tttls1.3 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 39cf5b4e5fd508981bdefedc27502ac14b984699983d44160d9a836b2ab2aa2b
-  data.tar.gz: 0250c8ad97ef5bef6a52d7b6e22c990b842ce66a8ab6e2d3abc0c6ef90a4eb13
+  metadata.gz: 98d9d2196c5b71c0bef8d7abb8838afb1c6d6bc42cdf5b09f24402591cb259ce
+  data.tar.gz: 7fa9dbb492a6a1b8b1b4040b212c8678aaa1fa384da421faa550bb64891908c1
 SHA512:
-  metadata.gz: e8ef15683ceabb9396eb51e5831f3dc48ed9c4df11871f10458160804891107fe3bff2d0c1810ad294134c8bec4d63534b2aee7cc6c8bff5f7ae07462bf753ef
-  data.tar.gz: 7baf720c22742962380449ad01372264634e878113858643cdc8a0db55e0f0cf07e0bd45cd80ad461cab9a337c89c7e0ad9c0e0057e02cbcda77a0765f10bdb9
+  metadata.gz: ee9f193f6d30c8248cebe79a34c949dbbd39529eb5df949dfd02e6fb164c474334d6767b3d2c9ce99794fb04368744ccb24063e92ca078bdf45e64f05004ec70
+  data.tar.gz: 974e0c1bfd02a73fa38ce1e46fb22032e68d43c8823692b1f0b79e6c3f417e4cf94206e9d865ef3aea7ece3c8d4268e235248c88f664264cf2e83a2df8963ecc

data/lib/tttls1.3/client.rb

@@ -420,6 +420,7 @@ module TTTLS13
       # supported_groups
       groups = @settings[:supported_groups]
       exs << Message::Extension::SupportedGroups.new(groups)
+
       # key_share
       ksg = @settings[:key_share_groups] || groups
       key_share, priv_keys \
@@ -668,7 +669,7 @@ module TTTLS13
       sh = @transcript[SH]
       sh_lv = sh.legacy_version
       sh_sv = sh.extensions[Message::ExtensionType::SUPPORTED_VERSIONS]
-                &.versions || []
+               &.versions || []
 
       sh_lv == Message::ProtocolVersion::TLS_1_2 &&
         sh_sv.first == Message::ProtocolVersion::TLS_1_3
@@ -744,7 +745,7 @@ module TTTLS13
     def valid_sh_key_share?
       offered = @transcript[CH].extensions[Message::ExtensionType::KEY_SHARE]
                                .key_share_entry.map(&:group)
-      selected = @transcript[CH].extensions[Message::ExtensionType::KEY_SHARE]
+      selected = @transcript[SH].extensions[Message::ExtensionType::KEY_SHARE]
                                 .key_share_entry.first.group
       offered.include?(selected)
     end
@@ -754,14 +755,11 @@ module TTTLS13
       # TODO: pre_shared_key
       ch1_exs = @transcript[CH1].extensions
       ngl = ch1_exs[Message::ExtensionType::SUPPORTED_GROUPS].named_group_list
+      kse = ch1_exs[Message::ExtensionType::KEY_SHARE].key_share_entry
       group = @transcript[HRR].extensions[Message::ExtensionType::KEY_SHARE]
                               .key_share_entry.first.group
-      return false unless ngl.include?(group)
 
-      kse = ch1_exs[Message::ExtensionType::KEY_SHARE].key_share_entry
-      return false if !kse.empty? && kse.map(&:group).include?(group)
-
-      true
+      ngl.include?(group) && !kse.map(&:group).include?(group)
     end
 
     # @param nst [TTTLS13::Message::NewSessionTicket]

data/lib/tttls1.3/connection.rb

@@ -363,15 +363,16 @@ module TTTLS13
     end
 
     # @return [Boolean]
-    #
-    # Received ccs before the first ClientHello message or after the peer's
-    # Finished message, peer MUST abort.
     def receivable_ccs?
-      return false unless @transcript.include?(CH)
-      return false if @endpoint == :client && @transcript.include?(SF)
-      return false if @endpoint == :server && @transcript.include?(CF)
-
-      true
+      # Received ccs before the first ClientHello message or after the peer's
+      # Finished message, peer MUST abort.
+      #
+      # Server may receive an unprotected record of type change_cipher_spec
+      # between the first and second ClientHello
+      finished = (@endpoint == :client ? SF : CF)
+
+      (@transcript.include?(CH) || @transcript.include?(CH1)) &&
+        !@transcript.include?(finished)
     end
 
     # @param symbol [Symbol] key of ALERT_DESCRIPTION

data/lib/tttls1.3/message/extension/key_share.rb

@@ -131,6 +131,17 @@ module TTTLS13
           [key_share, ec]
         end
 
+        # @param groups [TTTLS13::NamedGroup]
+        #
+        # @return [TTTLS13::Message::Extensions::KeyShare]
+        def self.gen_hrr_key_share(group)
+          kse = KeyShareEntry.new(group: group)
+          KeyShare.new(
+            msg_type: HandshakeType::HELLO_RETRY_REQUEST,
+            key_share_entry: [kse]
+          )
+        end
+
         class << self
           private
 

data/lib/tttls1.3/message/server_hello.rb

@@ -21,13 +21,12 @@ module TTTLS13
     ].freeze
     private_constant :APPEARABLE_HRR_EXTENSIONS
 
