* [Openvpn-devel] [L] Change in openvpn[master]: Implement methods to generate and manage OpenVPN Epoch keys
[not found] <gerrit.1731290343000.Id7d6a576ca8c9560cb2dfae82fc62175820e9b80@...2715...>
@ 2024-11-11 2:00 ` plaisthos (Code Review)
2024-11-15 15:12 ` plaisthos (Code Review)
` (11 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: plaisthos (Code Review) @ 2024-11-11 2:00 UTC (permalink / raw)
To: flichtenheld <frank@; +Cc: openvpn-devel
[-- Attachment #1: Type: text/plain, Size: 38782 bytes --]
Attention is currently required from: flichtenheld.
Hello flichtenheld,
I'd like you to do a code review.
Please visit
http://gerrit.openvpn.net/c/openvpn/+/804?usp=email
to review the following change.
Change subject: Implement methods to generate and manage OpenVPN Epoch keys
......................................................................
Implement methods to generate and manage OpenVPN Epoch keys
This implements functions that allow these keys to be generated and
managed. It does not yet implement using them for the data channel.
Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Signed-off-by: Arne Schwabe <arne@...1227...>
---
M src/openvpn/crypto.c
M src/openvpn/crypto.h
M src/openvpn/crypto_epoch.c
M src/openvpn/crypto_epoch.h
M src/openvpn/packet_id.c
M src/openvpn/packet_id.h
M src/openvpn/ssl_common.h
M tests/unit_tests/openvpn/test_crypto.c
8 files changed, 776 insertions(+), 22 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/04/804/1
diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
index f4453d8..dc23ffc 100644
--- a/src/openvpn/crypto.c
+++ b/src/openvpn/crypto.c
@@ -909,14 +909,27 @@
if (cipher_ctx_mode_aead(ctx->cipher))
{
size_t impl_iv_len = 0;
+ size_t impl_iv_offset = 0;
ASSERT(cipher_ctx_iv_length(ctx->cipher) >= OPENVPN_AEAD_MIN_IV_LEN);
- impl_iv_len = cipher_ctx_iv_length(ctx->cipher) - sizeof(packet_id_type);
+
+ /* Epoch keys use XOR of full IV length with the packet id to generate
+ * IVs. Old data format uses concatenation instead (XOR with 0 for the
+ * first 4 bytes (sizeof(packet_id_type) */
+ if (key->epoch)
+ {
+ impl_iv_len = cipher_ctx_iv_length(ctx->cipher);
+ impl_iv_offset = 0;
+ }
+ else
+ {
+ impl_iv_len = cipher_ctx_iv_length(ctx->cipher) - sizeof(packet_id_type);
+ impl_iv_offset = sizeof(packet_id_type);
+ }
ASSERT(impl_iv_len <= OPENVPN_MAX_IV_LENGTH);
ASSERT(impl_iv_len <= MAX_HMAC_KEY_LENGTH);
ASSERT(key->hmac_size >= impl_iv_len);
CLEAR(ctx->implicit_iv);
- /* The first bytes of the IV are filled with the packet id */
- memcpy(ctx->implicit_iv + sizeof(packet_id_type), key->hmac, impl_iv_len);
+ memcpy(ctx->implicit_iv + impl_iv_offset, key->hmac, impl_iv_len);
}
}
@@ -965,6 +978,7 @@
hmac_ctx_size(ctx->hmac));
}
+ ctx->epoch = key->epoch;
gc_free(&gc);
}
@@ -977,6 +991,7 @@
snprintf(log_prefix, sizeof(log_prefix), "Outgoing %s", name);
init_key_ctx(ctx, key_params, kt, OPENVPN_OP_ENCRYPT, log_prefix);
key_ctx_update_implicit_iv(ctx, key_params);
+ ctx->epoch = key_params->epoch;
}
void
@@ -988,6 +1003,7 @@
snprintf(log_prefix, sizeof(log_prefix), "Incoming %s", name);
init_key_ctx(ctx, key_params, kt, OPENVPN_OP_DECRYPT, log_prefix);
key_ctx_update_implicit_iv(ctx, key_params);
+ ctx->epoch = key_params->epoch;
}
void
@@ -1025,6 +1041,7 @@
}
CLEAR(ctx->implicit_iv);
ctx->plaintext_blocks = 0;
+ ctx->epoch = 0;
}
void
diff --git a/src/openvpn/crypto.h b/src/openvpn/crypto.h
index ff24f87..abba30c 100644
--- a/src/openvpn/crypto.h
+++ b/src/openvpn/crypto.h
@@ -170,6 +170,9 @@
/** Number of bytes set in the HMac key material */
int hmac_size;
+
+ /** the epoch of the key is if it was generated as epoch data key material */
+ uint16_t epoch;
};
/**
@@ -180,6 +183,11 @@
void
key_parameters_from_key(struct key_parameters *key_params, const struct key *key);
+struct epoch_key {
+ uint8_t epoch_key[SHA256_DIGEST_LENGTH];
+ uint16_t epoch;
+};
+
/**
* Container for one set of cipher and/or HMAC contexts.
* @ingroup control_processor
@@ -199,6 +207,10 @@
/** Counter for the number of plaintext encrypted using this cipher
* in number of 128 bit blocks (only used for AEAD ciphers) */
uint64_t plaintext_blocks;
+ /** OpenVPN data channel epoch, this variable holds the
+ * epoch number that is key belongs to. Note that epoch 0 is not used
+ * and epoch is always non-zero for epoch key contexts */
+ uint16_t epoch;
};
#define KEY_DIRECTION_BIDIRECTIONAL 0 /* same keys for both directions */
@@ -268,6 +280,39 @@
/**< OpenSSL cipher and HMAC contexts for
* both sending and receiving
* directions. */
+
+ /** last epoch_key used for generation of the current send data keys.
+ * As invariant, the epoch of epoch_key_send is always kept >= the epoch of
+ * epoch_key_recv */
+ struct epoch_key epoch_key_send;
+
+ /** epoch_key used for the highest receive epoch keys */
+ struct epoch_key epoch_key_recv;
+
+ /** the key_type that is used to generate the epoch keys */
+ struct key_type epoch_key_type;
+
+ /** This limit for AEAD cipher, this is the sum of packets + blocks
+ * that are allowed to be used. Will switch to a new epoch if this
+ * limit is reached*/
+ uint64_t aead_usage_limit;
+
+ /** Keeps the future epoch data keys for decryption. The current one
+ * that is expected to be used is stored in key_ctx_bi.
+ *
+ * We keep both decrypt and encrypt key here in the future keys
+ * as we want to be able to switch also sending key if the peer
+ * switching to a newer key epoch
+ * */
+ struct key_ctx *epoch_data_keys_future;
+
+ /** number of keys stored in \c epoch_data_keys_future */
+ uint16_t epoch_data_keys_future_count;
+
+ /** The old key bevor the sender switch to a new epoch data key */
+ struct key_ctx epoch_retiring_data_receive_key;
+ struct packet_id_rec epoch_retiring_key_pid_recv;
+
struct packet_id packet_id; /**< Current packet ID state for both
* sending and receiving directions.
*
@@ -276,7 +321,7 @@
*
* The packet id also used as the IV
* for AEAD/OFB/CFG ciphers.
- * */
+ */
struct packet_id_persist *pid_persist;
/**< Persistent packet ID state for
* keeping state between successive
@@ -464,13 +509,15 @@
*
* @param opt Crypto options for this packet, contains replay state.
* @param pin Packet ID read from packet.
+ * @param epoch Epoch read from packet or 0 when epoch is not used.
* @param error_prefix Prefix to use when printing error messages.
* @param gc Garbage collector to use.
*
* @return true if packet ID is validated to be not a replay, false otherwise.
*/
bool crypto_check_replay(struct crypto_options *opt,
- const struct packet_id_net *pin, const char *error_prefix,
+ const struct packet_id_net *pin,
+ const char *error_prefix,
struct gc_arena *gc);
diff --git a/src/openvpn/crypto_epoch.c b/src/openvpn/crypto_epoch.c
index 7a5b460..1f89804 100644
--- a/src/openvpn/crypto_epoch.c
+++ b/src/openvpn/crypto_epoch.c
@@ -21,7 +21,7 @@
* You should have received a copy of the GNU General Public License along
* with this program; if not, write to the Free Software Foundation, Inc.,
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
+ */
#ifdef HAVE_CONFIG_H
@@ -29,7 +29,13 @@
#endif
#include <inttypes.h>
+#include <string.h>
+#include <stdlib.h>
+
#include "crypto_backend.h"
+#include "packet_id.h"
+#include "crypto.h"
+#include "crypto_epoch.h"
#include "buffer.h"
#include "integer.h"
@@ -103,4 +109,333 @@
gc_free(&gc);
return true;
-}
\ No newline at end of file
+}
+
+/**
+ * Iterates the epoch key to make it E_n+1, ie increase the epoch by one
+ * and derive the new key material accordingly
+ * @param epoch_key epoch key to iterate
+ */
+static void
+epoch_key_iterate(struct epoch_key *epoch_key)
+{
+ struct epoch_key new_epoch_key = { 0 };
+ new_epoch_key.epoch = epoch_key->epoch + 1;
+ const uint8_t epoch_update_label[] = "datakey upd";
+
+ /* E_N+1 = OVPN-Expand-Label(E_N, "datakey upd", "", 32) */
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_update_label, 11,
+ NULL, 0,
+ new_epoch_key.epoch_key, sizeof(new_epoch_key.epoch_key));
+ *epoch_key = new_epoch_key;
+}
+
+void
+epoch_data_key_derive(struct key_parameters *key,
+ const struct epoch_key *epoch_key,
+ const struct key_type *kt)
+{
+ key->hmac_size = cipher_kt_iv_size(kt->cipher);
+ key->cipher_size = cipher_kt_key_size(kt->cipher);
+
+ /* Generate data key from epoch key:
+ * K_i = OVPN-Expand-Label(E_i, "data_key", "", key_size)
+ * implicit_iv = OVPN-Expand-Label(E_i, "data_iv", "", implicit_iv_len)
+ */
+
+ const uint8_t epoch_data_key_label[] = "data_key";
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_data_key_label, 8,
+ NULL, 0,
+ (uint8_t *)(&key->cipher), key->cipher_size);
+
+ const uint8_t epoch_data_iv_label[] = "data_iv";
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_data_iv_label, 7,
+ NULL, 0,
+ (uint8_t *)(&key->hmac), key->hmac_size);
+ key->epoch = epoch_key->epoch;
+}
+
+static void
+epoch_init_send_key_ctx(struct crypto_options *co)
+{
+ /* Ensure that we are NEVER regenerating the same key that has already
+ * been generated. Since we also reset the packet ID counter this would be
+ * catastrophic as we would do IV reuse which breaks ciphers like AES-GCM */
+ ASSERT(co->key_ctx_bi.encrypt.epoch != co->epoch_key_send.epoch);
+ char name[32] = { 0 };
+ snprintf(name, sizeof(name), "Epoch Data key %" PRIu16, co->epoch_key_send.epoch);
+
+ struct key_parameters send_key = { 0 };
+
+ epoch_data_key_derive(&send_key, &co->epoch_key_send, &co->epoch_key_type);
+
+ init_key_bi_ctx_send(&co->key_ctx_bi.encrypt, &send_key,
+ &co->epoch_key_type, name);
+ reset_packet_id_send(&co->packet_id.send);
+ CLEAR(send_key);
+}
+
+
+static void
+epoch_init_recv_key(struct key_ctx *ctx, struct crypto_options *co)
+{
+ struct key_parameters recv_key = { 0 };
+ epoch_data_key_derive(&recv_key, &co->epoch_key_recv, &co->epoch_key_type);
+
+ char name[32];
+
+ snprintf(name, sizeof(name), "Epoch Data key %" PRIu16, co->epoch_key_recv.epoch);
+
+ init_key_bi_ctx_recv(ctx, &recv_key, &co->epoch_key_type, name);
+ CLEAR(recv_key);
+}
+
+void
+epoch_generate_future_receive_keys(struct crypto_options *co)
+{
+ /* We want the number of receive keys starting with the currently used
+ * keys. */
+ ASSERT(co->key_ctx_bi.initialized);
+ uint16_t current_epoch_recv = co->key_ctx_bi.decrypt.epoch;
+
+ /* Either we have not generated any future keys yet or the last
+ * index is the same as our current epoch key */
+ struct key_ctx *highest_future_key = &co->epoch_data_keys_future[co->epoch_data_keys_future_count - 1];
+
+ ASSERT(co->epoch_key_recv.epoch == 1
+ || highest_future_key->epoch == co->epoch_key_recv.epoch);
+
+ /* free the keys that are not used anymore */
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ /* Keys in future keys are always epoch > 1 if initialised */
+ if (co->epoch_data_keys_future[i].epoch > 0
+ && co->epoch_data_keys_future[i].epoch < current_epoch_recv)
+ {
+ /* Key is old, free it */
+ free_key_ctx(&co->epoch_data_keys_future[i]);
+ }
+ }
+
+ /* Calculate the number of keys that need to be generated,
+ * if no keys have been generated assume only the first key is defined */
+ uint16_t current_highest_key = highest_future_key->epoch ? highest_future_key->epoch : 1;
+ uint16_t desired_highest_key = current_epoch_recv + co->epoch_data_keys_future_count;
+ uint16_t num_keys_generate = desired_highest_key - current_highest_key;
+
+
+ /* Move the old keys out of the way so the order of keys stays strictly
+ * monotonic and consecutive. */
+ /* first check that the destination we are going to overwrite is freed */
+ for (uint16_t i = 0; i < num_keys_generate; i++)
+ {
+ ASSERT(co->epoch_data_keys_future[i].epoch == 0);
+ }
+ memmove(co->epoch_data_keys_future,
+ co->epoch_data_keys_future + num_keys_generate,
+ (co->epoch_data_keys_future_count - num_keys_generate) * sizeof(struct key_ctx));
+
+ /* Clear and regenerate the array elements at the end */
+ for (uint16_t i = co->epoch_data_keys_future_count - num_keys_generate; i < co->epoch_data_keys_future_count; i++)
+ {
+ CLEAR(co->epoch_data_keys_future[i]);
+ epoch_key_iterate(&co->epoch_key_recv);
+
+ epoch_init_recv_key(&co->epoch_data_keys_future[i], co);
+ }
+
+ /* Assert that all keys are initialised */
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ ASSERT(co->epoch_data_keys_future[i].epoch > 0);
+ }
+}
+
+void
+epoch_iterate_send_key(struct crypto_options *co)
+{
+ ASSERT(co->epoch_key_send.epoch < UINT16_MAX);
+ epoch_key_iterate(&co->epoch_key_send);
+ free_key_ctx(&co->key_ctx_bi.encrypt);
+ epoch_init_send_key_ctx(co);
+}
+
+void
+epoch_replace_update_recv_key(struct crypto_options *co,
+ uint16_t new_epoch)
+{
+ /* Find the key of the new epoch in future keys */
+ uint16_t fki;
+ for (fki = 0; fki < co->epoch_data_keys_future_count; fki++)
+ {
+ if (co->epoch_data_keys_future[fki].epoch == new_epoch)
+ {
+ break;
+ }
+ }
+ /* we should only ever be called when we successfully decrypted/authenticated
+ * a packet from a peer, ie the epoch recv key *MUST* be in that
+ * array */
+ ASSERT(fki < co->epoch_data_keys_future_count);
+ ASSERT(co->epoch_data_keys_future[fki].epoch == new_epoch);
+
+ struct key_ctx *new_ctx = &co->epoch_data_keys_future[fki];
+
+ /* Check if the new recv key epoch is higher than the send key epoch. If
+ * yes we will replace the send key as well */
+ if (co->key_ctx_bi.encrypt.epoch < new_epoch)
+ {
+ free_key_ctx(&co->key_ctx_bi.encrypt);
+
+ /* Update the epoch_key for send to match the current key being used.
+ * This is a bit of extra work but since we are a maximum of 16
+ * keys behind, a maximum 16 HMAC invocations are a small price to
+ * pay for not keeping all the old epoch keys around in future_keys
+ * array */
+ while (co->epoch_key_send.epoch < new_epoch)
+ {
+ epoch_key_iterate(&co->epoch_key_send);
+ }
+ epoch_init_send_key_ctx(co);
+ }
+
+ /* Replace receive key */
+ free_key_ctx(&co->epoch_retiring_data_receive_key);
+ co->epoch_retiring_data_receive_key = co->key_ctx_bi.decrypt;
+ packet_id_move_recv(&co->epoch_retiring_key_pid_recv, &co->packet_id.rec);
+
+ co->key_ctx_bi.decrypt = *new_ctx;
+
+ /* Zero the old location instead to of free_key_ctx since we moved the keys
+ * and do not want to free the pointers in the old place */
+ memset(new_ctx, 0, sizeof(struct key_ctx));
+
+ /* Generate new future keys */
+ epoch_generate_future_receive_keys(co);
+}
+
+void
+free_epoch_key_ctx(struct crypto_options *co)
+{
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ free_key_ctx(&co->epoch_data_keys_future[i]);
+ }
+
+ free(co->epoch_data_keys_future);
+ free_key_ctx(&co->epoch_retiring_data_receive_key);
+ free(co->epoch_retiring_key_pid_recv.seq_list);
+ CLEAR(co->epoch_key_recv);
+ CLEAR(co->epoch_key_send);
+}
+
+void
+epoch_init_key_ctx(struct crypto_options *co, const struct key_type *key_type,
+ const struct epoch_key *e1_send,
+ const struct epoch_key *e1_recv,
+ uint16_t future_key_count)
+{
+ ASSERT(e1_send->epoch == 1 && e1_recv->epoch == 1);
+ co->epoch_key_recv = *e1_recv;
+ co->epoch_key_send = *e1_send;
+
+ co->epoch_key_type = *key_type;
+ co->aead_usage_limit = cipher_get_aead_limits(key_type->cipher);
+
+ epoch_init_send_key_ctx(co);
+ epoch_init_recv_key(&co->key_ctx_bi.decrypt, co);
+ co->key_ctx_bi.initialized = true;
+
+ co->epoch_data_keys_future_count = future_key_count;
+ ALLOC_ARRAY_CLEAR(co->epoch_data_keys_future, struct key_ctx, co->epoch_data_keys_future_count);
+ epoch_generate_future_receive_keys(co);
+}
+
+const struct key_ctx *
+epoch_lookup_decrypt_key(struct crypto_options *opt, uint16_t epoch)
+{
+ /* Current decrypt key is the most likely one */
+ if (opt->key_ctx_bi.decrypt.epoch == epoch)
+ {
+ return &opt->key_ctx_bi.decrypt;
+ }
+ else if (opt->epoch_retiring_data_receive_key.epoch
+ && opt->epoch_retiring_data_receive_key.epoch == epoch)
+ {
+ return &opt->epoch_retiring_data_receive_key;
+ }
+ else if (epoch > opt->key_ctx_bi.decrypt.epoch
+ && epoch <= opt->key_ctx_bi.decrypt.epoch + opt->epoch_data_keys_future_count)
+ {
+ /* Key in the range of future keys */
+ int index = epoch - (opt->key_ctx_bi.decrypt.epoch + 1);
+
+ /* If we have reached the edge of the valid keys we do not return
+ * the key anymore since regenerating the new keys would move us
+ * over the window of valid keys and would need all kind of
+ * special casing, so we stop returning the key in this case */
+ if (epoch > (UINT16_MAX - opt->epoch_data_keys_future_count - 1))
+ {
+ return NULL;
+ }
+ else
+ {
+ return &opt->epoch_data_keys_future[index];
+ }
+ }
+ else
+ {
+ return NULL;
+ }
+}
+
+
+void
+epoch_check_send_iterate(struct crypto_options *opt)
+{
+ if (opt->epoch_key_send.epoch == UINT16_MAX)
+ {
+ /* limit of epoch keys reached, cannot move to a newer key anymore */
+ return;
+ }
+ if (opt->aead_usage_limit)
+ {
+ if (aead_usage_limit_reached(opt->aead_usage_limit, &opt->key_ctx_bi.encrypt,
+ opt->packet_id.send.id))
+ {
+ /* Send key limit reached */
+ epoch_iterate_send_key(opt);
+ }
+ /* draft 8 of the aead usage limit still had but draft 9 complete
+ * dropped this statement:
+ *
+ * In particular, is two-party communication, one participant cannot
+ * regard apparent overuse of a key by other participants as
+ * being in error, when it could be that the other participant has
+ * better information about bounds.
+ *
+ * OpenVPN 2.x implements a compromise of not regarding this as an
+ * error but still accepting packets of the usage limit but tries to
+ * push the peer to a new epoch key by increasing our own key epoch
+ * */
+ else if (opt->key_ctx_bi.encrypt.epoch == opt->key_ctx_bi.decrypt.epoch
+ && aead_usage_limit_reached(opt->aead_usage_limit,
+ &opt->key_ctx_bi.decrypt,
+ opt->packet_id.rec.id))
+ {
+ /* Receive key limit reached. Increase our own send key to signal
+ * that we want to use a new epoch. Peer should then also move its
+ * key but is not required to do this */
+ epoch_iterate_send_key(opt);
+ }
+ }
+
+ if (opt->packet_id.send.id == PACKET_ID_EPOCH_MAX)
+ {
+ epoch_iterate_send_key(opt);
+ }
+
+}
diff --git a/src/openvpn/crypto_epoch.h b/src/openvpn/crypto_epoch.h
index dad2473..95d8e9e 100644
--- a/src/openvpn/crypto_epoch.h
+++ b/src/openvpn/crypto_epoch.h
@@ -66,4 +66,81 @@
const uint8_t *context, size_t context_len,
uint8_t *out, uint16_t out_len);
-#endif
+/**
+ * Generate a data channel key pair from the epoch key
+ * @param epoch_key Epoch key to be used
+ * @param key Destination for the generated data key
+ * @parm kt Cipher information to generate the data channel key for
+ */
+void
+epoch_data_key_derive(struct key_parameters *key,
+ const struct epoch_key *epoch_key,
+ const struct key_type *kt);
+
+/**
+ * Generates and fills the epoch_data_keys_future with next valid
+ * future keys in crypto_options
+ *
+ * This assume that the normal key_ctx_bi and epoch keys are already setup
+ */
+void
+epoch_generate_future_receive_keys(struct crypto_options *co);
+
+
+/** This is called when the peer using a new send key that is not the default
+ * key. This function ensures the following:
+ * - recv key matches the epoch index provided
+ * - send key epoch is equal or higher than recv_key epoch
+ *
+ * @param new_epoch the new epoch to use a the receive key
+ */
+void
+epoch_replace_update_recv_key(struct crypto_options *co,
+ uint16_t new_epoch);
+
+/**
+ * Updates the send key and send_epoch_keyt in cryptio_options->key_ctx_bi to
+ * use the next epoch */
+void
+epoch_iterate_send_key(struct crypto_options *co);
+
+/**
+ * Frees the extra data structures used by epoch keys in \c crypto_options
+ */
+void
+free_epoch_key_ctx(struct crypto_options *co);
+
+/**
+ * Initialises data channel keys and internal structures for epoch data keys
+ * using the provided E0 epoch key
+ *
+ * @param e1_send The E1 send epoch key derived by TLS-EKM
+ * @param e1_recv The E1 receive epoch key derived by TLS-EKM
+ */
+void
+epoch_init_key_ctx(struct crypto_options *co, const struct key_type *key_type,
+ const struct epoch_key *e1_send, const struct epoch_key *e1_recv,
+ uint16_t future_key_count);
+
+/**
+ * Using an epoch, this function will try to retrieve a decryption
+ * key context that matches that epoch from the \c opt argument
+ * @param opt crypto_options to use to find the decrypt key
+ * @param epoch epoch of the key to lookup
+ * @return the key context with
+ */
+const struct key_ctx *
+epoch_lookup_decrypt_key(struct crypto_options *opt, uint16_t epoch);
+
+/**
+ * Checks if we need to iterate the send epoch key. This needs to be in one
+ * of the following condition
+ * - max epoch counter reached
+ * - send key aead usage limit reached (for AES-GCM and similar ciphers)
+ * - recv key usage limit reached
+ */
+void
+epoch_check_send_iterate(struct crypto_options *opt);
+
+
+#endif /* ifndef CRYPTO_EPOCH_H */
diff --git a/src/openvpn/packet_id.c b/src/openvpn/packet_id.c
index 8cde108..177391a 100644
--- a/src/openvpn/packet_id.c
+++ b/src/openvpn/packet_id.c
@@ -78,6 +78,21 @@
}
void
+packet_id_init_recv(struct packet_id_rec *rec, int seq_backtrack, int time_backtrack, const char *name, int unit)
+{
+ rec->name = name;
+ rec->unit = unit;
+ if (seq_backtrack)
+ {
+ ASSERT(MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
+ ASSERT(MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
+ CIRC_LIST_ALLOC(rec->seq_list, struct seq_list, seq_backtrack);
+ rec->seq_backtrack = seq_backtrack;
+ rec->time_backtrack = time_backtrack;
+ }
+ rec->initialized = true;
+}
+void
packet_id_init(struct packet_id *p, int seq_backtrack, int time_backtrack, const char *name, int unit)
{
dmsg(D_PID_DEBUG, "PID packet_id_init seq_backtrack=%d time_backtrack=%d",
@@ -87,17 +102,25 @@
ASSERT(p);
CLEAR(*p);
- p->rec.name = name;
- p->rec.unit = unit;
- if (seq_backtrack)
- {
- ASSERT(MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
- ASSERT(MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
- CIRC_LIST_ALLOC(p->rec.seq_list, struct seq_list, seq_backtrack);
- p->rec.seq_backtrack = seq_backtrack;
- p->rec.time_backtrack = time_backtrack;
- }
- p->rec.initialized = true;
+ packet_id_init_recv(&p->rec, seq_backtrack, time_backtrack, name, unit);
+}
+
+void
+packet_id_move_recv(struct packet_id_rec *dest, struct packet_id_rec *src)
+{
+ ASSERT(src);
+ ASSERT(dest);
+ /* clear free any old data in rec list */
+ free(dest->seq_list);
+ CLEAR(*dest);
+
+ /* Copy data to dest */
+ *dest = *src;
+
+ /* Reinitalise the source */
+ CLEAR(*src);
+ packet_id_init_recv(src, dest->seq_backtrack, dest->time_backtrack,
+ dest->name, dest->unit);
}
void
diff --git a/src/openvpn/packet_id.h b/src/openvpn/packet_id.h
index 79224d2..7620ce5 100644
--- a/src/openvpn/packet_id.h
+++ b/src/openvpn/packet_id.h
@@ -203,6 +203,15 @@
void packet_id_free(struct packet_id *p);
+/**
+ * Move the packet id recv structure from src to dest. src will will
+ * be reinitialised with
+ * @param dest
+ * @param src
+ */
+void
+packet_id_move_recv(struct packet_id_rec *dest, struct packet_id_rec *src);
+
/* should we accept an incoming packet id ? */
bool packet_id_test(struct packet_id_rec *p,
const struct packet_id_net *pin);
diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h
index ce1cd9e..511127d 100644
--- a/src/openvpn/ssl_common.h
+++ b/src/openvpn/ssl_common.h
@@ -333,8 +333,8 @@
interval_t packet_timeout;
int64_t renegotiate_bytes;
int64_t renegotiate_packets;
- /** This limit for AEAD cipher, this is the sum of packets + blocks
- * that are allowed to be used */
+ /** This limit for AEAD cipher when not running in epoch data key mode,
+ * this is the sum of packets + blocks that are allowed to be used */
int64_t aead_usage_limit;
interval_t renegotiate_seconds;
diff --git a/tests/unit_tests/openvpn/test_crypto.c b/tests/unit_tests/openvpn/test_crypto.c
index c8d2a10..54a6caa 100644
--- a/tests/unit_tests/openvpn/test_crypto.c
+++ b/tests/unit_tests/openvpn/test_crypto.c
@@ -575,7 +575,7 @@
0x90, 0xb6, 0xc7, 0x3b, 0xb5, 0x0f, 0x9c, 0x31,
0x22, 0xec, 0x84, 0x4a, 0xd7, 0xc2, 0xb3, 0xe5};
- const uint8_t *label = (const uint8_t *)("unit test");
+ const uint8_t *label = (const uint8_t *) ("unit test");
uint8_t out[16];
ovpn_expand_label(secret, sizeof(secret), label, 9, NULL, 0, out, sizeof(out));
@@ -586,9 +586,238 @@
assert_memory_equal(out, out_expected, 16);
}
+struct epoch_test_state
+{
+ struct key_type kt;
+ struct gc_arena gc;
+ struct crypto_options co;
+};
+
+static int
+crypto_test_epoch_setup(void **state)
+{
+ int *num_future_keys = (int *)*state;
+ struct epoch_test_state *data = calloc(1, sizeof(struct epoch_test_state));
+
+ data->gc = gc_new();
+
+ init_key_type(&data->kt, "AES-128-GCM", "none", true, false);
+
+ /* have an epoch key that is uses 0x23 for the key for all bytes */
+ struct epoch_key epoch1send = { .epoch = 1, .epoch_key = {0x23} };
+ struct epoch_key epoch1recv = { .epoch = 1, .epoch_key = {0x27} };
+
+ epoch_init_key_ctx(&data->co, &data->kt, &epoch1send,
+ &epoch1recv, *num_future_keys);
+
+ *state = data;
+ return 0;
+}
+
+static int
+crypto_test_epoch_teardown(void **state)
+{
+ struct epoch_test_state *data = *state;
+ free_epoch_key_ctx(&data->co);
+ free_key_ctx_bi(&data->co.key_ctx_bi);
+ gc_free(&data->gc);
+ free(*state);
+ return 0;
+}
+
+void
+crypto_test_epoch_key_generation(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* check the keys look like expect */
+ assert_int_equal(co->epoch_data_keys_future[0].epoch, 2);
+ assert_int_equal(co->epoch_data_keys_future[15].epoch, 17);
+ assert_int_equal(co->epoch_key_send.epoch, 1);
+ assert_int_equal(co->epoch_key_recv.epoch, 17);
+
+ /* Now replace the recv key with the 6th future key (epoch = 8) */
+ free_key_ctx(&co->key_ctx_bi.decrypt);
+ assert_int_equal(co->epoch_data_keys_future[6].epoch, 8);
+ co->key_ctx_bi.decrypt = co->epoch_data_keys_future[6];
+ CLEAR(co->epoch_data_keys_future[6]);
+
+ epoch_generate_future_receive_keys(co);
+ assert_int_equal(co->epoch_data_keys_future[0].epoch, 9);
+ assert_int_equal(co->epoch_data_keys_future[15].epoch, 24);
+}
+
+
+void
+crypto_test_epoch_key_rotation(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* should replace send + key recv */
+ epoch_replace_update_recv_key(co, 9);
+
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 9);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 9);
+ assert_int_equal(co->epoch_key_send.epoch, 9);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 1);
+
+ /* Iterate the data send key four times to get it to 13 */
+ for (int i = 0; i < 4; i++)
+ {
+ epoch_iterate_send_key(co);
+ }
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+
+ epoch_replace_update_recv_key(co, 10);
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 10);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+ assert_int_equal(co->epoch_key_send.epoch, 13);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 9);
+
+ epoch_replace_update_recv_key(co, 12);
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 12);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+ assert_int_equal(co->epoch_key_send.epoch, 13);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 10);
+
+ epoch_iterate_send_key(co);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 14);
+}
+
+void
+crypto_test_epoch_key_receive_lookup(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* lookup some wacky things that should fail */
+ assert_null(epoch_lookup_decrypt_key(co, 2000));
+ assert_null(epoch_lookup_decrypt_key(co, -1));
+ assert_null(epoch_lookup_decrypt_key(co, 0xefff));
+
+ /* Lookup the edges of the current window */
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 2)->epoch, 2);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 13)->epoch, 13);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 14)->epoch, 14);
+ assert_null(epoch_lookup_decrypt_key(co, 15));
+
+ /* Should move 1 to retiring key but leave 1-5 undefined, 7 as
+ * active and 8-20 as future keys*/
+ epoch_replace_update_recv_key(co, 7);
+
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
+ assert_null(epoch_lookup_decrypt_key(co, 2));
+ assert_null(epoch_lookup_decrypt_key(co, 3));
+ assert_null(epoch_lookup_decrypt_key(co, 4));
+ assert_null(epoch_lookup_decrypt_key(co, 5));
+ assert_null(epoch_lookup_decrypt_key(co, 6));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 7)->epoch, 7);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 8)->epoch, 8);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 20)->epoch, 20);
+ assert_null(epoch_lookup_decrypt_key(co, 21));
+ assert_null(epoch_lookup_decrypt_key(co, 22));
+
+
+ /* Should move 7 to retiring key and have 8 as active key and
+ * 9-21 as future keys */
+ epoch_replace_update_recv_key(co, 8);
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_null(epoch_lookup_decrypt_key(co, 1));
+ assert_null(epoch_lookup_decrypt_key(co, 2));
+ assert_null(epoch_lookup_decrypt_key(co, 3));
+ assert_null(epoch_lookup_decrypt_key(co, 4));
+ assert_null(epoch_lookup_decrypt_key(co, 5));
+ assert_null(epoch_lookup_decrypt_key(co, 6));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 7)->epoch, 7);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 8)->epoch, 8);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 20)->epoch, 20);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 21)->epoch, 21);
+ assert_null(epoch_lookup_decrypt_key(co, 22));
+ assert_null(epoch_lookup_decrypt_key(co, 23));
+}
+
+void
+crypto_test_epoch_key_overflow(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* Modify the receive epoch and keys to have a very high epoch to test
+ * the end of array. Iterating through all 16k keys takes a 2-3s, so we
+ * avoid this for the unit test */
+ co->key_ctx_bi.decrypt.epoch = 16000;
+ co->key_ctx_bi.encrypt.epoch = 16000;
+
+ co->epoch_key_send.epoch = 16000;
+ co->epoch_key_recv.epoch = 16000 + co->epoch_data_keys_future_count;
+
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ co->epoch_data_keys_future[i].epoch = 16001 + i;
+ }
+
+ /* Move the last few keys until we are close to the limit */
+ while (co->key_ctx_bi.decrypt.epoch < (UINT16_MAX - 40))
+ {
+ epoch_replace_update_recv_key(co, co->key_ctx_bi.decrypt.epoch + 10);
+ }
+
+ /* Looking up this key should still work as it will not break the limit
+ * when generating keys */
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 34)->epoch, UINT16_MAX - 34);
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 33)->epoch, UINT16_MAX - 33);
+
+ /* This key is no longer eligible for decrypting as the 32 future keys
+ * would be larger than uint16_t maximum */
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - 32));
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX));
+
+ /* Check that moving to the last possible epoch works */
+ epoch_replace_update_recv_key(co, UINT16_MAX - 33);
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 33)->epoch, UINT16_MAX - 33);
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - 32));
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX));
+}
+
+void
+epoch_test_derive_data_key(void **state)
+{
+ struct epoch_key e17 = { .epoch = 17, .epoch_key = { 19, 12 }};
+ struct key_type kt = { 0 };
+ struct key_parameters key_parameters = { 0 };
+ init_key_type(&kt, "AES-192-GCM", "none", true, false);
+
+
+ epoch_data_key_derive(&key_parameters, &e17, &kt);
+
+ assert_int_equal(key_parameters.cipher_size, 24);
+ assert_int_equal(key_parameters.hmac_size, 12);
+
+ uint8_t exp_cipherkey[24] =
+ {0x00, 0x62, 0x84, 0xcb, 0x31, 0x57, 0xc7, 0x97,
+ 0x8d, 0xe8, 0xfb, 0x6e, 0xdc, 0x60, 0x38, 0xc3,
+ 0xa4, 0xb9, 0xa1, 0xea, 0xf4, 0x01, 0x86, 0xbc };
+
+ uint8_t exp_impl_iv[12] =
+ { 0xb4, 0x32, 0xeb, 0x4e, 0x61, 0x4b, 0xa2, 0xf3,
+ 0x5d, 0x86, 0x22, 0x1f };
+
+ assert_memory_equal(key_parameters.cipher, exp_cipherkey, sizeof(exp_cipherkey));
+ assert_memory_equal(key_parameters.hmac, exp_impl_iv, sizeof(exp_impl_iv));
+}
+
int
main(void)
{
+ int prestate_num13 = 13;
+ int prestate_num16 = 16;
+ int prestate_num32 = 32;
+
openvpn_unit_test_setup();
const struct CMUnitTest tests[] = {
cmocka_unit_test(crypto_pem_encode_decode_loopback),
@@ -602,6 +831,23 @@
cmocka_unit_test(crypto_test_hkdf_expand_testa2),
cmocka_unit_test(crypto_test_hkdf_expand_testa3),
cmocka_unit_test(crypto_test_ovpn_label_expand),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_generation,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num16),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_rotation,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num13),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_receive_lookup,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num13),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_overflow,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num32),
+ cmocka_unit_test(epoch_test_derive_data_key)
};
#if defined(ENABLE_CRYPTO_OPENSSL)
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/804?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Gerrit-Change-Number: 804
Gerrit-PatchSet: 1
Gerrit-Owner: plaisthos <arne-openvpn@...1227...>
Gerrit-Reviewer: flichtenheld <frank@...2641...>
Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net>
Gerrit-Attention: flichtenheld <frank@...2641...>
Gerrit-MessageType: newchange
[-- Attachment #2: Type: text/html, Size: 84570 bytes --]
^ permalink raw reply related [flat|nested] 14+ messages in thread* [Openvpn-devel] [L] Change in openvpn[master]: Implement methods to generate and manage OpenVPN Epoch keys
[not found] <gerrit.1731290343000.Id7d6a576ca8c9560cb2dfae82fc62175820e9b80@...2715...>
2024-11-11 2:00 ` [Openvpn-devel] [L] Change in openvpn[master]: Implement methods to generate and manage OpenVPN Epoch keys plaisthos (Code Review)
@ 2024-11-15 15:12 ` plaisthos (Code Review)
2024-11-22 16:29 ` plaisthos (Code Review)
` (10 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: plaisthos (Code Review) @ 2024-11-15 15:12 UTC (permalink / raw)
To: flichtenheld <frank@; +Cc: openvpn-devel
[-- Attachment #1: Type: text/plain, Size: 38475 bytes --]
Attention is currently required from: flichtenheld.
