Skip to content

Commit 582a360

Browse files
fdesbiensfdesbiens
authored
Fixed ECDHE_PSK cipher suites implementation. (#342)
* Restored ECC_CIPHERSUITE ifdef code. * Added ifdefs to exclude PSK code when build options require it.
1 parent 4ff4996 commit 582a360

File tree

3 files changed

+17
-58
lines changed

3 files changed

+17
-58
lines changed

‎nx_secure/src/nx_secure_generate_client_key_exchange.c‎

Lines changed: 3 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,6 @@ const NX_CRYPTO_METHOD *public_cipher_method;
9898
VOID *handler = NX_NULL;
9999
#endif
100100
UINT data_size;
101-
UINT key_size;
102101
UCHAR *encrypted_data_ptr;
103102
#ifndef NX_SECURE_DISABLE_X509
104103
UCHAR rand_byte;
@@ -133,50 +132,17 @@ NX_CRYPTO_EXTENDED_OUTPUT extended_output;
133132
if (ciphersuite -> nx_secure_tls_public_cipher -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_ECDH ||
134133
ciphersuite -> nx_secure_tls_public_cipher -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_ECDHE)
135134
{
136-
data_size = 0;
135+
data_size = (UINT)(1 + tls_key_material -> nx_secure_tls_new_key_material_data[0]);
137136

138-
if (ciphersuite -> nx_secure_tls_public_auth -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_PSK)
139-
{
140-
if ((tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_hint_size >
141-
sizeof(tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_hint)) ||
142-
(tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_hint_size >
143-
(buffer_length - 2)))
144-
{
145-
146-
/* Packet buffer too small. */
147-
return(NX_SECURE_TLS_PACKET_BUFFER_TOO_SMALL);
148-
}
149-
150-
/* Pointer to the output encrypted pre-master secret. */
151-
encrypted_data_ptr = &data_buffer[2];
152-
153-
/* Send the PSK Identity string to the remote server along with its length. */
154-
NX_SECURE_MEMCPY(encrypted_data_ptr, tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id,
155-
tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_size); /* Use case of memcpy is verified. */
156-
157-
/* Make sure our size is correct. */
158-
data_size = tls_credentials -> nx_secure_tls_client_psk.nx_secure_tls_psk_id_size;
159-
160-
/* Put the length into our outgoing packet buffer. */
161-
data_buffer[0] = (UCHAR)((data_size & 0xFF00) >> 8);
162-
data_buffer[1] = (UCHAR)(data_size & 0x00FF);
163-
164-
data_size += 2;
165-
data_buffer += data_size;
166-
}
167-
168-
key_size = (UINT)(1 + tls_key_material -> nx_secure_tls_new_key_material_data[0]);
169-
data_size += key_size;
170-
171-
if ((key_size > sizeof(tls_key_material -> nx_secure_tls_new_key_material_data)) ||
137+
if ((data_size > sizeof(tls_key_material -> nx_secure_tls_new_key_material_data)) ||
172138
(data_size > buffer_length))
173139
{
174140

175141
/* Packet buffer too small. */
176142
return(NX_SECURE_TLS_PACKET_BUFFER_TOO_SMALL);
177143
}
178144

179-
NX_SECURE_MEMCPY(data_buffer, tls_key_material -> nx_secure_tls_new_key_material_data, key_size); /* Use case of memcpy is verified. */
145+
NX_SECURE_MEMCPY(data_buffer, tls_key_material -> nx_secure_tls_new_key_material_data, data_size); /* Use case of memcpy is verified. */
180146
}
181147
else
182148
#endif /* NX_SECURE_ENABLE_ECC_CIPHERSUITE */

‎nx_secure/src/nx_secure_generate_premaster_secret.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,8 +98,10 @@ const NX_CRYPTO_METHOD *ecdh_method;
9898
NX_SECURE_EC_PUBLIC_KEY *ec_pubkey;
9999
VOID *handler = NX_NULL;
100100
NX_CRYPTO_EXTENDED_OUTPUT extended_output;
101+
#ifdef NX_SECURE_ENABLE_PSK_CIPHERSUITES
101102
UCHAR pre_master_secret_cpy[NX_SECURE_TLS_PREMASTER_SIZE];
102103
UINT pre_master_secret_size;
104+
#endif
103105
#endif /* NX_SECURE_ENABLE_ECC_CIPHERSUITE && !NX_SECURE_DISABLE_X509 */
104106