-    class ServerHello
-      # special value of the SHA-256 of "HelloRetryRequest"
-      HRR_RANDOM \
-      = "\xcf\x21\xad\x74\xe5\x9a\x61\x11\xbe\x1d\x8c\x02\x1e\x65\xb8\x91" \
-        "\xc2\xa2\x11\x16\x7a\xbb\x8c\x5e\x07\x9e\x09\xe2\xc8\xa8\x33\x9c"
-      private_constant :HRR_RANDOM
+    # special value of the SHA-256 of "HelloRetryRequest"
+    HRR_RANDOM \
+    = "\xcf\x21\xad\x74\xe5\x9a\x61\x11\xbe\x1d\x8c\x02\x1e\x65\xb8\x91" \
+      "\xc2\xa2\x11\x16\x7a\xbb\x8c\x5e\x07\x9e\x09\xe2\xc8\xa8\x33\x9c"
 
+    class ServerHello
       attr_reader :msg_type
       attr_reader :legacy_version
       attr_reader :random

data/lib/tttls1.3/server.rb

@@ -140,14 +140,22 @@ module TTTLS13
           terminate(:protocol_version) unless negotiated_tls_1_3?
 
           # validate/select parameters
+          terminamte(:illegal_parameter) unless valid_ch_compression_methods?
+          terminate(:illegal_parameter) unless valid_ch_key_share?
+          terminate(:unrecognized_name) unless recognized_server_name?
           @cipher_suite = select_cipher_suite
           @named_group = select_named_group
           @signature_scheme = select_signature_scheme
           terminate(:handshake_failure) \
-            if @cipher_suite.nil? || @named_group.nil? || @signature_scheme.nil?
-          terminamte(:illegal_parameter) unless valid_ch_compression_methods?
-          terminate(:unrecognized_name) unless recognized_server_name?
-
+            if @cipher_suite.nil? || @signature_scheme.nil?
+
+          # send HRR
+          if @named_group.nil?
+            @transcript[CH1] = @transcript.delete(CH)
+            @transcript[HRR] = send_hello_retry_request
+            @state = ServerState::START
+            next
+          end
           @state = ServerState::NEGOTIATED
         when ServerState::NEGOTIATED
           logger.debug('ServerState::NEGOTIATED')
@@ -157,12 +165,10 @@ module TTTLS13
           send_ccs # compatibility mode
 
           # generate shared secret
-          terminate(:illegal_parameter) unless valid_ch_key_share?
           ke = @transcript[CH].extensions[Message::ExtensionType::KEY_SHARE]
-                              &.key_share_entry
-                              &.find { |e| e.group == @named_group }
-                              &.key_exchange
-          # TODO: Send HelloRetryRequest
+                             &.key_share_entry
+                             &.find { |e| e.group == @named_group }
+                             &.key_exchange
           shared_secret = gen_shared_secret(ke, @priv_key, @named_group)
           @key_schedule = KeySchedule.new(psk: @psk,
                                           shared_secret: shared_secret,
@@ -260,6 +266,38 @@ module TTTLS13
       sh
     end
 
+    # @return [TTTLS13::Message::ServerHello]
+    def send_hello_retry_request
+      exs = []
+      # supported_versions
+      exs << Message::Extension::SupportedVersions.new(
+        msg_type: Message::HandshakeType::SERVER_HELLO
+      )
+
+      # key_share
+      ch1 = @transcript[CH1]
+      sp_groups = ch1.extensions[Message::ExtensionType::SUPPORTED_GROUPS]
+                    &.named_group_list || []
+      ks_groups = ch1.extensions[Message::ExtensionType::KEY_SHARE]
+                    &.key_share_entry&.map(&:group) || []
+      ksg = sp_groups.find do |g|
+        !ks_groups.include?(g) && @settings[:supported_groups].include?(g)
+      end
+
+      # TODO: cookie
+      exs << Message::Extension::KeyShare.gen_hrr_key_share(ksg)
+
+      sh = Message::ServerHello.new(
+        random: Message::HRR_RANDOM,
+        legacy_session_id_echo: ch1.legacy_session_id,
+        cipher_suite: @cipher_suite,
+        extensions: Message::Extensions.new(exs)
+      )
+      send_handshakes(Message::ContentType::HANDSHAKE, [sh], @write_cipher)
+
+      sh
+    end
+
     # @param messages [Array of TTTLS13::Message::$Object]
     #
     # @return [Array of TTTLS13::Message::$Object]
@@ -374,7 +412,7 @@ module TTTLS13
       ch = @transcript[CH]
       ch_lv = ch.legacy_version
       ch_sv = ch.extensions[Message::ExtensionType::SUPPORTED_VERSIONS]
-                &.versions || []
+               &.versions || []
 
       ch_lv == Message::ProtocolVersion::TLS_1_2 &&
         ch_sv.include?(Message::ProtocolVersion::TLS_1_3)
@@ -389,12 +427,11 @@ module TTTLS13
 