Hello flichtenheld,
I'd like you to reexamine a change. Please visit
http://gerrit.openvpn.net/c/openvpn/+/804?usp=email
to look at the new patch set (#4).
Change subject: Implement methods to generate and manage OpenVPN Epoch keys
......................................................................
Implement methods to generate and manage OpenVPN Epoch keys
This implements functions that allow these keys to be generated and
managed. It does not yet implement using them for the data channel.
Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Signed-off-by: Arne Schwabe <arne@...1227...>
---
M src/openvpn/crypto.c
M src/openvpn/crypto.h
M src/openvpn/crypto_epoch.c
M src/openvpn/crypto_epoch.h
M src/openvpn/packet_id.c
M src/openvpn/packet_id.h
M src/openvpn/ssl_common.h
M tests/unit_tests/openvpn/test_crypto.c
8 files changed, 774 insertions(+), 20 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/04/804/4
diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
index 769a274..a055b20 100644
--- a/src/openvpn/crypto.c
+++ b/src/openvpn/crypto.c
@@ -908,14 +908,27 @@
if (cipher_ctx_mode_aead(ctx->cipher))
{
size_t impl_iv_len = 0;
+ size_t impl_iv_offset = 0;
ASSERT(cipher_ctx_iv_length(ctx->cipher) >= OPENVPN_AEAD_MIN_IV_LEN);
- impl_iv_len = cipher_ctx_iv_length(ctx->cipher) - sizeof(packet_id_type);
+
+ /* Epoch keys use XOR of full IV length with the packet id to generate
+ * IVs. Old data format uses concatenation instead (XOR with 0 for the
+ * first 4 bytes (sizeof(packet_id_type) */
+ if (key->epoch)
+ {
+ impl_iv_len = cipher_ctx_iv_length(ctx->cipher);
+ impl_iv_offset = 0;
+ }
+ else
+ {
+ impl_iv_len = cipher_ctx_iv_length(ctx->cipher) - sizeof(packet_id_type);
+ impl_iv_offset = sizeof(packet_id_type);
+ }
ASSERT(impl_iv_len <= OPENVPN_MAX_IV_LENGTH);
ASSERT(impl_iv_len <= MAX_HMAC_KEY_LENGTH);
ASSERT(key->hmac_size >= impl_iv_len);
CLEAR(ctx->implicit_iv);
- /* The first bytes of the IV are filled with the packet id */
- memcpy(ctx->implicit_iv + sizeof(packet_id_type), key->hmac, impl_iv_len);
+ memcpy(ctx->implicit_iv + impl_iv_offset, key->hmac, impl_iv_len);
}
}
@@ -964,6 +977,7 @@
hmac_ctx_size(ctx->hmac));
}
+ ctx->epoch = key->epoch;
gc_free(&gc);
}
@@ -976,6 +990,7 @@
snprintf(log_prefix, sizeof(log_prefix), "Outgoing %s", name);
init_key_ctx(ctx, key_params, kt, OPENVPN_OP_ENCRYPT, log_prefix);
key_ctx_update_implicit_iv(ctx, key_params);
+ ctx->epoch = key_params->epoch;
}
void
@@ -987,6 +1002,7 @@
snprintf(log_prefix, sizeof(log_prefix), "Incoming %s", name);
init_key_ctx(ctx, key_params, kt, OPENVPN_OP_DECRYPT, log_prefix);
key_ctx_update_implicit_iv(ctx, key_params);
+ ctx->epoch = key_params->epoch;
}
void
@@ -1024,6 +1040,7 @@
}
CLEAR(ctx->implicit_iv);
ctx->plaintext_blocks = 0;
+ ctx->epoch = 0;
}
void
diff --git a/src/openvpn/crypto.h b/src/openvpn/crypto.h
index 640e321..617246b 100644
--- a/src/openvpn/crypto.h
+++ b/src/openvpn/crypto.h
@@ -170,6 +170,9 @@
/** Number of bytes set in the HMac key material */
int hmac_size;
+
+ /** the epoch of the key is if it was generated as epoch data key material */
+ uint16_t epoch;
};
/**
@@ -180,6 +183,11 @@
void
key_parameters_from_key(struct key_parameters *key_params, const struct key *key);
+struct epoch_key {
+ uint8_t epoch_key[SHA256_DIGEST_LENGTH];
+ uint16_t epoch;
+};
+
/**
* Container for one set of cipher and/or HMAC contexts.
* @ingroup control_processor
@@ -203,6 +211,10 @@
/** Counter for the number of plaintext encrypted using this cipher
* in number of 128 bit blocks (only used for AEAD ciphers) */
uint64_t plaintext_blocks;
+ /** OpenVPN data channel epoch, this variable holds the
+ * epoch number that is key belongs to. Note that epoch 0 is not used
+ * and epoch is always non-zero for epoch key contexts */
+ uint16_t epoch;
};
#define KEY_DIRECTION_BIDIRECTIONAL 0 /* same keys for both directions */
@@ -272,6 +284,39 @@
/**< OpenSSL cipher and HMAC contexts for
* both sending and receiving
* directions. */
+
+ /** last epoch_key used for generation of the current send data keys.
+ * As invariant, the epoch of epoch_key_send is always kept >= the epoch of
+ * epoch_key_recv */
+ struct epoch_key epoch_key_send;
+
+ /** epoch_key used for the highest receive epoch keys */
+ struct epoch_key epoch_key_recv;
+
+ /** the key_type that is used to generate the epoch keys */
+ struct key_type epoch_key_type;
+
+ /** This limit for AEAD cipher, this is the sum of packets + blocks
+ * that are allowed to be used. Will switch to a new epoch if this
+ * limit is reached*/
+ uint64_t aead_usage_limit;
+
+ /** Keeps the future epoch data keys for decryption. The current one
+ * that is expected to be used is stored in key_ctx_bi.
+ *
+ * We keep both decrypt and encrypt key here in the future keys
+ * as we want to be able to switch also sending key if the peer
+ * switching to a newer key epoch
+ * */
+ struct key_ctx *epoch_data_keys_future;
+
+ /** number of keys stored in \c epoch_data_keys_future */
+ uint16_t epoch_data_keys_future_count;
+
+ /** The old key bevor the sender switch to a new epoch data key */
+ struct key_ctx epoch_retiring_data_receive_key;
+ struct packet_id_rec epoch_retiring_key_pid_recv;
+
struct packet_id packet_id; /**< Current packet ID state for both
* sending and receiving directions.
*
@@ -280,7 +325,7 @@
*
* The packet id also used as the IV
* for AEAD/OFB/CFG ciphers.
- * */
+ */
struct packet_id_persist *pid_persist;
/**< Persistent packet ID state for
* keeping state between successive
@@ -468,13 +513,15 @@
*
* @param opt Crypto options for this packet, contains replay state.
* @param pin Packet ID read from packet.
+ * @param epoch Epoch read from packet or 0 when epoch is not used.
* @param error_prefix Prefix to use when printing error messages.
* @param gc Garbage collector to use.
*
* @return true if packet ID is validated to be not a replay, false otherwise.
*/
bool crypto_check_replay(struct crypto_options *opt,
- const struct packet_id_net *pin, const char *error_prefix,
+ const struct packet_id_net *pin,
+ const char *error_prefix,
struct gc_arena *gc);
diff --git a/src/openvpn/crypto_epoch.c b/src/openvpn/crypto_epoch.c
index f9111f1..1f89804 100644
--- a/src/openvpn/crypto_epoch.c
+++ b/src/openvpn/crypto_epoch.c
@@ -29,7 +29,13 @@
#endif
#include <inttypes.h>
+#include <string.h>
+#include <stdlib.h>
+
#include "crypto_backend.h"
+#include "packet_id.h"
+#include "crypto.h"
+#include "crypto_epoch.h"
#include "buffer.h"
#include "integer.h"
@@ -104,3 +110,332 @@
gc_free(&gc);
return true;
}
+
+/**
+ * Iterates the epoch key to make it E_n+1, ie increase the epoch by one
+ * and derive the new key material accordingly
+ * @param epoch_key epoch key to iterate
+ */
+static void
+epoch_key_iterate(struct epoch_key *epoch_key)
+{
+ struct epoch_key new_epoch_key = { 0 };
+ new_epoch_key.epoch = epoch_key->epoch + 1;
+ const uint8_t epoch_update_label[] = "datakey upd";
+
+ /* E_N+1 = OVPN-Expand-Label(E_N, "datakey upd", "", 32) */
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_update_label, 11,
+ NULL, 0,
+ new_epoch_key.epoch_key, sizeof(new_epoch_key.epoch_key));
+ *epoch_key = new_epoch_key;
+}
+
+void
+epoch_data_key_derive(struct key_parameters *key,
+ const struct epoch_key *epoch_key,
+ const struct key_type *kt)
+{
+ key->hmac_size = cipher_kt_iv_size(kt->cipher);
+ key->cipher_size = cipher_kt_key_size(kt->cipher);
+
+ /* Generate data key from epoch key:
+ * K_i = OVPN-Expand-Label(E_i, "data_key", "", key_size)
+ * implicit_iv = OVPN-Expand-Label(E_i, "data_iv", "", implicit_iv_len)
+ */
+
+ const uint8_t epoch_data_key_label[] = "data_key";
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_data_key_label, 8,
+ NULL, 0,
+ (uint8_t *)(&key->cipher), key->cipher_size);
+
+ const uint8_t epoch_data_iv_label[] = "data_iv";
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_data_iv_label, 7,
+ NULL, 0,
+ (uint8_t *)(&key->hmac), key->hmac_size);
+ key->epoch = epoch_key->epoch;
+}
+
+static void
+epoch_init_send_key_ctx(struct crypto_options *co)
+{
+ /* Ensure that we are NEVER regenerating the same key that has already
+ * been generated. Since we also reset the packet ID counter this would be
+ * catastrophic as we would do IV reuse which breaks ciphers like AES-GCM */
+ ASSERT(co->key_ctx_bi.encrypt.epoch != co->epoch_key_send.epoch);
+ char name[32] = { 0 };
+ snprintf(name, sizeof(name), "Epoch Data key %" PRIu16, co->epoch_key_send.epoch);
+
+ struct key_parameters send_key = { 0 };
+
+ epoch_data_key_derive(&send_key, &co->epoch_key_send, &co->epoch_key_type);
+
+ init_key_bi_ctx_send(&co->key_ctx_bi.encrypt, &send_key,
+ &co->epoch_key_type, name);
+ reset_packet_id_send(&co->packet_id.send);
+ CLEAR(send_key);
+}
+
+
+static void
+epoch_init_recv_key(struct key_ctx *ctx, struct crypto_options *co)
+{
+ struct key_parameters recv_key = { 0 };
+ epoch_data_key_derive(&recv_key, &co->epoch_key_recv, &co->epoch_key_type);
+
+ char name[32];
+
+ snprintf(name, sizeof(name), "Epoch Data key %" PRIu16, co->epoch_key_recv.epoch);
+
+ init_key_bi_ctx_recv(ctx, &recv_key, &co->epoch_key_type, name);
+ CLEAR(recv_key);
+}
+
+void
+epoch_generate_future_receive_keys(struct crypto_options *co)
+{
+ /* We want the number of receive keys starting with the currently used
+ * keys. */
+ ASSERT(co->key_ctx_bi.initialized);
+ uint16_t current_epoch_recv = co->key_ctx_bi.decrypt.epoch;
+
+ /* Either we have not generated any future keys yet or the last
+ * index is the same as our current epoch key */
+ struct key_ctx *highest_future_key = &co->epoch_data_keys_future[co->epoch_data_keys_future_count - 1];
+
+ ASSERT(co->epoch_key_recv.epoch == 1
+ || highest_future_key->epoch == co->epoch_key_recv.epoch);
+
+ /* free the keys that are not used anymore */
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ /* Keys in future keys are always epoch > 1 if initialised */
+ if (co->epoch_data_keys_future[i].epoch > 0
+ && co->epoch_data_keys_future[i].epoch < current_epoch_recv)
+ {
+ /* Key is old, free it */
+ free_key_ctx(&co->epoch_data_keys_future[i]);
+ }
+ }
+
+ /* Calculate the number of keys that need to be generated,
+ * if no keys have been generated assume only the first key is defined */
+ uint16_t current_highest_key = highest_future_key->epoch ? highest_future_key->epoch : 1;
+ uint16_t desired_highest_key = current_epoch_recv + co->epoch_data_keys_future_count;
+ uint16_t num_keys_generate = desired_highest_key - current_highest_key;
+
+
+ /* Move the old keys out of the way so the order of keys stays strictly
+ * monotonic and consecutive. */
+ /* first check that the destination we are going to overwrite is freed */
+ for (uint16_t i = 0; i < num_keys_generate; i++)
+ {
+ ASSERT(co->epoch_data_keys_future[i].epoch == 0);
+ }
+ memmove(co->epoch_data_keys_future,
+ co->epoch_data_keys_future + num_keys_generate,
+ (co->epoch_data_keys_future_count - num_keys_generate) * sizeof(struct key_ctx));
+
+ /* Clear and regenerate the array elements at the end */
+ for (uint16_t i = co->epoch_data_keys_future_count - num_keys_generate; i < co->epoch_data_keys_future_count; i++)
+ {
+ CLEAR(co->epoch_data_keys_future[i]);
+ epoch_key_iterate(&co->epoch_key_recv);
+
+ epoch_init_recv_key(&co->epoch_data_keys_future[i], co);
+ }
+
+ /* Assert that all keys are initialised */
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ ASSERT(co->epoch_data_keys_future[i].epoch > 0);
+ }
+}
+
+void
+epoch_iterate_send_key(struct crypto_options *co)
+{
+ ASSERT(co->epoch_key_send.epoch < UINT16_MAX);
+ epoch_key_iterate(&co->epoch_key_send);
+ free_key_ctx(&co->key_ctx_bi.encrypt);
+ epoch_init_send_key_ctx(co);
+}
+
+void
+epoch_replace_update_recv_key(struct crypto_options *co,
+ uint16_t new_epoch)
+{
+ /* Find the key of the new epoch in future keys */
+ uint16_t fki;
+ for (fki = 0; fki < co->epoch_data_keys_future_count; fki++)
+ {
+ if (co->epoch_data_keys_future[fki].epoch == new_epoch)
+ {
+ break;
+ }
+ }
+ /* we should only ever be called when we successfully decrypted/authenticated
+ * a packet from a peer, ie the epoch recv key *MUST* be in that
+ * array */
+ ASSERT(fki < co->epoch_data_keys_future_count);
+ ASSERT(co->epoch_data_keys_future[fki].epoch == new_epoch);
+
+ struct key_ctx *new_ctx = &co->epoch_data_keys_future[fki];
+
+ /* Check if the new recv key epoch is higher than the send key epoch. If
+ * yes we will replace the send key as well */
+ if (co->key_ctx_bi.encrypt.epoch < new_epoch)
+ {
+ free_key_ctx(&co->key_ctx_bi.encrypt);
+
+ /* Update the epoch_key for send to match the current key being used.
+ * This is a bit of extra work but since we are a maximum of 16
+ * keys behind, a maximum 16 HMAC invocations are a small price to
+ * pay for not keeping all the old epoch keys around in future_keys
+ * array */
+ while (co->epoch_key_send.epoch < new_epoch)
+ {
+ epoch_key_iterate(&co->epoch_key_send);
+ }
+ epoch_init_send_key_ctx(co);
+ }
+
+ /* Replace receive key */
+ free_key_ctx(&co->epoch_retiring_data_receive_key);
+ co->epoch_retiring_data_receive_key = co->key_ctx_bi.decrypt;
+ packet_id_move_recv(&co->epoch_retiring_key_pid_recv, &co->packet_id.rec);
+
+ co->key_ctx_bi.decrypt = *new_ctx;
+
+ /* Zero the old location instead to of free_key_ctx since we moved the keys
+ * and do not want to free the pointers in the old place */
+ memset(new_ctx, 0, sizeof(struct key_ctx));
+
+ /* Generate new future keys */
+ epoch_generate_future_receive_keys(co);
+}
+
+void
+free_epoch_key_ctx(struct crypto_options *co)
+{
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ free_key_ctx(&co->epoch_data_keys_future[i]);
+ }
+
+ free(co->epoch_data_keys_future);
+ free_key_ctx(&co->epoch_retiring_data_receive_key);
+ free(co->epoch_retiring_key_pid_recv.seq_list);
+ CLEAR(co->epoch_key_recv);
+ CLEAR(co->epoch_key_send);
+}
+
+void
+epoch_init_key_ctx(struct crypto_options *co, const struct key_type *key_type,
+ const struct epoch_key *e1_send,
+ const struct epoch_key *e1_recv,
+ uint16_t future_key_count)
+{
+ ASSERT(e1_send->epoch == 1 && e1_recv->epoch == 1);
+ co->epoch_key_recv = *e1_recv;
+ co->epoch_key_send = *e1_send;
+
+ co->epoch_key_type = *key_type;
+ co->aead_usage_limit = cipher_get_aead_limits(key_type->cipher);
+
+ epoch_init_send_key_ctx(co);
+ epoch_init_recv_key(&co->key_ctx_bi.decrypt, co);
+ co->key_ctx_bi.initialized = true;
+
+ co->epoch_data_keys_future_count = future_key_count;
+ ALLOC_ARRAY_CLEAR(co->epoch_data_keys_future, struct key_ctx, co->epoch_data_keys_future_count);
+ epoch_generate_future_receive_keys(co);
+}
+
+const struct key_ctx *
+epoch_lookup_decrypt_key(struct crypto_options *opt, uint16_t epoch)
+{
+ /* Current decrypt key is the most likely one */
+ if (opt->key_ctx_bi.decrypt.epoch == epoch)
+ {
+ return &opt->key_ctx_bi.decrypt;
+ }
+ else if (opt->epoch_retiring_data_receive_key.epoch
+ && opt->epoch_retiring_data_receive_key.epoch == epoch)
+ {
+ return &opt->epoch_retiring_data_receive_key;
+ }
+ else if (epoch > opt->key_ctx_bi.decrypt.epoch
+ && epoch <= opt->key_ctx_bi.decrypt.epoch + opt->epoch_data_keys_future_count)
+ {
+ /* Key in the range of future keys */
+ int index = epoch - (opt->key_ctx_bi.decrypt.epoch + 1);
+
+ /* If we have reached the edge of the valid keys we do not return
+ * the key anymore since regenerating the new keys would move us
+ * over the window of valid keys and would need all kind of
+ * special casing, so we stop returning the key in this case */
+ if (epoch > (UINT16_MAX - opt->epoch_data_keys_future_count - 1))
+ {
+ return NULL;
+ }
+ else
+ {
+ return &opt->epoch_data_keys_future[index];
+ }
+ }
+ else
+ {
+ return NULL;
+ }
+}
+
+
+void
+epoch_check_send_iterate(struct crypto_options *opt)
+{
+ if (opt->epoch_key_send.epoch == UINT16_MAX)
+ {
+ /* limit of epoch keys reached, cannot move to a newer key anymore */
+ return;
+ }
+ if (opt->aead_usage_limit)
+ {
+ if (aead_usage_limit_reached(opt->aead_usage_limit, &opt->key_ctx_bi.encrypt,
+ opt->packet_id.send.id))
+ {
+ /* Send key limit reached */
+ epoch_iterate_send_key(opt);
+ }
+ /* draft 8 of the aead usage limit still had but draft 9 complete
+ * dropped this statement:
+ *
+ * In particular, is two-party communication, one participant cannot
+ * regard apparent overuse of a key by other participants as
+ * being in error, when it could be that the other participant has
+ * better information about bounds.
+ *
+ * OpenVPN 2.x implements a compromise of not regarding this as an
+ * error but still accepting packets of the usage limit but tries to
+ * push the peer to a new epoch key by increasing our own key epoch
+ * */
+ else if (opt->key_ctx_bi.encrypt.epoch == opt->key_ctx_bi.decrypt.epoch
+ && aead_usage_limit_reached(opt->aead_usage_limit,
+ &opt->key_ctx_bi.decrypt,
+ opt->packet_id.rec.id))
+ {
+ /* Receive key limit reached. Increase our own send key to signal
+ * that we want to use a new epoch. Peer should then also move its
+ * key but is not required to do this */
+ epoch_iterate_send_key(opt);
+ }
+ }
+
+ if (opt->packet_id.send.id == PACKET_ID_EPOCH_MAX)
+ {
+ epoch_iterate_send_key(opt);
+ }
+
+}
diff --git a/src/openvpn/crypto_epoch.h b/src/openvpn/crypto_epoch.h
index dad2473..95d8e9e 100644
--- a/src/openvpn/crypto_epoch.h
+++ b/src/openvpn/crypto_epoch.h
@@ -66,4 +66,81 @@
const uint8_t *context, size_t context_len,
uint8_t *out, uint16_t out_len);
-#endif
+/**
+ * Generate a data channel key pair from the epoch key
+ * @param epoch_key Epoch key to be used
+ * @param key Destination for the generated data key
+ * @parm kt Cipher information to generate the data channel key for
+ */
+void
+epoch_data_key_derive(struct key_parameters *key,
+ const struct epoch_key *epoch_key,
+ const struct key_type *kt);
+
+/**
+ * Generates and fills the epoch_data_keys_future with next valid
+ * future keys in crypto_options
+ *
+ * This assume that the normal key_ctx_bi and epoch keys are already setup
+ */
+void
+epoch_generate_future_receive_keys(struct crypto_options *co);
+
+
+/** This is called when the peer using a new send key that is not the default
+ * key. This function ensures the following:
+ * - recv key matches the epoch index provided
+ * - send key epoch is equal or higher than recv_key epoch
+ *
+ * @param new_epoch the new epoch to use a the receive key
+ */
+void
+epoch_replace_update_recv_key(struct crypto_options *co,
+ uint16_t new_epoch);
+
+/**
+ * Updates the send key and send_epoch_keyt in cryptio_options->key_ctx_bi to
+ * use the next epoch */
+void
+epoch_iterate_send_key(struct crypto_options *co);
+
+/**
+ * Frees the extra data structures used by epoch keys in \c crypto_options
+ */
+void
+free_epoch_key_ctx(struct crypto_options *co);
+
+/**
+ * Initialises data channel keys and internal structures for epoch data keys
+ * using the provided E0 epoch key
+ *
+ * @param e1_send The E1 send epoch key derived by TLS-EKM
+ * @param e1_recv The E1 receive epoch key derived by TLS-EKM
+ */
+void
+epoch_init_key_ctx(struct crypto_options *co, const struct key_type *key_type,
+ const struct epoch_key *e1_send, const struct epoch_key *e1_recv,
+ uint16_t future_key_count);
+
+/**
+ * Using an epoch, this function will try to retrieve a decryption
+ * key context that matches that epoch from the \c opt argument
+ * @param opt crypto_options to use to find the decrypt key
+ * @param epoch epoch of the key to lookup
+ * @return the key context with
+ */
+const struct key_ctx *
+epoch_lookup_decrypt_key(struct crypto_options *opt, uint16_t epoch);
+
+/**
+ * Checks if we need to iterate the send epoch key. This needs to be in one
+ * of the following condition
+ * - max epoch counter reached
+ * - send key aead usage limit reached (for AES-GCM and similar ciphers)
+ * - recv key usage limit reached
+ */
+void
+epoch_check_send_iterate(struct crypto_options *opt);
+
+
+#endif /* ifndef CRYPTO_EPOCH_H */
diff --git a/src/openvpn/packet_id.c b/src/openvpn/packet_id.c
index 8cde108..177391a 100644
--- a/src/openvpn/packet_id.c
+++ b/src/openvpn/packet_id.c
@@ -78,6 +78,21 @@
}
void
+packet_id_init_recv(struct packet_id_rec *rec, int seq_backtrack, int time_backtrack, const char *name, int unit)
+{
+ rec->name = name;
+ rec->unit = unit;
+ if (seq_backtrack)
+ {
+ ASSERT(MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
+ ASSERT(MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
+ CIRC_LIST_ALLOC(rec->seq_list, struct seq_list, seq_backtrack);
+ rec->seq_backtrack = seq_backtrack;
+ rec->time_backtrack = time_backtrack;
+ }
+ rec->initialized = true;
+}
+void
packet_id_init(struct packet_id *p, int seq_backtrack, int time_backtrack, const char *name, int unit)
{
dmsg(D_PID_DEBUG, "PID packet_id_init seq_backtrack=%d time_backtrack=%d",
@@ -87,17 +102,25 @@
ASSERT(p);
CLEAR(*p);
- p->rec.name = name;
- p->rec.unit = unit;
- if (seq_backtrack)
- {
- ASSERT(MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
- ASSERT(MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
- CIRC_LIST_ALLOC(p->rec.seq_list, struct seq_list, seq_backtrack);
- p->rec.seq_backtrack = seq_backtrack;
- p->rec.time_backtrack = time_backtrack;
- }
- p->rec.initialized = true;
+ packet_id_init_recv(&p->rec, seq_backtrack, time_backtrack, name, unit);
+}
+
+void
+packet_id_move_recv(struct packet_id_rec *dest, struct packet_id_rec *src)
+{
+ ASSERT(src);
+ ASSERT(dest);
+ /* clear free any old data in rec list */
+ free(dest->seq_list);
+ CLEAR(*dest);
+
+ /* Copy data to dest */
+ *dest = *src;
+
+ /* Reinitalise the source */
+ CLEAR(*src);
+ packet_id_init_recv(src, dest->seq_backtrack, dest->time_backtrack,
+ dest->name, dest->unit);
}
void
diff --git a/src/openvpn/packet_id.h b/src/openvpn/packet_id.h
index 79224d2..7620ce5 100644
--- a/src/openvpn/packet_id.h
+++ b/src/openvpn/packet_id.h
@@ -203,6 +203,15 @@
void packet_id_free(struct packet_id *p);
+/**
+ * Move the packet id recv structure from src to dest. src will will
+ * be reinitialised with
+ * @param dest
+ * @param src
+ */
+void
+packet_id_move_recv(struct packet_id_rec *dest, struct packet_id_rec *src);
+
/* should we accept an incoming packet id ? */
bool packet_id_test(struct packet_id_rec *p,
const struct packet_id_net *pin);
diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h
index ce1cd9e..511127d 100644
--- a/src/openvpn/ssl_common.h
+++ b/src/openvpn/ssl_common.h
@@ -333,8 +333,8 @@
interval_t packet_timeout;
int64_t renegotiate_bytes;
int64_t renegotiate_packets;
- /** This limit for AEAD cipher, this is the sum of packets + blocks
- * that are allowed to be used */
+ /** This limit for AEAD cipher when not running in epoch data key mode,
+ * this is the sum of packets + blocks that are allowed to be used */
int64_t aead_usage_limit;
interval_t renegotiate_seconds;
diff --git a/tests/unit_tests/openvpn/test_crypto.c b/tests/unit_tests/openvpn/test_crypto.c
index c8d2a10..54a6caa 100644
--- a/tests/unit_tests/openvpn/test_crypto.c
+++ b/tests/unit_tests/openvpn/test_crypto.c
@@ -575,7 +575,7 @@
0x90, 0xb6, 0xc7, 0x3b, 0xb5, 0x0f, 0x9c, 0x31,
0x22, 0xec, 0x84, 0x4a, 0xd7, 0xc2, 0xb3, 0xe5};
- const uint8_t *label = (const uint8_t *)("unit test");
+ const uint8_t *label = (const uint8_t *) ("unit test");
uint8_t out[16];
ovpn_expand_label(secret, sizeof(secret), label, 9, NULL, 0, out, sizeof(out));
@@ -586,9 +586,238 @@
assert_memory_equal(out, out_expected, 16);
}
+struct epoch_test_state
+{
+ struct key_type kt;
+ struct gc_arena gc;
+ struct crypto_options co;
+};
+
+static int
+crypto_test_epoch_setup(void **state)
+{
+ int *num_future_keys = (int *)*state;
+ struct epoch_test_state *data = calloc(1, sizeof(struct epoch_test_state));
+
+ data->gc = gc_new();
+
+ init_key_type(&data->kt, "AES-128-GCM", "none", true, false);
+
+ /* have an epoch key that is uses 0x23 for the key for all bytes */
+ struct epoch_key epoch1send = { .epoch = 1, .epoch_key = {0x23} };
+ struct epoch_key epoch1recv = { .epoch = 1, .epoch_key = {0x27} };
+
+ epoch_init_key_ctx(&data->co, &data->kt, &epoch1send,
+ &epoch1recv, *num_future_keys);
+
+ *state = data;
+ return 0;
+}
+
+static int
+crypto_test_epoch_teardown(void **state)
+{
+ struct epoch_test_state *data = *state;
+ free_epoch_key_ctx(&data->co);
+ free_key_ctx_bi(&data->co.key_ctx_bi);
+ gc_free(&data->gc);
+ free(*state);
+ return 0;
+}
+
+void
+crypto_test_epoch_key_generation(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* check the keys look like expect */
+ assert_int_equal(co->epoch_data_keys_future[0].epoch, 2);
+ assert_int_equal(co->epoch_data_keys_future[15].epoch, 17);
+ assert_int_equal(co->epoch_key_send.epoch, 1);
+ assert_int_equal(co->epoch_key_recv.epoch, 17);
+
+ /* Now replace the recv key with the 6th future key (epoch = 8) */
+ free_key_ctx(&co->key_ctx_bi.decrypt);
+ assert_int_equal(co->epoch_data_keys_future[6].epoch, 8);
+ co->key_ctx_bi.decrypt = co->epoch_data_keys_future[6];
+ CLEAR(co->epoch_data_keys_future[6]);
+
+ epoch_generate_future_receive_keys(co);
+ assert_int_equal(co->epoch_data_keys_future[0].epoch, 9);
+ assert_int_equal(co->epoch_data_keys_future[15].epoch, 24);
+}
+
+
+void
+crypto_test_epoch_key_rotation(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* should replace send + key recv */
+ epoch_replace_update_recv_key(co, 9);
+
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 9);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 9);
+ assert_int_equal(co->epoch_key_send.epoch, 9);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 1);
+
+ /* Iterate the data send key four times to get it to 13 */
+ for (int i = 0; i < 4; i++)
+ {
+ epoch_iterate_send_key(co);
+ }
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+
+ epoch_replace_update_recv_key(co, 10);
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 10);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+ assert_int_equal(co->epoch_key_send.epoch, 13);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 9);
+
+ epoch_replace_update_recv_key(co, 12);
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 12);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+ assert_int_equal(co->epoch_key_send.epoch, 13);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 10);
+
+ epoch_iterate_send_key(co);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 14);
+}
+
+void
+crypto_test_epoch_key_receive_lookup(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* lookup some wacky things that should fail */
+ assert_null(epoch_lookup_decrypt_key(co, 2000));
+ assert_null(epoch_lookup_decrypt_key(co, -1));
+ assert_null(epoch_lookup_decrypt_key(co, 0xefff));
+
+ /* Lookup the edges of the current window */
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 2)->epoch, 2);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 13)->epoch, 13);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 14)->epoch, 14);
+ assert_null(epoch_lookup_decrypt_key(co, 15));
+
+ /* Should move 1 to retiring key but leave 1-5 undefined, 7 as
+ * active and 8-20 as future keys*/
+ epoch_replace_update_recv_key(co, 7);
+
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
+ assert_null(epoch_lookup_decrypt_key(co, 2));
+ assert_null(epoch_lookup_decrypt_key(co, 3));
+ assert_null(epoch_lookup_decrypt_key(co, 4));
+ assert_null(epoch_lookup_decrypt_key(co, 5));
+ assert_null(epoch_lookup_decrypt_key(co, 6));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 7)->epoch, 7);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 8)->epoch, 8);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 20)->epoch, 20);
+ assert_null(epoch_lookup_decrypt_key(co, 21));
+ assert_null(epoch_lookup_decrypt_key(co, 22));
+
+
+ /* Should move 7 to retiring key and have 8 as active key and
+ * 9-21 as future keys */
+ epoch_replace_update_recv_key(co, 8);
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_null(epoch_lookup_decrypt_key(co, 1));
+ assert_null(epoch_lookup_decrypt_key(co, 2));
+ assert_null(epoch_lookup_decrypt_key(co, 3));
+ assert_null(epoch_lookup_decrypt_key(co, 4));
+ assert_null(epoch_lookup_decrypt_key(co, 5));
+ assert_null(epoch_lookup_decrypt_key(co, 6));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 7)->epoch, 7);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 8)->epoch, 8);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 20)->epoch, 20);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 21)->epoch, 21);
+ assert_null(epoch_lookup_decrypt_key(co, 22));
+ assert_null(epoch_lookup_decrypt_key(co, 23));
+}
+
+void
+crypto_test_epoch_key_overflow(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* Modify the receive epoch and keys to have a very high epoch to test
+ * the end of array. Iterating through all 16k keys takes a 2-3s, so we
+ * avoid this for the unit test */
+ co->key_ctx_bi.decrypt.epoch = 16000;
+ co->key_ctx_bi.encrypt.epoch = 16000;
+
+ co->epoch_key_send.epoch = 16000;
+ co->epoch_key_recv.epoch = 16000 + co->epoch_data_keys_future_count;
+
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ co->epoch_data_keys_future[i].epoch = 16001 + i;
+ }
+
+ /* Move the last few keys until we are close to the limit */
+ while (co->key_ctx_bi.decrypt.epoch < (UINT16_MAX - 40))
+ {
+ epoch_replace_update_recv_key(co, co->key_ctx_bi.decrypt.epoch + 10);
+ }
+
+ /* Looking up this key should still work as it will not break the limit
+ * when generating keys */
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 34)->epoch, UINT16_MAX - 34);
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 33)->epoch, UINT16_MAX - 33);
+
+ /* This key is no longer eligible for decrypting as the 32 future keys
+ * would be larger than uint16_t maximum */
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - 32));
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX));
+
+ /* Check that moving to the last possible epoch works */
+ epoch_replace_update_recv_key(co, UINT16_MAX - 33);
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 33)->epoch, UINT16_MAX - 33);
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - 32));
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX));
+}
+
+void
+epoch_test_derive_data_key(void **state)
+{
+ struct epoch_key e17 = { .epoch = 17, .epoch_key = { 19, 12 }};
+ struct key_type kt = { 0 };
+ struct key_parameters key_parameters = { 0 };
+ init_key_type(&kt, "AES-192-GCM", "none", true, false);
+
+
+ epoch_data_key_derive(&key_parameters, &e17, &kt);
+
+ assert_int_equal(key_parameters.cipher_size, 24);
+ assert_int_equal(key_parameters.hmac_size, 12);
+
+ uint8_t exp_cipherkey[24] =
+ {0x00, 0x62, 0x84, 0xcb, 0x31, 0x57, 0xc7, 0x97,
+ 0x8d, 0xe8, 0xfb, 0x6e, 0xdc, 0x60, 0x38, 0xc3,
+ 0xa4, 0xb9, 0xa1, 0xea, 0xf4, 0x01, 0x86, 0xbc };
+
+ uint8_t exp_impl_iv[12] =
+ { 0xb4, 0x32, 0xeb, 0x4e, 0x61, 0x4b, 0xa2, 0xf3,
+ 0x5d, 0x86, 0x22, 0x1f };
+
+ assert_memory_equal(key_parameters.cipher, exp_cipherkey, sizeof(exp_cipherkey));
+ assert_memory_equal(key_parameters.hmac, exp_impl_iv, sizeof(exp_impl_iv));
+}
+
int
main(void)
{
+ int prestate_num13 = 13;
+ int prestate_num16 = 16;
+ int prestate_num32 = 32;
+
openvpn_unit_test_setup();
const struct CMUnitTest tests[] = {
cmocka_unit_test(crypto_pem_encode_decode_loopback),
@@ -602,6 +831,23 @@
cmocka_unit_test(crypto_test_hkdf_expand_testa2),
cmocka_unit_test(crypto_test_hkdf_expand_testa3),
cmocka_unit_test(crypto_test_ovpn_label_expand),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_generation,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num16),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_rotation,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num13),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_receive_lookup,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num13),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_overflow,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num32),
+ cmocka_unit_test(epoch_test_derive_data_key)
};
#if defined(ENABLE_CRYPTO_OPENSSL)
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/804?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Gerrit-Change-Number: 804
Gerrit-PatchSet: 4
Gerrit-Owner: plaisthos <arne-openvpn@...1227...>
Gerrit-Reviewer: flichtenheld <frank@...2641...>
Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net>
Gerrit-Attention: flichtenheld <frank@...2641...>
Gerrit-MessageType: newpatchset
[-- Attachment #2: Type: text/html, Size: 83924 bytes --]
^ permalink raw reply related [flat|nested] 14+ messages in thread* [Openvpn-devel] [L] Change in openvpn[master]: Implement methods to generate and manage OpenVPN Epoch keys
[not found] <gerrit.1731290343000.Id7d6a576ca8c9560cb2dfae82fc62175820e9b80@...2715...>
2024-11-11 2:00 ` [Openvpn-devel] [L] Change in openvpn[master]: Implement methods to generate and manage OpenVPN Epoch keys plaisthos (Code Review)
2024-11-15 15:12 ` plaisthos (Code Review)
@ 2024-11-22 16:29 ` plaisthos (Code Review)
2024-11-30 13:38 ` plaisthos (Code Review)
` (9 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: plaisthos (Code Review) @ 2024-11-22 16:29 UTC (permalink / raw)
To: flichtenheld <frank@; +Cc: openvpn-devel
[-- Attachment #1: Type: text/plain, Size: 38692 bytes --]
Attention is currently required from: flichtenheld.
