Implement the TLS 1.2 mechanisms for PKCS #11.

nss/lib/softoken/pkcs11c.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * This file implements PKCS 11 on top of our existing security modules
  *
  * For more information about PKCS 11 See PKCS 11 Token Inteface Standard.
  *   This implementation has two slots:
  *      slot 1 is our generic crypto support. It does not require login.
  *   It supports Public Key ops, and all they bulk ciphers and hashes. 
@@ skipping 139 matching lines @@
  */
 static CK_RV
 sftk_MapVerifyError(int error)
 {
     CK_RV crv = sftk_MapCryptError(error);
     if (crv == CKR_DEVICE_ERROR)
         crv = CKR_SIGNATURE_INVALID;
     return crv;
 }
 
+static HASH_HashType
+GetHashTypeFromMechanism(CK_MECHANISM_TYPE mech)
+{
+    switch (mech) {
+        case CKM_SHA256:
+            return HASH_AlgSHA256;
+        case CKM_SHA384:
+            return HASH_AlgSHA384;
+        case CKM_SHA512:
+            return HASH_AlgSHA512;
+        default:
+            return HASH_AlgNULL;
+    }
+}
+
 
 /*
  * turn a CDMF key into a des key. CDMF is an old IBM scheme to export DES by
  * Deprecating a full des key to 40 bit key strenth.
  */
 static CK_RV
 sftk_cdmf2des(unsigned char *cdmfkey, unsigned char *deskey)
 {
     unsigned char key1[8] = { 0xc4, 0x08, 0xb0, 0x54, 0x0b, 0xa1, 0xe0, 0xae };
     unsigned char key2[8] = { 0xef, 0x2c, 0x04, 0x1c, 0xe6, 0x38, 0x2f, 0xe6 };
@@ skipping 2070 matching lines @@
 
     case CKM_SSL3_MD5_MAC:
         crv = sftk_doSSLMACInit(context,SEC_OID_MD5,key,
                                         *(CK_ULONG *)pMechanism->pParameter);
         break;
     case CKM_SSL3_SHA1_MAC:
         crv = sftk_doSSLMACInit(context,SEC_OID_SHA1,key,
                                         *(CK_ULONG *)pMechanism->pParameter);
         break;
     case CKM_TLS_PRF_GENERAL:
-        crv = sftk_TLSPRFInit(context, key, key_type, HASH_AlgNULL);
+        crv = sftk_TLSPRFInit(context, key, key_type, HASH_AlgNULL, 0);
         break;
+    case CKM_TLS12_MAC: {
+        CK_TLS12_MAC_PARAMS *tls12_mac_params;
+        HASH_HashType tlsPrfHash;
+        const char *label;
+
+        if (pMechanism->ulParameterLen != sizeof(CK_TLS12_MAC_PARAMS)) {
+            crv = CKR_MECHANISM_PARAM_INVALID;
+            break;
+        }
+        tls12_mac_params = (CK_TLS12_MAC_PARAMS *)pMechanism->pParameter;
+        if (tls12_mac_params->prfHashMechanism == CKM_TLS_PRF) {
+            /* The TLS 1.0 and 1.1 PRF */
+            tlsPrfHash = HASH_AlgNULL;
+            if (tls12_mac_params->ulMacLength != 12) {
+                crv = CKR_MECHANISM_PARAM_INVALID;
+                break;
+            }
+        } else {
+            /* The hash function for the TLS 1.2 PRF */
+            tlsPrfHash =
+                GetHashTypeFromMechanism(tls12_mac_params->prfHashMechanism);
+            if (tlsPrfHash == HASH_AlgNULL ||
+                tls12_mac_params->ulMacLength < 12) {
+                crv = CKR_MECHANISM_PARAM_INVALID;
+                break;
+            }
+        }
+        if (tls12_mac_params->ulServerOrClient == 1) {
+            label = "server finished";
+        } else if (tls12_mac_params->ulServerOrClient == 2) {
+            label = "client finished";
+        } else {
+            crv = CKR_MECHANISM_PARAM_INVALID;
+            break;
+        }
+        crv = sftk_TLSPRFInit(context, key, key_type, tlsPrfHash,
+                              tls12_mac_params->ulMacLength);
+        if (crv == CKR_OK) {
+            context->hashUpdate(context->hashInfo, label, 15);
+        }
+        break;
+    }
     case CKM_NSS_TLS_PRF_GENERAL_SHA256:
-        crv = sftk_TLSPRFInit(context, key, key_type, HASH_AlgSHA256);
+        crv = sftk_TLSPRFInit(context, key, key_type, HASH_AlgSHA256, 0);
         break;
 
