key_schedule_test.go

     1  // Copyright 2018 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package tls
     6  
     7  import (
     8  	"bytes"
     9  	"crypto/internal/fips140/tls13"
    10  	"crypto/sha256"
    11  	"encoding/hex"
    12  	"strings"
    13  	"testing"
    14  	"unicode"
    15  )
    16  
    17  func TestACVPVectors(t *testing.T) {
    18  	// https://github.com/usnistgov/ACVP-Server/blob/3a7333f63/gen-val/json-files/TLS-v1.3-KDF-RFC8446/prompt.json#L428-L436
    19  	psk := fromHex("56288B726C73829F7A3E47B103837C8139ACF552E7530C7A710B35ED41191698")
    20  	dhe := fromHex("EFFE9EC26AA29FD750DFA6A10B944D74071595B27EE88887D5E11C84590B5CC3")
    21  	helloClientRandom := fromHex("E9137679E582BA7C1DB41CF725F86C6D09C8C05F297BAD9A65B552EAF524FDE4")
    22  	helloServerRandom := fromHex("23ECCFD030790748C8F8D8A656FD98D717F1B62AF3712F97211D2070B499F98A")
    23  	finishedClientRandom := fromHex("62A62FA75563ED4FDCAA0BC16567B314871C304ACF06B0FFC3F08C1797594D43")
    24  	finishedServerRandom := fromHex("C750EDA6696CD101B142BD79E00E6AC8C5F2C0ABC78DD64F4D991326659E9299")
    25  
    26  	// https://github.com/usnistgov/ACVP-Server/blob/3a7333f63/gen-val/json-files/TLS-v1.3-KDF-RFC8446/expectedResults.json#L571-L581
    27  	clientEarlyTrafficSecret := fromHex("3272189698C3594D18F58EFA3F12B638A249515099BE7A2FA9836BABE74F0111")
    28  	earlyExporterMasterSecret := fromHex("88E078F562CDC930219F6A5E98A1CE8C6E5F3DAC5AC516459A96F2EF8F114C66")
    29  	clientHandshakeTrafficSecret := fromHex("B32306C3CE9932C460A1FE6C0F060593974842036B96FA45049B7352E71C2AD2")
    30  	serverHandshakeTrafficSecret := fromHex("22787F8CA269D34BC549AC8BA19F2040938A3AA370D7CC9D60F720882B88D01B")
    31  	clientApplicationTrafficSecret := fromHex("47D7EA08397B5871154B0FE85584BCC30A87C69E84D69B56007C5B21F76493BA")
    32  	serverApplicationTrafficSecret := fromHex("EFBDB0C873C0480DA57307083839A8984BE25B9A8545E4FCA029940FE2800565")
    33  	exporterMasterSecret := fromHex("8A43D787EE3804EAD4A2A5B32972F9896B696295645D7222E1FD081DDD939834")
    34  	resumptionMasterSecret := fromHex("5F4C961329C91044011ACBECB0B289282E0E3FED045CB3EA924DFFE5FE654B3D")
    35  
    36  	// The "Random" values are undocumented, but they are meant to be written to
    37  	// the hash in sequence to develop the transcript.