Hello flichtenheld,
I'd like you to reexamine a change. Please visit
http://gerrit.openvpn.net/c/openvpn/+/804?usp=email
to look at the new patch set (#5).
Change subject: Implement methods to generate and manage OpenVPN Epoch keys
......................................................................
Implement methods to generate and manage OpenVPN Epoch keys
This implements functions that allow these keys to be generated and
managed. It does not yet implement using them for the data channel.
Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Signed-off-by: Arne Schwabe <arne@...1227...>
---
M src/openvpn/crypto.c
M src/openvpn/crypto.h
M src/openvpn/crypto_epoch.c
M src/openvpn/crypto_epoch.h
M src/openvpn/packet_id.c
M src/openvpn/packet_id.h
M src/openvpn/ssl_common.h
M tests/unit_tests/openvpn/test_crypto.c
8 files changed, 775 insertions(+), 22 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/04/804/5
diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
index 769a274..a055b20 100644
--- a/src/openvpn/crypto.c
+++ b/src/openvpn/crypto.c
@@ -908,14 +908,27 @@
if (cipher_ctx_mode_aead(ctx->cipher))
{
size_t impl_iv_len = 0;
+ size_t impl_iv_offset = 0;
ASSERT(cipher_ctx_iv_length(ctx->cipher) >= OPENVPN_AEAD_MIN_IV_LEN);
- impl_iv_len = cipher_ctx_iv_length(ctx->cipher) - sizeof(packet_id_type);
+
+ /* Epoch keys use XOR of full IV length with the packet id to generate
+ * IVs. Old data format uses concatenation instead (XOR with 0 for the
+ * first 4 bytes (sizeof(packet_id_type) */
+ if (key->epoch)
+ {
+ impl_iv_len = cipher_ctx_iv_length(ctx->cipher);
+ impl_iv_offset = 0;
+ }
+ else
+ {
+ impl_iv_len = cipher_ctx_iv_length(ctx->cipher) - sizeof(packet_id_type);
+ impl_iv_offset = sizeof(packet_id_type);
+ }
ASSERT(impl_iv_len <= OPENVPN_MAX_IV_LENGTH);
ASSERT(impl_iv_len <= MAX_HMAC_KEY_LENGTH);
ASSERT(key->hmac_size >= impl_iv_len);
CLEAR(ctx->implicit_iv);
- /* The first bytes of the IV are filled with the packet id */
- memcpy(ctx->implicit_iv + sizeof(packet_id_type), key->hmac, impl_iv_len);
+ memcpy(ctx->implicit_iv + impl_iv_offset, key->hmac, impl_iv_len);
}
}
@@ -964,6 +977,7 @@
hmac_ctx_size(ctx->hmac));
}
+ ctx->epoch = key->epoch;
gc_free(&gc);
}
@@ -976,6 +990,7 @@
snprintf(log_prefix, sizeof(log_prefix), "Outgoing %s", name);
init_key_ctx(ctx, key_params, kt, OPENVPN_OP_ENCRYPT, log_prefix);
key_ctx_update_implicit_iv(ctx, key_params);
+ ctx->epoch = key_params->epoch;
}
void
@@ -987,6 +1002,7 @@
snprintf(log_prefix, sizeof(log_prefix), "Incoming %s", name);
init_key_ctx(ctx, key_params, kt, OPENVPN_OP_DECRYPT, log_prefix);
key_ctx_update_implicit_iv(ctx, key_params);
+ ctx->epoch = key_params->epoch;
}
void
@@ -1024,6 +1040,7 @@
}
CLEAR(ctx->implicit_iv);
ctx->plaintext_blocks = 0;
+ ctx->epoch = 0;
}
void
diff --git a/src/openvpn/crypto.h b/src/openvpn/crypto.h
index 640e321..617246b 100644
--- a/src/openvpn/crypto.h
+++ b/src/openvpn/crypto.h
@@ -170,6 +170,9 @@
/** Number of bytes set in the HMac key material */
int hmac_size;
+
+ /** the epoch of the key is if it was generated as epoch data key material */
+ uint16_t epoch;
};
/**
@@ -180,6 +183,11 @@
void
key_parameters_from_key(struct key_parameters *key_params, const struct key *key);
+struct epoch_key {
+ uint8_t epoch_key[SHA256_DIGEST_LENGTH];
+ uint16_t epoch;
+};
+
/**
* Container for one set of cipher and/or HMAC contexts.
* @ingroup control_processor
@@ -203,6 +211,10 @@
/** Counter for the number of plaintext encrypted using this cipher
* in number of 128 bit blocks (only used for AEAD ciphers) */
uint64_t plaintext_blocks;
+ /** OpenVPN data channel epoch, this variable holds the
+ * epoch number that is key belongs to. Note that epoch 0 is not used
+ * and epoch is always non-zero for epoch key contexts */
+ uint16_t epoch;
};
#define KEY_DIRECTION_BIDIRECTIONAL 0 /* same keys for both directions */
@@ -272,6 +284,39 @@
/**< OpenSSL cipher and HMAC contexts for
* both sending and receiving
* directions. */
+
+ /** last epoch_key used for generation of the current send data keys.
+ * As invariant, the epoch of epoch_key_send is always kept >= the epoch of
+ * epoch_key_recv */
+ struct epoch_key epoch_key_send;
+
+ /** epoch_key used for the highest receive epoch keys */
+ struct epoch_key epoch_key_recv;
+
+ /** the key_type that is used to generate the epoch keys */
+ struct key_type epoch_key_type;
+
+ /** This limit for AEAD cipher, this is the sum of packets + blocks
+ * that are allowed to be used. Will switch to a new epoch if this
+ * limit is reached*/
+ uint64_t aead_usage_limit;
+
+ /** Keeps the future epoch data keys for decryption. The current one
+ * that is expected to be used is stored in key_ctx_bi.
+ *
+ * We keep both decrypt and encrypt key here in the future keys
+ * as we want to be able to switch also sending key if the peer
+ * switching to a newer key epoch
+ * */
+ struct key_ctx *epoch_data_keys_future;
+
+ /** number of keys stored in \c epoch_data_keys_future */
+ uint16_t epoch_data_keys_future_count;
+
+ /** The old key bevor the sender switch to a new epoch data key */
+ struct key_ctx epoch_retiring_data_receive_key;
+ struct packet_id_rec epoch_retiring_key_pid_recv;
+
struct packet_id packet_id; /**< Current packet ID state for both
* sending and receiving directions.
*
@@ -280,7 +325,7 @@
*
* The packet id also used as the IV
* for AEAD/OFB/CFG ciphers.
- * */
+ */
struct packet_id_persist *pid_persist;
/**< Persistent packet ID state for
* keeping state between successive
@@ -468,13 +513,15 @@
*
* @param opt Crypto options for this packet, contains replay state.
* @param pin Packet ID read from packet.
+ * @param epoch Epoch read from packet or 0 when epoch is not used.
* @param error_prefix Prefix to use when printing error messages.
* @param gc Garbage collector to use.
*
* @return true if packet ID is validated to be not a replay, false otherwise.
*/
bool crypto_check_replay(struct crypto_options *opt,
- const struct packet_id_net *pin, const char *error_prefix,
+ const struct packet_id_net *pin,
+ const char *error_prefix,
struct gc_arena *gc);
diff --git a/src/openvpn/crypto_epoch.c b/src/openvpn/crypto_epoch.c
index f341386..4a9a338 100644
--- a/src/openvpn/crypto_epoch.c
+++ b/src/openvpn/crypto_epoch.c
@@ -29,7 +29,13 @@
#endif
#include <inttypes.h>
+#include <string.h>
+#include <stdlib.h>
+
#include "crypto_backend.h"
+#include "packet_id.h"
+#include "crypto.h"
+#include "crypto_epoch.h"
#include "buffer.h"
#include "integer.h"
@@ -111,3 +117,332 @@
gc_free(&gc);
return true;
}
+
+/**
+ * Iterates the epoch key to make it E_n+1, ie increase the epoch by one
+ * and derive the new key material accordingly
+ * @param epoch_key epoch key to iterate
+ */
+static void
+epoch_key_iterate(struct epoch_key *epoch_key)
+{
+ struct epoch_key new_epoch_key = { 0 };
+ new_epoch_key.epoch = epoch_key->epoch + 1;
+ const uint8_t epoch_update_label[] = "datakey upd";
+
+ /* E_N+1 = OVPN-Expand-Label(E_N, "datakey upd", "", 32) */
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_update_label, 11,
+ NULL, 0,
+ new_epoch_key.epoch_key, sizeof(new_epoch_key.epoch_key));
+ *epoch_key = new_epoch_key;
+}
+
+void
+epoch_data_key_derive(struct key_parameters *key,
+ const struct epoch_key *epoch_key,
+ const struct key_type *kt)
+{
+ key->hmac_size = cipher_kt_iv_size(kt->cipher);
+ key->cipher_size = cipher_kt_key_size(kt->cipher);
+
+ /* Generate data key from epoch key:
+ * K_i = OVPN-Expand-Label(E_i, "data_key", "", key_size)
+ * implicit_iv = OVPN-Expand-Label(E_i, "data_iv", "", implicit_iv_len)
+ */
+
+ const uint8_t epoch_data_key_label[] = "data_key";
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_data_key_label, 8,
+ NULL, 0,
+ (uint8_t *)(&key->cipher), key->cipher_size);
+
+ const uint8_t epoch_data_iv_label[] = "data_iv";
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_data_iv_label, 7,
+ NULL, 0,
+ (uint8_t *)(&key->hmac), key->hmac_size);
+ key->epoch = epoch_key->epoch;
+}
+
+static void
+epoch_init_send_key_ctx(struct crypto_options *co)
+{
+ /* Ensure that we are NEVER regenerating the same key that has already
+ * been generated. Since we also reset the packet ID counter this would be
+ * catastrophic as we would do IV reuse which breaks ciphers like AES-GCM */
+ ASSERT(co->key_ctx_bi.encrypt.epoch != co->epoch_key_send.epoch);
+ char name[32] = { 0 };
+ snprintf(name, sizeof(name), "Epoch Data key %" PRIu16, co->epoch_key_send.epoch);
+
+ struct key_parameters send_key = { 0 };
+
+ epoch_data_key_derive(&send_key, &co->epoch_key_send, &co->epoch_key_type);
+
+ init_key_bi_ctx_send(&co->key_ctx_bi.encrypt, &send_key,
+ &co->epoch_key_type, name);
+ reset_packet_id_send(&co->packet_id.send);
+ CLEAR(send_key);
+}
+
+
+static void
+epoch_init_recv_key(struct key_ctx *ctx, struct crypto_options *co)
+{
+ struct key_parameters recv_key = { 0 };
+ epoch_data_key_derive(&recv_key, &co->epoch_key_recv, &co->epoch_key_type);
+
+ char name[32];
+
+ snprintf(name, sizeof(name), "Epoch Data key %" PRIu16, co->epoch_key_recv.epoch);
+
+ init_key_bi_ctx_recv(ctx, &recv_key, &co->epoch_key_type, name);
+ CLEAR(recv_key);
+}
+
+void
+epoch_generate_future_receive_keys(struct crypto_options *co)
+{
+ /* We want the number of receive keys starting with the currently used
+ * keys. */
+ ASSERT(co->key_ctx_bi.initialized);
+ uint16_t current_epoch_recv = co->key_ctx_bi.decrypt.epoch;
+
+ /* Either we have not generated any future keys yet or the last
+ * index is the same as our current epoch key */
+ struct key_ctx *highest_future_key = &co->epoch_data_keys_future[co->epoch_data_keys_future_count - 1];
+
+ ASSERT(co->epoch_key_recv.epoch == 1
+ || highest_future_key->epoch == co->epoch_key_recv.epoch);
+
+ /* free the keys that are not used anymore */
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ /* Keys in future keys are always epoch > 1 if initialised */
+ if (co->epoch_data_keys_future[i].epoch > 0
+ && co->epoch_data_keys_future[i].epoch < current_epoch_recv)
+ {
+ /* Key is old, free it */
+ free_key_ctx(&co->epoch_data_keys_future[i]);
+ }
+ }
+
+ /* Calculate the number of keys that need to be generated,
+ * if no keys have been generated assume only the first key is defined */
+ uint16_t current_highest_key = highest_future_key->epoch ? highest_future_key->epoch : 1;
+ uint16_t desired_highest_key = current_epoch_recv + co->epoch_data_keys_future_count;
+ uint16_t num_keys_generate = desired_highest_key - current_highest_key;
+
+
+ /* Move the old keys out of the way so the order of keys stays strictly
+ * monotonic and consecutive. */
+ /* first check that the destination we are going to overwrite is freed */
+ for (uint16_t i = 0; i < num_keys_generate; i++)
+ {
+ ASSERT(co->epoch_data_keys_future[i].epoch == 0);
+ }
+ memmove(co->epoch_data_keys_future,
+ co->epoch_data_keys_future + num_keys_generate,
+ (co->epoch_data_keys_future_count - num_keys_generate) * sizeof(struct key_ctx));
+
+ /* Clear and regenerate the array elements at the end */
+ for (uint16_t i = co->epoch_data_keys_future_count - num_keys_generate; i < co->epoch_data_keys_future_count; i++)
+ {
+ CLEAR(co->epoch_data_keys_future[i]);
+ epoch_key_iterate(&co->epoch_key_recv);
+
+ epoch_init_recv_key(&co->epoch_data_keys_future[i], co);
+ }
+
+ /* Assert that all keys are initialised */
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ ASSERT(co->epoch_data_keys_future[i].epoch > 0);
+ }
+}
+
+void
+epoch_iterate_send_key(struct crypto_options *co)
+{
+ ASSERT(co->epoch_key_send.epoch < UINT16_MAX);
+ epoch_key_iterate(&co->epoch_key_send);
+ free_key_ctx(&co->key_ctx_bi.encrypt);
+ epoch_init_send_key_ctx(co);
+}
+
+void
+epoch_replace_update_recv_key(struct crypto_options *co,
+ uint16_t new_epoch)
+{
+ /* Find the key of the new epoch in future keys */
+ uint16_t fki;
+ for (fki = 0; fki < co->epoch_data_keys_future_count; fki++)
+ {
+ if (co->epoch_data_keys_future[fki].epoch == new_epoch)
+ {
+ break;
+ }
+ }
+ /* we should only ever be called when we successfully decrypted/authenticated
+ * a packet from a peer, ie the epoch recv key *MUST* be in that
+ * array */
+ ASSERT(fki < co->epoch_data_keys_future_count);
+ ASSERT(co->epoch_data_keys_future[fki].epoch == new_epoch);
+
+ struct key_ctx *new_ctx = &co->epoch_data_keys_future[fki];
+
+ /* Check if the new recv key epoch is higher than the send key epoch. If
+ * yes we will replace the send key as well */
+ if (co->key_ctx_bi.encrypt.epoch < new_epoch)
+ {
+ free_key_ctx(&co->key_ctx_bi.encrypt);
+
+ /* Update the epoch_key for send to match the current key being used.
+ * This is a bit of extra work but since we are a maximum of 16
+ * keys behind, a maximum 16 HMAC invocations are a small price to
+ * pay for not keeping all the old epoch keys around in future_keys
+ * array */
+ while (co->epoch_key_send.epoch < new_epoch)
+ {
+ epoch_key_iterate(&co->epoch_key_send);
+ }
+ epoch_init_send_key_ctx(co);
+ }
+
+ /* Replace receive key */
+ free_key_ctx(&co->epoch_retiring_data_receive_key);
+ co->epoch_retiring_data_receive_key = co->key_ctx_bi.decrypt;
+ packet_id_move_recv(&co->epoch_retiring_key_pid_recv, &co->packet_id.rec);
+
+ co->key_ctx_bi.decrypt = *new_ctx;
+
+ /* Zero the old location instead to of free_key_ctx since we moved the keys
+ * and do not want to free the pointers in the old place */
+ memset(new_ctx, 0, sizeof(struct key_ctx));
+
+ /* Generate new future keys */
+ epoch_generate_future_receive_keys(co);
+}
+
+void
+free_epoch_key_ctx(struct crypto_options *co)
+{
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ free_key_ctx(&co->epoch_data_keys_future[i]);
+ }
+
+ free(co->epoch_data_keys_future);
+ free_key_ctx(&co->epoch_retiring_data_receive_key);
+ free(co->epoch_retiring_key_pid_recv.seq_list);
+ CLEAR(co->epoch_key_recv);
+ CLEAR(co->epoch_key_send);
+}
+
+void
+epoch_init_key_ctx(struct crypto_options *co, const struct key_type *key_type,
+ const struct epoch_key *e1_send,
+ const struct epoch_key *e1_recv,
+ uint16_t future_key_count)
+{
+ ASSERT(e1_send->epoch == 1 && e1_recv->epoch == 1);
+ co->epoch_key_recv = *e1_recv;
+ co->epoch_key_send = *e1_send;
+
+ co->epoch_key_type = *key_type;
+ co->aead_usage_limit = cipher_get_aead_limits(key_type->cipher);
+
+ epoch_init_send_key_ctx(co);
+ epoch_init_recv_key(&co->key_ctx_bi.decrypt, co);
+ co->key_ctx_bi.initialized = true;
+
+ co->epoch_data_keys_future_count = future_key_count;
+ ALLOC_ARRAY_CLEAR(co->epoch_data_keys_future, struct key_ctx, co->epoch_data_keys_future_count);
+ epoch_generate_future_receive_keys(co);
+}
+
+const struct key_ctx *
+epoch_lookup_decrypt_key(struct crypto_options *opt, uint16_t epoch)
+{
+ /* Current decrypt key is the most likely one */
+ if (opt->key_ctx_bi.decrypt.epoch == epoch)
+ {
+ return &opt->key_ctx_bi.decrypt;
+ }
+ else if (opt->epoch_retiring_data_receive_key.epoch
+ && opt->epoch_retiring_data_receive_key.epoch == epoch)
+ {
+ return &opt->epoch_retiring_data_receive_key;
+ }
+ else if (epoch > opt->key_ctx_bi.decrypt.epoch
+ && epoch <= opt->key_ctx_bi.decrypt.epoch + opt->epoch_data_keys_future_count)
+ {
+ /* Key in the range of future keys */
+ int index = epoch - (opt->key_ctx_bi.decrypt.epoch + 1);
+
+ /* If we have reached the edge of the valid keys we do not return
+ * the key anymore since regenerating the new keys would move us
+ * over the window of valid keys and would need all kind of
+ * special casing, so we stop returning the key in this case */
+ if (epoch > (UINT16_MAX - opt->epoch_data_keys_future_count - 1))
+ {
+ return NULL;
+ }
+ else
+ {
+ return &opt->epoch_data_keys_future[index];
+ }
+ }
+ else
+ {
+ return NULL;
+ }
+}
+
+
+void
+epoch_check_send_iterate(struct crypto_options *opt)
+{
+ if (opt->epoch_key_send.epoch == UINT16_MAX)
+ {
+ /* limit of epoch keys reached, cannot move to a newer key anymore */
+ return;
+ }
+ if (opt->aead_usage_limit)
+ {
+ if (aead_usage_limit_reached(opt->aead_usage_limit, &opt->key_ctx_bi.encrypt,
+ opt->packet_id.send.id))
+ {
+ /* Send key limit reached */
+ epoch_iterate_send_key(opt);
+ }
+ /* draft 8 of the aead usage limit still had but draft 9 complete
+ * dropped this statement:
+ *
+ * In particular, is two-party communication, one participant cannot
+ * regard apparent overuse of a key by other participants as
+ * being in error, when it could be that the other participant has
+ * better information about bounds.
+ *
+ * OpenVPN 2.x implements a compromise of not regarding this as an
+ * error but still accepting packets of the usage limit but tries to
+ * push the peer to a new epoch key by increasing our own key epoch
+ * */
+ else if (opt->key_ctx_bi.encrypt.epoch == opt->key_ctx_bi.decrypt.epoch
+ && aead_usage_limit_reached(opt->aead_usage_limit,
+ &opt->key_ctx_bi.decrypt,
+ opt->packet_id.rec.id))
+ {
+ /* Receive key limit reached. Increase our own send key to signal
+ * that we want to use a new epoch. Peer should then also move its
+ * key but is not required to do this */
+ epoch_iterate_send_key(opt);
+ }
+ }
+
+ if (opt->packet_id.send.id == PACKET_ID_EPOCH_MAX)
+ {
+ epoch_iterate_send_key(opt);
+ }
+
+}
diff --git a/src/openvpn/crypto_epoch.h b/src/openvpn/crypto_epoch.h
index e5d0e5d..6baf807 100644
--- a/src/openvpn/crypto_epoch.h
+++ b/src/openvpn/crypto_epoch.h
@@ -67,4 +67,81 @@
const uint8_t *context, size_t context_len,
uint8_t *out, uint16_t out_len);
-#endif
+/**
+ * Generate a data channel key pair from the epoch key
+ * @param epoch_key Epoch key to be used
+ * @param key Destination for the generated data key
+ * @parm kt Cipher information to generate the data channel key for
+ */
+void
+epoch_data_key_derive(struct key_parameters *key,
+ const struct epoch_key *epoch_key,
+ const struct key_type *kt);
+
+/**
+ * Generates and fills the epoch_data_keys_future with next valid
+ * future keys in crypto_options
+ *
+ * This assume that the normal key_ctx_bi and epoch keys are already setup
+ */
+void
+epoch_generate_future_receive_keys(struct crypto_options *co);
+
+
+/** This is called when the peer using a new send key that is not the default
+ * key. This function ensures the following:
+ * - recv key matches the epoch index provided
+ * - send key epoch is equal or higher than recv_key epoch
+ *
+ * @param new_epoch the new epoch to use a the receive key
+ */
+void
+epoch_replace_update_recv_key(struct crypto_options *co,
+ uint16_t new_epoch);
+
+/**
+ * Updates the send key and send_epoch_keyt in cryptio_options->key_ctx_bi to
+ * use the next epoch */
+void
+epoch_iterate_send_key(struct crypto_options *co);
+
+/**
+ * Frees the extra data structures used by epoch keys in \c crypto_options
+ */
+void
+free_epoch_key_ctx(struct crypto_options *co);
+
+/**
+ * Initialises data channel keys and internal structures for epoch data keys
+ * using the provided E0 epoch key
+ *
+ * @param e1_send The E1 send epoch key derived by TLS-EKM
+ * @param e1_recv The E1 receive epoch key derived by TLS-EKM
+ */
+void
+epoch_init_key_ctx(struct crypto_options *co, const struct key_type *key_type,
+ const struct epoch_key *e1_send, const struct epoch_key *e1_recv,
+ uint16_t future_key_count);
+
+/**
+ * Using an epoch, this function will try to retrieve a decryption
+ * key context that matches that epoch from the \c opt argument
+ * @param opt crypto_options to use to find the decrypt key
+ * @param epoch epoch of the key to lookup
+ * @return the key context with
+ */
+const struct key_ctx *
+epoch_lookup_decrypt_key(struct crypto_options *opt, uint16_t epoch);
+
+/**
+ * Checks if we need to iterate the send epoch key. This needs to be in one
+ * of the following condition
+ * - max epoch counter reached
+ * - send key aead usage limit reached (for AES-GCM and similar ciphers)
+ * - recv key usage limit reached
+ */
+void
+epoch_check_send_iterate(struct crypto_options *opt);
+
+
+#endif /* ifndef CRYPTO_EPOCH_H */
diff --git a/src/openvpn/packet_id.c b/src/openvpn/packet_id.c
index 8cde108..177391a 100644
--- a/src/openvpn/packet_id.c
+++ b/src/openvpn/packet_id.c
@@ -78,6 +78,21 @@
}
void
+packet_id_init_recv(struct packet_id_rec *rec, int seq_backtrack, int time_backtrack, const char *name, int unit)
+{
+ rec->name = name;
+ rec->unit = unit;
+ if (seq_backtrack)
+ {
+ ASSERT(MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
+ ASSERT(MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
+ CIRC_LIST_ALLOC(rec->seq_list, struct seq_list, seq_backtrack);
+ rec->seq_backtrack = seq_backtrack;
+ rec->time_backtrack = time_backtrack;
+ }
+ rec->initialized = true;
+}
+void
packet_id_init(struct packet_id *p, int seq_backtrack, int time_backtrack, const char *name, int unit)
{
dmsg(D_PID_DEBUG, "PID packet_id_init seq_backtrack=%d time_backtrack=%d",
@@ -87,17 +102,25 @@
ASSERT(p);
CLEAR(*p);
- p->rec.name = name;
- p->rec.unit = unit;
- if (seq_backtrack)
- {
- ASSERT(MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
- ASSERT(MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
- CIRC_LIST_ALLOC(p->rec.seq_list, struct seq_list, seq_backtrack);
- p->rec.seq_backtrack = seq_backtrack;
- p->rec.time_backtrack = time_backtrack;
- }
- p->rec.initialized = true;
+ packet_id_init_recv(&p->rec, seq_backtrack, time_backtrack, name, unit);
+}
+
+void
+packet_id_move_recv(struct packet_id_rec *dest, struct packet_id_rec *src)
+{
+ ASSERT(src);
+ ASSERT(dest);
+ /* clear free any old data in rec list */
+ free(dest->seq_list);
+ CLEAR(*dest);
+
+ /* Copy data to dest */
+ *dest = *src;
+
+ /* Reinitalise the source */
+ CLEAR(*src);
+ packet_id_init_recv(src, dest->seq_backtrack, dest->time_backtrack,
+ dest->name, dest->unit);
}
void
diff --git a/src/openvpn/packet_id.h b/src/openvpn/packet_id.h
index 79224d2..7620ce5 100644
--- a/src/openvpn/packet_id.h
+++ b/src/openvpn/packet_id.h
@@ -203,6 +203,15 @@
void packet_id_free(struct packet_id *p);
+/**
+ * Move the packet id recv structure from src to dest. src will will
+ * be reinitialised with
+ * @param dest
+ * @param src
+ */
+void
+packet_id_move_recv(struct packet_id_rec *dest, struct packet_id_rec *src);
+
/* should we accept an incoming packet id ? */
bool packet_id_test(struct packet_id_rec *p,
const struct packet_id_net *pin);
diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h
index ce1cd9e..511127d 100644
--- a/src/openvpn/ssl_common.h
+++ b/src/openvpn/ssl_common.h
@@ -333,8 +333,8 @@
interval_t packet_timeout;
int64_t renegotiate_bytes;
int64_t renegotiate_packets;
- /** This limit for AEAD cipher, this is the sum of packets + blocks
- * that are allowed to be used */
+ /** This limit for AEAD cipher when not running in epoch data key mode,
+ * this is the sum of packets + blocks that are allowed to be used */
int64_t aead_usage_limit;
interval_t renegotiate_seconds;
diff --git a/tests/unit_tests/openvpn/test_crypto.c b/tests/unit_tests/openvpn/test_crypto.c
index a2073c2..313b6c1 100644
--- a/tests/unit_tests/openvpn/test_crypto.c
+++ b/tests/unit_tests/openvpn/test_crypto.c
@@ -611,7 +611,7 @@
0x90, 0xb6, 0xc7, 0x3b, 0xb5, 0x0f, 0x9c, 0x31,
0x22, 0xec, 0x84, 0x4a, 0xd7, 0xc2, 0xb3, 0xe5};
- const uint8_t *label = (const uint8_t *)("unit test");
+ const uint8_t *label = (const uint8_t *) ("unit test");
uint8_t out[16];
ovpn_expand_label(secret, sizeof(secret), label, 9, NULL, 0, out, sizeof(out));
@@ -705,9 +705,237 @@
}
#endif /* if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L */
+struct epoch_test_state
+{
+ struct key_type kt;
+ struct gc_arena gc;
+ struct crypto_options co;
+};
+
+static int
+crypto_test_epoch_setup(void **state)
+{
+ int *num_future_keys = (int *)*state;
+ struct epoch_test_state *data = calloc(1, sizeof(struct epoch_test_state));
+
+ data->gc = gc_new();
+
+ init_key_type(&data->kt, "AES-128-GCM", "none", true, false);
+
+ /* have an epoch key that is uses 0x23 for the key for all bytes */
+ struct epoch_key epoch1send = { .epoch = 1, .epoch_key = {0x23} };
+ struct epoch_key epoch1recv = { .epoch = 1, .epoch_key = {0x27} };
+
+ epoch_init_key_ctx(&data->co, &data->kt, &epoch1send,
+ &epoch1recv, *num_future_keys);
+
+ *state = data;
+ return 0;
+}
+
+static int
+crypto_test_epoch_teardown(void **state)
+{
+ struct epoch_test_state *data = *state;
+ free_epoch_key_ctx(&data->co);
+ free_key_ctx_bi(&data->co.key_ctx_bi);
+ gc_free(&data->gc);
+ free(*state);
+ return 0;
+}
+
+void
+crypto_test_epoch_key_generation(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* check the keys look like expect */
+ assert_int_equal(co->epoch_data_keys_future[0].epoch, 2);
+ assert_int_equal(co->epoch_data_keys_future[15].epoch, 17);
+ assert_int_equal(co->epoch_key_send.epoch, 1);
+ assert_int_equal(co->epoch_key_recv.epoch, 17);
+
+ /* Now replace the recv key with the 6th future key (epoch = 8) */
+ free_key_ctx(&co->key_ctx_bi.decrypt);
+ assert_int_equal(co->epoch_data_keys_future[6].epoch, 8);
+ co->key_ctx_bi.decrypt = co->epoch_data_keys_future[6];
+ CLEAR(co->epoch_data_keys_future[6]);
+
+ epoch_generate_future_receive_keys(co);
+ assert_int_equal(co->epoch_data_keys_future[0].epoch, 9);
+ assert_int_equal(co->epoch_data_keys_future[15].epoch, 24);
+}
+
+
+void
+crypto_test_epoch_key_rotation(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* should replace send + key recv */
+ epoch_replace_update_recv_key(co, 9);
+
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 9);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 9);
+ assert_int_equal(co->epoch_key_send.epoch, 9);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 1);
+
+ /* Iterate the data send key four times to get it to 13 */
+ for (int i = 0; i < 4; i++)
+ {
+ epoch_iterate_send_key(co);
+ }
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+
+ epoch_replace_update_recv_key(co, 10);
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 10);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+ assert_int_equal(co->epoch_key_send.epoch, 13);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 9);
+
+ epoch_replace_update_recv_key(co, 12);
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 12);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+ assert_int_equal(co->epoch_key_send.epoch, 13);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 10);
+
+ epoch_iterate_send_key(co);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 14);
+}
+
+void
+crypto_test_epoch_key_receive_lookup(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* lookup some wacky things that should fail */
+ assert_null(epoch_lookup_decrypt_key(co, 2000));
+ assert_null(epoch_lookup_decrypt_key(co, -1));
+ assert_null(epoch_lookup_decrypt_key(co, 0xefff));
+
+ /* Lookup the edges of the current window */
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 2)->epoch, 2);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 13)->epoch, 13);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 14)->epoch, 14);
+ assert_null(epoch_lookup_decrypt_key(co, 15));
+
+ /* Should move 1 to retiring key but leave 1-5 undefined, 7 as
+ * active and 8-20 as future keys*/
+ epoch_replace_update_recv_key(co, 7);
+
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
+ assert_null(epoch_lookup_decrypt_key(co, 2));
+ assert_null(epoch_lookup_decrypt_key(co, 3));
+ assert_null(epoch_lookup_decrypt_key(co, 4));
+ assert_null(epoch_lookup_decrypt_key(co, 5));
+ assert_null(epoch_lookup_decrypt_key(co, 6));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 7)->epoch, 7);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 8)->epoch, 8);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 20)->epoch, 20);
+ assert_null(epoch_lookup_decrypt_key(co, 21));
+ assert_null(epoch_lookup_decrypt_key(co, 22));
+
+
+ /* Should move 7 to retiring key and have 8 as active key and
+ * 9-21 as future keys */
+ epoch_replace_update_recv_key(co, 8);
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_null(epoch_lookup_decrypt_key(co, 1));
+ assert_null(epoch_lookup_decrypt_key(co, 2));
+ assert_null(epoch_lookup_decrypt_key(co, 3));
+ assert_null(epoch_lookup_decrypt_key(co, 4));
+ assert_null(epoch_lookup_decrypt_key(co, 5));
+ assert_null(epoch_lookup_decrypt_key(co, 6));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 7)->epoch, 7);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 8)->epoch, 8);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 20)->epoch, 20);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 21)->epoch, 21);
+ assert_null(epoch_lookup_decrypt_key(co, 22));
+ assert_null(epoch_lookup_decrypt_key(co, 23));
+}
+
+void
+crypto_test_epoch_key_overflow(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* Modify the receive epoch and keys to have a very high epoch to test
+ * the end of array. Iterating through all 16k keys takes a 2-3s, so we
+ * avoid this for the unit test */
+ co->key_ctx_bi.decrypt.epoch = 16000;
+ co->key_ctx_bi.encrypt.epoch = 16000;
+
+ co->epoch_key_send.epoch = 16000;
+ co->epoch_key_recv.epoch = 16000 + co->epoch_data_keys_future_count;
+
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ co->epoch_data_keys_future[i].epoch = 16001 + i;
+ }
+
+ /* Move the last few keys until we are close to the limit */
+ while (co->key_ctx_bi.decrypt.epoch < (UINT16_MAX - 40))
+ {
+ epoch_replace_update_recv_key(co, co->key_ctx_bi.decrypt.epoch + 10);
+ }
+
+ /* Looking up this key should still work as it will not break the limit
+ * when generating keys */
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 34)->epoch, UINT16_MAX - 34);
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 33)->epoch, UINT16_MAX - 33);
+
+ /* This key is no longer eligible for decrypting as the 32 future keys
+ * would be larger than uint16_t maximum */
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - 32));
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX));
+
+ /* Check that moving to the last possible epoch works */
+ epoch_replace_update_recv_key(co, UINT16_MAX - 33);
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 33)->epoch, UINT16_MAX - 33);
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - 32));
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX));
+}
+
+void
+epoch_test_derive_data_key(void **state)
+{
+ struct epoch_key e17 = { .epoch = 17, .epoch_key = { 19, 12 }};
+ struct key_type kt = { 0 };
+ struct key_parameters key_parameters = { 0 };
+ init_key_type(&kt, "AES-192-GCM", "none", true, false);
+
+
+ epoch_data_key_derive(&key_parameters, &e17, &kt);
+
+ assert_int_equal(key_parameters.cipher_size, 24);
+ assert_int_equal(key_parameters.hmac_size, 12);
+
+ uint8_t exp_cipherkey[24] =
+ {0xed, 0x85, 0x33, 0xdb, 0x1c, 0x28, 0xac, 0xe4,
+ 0x18, 0xe9, 0x00, 0x6a, 0xb2, 0x9c, 0x17, 0x41,
+ 0x7d, 0x60, 0xeb, 0xe6, 0xcd, 0x90, 0xbf, 0x0a};
+
+ uint8_t exp_impl_iv[12] =
+ {0x86, 0x89, 0x0a, 0xab, 0xf0, 0x32, 0xcb, 0x59, 0xf4, 0xcf, 0xa3, 0x4e};
+
+ assert_memory_equal(key_parameters.cipher, exp_cipherkey, sizeof(exp_cipherkey));
+ assert_memory_equal(key_parameters.hmac, exp_impl_iv, sizeof(exp_impl_iv));
+}
+
int
main(void)
{
+ int prestate_num13 = 13;
+ int prestate_num16 = 16;
+ int prestate_num32 = 32;
+
openvpn_unit_test_setup();
const struct CMUnitTest tests[] = {
cmocka_unit_test(crypto_pem_encode_decode_loopback),
@@ -722,8 +950,25 @@
cmocka_unit_test(crypto_test_hkdf_expand_testa3),
cmocka_unit_test(crypto_test_hkdf_expand_test_ovpn),
cmocka_unit_test(crypto_test_ovpn_label_expand),
- cmocka_unit_test(crypto_test_ovpn_expand_openssl3)
- };
+ cmocka_unit_test(crypto_test_ovpn_expand_openssl3),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_generation,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num16),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_rotation,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num13),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_receive_lookup,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num13),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_overflow,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num32),
+ cmocka_unit_test(epoch_test_derive_data_key)
+ };
#if defined(ENABLE_CRYPTO_OPENSSL)
OpenSSL_add_all_algorithms();
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/804?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Gerrit-Change-Number: 804
Gerrit-PatchSet: 5
Gerrit-Owner: plaisthos <arne-openvpn@...1227...>
Gerrit-Reviewer: flichtenheld <frank@...2641...>
Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net>
Gerrit-Attention: flichtenheld <frank@...2641...>
Gerrit-MessageType: newpatchset
[-- Attachment #2: Type: text/html, Size: 84301 bytes --]
^ permalink raw reply related [flat|nested] 14+ messages in thread* [Openvpn-devel] [L] Change in openvpn[master]: Implement methods to generate and manage OpenVPN Epoch keys
[not found] <gerrit.1731290343000.Id7d6a576ca8c9560cb2dfae82fc62175820e9b80@...2715...>
` (2 preceding siblings ...)
