projects
/
tinc
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
|
inline
| side by side (parent:
42a0b61
)
Make sure the signature also covers the session label.
author
Guus Sliepen
<guus@tinc-vpn.org>
Sun, 18 Mar 2012 20:24:46 +0000
(21:24 +0100)
committer
Guus Sliepen
<guus@tinc-vpn.org>
Sun, 18 Mar 2012 20:24:46 +0000
(21:24 +0100)
doc/SPTPS
patch
|
blob
|
history
src/sptps.c
patch
|
blob
|
history
diff --git
a/doc/SPTPS
b/doc/SPTPS
index
78927f6
..
2d8fee5
100644
(file)
--- a/
doc/SPTPS
+++ b/
doc/SPTPS
@@
-124,7
+124,7
@@
Remarks:
- After receiving the other's SIG message, the signature is verified. If it is
correct, the shared secret is calculated from the public keys exchanged in the
KEX message using the Elliptic Curve Diffie-Helman algorithm.
- After receiving the other's SIG message, the signature is verified. If it is
correct, the shared secret is calculated from the public keys exchanged in the
KEX message using the Elliptic Curve Diffie-Helman algorithm.
-- The shared secret key is expanded using a PRF. Both nonces and
an
application
+- The shared secret key is expanded using a PRF. Both nonces and
the
application
specific label are also used as input for the PRF.
- An ACK message is sent only when doing key renegotiation, and is sent using
the old encryption keys.
specific label are also used as input for the PRF.
- An ACK message is sent only when doing key renegotiation, and is sent using
the old encryption keys.
@@
-135,6
+135,7
@@
The signature is calculated over this string:
- uint8_t initiator (0 = local peer, 1 = remote peer is initiator)
- opaque remote_kex_message[1 + 32 + ECDH_SIZE]
- opaque local_kex_message[1 + 32 + ECDH_SIZE]
- uint8_t initiator (0 = local peer, 1 = remote peer is initiator)
- opaque remote_kex_message[1 + 32 + ECDH_SIZE]
- opaque local_kex_message[1 + 32 + ECDH_SIZE]
+- opaque label[label_length]
The PRF is calculated as follows:
The PRF is calculated as follows:
diff --git
a/src/sptps.c
b/src/sptps.c
index
2449e7b
..
bdbfb89
100644
(file)
--- a/
src/sptps.c
+++ b/
src/sptps.c
@@
-159,13
+159,14
@@
static bool send_sig(sptps_t *s) {
size_t keylen = ECDH_SIZE;
size_t siglen = ecdsa_size(&s->mykey);
size_t keylen = ECDH_SIZE;
size_t siglen = ecdsa_size(&s->mykey);
- // Concatenate both KEX messages, plus tag indicating if it is from the connection originator
- char msg[(1 + 32 + keylen) * 2 + 1];
+ // Concatenate both KEX messages, plus tag indicating if it is from the connection originator
, plus label
+ char msg[(1 + 32 + keylen) * 2 + 1
+ s->labellen
];
char sig[siglen];
msg[0] = s->initiator;
memcpy(msg + 1, s->mykex, 1 + 32 + keylen);
char sig[siglen];
msg[0] = s->initiator;
memcpy(msg + 1, s->mykex, 1 + 32 + keylen);
- memcpy(msg + 2 + 32 + keylen, s->hiskex, 1 + 32 + keylen);
+ memcpy(msg + 1 + 33 + keylen, s->hiskex, 1 + 32 + keylen);
+ memcpy(msg + 1 + 2 * (33 + keylen), s->label, s->labellen);
// Sign the result.
if(!ecdsa_sign(&s->mykey, msg, sizeof msg, sig))
// Sign the result.
if(!ecdsa_sign(&s->mykey, msg, sizeof msg, sig))
@@
-275,11
+276,12
@@
static bool receive_sig(sptps_t *s, const char *data, uint16_t len) {
return error(s, EIO, "Invalid KEX record length");
// Concatenate both KEX messages, plus tag indicating if it is from the connection originator
return error(s, EIO, "Invalid KEX record length");
// Concatenate both KEX messages, plus tag indicating if it is from the connection originator
- char msg[(1 + 32 + keylen) * 2 + 1];
+ char msg[(1 + 32 + keylen) * 2 + 1
+ s->labellen
];
msg[0] = !s->initiator;
memcpy(msg + 1, s->hiskex, 1 + 32 + keylen);
msg[0] = !s->initiator;
memcpy(msg + 1, s->hiskex, 1 + 32 + keylen);
- memcpy(msg + 2 + 32 + keylen, s->mykex, 1 + 32 + keylen);
+ memcpy(msg + 1 + 33 + keylen, s->mykex, 1 + 32 + keylen);
+ memcpy(msg + 1 + 2 * (33 + keylen), s->label, s->labellen);
// Verify signature.
if(!ecdsa_verify(&s->hiskey, msg, sizeof msg, data))
// Verify signature.
if(!ecdsa_verify(&s->hiskey, msg, sizeof msg, data))