Skip to content

Commit aff5fcf

Browse files
ic0nsic0ns
authored
Merge pull request #654 from RUB-NDS/fix-tls13
Fix TLS 1.3 implementation
2 parents 06122ae + 19d37f2 commit aff5fcf

File tree

48 files changed

+698
-404
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+698
-404
lines changed

‎Attacks/src/main/java/de/rub/nds/tlsattacker/attacks/impl/InvalidCurveAttacker.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -257,7 +257,7 @@ private WorkflowTrace prepareRegularTrace(ModifiableByteArray serializedPublicKe
257257
}
258258
WorkflowTrace trace = new WorkflowConfigurationFactory(individualConfig).createWorkflowTrace(
259259
WorkflowTraceType.HELLO, RunningModeType.CLIENT);
260-
if (individualConfig.getHighestProtocolVersion() == ProtocolVersion.TLS13) {
260+
if (individualConfig.getHighestProtocolVersion().isTLS13()) {
261261

262262
// replace specific receive action with generic
263263
trace.removeTlsAction(trace.getTlsActions().size() - 1);
@@ -299,7 +299,7 @@ private WorkflowTrace prepareRegularTrace(ModifiableByteArray serializedPublicKe
299299
private WorkflowTrace prepareRenegotiationTrace(ModifiableByteArray serializedPublicKey, ModifiableByteArray pms,
300300
byte[] explicitPMS, Config individualConfig) {
301301
WorkflowTrace trace;
302-
if (individualConfig.getHighestProtocolVersion() == ProtocolVersion.TLS13) {
302+
if (individualConfig.getHighestProtocolVersion().isTLS13()) {
303303
trace = new WorkflowConfigurationFactory(individualConfig).createWorkflowTrace(WorkflowTraceType.HANDSHAKE,
304304
RunningModeType.CLIENT);
305305
trace.addTlsAction(new ReceiveAction(ReceiveOption.CHECK_ONLY_EXPECTED, new NewSessionTicketMessage(false)));

‎TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/certificate/CertificateByteChooser.java‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,10 @@
1111

1212
import de.rub.nds.tlsattacker.core.constants.AlgorithmResolver;
1313
import de.rub.nds.tlsattacker.core.constants.CertificateKeyType;
14+
import de.rub.nds.tlsattacker.core.constants.HashAlgorithm;
1415
import de.rub.nds.tlsattacker.core.constants.KeyExchangeAlgorithm;
1516
import de.rub.nds.tlsattacker.core.constants.NamedGroup;
17+
import de.rub.nds.tlsattacker.core.constants.SignatureAndHashAlgorithm;
1618
import de.rub.nds.tlsattacker.core.workflow.chooser.Chooser;
1719
import java.io.IOException;
1820
import java.security.PrivateKey;
@@ -167,6 +169,12 @@ public CertificateKeyPair chooseCertificateKeyPair(Chooser chooser) {
167169
.getSelectedCipherSuite());
168170
switch (keyExchangeAlgorithm) {
169171
case DH_RSA:
172+
case DHE_RSA:
173+
case ECDH_RSA:
174+
case ECDHE_RSA:
175+
case RSA:
176+
case SRP_SHA_RSA:
177+
case PSK_RSA:
170178
if (prefereredSignatureCertSignatureType != CertificateKeyType.RSA) {
171179
LOGGER.warn("PreferedSignatureType does not match Ciphersuite - ignoring preference");
172180
}
@@ -181,17 +189,6 @@ public CertificateKeyPair chooseCertificateKeyPair(Chooser chooser) {
181189
}
182190
prefereredSignatureCertSignatureType = CertificateKeyType.ECDSA;
183191
break;
184-
case DHE_RSA:
185-
case ECDH_RSA:
186-
case ECDHE_RSA:
187-
case RSA:
188-
case SRP_SHA_RSA:
189-
case PSK_RSA:
190-
if (prefereredSignatureCertSignatureType != CertificateKeyType.RSA) {
191-
LOGGER.warn("PreferedSignatureType does not match Ciphersuite - ignoring preference");
192-
}
193-
prefereredSignatureCertSignatureType = CertificateKeyType.RSA;
194-
break;
195192
case DHE_DSS:
196193
case DH_DSS:
197194
case SRP_SHA_DSS:
@@ -220,6 +217,8 @@ public CertificateKeyPair chooseCertificateKeyPair(Chooser chooser) {
220217
for (CertificateKeyPair pair : keyPairList) {
221218
if (pair.getCertPublicKeyType() == neededPublicKeyType
222219
&& pair.getCertSignatureType() == prefereredSignatureCertSignatureType) {
220+
221+
SignatureAndHashAlgorithm sigHashAlgo = SignatureAndHashAlgorithm.forCertificateKeyPair(pair, chooser);
223222
nextBestChoice = pair;
224223
if (neededPublicKeyType == CertificateKeyType.ECDSA) {
225224
if (pair.getSignatureGroup() == null) {
@@ -231,6 +230,12 @@ public CertificateKeyPair chooseCertificateKeyPair(Chooser chooser) {
231230
continue;
232231
}
233232
}
233+
if (neededPublicKeyType == CertificateKeyType.RSA
234+
&& sigHashAlgo.getSignatureAlgorithm().toString().startsWith("RSA_PSS")
235+
&& sigHashAlgo.getHashAlgorithm() == HashAlgorithm.SHA512
236+
&& pair.getPublicKey().keysize() < 2048) {
237+
continue;
238+
}
234239
return pair;
235240
}
236241