2024-11-22 16:29 ` plaisthos (Code Review)
@ 2024-11-30 13:38 ` plaisthos (Code Review)
2024-12-20 14:49 ` plaisthos (Code Review)
` (8 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: plaisthos (Code Review) @ 2024-11-30 13:38 UTC (permalink / raw)
To: flichtenheld <frank@; +Cc: openvpn-devel
[-- Attachment #1: Type: text/plain, Size: 38576 bytes --]
Attention is currently required from: flichtenheld.
Hello flichtenheld,
I'd like you to reexamine a change. Please visit
http://gerrit.openvpn.net/c/openvpn/+/804?usp=email
to look at the new patch set (#6).
Change subject: Implement methods to generate and manage OpenVPN Epoch keys
......................................................................
Implement methods to generate and manage OpenVPN Epoch keys
This implements functions that allow these keys to be generated and
managed. It does not yet implement using them for the data channel.
Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Signed-off-by: Arne Schwabe <arne@...1227...>
---
M src/openvpn/crypto.c
M src/openvpn/crypto.h
M src/openvpn/crypto_epoch.c
M src/openvpn/crypto_epoch.h
M src/openvpn/packet_id.c
M src/openvpn/packet_id.h
M src/openvpn/ssl_common.h
M tests/unit_tests/openvpn/test_crypto.c
8 files changed, 774 insertions(+), 21 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/04/804/6
diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
index 4b16630..4d6d83a 100644
--- a/src/openvpn/crypto.c
+++ b/src/openvpn/crypto.c
@@ -909,14 +909,27 @@
if (cipher_ctx_mode_aead(ctx->cipher))
{
size_t impl_iv_len = 0;
+ size_t impl_iv_offset = 0;
ASSERT(cipher_ctx_iv_length(ctx->cipher) >= OPENVPN_AEAD_MIN_IV_LEN);
- impl_iv_len = cipher_ctx_iv_length(ctx->cipher) - sizeof(packet_id_type);
+
+ /* Epoch keys use XOR of full IV length with the packet id to generate
+ * IVs. Old data format uses concatenation instead (XOR with 0 for the
+ * first 4 bytes (sizeof(packet_id_type) */
+ if (key->epoch)
+ {
+ impl_iv_len = cipher_ctx_iv_length(ctx->cipher);
+ impl_iv_offset = 0;
+ }
+ else
+ {
+ impl_iv_len = cipher_ctx_iv_length(ctx->cipher) - sizeof(packet_id_type);
+ impl_iv_offset = sizeof(packet_id_type);
+ }
ASSERT(impl_iv_len <= OPENVPN_MAX_IV_LENGTH);
ASSERT(impl_iv_len <= MAX_HMAC_KEY_LENGTH);
ASSERT(impl_iv_len <= key->hmac_size);
CLEAR(ctx->implicit_iv);
- /* The first bytes of the IV are filled with the packet id */
- memcpy(ctx->implicit_iv + sizeof(packet_id_type), key->hmac, impl_iv_len);
+ memcpy(ctx->implicit_iv + impl_iv_offset, key->hmac, impl_iv_len);
}
}
@@ -965,6 +978,7 @@
hmac_ctx_size(ctx->hmac));
}
+ ctx->epoch = key->epoch;
gc_free(&gc);
}
@@ -977,6 +991,7 @@
snprintf(log_prefix, sizeof(log_prefix), "Outgoing %s", name);
init_key_ctx(ctx, key_params, kt, OPENVPN_OP_ENCRYPT, log_prefix);
key_ctx_update_implicit_iv(ctx, key_params);
+ ctx->epoch = key_params->epoch;
}
void
@@ -988,6 +1003,7 @@
snprintf(log_prefix, sizeof(log_prefix), "Incoming %s", name);
init_key_ctx(ctx, key_params, kt, OPENVPN_OP_DECRYPT, log_prefix);
key_ctx_update_implicit_iv(ctx, key_params);
+ ctx->epoch = key_params->epoch;
}
void
@@ -1025,6 +1041,7 @@
}
CLEAR(ctx->implicit_iv);
ctx->plaintext_blocks = 0;
+ ctx->epoch = 0;
}
void
diff --git a/src/openvpn/crypto.h b/src/openvpn/crypto.h
index 726c07c..805bbf3 100644
--- a/src/openvpn/crypto.h
+++ b/src/openvpn/crypto.h
@@ -170,6 +170,9 @@
/** Number of bytes set in the HMac key material */
int hmac_size;
+
+ /** the epoch of the key is if it was generated as epoch data key material */
+ uint16_t epoch;
};
/**
@@ -180,6 +183,11 @@
void
key_parameters_from_key(struct key_parameters *key_params, const struct key *key);
+struct epoch_key {
+ uint8_t epoch_key[SHA256_DIGEST_LENGTH];
+ uint16_t epoch;
+};
+
/**
* Container for one set of cipher and/or HMAC contexts.
* @ingroup control_processor
@@ -206,6 +214,10 @@
* with the current key in number of 128 bit blocks (only used for
* AEAD ciphers) */
uint64_t plaintext_blocks;
+ /** OpenVPN data channel epoch, this variable holds the
+ * epoch number that is key belongs to. Note that epoch 0 is not used
+ * and epoch is always non-zero for epoch key contexts */
+ uint16_t epoch;
};
#define KEY_DIRECTION_BIDIRECTIONAL 0 /* same keys for both directions */
@@ -275,6 +287,39 @@
/**< OpenSSL cipher and HMAC contexts for
* both sending and receiving
* directions. */
+
+ /** last epoch_key used for generation of the current send data keys.
+ * As invariant, the epoch of epoch_key_send is always kept >= the epoch of
+ * epoch_key_recv */
+ struct epoch_key epoch_key_send;
+
+ /** epoch_key used for the highest receive epoch keys */
+ struct epoch_key epoch_key_recv;
+
+ /** the key_type that is used to generate the epoch keys */
+ struct key_type epoch_key_type;
+
+ /** This limit for AEAD cipher, this is the sum of packets + blocks
+ * that are allowed to be used. Will switch to a new epoch if this
+ * limit is reached*/
+ uint64_t aead_usage_limit;
+
+ /** Keeps the future epoch data keys for decryption. The current one
+ * that is expected to be used is stored in key_ctx_bi.
+ *
+ * We keep both decrypt and encrypt key here in the future keys
+ * as we want to be able to switch also sending key if the peer
+ * switching to a newer key epoch
+ * */
+ struct key_ctx *epoch_data_keys_future;
+
+ /** number of keys stored in \c epoch_data_keys_future */
+ uint16_t epoch_data_keys_future_count;
+
+ /** The old key bevor the sender switch to a new epoch data key */
+ struct key_ctx epoch_retiring_data_receive_key;
+ struct packet_id_rec epoch_retiring_key_pid_recv;
+
struct packet_id packet_id; /**< Current packet ID state for both
* sending and receiving directions.
*
@@ -283,7 +328,7 @@
*
* The packet id also used as the IV
* for AEAD/OFB/CFG ciphers.
- * */
+ */
struct packet_id_persist *pid_persist;
/**< Persistent packet ID state for
* keeping state between successive
@@ -471,13 +516,15 @@
*
* @param opt Crypto options for this packet, contains replay state.
* @param pin Packet ID read from packet.
+ * @param epoch Epoch read from packet or 0 when epoch is not used.
* @param error_prefix Prefix to use when printing error messages.
* @param gc Garbage collector to use.
*
* @return true if packet ID is validated to be not a replay, false otherwise.
*/
bool crypto_check_replay(struct crypto_options *opt,
- const struct packet_id_net *pin, const char *error_prefix,
+ const struct packet_id_net *pin,
+ const char *error_prefix,
struct gc_arena *gc);
diff --git a/src/openvpn/crypto_epoch.c b/src/openvpn/crypto_epoch.c
index 667e12a..d69f4d5 100644
--- a/src/openvpn/crypto_epoch.c
+++ b/src/openvpn/crypto_epoch.c
@@ -29,7 +29,13 @@
#endif
#include <inttypes.h>
+#include <string.h>
+#include <stdlib.h>
+
#include "crypto_backend.h"
+#include "packet_id.h"
+#include "crypto.h"
+#include "crypto_epoch.h"
#include "buffer.h"
#include "integer.h"
@@ -112,3 +118,332 @@
gc_free(&gc);
return true;
}
+
+/**
+ * Iterates the epoch key to make it E_n+1, ie increase the epoch by one
+ * and derive the new key material accordingly
+ * @param epoch_key epoch key to iterate
+ */
+static void
+epoch_key_iterate(struct epoch_key *epoch_key)
+{
+ struct epoch_key new_epoch_key = { 0 };
+ new_epoch_key.epoch = epoch_key->epoch + 1;
+ const uint8_t epoch_update_label[] = "datakey upd";
+
+ /* E_N+1 = OVPN-Expand-Label(E_N, "datakey upd", "", 32) */
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_update_label, 11,
+ NULL, 0,
+ new_epoch_key.epoch_key, sizeof(new_epoch_key.epoch_key));
+ *epoch_key = new_epoch_key;
+}
+
+void
+epoch_data_key_derive(struct key_parameters *key,
+ const struct epoch_key *epoch_key,
+ const struct key_type *kt)
+{
+ key->hmac_size = cipher_kt_iv_size(kt->cipher);
+ key->cipher_size = cipher_kt_key_size(kt->cipher);
+
+ /* Generate data key from epoch key:
+ * K_i = OVPN-Expand-Label(E_i, "data_key", "", key_size)
+ * implicit_iv = OVPN-Expand-Label(E_i, "data_iv", "", implicit_iv_len)
+ */
+
+ const uint8_t epoch_data_key_label[] = "data_key";
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_data_key_label, 8,
+ NULL, 0,
+ (uint8_t *)(&key->cipher), key->cipher_size);
+
+ const uint8_t epoch_data_iv_label[] = "data_iv";
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_data_iv_label, 7,
+ NULL, 0,
+ (uint8_t *)(&key->hmac), key->hmac_size);
+ key->epoch = epoch_key->epoch;
+}
+
+static void
+epoch_init_send_key_ctx(struct crypto_options *co)
+{
+ /* Ensure that we are NEVER regenerating the same key that has already
+ * been generated. Since we also reset the packet ID counter this would be
+ * catastrophic as we would do IV reuse which breaks ciphers like AES-GCM */
+ ASSERT(co->key_ctx_bi.encrypt.epoch != co->epoch_key_send.epoch);
+ char name[32] = { 0 };
+ snprintf(name, sizeof(name), "Epoch Data key %" PRIu16, co->epoch_key_send.epoch);
+
+ struct key_parameters send_key = { 0 };
+
+ epoch_data_key_derive(&send_key, &co->epoch_key_send, &co->epoch_key_type);
+
+ init_key_bi_ctx_send(&co->key_ctx_bi.encrypt, &send_key,
+ &co->epoch_key_type, name);
+ reset_packet_id_send(&co->packet_id.send);
+ CLEAR(send_key);
+}
+
+
+static void
+epoch_init_recv_key(struct key_ctx *ctx, struct crypto_options *co)
+{
+ struct key_parameters recv_key = { 0 };
+ epoch_data_key_derive(&recv_key, &co->epoch_key_recv, &co->epoch_key_type);
+
+ char name[32];
+
+ snprintf(name, sizeof(name), "Epoch Data key %" PRIu16, co->epoch_key_recv.epoch);
+
+ init_key_bi_ctx_recv(ctx, &recv_key, &co->epoch_key_type, name);
+ CLEAR(recv_key);
+}
+
+void
+epoch_generate_future_receive_keys(struct crypto_options *co)
+{
+ /* We want the number of receive keys starting with the currently used
+ * keys. */
+ ASSERT(co->key_ctx_bi.initialized);
+ uint16_t current_epoch_recv = co->key_ctx_bi.decrypt.epoch;
+
+ /* Either we have not generated any future keys yet or the last
+ * index is the same as our current epoch key */
+ struct key_ctx *highest_future_key = &co->epoch_data_keys_future[co->epoch_data_keys_future_count - 1];
+
+ ASSERT(co->epoch_key_recv.epoch == 1
+ || highest_future_key->epoch == co->epoch_key_recv.epoch);
+
+ /* free the keys that are not used anymore */
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ /* Keys in future keys are always epoch > 1 if initialised */
+ if (co->epoch_data_keys_future[i].epoch > 0
+ && co->epoch_data_keys_future[i].epoch < current_epoch_recv)
+ {
+ /* Key is old, free it */
+ free_key_ctx(&co->epoch_data_keys_future[i]);
+ }
+ }
+
+ /* Calculate the number of keys that need to be generated,
+ * if no keys have been generated assume only the first key is defined */
+ uint16_t current_highest_key = highest_future_key->epoch ? highest_future_key->epoch : 1;
+ uint16_t desired_highest_key = current_epoch_recv + co->epoch_data_keys_future_count;
+ uint16_t num_keys_generate = desired_highest_key - current_highest_key;
+
+
+ /* Move the old keys out of the way so the order of keys stays strictly
+ * monotonic and consecutive. */
+ /* first check that the destination we are going to overwrite is freed */
+ for (uint16_t i = 0; i < num_keys_generate; i++)
+ {
+ ASSERT(co->epoch_data_keys_future[i].epoch == 0);
+ }
+ memmove(co->epoch_data_keys_future,
+ co->epoch_data_keys_future + num_keys_generate,
+ (co->epoch_data_keys_future_count - num_keys_generate) * sizeof(struct key_ctx));
+
+ /* Clear and regenerate the array elements at the end */
+ for (uint16_t i = co->epoch_data_keys_future_count - num_keys_generate; i < co->epoch_data_keys_future_count; i++)
+ {
+ CLEAR(co->epoch_data_keys_future[i]);
+ epoch_key_iterate(&co->epoch_key_recv);
+
+ epoch_init_recv_key(&co->epoch_data_keys_future[i], co);
+ }
+
+ /* Assert that all keys are initialised */
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ ASSERT(co->epoch_data_keys_future[i].epoch > 0);
+ }
+}
+
+void
+epoch_iterate_send_key(struct crypto_options *co)
+{
+ ASSERT(co->epoch_key_send.epoch < UINT16_MAX);
+ epoch_key_iterate(&co->epoch_key_send);
+ free_key_ctx(&co->key_ctx_bi.encrypt);
+ epoch_init_send_key_ctx(co);
+}
+
+void
+epoch_replace_update_recv_key(struct crypto_options *co,
+ uint16_t new_epoch)
+{
+ /* Find the key of the new epoch in future keys */
+ uint16_t fki;
+ for (fki = 0; fki < co->epoch_data_keys_future_count; fki++)
+ {
+ if (co->epoch_data_keys_future[fki].epoch == new_epoch)
+ {
+ break;
+ }
+ }
+ /* we should only ever be called when we successfully decrypted/authenticated
+ * a packet from a peer, ie the epoch recv key *MUST* be in that
+ * array */
+ ASSERT(fki < co->epoch_data_keys_future_count);
+ ASSERT(co->epoch_data_keys_future[fki].epoch == new_epoch);
+
+ struct key_ctx *new_ctx = &co->epoch_data_keys_future[fki];
+
+ /* Check if the new recv key epoch is higher than the send key epoch. If
+ * yes we will replace the send key as well */
+ if (co->key_ctx_bi.encrypt.epoch < new_epoch)
+ {
+ free_key_ctx(&co->key_ctx_bi.encrypt);
+
+ /* Update the epoch_key for send to match the current key being used.
+ * This is a bit of extra work but since we are a maximum of 16
+ * keys behind, a maximum 16 HMAC invocations are a small price to
+ * pay for not keeping all the old epoch keys around in future_keys
+ * array */
+ while (co->epoch_key_send.epoch < new_epoch)
+ {
+ epoch_key_iterate(&co->epoch_key_send);
+ }
+ epoch_init_send_key_ctx(co);
+ }
+
+ /* Replace receive key */
+ free_key_ctx(&co->epoch_retiring_data_receive_key);
+ co->epoch_retiring_data_receive_key = co->key_ctx_bi.decrypt;
+ packet_id_move_recv(&co->epoch_retiring_key_pid_recv, &co->packet_id.rec);
+
+ co->key_ctx_bi.decrypt = *new_ctx;
+
+ /* Zero the old location instead to of free_key_ctx since we moved the keys
+ * and do not want to free the pointers in the old place */
+ memset(new_ctx, 0, sizeof(struct key_ctx));
+
+ /* Generate new future keys */
+ epoch_generate_future_receive_keys(co);
+}
+
+void
+free_epoch_key_ctx(struct crypto_options *co)
+{
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ free_key_ctx(&co->epoch_data_keys_future[i]);
+ }
+
+ free(co->epoch_data_keys_future);
+ free_key_ctx(&co->epoch_retiring_data_receive_key);
+ free(co->epoch_retiring_key_pid_recv.seq_list);
+ CLEAR(co->epoch_key_recv);
+ CLEAR(co->epoch_key_send);
+}
+
+void
+epoch_init_key_ctx(struct crypto_options *co, const struct key_type *key_type,
+ const struct epoch_key *e1_send,
+ const struct epoch_key *e1_recv,
+ uint16_t future_key_count)
+{
+ ASSERT(e1_send->epoch == 1 && e1_recv->epoch == 1);
+ co->epoch_key_recv = *e1_recv;
+ co->epoch_key_send = *e1_send;
+
+ co->epoch_key_type = *key_type;
+ co->aead_usage_limit = cipher_get_aead_limits(key_type->cipher);
+
+ epoch_init_send_key_ctx(co);
+ epoch_init_recv_key(&co->key_ctx_bi.decrypt, co);
+ co->key_ctx_bi.initialized = true;
+
+ co->epoch_data_keys_future_count = future_key_count;
+ ALLOC_ARRAY_CLEAR(co->epoch_data_keys_future, struct key_ctx, co->epoch_data_keys_future_count);
+ epoch_generate_future_receive_keys(co);
+}
+
+const struct key_ctx *
+epoch_lookup_decrypt_key(struct crypto_options *opt, uint16_t epoch)
+{
+ /* Current decrypt key is the most likely one */
+ if (opt->key_ctx_bi.decrypt.epoch == epoch)
+ {
+ return &opt->key_ctx_bi.decrypt;
+ }
+ else if (opt->epoch_retiring_data_receive_key.epoch
+ && opt->epoch_retiring_data_receive_key.epoch == epoch)
+ {
+ return &opt->epoch_retiring_data_receive_key;
+ }
+ else if (epoch > opt->key_ctx_bi.decrypt.epoch
+ && epoch <= opt->key_ctx_bi.decrypt.epoch + opt->epoch_data_keys_future_count)
+ {
+ /* Key in the range of future keys */
+ int index = epoch - (opt->key_ctx_bi.decrypt.epoch + 1);
+
+ /* If we have reached the edge of the valid keys we do not return
+ * the key anymore since regenerating the new keys would move us
+ * over the window of valid keys and would need all kind of
+ * special casing, so we stop returning the key in this case */
+ if (epoch > (UINT16_MAX - opt->epoch_data_keys_future_count - 1))
+ {
+ return NULL;
+ }
+ else
+ {
+ return &opt->epoch_data_keys_future[index];
+ }
+ }
+ else
+ {
+ return NULL;
+ }
+}
+
+
+void
+epoch_check_send_iterate(struct crypto_options *opt)
+{
+ if (opt->epoch_key_send.epoch == UINT16_MAX)
+ {
+ /* limit of epoch keys reached, cannot move to a newer key anymore */
+ return;
+ }
+ if (opt->aead_usage_limit)
+ {
+ if (aead_usage_limit_reached(opt->aead_usage_limit, &opt->key_ctx_bi.encrypt,
+ opt->packet_id.send.id))
+ {
+ /* Send key limit reached */
+ epoch_iterate_send_key(opt);
+ }
+ /* draft 8 of the aead usage limit still had but draft 9 complete
+ * dropped this statement:
+ *
+ * In particular, is two-party communication, one participant cannot
+ * regard apparent overuse of a key by other participants as
+ * being in error, when it could be that the other participant has
+ * better information about bounds.
+ *
+ * OpenVPN 2.x implements a compromise of not regarding this as an
+ * error but still accepting packets of the usage limit but tries to
+ * push the peer to a new epoch key by increasing our own key epoch
+ * */
+ else if (opt->key_ctx_bi.encrypt.epoch == opt->key_ctx_bi.decrypt.epoch
+ && aead_usage_limit_reached(opt->aead_usage_limit,
+ &opt->key_ctx_bi.decrypt,
+ opt->packet_id.rec.id))
+ {
+ /* Receive key limit reached. Increase our own send key to signal
+ * that we want to use a new epoch. Peer should then also move its
+ * key but is not required to do this */
+ epoch_iterate_send_key(opt);
+ }
+ }
+
+ if (opt->packet_id.send.id == PACKET_ID_EPOCH_MAX)
+ {
+ epoch_iterate_send_key(opt);
+ }
+
+}
diff --git a/src/openvpn/crypto_epoch.h b/src/openvpn/crypto_epoch.h
index e5d0e5d..6baf807 100644
--- a/src/openvpn/crypto_epoch.h
+++ b/src/openvpn/crypto_epoch.h
@@ -67,4 +67,81 @@
const uint8_t *context, size_t context_len,
uint8_t *out, uint16_t out_len);
-#endif
+/**
+ * Generate a data channel key pair from the epoch key
+ * @param epoch_key Epoch key to be used
+ * @param key Destination for the generated data key
+ * @parm kt Cipher information to generate the data channel key for
+ */
+void
+epoch_data_key_derive(struct key_parameters *key,
+ const struct epoch_key *epoch_key,
+ const struct key_type *kt);
+
+/**
+ * Generates and fills the epoch_data_keys_future with next valid
+ * future keys in crypto_options
+ *
+ * This assume that the normal key_ctx_bi and epoch keys are already setup
+ */
+void
+epoch_generate_future_receive_keys(struct crypto_options *co);
+
+
+/** This is called when the peer using a new send key that is not the default
+ * key. This function ensures the following:
+ * - recv key matches the epoch index provided
+ * - send key epoch is equal or higher than recv_key epoch
+ *
+ * @param new_epoch the new epoch to use a the receive key
+ */
+void
+epoch_replace_update_recv_key(struct crypto_options *co,
+ uint16_t new_epoch);
+
+/**
+ * Updates the send key and send_epoch_keyt in cryptio_options->key_ctx_bi to
+ * use the next epoch */
+void
+epoch_iterate_send_key(struct crypto_options *co);
+
+/**
+ * Frees the extra data structures used by epoch keys in \c crypto_options
+ */
+void
+free_epoch_key_ctx(struct crypto_options *co);
+
+/**
+ * Initialises data channel keys and internal structures for epoch data keys
+ * using the provided E0 epoch key
+ *
+ * @param e1_send The E1 send epoch key derived by TLS-EKM
+ * @param e1_recv The E1 receive epoch key derived by TLS-EKM
+ */
+void
+epoch_init_key_ctx(struct crypto_options *co, const struct key_type *key_type,
+ const struct epoch_key *e1_send, const struct epoch_key *e1_recv,
+ uint16_t future_key_count);
+
+/**
+ * Using an epoch, this function will try to retrieve a decryption
+ * key context that matches that epoch from the \c opt argument
+ * @param opt crypto_options to use to find the decrypt key
+ * @param epoch epoch of the key to lookup
+ * @return the key context with
+ */
+const struct key_ctx *
+epoch_lookup_decrypt_key(struct crypto_options *opt, uint16_t epoch);
+
+/**
+ * Checks if we need to iterate the send epoch key. This needs to be in one
+ * of the following condition
+ * - max epoch counter reached
+ * - send key aead usage limit reached (for AES-GCM and similar ciphers)
+ * - recv key usage limit reached
+ */
+void
+epoch_check_send_iterate(struct crypto_options *opt);
+
+
+#endif /* ifndef CRYPTO_EPOCH_H */
diff --git a/src/openvpn/packet_id.c b/src/openvpn/packet_id.c
index e3a29f5..9fc4554 100644
--- a/src/openvpn/packet_id.c
+++ b/src/openvpn/packet_id.c
@@ -78,6 +78,21 @@
}
void
+packet_id_init_recv(struct packet_id_rec *rec, int seq_backtrack, int time_backtrack, const char *name, int unit)
+{
+ rec->name = name;
+ rec->unit = unit;
+ if (seq_backtrack)
+ {
+ ASSERT(MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
+ ASSERT(MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
+ CIRC_LIST_ALLOC(rec->seq_list, struct seq_list, seq_backtrack);
+ rec->seq_backtrack = seq_backtrack;
+ rec->time_backtrack = time_backtrack;
+ }
+ rec->initialized = true;
+}
+void
packet_id_init(struct packet_id *p, int seq_backtrack, int time_backtrack, const char *name, int unit)
{
dmsg(D_PID_DEBUG, "PID packet_id_init seq_backtrack=%d time_backtrack=%d",
@@ -87,17 +102,25 @@
ASSERT(p);
CLEAR(*p);
- p->rec.name = name;
- p->rec.unit = unit;
- if (seq_backtrack)
- {
- ASSERT(MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
- ASSERT(MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
- CIRC_LIST_ALLOC(p->rec.seq_list, struct seq_list, seq_backtrack);
- p->rec.seq_backtrack = seq_backtrack;
- p->rec.time_backtrack = time_backtrack;
- }
- p->rec.initialized = true;
+ packet_id_init_recv(&p->rec, seq_backtrack, time_backtrack, name, unit);
+}
+
+void
+packet_id_move_recv(struct packet_id_rec *dest, struct packet_id_rec *src)
+{
+ ASSERT(src);
+ ASSERT(dest);
+ /* clear free any old data in rec list */
+ free(dest->seq_list);
+ CLEAR(*dest);
+
+ /* Copy data to dest */
+ *dest = *src;
+
+ /* Reinitalise the source */
+ CLEAR(*src);
+ packet_id_init_recv(src, dest->seq_backtrack, dest->time_backtrack,
+ dest->name, dest->unit);
}
void
diff --git a/src/openvpn/packet_id.h b/src/openvpn/packet_id.h
index f6b1463..a6d49b6 100644
--- a/src/openvpn/packet_id.h
+++ b/src/openvpn/packet_id.h
@@ -205,6 +205,15 @@
void packet_id_free(struct packet_id *p);
+/**
+ * Move the packet id recv structure from src to dest. src will will
+ * be reinitialised with
+ * @param dest
+ * @param src
+ */
+void
+packet_id_move_recv(struct packet_id_rec *dest, struct packet_id_rec *src);
+
/* should we accept an incoming packet id ? */
bool packet_id_test(struct packet_id_rec *p,
const struct packet_id_net *pin);
diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h
index ced5299..77aef4f 100644
--- a/src/openvpn/ssl_common.h
+++ b/src/openvpn/ssl_common.h
@@ -333,8 +333,8 @@
interval_t packet_timeout;
int64_t renegotiate_bytes;
int64_t renegotiate_packets;
- /** limit for AEAD cipher, this is the sum of packets + blocks
- * that are allowed to be used */
+ /** limit for AEAD cipher when not running in epoch data key mode,
+ * this is the sum of packets + blocks that are allowed to be used */
int64_t aead_usage_limit;
interval_t renegotiate_seconds;
diff --git a/tests/unit_tests/openvpn/test_crypto.c b/tests/unit_tests/openvpn/test_crypto.c
index 5deb8eb..e9b01c2 100644
--- a/tests/unit_tests/openvpn/test_crypto.c
+++ b/tests/unit_tests/openvpn/test_crypto.c
@@ -613,7 +613,7 @@
0x90, 0xb6, 0xc7, 0x3b, 0xb5, 0x0f, 0x9c, 0x31,
0x22, 0xec, 0x84, 0x4a, 0xd7, 0xc2, 0xb3, 0xe5};
- const uint8_t *label = (const uint8_t *)("unit test");
+ const uint8_t *label = (const uint8_t *) ("unit test");
uint8_t out[16];
ovpn_expand_label(secret, sizeof(secret), label, 9, NULL, 0, out, sizeof(out));
@@ -707,9 +707,237 @@
}
#endif /* if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L */
+struct epoch_test_state
+{
+ struct key_type kt;
+ struct gc_arena gc;
+ struct crypto_options co;
+};
+
+static int
+crypto_test_epoch_setup(void **state)
+{
+ int *num_future_keys = (int *)*state;
+ struct epoch_test_state *data = calloc(1, sizeof(struct epoch_test_state));
+
+ data->gc = gc_new();
+
+ init_key_type(&data->kt, "AES-128-GCM", "none", true, false);
+
+ /* have an epoch key that is uses 0x23 for the key for all bytes */
+ struct epoch_key epoch1send = { .epoch = 1, .epoch_key = {0x23} };
+ struct epoch_key epoch1recv = { .epoch = 1, .epoch_key = {0x27} };
+
+ epoch_init_key_ctx(&data->co, &data->kt, &epoch1send,
+ &epoch1recv, *num_future_keys);
+
+ *state = data;
+ return 0;
+}
+
+static int
+crypto_test_epoch_teardown(void **state)
+{
+ struct epoch_test_state *data = *state;
+ free_epoch_key_ctx(&data->co);
+ free_key_ctx_bi(&data->co.key_ctx_bi);
+ gc_free(&data->gc);
+ free(*state);
+ return 0;
+}
+
+void
+crypto_test_epoch_key_generation(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* check the keys look like expect */
+ assert_int_equal(co->epoch_data_keys_future[0].epoch, 2);
+ assert_int_equal(co->epoch_data_keys_future[15].epoch, 17);
+ assert_int_equal(co->epoch_key_send.epoch, 1);
+ assert_int_equal(co->epoch_key_recv.epoch, 17);
+
+ /* Now replace the recv key with the 6th future key (epoch = 8) */
+ free_key_ctx(&co->key_ctx_bi.decrypt);
+ assert_int_equal(co->epoch_data_keys_future[6].epoch, 8);
+ co->key_ctx_bi.decrypt = co->epoch_data_keys_future[6];
+ CLEAR(co->epoch_data_keys_future[6]);
+
+ epoch_generate_future_receive_keys(co);
+ assert_int_equal(co->epoch_data_keys_future[0].epoch, 9);
+ assert_int_equal(co->epoch_data_keys_future[15].epoch, 24);
+}
+
+
+void
+crypto_test_epoch_key_rotation(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* should replace send + key recv */
+ epoch_replace_update_recv_key(co, 9);
+
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 9);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 9);
+ assert_int_equal(co->epoch_key_send.epoch, 9);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 1);
+
+ /* Iterate the data send key four times to get it to 13 */
+ for (int i = 0; i < 4; i++)
+ {
+ epoch_iterate_send_key(co);
+ }
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+
+ epoch_replace_update_recv_key(co, 10);
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 10);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+ assert_int_equal(co->epoch_key_send.epoch, 13);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 9);
+
+ epoch_replace_update_recv_key(co, 12);
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 12);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+ assert_int_equal(co->epoch_key_send.epoch, 13);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 10);
+
+ epoch_iterate_send_key(co);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 14);
+}
+
+void
+crypto_test_epoch_key_receive_lookup(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* lookup some wacky things that should fail */
+ assert_null(epoch_lookup_decrypt_key(co, 2000));
+ assert_null(epoch_lookup_decrypt_key(co, -1));
+ assert_null(epoch_lookup_decrypt_key(co, 0xefff));
+
+ /* Lookup the edges of the current window */
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 2)->epoch, 2);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 13)->epoch, 13);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 14)->epoch, 14);
+ assert_null(epoch_lookup_decrypt_key(co, 15));
+
+ /* Should move 1 to retiring key but leave 1-5 undefined, 7 as
+ * active and 8-20 as future keys*/
+ epoch_replace_update_recv_key(co, 7);
+
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
+ assert_null(epoch_lookup_decrypt_key(co, 2));
+ assert_null(epoch_lookup_decrypt_key(co, 3));
+ assert_null(epoch_lookup_decrypt_key(co, 4));
+ assert_null(epoch_lookup_decrypt_key(co, 5));
+ assert_null(epoch_lookup_decrypt_key(co, 6));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 7)->epoch, 7);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 8)->epoch, 8);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 20)->epoch, 20);
+ assert_null(epoch_lookup_decrypt_key(co, 21));
+ assert_null(epoch_lookup_decrypt_key(co, 22));
+
+
+ /* Should move 7 to retiring key and have 8 as active key and
+ * 9-21 as future keys */
+ epoch_replace_update_recv_key(co, 8);
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_null(epoch_lookup_decrypt_key(co, 1));
+ assert_null(epoch_lookup_decrypt_key(co, 2));
+ assert_null(epoch_lookup_decrypt_key(co, 3));
+ assert_null(epoch_lookup_decrypt_key(co, 4));
+ assert_null(epoch_lookup_decrypt_key(co, 5));
+ assert_null(epoch_lookup_decrypt_key(co, 6));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 7)->epoch, 7);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 8)->epoch, 8);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 20)->epoch, 20);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 21)->epoch, 21);
+ assert_null(epoch_lookup_decrypt_key(co, 22));
+ assert_null(epoch_lookup_decrypt_key(co, 23));
+}
+
+void
+crypto_test_epoch_key_overflow(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* Modify the receive epoch and keys to have a very high epoch to test
+ * the end of array. Iterating through all 16k keys takes a 2-3s, so we
+ * avoid this for the unit test */
+ co->key_ctx_bi.decrypt.epoch = 16000;
+ co->key_ctx_bi.encrypt.epoch = 16000;
+
+ co->epoch_key_send.epoch = 16000;
+ co->epoch_key_recv.epoch = 16000 + co->epoch_data_keys_future_count;
+
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ co->epoch_data_keys_future[i].epoch = 16001 + i;
+ }
+
+ /* Move the last few keys until we are close to the limit */
+ while (co->key_ctx_bi.decrypt.epoch < (UINT16_MAX - 40))
+ {
+ epoch_replace_update_recv_key(co, co->key_ctx_bi.decrypt.epoch + 10);
+ }
+
+ /* Looking up this key should still work as it will not break the limit
+ * when generating keys */
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 34)->epoch, UINT16_MAX - 34);
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 33)->epoch, UINT16_MAX - 33);
+
+ /* This key is no longer eligible for decrypting as the 32 future keys
+ * would be larger than uint16_t maximum */
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - 32));
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX));
+
+ /* Check that moving to the last possible epoch works */
+ epoch_replace_update_recv_key(co, UINT16_MAX - 33);
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 33)->epoch, UINT16_MAX - 33);
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - 32));
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX));
+}
+
+void
+epoch_test_derive_data_key(void **state)
+{
+ struct epoch_key e17 = { .epoch = 17, .epoch_key = { 19, 12 }};
+ struct key_type kt = { 0 };
+ struct key_parameters key_parameters = { 0 };
+ init_key_type(&kt, "AES-192-GCM", "none", true, false);
+
+
+ epoch_data_key_derive(&key_parameters, &e17, &kt);
+
+ assert_int_equal(key_parameters.cipher_size, 24);
+ assert_int_equal(key_parameters.hmac_size, 12);
+
+ uint8_t exp_cipherkey[24] =
+ {0xed, 0x85, 0x33, 0xdb, 0x1c, 0x28, 0xac, 0xe4,
+ 0x18, 0xe9, 0x00, 0x6a, 0xb2, 0x9c, 0x17, 0x41,
+ 0x7d, 0x60, 0xeb, 0xe6, 0xcd, 0x90, 0xbf, 0x0a};
+
+ uint8_t exp_impl_iv[12] =
+ {0x86, 0x89, 0x0a, 0xab, 0xf0, 0x32, 0xcb, 0x59, 0xf4, 0xcf, 0xa3, 0x4e};
+
+ assert_memory_equal(key_parameters.cipher, exp_cipherkey, sizeof(exp_cipherkey));
+ assert_memory_equal(key_parameters.hmac, exp_impl_iv, sizeof(exp_impl_iv));
+}
+
int
main(void)
{
+ int prestate_num13 = 13;
+ int prestate_num16 = 16;
+ int prestate_num32 = 32;
+
openvpn_unit_test_setup();
const struct CMUnitTest tests[] = {
cmocka_unit_test(crypto_pem_encode_decode_loopback),
@@ -724,7 +952,24 @@
cmocka_unit_test(crypto_test_hkdf_expand_testa3),
cmocka_unit_test(crypto_test_hkdf_expand_test_ovpn),
cmocka_unit_test(crypto_test_ovpn_label_expand),
- cmocka_unit_test(crypto_test_ovpn_expand_openssl3)
+ cmocka_unit_test(crypto_test_ovpn_expand_openssl3),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_generation,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num16),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_rotation,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num13),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_receive_lookup,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num13),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_overflow,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num32),
+ cmocka_unit_test(epoch_test_derive_data_key)
};
#if defined(ENABLE_CRYPTO_OPENSSL)
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/804?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Gerrit-Change-Number: 804
Gerrit-PatchSet: 6
Gerrit-Owner: plaisthos <arne-openvpn@...1227...>
Gerrit-Reviewer: flichtenheld <frank@...2641...>
Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net>
Gerrit-Attention: flichtenheld <frank@...2641...>
Gerrit-MessageType: newpatchset
[-- Attachment #2: Type: text/html, Size: 84086 bytes --]
^ permalink raw reply related [flat|nested] 14+ messages in thread* [Openvpn-devel] [L] Change in openvpn[master]: Implement methods to generate and manage OpenVPN Epoch keys
[not found] <gerrit.1731290343000.Id7d6a576ca8c9560cb2dfae82fc62175820e9b80@...2715...>
` (3 preceding siblings ...)
