TLS key schedule. More...
#include <tls.h>
Data Fields | |
| struct digest_algorithm * | digest |
| Digest algorithm. | |
| struct tls_named_group * | group |
| Named key exchange group. | |
| int | keyed |
| Schedule holds secret key material. | |
| struct x509_certificate * | bound |
| Server identity to which the schedule has been bound (if any). | |
| void * | dynamic |
| Dynamically-allocated storage. | |
| void * | handshake |
| Handshake running transcript digest context. | |
| void * | kdf |
| Key derivation function master secret. | |
| uint8_t | ephemeral [SHA256_DIGEST_SIZE] |
| Ephemeral master secret. | |
Detailed Description
Field Documentation
◆ digest
| struct digest_algorithm* tls_key_schedule::digest |
Digest algorithm.
This is the digest algorithm specified by the cipher suite. It is used to construct the handshake running transcript digest value, and as the HMAC digest algorithm for key derivation.
Definition at line 378 of file tls.h.
Referenced by tls_new_finished(), tls_send_certificate_verify(), tls_send_finished(), and tls_set_digest().
◆ group
| struct tls_named_group* tls_key_schedule::group |
Named key exchange group.
Definition at line 380 of file tls.h.
Referenced by tls_new_server_key_exchange_dhe(), and tls_new_server_key_exchange_ecdhe().
◆ keyed
| int tls_key_schedule::keyed |
Schedule holds secret key material.
This flag is set when shared secret key material is introduced into the schedule (e.g. when the TLS pre-master secret is calculated, or when a session is resumed).
If this flag has not been set, then the key schedule contains only public information.
This flag must be cleared whenever the key schedule is reset.
Definition at line 393 of file tls.h.
Referenced by tls_generate_keys().
◆ bound
| struct x509_certificate* tls_key_schedule::bound |
Server identity to which the schedule has been bound (if any).
This reference to the server certificate is set when the shared secret key material has been bound to the identity represented by the server's certificate. It represents the successful delegation of authority from the server's long-term authentication key to the per-connection shared secret key material for the purpose of authenticating the connection via a successfully verified server Finished message.
Note that this reference may be set before the server certificate has been validated. The validation of the server certificate's chain is independent from the binding of the key schedule to the server certificate.
The binding may take place in several different ways, depending on the protocol version and options:
- For classic RSA key transport, the binding occurs when the encrypted ClientKeyExchange message is sent and incorporated into the handshake digest. A subsequent successfully verified server Finished message simultaneously proves knowledge of the certificate's private key and agreement on the shared secret key material.
- For ephemeral key exchange via ServerKeyExchange, the binding occurs when the signature over the DH parameters within ServerKeyExchange is verified against the certificate's public key. That signature represents the server's intention to delegate authority to any shared secret constructed from the signed DH parameters.
- For ephemeral key exchange via ClientHello/ServerHello, the binding occurs when the signature over the handshake digest within the server CertificateVerify is verified against the certificate's public key. The handshake digest incorporates the ephemeral key exchange and so the signature represents the server's intention to delegate authority to any shared secret constructed from the indirectly signed DH parameters.
- For session resumption, the binding occurs when the key schedule is resumed from the session secret. The server's choice to accept the resumption represents its intention to delegate authority to the shared secret derived from the session secret.
This reference may not be set unless the "keyed" flag has already been set, and must be cleared whenever the "keyed" flag is cleared.
This reference must be cleared whenever the server identity represented by the current certificate changes (e.g. when a new certificate chain is provided), or whenever the key derivation function master secret is overwritten with a value that is not cryptographically derived from its current value.
Definition at line 455 of file tls.h.
Referenced by tls_generate_keys(), and tls_parse_chain().
◆ dynamic
| void* tls_key_schedule::dynamic |
Dynamically-allocated storage.
Definition at line 457 of file tls.h.
Referenced by tls_set_digest().
◆ handshake
| void* tls_key_schedule::handshake |
◆ kdf
| void* tls_key_schedule::kdf |
◆ ephemeral
| uint8_t tls_key_schedule::ephemeral[SHA256_DIGEST_SIZE] |
The documentation for this struct was generated from the following file:
- include/ipxe/tls.h
Generated by
1.16.1