tlsclassic.c File Reference

Classic TLS static RSA pre-master secret. More...

#include <string.h>
#include <byteswap.h>
#include <ipxe/tls.h>
#include <ipxe/crypto.h>
#include <config/crypto.h>

Go to the source code of this file.

Data Structures
struct	tls_classic_pre_master_private
	A classic pre-master private key. More...
struct	tls_classic_pre_master_shared
	A classic pre-master shared secret. More...

Functions
	FILE_LICENCE (GPL2_OR_LATER_OR_UBDL)
	FILE_SECBOOT (PERMITTED)
static int	tls_classic_pre_master_agree (struct exchange_algorithm *exchange __unused, const void *private, const void *partner __unused, void *shared)
	Agree classic pre-master secret.

Variables
struct exchange_algorithm	tls_classic_pre_master_algorithm
	Classic pre-master secret key exchange algorithm.

Detailed Description

Classic TLS static RSA pre-master secret.

With classic static RSA key transport, the client unilaterally constructs the shared pre-master secret and then encrypts it using the server's public key.

We model key transport as a key exchange algorithm that is incapable of generating public keys and where the public key size is zero (implying that the shared secret must be communicated via a means other than key exchange).

This RSA pre-master secret structure could in principle have been used with any public-key algorithm that supports encryption and decryption (rather than only signing and verification), but no non-RSA cipher suites were ever defined to use this exact same structure of the pre-master secret.

Key transport provides no forward secrecy since a compromise of the server's long-term private key provides the ability to decrypt all pre-master secrets that were encrypted using that key. Almost all servers will prefer to use ephemeral key exhange (which does provide forward secrecy). We retain support for key transport only for the sake of backwards compatibility with older servers.

Definition in file tlsclassic.c.

Function Documentation

FILE_LICENCE()

FILE_LICENCE

(

GPL2_OR_LATER_OR_UBDL

)

FILE_SECBOOT()

FILE_SECBOOT

(

PERMITTED

)

tls_classic_pre_master_agree()

int tls_classic_pre_master_agree ( struct exchange_algorithm *exchange __unused, const void * private, const void *partner __unused, void * shared )

static

Agree classic pre-master secret.

Parameters

exchange	Key exchange algorithm
private	Private key
partner	Partner public key
shared	Shared secret to fill in

Return values

rc	Return status code

Definition at line 85 of file tlsclassic.c.

                                                                            {
        struct tls_classic_pre_master_shared *premaster = shared;
 
        /* We model the classic pre-master secret as a key exchange
         * algorithm in which we unilaterally construct the shared
         * secret (with no partner public key input).
         */
        premaster->version = htons ( TLS_VERSION_MAX );
        memcpy ( &premaster->private, private, sizeof ( premaster->private ) );
 
        return 0;
}

References __unused, htons, memcpy(), partner, tls_classic_pre_master_shared::private, TLS_VERSION_MAX, and tls_classic_pre_master_shared::version.

Variable Documentation

tls_classic_pre_master_algorithm

struct exchange_algorithm tls_classic_pre_master_algorithm

Initial value:

                        = {
        .name = "classic pre-master",
        .privsize = sizeof ( struct tls_classic_pre_master_private ),
        .pubsize = 0,
        .sharedsize = sizeof ( struct tls_classic_pre_master_shared ),
        .share = exchange_null_share,
        .agree = tls_classic_pre_master_agree,
}

Classic pre-master secret key exchange algorithm.

Definition at line 101 of file tlsclassic.c.

                                                           {
        .name = "classic pre-master",
        .privsize = sizeof ( struct tls_classic_pre_master_private ),
        .pubsize = 0,
        .sharedsize = sizeof ( struct tls_classic_pre_master_shared ),
        .share = exchange_null_share,
        .agree = tls_classic_pre_master_agree,
};

Referenced by tls_send_client_key_exchange_pubkey().