2024-11-30 13:38 ` plaisthos (Code Review)
@ 2024-12-20 14:49 ` plaisthos (Code Review)
2024-12-28 17:34 ` MaxF (Code Review)
` (7 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: plaisthos (Code Review) @ 2024-12-20 14:49 UTC (permalink / raw)
To: flichtenheld <frank@; +Cc: openvpn-devel
[-- Attachment #1: Type: text/plain, Size: 38901 bytes --]
Attention is currently required from: flichtenheld.
Hello flichtenheld,
I'd like you to reexamine a change. Please visit
http://gerrit.openvpn.net/c/openvpn/+/804?usp=email
to look at the new patch set (#8).
Change subject: Implement methods to generate and manage OpenVPN Epoch keys
......................................................................
Implement methods to generate and manage OpenVPN Epoch keys
This implements functions that allow these keys to be generated and
managed. It does not yet implement using them for the data channel.
Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Signed-off-by: Arne Schwabe <arne@...1227...>
---
M src/openvpn/crypto.c
M src/openvpn/crypto.h
M src/openvpn/crypto_epoch.c
M src/openvpn/crypto_epoch.h
M src/openvpn/packet_id.c
M src/openvpn/packet_id.h
M src/openvpn/ssl_common.h
M tests/unit_tests/openvpn/test_crypto.c
8 files changed, 780 insertions(+), 22 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/04/804/8
diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
index 6e442a3..4e93882 100644
--- a/src/openvpn/crypto.c
+++ b/src/openvpn/crypto.c
@@ -918,14 +918,27 @@
if (cipher_ctx_mode_aead(ctx->cipher))
{
size_t impl_iv_len = 0;
+ size_t impl_iv_offset = 0;
ASSERT(cipher_ctx_iv_length(ctx->cipher) >= OPENVPN_AEAD_MIN_IV_LEN);
- impl_iv_len = cipher_ctx_iv_length(ctx->cipher) - sizeof(packet_id_type);
- ASSERT(impl_iv_len + sizeof(packet_id_type) <= OPENVPN_MAX_IV_LENGTH);
+
+ /* Epoch keys use XOR of full IV length with the packet id to generate
+ * IVs. Old data format uses concatenation instead (XOR with 0 for the
+ * first 4 bytes (sizeof(packet_id_type) */
+ if (key->epoch)
+ {
+ impl_iv_len = cipher_ctx_iv_length(ctx->cipher);
+ impl_iv_offset = 0;
+ }
+ else
+ {
+ impl_iv_len = cipher_ctx_iv_length(ctx->cipher) - sizeof(packet_id_type);
+ impl_iv_offset = sizeof(packet_id_type);
+ }
+ ASSERT(impl_iv_offset + impl_iv_len <= OPENVPN_MAX_IV_LENGTH);
ASSERT(impl_iv_len <= MAX_HMAC_KEY_LENGTH);
ASSERT(impl_iv_len <= key->hmac_size);
CLEAR(ctx->implicit_iv);
- /* The first bytes of the IV are filled with the packet id */
- memcpy(ctx->implicit_iv + sizeof(packet_id_type), key->hmac, impl_iv_len);
+ memcpy(ctx->implicit_iv + impl_iv_offset, key->hmac, impl_iv_len);
}
}
@@ -974,6 +987,7 @@
hmac_ctx_size(ctx->hmac));
}
+ ctx->epoch = key->epoch;
gc_free(&gc);
}
@@ -986,6 +1000,7 @@
snprintf(log_prefix, sizeof(log_prefix), "Outgoing %s", name);
init_key_ctx(ctx, key_params, kt, OPENVPN_OP_ENCRYPT, log_prefix);
key_ctx_update_implicit_iv(ctx, key_params);
+ ctx->epoch = key_params->epoch;
}
void
@@ -997,6 +1012,7 @@
snprintf(log_prefix, sizeof(log_prefix), "Incoming %s", name);
init_key_ctx(ctx, key_params, kt, OPENVPN_OP_DECRYPT, log_prefix);
key_ctx_update_implicit_iv(ctx, key_params);
+ ctx->epoch = key_params->epoch;
}
void
@@ -1034,6 +1050,7 @@
}
CLEAR(ctx->implicit_iv);
ctx->plaintext_blocks = 0;
+ ctx->epoch = 0;
}
void
diff --git a/src/openvpn/crypto.h b/src/openvpn/crypto.h
index 661c567..573c7fd 100644
--- a/src/openvpn/crypto.h
+++ b/src/openvpn/crypto.h
@@ -170,6 +170,9 @@
/** Number of bytes set in the HMac key material */
int hmac_size;
+
+ /** the epoch of the key is if it was generated as epoch data key material */
+ uint16_t epoch;
};
/**
@@ -180,6 +183,11 @@
void
key_parameters_from_key(struct key_parameters *key_params, const struct key *key);
+struct epoch_key {
+ uint8_t epoch_key[SHA256_DIGEST_LENGTH];
+ uint16_t epoch;
+};
+
/**
* Container for one set of cipher and/or HMAC contexts.
* @ingroup control_processor
@@ -208,6 +216,10 @@
uint64_t plaintext_blocks;
/** number of failed verification using this cipher */
uint64_t failed_verifications;
+ /** OpenVPN data channel epoch, this variable holds the
+ * epoch number that is key belongs to. Note that epoch 0 is not used
+ * and epoch is always non-zero for epoch key contexts */
+ uint16_t epoch;
};
#define KEY_DIRECTION_BIDIRECTIONAL 0 /* same keys for both directions */
@@ -277,6 +289,39 @@
/**< OpenSSL cipher and HMAC contexts for
* both sending and receiving
* directions. */
+
+ /** last epoch_key used for generation of the current send data keys.
+ * As invariant, the epoch of epoch_key_send is always kept >= the epoch of
+ * epoch_key_recv */
+ struct epoch_key epoch_key_send;
+
+ /** epoch_key used for the highest receive epoch keys */
+ struct epoch_key epoch_key_recv;
+
+ /** the key_type that is used to generate the epoch keys */
+ struct key_type epoch_key_type;
+
+ /** This limit for AEAD cipher, this is the sum of packets + blocks
+ * that are allowed to be used. Will switch to a new epoch if this
+ * limit is reached*/
+ uint64_t aead_usage_limit;
+
+ /** Keeps the future epoch data keys for decryption. The current one
+ * that is expected to be used is stored in key_ctx_bi.
+ *
+ * We keep both decrypt and encrypt key here in the future keys
+ * as we want to be able to switch also sending key if the peer
+ * switching to a newer key epoch
+ * */
+ struct key_ctx *epoch_data_keys_future;
+
+ /** number of keys stored in \c epoch_data_keys_future */
+ uint16_t epoch_data_keys_future_count;
+
+ /** The old key bevor the sender switch to a new epoch data key */
+ struct key_ctx epoch_retiring_data_receive_key;
+ struct packet_id_rec epoch_retiring_key_pid_recv;
+
struct packet_id packet_id; /**< Current packet ID state for both
* sending and receiving directions.
*
@@ -285,7 +330,7 @@
*
* The packet id also used as the IV
* for AEAD/OFB/CFG ciphers.
- * */
+ */
struct packet_id_persist *pid_persist;
/**< Persistent packet ID state for
* keeping state between successive
@@ -473,13 +518,15 @@
*
* @param opt Crypto options for this packet, contains replay state.
* @param pin Packet ID read from packet.
+ * @param epoch Epoch read from packet or 0 when epoch is not used.
* @param error_prefix Prefix to use when printing error messages.
* @param gc Garbage collector to use.
*
* @return true if packet ID is validated to be not a replay, false otherwise.
*/
bool crypto_check_replay(struct crypto_options *opt,
- const struct packet_id_net *pin, const char *error_prefix,
+ const struct packet_id_net *pin,
+ const char *error_prefix,
struct gc_arena *gc);
diff --git a/src/openvpn/crypto_epoch.c b/src/openvpn/crypto_epoch.c
index 667e12a6..1e48d33 100644
--- a/src/openvpn/crypto_epoch.c
+++ b/src/openvpn/crypto_epoch.c
@@ -29,7 +29,13 @@
#endif
#include <inttypes.h>
+#include <string.h>
+#include <stdlib.h>
+
#include "crypto_backend.h"
+#include "packet_id.h"
+#include "crypto.h"
+#include "crypto_epoch.h"
#include "buffer.h"
#include "integer.h"
@@ -112,3 +118,337 @@
gc_free(&gc);
return true;
}
+
+/**
+ * Iterates the epoch key to make it E_n+1, ie increase the epoch by one
+ * and derive the new key material accordingly
+ * @param epoch_key epoch key to iterate
+ */
+static void
+epoch_key_iterate(struct epoch_key *epoch_key)
+{
+ struct epoch_key new_epoch_key = { 0 };
+ new_epoch_key.epoch = epoch_key->epoch + 1;
+ const uint8_t epoch_update_label[] = "datakey upd";
+
+ /* E_N+1 = OVPN-Expand-Label(E_N, "datakey upd", "", 32) */
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_update_label, 11,
+ NULL, 0,
+ new_epoch_key.epoch_key, sizeof(new_epoch_key.epoch_key));
+ *epoch_key = new_epoch_key;
+}
+
+void
+epoch_data_key_derive(struct key_parameters *key,
+ const struct epoch_key *epoch_key,
+ const struct key_type *kt)
+{
+ key->hmac_size = cipher_kt_iv_size(kt->cipher);
+ key->cipher_size = cipher_kt_key_size(kt->cipher);
+
+ /* Generate data key from epoch key:
+ * K_i = OVPN-Expand-Label(E_i, "data_key", "", key_size)
+ * implicit_iv = OVPN-Expand-Label(E_i, "data_iv", "", implicit_iv_len)
+ */
+
+ const uint8_t epoch_data_key_label[] = "data_key";
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_data_key_label, 8,
+ NULL, 0,
+ (uint8_t *)(&key->cipher), key->cipher_size);
+
+ const uint8_t epoch_data_iv_label[] = "data_iv";
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_data_iv_label, 7,
+ NULL, 0,
+ (uint8_t *)(&key->hmac), key->hmac_size);
+ key->epoch = epoch_key->epoch;
+}
+
+static void
+epoch_init_send_key_ctx(struct crypto_options *co)
+{
+ /* Ensure that we are NEVER regenerating the same key that has already
+ * been generated. Since we also reset the packet ID counter this would be
+ * catastrophic as we would do IV reuse which breaks ciphers like AES-GCM */
+ ASSERT(co->key_ctx_bi.encrypt.epoch != co->epoch_key_send.epoch);
+ char name[32] = { 0 };
+ snprintf(name, sizeof(name), "Epoch Data key %" PRIu16, co->epoch_key_send.epoch);
+
+ struct key_parameters send_key = { 0 };
+
+ epoch_data_key_derive(&send_key, &co->epoch_key_send, &co->epoch_key_type);
+
+ init_key_bi_ctx_send(&co->key_ctx_bi.encrypt, &send_key,
+ &co->epoch_key_type, name);
+ reset_packet_id_send(&co->packet_id.send);
+ CLEAR(send_key);
+}
+
+
+static void
+epoch_init_recv_key(struct key_ctx *ctx, struct crypto_options *co)
+{
+ struct key_parameters recv_key = { 0 };
+ epoch_data_key_derive(&recv_key, &co->epoch_key_recv, &co->epoch_key_type);
+
+ char name[32];
+
+ snprintf(name, sizeof(name), "Epoch Data key %" PRIu16, co->epoch_key_recv.epoch);
+
+ init_key_bi_ctx_recv(ctx, &recv_key, &co->epoch_key_type, name);
+ CLEAR(recv_key);
+}
+
+void
+epoch_generate_future_receive_keys(struct crypto_options *co)
+{
+ /* We want the number of receive keys starting with the currently used
+ * keys. */
+ ASSERT(co->key_ctx_bi.initialized);
+ uint16_t current_epoch_recv = co->key_ctx_bi.decrypt.epoch;
+
+ /* Either we have not generated any future keys yet or the last
+ * index is the same as our current epoch key */
+ struct key_ctx *highest_future_key = &co->epoch_data_keys_future[co->epoch_data_keys_future_count - 1];
+
+ ASSERT(co->epoch_key_recv.epoch == 1
+ || highest_future_key->epoch == co->epoch_key_recv.epoch);
+
+ /* free the keys that are not used anymore */
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ /* Keys in future keys are always epoch > 1 if initialised */
+ if (co->epoch_data_keys_future[i].epoch > 0
+ && co->epoch_data_keys_future[i].epoch < current_epoch_recv)
+ {
+ /* Key is old, free it */
+ free_key_ctx(&co->epoch_data_keys_future[i]);
+ }
+ }
+
+ /* Calculate the number of keys that need to be generated,
+ * if no keys have been generated assume only the first key is defined */
+ uint16_t current_highest_key = highest_future_key->epoch ? highest_future_key->epoch : 1;
+ uint16_t desired_highest_key = current_epoch_recv + co->epoch_data_keys_future_count;
+ uint16_t num_keys_generate = desired_highest_key - current_highest_key;
+
+
+ /* Move the old keys out of the way so the order of keys stays strictly
+ * monotonic and consecutive. */
+ /* first check that the destination we are going to overwrite is freed */
+ for (uint16_t i = 0; i < num_keys_generate; i++)
+ {
+ ASSERT(co->epoch_data_keys_future[i].epoch == 0);
+ }
+ memmove(co->epoch_data_keys_future,
+ co->epoch_data_keys_future + num_keys_generate,
+ (co->epoch_data_keys_future_count - num_keys_generate) * sizeof(struct key_ctx));
+
+ /* Clear and regenerate the array elements at the end */
+ for (uint16_t i = co->epoch_data_keys_future_count - num_keys_generate; i < co->epoch_data_keys_future_count; i++)
+ {
+ CLEAR(co->epoch_data_keys_future[i]);
+ epoch_key_iterate(&co->epoch_key_recv);
+
+ epoch_init_recv_key(&co->epoch_data_keys_future[i], co);
+ }
+
+ /* Assert that all keys are initialised */
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ ASSERT(co->epoch_data_keys_future[i].epoch > 0);
+ }
+}
+
+void
+epoch_iterate_send_key(struct crypto_options *co)
+{
+ ASSERT(co->epoch_key_send.epoch < UINT16_MAX);
+ epoch_key_iterate(&co->epoch_key_send);
+ free_key_ctx(&co->key_ctx_bi.encrypt);
+ epoch_init_send_key_ctx(co);
+}
+
+void
+epoch_replace_update_recv_key(struct crypto_options *co,
+ uint16_t new_epoch)
+{
+ /* Find the key of the new epoch in future keys */
+ uint16_t fki;
+ for (fki = 0; fki < co->epoch_data_keys_future_count; fki++)
+ {
+ if (co->epoch_data_keys_future[fki].epoch == new_epoch)
+ {
+ break;
+ }
+ }
+ /* we should only ever be called when we successfully decrypted/authenticated
+ * a packet from a peer, ie the epoch recv key *MUST* be in that
+ * array */
+ ASSERT(fki < co->epoch_data_keys_future_count);
+ ASSERT(co->epoch_data_keys_future[fki].epoch == new_epoch);
+
+ struct key_ctx *new_ctx = &co->epoch_data_keys_future[fki];
+
+ /* Check if the new recv key epoch is higher than the send key epoch. If
+ * yes we will replace the send key as well */
+ if (co->key_ctx_bi.encrypt.epoch < new_epoch)
+ {
+ free_key_ctx(&co->key_ctx_bi.encrypt);
+
+ /* Update the epoch_key for send to match the current key being used.
+ * This is a bit of extra work but since we are a maximum of 16
+ * keys behind, a maximum 16 HMAC invocations are a small price to
+ * pay for not keeping all the old epoch keys around in future_keys
+ * array */
+ while (co->epoch_key_send.epoch < new_epoch)
+ {
+ epoch_key_iterate(&co->epoch_key_send);
+ }
+ epoch_init_send_key_ctx(co);
+ }
+
+ /* Replace receive key */
+ free_key_ctx(&co->epoch_retiring_data_receive_key);
+ co->epoch_retiring_data_receive_key = co->key_ctx_bi.decrypt;
+ packet_id_move_recv(&co->epoch_retiring_key_pid_recv, &co->packet_id.rec);
+
+ co->key_ctx_bi.decrypt = *new_ctx;
+
+ /* Zero the old location instead to of free_key_ctx since we moved the keys
+ * and do not want to free the pointers in the old place */
+ memset(new_ctx, 0, sizeof(struct key_ctx));
+
+ /* Generate new future keys */
+ epoch_generate_future_receive_keys(co);
+}
+
+void
+free_epoch_key_ctx(struct crypto_options *co)
+{
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ free_key_ctx(&co->epoch_data_keys_future[i]);
+ }
+
+ free(co->epoch_data_keys_future);
+ free_key_ctx(&co->epoch_retiring_data_receive_key);
+ free(co->epoch_retiring_key_pid_recv.seq_list);
+ CLEAR(co->epoch_key_recv);
+ CLEAR(co->epoch_key_send);
+}
+
+void
+epoch_init_key_ctx(struct crypto_options *co, const struct key_type *key_type,
+ const struct epoch_key *e1_send,
+ const struct epoch_key *e1_recv,
+ uint16_t future_key_count)
+{
+ ASSERT(e1_send->epoch == 1 && e1_recv->epoch == 1);
+ co->epoch_key_recv = *e1_recv;
+ co->epoch_key_send = *e1_send;
+
+ co->epoch_key_type = *key_type;
+ co->aead_usage_limit = cipher_get_aead_limits(key_type->cipher);
+
+ epoch_init_send_key_ctx(co);
+ epoch_init_recv_key(&co->key_ctx_bi.decrypt, co);
+ co->key_ctx_bi.initialized = true;
+
+ co->epoch_data_keys_future_count = future_key_count;
+ ALLOC_ARRAY_CLEAR(co->epoch_data_keys_future, struct key_ctx, co->epoch_data_keys_future_count);
+ epoch_generate_future_receive_keys(co);
+}
+
+struct key_ctx *
+epoch_lookup_decrypt_key(struct crypto_options *opt, uint16_t epoch)
+{
+ /* Current decrypt key is the most likely one */
+ if (opt->key_ctx_bi.decrypt.epoch == epoch)
+ {
+ return &opt->key_ctx_bi.decrypt;
+ }
+ else if (opt->epoch_retiring_data_receive_key.epoch
+ && opt->epoch_retiring_data_receive_key.epoch == epoch)
+ {
+ return &opt->epoch_retiring_data_receive_key;
+ }
+ else if (epoch > opt->key_ctx_bi.decrypt.epoch
+ && epoch <= opt->key_ctx_bi.decrypt.epoch + opt->epoch_data_keys_future_count)
+ {
+ /* Key in the range of future keys */
+ int index = epoch - (opt->key_ctx_bi.decrypt.epoch + 1);
+
+ /* If we have reached the edge of the valid keys we do not return
+ * the key anymore since regenerating the new keys would move us
+ * over the window of valid keys and would need all kind of
+ * special casing, so we stop returning the key in this case */
+ if (epoch > (UINT16_MAX - opt->epoch_data_keys_future_count - 1))
+ {
+ return NULL;
+ }
+ else
+ {
+ return &opt->epoch_data_keys_future[index];
+ }
+ }
+ else
+ {
+ return NULL;
+ }
+}
+
+
+void
+epoch_check_send_iterate(struct crypto_options *opt)
+{
+ if (opt->epoch_key_send.epoch == UINT16_MAX)
+ {
+ /* limit of epoch keys reached, cannot move to a newer key anymore */
+ return;
+ }
+ if (opt->aead_usage_limit)
+ {
+ if (aead_usage_limit_reached(opt->aead_usage_limit, &opt->key_ctx_bi.encrypt,
+ opt->packet_id.send.id))
+ {
+ /* Send key limit reached */
+ epoch_iterate_send_key(opt);
+ }
+ /* draft 8 of the aead usage limit still had but draft 9 complete
+ * dropped this statement:
+ *
+ * In particular, is two-party communication, one participant cannot
+ * regard apparent overuse of a key by other participants as
+ * being in error, when it could be that the other participant has
+ * better information about bounds.
+ *
+ * OpenVPN 2.x implements a compromise of not regarding this as an
+ * error but still accepting packets of the usage limit but tries to
+ * push the peer to a new epoch key by increasing our own key epoch
+ *
+ * Also try to push the sender to use a new key if we are the
+ * decryption fail warn limit.
+ * */
+ else if (opt->key_ctx_bi.encrypt.epoch == opt->key_ctx_bi.decrypt.epoch
+ && (aead_usage_limit_reached(opt->aead_usage_limit,
+ &opt->key_ctx_bi.decrypt,
+ opt->packet_id.rec.id)
+ || cipher_decrypt_verify_fail_warn(&opt->key_ctx_bi.decrypt)
+ ))
+ {
+ /* Receive key limit reached. Increase our own send key to signal
+ * that we want to use a new epoch. Peer should then also move its
+ * key but is not required to do this */
+ epoch_iterate_send_key(opt);
+ }
+ }
+
+ if (opt->packet_id.send.id == PACKET_ID_EPOCH_MAX)
+ {
+ epoch_iterate_send_key(opt);
+ }
+
+}
diff --git a/src/openvpn/crypto_epoch.h b/src/openvpn/crypto_epoch.h
index e5d0e5d..3b25b36 100644
--- a/src/openvpn/crypto_epoch.h
+++ b/src/openvpn/crypto_epoch.h
@@ -67,4 +67,81 @@
const uint8_t *context, size_t context_len,
uint8_t *out, uint16_t out_len);
-#endif
+/**
+ * Generate a data channel key pair from the epoch key
+ * @param epoch_key Epoch key to be used
+ * @param key Destination for the generated data key
+ * @parm kt Cipher information to generate the data channel key for
+ */
+void
+epoch_data_key_derive(struct key_parameters *key,
+ const struct epoch_key *epoch_key,
+ const struct key_type *kt);
+
+/**
+ * Generates and fills the epoch_data_keys_future with next valid
+ * future keys in crypto_options
+ *
+ * This assume that the normal key_ctx_bi and epoch keys are already setup
+ */
+void
+epoch_generate_future_receive_keys(struct crypto_options *co);
+
+
+/** This is called when the peer using a new send key that is not the default
+ * key. This function ensures the following:
+ * - recv key matches the epoch index provided
+ * - send key epoch is equal or higher than recv_key epoch
+ *
+ * @param new_epoch the new epoch to use a the receive key
+ */
+void
+epoch_replace_update_recv_key(struct crypto_options *co,
+ uint16_t new_epoch);
+
+/**
+ * Updates the send key and send_epoch_keyt in cryptio_options->key_ctx_bi to
+ * use the next epoch */
+void
+epoch_iterate_send_key(struct crypto_options *co);
+
+/**
+ * Frees the extra data structures used by epoch keys in \c crypto_options
+ */
+void
+free_epoch_key_ctx(struct crypto_options *co);
+
+/**
+ * Initialises data channel keys and internal structures for epoch data keys
+ * using the provided E0 epoch key
+ *
+ * @param e1_send The E1 send epoch key derived by TLS-EKM
+ * @param e1_recv The E1 receive epoch key derived by TLS-EKM
+ */
+void
+epoch_init_key_ctx(struct crypto_options *co, const struct key_type *key_type,
+ const struct epoch_key *e1_send, const struct epoch_key *e1_recv,
+ uint16_t future_key_count);
+
+/**
+ * Using an epoch, this function will try to retrieve a decryption
+ * key context that matches that epoch from the \c opt argument
+ * @param opt crypto_options to use to find the decrypt key
+ * @param epoch epoch of the key to lookup
+ * @return the key context with
+ */
+struct key_ctx *
+epoch_lookup_decrypt_key(struct crypto_options *opt, uint16_t epoch);
+
+/**
+ * Checks if we need to iterate the send epoch key. This needs to be in one
+ * of the following condition
+ * - max epoch counter reached
+ * - send key aead usage limit reached (for AES-GCM and similar ciphers)
+ * - recv key usage limit reached
+ */
+void
+epoch_check_send_iterate(struct crypto_options *opt);
+
+
+#endif /* ifndef CRYPTO_EPOCH_H */
diff --git a/src/openvpn/packet_id.c b/src/openvpn/packet_id.c
index e3a29f5..9fc4554 100644
--- a/src/openvpn/packet_id.c
+++ b/src/openvpn/packet_id.c
@@ -78,6 +78,21 @@
}
void
+packet_id_init_recv(struct packet_id_rec *rec, int seq_backtrack, int time_backtrack, const char *name, int unit)
+{
+ rec->name = name;
+ rec->unit = unit;
+ if (seq_backtrack)
+ {
+ ASSERT(MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
+ ASSERT(MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
+ CIRC_LIST_ALLOC(rec->seq_list, struct seq_list, seq_backtrack);
+ rec->seq_backtrack = seq_backtrack;
+ rec->time_backtrack = time_backtrack;
+ }
+ rec->initialized = true;
+}
+void
packet_id_init(struct packet_id *p, int seq_backtrack, int time_backtrack, const char *name, int unit)
{
dmsg(D_PID_DEBUG, "PID packet_id_init seq_backtrack=%d time_backtrack=%d",
@@ -87,17 +102,25 @@
ASSERT(p);
CLEAR(*p);
- p->rec.name = name;
- p->rec.unit = unit;
- if (seq_backtrack)
- {
- ASSERT(MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
- ASSERT(MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
- CIRC_LIST_ALLOC(p->rec.seq_list, struct seq_list, seq_backtrack);
- p->rec.seq_backtrack = seq_backtrack;
- p->rec.time_backtrack = time_backtrack;
- }
- p->rec.initialized = true;
+ packet_id_init_recv(&p->rec, seq_backtrack, time_backtrack, name, unit);
+}
+
+void
+packet_id_move_recv(struct packet_id_rec *dest, struct packet_id_rec *src)
+{
+ ASSERT(src);
+ ASSERT(dest);
+ /* clear free any old data in rec list */
+ free(dest->seq_list);
+ CLEAR(*dest);
+
+ /* Copy data to dest */
+ *dest = *src;
+
+ /* Reinitalise the source */
+ CLEAR(*src);
+ packet_id_init_recv(src, dest->seq_backtrack, dest->time_backtrack,
+ dest->name, dest->unit);
}
void
diff --git a/src/openvpn/packet_id.h b/src/openvpn/packet_id.h
index f6b1463..a6d49b6 100644
--- a/src/openvpn/packet_id.h
+++ b/src/openvpn/packet_id.h
@@ -205,6 +205,15 @@
void packet_id_free(struct packet_id *p);
+/**
+ * Move the packet id recv structure from src to dest. src will will
+ * be reinitialised with
+ * @param dest
+ * @param src
+ */
+void
+packet_id_move_recv(struct packet_id_rec *dest, struct packet_id_rec *src);
+
/* should we accept an incoming packet id ? */
bool packet_id_test(struct packet_id_rec *p,
const struct packet_id_net *pin);
diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h
index ccbc053..c7ae962 100644
--- a/src/openvpn/ssl_common.h
+++ b/src/openvpn/ssl_common.h
@@ -333,8 +333,8 @@
interval_t packet_timeout;
int64_t renegotiate_bytes;
int64_t renegotiate_packets;
- /** limit for AEAD cipher, this is the sum of packets + blocks
- * that are allowed to be used */
+ /** limit for AEAD cipher when not running in epoch data key mode,
+ * this is the sum of packets + blocks that are allowed to be used */
uint64_t aead_usage_limit;
interval_t renegotiate_seconds;
diff --git a/tests/unit_tests/openvpn/test_crypto.c b/tests/unit_tests/openvpn/test_crypto.c
index e16296b..82ca86e 100644
--- a/tests/unit_tests/openvpn/test_crypto.c
+++ b/tests/unit_tests/openvpn/test_crypto.c
@@ -613,7 +613,7 @@
0x90, 0xb6, 0xc7, 0x3b, 0xb5, 0x0f, 0x9c, 0x31,
0x22, 0xec, 0x84, 0x4a, 0xd7, 0xc2, 0xb3, 0xe5};
- const uint8_t *label = (const uint8_t *)("unit test");
+ const uint8_t *label = (const uint8_t *) ("unit test");
uint8_t out[16];
ovpn_expand_label(secret, sizeof(secret), label, 9, NULL, 0, out, sizeof(out));
@@ -708,9 +708,237 @@
}
#endif /* if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L */
+struct epoch_test_state
+{
+ struct key_type kt;
+ struct gc_arena gc;
+ struct crypto_options co;
+};
+
+static int
+crypto_test_epoch_setup(void **state)
+{
+ int *num_future_keys = (int *)*state;
+ struct epoch_test_state *data = calloc(1, sizeof(struct epoch_test_state));
+
+ data->gc = gc_new();
+
+ init_key_type(&data->kt, "AES-128-GCM", "none", true, false);
+
+ /* have an epoch key that is uses 0x23 for the key for all bytes */
+ struct epoch_key epoch1send = { .epoch = 1, .epoch_key = {0x23} };
+ struct epoch_key epoch1recv = { .epoch = 1, .epoch_key = {0x27} };
+
+ epoch_init_key_ctx(&data->co, &data->kt, &epoch1send,
+ &epoch1recv, *num_future_keys);
+
+ *state = data;
+ return 0;
+}
+
+static int
+crypto_test_epoch_teardown(void **state)
+{
+ struct epoch_test_state *data = *state;
+ free_epoch_key_ctx(&data->co);
+ free_key_ctx_bi(&data->co.key_ctx_bi);
+ gc_free(&data->gc);
+ free(*state);
+ return 0;
+}
+
+void
+crypto_test_epoch_key_generation(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* check the keys look like expect */
+ assert_int_equal(co->epoch_data_keys_future[0].epoch, 2);
+ assert_int_equal(co->epoch_data_keys_future[15].epoch, 17);
+ assert_int_equal(co->epoch_key_send.epoch, 1);
+ assert_int_equal(co->epoch_key_recv.epoch, 17);
+
+ /* Now replace the recv key with the 6th future key (epoch = 8) */
+ free_key_ctx(&co->key_ctx_bi.decrypt);
+ assert_int_equal(co->epoch_data_keys_future[6].epoch, 8);
+ co->key_ctx_bi.decrypt = co->epoch_data_keys_future[6];
+ CLEAR(co->epoch_data_keys_future[6]);
+
+ epoch_generate_future_receive_keys(co);
+ assert_int_equal(co->epoch_data_keys_future[0].epoch, 9);
+ assert_int_equal(co->epoch_data_keys_future[15].epoch, 24);
+}
+
+
+void
+crypto_test_epoch_key_rotation(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* should replace send + key recv */
+ epoch_replace_update_recv_key(co, 9);
+
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 9);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 9);
+ assert_int_equal(co->epoch_key_send.epoch, 9);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 1);
+
+ /* Iterate the data send key four times to get it to 13 */
+ for (int i = 0; i < 4; i++)
+ {
+ epoch_iterate_send_key(co);
+ }
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+
+ epoch_replace_update_recv_key(co, 10);
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 10);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+ assert_int_equal(co->epoch_key_send.epoch, 13);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 9);
+
+ epoch_replace_update_recv_key(co, 12);
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 12);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+ assert_int_equal(co->epoch_key_send.epoch, 13);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 10);
+
+ epoch_iterate_send_key(co);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 14);
+}
+
+void
+crypto_test_epoch_key_receive_lookup(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* lookup some wacky things that should fail */
+ assert_null(epoch_lookup_decrypt_key(co, 2000));
+ assert_null(epoch_lookup_decrypt_key(co, -1));
+ assert_null(epoch_lookup_decrypt_key(co, 0xefff));
+
+ /* Lookup the edges of the current window */
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 2)->epoch, 2);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 13)->epoch, 13);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 14)->epoch, 14);
+ assert_null(epoch_lookup_decrypt_key(co, 15));
+
+ /* Should move 1 to retiring key but leave 1-5 undefined, 7 as
+ * active and 8-20 as future keys*/
+ epoch_replace_update_recv_key(co, 7);
+
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
+ assert_null(epoch_lookup_decrypt_key(co, 2));
+ assert_null(epoch_lookup_decrypt_key(co, 3));
+ assert_null(epoch_lookup_decrypt_key(co, 4));
+ assert_null(epoch_lookup_decrypt_key(co, 5));
+ assert_null(epoch_lookup_decrypt_key(co, 6));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 7)->epoch, 7);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 8)->epoch, 8);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 20)->epoch, 20);
+ assert_null(epoch_lookup_decrypt_key(co, 21));
+ assert_null(epoch_lookup_decrypt_key(co, 22));
+
+
+ /* Should move 7 to retiring key and have 8 as active key and
+ * 9-21 as future keys */
+ epoch_replace_update_recv_key(co, 8);
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_null(epoch_lookup_decrypt_key(co, 1));
+ assert_null(epoch_lookup_decrypt_key(co, 2));
+ assert_null(epoch_lookup_decrypt_key(co, 3));
+ assert_null(epoch_lookup_decrypt_key(co, 4));
+ assert_null(epoch_lookup_decrypt_key(co, 5));
+ assert_null(epoch_lookup_decrypt_key(co, 6));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 7)->epoch, 7);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 8)->epoch, 8);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 20)->epoch, 20);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 21)->epoch, 21);
+ assert_null(epoch_lookup_decrypt_key(co, 22));
+ assert_null(epoch_lookup_decrypt_key(co, 23));
+}
+
+void
+crypto_test_epoch_key_overflow(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* Modify the receive epoch and keys to have a very high epoch to test
+ * the end of array. Iterating through all 16k keys takes a 2-3s, so we
+ * avoid this for the unit test */
+ co->key_ctx_bi.decrypt.epoch = 16000;
+ co->key_ctx_bi.encrypt.epoch = 16000;
+
+ co->epoch_key_send.epoch = 16000;
+ co->epoch_key_recv.epoch = 16000 + co->epoch_data_keys_future_count;
+
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ co->epoch_data_keys_future[i].epoch = 16001 + i;
+ }
+
+ /* Move the last few keys until we are close to the limit */
+ while (co->key_ctx_bi.decrypt.epoch < (UINT16_MAX - 40))
+ {
+ epoch_replace_update_recv_key(co, co->key_ctx_bi.decrypt.epoch + 10);
+ }
+
+ /* Looking up this key should still work as it will not break the limit
+ * when generating keys */
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 34)->epoch, UINT16_MAX - 34);
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 33)->epoch, UINT16_MAX - 33);
+
+ /* This key is no longer eligible for decrypting as the 32 future keys
+ * would be larger than uint16_t maximum */
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - 32));
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX));
+
+ /* Check that moving to the last possible epoch works */
+ epoch_replace_update_recv_key(co, UINT16_MAX - 33);
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 33)->epoch, UINT16_MAX - 33);
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - 32));
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX));
+}
+
+void
+epoch_test_derive_data_key(void **state)
+{
+ struct epoch_key e17 = { .epoch = 17, .epoch_key = { 19, 12 }};
+ struct key_type kt = { 0 };
+ struct key_parameters key_parameters = { 0 };
+ init_key_type(&kt, "AES-192-GCM", "none", true, false);
+
+
+ epoch_data_key_derive(&key_parameters, &e17, &kt);
+
+ assert_int_equal(key_parameters.cipher_size, 24);
+ assert_int_equal(key_parameters.hmac_size, 12);
+
+ uint8_t exp_cipherkey[24] =
+ {0xed, 0x85, 0x33, 0xdb, 0x1c, 0x28, 0xac, 0xe4,
+ 0x18, 0xe9, 0x00, 0x6a, 0xb2, 0x9c, 0x17, 0x41,
+ 0x7d, 0x60, 0xeb, 0xe6, 0xcd, 0x90, 0xbf, 0x0a};
+
+ uint8_t exp_impl_iv[12] =
+ {0x86, 0x89, 0x0a, 0xab, 0xf0, 0x32, 0xcb, 0x59, 0xf4, 0xcf, 0xa3, 0x4e};
+
+ assert_memory_equal(key_parameters.cipher, exp_cipherkey, sizeof(exp_cipherkey));
+ assert_memory_equal(key_parameters.hmac, exp_impl_iv, sizeof(exp_impl_iv));
+}
+
int
main(void)
{
+ int prestate_num13 = 13;
+ int prestate_num16 = 16;
+ int prestate_num32 = 32;
+
openvpn_unit_test_setup();
const struct CMUnitTest tests[] = {
cmocka_unit_test(crypto_pem_encode_decode_loopback),
@@ -725,7 +953,24 @@
cmocka_unit_test(crypto_test_hkdf_expand_testa3),
cmocka_unit_test(crypto_test_hkdf_expand_test_ovpn),
cmocka_unit_test(crypto_test_ovpn_label_expand),
- cmocka_unit_test(crypto_test_ovpn_expand_openssl3)
+ cmocka_unit_test(crypto_test_ovpn_expand_openssl3),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_generation,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num16),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_rotation,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num13),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_receive_lookup,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num13),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_overflow,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num32),
+ cmocka_unit_test(epoch_test_derive_data_key)
};
#if defined(ENABLE_CRYPTO_OPENSSL)
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/804?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Gerrit-Change-Number: 804
Gerrit-PatchSet: 8
Gerrit-Owner: plaisthos <arne-openvpn@...1227...>
Gerrit-Reviewer: flichtenheld <frank@...2641...>
Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net>
Gerrit-Attention: flichtenheld <frank@...2641...>
Gerrit-MessageType: newpatchset
[-- Attachment #2: Type: text/html, Size: 84762 bytes --]
^ permalink raw reply related [flat|nested] 14+ messages in thread* [Openvpn-devel] [L] Change in openvpn[master]: Implement methods to generate and manage OpenVPN Epoch keys
[not found] <gerrit.1731290343000.Id7d6a576ca8c9560cb2dfae82fc62175820e9b80@...2715...>
` (4 preceding siblings ...)