‎TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/certificate/CertificateKeyPair.java‎

Lines changed: 15 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,9 @@
3434
import java.security.PrivateKey;
3535
import java.security.PublicKey;
3636
import java.security.cert.CertificateException;
37+
import java.util.ArrayList;
3738
import java.util.Arrays;
39+
import java.util.List;
3840
import java.util.Objects;
3941
import javax.xml.bind.annotation.XmlAccessType;
4042
import javax.xml.bind.annotation.XmlAccessorType;
@@ -348,6 +350,10 @@ public NamedGroup getPublicKeyGroup() {
348350
return publicKeyGroup;
349351
}
350352

353+
public GOSTCurve getGostCurve() {
354+
return gostCurve;
355+
}
356+
351357
public void adjustInConfig(Config config, ConnectionEndType connectionEnd) {
352358
publicKey.adjustInConfig(config, connectionEnd);
353359
if (privateKey != null) {
@@ -368,40 +374,16 @@ public void adjustInContext(TlsContext context, ConnectionEndType connectionEnd)
368374
}
369375
context.setEcCertificateCurve(publicKeyGroup);
370376
if (context.getConfig().getAutoAdjustSignatureAndHashAlgorithm()) {
371-
// TODO rething auto selection
372-
SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.RSA;
373-
HashAlgorithm hashAlgorithm = context.getConfig().getPreferredHashAlgorithm();
374-
switch (certPublicKeyType) {
375-
case ECDSA:
376-
signatureAlgorithm = SignatureAlgorithm.ECDSA;
377-
break;
378-
case RSA:
379-
signatureAlgorithm = SignatureAlgorithm.RSA;
380-
break;
381-
case DSS:
382-
signatureAlgorithm = SignatureAlgorithm.DSA;
383-
break;
384-
case GOST01:
385-
signatureAlgorithm = SignatureAlgorithm.GOSTR34102001;
386-
hashAlgorithm = HashAlgorithm.GOSTR3411;
387-
context.setSelectedGostCurve(gostCurve);
388-
LOGGER.debug("Adjusting selected gost curve:" + gostCurve);
389-
390-
break;
391-
case GOST12:
392-
if (gostCurve.is512bit2012()) {
393-
signatureAlgorithm = SignatureAlgorithm.GOSTR34102012_512;
394-
hashAlgorithm = HashAlgorithm.GOSTR34112012_512;
395-
} else {
396-
signatureAlgorithm = SignatureAlgorithm.GOSTR34102012_256;
397-
hashAlgorithm = HashAlgorithm.GOSTR34112012_256;
398-
}
399-
context.setSelectedGostCurve(gostCurve);
400-
LOGGER.debug("Adjusting selected GOST curve:" + gostCurve);
401-
break;
377+
SignatureAndHashAlgorithm sigHashAlgo = SignatureAndHashAlgorithm.forCertificateKeyPair(this,
378+
context.getChooser());
379+
380+
if (sigHashAlgo == SignatureAndHashAlgorithm.GOSTR34102012_512_GOSTR34112012_512
381+
|| sigHashAlgo == SignatureAndHashAlgorithm.GOSTR34102012_256_GOSTR34112012_256
382+
|| sigHashAlgo == SignatureAndHashAlgorithm.GOSTR34102001_GOSTR3411) {
383+
context.setSelectedGostCurve(gostCurve);
384+
LOGGER.debug("Adjusting selected GOST curve:" + gostCurve);
402385
}
403-
SignatureAndHashAlgorithm sigHashAlgo = SignatureAndHashAlgorithm.getSignatureAndHashAlgorithm(
404-
signatureAlgorithm, hashAlgorithm);
386+
405387
LOGGER.debug("Setting selected SignatureAndHash algorithm to:" + sigHashAlgo);
406388
context.setSelectedSignatureAndHashAlgorithm(sigHashAlgo);
407389
}