     case CKM_NSS_HMAC_CONSTANT_TIME: {
         sftk_MACConstantTimeCtx *ctx =
             sftk_HMACConstantTime_New(pMechanism,key);
         CK_ULONG *intpointer;
 
         if (ctx == NULL) {
             crv = CKR_ARGUMENTS_BAD;
             break;
@@ skipping 535 matching lines @@
 
     case CKM_SSL3_MD5_MAC:
         crv = sftk_doSSLMACInit(context,SEC_OID_MD5,key,
                                         *(CK_ULONG *)pMechanism->pParameter);
         break;
     case CKM_SSL3_SHA1_MAC:
         crv = sftk_doSSLMACInit(context,SEC_OID_SHA1,key,
                                         *(CK_ULONG *)pMechanism->pParameter);
         break;
     case CKM_TLS_PRF_GENERAL:
-        crv = sftk_TLSPRFInit(context, key, key_type, HASH_AlgNULL);
+        crv = sftk_TLSPRFInit(context, key, key_type, HASH_AlgNULL, 0);
         break;
     case CKM_NSS_TLS_PRF_GENERAL_SHA256:
-        crv = sftk_TLSPRFInit(context, key, key_type, HASH_AlgSHA256);
+        crv = sftk_TLSPRFInit(context, key, key_type, HASH_AlgSHA256, 0);
         break;
 
     default:
         crv = CKR_MECHANISM_INVALID;
         break;
     }
 
     if (crv != CKR_OK) {
         if (info) PORT_Free(info);
         sftk_FreeContext(context);
@@ skipping 2646 matching lines @@
     MD2Context *    md2;
     CK_ULONG        macSize;
     CK_ULONG        tmpKeySize;
     CK_ULONG        IVSize;
     CK_ULONG        keySize     = 0;
     CK_RV           crv         = CKR_OK;
     CK_BBOOL        cktrue      = CK_TRUE;
     CK_KEY_TYPE     keyType     = CKK_GENERIC_SECRET;
     CK_OBJECT_CLASS classType   = CKO_SECRET_KEY;
     CK_KEY_DERIVATION_STRING_DATA *stringPtr;
+    CK_MECHANISM_TYPE mechanism = pMechanism->mechanism;
     PRBool          isTLS = PR_FALSE;
-    PRBool          isSHA256 = PR_FALSE;
     PRBool          isDH = PR_FALSE;
+    HASH_HashType   tlsPrfHash = HASH_AlgNULL;
     SECStatus       rv;
     int             i;
     unsigned int    outLen;
     unsigned char   sha_out[SHA1_LENGTH];
     unsigned char   key_block[NUM_MIXERS * MD5_LENGTH];
     unsigned char   key_block2[MD5_LENGTH];
     PRBool          isFIPS;             
     HASH_HashType   hashType;
     PRBool          extractValue = PR_TRUE;
 
@@ skipping 26 matching lines @@
         if (pTemplate[i].type == CKA_VALUE_LEN) {
             keySize = *(CK_ULONG *)pTemplate[i].pValue;
         }
     }
     if (crv != CKR_OK) { sftk_FreeObject(key); return crv; }
 
     if (keySize == 0) {
         keySize = sftk_MapKeySize(keyType);
     }
 
-    switch (pMechanism->mechanism) {
+    switch (mechanism) {
       case CKM_NSS_JPAKE_ROUND2_SHA1:   /* fall through */
       case CKM_NSS_JPAKE_ROUND2_SHA256: /* fall through */
       case CKM_NSS_JPAKE_ROUND2_SHA384: /* fall through */
       case CKM_NSS_JPAKE_ROUND2_SHA512:
           extractValue = PR_FALSE;
           classType = CKO_PRIVATE_KEY;
           break;
       case CKM_NSS_JPAKE_FINAL_SHA1:   /* fall through */
       case CKM_NSS_JPAKE_FINAL_SHA256: /* fall through */
       case CKM_NSS_JPAKE_FINAL_SHA384: /* fall through */
@@ skipping 27 matching lines @@
     if (extractValue) {
         /* get the value of the base key */
         att = sftk_FindAttribute(sourceKey,CKA_VALUE);
         if (att == NULL) {
             sftk_FreeObject(key);
             sftk_FreeObject(sourceKey);
             return CKR_KEY_HANDLE_INVALID;
         }
     }
 
