void/ZeroTierOne
2
0
Fork 0
mirror of https://github.com/zerotier/ZeroTierOne.git synced 2025-06-07 21:13:44 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

prepared for audit

Browse source
This commit is contained in:
mamoniot 2022-12-14 20:06:51 -05:00
parent 1f7a210760
commit d8aa3c6707
1 changed files with 9 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
zssp/src/zssp.rs
View file

@ -743,12 +743,13 @@ impl<Layer: ApplicationLayer> ReceiveContext<Layer> {
let hmac1_end = kex_packet_len - HMAC_SIZE; let hmac1_end = kex_packet_len - HMAC_SIZE;
// Check the second HMAC first, which proves that the sender knows the recipient's full static identity. // Check the second HMAC first, which proves that the sender knows the recipient's full static identity.
let hmac2 = &kex_packet[hmac1_end..kex_packet_len];
if !hmac_sha384_2( if !hmac_sha384_2(
host.get_local_s_public_blob_hash(), host.get_local_s_public_blob_hash(),
canonical_header_bytes, canonical_header_bytes,
&kex_packet[HEADER_SIZE..hmac1_end], &kex_packet[HEADER_SIZE..hmac1_end],
) )
.eq(&kex_packet[hmac1_end..kex_packet_len]) .eq(hmac2)
{ {
return Err(Error::FailedAuthentication); return Err(Error::FailedAuthentication);
} }
@ -808,12 +809,13 @@ impl<Layer: ApplicationLayer> ReceiveContext<Layer> {
// Authenticate entire packet with HMAC-SHA384, verifying alice's identity via 'ss' secret that was // Authenticate entire packet with HMAC-SHA384, verifying alice's identity via 'ss' secret that was
// just mixed into the key. // just mixed into the key.
let hmac1 = &kex_packet[aes_gcm_tag_end..hmac1_end];
if !hmac_sha384_2( if !hmac_sha384_2(
kbkdf512(ss_key.as_bytes(), KBKDF_KEY_USAGE_LABEL_HMAC).first_n::<48>(), kbkdf512(ss_key.as_bytes(), KBKDF_KEY_USAGE_LABEL_HMAC).first_n::<48>(),
canonical_header_bytes, canonical_header_bytes,
&kex_packet_saved_ciphertext[HEADER_SIZE..aes_gcm_tag_end], &kex_packet_saved_ciphertext[HEADER_SIZE..aes_gcm_tag_end],
) )
.eq(&kex_packet[aes_gcm_tag_end..hmac1_end]) .eq(hmac1)
{ {
return Err(Error::FailedAuthentication); return Err(Error::FailedAuthentication);
} }
@ -1080,6 +1082,7 @@ impl<Layer: ApplicationLayer> ReceiveContext<Layer> {
None None
}; };
// Mix ratchet key from previous session key (if any) and Kyber1024 hybrid shared key (if any).
let mut ratchet_count = 0; let mut ratchet_count = 0;
let mut session_key = noise_ik_key; let mut session_key = noise_ik_key;
if bob_ratchet_key_id.is_some() && offer.ratchet_key.is_some() { if bob_ratchet_key_id.is_some() && offer.ratchet_key.is_some() {
@ -1090,12 +1093,13 @@ impl<Layer: ApplicationLayer> ReceiveContext<Layer> {
session_key = Secret(hmac_sha512(hybrid_kk.as_bytes(), session_key.as_bytes())); session_key = Secret(hmac_sha512(hybrid_kk.as_bytes(), session_key.as_bytes()));
} }
let hmac = &kex_packet[aes_gcm_tag_end..kex_packet_len];
if !hmac_sha384_2( if !hmac_sha384_2(
kbkdf512(session_key.as_bytes(), KBKDF_KEY_USAGE_LABEL_HMAC).first_n::<48>(), kbkdf512(session_key.as_bytes(), KBKDF_KEY_USAGE_LABEL_HMAC).first_n::<48>(),
canonical_header_bytes, canonical_header_bytes,
&kex_packet_saved_ciphertext[HEADER_SIZE..aes_gcm_tag_end], &kex_packet_saved_ciphertext[HEADER_SIZE..aes_gcm_tag_end],
) )
.eq(&kex_packet[aes_gcm_tag_end..kex_packet_len]) .eq(hmac)
{ {
return Err(Error::FailedAuthentication); return Err(Error::FailedAuthentication);
} }
@ -1257,12 +1261,12 @@ fn send_ephemeral_offer<SendFunction: FnMut(&mut [u8])>(
drop(es_key); drop(es_key);
// HMAC packet using static + ephemeral key. // HMAC packet using static + ephemeral key.
let hmac = hmac_sha384_2( let hmac1 = hmac_sha384_2(
kbkdf512(ss_key.as_bytes(), KBKDF_KEY_USAGE_LABEL_HMAC).first_n::<48>(), kbkdf512(ss_key.as_bytes(), KBKDF_KEY_USAGE_LABEL_HMAC).first_n::<48>(),
canonical_header.as_bytes(), canonical_header.as_bytes(),
&packet_buf[HEADER_SIZE..aes_gcm_tag_end], &packet_buf[HEADER_SIZE..aes_gcm_tag_end],
); );
idx = safe_write_all(&mut packet_buf, idx, &hmac)?; idx = safe_write_all(&mut packet_buf, idx, &hmac1)?;
let hmac1_end = idx; let hmac1_end = idx;
// Add secondary HMAC to verify that the caller knows the recipient's full static public identity. // Add secondary HMAC to verify that the caller knows the recipient's full static public identity.