     # @return [TTTLS13::NamedGroup, nil]
     def select_named_group
-      groups \
-      = @transcript[CH].extensions[Message::ExtensionType::SUPPORTED_GROUPS]
-                       &.named_group_list || []
+      ks_groups = @transcript[CH].extensions[Message::ExtensionType::KEY_SHARE]
+                                &.key_share_entry&.map(&:group) || []
 
-      groups.find do |sg|
-        @settings[:supported_groups].include?(sg)
+      ks_groups.find do |g|
+        @settings[:supported_groups].include?(g)
       end
     end
 
@@ -402,7 +439,7 @@ module TTTLS13
     def select_signature_scheme
       algorithms \
       = @transcript[CH].extensions[Message::ExtensionType::SIGNATURE_ALGORITHMS]
-                       &.supported_signature_algorithms || []
+                      &.supported_signature_algorithms || []
 
       do_select_signature_algorithms(algorithms, @crt).find do |ss|
         @settings[:signature_algorithms].include?(ss)
@@ -418,7 +455,7 @@ module TTTLS13
     def recognized_server_name?
       server_name \
       = @transcript[CH].extensions[Message::ExtensionType::SERVER_NAME]
-                       &.server_name
+                      &.server_name
 
       return true if server_name.nil?
 
@@ -432,7 +469,13 @@ module TTTLS13
       sg = @transcript[CH].extensions[Message::ExtensionType::SUPPORTED_GROUPS]
       sp_groups = sg&.named_group_list || []
 
-      ks_groups.uniq == ks_groups && (ks_groups - sp_groups).empty?
+      # Each KeyShareEntry value MUST correspond to a group offered in the
+      # "supported_groups" extension and MUST appear in the same order.
+      #
+      # Clients MUST NOT offer multiple KeyShareEntry values for the same group.
+      (ks_groups - sp_groups).empty? &&
+        sp_groups.filter { |g| ks_groups.include?(g) } == ks_groups &&
+        ks_groups.uniq == ks_groups
     end
   end
   # rubocop: enable Metrics/ClassLength

data/lib/tttls1.3/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module TTTLS13
-  VERSION = '0.2.0'
+  VERSION = '0.2.1'
 end

data/spec/server_hello_spec.rb

@@ -98,4 +98,43 @@ RSpec.describe ServerHello do
       expect(message.serialize).to eq TESTBINARY_0_RTT_SERVER_HELLO
     end
   end
+
+  context 'default hello_retry_request' do
+    let(:legacy_session_id_echo) do
+      Array.new(32, 0).map(&:chr).join
+    end
+
+    let(:cipher_suite) do
+      CipherSuite::TLS_AES_256_GCM_SHA384
+    end
+
+    let(:message) do
+      ServerHello.new(random: Message::HRR_RANDOM,
+                      legacy_session_id_echo: legacy_session_id_echo,
+                      cipher_suite: cipher_suite)
+    end
+
+    it 'should be generated' do
+      expect(message.msg_type).to eq HandshakeType::SERVER_HELLO
+      expect(message.legacy_version).to eq ProtocolVersion::TLS_1_2
+      expect(message.random).to eq Message::HRR_RANDOM
+      expect(message.legacy_session_id_echo).to eq legacy_session_id_echo
+      expect(message.cipher_suite).to eq CipherSuite::TLS_AES_256_GCM_SHA384
+      expect(message.legacy_compression_method).to eq "\x00"
+      expect(message.extensions).to be_empty
+      expect(message.hrr?).to eq true
+    end
+
+    it 'should be serialized' do
+      expect(message.serialize).to eq HandshakeType::SERVER_HELLO \
+                                      + 72.to_uint24 \
+                                      + ProtocolVersion::TLS_1_2 \
+                                      + Message::HRR_RANDOM \
+                                      + legacy_session_id_echo.length.to_uint8 \
+                                      + legacy_session_id_echo \
+                                      + cipher_suite \
+                                      + "\x00" \
+                                      + Extensions.new.serialize
+    end
+  end
 end

data/spec/server_spec.rb

@@ -40,8 +40,8 @@ RSpec.describe Server do
       server.instance_variable_set(:@transcript, transcript)
       cipher_suite = server.send(:select_cipher_suite)
       server.instance_variable_set(:@cipher_suite, cipher_suite)
-      named_group = server.send(:select_named_group)
-      server.instance_variable_set(:@named_group, named_group)
+      # X25519 is unsupported so @named_group uses SECP256R1.
+      server.instance_variable_set(:@named_group, NamedGroup::SECP256R1)
       signature_scheme = server.send(:select_signature_scheme)
       server.instance_variable_set(:@signature_scheme, signature_scheme)
       exs, _priv_key = server.send(:gen_sh_extensions)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tttls1.3
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - thekuwayama
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-05-22 00:00:00.000000000 Z
+date: 2019-05-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler