcNJ\x9d#YP@\x9b\x8ez\x06\xfb" +
b"\x8f2\x8cz\xb7\xd6IP\xfa\xeezcQ\xf3\xe2n\x82\xd1\x9f\xd1x" +
b"\x01x\xea\xd4ht[)\x06"
))
b"\x8f2\x8cz\xb7\xd6IP\xfa\xeezcQ\xf3"
b"(\t\x8e\x0b\xf8\x02\xb4\x9du\xa0f\x88;\xb9\xfd\x87"))

def test_sendRecord_with_malformed_inner_plaintext(self):
# setup
Expand Down Expand Up @@ -748,7 +749,8 @@ def test_sendRecord_with_malformed_inner_plaintext(self):
b'\x00\x15' # length
))
self.assertEqual(sock.sent[0][5:], bytearray(
b'\x95\xf5^\xa5\xea\x8cCf\xbb\xbb\xe2\xdb!\x13\xf1\x1b\x93s\x81>M'
b'\x95\xf5^\xa5\xea'
b'\xddV\x81z97\xaf\xf4\xd7g\xae\xd4\x89\x9b\xe6\xa9'
))

# test proper
Expand Down