RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-27 05:37:34 +00:00
Code Issues Activity Actions

LibTLS: Generate cipher variants based on the cipher

Browse source 
This is better than using the AEAD flag :^)
This commit is contained in:
DexesTTP 2021-05-18 23:26:23 +02:00 • committed by Andreas Kling
parent 2e9a4bb95c
commit 9bb823a6ab
3 changed files with 42 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Userland/Libraries/LibTLS/CipherSuite.h
View file

@ -43,6 +43,7 @@ enum class SignatureAlgorithm : u8 {
}; };
enum class CipherAlgorithm { enum class CipherAlgorithm {
Invalid,
AES_128_CBC, AES_128_CBC,
AES_128_GCM, AES_128_GCM,
AES_128_CCM, AES_128_CCM,
@ -62,8 +63,9 @@ constexpr size_t cipher_key_size(CipherAlgorithm algorithm)
case CipherAlgorithm::AES_256_CBC: case CipherAlgorithm::AES_256_CBC:
case CipherAlgorithm::AES_256_GCM: case CipherAlgorithm::AES_256_GCM:
return 256; return 256;
case CipherAlgorithm::Invalid:
default: default:
return 128; return 0;
} }
} }

33
Userland/Libraries/LibTLS/HandshakeClient.cpp
View file

@ -25,6 +25,7 @@ bool TLSv12::expand_key()
} }
auto key_size = key_length(); auto key_size = key_length();
VERIFY(key_size);
auto mac_size = mac_length(); auto mac_size = mac_length();
auto iv_size = iv_length(); auto iv_size = iv_length();
@ -71,18 +72,36 @@ bool TLSv12::expand_key()
} }
} }
if (is_aead) { switch (get_cipher_algorithm(m_context.cipher)) {
memcpy(m_context.crypto.local_aead_iv, client_iv, iv_size); case CipherAlgorithm::AES_128_CBC:
memcpy(m_context.crypto.remote_aead_iv, server_iv, iv_size); case CipherAlgorithm::AES_256_CBC: {
VERIFY(!is_aead);
m_cipher_local = Crypto::Cipher::AESCipher::GCMMode(ReadonlyBytes { client_key, key_size }, key_size * 8, Crypto::Cipher::Intent::Encryption, Crypto::Cipher::PaddingMode::RFC5246);
m_cipher_remote = Crypto::Cipher::AESCipher::GCMMode(ReadonlyBytes { server_key, key_size }, key_size * 8, Crypto::Cipher::Intent::Decryption, Crypto::Cipher::PaddingMode::RFC5246);
} else {
memcpy(m_context.crypto.local_iv, client_iv, iv_size); memcpy(m_context.crypto.local_iv, client_iv, iv_size);
memcpy(m_context.crypto.remote_iv, server_iv, iv_size); memcpy(m_context.crypto.remote_iv, server_iv, iv_size);
m_cipher_local = Crypto::Cipher::AESCipher::CBCMode(ReadonlyBytes { client_key, key_size }, key_size * 8, Crypto::Cipher::Intent::Encryption, Crypto::Cipher::PaddingMode::RFC5246); m_cipher_local = Crypto::Cipher::AESCipher::CBCMode(ReadonlyBytes { client_key, key_size }, key_size * 8, Crypto::Cipher::Intent::Encryption, Crypto::Cipher::PaddingMode::RFC5246);
m_cipher_remote = Crypto::Cipher::AESCipher::CBCMode(ReadonlyBytes { server_key, key_size }, key_size * 8, Crypto::Cipher::Intent::Decryption, Crypto::Cipher::PaddingMode::RFC5246); m_cipher_remote = Crypto::Cipher::AESCipher::CBCMode(ReadonlyBytes { server_key, key_size }, key_size * 8, Crypto::Cipher::Intent::Decryption, Crypto::Cipher::PaddingMode::RFC5246);
break;
}
case CipherAlgorithm::AES_128_GCM:
case CipherAlgorithm::AES_256_GCM: {
VERIFY(is_aead);
memcpy(m_context.crypto.local_aead_iv, client_iv, iv_size);
memcpy(m_context.crypto.remote_aead_iv, server_iv, iv_size);
m_cipher_local = Crypto::Cipher::AESCipher::GCMMode(ReadonlyBytes { client_key, key_size }, key_size * 8, Crypto::Cipher::Intent::Encryption, Crypto::Cipher::PaddingMode::RFC5246);
m_cipher_remote = Crypto::Cipher::AESCipher::GCMMode(ReadonlyBytes { server_key, key_size }, key_size * 8, Crypto::Cipher::Intent::Decryption, Crypto::Cipher::PaddingMode::RFC5246);
break;
}
case CipherAlgorithm::AES_128_CCM:
dbgln("Requested unimplemented AES CCM cipher");
TODO();
case CipherAlgorithm::AES_128_CCM_8:
dbgln("Requested unimplemented AES CCM-8 block cipher");
TODO();
default:
dbgln("Requested unknown block cipher");
VERIFY_NOT_REACHED();
} }
m_context.crypto.created = 1; m_context.crypto.created = 1;

13
Userland/Libraries/LibTLS/TLSv12.h
View file

@ -179,6 +179,19 @@ enum ClientVerificationStaus {
C(true, CipherSuite::RSA_WITH_AES_128_GCM_SHA256, SignatureAlgorithm::RSA, CipherAlgorithm::AES_128_GCM, Crypto::Hash::SHA256, 8, true) \ C(true, CipherSuite::RSA_WITH_AES_128_GCM_SHA256, SignatureAlgorithm::RSA, CipherAlgorithm::AES_128_GCM, Crypto::Hash::SHA256, 8, true) \
C(false, CipherSuite::RSA_WITH_AES_256_GCM_SHA384, SignatureAlgorithm::RSA, CipherAlgorithm::AES_256_GCM, Crypto::Hash::SHA384, 8, true) C(false, CipherSuite::RSA_WITH_AES_256_GCM_SHA384, SignatureAlgorithm::RSA, CipherAlgorithm::AES_256_GCM, Crypto::Hash::SHA384, 8, true)
constexpr CipherAlgorithm get_cipher_algorithm(CipherSuite suite)
{
switch (suite) {
#define C(is_supported, suite, signature, cipher, hash, iv_size, is_aead) \
case suite: \
return cipher;
ENUMERATE_CIPHERS(C)
#undef C
default:
return CipherAlgorithm::Invalid;
}
}
struct Options { struct Options {
static Vector<CipherSuite> default_usable_cipher_suites() static Vector<CipherSuite> default_usable_cipher_suites()
{ {