105107
#if !defined(NX_SECURE_ENABLE_ECC_CIPHERSUITE) || defined(NX_SECURE_DISABLE_X509)
@@ -122,6 +124,7 @@ UINT pre_master_secret_size;
122124
#if defined(NX_SECURE_ENABLE_ECC_CIPHERSUITE) && !defined(NX_SECURE_DISABLE_X509)
123125
if (ciphersuite -> nx_secure_tls_public_cipher -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_ECDHE)
124126
{
127+
#ifdef NX_SECURE_ENABLE_PSK_CIPHERSUITES
125128
if(ciphersuite->nx_secure_tls_public_auth->nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_PSK)
126129
{
127130
/* From RFC 5489:
@@ -173,6 +176,7 @@ UINT pre_master_secret_size;
173176
NX_SECURE_MEMSET(pre_master_secret_cpy, 0x0, sizeof(pre_master_secret_cpy));
174177
#endif /* NX_SECURE_KEY_CLEAR */
175178
}
179+
#endif
176180
return(NX_SECURE_TLS_SUCCESS);
177181
}
178182
else if (ciphersuite -> nx_secure_tls_public_cipher -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_ECDH)

‎nx_secure/src/nx_secure_process_server_key_exchange.c‎

Lines changed: 10 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,6 @@ UCHAR *current_buffer;
139139
UCHAR hash_algorithm;
140140
UCHAR signature_algorithm;
141141
USHORT signature_algorithm_id;
142-
ULONG size_param;
143142
#if (NX_SECURE_TLS_TLS_1_0_ENABLED || NX_SECURE_TLS_TLS_1_1_ENABLED)
144143
UINT i;
145144
#endif /* NX_SECURE_TLS_TLS_1_0_ENABLED || NX_SECURE_TLS_TLS_1_1_ENABLED */
@@ -295,16 +294,11 @@ UINT i;
295294
protocol_version == NX_SECURE_TLS_VERSION_TLS_1_1)
296295
#endif /* NX_SECURE_ENABLE_DTLS */
297296
{
298-
if(auth_method ->nx_crypto_algorithm != NX_CRYPTO_KEY_EXCHANGE_PSK)
299-
{
300-
size_param = 6;
301-
}
302-
else
303-
{
304-
size_param = 6 + tls_credentials -> nx_secure_tls_remote_psk_id_size;
305-
}
306-
307-
if ((UINT)key_length + size_param > message_length)
297+
#ifdef NX_SECURE_ENABLE_PSK_CIPHERSUITES
298+
if ((UINT)6 + tls_credentials -> nx_secure_tls_remote_psk_id_size > message_length)
299+
#else
300+
if ((UINT)key_length + 8 > message_length)
301+
#endif
308302
{
309303
return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH);
310304
}
@@ -322,16 +316,11 @@ UINT i;
322316
else
323317
#endif /* NX_SECURE_TLS_TLS_1_0_ENABLED || NX_SECURE_TLS_TLS_1_1_ENABLED */
324318
{
325-
if(auth_method ->nx_crypto_algorithm != NX_CRYPTO_KEY_EXCHANGE_PSK)
326-
{
327-
size_param = 8;
328-
}
329-
else
330-
{
331-
size_param = 6 + tls_credentials -> nx_secure_tls_remote_psk_id_size;
332-
}
333-
334-
if ((UINT)key_length + size_param > message_length)
319+
#ifdef NX_SECURE_ENABLE_PSK_CIPHERSUITES
320+
if ((UINT)6 + tls_credentials -> nx_secure_tls_remote_psk_id_size > message_length)
321+
#else
322+
if ((UINT)key_length + 8 > message_length)
323+
#endif
335324
{
336325
return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH);
337326
}

0 commit comments

Comments
 (0)