2024-12-20 14:49 ` plaisthos (Code Review)
@ 2024-12-28 17:34 ` MaxF (Code Review)
2024-12-29 0:42 ` MaxF (Code Review)
` (6 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: MaxF (Code Review) @ 2024-12-28 17:34 UTC (permalink / raw)
To: plaisthos <arne-openvpn@; +Cc: flichtenheld <frank@
[-- Attachment #1: Type: text/plain, Size: 3081 bytes --]
Attention is currently required from: flichtenheld, plaisthos.
MaxF has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/804?usp=email )
Change subject: Implement methods to generate and manage OpenVPN Epoch keys
......................................................................
Patch Set 9:
(12 comments)
Patchset:
PS9:
Reviewed until crypto_epoch.h, will continue later
File src/openvpn/crypto.h:
http://gerrit.openvpn.net/c/openvpn/+/804/comment/a432af93_97a33d7a :
PS9, Line 175: /** the epoch of the key is if it was generated as epoch data key material */
I think you mean: The epoch of the key, if it was generated as epoch data key material.
(Implying, it's undefined if this is a different kind of key?)
http://gerrit.openvpn.net/c/openvpn/+/804/comment/735a8e52_5784bd7e :
PS9, Line 223: is
this?
http://gerrit.openvpn.net/c/openvpn/+/804/comment/a6671a3f_87bca2ec :
PS9, Line 315: key
keys
http://gerrit.openvpn.net/c/openvpn/+/804/comment/5f52e18e_e35d296c :
PS9, Line 316: to switch also sending key
to also switch the sending key?
http://gerrit.openvpn.net/c/openvpn/+/804/comment/68672759_37e827d3 :
PS9, Line 324: switch
switched?
http://gerrit.openvpn.net/c/openvpn/+/804/comment/7c80d6b3_104e8e59 :
PS9, Line 524: @param epoch Epoch read from packet or 0 when epoch is not used.
That's not an argument of the function.
File src/openvpn/crypto_epoch.h:
http://gerrit.openvpn.net/c/openvpn/+/804/comment/ced0bc22_010e9c3f :
PS9, Line 72: * @param epoch_key Epoch key to be used
: * @param key Destination for the generated data key
wrong order compared to the function.
http://gerrit.openvpn.net/c/openvpn/+/804/comment/cb952e40_38a4c3a6 :
PS9, Line 91: using
uses
http://gerrit.openvpn.net/c/openvpn/+/804/comment/480f9270_6b023e63 :
PS9, Line 96: a
for the receive key?
http://gerrit.openvpn.net/c/openvpn/+/804/comment/3dba7c21_2b0cdd56 :
PS9, Line 103: send_epoch_keyt
send_epoch_key
http://gerrit.openvpn.net/c/openvpn/+/804/comment/44263987_947e608e :
PS9, Line 118: * @param e1_send The E1 send epoch key derived by TLS-EKM
: * @param e1_recv The E1 receive epoch key derived by TLS-EKM
incomplete parameters
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/804?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Gerrit-Change-Number: 804
Gerrit-PatchSet: 9
Gerrit-Owner: plaisthos <arne-openvpn@...1227...>
Gerrit-Reviewer: flichtenheld <frank@...2641...>
Gerrit-CC: MaxF <max@...2606...>
Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net>
Gerrit-Attention: plaisthos <arne-openvpn@...1227...>
Gerrit-Attention: flichtenheld <frank@...2641...>
Gerrit-Comment-Date: Sat, 28 Dec 2024 17:34:37 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
[-- Attachment #2: Type: text/html, Size: 6941 bytes --]
^ permalink raw reply [flat|nested] 14+ messages in thread* [Openvpn-devel] [L] Change in openvpn[master]: Implement methods to generate and manage OpenVPN Epoch keys
[not found] <gerrit.1731290343000.Id7d6a576ca8c9560cb2dfae82fc62175820e9b80@...2715...>
` (5 preceding siblings ...)
2024-12-28 17:34 ` MaxF (Code Review)
@ 2024-12-29 0:42 ` MaxF (Code Review)
2024-12-29 3:09 ` plaisthos (Code Review)
` (5 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: MaxF (Code Review) @ 2024-12-29 0:42 UTC (permalink / raw)
To: plaisthos <arne-openvpn@; +Cc: flichtenheld <frank@
[-- Attachment #1: Type: text/plain, Size: 3659 bytes --]
Attention is currently required from: flichtenheld, plaisthos.
MaxF has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/804?usp=email )
Change subject: Implement methods to generate and manage OpenVPN Epoch keys
......................................................................
Patch Set 9: Code-Review-1
(13 comments)
Patchset:
PS9:
Needs uncrustification.
Code looks good to me, I just have some comments about comments and naming.
File src/openvpn/crypto.h:
http://gerrit.openvpn.net/c/openvpn/+/804/comment/71ce8066_a53680c4 :
PS9, Line 307: This limit for AEAD cipher
The limit for AEAD ciphers?
File src/openvpn/crypto_epoch.c:
http://gerrit.openvpn.net/c/openvpn/+/804/comment/4fc082c6_eb80eb11 :
PS9, Line 136: 11
We could use strlen() here.
http://gerrit.openvpn.net/c/openvpn/+/804/comment/8fdb0547_fcd70ff2 :
PS9, Line 157: 8
strlen?
http://gerrit.openvpn.net/c/openvpn/+/804/comment/403bd9f7_0bc3e36d :
PS9, Line 163: 7
strlen?
http://gerrit.openvpn.net/c/openvpn/+/804/comment/769c056a_676d4fc5 :
PS9, Line 210: uint16_t current_epoch_recv = co->key_ctx_bi.decrypt.epoch;
The variable name makes this look like it should be co->epoch_key_recv.epoch.
After reading the function, I think the code is correct, but together with the ASSERT below, this caused me a lot of confusion. I thought that the assert was saying that you can only generate new future keys if you used them all up.
http://gerrit.openvpn.net/c/openvpn/+/804/comment/dcaea617_c7f7124b :
PS9, Line 423: is
in?
File src/openvpn/packet_id.h:
http://gerrit.openvpn.net/c/openvpn/+/804/comment/7be792f3_fe78b9b2 :
PS9, Line 214: */
Incomplete
File src/openvpn/packet_id.c:
http://gerrit.openvpn.net/c/openvpn/+/804/comment/bf06e613_bc17423a :
PS9, Line 81: packet_id_init_recv(struct packet_id_rec *rec, int seq_backtrack, int time_backtrack, const char *name, int unit)
You could make this a static function.
File tests/unit_tests/openvpn/test_crypto.c:
http://gerrit.openvpn.net/c/openvpn/+/804/comment/7799a129_e434234f :
PS9, Line 728: is uses
uses
http://gerrit.openvpn.net/c/openvpn/+/804/comment/e365ffa5_5d07eb01 :
PS9, Line 830: 1-5
2-6
http://gerrit.openvpn.net/c/openvpn/+/804/comment/c9e49297_c1a18bdd :
PS9, Line 835: assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
Could we make sure that it really is the retiring key by comparing it with &co->epoch_retiring_data_receive_key?
Similar for epoch 7 and &co->key_ctx_bi.decrypt
http://gerrit.openvpn.net/c/openvpn/+/804/comment/a1b07fcd_530357a4 :
PS9, Line 899: assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - 32));
This hard-codes the assumption that this function is called with a state that has num_future_keys == 32. Can't we get that number from co instead?
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/804?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Gerrit-Change-Number: 804
Gerrit-PatchSet: 9
Gerrit-Owner: plaisthos <arne-openvpn@...1227...>
Gerrit-Reviewer: MaxF <max@...2606...>
Gerrit-Reviewer: flichtenheld <frank@...2641...>
Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net>
Gerrit-Attention: plaisthos <arne-openvpn@...1227...>
Gerrit-Attention: flichtenheld <frank@...2641...>
Gerrit-Comment-Date: Sun, 29 Dec 2024 00:42:46 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
[-- Attachment #2: Type: text/html, Size: 8037 bytes --]
^ permalink raw reply [flat|nested] 14+ messages in thread* [Openvpn-devel] [L] Change in openvpn[master]: Implement methods to generate and manage OpenVPN Epoch keys
[not found] <gerrit.1731290343000.Id7d6a576ca8c9560cb2dfae82fc62175820e9b80@...2715...>
` (6 preceding siblings ...)
2024-12-29 0:42 ` MaxF (Code Review)
@ 2024-12-29 3:09 ` plaisthos (Code Review)
2024-12-29 3:12 ` plaisthos (Code Review)
` (4 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: plaisthos (Code Review) @ 2024-12-29 3:09 UTC (permalink / raw)
Cc: MaxF <max@
[-- Attachment #1: Type: text/plain, Size: 6145 bytes --]
Attention is currently required from: MaxF, flichtenheld.
plaisthos has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/804?usp=email )
Change subject: Implement methods to generate and manage OpenVPN Epoch keys
......................................................................
Patch Set 9:
(23 comments)
File src/openvpn/crypto.h:
http://gerrit.openvpn.net/c/openvpn/+/804/comment/4cf4ae43_56da8da9 :
PS9, Line 175: /** the epoch of the key is if it was generated as epoch data key material */
> I think you mean: The epoch of the key, if it was generated as epoch data key material. […]
I will clarify that this only meaningful if key parameters are used in epoch data and it is not meaningful otherwise.
http://gerrit.openvpn.net/c/openvpn/+/804/comment/788a09ea_7023fafa :
PS9, Line 223: is
> this?
Acknowledged
http://gerrit.openvpn.net/c/openvpn/+/804/comment/3d1e7540_b7a53f6a :
PS9, Line 307: This limit for AEAD cipher
> The limit for AEAD ciphers?
Acknowledged
http://gerrit.openvpn.net/c/openvpn/+/804/comment/1dead943_a6393dd1 :
PS9, Line 315: key
> keys
yes but also the comment is wrong as epoch_data_keys_future only stores receive keys.
http://gerrit.openvpn.net/c/openvpn/+/804/comment/78aa125b_37d2d67c :
PS9, Line 316: to switch also sending key
> to also switch the sending key?
Acknowledged
http://gerrit.openvpn.net/c/openvpn/+/804/comment/f57d4cd6_30ec7906 :
PS9, Line 324: switch
> switched?
yes, and also before instead of bevor.
http://gerrit.openvpn.net/c/openvpn/+/804/comment/be5e1ecc_1af62691 :
PS9, Line 524: @param epoch Epoch read from packet or 0 when epoch is not used.
> That's not an argument of the function.
yes that got into a commit too early. I moved it to the commit that actually adds the epoch parameter.
File src/openvpn/crypto_epoch.h:
http://gerrit.openvpn.net/c/openvpn/+/804/comment/87827b4b_e2c66cc6 :
PS9, Line 72: * @param epoch_key Epoch key to be used
: * @param key Destination for the generated data key
> wrong order compared to the function.
Acknowledged
http://gerrit.openvpn.net/c/openvpn/+/804/comment/3e654f8c_e8b2f61e :
PS9, Line 91: using
> uses
Acknowledged
http://gerrit.openvpn.net/c/openvpn/+/804/comment/0a1c083e_f7fbf9ba :
PS9, Line 96: a
> for the receive key?
Acknowledged
http://gerrit.openvpn.net/c/openvpn/+/804/comment/f2c845b2_b82d132e :
PS9, Line 103: send_epoch_keyt
> send_epoch_key
Acknowledged
http://gerrit.openvpn.net/c/openvpn/+/804/comment/2ef5767a_589a85d0 :
PS9, Line 118: * @param e1_send The E1 send epoch key derived by TLS-EKM
: * @param e1_recv The E1 receive epoch key derived by TLS-EKM
> incomplete parameters
Acknowledged
File src/openvpn/crypto_epoch.c:
http://gerrit.openvpn.net/c/openvpn/+/804/comment/37c7c0ca_5ba66eff :
PS9, Line 136: 11
> We could use strlen() here.
I will be using sizeof(array) - 1 as strlen doesn't really like operating on a uint8_t array.
http://gerrit.openvpn.net/c/openvpn/+/804/comment/b83b22ac_c3dd00bb :
PS9, Line 157: 8
> strlen?
same as above
http://gerrit.openvpn.net/c/openvpn/+/804/comment/ae88362e_fa765dab :
PS9, Line 163: 7
> strlen?
same as above
http://gerrit.openvpn.net/c/openvpn/+/804/comment/4b15f462_6189d29b :
PS9, Line 210: uint16_t current_epoch_recv = co->key_ctx_bi.decrypt.epoch;
> The variable name makes this look like it should be co->epoch_key_recv.epoch. […]
I reworked the comment and the function doxygen to hopefully make it a bit better to understand.
http://gerrit.openvpn.net/c/openvpn/+/804/comment/85168ea8_12a0a758 :
PS9, Line 423: is
> in?
not sure how I managed to mangle this when I copy&pasted it.
File src/openvpn/packet_id.h:
http://gerrit.openvpn.net/c/openvpn/+/804/comment/929b34fb_60e60e0a :
PS9, Line 214: */
> Incomplete
Acknowledged
File src/openvpn/packet_id.c:
http://gerrit.openvpn.net/c/openvpn/+/804/comment/129a630b_4118bf6c :
PS9, Line 81: packet_id_init_recv(struct packet_id_rec *rec, int seq_backtrack, int time_backtrack, const char *name, int unit)
> You could make this a static function.
Acknowledged
File tests/unit_tests/openvpn/test_crypto.c:
http://gerrit.openvpn.net/c/openvpn/+/804/comment/b63adfb5_696e6519 :
PS9, Line 728: is uses
> uses
Done
http://gerrit.openvpn.net/c/openvpn/+/804/comment/aa4ca31d_556d7a6b :
PS9, Line 830: 1-5
> 2-6
Done
http://gerrit.openvpn.net/c/openvpn/+/804/comment/cb188983_ad366b2c :
PS9, Line 835: assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
> Could we make sure that it really is the retiring key by comparing it with &co->epoch_retiring_data_ […]
good idea.
http://gerrit.openvpn.net/c/openvpn/+/804/comment/eca5ecc7_126d252a :
PS9, Line 899: assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - 32));
> This hard-codes the assumption that this function is called with a state that has num_future_keys == […]
I think for a unit test hardcoding this is fine. I think we want to rather hardcode it here rather then to rely on the internal state of co being correct for the unit test.
I will add an assert that the num_future_keys is 32 and then use num_future_keys as you suggested.
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/804?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Gerrit-Change-Number: 804
Gerrit-PatchSet: 9
Gerrit-Owner: plaisthos <arne-openvpn@...1227...>
Gerrit-Reviewer: MaxF <max@...2606...>
Gerrit-Reviewer: flichtenheld <frank@...2641...>
Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net>
Gerrit-Attention: flichtenheld <frank@...2641...>
Gerrit-Attention: MaxF <max@...2606...>
Gerrit-Comment-Date: Sun, 29 Dec 2024 03:09:05 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: MaxF <max@...2606...>
Gerrit-MessageType: comment
[-- Attachment #2: Type: text/html, Size: 14880 bytes --]
^ permalink raw reply [flat|nested] 14+ messages in thread* [Openvpn-devel] [L] Change in openvpn[master]: Implement methods to generate and manage OpenVPN Epoch keys
[not found] <gerrit.1731290343000.Id7d6a576ca8c9560cb2dfae82fc62175820e9b80@...2715...>
` (7 preceding siblings ...)
2024-12-29 3:09 ` plaisthos (Code Review)
@ 2024-12-29 3:12 ` plaisthos (Code Review)
2025-01-09 16:33 ` MaxF (Code Review)
` (3 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: plaisthos (Code Review) @ 2024-12-29 3:12 UTC (permalink / raw)
To: flichtenheld <frank@; +Cc: openvpn-devel
[-- Attachment #1: Type: text/plain, Size: 40639 bytes --]
Attention is currently required from: MaxF, flichtenheld.
Hello MaxF, flichtenheld,
I'd like you to reexamine a change. Please visit
http://gerrit.openvpn.net/c/openvpn/+/804?usp=email
to look at the new patch set (#10).
The following approvals got outdated and were removed:
Code-Review-1 by MaxF
Change subject: Implement methods to generate and manage OpenVPN Epoch keys
......................................................................
Implement methods to generate and manage OpenVPN Epoch keys
This implements functions that allow these keys to be generated and
managed. It does not yet implement using them for the data channel.
Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Signed-off-by: Arne Schwabe <arne@...1227...>
---
M src/openvpn/crypto.c
M src/openvpn/crypto.h
M src/openvpn/crypto_epoch.c
M src/openvpn/crypto_epoch.h
M src/openvpn/packet_id.c
M src/openvpn/packet_id.h
M src/openvpn/ssl_common.h
M tests/unit_tests/openvpn/test_crypto.c
8 files changed, 806 insertions(+), 22 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/04/804/10
diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
index 6e442a3..4e93882 100644
--- a/src/openvpn/crypto.c
+++ b/src/openvpn/crypto.c
@@ -918,14 +918,27 @@
if (cipher_ctx_mode_aead(ctx->cipher))
{
size_t impl_iv_len = 0;
+ size_t impl_iv_offset = 0;
ASSERT(cipher_ctx_iv_length(ctx->cipher) >= OPENVPN_AEAD_MIN_IV_LEN);
- impl_iv_len = cipher_ctx_iv_length(ctx->cipher) - sizeof(packet_id_type);
- ASSERT(impl_iv_len + sizeof(packet_id_type) <= OPENVPN_MAX_IV_LENGTH);
+
+ /* Epoch keys use XOR of full IV length with the packet id to generate
+ * IVs. Old data format uses concatenation instead (XOR with 0 for the
+ * first 4 bytes (sizeof(packet_id_type) */
+ if (key->epoch)
+ {
+ impl_iv_len = cipher_ctx_iv_length(ctx->cipher);
+ impl_iv_offset = 0;
+ }
+ else
+ {
+ impl_iv_len = cipher_ctx_iv_length(ctx->cipher) - sizeof(packet_id_type);
+ impl_iv_offset = sizeof(packet_id_type);
+ }
+ ASSERT(impl_iv_offset + impl_iv_len <= OPENVPN_MAX_IV_LENGTH);
ASSERT(impl_iv_len <= MAX_HMAC_KEY_LENGTH);
ASSERT(impl_iv_len <= key->hmac_size);
CLEAR(ctx->implicit_iv);
- /* The first bytes of the IV are filled with the packet id */
- memcpy(ctx->implicit_iv + sizeof(packet_id_type), key->hmac, impl_iv_len);
+ memcpy(ctx->implicit_iv + impl_iv_offset, key->hmac, impl_iv_len);
}
}
@@ -974,6 +987,7 @@
hmac_ctx_size(ctx->hmac));
}
+ ctx->epoch = key->epoch;
gc_free(&gc);
}
@@ -986,6 +1000,7 @@
snprintf(log_prefix, sizeof(log_prefix), "Outgoing %s", name);
init_key_ctx(ctx, key_params, kt, OPENVPN_OP_ENCRYPT, log_prefix);
key_ctx_update_implicit_iv(ctx, key_params);
+ ctx->epoch = key_params->epoch;
}
void
@@ -997,6 +1012,7 @@
snprintf(log_prefix, sizeof(log_prefix), "Incoming %s", name);
init_key_ctx(ctx, key_params, kt, OPENVPN_OP_DECRYPT, log_prefix);
key_ctx_update_implicit_iv(ctx, key_params);
+ ctx->epoch = key_params->epoch;
}
void
@@ -1034,6 +1050,7 @@
}
CLEAR(ctx->implicit_iv);
ctx->plaintext_blocks = 0;
+ ctx->epoch = 0;
}
void
diff --git a/src/openvpn/crypto.h b/src/openvpn/crypto.h
index 602e2e9..848ed0d 100644
--- a/src/openvpn/crypto.h
+++ b/src/openvpn/crypto.h
@@ -171,6 +171,11 @@
/** Number of bytes set in the HMac key material */
int hmac_size;
+
+ /** the epoch of the key. Only defined/non zero if key parameters
+ * represent a data channel epoch key parameters.
+ * Other uses of this struct leave this zero. */
+ uint16_t epoch;
};
/**
@@ -183,6 +188,11 @@
void
key_parameters_from_key(struct key_parameters *key_params, const struct key *key);
+struct epoch_key {
+ uint8_t epoch_key[SHA256_DIGEST_LENGTH];
+ uint16_t epoch;
+};
+
/**
* Container for one set of cipher and/or HMAC contexts.
* @ingroup control_processor
@@ -211,6 +221,10 @@
uint64_t plaintext_blocks;
/** number of failed verification using this cipher */
uint64_t failed_verifications;
+ /** OpenVPN data channel epoch, this variable holds the
+ * epoch number this key belongs to. Note that epoch 0 is not used
+ * and epoch is always non-zero for epoch key contexts */
+ uint16_t epoch;
};
#define KEY_DIRECTION_BIDIRECTIONAL 0 /* same keys for both directions */
@@ -280,6 +294,39 @@
/**< OpenSSL cipher and HMAC contexts for
* both sending and receiving
* directions. */
+
+ /** last epoch_key used for generation of the current send data keys.
+ * As invariant, the epoch of epoch_key_send is always kept >= the epoch of
+ * epoch_key_recv */
+ struct epoch_key epoch_key_send;
+
+ /** epoch_key used for the highest receive epoch keys */
+ struct epoch_key epoch_key_recv;
+
+ /** the key_type that is used to generate the epoch keys */
+ struct key_type epoch_key_type;
+
+ /** The limit for AEAD cipher, this is the sum of packets + blocks
+ * that are allowed to be used. Will switch to a new epoch if this
+ * limit is reached*/
+ uint64_t aead_usage_limit;
+
+ /** Keeps the future epoch data keys for decryption. The current one
+ * that is expected to be used is stored in key_ctx_bi.
+ *
+ * for encryption keys this is not needed as we only need the current
+ * and move to another key by iteration and we never need to go back
+ * to an older key.
+ */
+ struct key_ctx *epoch_data_keys_future;
+
+ /** number of keys stored in \c epoch_data_keys_future */
+ uint16_t epoch_data_keys_future_count;
+
+ /** The old key before the sender switched to a new epoch data key */
+ struct key_ctx epoch_retiring_data_receive_key;
+ struct packet_id_rec epoch_retiring_key_pid_recv;
+
struct packet_id packet_id; /**< Current packet ID state for both
* sending and receiving directions.
*
@@ -288,7 +335,7 @@
*
* The packet id also used as the IV
* for AEAD/OFB/CFG ciphers.
- * */
+ */
struct packet_id_persist *pid_persist;
/**< Persistent packet ID state for
* keeping state between successive
@@ -482,7 +529,8 @@
* @return true if packet ID is validated to be not a replay, false otherwise.
*/
bool crypto_check_replay(struct crypto_options *opt,
- const struct packet_id_net *pin, const char *error_prefix,
+ const struct packet_id_net *pin,
+ const char *error_prefix,
struct gc_arena *gc);
diff --git a/src/openvpn/crypto_epoch.c b/src/openvpn/crypto_epoch.c
index 667e12a6..368344b 100644
--- a/src/openvpn/crypto_epoch.c
+++ b/src/openvpn/crypto_epoch.c
@@ -29,7 +29,13 @@
#endif
#include <inttypes.h>
+#include <string.h>
+#include <stdlib.h>
+
#include "crypto_backend.h"
+#include "packet_id.h"
+#include "crypto.h"
+#include "crypto_epoch.h"
#include "buffer.h"
#include "integer.h"
@@ -112,3 +118,346 @@
gc_free(&gc);
return true;
}
+
+/**
+ * Iterates the epoch key to make it E_n+1, ie increase the epoch by one
+ * and derive the new key material accordingly
+ * @param epoch_key epoch key to iterate
+ */
+static void
+epoch_key_iterate(struct epoch_key *epoch_key)
+{
+ struct epoch_key new_epoch_key = { 0 };
+ new_epoch_key.epoch = epoch_key->epoch + 1;
+ const uint8_t epoch_update_label[] = "datakey upd";
+ /* length of the array without extra \0 byte from the string */
+ const size_t epoch_update_label_len = sizeof(epoch_update_label) - 1;
+
+ /* E_N+1 = OVPN-Expand-Label(E_N, "datakey upd", "", 32) */
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_update_label, epoch_update_label_len,
+ NULL, 0,
+ new_epoch_key.epoch_key, sizeof(new_epoch_key.epoch_key));
+ *epoch_key = new_epoch_key;
+}
+
+void
+epoch_data_key_derive(struct key_parameters *key,
+ const struct epoch_key *epoch_key,
+ const struct key_type *kt)
+{
+ key->hmac_size = cipher_kt_iv_size(kt->cipher);
+ key->cipher_size = cipher_kt_key_size(kt->cipher);
+
+ /* Generate data key from epoch key:
+ * K_i = OVPN-Expand-Label(E_i, "data_key", "", key_size)
+ * implicit_iv = OVPN-Expand-Label(E_i, "data_iv", "", implicit_iv_len)
+ */
+
+ const uint8_t epoch_data_key_label[] = "data_key";
+ /* length of the array without extra \0 byte from the string */
+ const size_t epoch_data_key_label_len = sizeof(epoch_data_key_label) - 1;
+
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_data_key_label, epoch_data_key_label_len,
+ NULL, 0,
+ (uint8_t *)(&key->cipher), key->cipher_size);
+
+ const uint8_t epoch_data_iv_label[] = "data_iv";
+ /* length of the array without extra \0 byte from the string */
+ const size_t epoch_data_iv_label_len = sizeof(epoch_data_iv_label) - 1;
+
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_data_iv_label, epoch_data_iv_label_len,
+ NULL, 0,
+ (uint8_t *)(&key->hmac), key->hmac_size);
+ key->epoch = epoch_key->epoch;
+}
+
+static void
+epoch_init_send_key_ctx(struct crypto_options *co)
+{
+ /* Ensure that we are NEVER regenerating the same key that has already
+ * been generated. Since we also reset the packet ID counter this would be
+ * catastrophic as we would do IV reuse which breaks ciphers like AES-GCM */
+ ASSERT(co->key_ctx_bi.encrypt.epoch != co->epoch_key_send.epoch);
+ char name[32] = { 0 };
+ snprintf(name, sizeof(name), "Epoch Data key %" PRIu16, co->epoch_key_send.epoch);
+
+ struct key_parameters send_key = { 0 };
+
+ epoch_data_key_derive(&send_key, &co->epoch_key_send, &co->epoch_key_type);
+
+ init_key_bi_ctx_send(&co->key_ctx_bi.encrypt, &send_key,
+ &co->epoch_key_type, name);
+ reset_packet_id_send(&co->packet_id.send);
+ CLEAR(send_key);
+}
+
+
+static void
+epoch_init_recv_key(struct key_ctx *ctx, struct crypto_options *co)
+{
+ struct key_parameters recv_key = { 0 };
+ epoch_data_key_derive(&recv_key, &co->epoch_key_recv, &co->epoch_key_type);
+
+ char name[32];
+
+ snprintf(name, sizeof(name), "Epoch Data key %" PRIu16, co->epoch_key_recv.epoch);
+
+ init_key_bi_ctx_recv(ctx, &recv_key, &co->epoch_key_type, name);
+ CLEAR(recv_key);
+}
+
+void
+epoch_generate_future_receive_keys(struct crypto_options *co)
+{
+ /* We want the future receive keys to start just after the epoch of the
+ * the currently used decryption key. */
+ ASSERT(co->key_ctx_bi.initialized);
+ uint16_t current_decrypt_epoch = co->key_ctx_bi.decrypt.epoch;
+
+ /* Either we have not generated any future keys yet (first initialisation)
+ * or the last index is the same as our current epoch key
+ * (last generated receive epoch key should match the epoch key) */
+ struct key_ctx *highest_future_key = &co->epoch_data_keys_future[co->epoch_data_keys_future_count - 1];
+
+ ASSERT(co->epoch_key_recv.epoch == 1
+ || highest_future_key->epoch == co->epoch_key_recv.epoch);
+
+ /* free the keys that are not used anymore */
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ /* Keys in future keys are always epoch > 1 if initialised */
+ if (co->epoch_data_keys_future[i].epoch > 0
+ && co->epoch_data_keys_future[i].epoch < current_decrypt_epoch)
+ {
+ /* Key is old, free it */
+ free_key_ctx(&co->epoch_data_keys_future[i]);
+ }
+ }
+
+ /* Calculate the number of keys that need to be generated,
+ * if no keys have been generated assume only the first key is defined */
+ uint16_t current_highest_key = highest_future_key->epoch ? highest_future_key->epoch : 1;
+ uint16_t desired_highest_key = current_decrypt_epoch + co->epoch_data_keys_future_count;
+ uint16_t num_keys_generate = desired_highest_key - current_highest_key;
+
+
+ /* Move the old keys out of the way so the order of keys stays strictly
+ * monotonic and consecutive. */
+ /* first check that the destination we are going to overwrite is freed */
+ for (uint16_t i = 0; i < num_keys_generate; i++)
+ {
+ ASSERT(co->epoch_data_keys_future[i].epoch == 0);
+ }
+ memmove(co->epoch_data_keys_future,
+ co->epoch_data_keys_future + num_keys_generate,
+ (co->epoch_data_keys_future_count - num_keys_generate) * sizeof(struct key_ctx));
+
+ /* Clear and regenerate the array elements at the end */
+ for (uint16_t i = co->epoch_data_keys_future_count - num_keys_generate; i < co->epoch_data_keys_future_count; i++)
+ {
+ CLEAR(co->epoch_data_keys_future[i]);
+ epoch_key_iterate(&co->epoch_key_recv);
+
+ epoch_init_recv_key(&co->epoch_data_keys_future[i], co);
+ }
+
+ /* Assert that all keys are initialised */
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ ASSERT(co->epoch_data_keys_future[i].epoch > 0);
+ }
+}
+
+void
+epoch_iterate_send_key(struct crypto_options *co)
+{
+ ASSERT(co->epoch_key_send.epoch < UINT16_MAX);
+ epoch_key_iterate(&co->epoch_key_send);
+ free_key_ctx(&co->key_ctx_bi.encrypt);
+ epoch_init_send_key_ctx(co);
+}
+
+void
+epoch_replace_update_recv_key(struct crypto_options *co,
+ uint16_t new_epoch)
+{
+ /* Find the key of the new epoch in future keys */
+ uint16_t fki;
+ for (fki = 0; fki < co->epoch_data_keys_future_count; fki++)
+ {
+ if (co->epoch_data_keys_future[fki].epoch == new_epoch)
+ {
+ break;
+ }
+ }
+ /* we should only ever be called when we successfully decrypted/authenticated
+ * a packet from a peer, ie the epoch recv key *MUST* be in that
+ * array */
+ ASSERT(fki < co->epoch_data_keys_future_count);
+ ASSERT(co->epoch_data_keys_future[fki].epoch == new_epoch);
+
+ struct key_ctx *new_ctx = &co->epoch_data_keys_future[fki];
+
+ /* Check if the new recv key epoch is higher than the send key epoch. If
+ * yes we will replace the send key as well */
+ if (co->key_ctx_bi.encrypt.epoch < new_epoch)
+ {
+ free_key_ctx(&co->key_ctx_bi.encrypt);
+
+ /* Update the epoch_key for send to match the current key being used.