    38  	transcript := sha256.New()
    39  
    40  	es := tls13.NewEarlySecret(sha256.New, psk)
    41  
    42  	transcript.Write(helloClientRandom)
    43  
    44  	if got := es.ClientEarlyTrafficSecret(transcript); !bytes.Equal(got, clientEarlyTrafficSecret) {
    45  		t.Errorf("clientEarlyTrafficSecret = %x, want %x", got, clientEarlyTrafficSecret)
    46  	}
    47  	if got := tls13.TestingOnlyExporterSecret(es.EarlyExporterMasterSecret(transcript)); !bytes.Equal(got, earlyExporterMasterSecret) {
    48  		t.Errorf("earlyExporterMasterSecret = %x, want %x", got, earlyExporterMasterSecret)
    49  	}
    50  
    51  	hs := es.HandshakeSecret(dhe)
    52  
    53  	transcript.Write(helloServerRandom)
    54  
    55  	if got := hs.ClientHandshakeTrafficSecret(transcript); !bytes.Equal(got, clientHandshakeTrafficSecret) {
    56  		t.Errorf("clientHandshakeTrafficSecret = %x, want %x", got, clientHandshakeTrafficSecret)
    57  	}
    58  	if got := hs.ServerHandshakeTrafficSecret(transcript); !bytes.Equal(got, serverHandshakeTrafficSecret) {
    59  		t.Errorf("serverHandshakeTrafficSecret = %x, want %x", got, serverHandshakeTrafficSecret)
    60  	}
    61  
    62  	ms := hs.MasterSecret()
    63  
    64  	transcript.Write(finishedServerRandom)
    65  
    66  	if got := ms.ClientApplicationTrafficSecret(transcript); !bytes.Equal(got, clientApplicationTrafficSecret) {
    67  		t.Errorf("clientApplicationTrafficSecret = %x, want %x", got, clientApplicationTrafficSecret)
    68  	}
    69  	if got := ms.ServerApplicationTrafficSecret(transcript); !bytes.Equal(got, serverApplicationTrafficSecret) {
    70  		t.Errorf("serverApplicationTrafficSecret = %x, want %x", got, serverApplicationTrafficSecret)
    71  	}
    72  	if got := tls13.TestingOnlyExporterSecret(ms.ExporterMasterSecret(transcript)); !bytes.Equal(got, exporterMasterSecret) {
    73  		t.Errorf("exporterMasterSecret = %x, want %x", got, exporterMasterSecret)
    74  	}
    75  
    76  	transcript.Write(finishedClientRandom)
    77  
    78  	if got := ms.ResumptionMasterSecret(transcript); !bytes.Equal(got, resumptionMasterSecret) {
    79  		t.Errorf("resumptionMasterSecret = %x, want %x", got, resumptionMasterSecret)
    80  	}
    81  }
    82  
    83  // This file contains tests derived from draft-ietf-tls-tls13-vectors-07.
    84  
    85  func parseVector(v string) []byte {
    86  	v = strings.Map(func(c rune) rune {
    87  		if unicode.IsSpace(c) {
    88  			return -1
    89  		}
    90  		return c
    91  	}, v)
    92  	parts := strings.Split(v, ":")
    93  	v = parts[len(parts)-1]
    94  	res, err := hex.DecodeString(v)
    95  	if err != nil {
    96  		panic(err)
    97  	}
    98  	return res
    99  }
   100  
   101  func TestTrafficKey(t *testing.T) {
   102  	trafficSecret := parseVector(
   103  		`PRK (32 octets):  b6 7b 7d 69 0c c1 6c 4e 75 e5 42 13 cb 2d 37 b4
   104  		e9 c9 12 bc de d9 10 5d 42 be fd 59 d3 91 ad 38`)
   105  	wantKey := parseVector(
   106  		`key expanded (16 octets):  3f ce 51 60 09 c2 17 27 d0 f2 e4 e8 6e
   107  		e4 03 bc`)
   108  	wantIV := parseVector(
   109  		`iv expanded (12 octets):  5d 31 3e b2 67 12 76 ee 13 00 0b 30`)
   110  
   111  	c := cipherSuitesTLS13[0]
   112  	gotKey, gotIV := c.trafficKey(trafficSecret)
   113  	if !bytes.Equal(gotKey, wantKey) {
   114  		t.Errorf("cipherSuiteTLS13.trafficKey() gotKey = % x, want % x", gotKey, wantKey)
   115  	}
   116  	if !bytes.Equal(gotIV, wantIV) {
   117  		t.Errorf("cipherSuiteTLS13.trafficKey() gotIV = % x, want % x", gotIV, wantIV)
   118  	}
   119  }
   120
View as plain text