-    switch (pMechanism->mechanism) {
+    switch (mechanism) {
     /*
      * generate the master secret 
      */
+    case CKM_TLS12_MASTER_KEY_DERIVE:
+    case CKM_TLS12_MASTER_KEY_DERIVE_DH:
     case CKM_NSS_TLS_MASTER_KEY_DERIVE_SHA256:
     case CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256:
-        isSHA256 = PR_TRUE;
-        /* fall thru */
     case CKM_TLS_MASTER_KEY_DERIVE:
     case CKM_TLS_MASTER_KEY_DERIVE_DH:
-        isTLS = PR_TRUE;
-        /* fall thru */
     case CKM_SSL3_MASTER_KEY_DERIVE:
     case CKM_SSL3_MASTER_KEY_DERIVE_DH:
       {
         CK_SSL3_MASTER_KEY_DERIVE_PARAMS *ssl3_master;
         SSL3RSAPreMasterSecret *          rsa_pms;
         unsigned char                     crsrdata[SSL3_RANDOM_LENGTH * 2];
 
-        if ((pMechanism->mechanism == CKM_SSL3_MASTER_KEY_DERIVE_DH) ||
-            (pMechanism->mechanism == CKM_TLS_MASTER_KEY_DERIVE_DH) ||
-            (pMechanism->mechanism == CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256))
-                isDH = PR_TRUE;
+        if ((mechanism == CKM_TLS12_MASTER_KEY_DERIVE) ||
+            (mechanism == CKM_TLS12_MASTER_KEY_DERIVE_DH)) {
+            CK_TLS12_MASTER_KEY_DERIVE_PARAMS *tls12_master =
+                (CK_TLS12_MASTER_KEY_DERIVE_PARAMS *) pMechanism->pParameter;
+            tlsPrfHash = GetHashTypeFromMechanism(tls12_master->prfHashMechanism);
+            if (tlsPrfHash == HASH_AlgNULL) {
+                crv = CKR_MECHANISM_PARAM_INVALID;
+                break;
+            }
+        } else if ((mechanism == CKM_NSS_TLS_MASTER_KEY_DERIVE_SHA256) ||
+                   (mechanism == CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256)) {
+            tlsPrfHash = HASH_AlgSHA256;
+        }
+
+        if ((mechanism != CKM_SSL3_MASTER_KEY_DERIVE) &&
+            (mechanism != CKM_SSL3_MASTER_KEY_DERIVE_DH)) {
+            isTLS = PR_TRUE;
+        }
+        if ((mechanism == CKM_SSL3_MASTER_KEY_DERIVE_DH) ||
+            (mechanism == CKM_TLS_MASTER_KEY_DERIVE_DH) ||
+            (mechanism == CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256) ||
+            (mechanism == CKM_TLS12_MASTER_KEY_DERIVE_DH)) {
+            isDH = PR_TRUE;
+        }
 
         /* first do the consistancy checks */
         if (!isDH && (att->attrib.ulValueLen != SSL3_PMS_LENGTH)) {
             crv = CKR_KEY_TYPE_INCONSISTENT;
             break;
         }
         att2 = sftk_FindAttribute(sourceKey,CKA_KEY_TYPE);
         if ((att2 == NULL) || (*(CK_KEY_TYPE *)att2->attrib.pValue !=
                                         CKK_GENERIC_SECRET)) {
             if (att2) sftk_FreeAttribute(att2);
@@ skipping 46 matching lines @@
             SECItem master = { siBuffer, NULL, 0 };
             SECItem pms    = { siBuffer, NULL, 0 };
 
             crsr.data   = crsrdata;
             crsr.len    = sizeof crsrdata;
             master.data = key_block;
             master.len  = SSL3_MASTER_SECRET_LENGTH;
             pms.data    = (unsigned char*)att->attrib.pValue;
             pms.len     =                 att->attrib.ulValueLen;
 
-            if (isSHA256) {
-                status = TLS_P_hash(HASH_AlgSHA256, &pms, "master secret",
+            if (tlsPrfHash != HASH_AlgNULL) {
+                status = TLS_P_hash(tlsPrfHash, &pms, "master secret",
                                     &crsr, &master, isFIPS);
             } else {
                 status = TLS_PRF(&pms, "master secret", &crsr, &master, isFIPS);
             }
             if (status != SECSuccess) {
                 crv = CKR_FUNCTION_FAILED;
                 break;
             }
         } else {
             /* now allocate the hash contexts */
@@ skipping 42 matching lines @@
             if (crv != CKR_OK) break;
             crv = sftk_forceAttribute(key,CKA_VERIFY,&cktrue,sizeof(CK_BBOOL));
             if (crv != CKR_OK) break;
             /* While we're here, we might as well force this, too. */
             crv = sftk_forceAttribute(key,CKA_DERIVE,&cktrue,sizeof(CK_BBOOL));
             if (crv != CKR_OK) break;
         }
         break;
       }
 