+ * This is a bit of extra work but since we are a maximum of 16
+ * keys behind, a maximum 16 HMAC invocations are a small price to
+ * pay for not keeping all the old epoch keys around in future_keys
+ * array */
+ while (co->epoch_key_send.epoch < new_epoch)
+ {
+ epoch_key_iterate(&co->epoch_key_send);
+ }
+ epoch_init_send_key_ctx(co);
+ }
+
+ /* Replace receive key */
+ free_key_ctx(&co->epoch_retiring_data_receive_key);
+ co->epoch_retiring_data_receive_key = co->key_ctx_bi.decrypt;
+ packet_id_move_recv(&co->epoch_retiring_key_pid_recv, &co->packet_id.rec);
+
+ co->key_ctx_bi.decrypt = *new_ctx;
+
+ /* Zero the old location instead to of free_key_ctx since we moved the keys
+ * and do not want to free the pointers in the old place */
+ memset(new_ctx, 0, sizeof(struct key_ctx));
+
+ /* Generate new future keys */
+ epoch_generate_future_receive_keys(co);
+}
+
+void
+free_epoch_key_ctx(struct crypto_options *co)
+{
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ free_key_ctx(&co->epoch_data_keys_future[i]);
+ }
+
+ free(co->epoch_data_keys_future);
+ free_key_ctx(&co->epoch_retiring_data_receive_key);
+ free(co->epoch_retiring_key_pid_recv.seq_list);
+ CLEAR(co->epoch_key_recv);
+ CLEAR(co->epoch_key_send);
+}
+
+void
+epoch_init_key_ctx(struct crypto_options *co, const struct key_type *key_type,
+ const struct epoch_key *e1_send,
+ const struct epoch_key *e1_recv,
+ uint16_t future_key_count)
+{
+ ASSERT(e1_send->epoch == 1 && e1_recv->epoch == 1);
+ co->epoch_key_recv = *e1_recv;
+ co->epoch_key_send = *e1_send;
+
+ co->epoch_key_type = *key_type;
+ co->aead_usage_limit = cipher_get_aead_limits(key_type->cipher);
+
+ epoch_init_send_key_ctx(co);
+ epoch_init_recv_key(&co->key_ctx_bi.decrypt, co);
+ co->key_ctx_bi.initialized = true;
+
+ co->epoch_data_keys_future_count = future_key_count;
+ ALLOC_ARRAY_CLEAR(co->epoch_data_keys_future, struct key_ctx, co->epoch_data_keys_future_count);
+ epoch_generate_future_receive_keys(co);
+}
+
+struct key_ctx *
+epoch_lookup_decrypt_key(struct crypto_options *opt, uint16_t epoch)
+{
+ /* Current decrypt key is the most likely one */
+ if (opt->key_ctx_bi.decrypt.epoch == epoch)
+ {
+ return &opt->key_ctx_bi.decrypt;
+ }
+ else if (opt->epoch_retiring_data_receive_key.epoch
+ && opt->epoch_retiring_data_receive_key.epoch == epoch)
+ {
+ return &opt->epoch_retiring_data_receive_key;
+ }
+ else if (epoch > opt->key_ctx_bi.decrypt.epoch
+ && epoch <= opt->key_ctx_bi.decrypt.epoch + opt->epoch_data_keys_future_count)
+ {
+ /* Key in the range of future keys */
+ int index = epoch - (opt->key_ctx_bi.decrypt.epoch + 1);
+
+ /* If we have reached the edge of the valid keys we do not return
+ * the key anymore since regenerating the new keys would move us
+ * over the window of valid keys and would need all kind of
+ * special casing, so we stop returning the key in this case */
+ if (epoch > (UINT16_MAX - opt->epoch_data_keys_future_count - 1))
+ {
+ return NULL;
+ }
+ else
+ {
+ return &opt->epoch_data_keys_future[index];
+ }
+ }
+ else
+ {
+ return NULL;
+ }
+}
+
+
+void
+epoch_check_send_iterate(struct crypto_options *opt)
+{
+ if (opt->epoch_key_send.epoch == UINT16_MAX)
+ {
+ /* limit of epoch keys reached, cannot move to a newer key anymore */
+ return;
+ }
+ if (opt->aead_usage_limit)
+ {
+ if (aead_usage_limit_reached(opt->aead_usage_limit, &opt->key_ctx_bi.encrypt,
+ opt->packet_id.send.id))
+ {
+ /* Send key limit reached */
+ epoch_iterate_send_key(opt);
+ }
+ /* draft 8 of the aead usage limit still had but draft 9 complete
+ * dropped this statement:
+ *
+ * In particular, in two-party communication, one participant cannot
+ * regard apparent overuse of a key by other participants as
+ * being in error, when it could be that the other participant has
+ * better information about bounds.
+ *
+ * OpenVPN 2.x implements a compromise of not regarding this as an
+ * error but still accepting packets of the usage limit but tries to
+ * push the peer to a new epoch key by increasing our own key epoch
+ *
+ * Also try to push the sender to use a new key if we are the
+ * decryption fail warn limit.
+ * */
+ else if (opt->key_ctx_bi.encrypt.epoch == opt->key_ctx_bi.decrypt.epoch
+ && (aead_usage_limit_reached(opt->aead_usage_limit,
+ &opt->key_ctx_bi.decrypt,
+ opt->packet_id.rec.id)
+ || cipher_decrypt_verify_fail_warn(&opt->key_ctx_bi.decrypt)
+ ))
+ {
+ /* Receive key limit reached. Increase our own send key to signal
+ * that we want to use a new epoch. Peer should then also move its
+ * key but is not required to do this */
+ epoch_iterate_send_key(opt);
+ }
+ }
+
+ if (opt->packet_id.send.id == PACKET_ID_EPOCH_MAX)
+ {
+ epoch_iterate_send_key(opt);
+ }
+
+}
diff --git a/src/openvpn/crypto_epoch.h b/src/openvpn/crypto_epoch.h
index e5d0e5d..b2f3d86 100644
--- a/src/openvpn/crypto_epoch.h
+++ b/src/openvpn/crypto_epoch.h
@@ -67,4 +67,94 @@
const uint8_t *context, size_t context_len,
uint8_t *out, uint16_t out_len);
-#endif
+/**
+ * Generate a data channel key pair from the epoch key
+ * @param key Destination for the generated data key
+ * @param epoch_key Epoch key to be used
+ * @parm kt Cipher information to generate the data channel key for
+ */
+void
+epoch_data_key_derive(struct key_parameters *key,
+ const struct epoch_key *epoch_key,
+ const struct key_type *kt);
+
+/**
+ * Generates and fills the epoch_data_keys_future with next valid
+ * future keys in crypto_options using the epoch of the key in
+ * crypto_options.key_ctx_bi.decrypt as starting point
+ *
+ * This assume that the normal key_ctx_bi and epoch keys have been already
+ * setup.
+ *
+ * This method is also called if crypto_options.key_ctx_bi.decrypt is changed.
+ * The method will then change the future keys in epoch_data_keys_future to
+ * free the ones that are older than the crypto_options.key_ctx_bi.decrypt and
+ * generate the keys from the newer epoch.
+ */
+void
+epoch_generate_future_receive_keys(struct crypto_options *co);
+
+
+/** This is called when the peer uses a new send key that is not the default
+ * key. This function ensures the following:
+ * - recv key matches the epoch index provided
+ * - send key epoch is equal or higher than recv_key epoch
+ *
+ * @param new_epoch the new epoch to use for the receive key
+ */
+void
+epoch_replace_update_recv_key(struct crypto_options *co,
+ uint16_t new_epoch);
+
+/**
+ * Updates the send key and send_epoch_key in cryptio_options->key_ctx_bi to
+ * use the next epoch */
+void
+epoch_iterate_send_key(struct crypto_options *co);
+
+/**
+ * Frees the extra data structures used by epoch keys in \c crypto_options
+ */
+void
+free_epoch_key_ctx(struct crypto_options *co);
+
+/**
+ * Initialises data channel keys and internal structures for epoch data keys
+ * using the provided E0 epoch key
+ *
+ * @param co The crypto option struct to initialise the epoch
+ * related fields
+ * @param key_type The parameter of what encryption cipher to use when
+ * initialising the epoch related fields
+ * @param e1_send The E1 send epoch key derived by TLS-EKM
+ * @param e1_recv The E1 receive epoch key derived by TLS-EKM
+ * @param future_key_count the number of future epoch keys that should be
+ * considered valid when receiving data from the peer
+ */
+void
+epoch_init_key_ctx(struct crypto_options *co, const struct key_type *key_type,
+ const struct epoch_key *e1_send, const struct epoch_key *e1_recv,
+ uint16_t future_key_count);
+
+/**
+ * Using an epoch, this function will try to retrieve a decryption
+ * key context that matches that epoch from the \c opt argument
+ * @param opt crypto_options to use to find the decrypt key
+ * @param epoch epoch of the key to lookup
+ * @return the key context with
+ */
+struct key_ctx *
+epoch_lookup_decrypt_key(struct crypto_options *opt, uint16_t epoch);
+
+/**
+ * Checks if we need to iterate the send epoch key. This needs to be in one
+ * of the following condition
+ * - max epoch counter reached
+ * - send key aead usage limit reached (for AES-GCM and similar ciphers)
+ * - recv key usage limit reached
+ */
+void
+epoch_check_send_iterate(struct crypto_options *opt);
+
+
+#endif /* ifndef CRYPTO_EPOCH_H */
diff --git a/src/openvpn/packet_id.c b/src/openvpn/packet_id.c
index 0806e99..149dda2 100644
--- a/src/openvpn/packet_id.c
+++ b/src/openvpn/packet_id.c
@@ -77,6 +77,21 @@
#endif
}
+static void
+packet_id_init_recv(struct packet_id_rec *rec, int seq_backtrack, int time_backtrack, const char *name, int unit)
+{
+ rec->name = name;
+ rec->unit = unit;
+ if (seq_backtrack)
+ {
+ ASSERT(MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
+ ASSERT(MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
+ CIRC_LIST_ALLOC(rec->seq_list, struct seq_list, seq_backtrack);
+ rec->seq_backtrack = seq_backtrack;
+ rec->time_backtrack = time_backtrack;
+ }
+ rec->initialized = true;
+}
void
packet_id_init(struct packet_id *p, int seq_backtrack, int time_backtrack, const char *name, int unit)
{
@@ -87,17 +102,25 @@
ASSERT(p);
CLEAR(*p);
- p->rec.name = name;
- p->rec.unit = unit;
- if (seq_backtrack)
- {
- ASSERT(MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
- ASSERT(MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
- CIRC_LIST_ALLOC(p->rec.seq_list, struct seq_list, seq_backtrack);
- p->rec.seq_backtrack = seq_backtrack;
- p->rec.time_backtrack = time_backtrack;
- }
- p->rec.initialized = true;
+ packet_id_init_recv(&p->rec, seq_backtrack, time_backtrack, name, unit);
+}
+
+void
+packet_id_move_recv(struct packet_id_rec *dest, struct packet_id_rec *src)
+{
+ ASSERT(src);
+ ASSERT(dest);
+ /* clear free any old data in rec list */
+ free(dest->seq_list);
+ CLEAR(*dest);
+
+ /* Copy data to dest */
+ *dest = *src;
+
+ /* Reinitalise the source */
+ CLEAR(*src);
+ packet_id_init_recv(src, dest->seq_backtrack, dest->time_backtrack,
+ dest->name, dest->unit);
}
void
diff --git a/src/openvpn/packet_id.h b/src/openvpn/packet_id.h
index fa7ef7c..e78d912 100644
--- a/src/openvpn/packet_id.h
+++ b/src/openvpn/packet_id.h
@@ -206,6 +206,13 @@
void packet_id_free(struct packet_id *p);
+/**
+ * Move the packet id recv structure from \c src to \c dest. \c src will will
+ * be reinitialised. \c dest will be freed before the move.
+ */
+void
+packet_id_move_recv(struct packet_id_rec *dest, struct packet_id_rec *src);
+
/* should we accept an incoming packet id ? */
bool packet_id_test(struct packet_id_rec *p,
const struct packet_id_net *pin);
diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h
index e697d68..e092472 100644
--- a/src/openvpn/ssl_common.h
+++ b/src/openvpn/ssl_common.h
@@ -334,8 +334,8 @@
interval_t packet_timeout;
int64_t renegotiate_bytes;
int64_t renegotiate_packets;
- /** limit for AEAD cipher, this is the sum of packets + blocks
- * that are allowed to be used */
+ /** limit for AEAD cipher when not running in epoch data key mode,
+ * this is the sum of packets + blocks that are allowed to be used */
uint64_t aead_usage_limit;
interval_t renegotiate_seconds;
diff --git a/tests/unit_tests/openvpn/test_crypto.c b/tests/unit_tests/openvpn/test_crypto.c
index e16296b..3d9c99c 100644
--- a/tests/unit_tests/openvpn/test_crypto.c
+++ b/tests/unit_tests/openvpn/test_crypto.c
@@ -613,7 +613,7 @@
0x90, 0xb6, 0xc7, 0x3b, 0xb5, 0x0f, 0x9c, 0x31,
0x22, 0xec, 0x84, 0x4a, 0xd7, 0xc2, 0xb3, 0xe5};
- const uint8_t *label = (const uint8_t *)("unit test");
+ const uint8_t *label = (const uint8_t *) ("unit test");
uint8_t out[16];
ovpn_expand_label(secret, sizeof(secret), label, 9, NULL, 0, out, sizeof(out));
@@ -708,9 +708,242 @@
}
#endif /* if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L */
+struct epoch_test_state
+{
+ struct key_type kt;
+ struct gc_arena gc;
+ struct crypto_options co;
+};
+
+static int
+crypto_test_epoch_setup(void **state)
+{
+ int *num_future_keys = (int *)*state;
+ struct epoch_test_state *data = calloc(1, sizeof(struct epoch_test_state));
+
+ data->gc = gc_new();
+
+ init_key_type(&data->kt, "AES-128-GCM", "none", true, false);
+
+ /* have an epoch key that uses 0x23 for the key for all bytes */
+ struct epoch_key epoch1send = { .epoch = 1, .epoch_key = {0x23} };
+ struct epoch_key epoch1recv = { .epoch = 1, .epoch_key = {0x27} };
+
+ epoch_init_key_ctx(&data->co, &data->kt, &epoch1send,
+ &epoch1recv, *num_future_keys);
+
+ *state = data;
+ return 0;
+}
+
+static int
+crypto_test_epoch_teardown(void **state)
+{
+ struct epoch_test_state *data = *state;
+ free_epoch_key_ctx(&data->co);
+ free_key_ctx_bi(&data->co.key_ctx_bi);
+ gc_free(&data->gc);
+ free(*state);
+ return 0;
+}
+
+void
+crypto_test_epoch_key_generation(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* check the keys look like expect */
+ assert_int_equal(co->epoch_data_keys_future[0].epoch, 2);
+ assert_int_equal(co->epoch_data_keys_future[15].epoch, 17);
+ assert_int_equal(co->epoch_key_send.epoch, 1);
+ assert_int_equal(co->epoch_key_recv.epoch, 17);
+
+ /* Now replace the recv key with the 6th future key (epoch = 8) */
+ free_key_ctx(&co->key_ctx_bi.decrypt);
+ assert_int_equal(co->epoch_data_keys_future[6].epoch, 8);
+ co->key_ctx_bi.decrypt = co->epoch_data_keys_future[6];
+ CLEAR(co->epoch_data_keys_future[6]);
+
+ epoch_generate_future_receive_keys(co);
+ assert_int_equal(co->epoch_data_keys_future[0].epoch, 9);
+ assert_int_equal(co->epoch_data_keys_future[15].epoch, 24);
+}
+
+
+void
+crypto_test_epoch_key_rotation(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* should replace send + key recv */
+ epoch_replace_update_recv_key(co, 9);
+
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 9);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 9);
+ assert_int_equal(co->epoch_key_send.epoch, 9);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 1);
+
+ /* Iterate the data send key four times to get it to 13 */
+ for (int i = 0; i < 4; i++)
+ {
+ epoch_iterate_send_key(co);
+ }
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+
+ epoch_replace_update_recv_key(co, 10);
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 10);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+ assert_int_equal(co->epoch_key_send.epoch, 13);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 9);
+
+ epoch_replace_update_recv_key(co, 12);
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 12);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+ assert_int_equal(co->epoch_key_send.epoch, 13);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 10);
+
+ epoch_iterate_send_key(co);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 14);
+}
+
+void
+crypto_test_epoch_key_receive_lookup(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* lookup some wacky things that should fail */
+ assert_null(epoch_lookup_decrypt_key(co, 2000));
+ assert_null(epoch_lookup_decrypt_key(co, -1));
+ assert_null(epoch_lookup_decrypt_key(co, 0xefff));
+
+ /* Lookup the edges of the current window */
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 0);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 2)->epoch, 2);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 13)->epoch, 13);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 14)->epoch, 14);
+ assert_null(epoch_lookup_decrypt_key(co, 15));
+
+ /* Should move 1 to retiring key but leave 2-6 undefined, 7 as
+ * active and 8-20 as future keys*/
+ epoch_replace_update_recv_key(co, 7);
+
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
+ assert_ptr_equal(epoch_lookup_decrypt_key(co, 1), &co->epoch_retiring_data_receive_key);
+
+ assert_null(epoch_lookup_decrypt_key(co, 2));
+ assert_null(epoch_lookup_decrypt_key(co, 3));
+ assert_null(epoch_lookup_decrypt_key(co, 4));
+ assert_null(epoch_lookup_decrypt_key(co, 5));
+ assert_null(epoch_lookup_decrypt_key(co, 6));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 7)->epoch, 7);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 8)->epoch, 8);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 20)->epoch, 20);
+ assert_null(epoch_lookup_decrypt_key(co, 21));
+ assert_null(epoch_lookup_decrypt_key(co, 22));
+
+
+ /* Should move 7 to retiring key and have 8 as active key and
+ * 9-21 as future keys */
+ epoch_replace_update_recv_key(co, 8);
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_null(epoch_lookup_decrypt_key(co, 1));
+ assert_null(epoch_lookup_decrypt_key(co, 2));
+ assert_null(epoch_lookup_decrypt_key(co, 3));
+ assert_null(epoch_lookup_decrypt_key(co, 4));
+ assert_null(epoch_lookup_decrypt_key(co, 5));
+ assert_null(epoch_lookup_decrypt_key(co, 6));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 7)->epoch, 7);
+ assert_ptr_equal(epoch_lookup_decrypt_key(co, 7), &co->epoch_retiring_data_receive_key);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 8)->epoch, 8);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 20)->epoch, 20);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 21)->epoch, 21);
+ assert_null(epoch_lookup_decrypt_key(co, 22));
+ assert_null(epoch_lookup_decrypt_key(co, 23));
+}
+
+void
+crypto_test_epoch_key_overflow(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* Modify the receive epoch and keys to have a very high epoch to test
+ * the end of array. Iterating through all 16k keys takes a 2-3s, so we
+ * avoid this for the unit test */
+ co->key_ctx_bi.decrypt.epoch = 16000;
+ co->key_ctx_bi.encrypt.epoch = 16000;
+
+ co->epoch_key_send.epoch = 16000;
+ co->epoch_key_recv.epoch = 16000 + co->epoch_data_keys_future_count;
+
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ co->epoch_data_keys_future[i].epoch = 16001 + i;
+ }
+
+ /* Move the last few keys until we are close to the limit */
+ while (co->key_ctx_bi.decrypt.epoch < (UINT16_MAX - 40))
+ {
+ epoch_replace_update_recv_key(co, co->key_ctx_bi.decrypt.epoch + 10);
+ }
+
+ /* Looking up this key should still work as it will not break the limit
+ * when generating keys */
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 34)->epoch, UINT16_MAX - 34);
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 33)->epoch, UINT16_MAX - 33);
+
+ /* This key is no longer eligible for decrypting as the 32 future keys
+ * would be larger than uint16_t maximum */
+ assert_int_equal(co->epoch_data_keys_future_count, 32);
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - co->epoch_data_keys_future_count));
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX));
+
+ /* Check that moving to the last possible epoch works */
+ epoch_replace_update_recv_key(co, UINT16_MAX - 33);
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 33)->epoch, UINT16_MAX - 33);
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - 32));
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX));
+}
+
+void
+epoch_test_derive_data_key(void **state)
+{
+ struct epoch_key e17 = { .epoch = 17, .epoch_key = { 19, 12 }};
+ struct key_type kt = { 0 };
+ struct key_parameters key_parameters = { 0 };
+ init_key_type(&kt, "AES-192-GCM", "none", true, false);
+
+
+ epoch_data_key_derive(&key_parameters, &e17, &kt);
+
+ assert_int_equal(key_parameters.cipher_size, 24);
+ assert_int_equal(key_parameters.hmac_size, 12);
+
+ uint8_t exp_cipherkey[24] =
+ {0xed, 0x85, 0x33, 0xdb, 0x1c, 0x28, 0xac, 0xe4,
+ 0x18, 0xe9, 0x00, 0x6a, 0xb2, 0x9c, 0x17, 0x41,
+ 0x7d, 0x60, 0xeb, 0xe6, 0xcd, 0x90, 0xbf, 0x0a};
+
+ uint8_t exp_impl_iv[12] =
+ {0x86, 0x89, 0x0a, 0xab, 0xf0, 0x32, 0xcb, 0x59, 0xf4, 0xcf, 0xa3, 0x4e};
+
+ assert_memory_equal(key_parameters.cipher, exp_cipherkey, sizeof(exp_cipherkey));
+ assert_memory_equal(key_parameters.hmac, exp_impl_iv, sizeof(exp_impl_iv));
+}
+
int
main(void)
{
+ int prestate_num13 = 13;
+ int prestate_num16 = 16;
+ int prestate_num32 = 32;
+
openvpn_unit_test_setup();
const struct CMUnitTest tests[] = {
cmocka_unit_test(crypto_pem_encode_decode_loopback),
@@ -725,7 +958,24 @@
cmocka_unit_test(crypto_test_hkdf_expand_testa3),
cmocka_unit_test(crypto_test_hkdf_expand_test_ovpn),
cmocka_unit_test(crypto_test_ovpn_label_expand),
- cmocka_unit_test(crypto_test_ovpn_expand_openssl3)
+ cmocka_unit_test(crypto_test_ovpn_expand_openssl3),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_generation,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num16),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_rotation,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num13),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_receive_lookup,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num13),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_overflow,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num32),
+ cmocka_unit_test(epoch_test_derive_data_key)
};
#if defined(ENABLE_CRYPTO_OPENSSL)
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/804?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Gerrit-Change-Number: 804
Gerrit-PatchSet: 10
Gerrit-Owner: plaisthos <arne-openvpn@...1227...>
Gerrit-Reviewer: MaxF <max@...2606...>
Gerrit-Reviewer: flichtenheld <frank@...2641...>
Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net>
Gerrit-Attention: flichtenheld <frank@...2641...>
Gerrit-Attention: MaxF <max@...2606...>
Gerrit-MessageType: newpatchset
[-- Attachment #2: Type: text/html, Size: 87826 bytes --]
^ permalink raw reply related [flat|nested] 14+ messages in thread* [Openvpn-devel] [L] Change in openvpn[master]: Implement methods to generate and manage OpenVPN Epoch keys
[not found] <gerrit.1731290343000.Id7d6a576ca8c9560cb2dfae82fc62175820e9b80@...2715...>
` (8 preceding siblings ...)
2024-12-29 3:12 ` plaisthos (Code Review)
@ 2025-01-09 16:33 ` MaxF (Code Review)
2025-01-09 18:05 ` [Openvpn-devel] [PATCH v12] " Gert Doering
` (2 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: MaxF (Code Review) @ 2025-01-09 16:33 UTC (permalink / raw)
To: plaisthos <arne-openvpn@; +Cc: flichtenheld <frank@
[-- Attachment #1: Type: text/plain, Size: 1847 bytes --]
Attention is currently required from: flichtenheld, plaisthos.
MaxF has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/804?usp=email )
Change subject: Implement methods to generate and manage OpenVPN Epoch keys
......................................................................
Patch Set 12: Code-Review+2
(3 comments)
Patchset:
PS12:
Looks good!
Some typos, but those can be resolved during check-in I think.
File src/openvpn/crypto_epoch.c:
http://gerrit.openvpn.net/c/openvpn/+/804/comment/b2171fc7_9bf1eb9e :
PS12, Line 215: /* We want the future receive keys to start just after the epoch of the
: * the currently used decryption key. */
"the the"
(can be fixed during commit I think)
File src/openvpn/packet_id.h:
http://gerrit.openvpn.net/c/openvpn/+/804/comment/0548db58_7fc4e970 :
PS12, Line 210: * Move the packet id recv structure from \c src to \c dest. \c src will will
: * be reinitialised. \c dest will be freed before the move.
"will will"
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/804?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Gerrit-Change-Number: 804
Gerrit-PatchSet: 12
Gerrit-Owner: plaisthos <arne-openvpn@...1227...>
Gerrit-Reviewer: MaxF <max@...2606...>
Gerrit-Reviewer: flichtenheld <frank@...2641...>
Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net>
Gerrit-Attention: plaisthos <arne-openvpn@...1227...>
Gerrit-Attention: flichtenheld <frank@...2641...>
Gerrit-Comment-Date: Thu, 09 Jan 2025 16:33:05 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
[-- Attachment #2: Type: text/html, Size: 4021 bytes --]
^ permalink raw reply [flat|nested] 14+ messages in thread* [Openvpn-devel] [PATCH v12] Implement methods to generate and manage OpenVPN Epoch keys
[not found] <gerrit.1731290343000.Id7d6a576ca8c9560cb2dfae82fc62175820e9b80@...2715...>
` (9 preceding siblings ...)
2025-01-09 16:33 ` MaxF (Code Review)
@ 2025-01-09 18:05 ` Gert Doering
2025-01-10 7:14 ` [Openvpn-devel] [PATCH applied] " Gert Doering
2025-01-10 7:14 ` [Openvpn-devel] [L] Change in openvpn[master]: " cron2 (Code Review)
2025-01-10 7:14 ` cron2 (Code Review)
12 siblings, 1 reply; 14+ messages in thread
From: Gert Doering @ 2025-01-09 18:05 UTC (permalink / raw)
To: openvpn-devel
From: Arne Schwabe <arne@...1227...>
This implements functions that allow these keys to be generated and
managed. It does not yet implement using them for the data channel.
Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Signed-off-by: Arne Schwabe <arne@...1227...>
Acked-by: MaxF <max@...2606...>
---
This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/804
This mail reflects revision 12 of this Change.
Acked-by according to Gerrit (reflected above):
MaxF <max@...2606...>
diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
index ee9b0c6..b107f88 100644
--- a/src/openvpn/crypto.c
+++ b/src/openvpn/crypto.c
@@ -916,14 +916,27 @@
if (cipher_ctx_mode_aead(ctx->cipher))
{
size_t impl_iv_len = 0;
+ size_t impl_iv_offset = 0;
ASSERT(cipher_ctx_iv_length(ctx->cipher) >= OPENVPN_AEAD_MIN_IV_LEN);
- impl_iv_len = cipher_ctx_iv_length(ctx->cipher) - sizeof(packet_id_type);
- ASSERT(impl_iv_len + sizeof(packet_id_type) <= OPENVPN_MAX_IV_LENGTH);
+
+ /* Epoch keys use XOR of full IV length with the packet id to generate
+ * IVs. Old data format uses concatenation instead (XOR with 0 for the
+ * first 4 bytes (sizeof(packet_id_type) */
+ if (key->epoch)
+ {
+ impl_iv_len = cipher_ctx_iv_length(ctx->cipher);
+ impl_iv_offset = 0;
+ }
+ else
+ {
+ impl_iv_len = cipher_ctx_iv_length(ctx->cipher) - sizeof(packet_id_type);
+ impl_iv_offset = sizeof(packet_id_type);
+ }
+ ASSERT(impl_iv_offset + impl_iv_len <= OPENVPN_MAX_IV_LENGTH);
ASSERT(impl_iv_len <= MAX_HMAC_KEY_LENGTH);
ASSERT(impl_iv_len <= key->hmac_size);
CLEAR(ctx->implicit_iv);
- /* The first bytes of the IV are filled with the packet id */
- memcpy(ctx->implicit_iv + sizeof(packet_id_type), key->hmac, impl_iv_len);
+ memcpy(ctx->implicit_iv + impl_iv_offset, key->hmac, impl_iv_len);
}
}
@@ -972,6 +985,7 @@
hmac_ctx_size(ctx->hmac));
}
+ ctx->epoch = key->epoch;
gc_free(&gc);
}
@@ -984,6 +998,7 @@
snprintf(log_prefix, sizeof(log_prefix), "Outgoing %s", name);
init_key_ctx(ctx, key_params, kt, OPENVPN_OP_ENCRYPT, log_prefix);
key_ctx_update_implicit_iv(ctx, key_params);
+ ctx->epoch = key_params->epoch;
}
void
@@ -995,6 +1010,7 @@
snprintf(log_prefix, sizeof(log_prefix), "Incoming %s", name);
init_key_ctx(ctx, key_params, kt, OPENVPN_OP_DECRYPT, log_prefix);
key_ctx_update_implicit_iv(ctx, key_params);
+ ctx->epoch = key_params->epoch;
}
void
@@ -1032,6 +1048,7 @@
}
CLEAR(ctx->implicit_iv);
ctx->plaintext_blocks = 0;
+ ctx->epoch = 0;
}
void
diff --git a/src/openvpn/crypto.h b/src/openvpn/crypto.h
index fe81c7f..a98dca0 100644
--- a/src/openvpn/crypto.h
+++ b/src/openvpn/crypto.h
@@ -171,6 +171,11 @@
/** Number of bytes set in the HMac key material */
int hmac_size;
+
+ /** the epoch of the key. Only defined/non zero if key parameters
+ * represent a data channel epoch key parameters.
+ * Other uses of this struct leave this zero. */
+ uint16_t epoch;
};
/**
@@ -183,6 +188,11 @@
void
key_parameters_from_key(struct key_parameters *key_params, const struct key *key);
+struct epoch_key {
+ uint8_t epoch_key[SHA256_DIGEST_LENGTH];
+ uint16_t epoch;
+};
+
/**
* Container for one set of cipher and/or HMAC contexts.
* @ingroup control_processor
@@ -211,6 +221,10 @@
uint64_t plaintext_blocks;
/** number of failed verification using this cipher */
uint64_t failed_verifications;
+ /** OpenVPN data channel epoch, this variable holds the
+ * epoch number this key belongs to. Note that epoch 0 is not used
+ * and epoch is always non-zero for epoch key contexts */
+ uint16_t epoch;
};
#define KEY_DIRECTION_BIDIRECTIONAL 0 /* same keys for both directions */
@@ -280,6 +294,39 @@
/**< OpenSSL cipher and HMAC contexts for
* both sending and receiving
* directions. */
+
+ /** last epoch_key used for generation of the current send data keys.
+ * As invariant, the epoch of epoch_key_send is always kept >= the epoch of
+ * epoch_key_recv */
+ struct epoch_key epoch_key_send;
+
+ /** epoch_key used for the highest receive epoch keys */
+ struct epoch_key epoch_key_recv;
+
+ /** the key_type that is used to generate the epoch keys */
+ struct key_type epoch_key_type;
+
+ /** The limit for AEAD cipher, this is the sum of packets + blocks
+ * that are allowed to be used. Will switch to a new epoch if this
+ * limit is reached*/
+ uint64_t aead_usage_limit;
+
+ /** Keeps the future epoch data keys for decryption. The current one
+ * that is expected to be used is stored in key_ctx_bi.
+ *
+ * for encryption keys this is not needed as we only need the current
+ * and move to another key by iteration and we never need to go back
+ * to an older key.
+ */
+ struct key_ctx *epoch_data_keys_future;
+
+ /** number of keys stored in \c epoch_data_keys_future */
+ uint16_t epoch_data_keys_future_count;
+
+ /** The old key before the sender switched to a new epoch data key */
+ struct key_ctx epoch_retiring_data_receive_key;
+ struct packet_id_rec epoch_retiring_key_pid_recv;
+
struct packet_id packet_id; /**< Current packet ID state for both
* sending and receiving directions.
*
@@ -288,7 +335,7 @@
*
* The packet id also used as the IV
* for AEAD/OFB/CFG ciphers.
- * */
+ */
struct packet_id_persist *pid_persist;
/**< Persistent packet ID state for
* keeping state between successive
@@ -482,7 +529,8 @@
* @return true if packet ID is validated to be not a replay, false otherwise.
*/
bool crypto_check_replay(struct crypto_options *opt,
- const struct packet_id_net *pin, const char *error_prefix,
+ const struct packet_id_net *pin,
+ const char *error_prefix,
struct gc_arena *gc);
diff --git a/src/openvpn/crypto_epoch.c b/src/openvpn/crypto_epoch.c
index 667e12a6..368344b 100644
--- a/src/openvpn/crypto_epoch.c
+++ b/src/openvpn/crypto_epoch.c
@@ -29,7 +29,13 @@
#endif
#include <inttypes.h>
+#include <string.h>
+#include <stdlib.h>
+
#include "crypto_backend.h"
+#include "packet_id.h"
+#include "crypto.h"
+#include "crypto_epoch.h"
#include "buffer.h"
#include "integer.h"
@@ -112,3 +118,346 @@
gc_free(&gc);
return true;
}
+
+/**
+ * Iterates the epoch key to make it E_n+1, ie increase the epoch by one
+ * and derive the new key material accordingly
+ * @param epoch_key epoch key to iterate
+ */
+static void
+epoch_key_iterate(struct epoch_key *epoch_key)
+{
+ struct epoch_key new_epoch_key = { 0 };
+ new_epoch_key.epoch = epoch_key->epoch + 1;
+ const uint8_t epoch_update_label[] = "datakey upd";
+ /* length of the array without extra \0 byte from the string */
+ const size_t epoch_update_label_len = sizeof(epoch_update_label) - 1;
+
+ /* E_N+1 = OVPN-Expand-Label(E_N, "datakey upd", "", 32) */
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_update_label, epoch_update_label_len,
+ NULL, 0,
+ new_epoch_key.epoch_key, sizeof(new_epoch_key.epoch_key));
+ *epoch_key = new_epoch_key;
+}
+
+void
+epoch_data_key_derive(struct key_parameters *key,
+ const struct epoch_key *epoch_key,
+ const struct key_type *kt)
+{
+ key->hmac_size = cipher_kt_iv_size(kt->cipher);
+ key->cipher_size = cipher_kt_key_size(kt->cipher);
+
+ /* Generate data key from epoch key:
+ * K_i = OVPN-Expand-Label(E_i, "data_key", "", key_size)
+ * implicit_iv = OVPN-Expand-Label(E_i, "data_iv", "", implicit_iv_len)
+ */
+
+ const uint8_t epoch_data_key_label[] = "data_key";
+ /* length of the array without extra \0 byte from the string */
+ const size_t epoch_data_key_label_len = sizeof(epoch_data_key_label) - 1;
+
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_data_key_label, epoch_data_key_label_len,
+ NULL, 0,
+ (uint8_t *)(&key->cipher), key->cipher_size);
+
+ const uint8_t epoch_data_iv_label[] = "data_iv";
+ /* length of the array without extra \0 byte from the string */
+ const size_t epoch_data_iv_label_len = sizeof(epoch_data_iv_label) - 1;
+
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_data_iv_label, epoch_data_iv_label_len,
+ NULL, 0,
+ (uint8_t *)(&key->hmac), key->hmac_size);
+ key->epoch = epoch_key->epoch;
+}
+
+static void
+epoch_init_send_key_ctx(struct crypto_options *co)
+{
+ /* Ensure that we are NEVER regenerating the same key that has already
+ * been generated. Since we also reset the packet ID counter this would be
+ * catastrophic as we would do IV reuse which breaks ciphers like AES-GCM */
+ ASSERT(co->key_ctx_bi.encrypt.epoch != co->epoch_key_send.epoch);
+ char name[32] = { 0 };
+ snprintf(name, sizeof(name), "Epoch Data key %" PRIu16, co->epoch_key_send.epoch);
+
+ struct key_parameters send_key = { 0 };
+
+ epoch_data_key_derive(&send_key, &co->epoch_key_send, &co->epoch_key_type);
+
+ init_key_bi_ctx_send(&co->key_ctx_bi.encrypt, &send_key,
+ &co->epoch_key_type, name);
+ reset_packet_id_send(&co->packet_id.send);
+ CLEAR(send_key);
+}
+
+
+static void
+epoch_init_recv_key(struct key_ctx *ctx, struct crypto_options *co)
+{
+ struct key_parameters recv_key = { 0 };
+ epoch_data_key_derive(&recv_key, &co->epoch_key_recv, &co->epoch_key_type);
+
+ char name[32];
+
+ snprintf(name, sizeof(name), "Epoch Data key %" PRIu16, co->epoch_key_recv.epoch);
+
+ init_key_bi_ctx_recv(ctx, &recv_key, &co->epoch_key_type, name);
+ CLEAR(recv_key);
+}
+
+void
+epoch_generate_future_receive_keys(struct crypto_options *co)
+{
+ /* We want the future receive keys to start just after the epoch of the
+ * the currently used decryption key. */
+ ASSERT(co->key_ctx_bi.initialized);
+ uint16_t current_decrypt_epoch = co->key_ctx_bi.decrypt.epoch;
+
+ /* Either we have not generated any future keys yet (first initialisation)
+ * or the last index is the same as our current epoch key
+ * (last generated receive epoch key should match the epoch key) */
+ struct key_ctx *highest_future_key = &co->epoch_data_keys_future[co->epoch_data_keys_future_count - 1];
+
+ ASSERT(co->epoch_key_recv.epoch == 1
+ || highest_future_key->epoch == co->epoch_key_recv.epoch);
+
+ /* free the keys that are not used anymore */
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ /* Keys in future keys are always epoch > 1 if initialised */
+ if (co->epoch_data_keys_future[i].epoch > 0
+ && co->epoch_data_keys_future[i].epoch < current_decrypt_epoch)
+ {
+ /* Key is old, free it */
+ free_key_ctx(&co->epoch_data_keys_future[i]);
+ }
+ }
+
+ /* Calculate the number of keys that need to be generated,
+ * if no keys have been generated assume only the first key is defined */
+ uint16_t current_highest_key = highest_future_key->epoch ? highest_future_key->epoch : 1;
+ uint16_t desired_highest_key = current_decrypt_epoch + co->epoch_data_keys_future_count;
+ uint16_t num_keys_generate = desired_highest_key - current_highest_key;
+
+
+ /* Move the old keys out of the way so the order of keys stays strictly
+ * monotonic and consecutive. */
+ /* first check that the destination we are going to overwrite is freed */
+ for (uint16_t i = 0; i < num_keys_generate; i++)
+ {
+ ASSERT(co->epoch_data_keys_future[i].epoch == 0);
+ }
+ memmove(co->epoch_data_keys_future,
+ co->epoch_data_keys_future + num_keys_generate,
+ (co->epoch_data_keys_future_count - num_keys_generate) * sizeof(struct key_ctx));
+
+ /* Clear and regenerate the array elements at the end */
+ for (uint16_t i = co->epoch_data_keys_future_count - num_keys_generate; i < co->epoch_data_keys_future_count; i++)
+ {
+ CLEAR(co->epoch_data_keys_future[i]);
+ epoch_key_iterate(&co->epoch_key_recv);
+
+ epoch_init_recv_key(&co->epoch_data_keys_future[i], co);
+ }
+
+ /* Assert that all keys are initialised */
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ ASSERT(co->epoch_data_keys_future[i].epoch > 0);
+ }
+}
+
+void
+epoch_iterate_send_key(struct crypto_options *co)
+{
+ ASSERT(co->epoch_key_send.epoch < UINT16_MAX);
+ epoch_key_iterate(&co->epoch_key_send);
+ free_key_ctx(&co->key_ctx_bi.encrypt);
+ epoch_init_send_key_ctx(co);
+}
+
+void
+epoch_replace_update_recv_key(struct crypto_options *co,
+ uint16_t new_epoch)
+{
+ /* Find the key of the new epoch in future keys */
+ uint16_t fki;
+ for (fki = 0; fki < co->epoch_data_keys_future_count; fki++)
+ {
+ if (co->epoch_data_keys_future[fki].epoch == new_epoch)
+ {
+ break;
+ }
+ }
+ /* we should only ever be called when we successfully decrypted/authenticated
+ * a packet from a peer, ie the epoch recv key *MUST* be in that
+ * array */
+ ASSERT(fki < co->epoch_data_keys_future_count);
+ ASSERT(co->epoch_data_keys_future[fki].epoch == new_epoch);
+
+ struct key_ctx *new_ctx = &co->epoch_data_keys_future[fki];
+
+ /* Check if the new recv key epoch is higher than the send key epoch. If
+ * yes we will replace the send key as well */
+ if (co->key_ctx_bi.encrypt.epoch < new_epoch)
+ {
+ free_key_ctx(&co->key_ctx_bi.encrypt);
+
+ /* Update the epoch_key for send to match the current key being used.