‎TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/config/Config.java‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2402,17 +2402,12 @@ public void setDefaultClientSupportedSignatureAndHashAlgorithms(
24022402
this.defaultClientSupportedSignatureAndHashAlgorithms = defaultClientSupportedSignatureAndHashAlgorithms;
24032403
}
24042404

2405-
public final void setSupportedSignatureAndHashAlgorithms(
2405+
public final void setDefaultClientSupportedSignatureAndHashAlgorithms(
24062406
SignatureAndHashAlgorithm... supportedSignatureAndHashAlgorithms) {
24072407
this.defaultClientSupportedSignatureAndHashAlgorithms = new ArrayList(
24082408
Arrays.asList(supportedSignatureAndHashAlgorithms));
24092409
}
24102410

2411-
public final void setSupportedSignatureAndHashAlgorithms(
2412-
List<SignatureAndHashAlgorithm> supportedSignatureAndHashAlgorithms) {
2413-
this.defaultClientSupportedSignatureAndHashAlgorithms = supportedSignatureAndHashAlgorithms;
2414-
}
2415-
24162411
public List<ProtocolVersion> getSupportedVersions() {
24172412
return supportedVersions;
24182413
}

‎TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/constants/CipherSuite.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -748,6 +748,9 @@ public static List<CipherSuite> getImplemented() {
748748
list.add(TLS_ECDHE_ECDSA_WITH_AES_256_CCM);
749749
list.add(TLS_AES_128_GCM_SHA256);
750750
list.add(TLS_AES_256_GCM_SHA384);
751+
list.add(TLS_CHACHA20_POLY1305_SHA256);
752+
list.add(TLS_AES_128_CCM_SHA256);
753+
list.add(TLS_AES_128_CCM_8_SHA256);
751754
list.add(TLS_PSK_WITH_AES_128_CBC_SHA);
752755
list.add(TLS_PSK_DHE_WITH_AES_128_CCM_8);
753756
list.add(TLS_PSK_DHE_WITH_AES_256_CCM_8);

‎TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/constants/ExtensionType.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,12 @@ public enum ExtensionType {
5555
PRE_SHARED_KEY(new byte[] { (byte) 0, (byte) 41 }),
5656
EARLY_DATA(new byte[] { (byte) 0, (byte) 42 }),
5757
SUPPORTED_VERSIONS(new byte[] { (byte) 0, (byte) 43 }),
58+
COOKIE(new byte[] { 0x00, (byte) 44 }),
5859
PSK_KEY_EXCHANGE_MODES(new byte[] { (byte) 0, (byte) 45 }),
60+
CERTIFICATE_AUTHORITIES(new byte[] { (byte) 0, (byte) 47 }),
61+
OID_FILTERS(new byte[] { (byte) 0, (byte) 48 }),
62+
POST_HANDSHAKE_AUTH(new byte[] { (byte) 0, (byte) 49 }),
63+
SIGNATURE_ALGORITHMS_CERT(new byte[] { (byte) 0, (byte) 50 }),
5964
KEY_SHARE(new byte[] { (byte) 0, (byte) 51 }),
6065
RENEGOTIATION_INFO(new byte[] { (byte) 0xFF, (byte) 0x01 }),
6166
ENCRYPTED_SERVER_NAME_INDICATION(new byte[] { (byte) 0xFF, (byte) 0xCE }),

