Botan::TLS::Connection_Cipher_State Class Reference

#include <tls_record.h>

Public Member Functions
AEAD_Mode *	aead ()
std::vector< uint8_t >	aead_nonce (uint64_t seq, RandomNumberGenerator &rng)
std::vector< uint8_t >	aead_nonce (const uint8_t record[], size_t record_len, uint64_t seq)
std::chrono::seconds	age () const
bool	cbc_nonce () const
	Connection_Cipher_State (Protocol_Version version, Connection_Side which_side, bool is_our_side, const Ciphersuite &suite, const Session_Keys &keys, bool uses_encrypt_then_mac)
std::vector< uint8_t >	format_ad (uint64_t seq, uint8_t type, Protocol_Version version, uint16_t ptext_length)
size_t	nonce_bytes_from_handshake () const
size_t	nonce_bytes_from_record () const

Detailed Description

TLS Cipher State

Definition at line 32 of file tls_record.h.

Constructor & Destructor Documentation

Botan::TLS::Connection_Cipher_State::Connection_Cipher_State	(	Protocol_Version	version,
		Connection_Side	which_side,
		bool	is_our_side,
		const Ciphersuite &	suite,
		const Session_Keys &	keys,
		bool	uses_encrypt_then_mac
	)

Initialize a new cipher state

Definition at line 28 of file tls_record.cpp.

References Botan::OctetString::bits_of(), BOTAN_ASSERT, BOTAN_ASSERT_EQUAL, Botan::TLS::Ciphersuite::cipher_algo(), Botan::TLS::Ciphersuite::cipher_keylen(), Botan::TLS::CLIENT, Botan::TLS::Session_Keys::client_cipher_key(), Botan::TLS::Session_Keys::client_iv(), Botan::TLS::Session_Keys::client_mac_key(), Botan::DECRYPTION, Botan::ENCRYPTION, Botan::get_aead(), Botan::OctetString::length(), Botan::TLS::Ciphersuite::mac_algo(), Botan::TLS::Ciphersuite::mac_keylen(), nonce_bytes_from_handshake(), nonce_bytes_from_record(), Botan::TLS::Session_Keys::server_cipher_key(), Botan::TLS::Session_Keys::server_iv(), Botan::TLS::Session_Keys::server_mac_key(), Botan::TLS::Protocol_Version::supports_explicit_cbc_ivs(), and Botan::unlock().

                                                                             :
   m_start_time(std::chrono::system_clock::now()),
   m_nonce_bytes_from_handshake(suite.nonce_bytes_from_handshake()),
   m_nonce_bytes_from_record(suite.nonce_bytes_from_record())
   {
   SymmetricKey mac_key, cipher_key;
   InitializationVector iv;

   if(side == CLIENT)
      {
      cipher_key = keys.client_cipher_key();
      iv = keys.client_iv();
      mac_key = keys.client_mac_key();
      }
   else
      {
      cipher_key = keys.server_cipher_key();
      iv = keys.server_iv();
      mac_key = keys.server_mac_key();
      }

   BOTAN_ASSERT_EQUAL(iv.length(), nonce_bytes_from_handshake(), "Matching nonce sizes");

   m_nonce = unlock(iv.bits_of());

   if(suite.mac_algo() == "AEAD")
      {
      m_aead.reset(get_aead(suite.cipher_algo(), our_side ? ENCRYPTION : DECRYPTION));
      BOTAN_ASSERT(m_aead, "Have AEAD");

      m_aead->set_key(cipher_key + mac_key);

      BOTAN_ASSERT(nonce_bytes_from_record() == 0 || nonce_bytes_from_record() == 8,
                   "Ciphersuite uses implemented IV length");

      m_cbc_nonce = false;
      if(m_nonce.size() != 12)
         {
         m_nonce.resize(m_nonce.size() + 8);
         }
      }
   else
      {
#if defined(BOTAN_HAS_TLS_CBC)
      // legacy CBC+HMAC mode
      if(our_side)
         {
         m_aead.reset(new TLS_CBC_HMAC_AEAD_Encryption(
                         suite.cipher_algo(),
                         suite.cipher_keylen(),
                         suite.mac_algo(),
                         suite.mac_keylen(),
                         version.supports_explicit_cbc_ivs(),
                         uses_encrypt_then_mac));
         }
      else
         {
         m_aead.reset(new TLS_CBC_HMAC_AEAD_Decryption(
                         suite.cipher_algo(),
                         suite.cipher_keylen(),
                         suite.mac_algo(),
                         suite.mac_keylen(),
                         version.supports_explicit_cbc_ivs(),
                         uses_encrypt_then_mac));
         }

      m_aead->set_key(cipher_key + mac_key);

      m_cbc_nonce = true;
      if(version.supports_explicit_cbc_ivs())
         m_nonce_bytes_from_record = m_nonce_bytes_from_handshake;
      else if(our_side == false)
         m_aead->start(iv.bits_of());
#else
      throw Exception("Negotiated disabled TLS CBC+HMAC ciphersuite");
#endif
      }
   }

Member Function Documentation

AEAD_Mode* Botan::TLS::Connection_Cipher_State::aead ( )

inline

Definition at line 45 of file tls_record.h.

