hs_ntor.c 25 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618
  1. /* Copyright (c) 2017, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. /** \file hs_ntor.c
  4. * \brief Implements the ntor variant used in Tor hidden services.
  5. *
  6. * \details
  7. * This module handles the variant of the ntor handshake that is documented in
  8. * section [NTOR-WITH-EXTRA-DATA] of rend-spec-ng.txt .
  9. *
  10. * The functions in this file provide an API that should be used when sending
  11. * or receiving INTRODUCE1/RENDEZVOUS1 cells to generate the various key
  12. * material required to create and handle those cells.
  13. *
  14. * In the case of INTRODUCE1 it provides encryption and MAC keys to
  15. * encode/decode the encrypted blob (see hs_ntor_intro_cell_keys_t). The
  16. * relevant pub functions are hs_ntor_{client,service}_get_introduce1_keys().
  17. *
  18. * In the case of RENDEZVOUS1 it calculates the MAC required to authenticate
  19. * the cell, and also provides the key seed that is used to derive the crypto
  20. * material for rendezvous encryption (see hs_ntor_rend_cell_keys_t). The
  21. * relevant pub functions are hs_ntor_{client,service}_get_rendezvous1_keys().
  22. * It also provides a function (hs_ntor_circuit_key_expansion()) that does the
  23. * rendezvous key expansion to setup end-to-end rend circuit keys.
  24. */
  25. #include "or.h"
  26. #include "hs_ntor.h"
  27. /* String constants used by the ntor HS protocol */
  28. #define PROTOID "tor-hs-ntor-curve25519-sha3-256-1"
  29. #define PROTOID_LEN (sizeof(PROTOID) - 1)
  30. #define SERVER_STR "Server"
  31. #define SERVER_STR_LEN (sizeof(SERVER_STR) - 1)
  32. /* Protocol-specific tweaks to our crypto inputs */
  33. #define T_HSENC PROTOID ":hs_key_extract"
  34. #define T_HSENC_LEN (sizeof(T_HSENC) - 1)
  35. #define T_HSVERIFY PROTOID ":hs_verify"
  36. #define T_HSMAC PROTOID ":hs_mac"
  37. #define M_HSEXPAND PROTOID ":hs_key_expand"
  38. #define M_HSEXPAND_LEN (sizeof(M_HSEXPAND) - 1)
  39. /************************* Helper functions: *******************************/
  40. /** Helper macro: copy <b>len</b> bytes from <b>inp</b> to <b>ptr</b> and
  41. *advance <b>ptr</b> by the number of bytes copied. Stolen from onion_ntor.c */
  42. #define APPEND(ptr, inp, len) \
  43. STMT_BEGIN { \
  44. memcpy(ptr, (inp), (len)); \
  45. ptr += len; \
  46. } STMT_END
  47. /* Length of EXP(X,y) | EXP(X,b) | AUTH_KEY | B | X | Y | PROTOID */
  48. #define REND_SECRET_HS_INPUT_LEN (CURVE25519_OUTPUT_LEN * 2 + \
  49. ED25519_PUBKEY_LEN + CURVE25519_PUBKEY_LEN * 3 + PROTOID_LEN)
  50. /* Length of auth_input = verify | AUTH_KEY | B | Y | X | PROTOID | "Server" */
  51. #define REND_AUTH_INPUT_LEN (DIGEST256_LEN + ED25519_PUBKEY_LEN + \
  52. CURVE25519_PUBKEY_LEN * 3 + PROTOID_LEN + SERVER_STR_LEN)
  53. /** Helper function: Compute the last part of the HS ntor handshake which
  54. * derives key material necessary to create and handle RENDEZVOUS1
  55. * cells. Function used by both client and service. The actual calculations is
  56. * as follows:
  57. *
  58. * NTOR_KEY_SEED = MAC(rend_secret_hs_input, t_hsenc)
  59. * verify = MAC(rend_secret_hs_input, t_hsverify)
  60. * auth_input = verify | AUTH_KEY | B | Y | X | PROTOID | "Server"
  61. * auth_input_mac = MAC(auth_input, t_hsmac)
  62. *
  63. * where in the above, AUTH_KEY is <b>intro_auth_pubkey</b>, B is
  64. * <b>intro_enc_pubkey</b>, Y is <b>service_ephemeral_rend_pubkey</b>, and X
  65. * is <b>client_ephemeral_enc_pubkey</b>. The provided
  66. * <b>rend_secret_hs_input</b> is of size REND_SECRET_HS_INPUT_LEN.
  67. *
  68. * The final results of NTOR_KEY_SEED and auth_input_mac are placed in
  69. * <b>hs_ntor_rend_cell_keys_out</b>. Return 0 if everything went fine. */
  70. static int
  71. get_rendezvous1_key_material(const uint8_t *rend_secret_hs_input,
  72. const ed25519_public_key_t *intro_auth_pubkey,
  73. const curve25519_public_key_t *intro_enc_pubkey,
  74. const curve25519_public_key_t *service_ephemeral_rend_pubkey,
  75. const curve25519_public_key_t *client_ephemeral_enc_pubkey,
  76. hs_ntor_rend_cell_keys_t *hs_ntor_rend_cell_keys_out)
  77. {
  78. int bad = 0;
  79. uint8_t ntor_key_seed[DIGEST256_LEN];
  80. uint8_t ntor_verify[DIGEST256_LEN];
  81. uint8_t rend_auth_input[REND_AUTH_INPUT_LEN];
  82. uint8_t rend_cell_auth[DIGEST256_LEN];
  83. uint8_t *ptr;
  84. /* Let's build NTOR_KEY_SEED */
  85. crypto_mac_sha3_256(ntor_key_seed, sizeof(ntor_key_seed),
  86. rend_secret_hs_input, REND_SECRET_HS_INPUT_LEN,
  87. (const uint8_t *)T_HSENC, strlen(T_HSENC));
  88. bad |= safe_mem_is_zero(ntor_key_seed, DIGEST256_LEN);
  89. /* Let's build ntor_verify */
  90. crypto_mac_sha3_256(ntor_verify, sizeof(ntor_verify),
  91. rend_secret_hs_input, REND_SECRET_HS_INPUT_LEN,
  92. (const uint8_t *)T_HSVERIFY, strlen(T_HSVERIFY));
  93. bad |= safe_mem_is_zero(ntor_verify, DIGEST256_LEN);
  94. /* Let's build auth_input: */
  95. ptr = rend_auth_input;
  96. /* Append ntor_verify */
  97. APPEND(ptr, ntor_verify, sizeof(ntor_verify));
  98. /* Append AUTH_KEY */
  99. APPEND(ptr, intro_auth_pubkey->pubkey, ED25519_PUBKEY_LEN);
  100. /* Append B */
  101. APPEND(ptr, intro_enc_pubkey->public_key, CURVE25519_PUBKEY_LEN);
  102. /* Append Y */
  103. APPEND(ptr,
  104. service_ephemeral_rend_pubkey->public_key, CURVE25519_PUBKEY_LEN);
  105. /* Append X */
  106. APPEND(ptr,
  107. client_ephemeral_enc_pubkey->public_key, CURVE25519_PUBKEY_LEN);
  108. /* Append PROTOID */
  109. APPEND(ptr, PROTOID, strlen(PROTOID));
  110. /* Append "Server" */
  111. APPEND(ptr, SERVER_STR, strlen(SERVER_STR));
  112. tor_assert(ptr == rend_auth_input + sizeof(rend_auth_input));
  113. /* Let's build auth_input_mac that goes in RENDEZVOUS1 cell */
  114. crypto_mac_sha3_256(rend_cell_auth, sizeof(rend_cell_auth),
  115. rend_auth_input, sizeof(rend_auth_input),
  116. (const uint8_t *)T_HSMAC, strlen(T_HSMAC));
  117. bad |= safe_mem_is_zero(ntor_verify, DIGEST256_LEN);
  118. { /* Get the computed RENDEZVOUS1 material! */
  119. memcpy(&hs_ntor_rend_cell_keys_out->rend_cell_auth_mac,
  120. rend_cell_auth, DIGEST256_LEN);
  121. memcpy(&hs_ntor_rend_cell_keys_out->ntor_key_seed,
  122. ntor_key_seed, DIGEST256_LEN);
  123. }
  124. memwipe(rend_cell_auth, 0, sizeof(rend_cell_auth));
  125. memwipe(rend_auth_input, 0, sizeof(rend_auth_input));
  126. memwipe(ntor_key_seed, 0, sizeof(ntor_key_seed));
  127. return bad;
  128. }
  129. /** Length of secret_input = EXP(B,x) | AUTH_KEY | X | B | PROTOID */
  130. #define INTRO_SECRET_HS_INPUT_LEN (CURVE25519_OUTPUT_LEN +ED25519_PUBKEY_LEN +\
  131. CURVE25519_PUBKEY_LEN + CURVE25519_PUBKEY_LEN + PROTOID_LEN)
  132. /* Length of info = m_hsexpand | subcredential */
  133. #define INFO_BLOB_LEN (M_HSEXPAND_LEN + DIGEST256_LEN)
  134. /* Length of KDF input = intro_secret_hs_input | t_hsenc | info */
  135. #define KDF_INPUT_LEN (INTRO_SECRET_HS_INPUT_LEN + T_HSENC_LEN + INFO_BLOB_LEN)
  136. /** Helper function: Compute the part of the HS ntor handshake that generates
  137. * key material for creating and handling INTRODUCE1 cells. Function used
  138. * by both client and service. Specifically, calculate the following:
  139. *
  140. * info = m_hsexpand | subcredential
  141. * hs_keys = KDF(intro_secret_hs_input | t_hsenc | info, S_KEY_LEN+MAC_LEN)
  142. * ENC_KEY = hs_keys[0:S_KEY_LEN]
  143. * MAC_KEY = hs_keys[S_KEY_LEN:S_KEY_LEN+MAC_KEY_LEN]
  144. *
  145. * where intro_secret_hs_input is <b>secret_input</b> (of size
  146. * INTRO_SECRET_HS_INPUT_LEN), and <b>subcredential</b> is of size
  147. * DIGEST256_LEN.
  148. *
  149. * If everything went well, fill <b>hs_ntor_intro_cell_keys_out</b> with the
  150. * necessary key material, and return 0. */
  151. static void
  152. get_introduce1_key_material(const uint8_t *secret_input,
  153. const uint8_t *subcredential,
  154. hs_ntor_intro_cell_keys_t *hs_ntor_intro_cell_keys_out)
  155. {
  156. uint8_t keystream[CIPHER256_KEY_LEN + DIGEST256_LEN];
  157. uint8_t info_blob[INFO_BLOB_LEN];
  158. uint8_t kdf_input[KDF_INPUT_LEN];
  159. crypto_xof_t *xof;
  160. uint8_t *ptr;
  161. /* Let's build info */
  162. ptr = info_blob;
  163. APPEND(ptr, M_HSEXPAND, strlen(M_HSEXPAND));
  164. APPEND(ptr, subcredential, DIGEST256_LEN);
  165. tor_assert(ptr == info_blob + sizeof(info_blob));
  166. /* Let's build the input to the KDF */
  167. ptr = kdf_input;
  168. APPEND(ptr, secret_input, INTRO_SECRET_HS_INPUT_LEN);
  169. APPEND(ptr, T_HSENC, strlen(T_HSENC));
  170. APPEND(ptr, info_blob, sizeof(info_blob));
  171. tor_assert(ptr == kdf_input + sizeof(kdf_input));
  172. /* Now we need to run kdf_input over SHAKE-256 */
  173. xof = crypto_xof_new();
  174. crypto_xof_add_bytes(xof, kdf_input, sizeof(kdf_input));
  175. crypto_xof_squeeze_bytes(xof, keystream, sizeof(keystream)) ;
  176. crypto_xof_free(xof);
  177. { /* Get the keys */
  178. memcpy(&hs_ntor_intro_cell_keys_out->enc_key, keystream,CIPHER256_KEY_LEN);
  179. memcpy(&hs_ntor_intro_cell_keys_out->mac_key,
  180. keystream+CIPHER256_KEY_LEN, DIGEST256_LEN);
  181. }
  182. memwipe(keystream, 0, sizeof(keystream));
  183. memwipe(kdf_input, 0, sizeof(kdf_input));
  184. }
  185. /** Helper function: Calculate the 'intro_secret_hs_input' element used by the
  186. * HS ntor handshake and place it in <b>secret_input_out</b>. This function is
  187. * used by both client and service code.
  188. *
  189. * For the client-side it looks like this:
  190. *
  191. * intro_secret_hs_input = EXP(B,x) | AUTH_KEY | X | B | PROTOID
  192. *
  193. * whereas for the service-side it looks like this:
  194. *
  195. * intro_secret_hs_input = EXP(X,b) | AUTH_KEY | X | B | PROTOID
  196. *
  197. * In this function, <b>dh_result</b> carries the EXP() result (and has size
  198. * CURVE25519_OUTPUT_LEN) <b>intro_auth_pubkey</b> is AUTH_KEY,
  199. * <b>client_ephemeral_enc_pubkey</b> is X, and <b>intro_enc_pubkey</b> is B.
  200. */
  201. static void
  202. get_intro_secret_hs_input(const uint8_t *dh_result,
  203. const ed25519_public_key_t *intro_auth_pubkey,
  204. const curve25519_public_key_t *client_ephemeral_enc_pubkey,
  205. const curve25519_public_key_t *intro_enc_pubkey,
  206. uint8_t *secret_input_out)
  207. {
  208. uint8_t *ptr;
  209. /* Append EXP() */
  210. ptr = secret_input_out;
  211. APPEND(ptr, dh_result, CURVE25519_OUTPUT_LEN);
  212. /* Append AUTH_KEY */
  213. APPEND(ptr, intro_auth_pubkey->pubkey, ED25519_PUBKEY_LEN);
  214. /* Append X */
  215. APPEND(ptr, client_ephemeral_enc_pubkey->public_key, CURVE25519_PUBKEY_LEN);
  216. /* Append B */
  217. APPEND(ptr, intro_enc_pubkey->public_key, CURVE25519_PUBKEY_LEN);
  218. /* Append PROTOID */
  219. APPEND(ptr, PROTOID, strlen(PROTOID));
  220. tor_assert(ptr == secret_input_out + INTRO_SECRET_HS_INPUT_LEN);
  221. }
  222. /** Calculate the 'rend_secret_hs_input' element used by the HS ntor handshake
  223. * and place it in <b>rend_secret_hs_input_out</b>. This function is used by
  224. * both client and service code.
  225. *
  226. * The computation on the client side is:
  227. * rend_secret_hs_input = EXP(X,y) | EXP(X,b) | AUTH_KEY | B | X | Y | PROTOID
  228. * whereas on the service side it is:
  229. * rend_secret_hs_input = EXP(Y,x) | EXP(B,x) | AUTH_KEY | B | X | Y | PROTOID
  230. *
  231. * where:
  232. * <b>dh_result1</b> and <b>dh_result2</b> carry the two EXP() results (of size
  233. * CURVE25519_OUTPUT_LEN)
  234. * <b>intro_auth_pubkey</b> is AUTH_KEY,
  235. * <b>intro_enc_pubkey</b> is B,
  236. * <b>client_ephemeral_enc_pubkey</b> is X, and
  237. * <b>service_ephemeral_rend_pubkey</b> is Y.
  238. */
  239. static void
  240. get_rend_secret_hs_input(const uint8_t *dh_result1, const uint8_t *dh_result2,
  241. const ed25519_public_key_t *intro_auth_pubkey,
  242. const curve25519_public_key_t *intro_enc_pubkey,
  243. const curve25519_public_key_t *client_ephemeral_enc_pubkey,
  244. const curve25519_public_key_t *service_ephemeral_rend_pubkey,
  245. uint8_t *rend_secret_hs_input_out)
  246. {
  247. uint8_t *ptr;
  248. ptr = rend_secret_hs_input_out;
  249. /* Append the first EXP() */
  250. APPEND(ptr, dh_result1, CURVE25519_OUTPUT_LEN);
  251. /* Append the other EXP() */
  252. APPEND(ptr, dh_result2, CURVE25519_OUTPUT_LEN);
  253. /* Append AUTH_KEY */
  254. APPEND(ptr, intro_auth_pubkey->pubkey, ED25519_PUBKEY_LEN);
  255. /* Append B */
  256. APPEND(ptr, intro_enc_pubkey->public_key, CURVE25519_PUBKEY_LEN);
  257. /* Append X */
  258. APPEND(ptr,
  259. client_ephemeral_enc_pubkey->public_key, CURVE25519_PUBKEY_LEN);
  260. /* Append Y */
  261. APPEND(ptr,
  262. service_ephemeral_rend_pubkey->public_key, CURVE25519_PUBKEY_LEN);
  263. /* Append PROTOID */
  264. APPEND(ptr, PROTOID, strlen(PROTOID));
  265. tor_assert(ptr == rend_secret_hs_input_out + REND_SECRET_HS_INPUT_LEN);
  266. }
  267. /************************* Public functions: *******************************/
  268. /* Public function: Do the appropriate ntor calculations and derive the keys
  269. * needed to encrypt and authenticate INTRODUCE1 cells. Return 0 and place the
  270. * final key material in <b>hs_ntor_intro_cell_keys_out</b> if everything went
  271. * well, otherwise return -1;
  272. *
  273. * The relevant calculations are as follows:
  274. *
  275. * intro_secret_hs_input = EXP(B,x) | AUTH_KEY | X | B | PROTOID
  276. * info = m_hsexpand | subcredential
  277. * hs_keys = KDF(intro_secret_hs_input | t_hsenc | info, S_KEY_LEN+MAC_LEN)
  278. * ENC_KEY = hs_keys[0:S_KEY_LEN]
  279. * MAC_KEY = hs_keys[S_KEY_LEN:S_KEY_LEN+MAC_KEY_LEN]
  280. *
  281. * where:
  282. * <b>intro_auth_pubkey</b> is AUTH_KEY (found in HS descriptor),
  283. * <b>intro_enc_pubkey</b> is B (also found in HS descriptor),
  284. * <b>client_ephemeral_enc_keypair</b> is freshly generated keypair (x,X)
  285. * <b>subcredential</b> is the hidden service subcredential (of size
  286. * DIGEST256_LEN). */
  287. int
  288. hs_ntor_client_get_introduce1_keys(
  289. const ed25519_public_key_t *intro_auth_pubkey,
  290. const curve25519_public_key_t *intro_enc_pubkey,
  291. const curve25519_keypair_t *client_ephemeral_enc_keypair,
  292. const uint8_t *subcredential,
  293. hs_ntor_intro_cell_keys_t *hs_ntor_intro_cell_keys_out)
  294. {
  295. int bad = 0;
  296. uint8_t secret_input[INTRO_SECRET_HS_INPUT_LEN];
  297. uint8_t dh_result[CURVE25519_OUTPUT_LEN];
  298. tor_assert(intro_auth_pubkey);
  299. tor_assert(intro_enc_pubkey);
  300. tor_assert(client_ephemeral_enc_keypair);
  301. tor_assert(subcredential);
  302. tor_assert(hs_ntor_intro_cell_keys_out);
  303. /* Calculate EXP(B,x) */
  304. curve25519_handshake(dh_result,
  305. &client_ephemeral_enc_keypair->seckey,
  306. intro_enc_pubkey);
  307. bad |= safe_mem_is_zero(dh_result, CURVE25519_OUTPUT_LEN);
  308. /* Get intro_secret_hs_input */
  309. get_intro_secret_hs_input(dh_result, intro_auth_pubkey,
  310. &client_ephemeral_enc_keypair->pubkey,
  311. intro_enc_pubkey, secret_input);
  312. bad |= safe_mem_is_zero(secret_input, CURVE25519_OUTPUT_LEN);
  313. /* Get ENC_KEY and MAC_KEY! */
  314. get_introduce1_key_material(secret_input, subcredential,
  315. hs_ntor_intro_cell_keys_out);
  316. /* Cleanup */
  317. memwipe(secret_input, 0, sizeof(secret_input));
  318. if (bad) {
  319. memwipe(hs_ntor_intro_cell_keys_out, 0, sizeof(hs_ntor_intro_cell_keys_t));
  320. }
  321. return bad ? -1 : 0;
  322. }
  323. /* Public function: Do the appropriate ntor calculations and derive the keys
  324. * needed to verify RENDEZVOUS1 cells and encrypt further rendezvous
  325. * traffic. Return 0 and place the final key material in
  326. * <b>hs_ntor_rend_cell_keys_out</b> if everything went well, else return -1.
  327. *
  328. * The relevant calculations are as follows:
  329. *
  330. * rend_secret_hs_input = EXP(Y,x) | EXP(B,x) | AUTH_KEY | B | X | Y | PROTOID
  331. * NTOR_KEY_SEED = MAC(rend_secret_hs_input, t_hsenc)
  332. * verify = MAC(rend_secret_hs_input, t_hsverify)
  333. * auth_input = verify | AUTH_KEY | B | Y | X | PROTOID | "Server"
  334. * auth_input_mac = MAC(auth_input, t_hsmac)
  335. *
  336. * where:
  337. * <b>intro_auth_pubkey</b> is AUTH_KEY (found in HS descriptor),
  338. * <b>client_ephemeral_enc_keypair</b> is freshly generated keypair (x,X)
  339. * <b>intro_enc_pubkey</b> is B (also found in HS descriptor),
  340. * <b>service_ephemeral_rend_pubkey</b> is Y (SERVER_PK in RENDEZVOUS1 cell) */
  341. int
  342. hs_ntor_client_get_rendezvous1_keys(
  343. const ed25519_public_key_t *intro_auth_pubkey,
  344. const curve25519_keypair_t *client_ephemeral_enc_keypair,
  345. const curve25519_public_key_t *intro_enc_pubkey,
  346. const curve25519_public_key_t *service_ephemeral_rend_pubkey,
  347. hs_ntor_rend_cell_keys_t *hs_ntor_rend_cell_keys_out)
  348. {
  349. int bad = 0;
  350. uint8_t rend_secret_hs_input[REND_SECRET_HS_INPUT_LEN];
  351. uint8_t dh_result1[CURVE25519_OUTPUT_LEN];
  352. uint8_t dh_result2[CURVE25519_OUTPUT_LEN];
  353. tor_assert(intro_auth_pubkey);
  354. tor_assert(client_ephemeral_enc_keypair);
  355. tor_assert(intro_enc_pubkey);
  356. tor_assert(service_ephemeral_rend_pubkey);
  357. tor_assert(hs_ntor_rend_cell_keys_out);
  358. /* Compute EXP(Y, x) */
  359. curve25519_handshake(dh_result1,
  360. &client_ephemeral_enc_keypair->seckey,
  361. service_ephemeral_rend_pubkey);
  362. bad |= safe_mem_is_zero(dh_result1, CURVE25519_OUTPUT_LEN);
  363. /* Compute EXP(B, x) */
  364. curve25519_handshake(dh_result2,
  365. &client_ephemeral_enc_keypair->seckey,
  366. intro_enc_pubkey);
  367. bad |= safe_mem_is_zero(dh_result2, CURVE25519_OUTPUT_LEN);
  368. /* Get rend_secret_hs_input */
  369. get_rend_secret_hs_input(dh_result1, dh_result2,
  370. intro_auth_pubkey, intro_enc_pubkey,
  371. &client_ephemeral_enc_keypair->pubkey,
  372. service_ephemeral_rend_pubkey,
  373. rend_secret_hs_input);
  374. /* Get NTOR_KEY_SEED and the auth_input MAC */
  375. bad |= get_rendezvous1_key_material(rend_secret_hs_input,
  376. intro_auth_pubkey,
  377. intro_enc_pubkey,
  378. service_ephemeral_rend_pubkey,
  379. &client_ephemeral_enc_keypair->pubkey,
  380. hs_ntor_rend_cell_keys_out);
  381. memwipe(rend_secret_hs_input, 0, sizeof(rend_secret_hs_input));
  382. if (bad) {
  383. memwipe(hs_ntor_rend_cell_keys_out, 0, sizeof(hs_ntor_rend_cell_keys_t));
  384. }
  385. return bad ? -1 : 0;
  386. }
  387. /* Public function: Do the appropriate ntor calculations and derive the keys
  388. * needed to decrypt and verify INTRODUCE1 cells. Return 0 and place the final
  389. * key material in <b>hs_ntor_intro_cell_keys_out</b> if everything went well,
  390. * otherwise return -1;
  391. *
  392. * The relevant calculations are as follows:
  393. *
  394. * intro_secret_hs_input = EXP(X,b) | AUTH_KEY | X | B | PROTOID
  395. * info = m_hsexpand | subcredential
  396. * hs_keys = KDF(intro_secret_hs_input | t_hsenc | info, S_KEY_LEN+MAC_LEN)
  397. * HS_DEC_KEY = hs_keys[0:S_KEY_LEN]
  398. * HS_MAC_KEY = hs_keys[S_KEY_LEN:S_KEY_LEN+MAC_KEY_LEN]
  399. *
  400. * where:
  401. * <b>intro_auth_pubkey</b> is AUTH_KEY (introduction point auth key),
  402. * <b>intro_enc_keypair</b> is (b,B) (introduction point encryption keypair),
  403. * <b>client_ephemeral_enc_pubkey</b> is X (CLIENT_PK in INTRODUCE2 cell),
  404. * <b>subcredential</b> is the HS subcredential (of size DIGEST256_LEN) */
  405. int
  406. hs_ntor_service_get_introduce1_keys(
  407. const ed25519_public_key_t *intro_auth_pubkey,
  408. const curve25519_keypair_t *intro_enc_keypair,
  409. const curve25519_public_key_t *client_ephemeral_enc_pubkey,
  410. const uint8_t *subcredential,
  411. hs_ntor_intro_cell_keys_t *hs_ntor_intro_cell_keys_out)
  412. {
  413. int bad = 0;
  414. uint8_t secret_input[INTRO_SECRET_HS_INPUT_LEN];
  415. uint8_t dh_result[CURVE25519_OUTPUT_LEN];
  416. tor_assert(intro_auth_pubkey);
  417. tor_assert(intro_enc_keypair);
  418. tor_assert(client_ephemeral_enc_pubkey);
  419. tor_assert(subcredential);
  420. tor_assert(hs_ntor_intro_cell_keys_out);
  421. /* Compute EXP(X, b) */
  422. curve25519_handshake(dh_result,
  423. &intro_enc_keypair->seckey,
  424. client_ephemeral_enc_pubkey);
  425. bad |= safe_mem_is_zero(dh_result, CURVE25519_OUTPUT_LEN);
  426. /* Get intro_secret_hs_input */
  427. get_intro_secret_hs_input(dh_result, intro_auth_pubkey,
  428. client_ephemeral_enc_pubkey,
  429. &intro_enc_keypair->pubkey,
  430. secret_input);
  431. bad |= safe_mem_is_zero(secret_input, CURVE25519_OUTPUT_LEN);
  432. /* Get ENC_KEY and MAC_KEY! */
  433. get_introduce1_key_material(secret_input, subcredential,
  434. hs_ntor_intro_cell_keys_out);
  435. memwipe(secret_input, 0, sizeof(secret_input));
  436. if (bad) {
  437. memwipe(hs_ntor_intro_cell_keys_out, 0, sizeof(hs_ntor_intro_cell_keys_t));
  438. }
  439. return bad ? -1 : 0;
  440. }
  441. /* Public function: Do the appropriate ntor calculations and derive the keys
  442. * needed to create and authenticate RENDEZVOUS1 cells. Return 0 and place the
  443. * final key material in <b>hs_ntor_rend_cell_keys_out</b> if all went fine,
  444. * return -1 if error happened.
  445. *
  446. * The relevant calculations are as follows:
  447. *
  448. * rend_secret_hs_input = EXP(X,y) | EXP(X,b) | AUTH_KEY | B | X | Y | PROTOID
  449. * NTOR_KEY_SEED = MAC(rend_secret_hs_input, t_hsenc)
  450. * verify = MAC(rend_secret_hs_input, t_hsverify)
  451. * auth_input = verify | AUTH_KEY | B | Y | X | PROTOID | "Server"
  452. * auth_input_mac = MAC(auth_input, t_hsmac)
  453. *
  454. * where:
  455. * <b>intro_auth_pubkey</b> is AUTH_KEY (intro point auth key),
  456. * <b>intro_enc_keypair</b> is (b,B) (intro point enc keypair)
  457. * <b>service_ephemeral_rend_keypair</b> is a fresh (y,Y) keypair
  458. * <b>client_ephemeral_enc_pubkey</b> is X (CLIENT_PK in INTRODUCE2 cell) */
  459. int
  460. hs_ntor_service_get_rendezvous1_keys(
  461. const ed25519_public_key_t *intro_auth_pubkey,
  462. const curve25519_keypair_t *intro_enc_keypair,
  463. const curve25519_keypair_t *service_ephemeral_rend_keypair,
  464. const curve25519_public_key_t *client_ephemeral_enc_pubkey,
  465. hs_ntor_rend_cell_keys_t *hs_ntor_rend_cell_keys_out)
  466. {
  467. int bad = 0;
  468. uint8_t rend_secret_hs_input[REND_SECRET_HS_INPUT_LEN];
  469. uint8_t dh_result1[CURVE25519_OUTPUT_LEN];
  470. uint8_t dh_result2[CURVE25519_OUTPUT_LEN];
  471. tor_assert(intro_auth_pubkey);
  472. tor_assert(intro_enc_keypair);
  473. tor_assert(service_ephemeral_rend_keypair);
  474. tor_assert(client_ephemeral_enc_pubkey);
  475. tor_assert(hs_ntor_rend_cell_keys_out);
  476. /* Compute EXP(X, y) */
  477. curve25519_handshake(dh_result1,
  478. &service_ephemeral_rend_keypair->seckey,
  479. client_ephemeral_enc_pubkey);
  480. bad |= safe_mem_is_zero(dh_result1, CURVE25519_OUTPUT_LEN);
  481. /* Compute EXP(X, b) */
  482. curve25519_handshake(dh_result2,
  483. &intro_enc_keypair->seckey,
  484. client_ephemeral_enc_pubkey);
  485. bad |= safe_mem_is_zero(dh_result2, CURVE25519_OUTPUT_LEN);
  486. /* Get rend_secret_hs_input */
  487. get_rend_secret_hs_input(dh_result1, dh_result2,
  488. intro_auth_pubkey,
  489. &intro_enc_keypair->pubkey,
  490. client_ephemeral_enc_pubkey,
  491. &service_ephemeral_rend_keypair->pubkey,
  492. rend_secret_hs_input);
  493. /* Get NTOR_KEY_SEED and AUTH_INPUT_MAC! */
  494. bad |= get_rendezvous1_key_material(rend_secret_hs_input,
  495. intro_auth_pubkey,
  496. &intro_enc_keypair->pubkey,
  497. &service_ephemeral_rend_keypair->pubkey,
  498. client_ephemeral_enc_pubkey,
  499. hs_ntor_rend_cell_keys_out);
  500. memwipe(rend_secret_hs_input, 0, sizeof(rend_secret_hs_input));
  501. if (bad) {
  502. memwipe(hs_ntor_rend_cell_keys_out, 0, sizeof(hs_ntor_rend_cell_keys_t));
  503. }
  504. return bad ? -1 : 0;
  505. }
  506. /** Given a received RENDEZVOUS2 MAC in <b>mac</b> (of length DIGEST256_LEN),
  507. * and the RENDEZVOUS1 key material in <b>hs_ntor_rend_cell_keys</b>, return 1
  508. * if the MAC is good, otherwise return 0. */
  509. int
  510. hs_ntor_client_rendezvous2_mac_is_good(
  511. const hs_ntor_rend_cell_keys_t *hs_ntor_rend_cell_keys,
  512. const uint8_t *rcvd_mac)
  513. {
  514. tor_assert(rcvd_mac);
  515. tor_assert(hs_ntor_rend_cell_keys);
  516. return tor_memeq(hs_ntor_rend_cell_keys->rend_cell_auth_mac,
  517. rcvd_mac, DIGEST256_LEN);
  518. }
  519. /* Input length to KDF for key expansion */
  520. #define NTOR_KEY_EXPANSION_KDF_INPUT_LEN (DIGEST256_LEN + M_HSEXPAND_LEN)
  521. /** Given the rendezvous key seed in <b>ntor_key_seed</b> (of size
  522. * DIGEST256_LEN), do the circuit key expansion as specified by section
  523. * '4.2.1. Key expansion' and place the keys in <b>keys_out</b> (which must be
  524. * of size HS_NTOR_KEY_EXPANSION_KDF_OUT_LEN).
  525. *
  526. * Return 0 if things went well, else return -1. */
  527. int
  528. hs_ntor_circuit_key_expansion(const uint8_t *ntor_key_seed, size_t seed_len,
  529. uint8_t *keys_out, size_t keys_out_len)
  530. {
  531. uint8_t *ptr;
  532. uint8_t kdf_input[NTOR_KEY_EXPANSION_KDF_INPUT_LEN];
  533. crypto_xof_t *xof;
  534. /* Sanity checks on lengths to make sure we are good */
  535. if (BUG(seed_len != DIGEST256_LEN)) {
  536. return -1;
  537. }
  538. if (BUG(keys_out_len != HS_NTOR_KEY_EXPANSION_KDF_OUT_LEN)) {
  539. return -1;
  540. }
  541. /* Let's build the input to the KDF */
  542. ptr = kdf_input;
  543. APPEND(ptr, ntor_key_seed, DIGEST256_LEN);
  544. APPEND(ptr, M_HSEXPAND, strlen(M_HSEXPAND));
  545. tor_assert(ptr == kdf_input + sizeof(kdf_input));
  546. /* Generate the keys */
  547. xof = crypto_xof_new();
  548. crypto_xof_add_bytes(xof, kdf_input, sizeof(kdf_input));
  549. crypto_xof_squeeze_bytes(xof, keys_out, HS_NTOR_KEY_EXPANSION_KDF_OUT_LEN);
  550. crypto_xof_free(xof);
  551. return 0;
  552. }