Examples with PRF sun.security.ssl.CipherSuite.PRF used on opensource projects

Example 1 with PRF

use of sun.security.ssl.CipherSuite.PRF in project jdk8u_jdk by JetBrains.

the class Handshaker method calculateMasterSecret.

/*
     * Calculate the master secret from its various components.  This is
     * used for key exchange by all cipher suites.
     *
     * The master secret is the catenation of three MD5 hashes, each
     * consisting of the pre-master secret and a SHA1 hash.  Those three
     * SHA1 hashes are of (different) constant strings, the pre-master
     * secret, and the nonces provided by the client and the server.
     */
private SecretKey calculateMasterSecret(SecretKey preMasterSecret, ProtocolVersion requestedVersion) {
    if (debug != null && Debug.isOn("keygen")) {
        HexDumpEncoder dump = new HexDumpEncoder();
        System.out.println("SESSION KEYGEN:");
        System.out.println("PreMaster Secret:");
        printHex(dump, preMasterSecret.getEncoded());
    // Nonces are dumped with connection keygen, no
    // benefit to doing it twice
    }
    // What algs/params do we need to use?
    String masterAlg;
    PRF prf;
    if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
        masterAlg = "SunTls12MasterSecret";
        prf = cipherSuite.prfAlg;
    } else {
        masterAlg = "SunTlsMasterSecret";
        prf = P_NONE;
    }
    String prfHashAlg = prf.getPRFHashAlg();
    int prfHashLength = prf.getPRFHashLength();
    int prfBlockSize = prf.getPRFBlockSize();
    TlsMasterSecretParameterSpec spec = new TlsMasterSecretParameterSpec(preMasterSecret, protocolVersion.major, protocolVersion.minor, clnt_random.random_bytes, svr_random.random_bytes, prfHashAlg, prfHashLength, prfBlockSize);
    try {
        KeyGenerator kg = JsseJce.getKeyGenerator(masterAlg);
        kg.init(spec);
        return kg.generateKey();
    } catch (InvalidAlgorithmParameterException | NoSuchAlgorithmException iae) {
        // due to the Bleichenbacher attack. See comments further down.
        if (debug != null && Debug.isOn("handshake")) {
            System.out.println("RSA master secret generation error:");
            iae.printStackTrace(System.out);
        }
        throw new ProviderException(iae);
    }
}

Example 2 with PRF

use of sun.security.ssl.CipherSuite.PRF in project jdk8u_jdk by JetBrains.

the class Handshaker method calculateConnectionKeys.

/*
     * Calculate the keys needed for this connection, once the session's
     * master secret has been calculated.  Uses the master key and nonces;
     * the amount of keying material generated is a function of the cipher
     * suite that's been negotiated.
     *
     * This gets called both on the "full handshake" (where we exchanged
     * a premaster secret and started a new session) as well as on the
     * "fast handshake" (where we just resumed a pre-existing session).
     */
void calculateConnectionKeys(SecretKey masterKey) {
    /*
         * For both the read and write sides of the protocol, we use the
         * master to generate MAC secrets and cipher keying material.  Block
         * ciphers need initialization vectors, which we also generate.
         *
         * First we figure out how much keying material is needed.
         */
    int hashSize = cipherSuite.macAlg.size;
    boolean is_exportable = cipherSuite.exportable;
    BulkCipher cipher = cipherSuite.cipher;
    int expandedKeySize = is_exportable ? cipher.expandedKeySize : 0;
    // Which algs/params do we need to use?
    String keyMaterialAlg;
    PRF prf;
    if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
        keyMaterialAlg = "SunTls12KeyMaterial";
        prf = cipherSuite.prfAlg;
    } else {
        keyMaterialAlg = "SunTlsKeyMaterial";
        prf = P_NONE;
    }
    String prfHashAlg = prf.getPRFHashAlg();
    int prfHashLength = prf.getPRFHashLength();
    int prfBlockSize = prf.getPRFBlockSize();
    // TLS v1.1 or later uses an explicit IV in CBC cipher suites to
    // protect against the CBC attacks.  AEAD/GCM cipher suites in TLS
    // v1.2 or later use a fixed IV as the implicit part of the partially
    // implicit nonce technique described in RFC 5116.
    int ivSize = cipher.ivSize;
    if (cipher.cipherType == AEAD_CIPHER) {
        ivSize = cipher.fixedIvSize;
    } else if (protocolVersion.v >= ProtocolVersion.TLS11.v && cipher.cipherType == BLOCK_CIPHER) {
        ivSize = 0;
    }
    TlsKeyMaterialParameterSpec spec = new TlsKeyMaterialParameterSpec(masterKey, protocolVersion.major, protocolVersion.minor, clnt_random.random_bytes, svr_random.random_bytes, cipher.algorithm, cipher.keySize, expandedKeySize, ivSize, hashSize, prfHashAlg, prfHashLength, prfBlockSize);
    try {
        KeyGenerator kg = JsseJce.getKeyGenerator(keyMaterialAlg);
        kg.init(spec);
        TlsKeyMaterialSpec keySpec = (TlsKeyMaterialSpec) kg.generateKey();
        // Return null if cipher keys are not supposed to be generated.
        clntWriteKey = keySpec.getClientCipherKey();
        svrWriteKey = keySpec.getServerCipherKey();
        // Return null if IVs are not supposed to be generated.
        clntWriteIV = keySpec.getClientIv();
        svrWriteIV = keySpec.getServerIv();
        // Return null if MAC keys are not supposed to be generated.
        clntMacSecret = keySpec.getClientMacKey();
        svrMacSecret = keySpec.getServerMacKey();
    } catch (GeneralSecurityException e) {
        throw new ProviderException(e);
    }
    // Mark a flag that allows outside entities (like SSLSocket/SSLEngine)
    // determine if a ChangeCipherSpec message could be processed.
    sessKeysCalculated = true;
    //
    if (debug != null && Debug.isOn("keygen")) {
        synchronized (System.out) {
            HexDumpEncoder dump = new HexDumpEncoder();
            System.out.println("CONNECTION KEYGEN:");
            // Inputs:
            System.out.println("Client Nonce:");
            printHex(dump, clnt_random.random_bytes);
            System.out.println("Server Nonce:");
            printHex(dump, svr_random.random_bytes);
            System.out.println("Master Secret:");
            printHex(dump, masterKey.getEncoded());
            // Outputs:
            if (clntMacSecret != null) {
                System.out.println("Client MAC write Secret:");
                printHex(dump, clntMacSecret.getEncoded());
                System.out.println("Server MAC write Secret:");
                printHex(dump, svrMacSecret.getEncoded());
            } else {
                System.out.println("... no MAC keys used for this cipher");
            }
            if (clntWriteKey != null) {
                System.out.println("Client write key:");
                printHex(dump, clntWriteKey.getEncoded());
                System.out.println("Server write key:");
                printHex(dump, svrWriteKey.getEncoded());
            } else {
                System.out.println("... no encryption keys used");
            }
            if (clntWriteIV != null) {
                System.out.println("Client write IV:");
                printHex(dump, clntWriteIV.getIV());
                System.out.println("Server write IV:");
                printHex(dump, svrWriteIV.getIV());
            } else {
                if (protocolVersion.v >= ProtocolVersion.TLS11.v) {
                    System.out.println("... no IV derived for this protocol");
                } else {
                    System.out.println("... no IV used for this cipher");
                }
            }
            System.out.flush();
        }
    }
}

Example 3 with PRF

use of sun.security.ssl.CipherSuite.PRF in project jdk8u_jdk by JetBrains.

the class CipherSuite method add.

/*
     * Use this method when there is no lower protocol limit where this
     * suite can be used, and the PRF is P_SHA256.  That is, the
     * existing ciphersuites.  From RFC 5246:
     *
     *     All cipher suites in this document use P_SHA256.
     */
private static void add(String name, int id, int priority, KeyExchange keyExchange, BulkCipher cipher, boolean allowed, int obsoleted) {
    // If this is an obsoleted suite, then don't let the TLS 1.2
    // protocol have a valid PRF value.
    PRF prf = P_SHA256;
    if (obsoleted < ProtocolVersion.TLS12.v) {
        prf = P_NONE;
    }
    add(name, id, priority, keyExchange, cipher, allowed, obsoleted, ProtocolVersion.LIMIT_MIN_VALUE, prf);
}