Referenced by Botan::TLS::write_record().

{ return m_aead.get(); }

std::vector< uint8_t > Botan::TLS::Connection_Cipher_State::aead_nonce	(	uint64_t	seq,
		RandomNumberGenerator &	rng
	)

Definition at line 112 of file tls_record.cpp.

References nonce_bytes_from_handshake(), nonce_bytes_from_record(), Botan::RandomNumberGenerator::randomize(), Botan::store_be(), and Botan::xor_buf().

Referenced by Botan::TLS::write_record().

   {
   if(m_cbc_nonce)
      {
      if(m_nonce.size())
         {
         std::vector<uint8_t> nonce;
         nonce.swap(m_nonce);
         return nonce;
         }
      std::vector<uint8_t> nonce(nonce_bytes_from_record());
      rng.randomize(nonce.data(), nonce.size());
      return nonce;
      }
   else if(nonce_bytes_from_handshake() == 12)
      {
      std::vector<uint8_t> nonce(12);
      store_be(seq, nonce.data() + 4);
      xor_buf(nonce, m_nonce.data(), m_nonce.size());
      return nonce;
      }
   else
      {
      std::vector<uint8_t> nonce = m_nonce;
      store_be(seq, &nonce[nonce_bytes_from_handshake()]);
      return nonce;
      }
   }

std::vector< uint8_t > Botan::TLS::Connection_Cipher_State::aead_nonce	(	const uint8_t	record[],
		size_t	record_len,
		uint64_t	seq
	)

Definition at line 142 of file tls_record.cpp.

References Botan::copy_mem(), nonce_bytes_from_handshake(), nonce_bytes_from_record(), Botan::store_be(), and Botan::xor_buf().

   {
   if(m_cbc_nonce)
      {
      if(record_len < nonce_bytes_from_record())
         throw Decoding_Error("Invalid CBC packet too short to be valid");
      std::vector<uint8_t> nonce(record, record + nonce_bytes_from_record());
      return nonce;
      }
   else if(nonce_bytes_from_handshake() == 12)
      {
      /*
      Assumes if the suite specifies 12 bytes come from the handshake then
      use the XOR nonce construction from draft-ietf-tls-chacha20-poly1305
      */

      std::vector<uint8_t> nonce(12);
      store_be(seq, nonce.data() + 4);
      xor_buf(nonce, m_nonce.data(), m_nonce.size());
      return nonce;
      }
   else if(nonce_bytes_from_record() > 0)
      {
      if(record_len < nonce_bytes_from_record())
         throw Decoding_Error("Invalid AEAD packet too short to be valid");
      std::vector<uint8_t> nonce = m_nonce;
      copy_mem(&nonce[nonce_bytes_from_handshake()], record, nonce_bytes_from_record());
      return nonce;
      }
   else
      {
      /*
      nonce_len == 0 is assumed to mean no nonce in the message but
      instead the AEAD uses the seq number in network order.
      */
      std::vector<uint8_t> nonce = m_nonce;
      store_be(seq, &nonce[nonce_bytes_from_handshake()]);
      return nonce;
      }
   }

std::chrono::seconds Botan::TLS::Connection_Cipher_State::age ( ) const

inline

Definition at line 59 of file tls_record.h.

         {
         return std::chrono::duration_cast<std::chrono::seconds>(
            std::chrono::system_clock::now() - m_start_time);
         }

bool Botan::TLS::Connection_Cipher_State::cbc_nonce ( ) const

inline

Definition at line 57 of file tls_record.h.

Referenced by Botan::TLS::write_record().

{ return m_cbc_nonce; }

std::vector< uint8_t > Botan::TLS::Connection_Cipher_State::format_ad	(	uint64_t	seq,
		uint8_t	type,
		Protocol_Version	version,
		uint16_t	ptext_length
	)

Definition at line 184 of file tls_record.cpp.

References Botan::get_byte(), Botan::TLS::Protocol_Version::major_version(), Botan::TLS::Protocol_Version::minor_version(), and Botan::store_be().

Referenced by Botan::TLS::write_record().

   {
   std::vector<uint8_t> ad(13);

   store_be(msg_sequence, &ad[0]);
   ad[8] = msg_type;
   ad[9] = version.major_version();
   ad[10] = version.minor_version();
   ad[11] = get_byte(0, msg_length);
   ad[12] = get_byte(1, msg_length);

   return ad;
   }

size_t Botan::TLS::Connection_Cipher_State::nonce_bytes_from_handshake ( ) const

inline

Definition at line 55 of file tls_record.h.

Referenced by aead_nonce(), Connection_Cipher_State(), and Botan::TLS::write_record().

{ return m_nonce_bytes_from_handshake; }

size_t Botan::TLS::Connection_Cipher_State::nonce_bytes_from_record ( ) const

inline

Definition at line 56 of file tls_record.h.

Referenced by aead_nonce(), Connection_Cipher_State(), and Botan::TLS::write_record().

{ return m_nonce_bytes_from_record; }

---

The documentation for this class was generated from the following files:

• src/lib/tls/tls_record.h
• src/lib/tls/tls_record.cpp