‎TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/constants/ProtocolVersion.java‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,14 @@
1414

1515
import java.util.*;
1616

17+
class ProtocolVersionComparator implements Comparator<ProtocolVersion> {
18+
19+
@Override
20+
public int compare(ProtocolVersion o1, ProtocolVersion o2) {
21+
return o1.compare(o2);
22+
}
23+
}
24+
1725
public enum ProtocolVersion {
1826

1927
SSL2(new byte[] { (byte) 0x00, (byte) 0x02 }),
@@ -75,6 +83,18 @@ public static ProtocolVersion getProtocolVersion(byte[] value) {
7583
return MAP.get(i);
7684
}
7785

86+
public static void sort(List<ProtocolVersion> versions) {
87+
sort(versions, true);
88+
}
89+
90+
public static void sort(List<ProtocolVersion> versions, boolean ascending) {
91+
Comparator<ProtocolVersion> comparator = new ProtocolVersionComparator();
92+
if (!ascending) {
93+
comparator = comparator.reversed();
94+
}
95+
versions.sort(comparator);
96+
}
97+
7898
public static List<ProtocolVersion> getProtocolVersions(byte[] values) {
7999
List<ProtocolVersion> versions = new LinkedList<>();
80100
if (values.length % 2 != 0) {
@@ -178,4 +198,14 @@ public boolean usesExplicitIv() {
178198
|| this == ProtocolVersion.DTLS12;
179199
}
180200

201+
public int compare(ProtocolVersion o1) {
202+
if (o1 == this) {
203+
return 0;
204+
}
205+
206+
if (ArrayConverter.bytesToInt(this.getValue()) > ArrayConverter.bytesToInt(o1.getValue())) {
207+
return 1;
208+
}
209+
return -1;
210+
}
181211
}

‎TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/constants/SignatureAndHashAlgorithm.java‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,21 @@
99
*/
1010
package de.rub.nds.tlsattacker.core.constants;
1111

12+
import com.google.common.collect.Sets;
1213
import de.rub.nds.modifiablevariable.util.ArrayConverter;
14+
import de.rub.nds.tlsattacker.core.certificate.CertificateKeyPair;
1315
import de.rub.nds.tlsattacker.core.exceptions.UnknownSignatureAndHashAlgorithm;
16+
17+
import java.security.InvalidAlgorithmParameterException;
18+
import java.security.Signature;
19+
import java.security.spec.MGF1ParameterSpec;
20+
import java.security.spec.PSSParameterSpec;
21+
import java.util.ArrayList;
1422
import java.util.HashMap;
1523
import java.util.LinkedList;
1624
import java.util.List;
1725
import java.util.Map;
26+
import de.rub.nds.tlsattacker.core.workflow.chooser.Chooser;
1827
import org.apache.logging.log4j.LogManager;
1928
import org.apache.logging.log4j.Logger;
2029

@@ -193,6 +202,10 @@ public HashAlgorithm getHashAlgorithm() {
193202
}
194203

195204
public String getJavaName() {
205+
if (this.toString().contains("RSA_PSS")) {
206+
return this.getHashAlgorithm().getJavaName().replaceAll("-", "") + "withRSA/PSS";
207+
}
208+
196209
String hashAlgorithmName = getHashAlgorithm().getJavaName();
197210
if (!hashAlgorithmName.contains("GOST")) {
198211
hashAlgorithmName = hashAlgorithmName.replace("-", "");
@@ -201,4 +214,107 @@ public String getJavaName() {
201214
return hashAlgorithmName + "with" + signatureAlgorithmName;
202215
}
203216