+    case CKM_TLS12_KEY_AND_MAC_DERIVE:
     case CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256:
-        isSHA256 = PR_TRUE;
-        /* fall thru */
     case CKM_TLS_KEY_AND_MAC_DERIVE:
-        isTLS = PR_TRUE;
-        /* fall thru */
     case CKM_SSL3_KEY_AND_MAC_DERIVE:
       {
         CK_SSL3_KEY_MAT_PARAMS *ssl3_keys;
         CK_SSL3_KEY_MAT_OUT *   ssl3_keys_out;
         CK_ULONG                effKeySize;
         unsigned int            block_needed;
         unsigned char           srcrdata[SSL3_RANDOM_LENGTH * 2];
         unsigned char           crsrdata[SSL3_RANDOM_LENGTH * 2];
 
+        if (mechanism == CKM_TLS12_KEY_AND_MAC_DERIVE) {
+            CK_TLS12_KEY_MAT_PARAMS *tls12_keys =
+                (CK_TLS12_KEY_MAT_PARAMS *) pMechanism->pParameter;
+            tlsPrfHash = GetHashTypeFromMechanism(tls12_keys->prfHashMechanism);
+            if (tlsPrfHash == HASH_AlgNULL) {
+                crv = CKR_MECHANISM_PARAM_INVALID;
+                break;
+            }
+        } else if (mechanism == CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256) {
+            tlsPrfHash = HASH_AlgSHA256;
+        }
+
+        if (mechanism != CKM_SSL3_KEY_AND_MAC_DERIVE) {
+            isTLS = PR_TRUE;
+        }
+
         crv = sftk_DeriveSensitiveCheck(sourceKey,key);
         if (crv != CKR_OK) break;
 
         if (att->attrib.ulValueLen != SSL3_MASTER_SECRET_LENGTH) {
             crv = CKR_KEY_FUNCTION_NOT_PERMITTED;
             break;
         }
         att2 = sftk_FindAttribute(sourceKey,CKA_KEY_TYPE);
         if ((att2 == NULL) || (*(CK_KEY_TYPE *)att2->attrib.pValue !=
                                         CKK_GENERIC_SECRET)) {
@@ skipping 59 matching lines @@
             SECItem       keyblk = { siBuffer, NULL, 0 };
             SECItem       master = { siBuffer, NULL, 0 }; 
 
             srcr.data   = srcrdata;
             srcr.len    = sizeof srcrdata;
             keyblk.data = key_block;
             keyblk.len  = block_needed;
             master.data = (unsigned char*)att->attrib.pValue;
             master.len  =                 att->attrib.ulValueLen;
 
-            if (isSHA256) {
-                status = TLS_P_hash(HASH_AlgSHA256, &master, "key expansion",
+            if (tlsPrfHash != HASH_AlgNULL) {
+                status = TLS_P_hash(tlsPrfHash, &master, "key expansion",
                                     &srcr, &keyblk, isFIPS);
             } else {
                 status = TLS_PRF(&master, "key expansion", &srcr, &keyblk,
                                  isFIPS);
             }
             if (status != SECSuccess) {
                 goto key_and_mac_derive_fail;
             }
         } else {
             unsigned int block_bytes = 0;
@@ skipping 595 matching lines @@
 
             rv = SEC_QuickDERDecodeItem(arena, &newPoint, 
                                         SEC_ASN1_GET(SEC_OctetStringTemplate), 
                                         &ecPoint);
             if (rv != SECSuccess) {
                 goto ec_loser;
             }
             ecPoint = newPoint;
         }
 
-        if (pMechanism->mechanism == CKM_ECDH1_COFACTOR_DERIVE) {
+        if (mechanism == CKM_ECDH1_COFACTOR_DERIVE) {
             withCofactor = PR_TRUE;
         } else {
             /* When not using cofactor derivation, one should
              * validate the public key to avoid small subgroup
              * attacks.
              */
             if (EC_ValidatePublicKey(&privKey->u.ec.ecParams, &ecPoint) 
                 != SECSuccess) {
                 goto ec_loser;
             }
@@ skipping 496 matching lines @@
     att = sftk_FindAttribute(key,CKA_VALUE);
     sftk_FreeObject(key);
     if (!att) {
         return CKR_KEY_HANDLE_INVALID;        
     }
     crv = NSC_DigestUpdate(hSession,(CK_BYTE_PTR)att->attrib.pValue,
                            att->attrib.ulValueLen);
     sftk_FreeAttribute(att);
     return crv;
 }