217+
public void setupSignature(Signature signature) throws InvalidAlgorithmParameterException {
218+
if (this.getSignatureAlgorithm().toString().startsWith("RSA_PSS")) {
219+
String hashName = this.getHashAlgorithm().getJavaName();
220+
int saltLength = 0;
221+
switch (this.getHashAlgorithm()) {
222+
case SHA1:
223+
saltLength = 20;
224+
break;
225+
case MD5:
226+
saltLength = 16;
227+
break;
228+
case SHA256:
229+
case GOSTR3411:
230+
case GOSTR34112012_256:
231+
saltLength = 32;
232+
break;
233+
case SHA224:
234+
saltLength = 28;
235+
break;
236+
case SHA384:
237+
saltLength = 48;
238+
break;
239+
case GOSTR34112012_512:
240+
case SHA512:
241+
saltLength = 64;
242+
break;
243+
case NONE:
244+
break;
245+
}
246+
247+
signature.setParameter(new PSSParameterSpec(hashName, "MGF1", new MGF1ParameterSpec(hashName), saltLength,
248+
1));
249+
}
250+
}
251+
252+
public static SignatureAndHashAlgorithm forCertificateKeyPair(CertificateKeyPair keyPair, Chooser chooser) {
253+
Sets.SetView<SignatureAndHashAlgorithm> intersection = Sets.intersection(
254+
Sets.newHashSet(chooser.getClientSupportedSignatureAndHashAlgorithms()),
255+
Sets.newHashSet(chooser.getServerSupportedSignatureAndHashAlgorithms()));
256+
List<SignatureAndHashAlgorithm> algorithms = new ArrayList<>(intersection);
257+
List<SignatureAndHashAlgorithm> clientPreferredHash = new ArrayList<>(algorithms);
258+
clientPreferredHash.removeIf(i -> i.getHashAlgorithm() != chooser.getConfig().getPreferredHashAlgorithm());
259+
algorithms.addAll(0, clientPreferredHash);
260+
261+
if (chooser.getSelectedProtocolVersion().isTLS13()) {
262+
algorithms.removeIf(i -> i.toString().contains("RSA_SHA"));
263+
}
264+
265+
SignatureAndHashAlgorithm sigHashAlgo = null;
266+
CertificateKeyType certPublicKeyType = keyPair.getCertPublicKeyType();
267+
268+
boolean found = false;
269+
for (SignatureAndHashAlgorithm i : algorithms) {
270+
SignatureAlgorithm sig = i.getSignatureAlgorithm();
271+
272+
switch (certPublicKeyType) {
273+
case ECDSA:
274+
if (sig == SignatureAlgorithm.ECDSA) {
275+
found = true;
276+
sigHashAlgo = i;
277+
}
278+
break;
279+
case RSA:
280+
if (sig.toString().contains("RSA")) {
281+
found = true;
282+
sigHashAlgo = i;
283+
}
284+
break;
285+
case DSS:
286+
if (sig == SignatureAlgorithm.DSA) {
287+
found = true;
288+
sigHashAlgo = i;
289+
}
290+
break;
291+
case GOST01:
292+
if (sig == SignatureAlgorithm.GOSTR34102001) {
293+
found = true;
294+
sigHashAlgo = SignatureAndHashAlgorithm.GOSTR34102001_GOSTR3411;
295+
}
296+
break;
297+
case GOST12:
298+
if (sig == SignatureAlgorithm.GOSTR34102012_256 || sig == SignatureAlgorithm.GOSTR34102012_512) {
299+
found = true;
300+
if (keyPair.getGostCurve().is512bit2012()) {
301+
sigHashAlgo = SignatureAndHashAlgorithm.GOSTR34102012_512_GOSTR34112012_512;
302+
} else {
303+
sigHashAlgo = SignatureAndHashAlgorithm.GOSTR34102012_256_GOSTR34112012_256;
304+
}
305+
}
306+
break;
307+
}
308+
309+
if (found)
310+
break;
311+
}
312+
313+
if (sigHashAlgo == null) {
314+
LOGGER.warn("Could not auto select SignatureAndHashAlgorithm, setting default value");
315+
sigHashAlgo = SignatureAndHashAlgorithm.RSA_SHA256;
316+
}
317+
318+
return sigHashAlgo;
319+
}
204320
}

0 commit comments

Comments
 (0)