+ * This is a bit of extra work but since we are a maximum of 16
+ * keys behind, a maximum 16 HMAC invocations are a small price to
+ * pay for not keeping all the old epoch keys around in future_keys
+ * array */
+ while (co->epoch_key_send.epoch < new_epoch)
+ {
+ epoch_key_iterate(&co->epoch_key_send);
+ }
+ epoch_init_send_key_ctx(co);
+ }
+
+ /* Replace receive key */
+ free_key_ctx(&co->epoch_retiring_data_receive_key);
+ co->epoch_retiring_data_receive_key = co->key_ctx_bi.decrypt;
+ packet_id_move_recv(&co->epoch_retiring_key_pid_recv, &co->packet_id.rec);
+
+ co->key_ctx_bi.decrypt = *new_ctx;
+
+ /* Zero the old location instead to of free_key_ctx since we moved the keys
+ * and do not want to free the pointers in the old place */
+ memset(new_ctx, 0, sizeof(struct key_ctx));
+
+ /* Generate new future keys */
+ epoch_generate_future_receive_keys(co);
+}
+
+void
+free_epoch_key_ctx(struct crypto_options *co)
+{
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ free_key_ctx(&co->epoch_data_keys_future[i]);
+ }
+
+ free(co->epoch_data_keys_future);
+ free_key_ctx(&co->epoch_retiring_data_receive_key);
+ free(co->epoch_retiring_key_pid_recv.seq_list);
+ CLEAR(co->epoch_key_recv);
+ CLEAR(co->epoch_key_send);
+}
+
+void
+epoch_init_key_ctx(struct crypto_options *co, const struct key_type *key_type,
+ const struct epoch_key *e1_send,
+ const struct epoch_key *e1_recv,
+ uint16_t future_key_count)
+{
+ ASSERT(e1_send->epoch == 1 && e1_recv->epoch == 1);
+ co->epoch_key_recv = *e1_recv;
+ co->epoch_key_send = *e1_send;
+
+ co->epoch_key_type = *key_type;
+ co->aead_usage_limit = cipher_get_aead_limits(key_type->cipher);
+
+ epoch_init_send_key_ctx(co);
+ epoch_init_recv_key(&co->key_ctx_bi.decrypt, co);
+ co->key_ctx_bi.initialized = true;
+
+ co->epoch_data_keys_future_count = future_key_count;
+ ALLOC_ARRAY_CLEAR(co->epoch_data_keys_future, struct key_ctx, co->epoch_data_keys_future_count);
+ epoch_generate_future_receive_keys(co);
+}
+
+struct key_ctx *
+epoch_lookup_decrypt_key(struct crypto_options *opt, uint16_t epoch)
+{
+ /* Current decrypt key is the most likely one */
+ if (opt->key_ctx_bi.decrypt.epoch == epoch)
+ {
+ return &opt->key_ctx_bi.decrypt;
+ }
+ else if (opt->epoch_retiring_data_receive_key.epoch
+ && opt->epoch_retiring_data_receive_key.epoch == epoch)
+ {
+ return &opt->epoch_retiring_data_receive_key;
+ }
+ else if (epoch > opt->key_ctx_bi.decrypt.epoch
+ && epoch <= opt->key_ctx_bi.decrypt.epoch + opt->epoch_data_keys_future_count)
+ {
+ /* Key in the range of future keys */
+ int index = epoch - (opt->key_ctx_bi.decrypt.epoch + 1);
+
+ /* If we have reached the edge of the valid keys we do not return
+ * the key anymore since regenerating the new keys would move us
+ * over the window of valid keys and would need all kind of
+ * special casing, so we stop returning the key in this case */
+ if (epoch > (UINT16_MAX - opt->epoch_data_keys_future_count - 1))
+ {
+ return NULL;
+ }
+ else
+ {
+ return &opt->epoch_data_keys_future[index];
+ }
+ }
+ else
+ {
+ return NULL;
+ }
+}
+
+
+void
+epoch_check_send_iterate(struct crypto_options *opt)
+{
+ if (opt->epoch_key_send.epoch == UINT16_MAX)
+ {
+ /* limit of epoch keys reached, cannot move to a newer key anymore */
+ return;
+ }
+ if (opt->aead_usage_limit)
+ {
+ if (aead_usage_limit_reached(opt->aead_usage_limit, &opt->key_ctx_bi.encrypt,
+ opt->packet_id.send.id))
+ {
+ /* Send key limit reached */
+ epoch_iterate_send_key(opt);
+ }
+ /* draft 8 of the aead usage limit still had but draft 9 complete
+ * dropped this statement:
+ *
+ * In particular, in two-party communication, one participant cannot
+ * regard apparent overuse of a key by other participants as
+ * being in error, when it could be that the other participant has
+ * better information about bounds.
+ *
+ * OpenVPN 2.x implements a compromise of not regarding this as an
+ * error but still accepting packets of the usage limit but tries to
+ * push the peer to a new epoch key by increasing our own key epoch
+ *
+ * Also try to push the sender to use a new key if we are the
+ * decryption fail warn limit.
+ * */
+ else if (opt->key_ctx_bi.encrypt.epoch == opt->key_ctx_bi.decrypt.epoch
+ && (aead_usage_limit_reached(opt->aead_usage_limit,
+ &opt->key_ctx_bi.decrypt,
+ opt->packet_id.rec.id)
+ || cipher_decrypt_verify_fail_warn(&opt->key_ctx_bi.decrypt)
+ ))
+ {
+ /* Receive key limit reached. Increase our own send key to signal
+ * that we want to use a new epoch. Peer should then also move its
+ * key but is not required to do this */
+ epoch_iterate_send_key(opt);
+ }
+ }
+
+ if (opt->packet_id.send.id == PACKET_ID_EPOCH_MAX)
+ {
+ epoch_iterate_send_key(opt);
+ }
+
+}
diff --git a/src/openvpn/crypto_epoch.h b/src/openvpn/crypto_epoch.h
index e5d0e5d..b2f3d86 100644
--- a/src/openvpn/crypto_epoch.h
+++ b/src/openvpn/crypto_epoch.h
@@ -67,4 +67,94 @@
const uint8_t *context, size_t context_len,
uint8_t *out, uint16_t out_len);
-#endif
+/**
+ * Generate a data channel key pair from the epoch key
+ * @param key Destination for the generated data key
+ * @param epoch_key Epoch key to be used
+ * @parm kt Cipher information to generate the data channel key for
+ */
+void
+epoch_data_key_derive(struct key_parameters *key,
+ const struct epoch_key *epoch_key,
+ const struct key_type *kt);
+
+/**
+ * Generates and fills the epoch_data_keys_future with next valid
+ * future keys in crypto_options using the epoch of the key in
+ * crypto_options.key_ctx_bi.decrypt as starting point
+ *
+ * This assume that the normal key_ctx_bi and epoch keys have been already
+ * setup.
+ *
+ * This method is also called if crypto_options.key_ctx_bi.decrypt is changed.
+ * The method will then change the future keys in epoch_data_keys_future to
+ * free the ones that are older than the crypto_options.key_ctx_bi.decrypt and
+ * generate the keys from the newer epoch.
+ */
+void
+epoch_generate_future_receive_keys(struct crypto_options *co);
+
+
+/** This is called when the peer uses a new send key that is not the default
+ * key. This function ensures the following:
+ * - recv key matches the epoch index provided
+ * - send key epoch is equal or higher than recv_key epoch
+ *
+ * @param new_epoch the new epoch to use for the receive key
+ */
+void
+epoch_replace_update_recv_key(struct crypto_options *co,
+ uint16_t new_epoch);
+
+/**
+ * Updates the send key and send_epoch_key in cryptio_options->key_ctx_bi to
+ * use the next epoch */
+void
+epoch_iterate_send_key(struct crypto_options *co);
+
+/**
+ * Frees the extra data structures used by epoch keys in \c crypto_options
+ */
+void
+free_epoch_key_ctx(struct crypto_options *co);
+
+/**
+ * Initialises data channel keys and internal structures for epoch data keys
+ * using the provided E0 epoch key
+ *
+ * @param co The crypto option struct to initialise the epoch
+ * related fields
+ * @param key_type The parameter of what encryption cipher to use when
+ * initialising the epoch related fields
+ * @param e1_send The E1 send epoch key derived by TLS-EKM
+ * @param e1_recv The E1 receive epoch key derived by TLS-EKM
+ * @param future_key_count the number of future epoch keys that should be
+ * considered valid when receiving data from the peer
+ */
+void
+epoch_init_key_ctx(struct crypto_options *co, const struct key_type *key_type,
+ const struct epoch_key *e1_send, const struct epoch_key *e1_recv,
+ uint16_t future_key_count);
+
+/**
+ * Using an epoch, this function will try to retrieve a decryption
+ * key context that matches that epoch from the \c opt argument
+ * @param opt crypto_options to use to find the decrypt key
+ * @param epoch epoch of the key to lookup
+ * @return the key context with
+ */
+struct key_ctx *
+epoch_lookup_decrypt_key(struct crypto_options *opt, uint16_t epoch);
+
+/**
+ * Checks if we need to iterate the send epoch key. This needs to be in one
+ * of the following condition
+ * - max epoch counter reached
+ * - send key aead usage limit reached (for AES-GCM and similar ciphers)
+ * - recv key usage limit reached
+ */
+void
+epoch_check_send_iterate(struct crypto_options *opt);
+
+
+#endif /* ifndef CRYPTO_EPOCH_H */
diff --git a/src/openvpn/packet_id.c b/src/openvpn/packet_id.c
index 0806e99..149dda2 100644
--- a/src/openvpn/packet_id.c
+++ b/src/openvpn/packet_id.c
@@ -77,6 +77,21 @@
#endif
}
+static void
+packet_id_init_recv(struct packet_id_rec *rec, int seq_backtrack, int time_backtrack, const char *name, int unit)
+{
+ rec->name = name;
+ rec->unit = unit;
+ if (seq_backtrack)
+ {
+ ASSERT(MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
+ ASSERT(MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
+ CIRC_LIST_ALLOC(rec->seq_list, struct seq_list, seq_backtrack);
+ rec->seq_backtrack = seq_backtrack;
+ rec->time_backtrack = time_backtrack;
+ }
+ rec->initialized = true;
+}
void
packet_id_init(struct packet_id *p, int seq_backtrack, int time_backtrack, const char *name, int unit)
{
@@ -87,17 +102,25 @@
ASSERT(p);
CLEAR(*p);
- p->rec.name = name;
- p->rec.unit = unit;
- if (seq_backtrack)
- {
- ASSERT(MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
- ASSERT(MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
- CIRC_LIST_ALLOC(p->rec.seq_list, struct seq_list, seq_backtrack);
- p->rec.seq_backtrack = seq_backtrack;
- p->rec.time_backtrack = time_backtrack;
- }
- p->rec.initialized = true;
+ packet_id_init_recv(&p->rec, seq_backtrack, time_backtrack, name, unit);
+}
+
+void
+packet_id_move_recv(struct packet_id_rec *dest, struct packet_id_rec *src)
+{
+ ASSERT(src);
+ ASSERT(dest);
+ /* clear free any old data in rec list */
+ free(dest->seq_list);
+ CLEAR(*dest);
+
+ /* Copy data to dest */
+ *dest = *src;
+
+ /* Reinitalise the source */
+ CLEAR(*src);
+ packet_id_init_recv(src, dest->seq_backtrack, dest->time_backtrack,
+ dest->name, dest->unit);
}
void
diff --git a/src/openvpn/packet_id.h b/src/openvpn/packet_id.h
index c05ac9a..9c0f464 100644
--- a/src/openvpn/packet_id.h
+++ b/src/openvpn/packet_id.h
@@ -206,6 +206,13 @@
void packet_id_free(struct packet_id *p);
+/**
+ * Move the packet id recv structure from \c src to \c dest. \c src will will
+ * be reinitialised. \c dest will be freed before the move.
+ */
+void
+packet_id_move_recv(struct packet_id_rec *dest, struct packet_id_rec *src);
+
/* should we accept an incoming packet id ? */
bool packet_id_test(struct packet_id_rec *p,
const struct packet_id_net *pin);
diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h
index e697d68..e092472 100644
--- a/src/openvpn/ssl_common.h
+++ b/src/openvpn/ssl_common.h
@@ -334,8 +334,8 @@
interval_t packet_timeout;
int64_t renegotiate_bytes;
int64_t renegotiate_packets;
- /** limit for AEAD cipher, this is the sum of packets + blocks
- * that are allowed to be used */
+ /** limit for AEAD cipher when not running in epoch data key mode,
+ * this is the sum of packets + blocks that are allowed to be used */
uint64_t aead_usage_limit;
interval_t renegotiate_seconds;
diff --git a/tests/unit_tests/openvpn/test_crypto.c b/tests/unit_tests/openvpn/test_crypto.c
index e16296b..3d9c99c 100644
--- a/tests/unit_tests/openvpn/test_crypto.c
+++ b/tests/unit_tests/openvpn/test_crypto.c
@@ -613,7 +613,7 @@
0x90, 0xb6, 0xc7, 0x3b, 0xb5, 0x0f, 0x9c, 0x31,
0x22, 0xec, 0x84, 0x4a, 0xd7, 0xc2, 0xb3, 0xe5};
- const uint8_t *label = (const uint8_t *)("unit test");
+ const uint8_t *label = (const uint8_t *) ("unit test");
uint8_t out[16];
ovpn_expand_label(secret, sizeof(secret), label, 9, NULL, 0, out, sizeof(out));
@@ -708,9 +708,242 @@
}
#endif /* if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L */
+struct epoch_test_state
+{
+ struct key_type kt;
+ struct gc_arena gc;
+ struct crypto_options co;
+};
+
+static int
+crypto_test_epoch_setup(void **state)
+{
+ int *num_future_keys = (int *)*state;
+ struct epoch_test_state *data = calloc(1, sizeof(struct epoch_test_state));
+
+ data->gc = gc_new();
+
+ init_key_type(&data->kt, "AES-128-GCM", "none", true, false);
+
+ /* have an epoch key that uses 0x23 for the key for all bytes */
+ struct epoch_key epoch1send = { .epoch = 1, .epoch_key = {0x23} };
+ struct epoch_key epoch1recv = { .epoch = 1, .epoch_key = {0x27} };
+
+ epoch_init_key_ctx(&data->co, &data->kt, &epoch1send,
+ &epoch1recv, *num_future_keys);
+
+ *state = data;
+ return 0;
+}
+
+static int
+crypto_test_epoch_teardown(void **state)
+{
+ struct epoch_test_state *data = *state;
+ free_epoch_key_ctx(&data->co);
+ free_key_ctx_bi(&data->co.key_ctx_bi);
+ gc_free(&data->gc);
+ free(*state);
+ return 0;
+}
+
+void
+crypto_test_epoch_key_generation(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* check the keys look like expect */
+ assert_int_equal(co->epoch_data_keys_future[0].epoch, 2);
+ assert_int_equal(co->epoch_data_keys_future[15].epoch, 17);
+ assert_int_equal(co->epoch_key_send.epoch, 1);
+ assert_int_equal(co->epoch_key_recv.epoch, 17);
+
+ /* Now replace the recv key with the 6th future key (epoch = 8) */
+ free_key_ctx(&co->key_ctx_bi.decrypt);
+ assert_int_equal(co->epoch_data_keys_future[6].epoch, 8);
+ co->key_ctx_bi.decrypt = co->epoch_data_keys_future[6];
+ CLEAR(co->epoch_data_keys_future[6]);
+
+ epoch_generate_future_receive_keys(co);
+ assert_int_equal(co->epoch_data_keys_future[0].epoch, 9);
+ assert_int_equal(co->epoch_data_keys_future[15].epoch, 24);
+}
+
+
+void
+crypto_test_epoch_key_rotation(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* should replace send + key recv */
+ epoch_replace_update_recv_key(co, 9);
+
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 9);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 9);
+ assert_int_equal(co->epoch_key_send.epoch, 9);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 1);
+
+ /* Iterate the data send key four times to get it to 13 */
+ for (int i = 0; i < 4; i++)
+ {
+ epoch_iterate_send_key(co);
+ }
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+
+ epoch_replace_update_recv_key(co, 10);
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 10);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+ assert_int_equal(co->epoch_key_send.epoch, 13);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 9);
+
+ epoch_replace_update_recv_key(co, 12);
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 12);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+ assert_int_equal(co->epoch_key_send.epoch, 13);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 10);
+
+ epoch_iterate_send_key(co);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 14);
+}
+
+void
+crypto_test_epoch_key_receive_lookup(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* lookup some wacky things that should fail */
+ assert_null(epoch_lookup_decrypt_key(co, 2000));
+ assert_null(epoch_lookup_decrypt_key(co, -1));
+ assert_null(epoch_lookup_decrypt_key(co, 0xefff));
+
+ /* Lookup the edges of the current window */
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 0);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 2)->epoch, 2);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 13)->epoch, 13);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 14)->epoch, 14);
+ assert_null(epoch_lookup_decrypt_key(co, 15));
+
+ /* Should move 1 to retiring key but leave 2-6 undefined, 7 as
+ * active and 8-20 as future keys*/
+ epoch_replace_update_recv_key(co, 7);
+
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
+ assert_ptr_equal(epoch_lookup_decrypt_key(co, 1), &co->epoch_retiring_data_receive_key);
+
+ assert_null(epoch_lookup_decrypt_key(co, 2));
+ assert_null(epoch_lookup_decrypt_key(co, 3));
+ assert_null(epoch_lookup_decrypt_key(co, 4));
+ assert_null(epoch_lookup_decrypt_key(co, 5));
+ assert_null(epoch_lookup_decrypt_key(co, 6));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 7)->epoch, 7);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 8)->epoch, 8);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 20)->epoch, 20);
+ assert_null(epoch_lookup_decrypt_key(co, 21));
+ assert_null(epoch_lookup_decrypt_key(co, 22));
+
+
+ /* Should move 7 to retiring key and have 8 as active key and
+ * 9-21 as future keys */
+ epoch_replace_update_recv_key(co, 8);
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_null(epoch_lookup_decrypt_key(co, 1));
+ assert_null(epoch_lookup_decrypt_key(co, 2));
+ assert_null(epoch_lookup_decrypt_key(co, 3));
+ assert_null(epoch_lookup_decrypt_key(co, 4));
+ assert_null(epoch_lookup_decrypt_key(co, 5));
+ assert_null(epoch_lookup_decrypt_key(co, 6));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 7)->epoch, 7);
+ assert_ptr_equal(epoch_lookup_decrypt_key(co, 7), &co->epoch_retiring_data_receive_key);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 8)->epoch, 8);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 20)->epoch, 20);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 21)->epoch, 21);
+ assert_null(epoch_lookup_decrypt_key(co, 22));
+ assert_null(epoch_lookup_decrypt_key(co, 23));
+}
+
+void
+crypto_test_epoch_key_overflow(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* Modify the receive epoch and keys to have a very high epoch to test
+ * the end of array. Iterating through all 16k keys takes a 2-3s, so we
+ * avoid this for the unit test */
+ co->key_ctx_bi.decrypt.epoch = 16000;
+ co->key_ctx_bi.encrypt.epoch = 16000;
+
+ co->epoch_key_send.epoch = 16000;
+ co->epoch_key_recv.epoch = 16000 + co->epoch_data_keys_future_count;
+
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ co->epoch_data_keys_future[i].epoch = 16001 + i;
+ }
+
+ /* Move the last few keys until we are close to the limit */
+ while (co->key_ctx_bi.decrypt.epoch < (UINT16_MAX - 40))
+ {
+ epoch_replace_update_recv_key(co, co->key_ctx_bi.decrypt.epoch + 10);
+ }
+
+ /* Looking up this key should still work as it will not break the limit
+ * when generating keys */
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 34)->epoch, UINT16_MAX - 34);
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 33)->epoch, UINT16_MAX - 33);
+
+ /* This key is no longer eligible for decrypting as the 32 future keys
+ * would be larger than uint16_t maximum */
+ assert_int_equal(co->epoch_data_keys_future_count, 32);
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - co->epoch_data_keys_future_count));
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX));
+
+ /* Check that moving to the last possible epoch works */
+ epoch_replace_update_recv_key(co, UINT16_MAX - 33);
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 33)->epoch, UINT16_MAX - 33);
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - 32));
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX));
+}
+
+void
+epoch_test_derive_data_key(void **state)
+{
+ struct epoch_key e17 = { .epoch = 17, .epoch_key = { 19, 12 }};
+ struct key_type kt = { 0 };
+ struct key_parameters key_parameters = { 0 };
+ init_key_type(&kt, "AES-192-GCM", "none", true, false);
+
+
+ epoch_data_key_derive(&key_parameters, &e17, &kt);
+
+ assert_int_equal(key_parameters.cipher_size, 24);
+ assert_int_equal(key_parameters.hmac_size, 12);
+
+ uint8_t exp_cipherkey[24] =
+ {0xed, 0x85, 0x33, 0xdb, 0x1c, 0x28, 0xac, 0xe4,
+ 0x18, 0xe9, 0x00, 0x6a, 0xb2, 0x9c, 0x17, 0x41,
+ 0x7d, 0x60, 0xeb, 0xe6, 0xcd, 0x90, 0xbf, 0x0a};
+
+ uint8_t exp_impl_iv[12] =
+ {0x86, 0x89, 0x0a, 0xab, 0xf0, 0x32, 0xcb, 0x59, 0xf4, 0xcf, 0xa3, 0x4e};
+
+ assert_memory_equal(key_parameters.cipher, exp_cipherkey, sizeof(exp_cipherkey));
+ assert_memory_equal(key_parameters.hmac, exp_impl_iv, sizeof(exp_impl_iv));
+}
+
int
main(void)
{
+ int prestate_num13 = 13;
+ int prestate_num16 = 16;
+ int prestate_num32 = 32;
+
openvpn_unit_test_setup();
const struct CMUnitTest tests[] = {
cmocka_unit_test(crypto_pem_encode_decode_loopback),
@@ -725,7 +958,24 @@
cmocka_unit_test(crypto_test_hkdf_expand_testa3),
cmocka_unit_test(crypto_test_hkdf_expand_test_ovpn),
cmocka_unit_test(crypto_test_ovpn_label_expand),
- cmocka_unit_test(crypto_test_ovpn_expand_openssl3)
+ cmocka_unit_test(crypto_test_ovpn_expand_openssl3),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_generation,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num16),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_rotation,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num13),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_receive_lookup,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num13),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_overflow,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num32),
+ cmocka_unit_test(epoch_test_derive_data_key)
};
#if defined(ENABLE_CRYPTO_OPENSSL)
^ permalink raw reply related [flat|nested] 14+ messages in thread* [Openvpn-devel] [PATCH applied] Re: Implement methods to generate and manage OpenVPN Epoch keys
2025-01-09 18:05 ` [Openvpn-devel] [PATCH v12] " Gert Doering
@ 2025-01-10 7:14 ` Gert Doering
0 siblings, 0 replies; 14+ messages in thread
From: Gert Doering @ 2025-01-10 7:14 UTC (permalink / raw)
To: Arne Schwabe <arne@; +Cc: openvpn-devel
Another patch in the series that doesn't actually change anything yet,
but builds infrastructure. It comes with a fairly extensive unit test,
which passes :-)
The changes look reasonable to me, and have a +2 from MaxF in Gerrit
(who understands crypto much better).
As the patch actually does add a (not yet used) branch to the regular
AEAD cipher path and also changes the "impl_iv_offset" stuff, I stared
a bit harder, and subjected everything to the client/server testbed -
and nothing breaks in the old packet format.
Two comments have been grammar fixed as instructed ("the the -> the" and
"will will -> will").
Your patch has been applied to the master branch.
commit 92adbc88b1b37095cebde2a1c5b6ae242f382678
Author: Arne Schwabe
Date: Thu Jan 9 19:05:37 2025 +0100
Implement methods to generate and manage OpenVPN Epoch keys
Signed-off-by: Arne Schwabe <arne@...1227...>
Acked-by: MaxF <max@...2606...>
Message-Id: <20250109180537.27686-1-gert@...1296...>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg30390.html
Signed-off-by: Gert Doering <gert@...1296...>
--
kind regards,
Gert Doering
^ permalink raw reply [flat|nested] 14+ messages in thread
* [Openvpn-devel] [L] Change in openvpn[master]: Implement methods to generate and manage OpenVPN Epoch keys
[not found] <gerrit.1731290343000.Id7d6a576ca8c9560cb2dfae82fc62175820e9b80@...2715...>
` (10 preceding siblings ...)
2025-01-09 18:05 ` [Openvpn-devel] [PATCH v12] " Gert Doering
@ 2025-01-10 7:14 ` cron2 (Code Review)
2025-01-10 7:14 ` cron2 (Code Review)
12 siblings, 0 replies; 14+ messages in thread
From: cron2 (Code Review) @ 2025-01-10 7:14 UTC (permalink / raw)
To: plaisthos <arne-openvpn@; +Cc: openvpn-devel
[-- Attachment #1: Type: text/plain, Size: 40662 bytes --]
cron2 has uploaded a new patch set (#13) to the change originally created by plaisthos. ( http://gerrit.openvpn.net/c/openvpn/+/804?usp=email )
The following approvals got outdated and were removed:
Code-Review+2 by MaxF
Change subject: Implement methods to generate and manage OpenVPN Epoch keys
......................................................................
Implement methods to generate and manage OpenVPN Epoch keys
This implements functions that allow these keys to be generated and
managed. It does not yet implement using them for the data channel.
Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Signed-off-by: Arne Schwabe <arne@...1227...>
Acked-by: MaxF <max@...2606...>
Message-Id: <20250109180537.27686-1-gert@...1296...>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg30390.html
Signed-off-by: Gert Doering <gert@...1296...>
---
M src/openvpn/crypto.c
M src/openvpn/crypto.h
M src/openvpn/crypto_epoch.c
M src/openvpn/crypto_epoch.h
M src/openvpn/packet_id.c
M src/openvpn/packet_id.h
M src/openvpn/ssl_common.h
M tests/unit_tests/openvpn/test_crypto.c
8 files changed, 806 insertions(+), 22 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/04/804/13
diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
index ee9b0c6..b107f88 100644
--- a/src/openvpn/crypto.c
+++ b/src/openvpn/crypto.c
@@ -916,14 +916,27 @@
if (cipher_ctx_mode_aead(ctx->cipher))
{
size_t impl_iv_len = 0;
+ size_t impl_iv_offset = 0;
ASSERT(cipher_ctx_iv_length(ctx->cipher) >= OPENVPN_AEAD_MIN_IV_LEN);
- impl_iv_len = cipher_ctx_iv_length(ctx->cipher) - sizeof(packet_id_type);
- ASSERT(impl_iv_len + sizeof(packet_id_type) <= OPENVPN_MAX_IV_LENGTH);
+
+ /* Epoch keys use XOR of full IV length with the packet id to generate
+ * IVs. Old data format uses concatenation instead (XOR with 0 for the
+ * first 4 bytes (sizeof(packet_id_type) */
+ if (key->epoch)
+ {
+ impl_iv_len = cipher_ctx_iv_length(ctx->cipher);
+ impl_iv_offset = 0;
+ }
+ else
+ {
+ impl_iv_len = cipher_ctx_iv_length(ctx->cipher) - sizeof(packet_id_type);
+ impl_iv_offset = sizeof(packet_id_type);
+ }
+ ASSERT(impl_iv_offset + impl_iv_len <= OPENVPN_MAX_IV_LENGTH);
ASSERT(impl_iv_len <= MAX_HMAC_KEY_LENGTH);
ASSERT(impl_iv_len <= key->hmac_size);
CLEAR(ctx->implicit_iv);
- /* The first bytes of the IV are filled with the packet id */
- memcpy(ctx->implicit_iv + sizeof(packet_id_type), key->hmac, impl_iv_len);
+ memcpy(ctx->implicit_iv + impl_iv_offset, key->hmac, impl_iv_len);
}
}
@@ -972,6 +985,7 @@
hmac_ctx_size(ctx->hmac));
}
+ ctx->epoch = key->epoch;
gc_free(&gc);
}
@@ -984,6 +998,7 @@
snprintf(log_prefix, sizeof(log_prefix), "Outgoing %s", name);
init_key_ctx(ctx, key_params, kt, OPENVPN_OP_ENCRYPT, log_prefix);
key_ctx_update_implicit_iv(ctx, key_params);
+ ctx->epoch = key_params->epoch;
}
void
@@ -995,6 +1010,7 @@
snprintf(log_prefix, sizeof(log_prefix), "Incoming %s", name);
init_key_ctx(ctx, key_params, kt, OPENVPN_OP_DECRYPT, log_prefix);
key_ctx_update_implicit_iv(ctx, key_params);
+ ctx->epoch = key_params->epoch;
}
void
@@ -1032,6 +1048,7 @@
}
CLEAR(ctx->implicit_iv);
ctx->plaintext_blocks = 0;
+ ctx->epoch = 0;
}
void
diff --git a/src/openvpn/crypto.h b/src/openvpn/crypto.h
index fe81c7f..a98dca0 100644
--- a/src/openvpn/crypto.h
+++ b/src/openvpn/crypto.h
@@ -171,6 +171,11 @@
/** Number of bytes set in the HMac key material */
int hmac_size;
+
+ /** the epoch of the key. Only defined/non zero if key parameters
+ * represent a data channel epoch key parameters.
+ * Other uses of this struct leave this zero. */
+ uint16_t epoch;
};
/**
@@ -183,6 +188,11 @@
void
key_parameters_from_key(struct key_parameters *key_params, const struct key *key);
+struct epoch_key {
+ uint8_t epoch_key[SHA256_DIGEST_LENGTH];
+ uint16_t epoch;
+};
+
/**
* Container for one set of cipher and/or HMAC contexts.
* @ingroup control_processor
@@ -211,6 +221,10 @@
uint64_t plaintext_blocks;
/** number of failed verification using this cipher */
uint64_t failed_verifications;
+ /** OpenVPN data channel epoch, this variable holds the
+ * epoch number this key belongs to. Note that epoch 0 is not used
+ * and epoch is always non-zero for epoch key contexts */
+ uint16_t epoch;
};
#define KEY_DIRECTION_BIDIRECTIONAL 0 /* same keys for both directions */
@@ -280,6 +294,39 @@
/**< OpenSSL cipher and HMAC contexts for
* both sending and receiving
* directions. */
+
+ /** last epoch_key used for generation of the current send data keys.
+ * As invariant, the epoch of epoch_key_send is always kept >= the epoch of
+ * epoch_key_recv */
+ struct epoch_key epoch_key_send;
+
+ /** epoch_key used for the highest receive epoch keys */
+ struct epoch_key epoch_key_recv;
+
+ /** the key_type that is used to generate the epoch keys */
+ struct key_type epoch_key_type;
+
+ /** The limit for AEAD cipher, this is the sum of packets + blocks
+ * that are allowed to be used. Will switch to a new epoch if this
+ * limit is reached*/
+ uint64_t aead_usage_limit;
+
+ /** Keeps the future epoch data keys for decryption. The current one
+ * that is expected to be used is stored in key_ctx_bi.
+ *
+ * for encryption keys this is not needed as we only need the current
+ * and move to another key by iteration and we never need to go back
+ * to an older key.
+ */
+ struct key_ctx *epoch_data_keys_future;
+
+ /** number of keys stored in \c epoch_data_keys_future */
+ uint16_t epoch_data_keys_future_count;
+
+ /** The old key before the sender switched to a new epoch data key */
+ struct key_ctx epoch_retiring_data_receive_key;
+ struct packet_id_rec epoch_retiring_key_pid_recv;
+
struct packet_id packet_id; /**< Current packet ID state for both
* sending and receiving directions.
*
@@ -288,7 +335,7 @@
*
* The packet id also used as the IV
* for AEAD/OFB/CFG ciphers.
- * */
+ */
struct packet_id_persist *pid_persist;
/**< Persistent packet ID state for
* keeping state between successive
@@ -482,7 +529,8 @@
* @return true if packet ID is validated to be not a replay, false otherwise.
*/
bool crypto_check_replay(struct crypto_options *opt,
- const struct packet_id_net *pin, const char *error_prefix,
+ const struct packet_id_net *pin,
+ const char *error_prefix,
struct gc_arena *gc);
diff --git a/src/openvpn/crypto_epoch.c b/src/openvpn/crypto_epoch.c
index 667e12a6..67bc910 100644
--- a/src/openvpn/crypto_epoch.c
+++ b/src/openvpn/crypto_epoch.c
@@ -29,7 +29,13 @@
#endif
#include <inttypes.h>
+#include <string.h>
+#include <stdlib.h>
+
#include "crypto_backend.h"
+#include "packet_id.h"
+#include "crypto.h"
+#include "crypto_epoch.h"
#include "buffer.h"
#include "integer.h"
@@ -112,3 +118,346 @@
gc_free(&gc);
return true;
}
+
+/**
+ * Iterates the epoch key to make it E_n+1, ie increase the epoch by one
+ * and derive the new key material accordingly
+ * @param epoch_key epoch key to iterate
+ */
+static void
+epoch_key_iterate(struct epoch_key *epoch_key)
+{
+ struct epoch_key new_epoch_key = { 0 };
+ new_epoch_key.epoch = epoch_key->epoch + 1;
+ const uint8_t epoch_update_label[] = "datakey upd";
+ /* length of the array without extra \0 byte from the string */
+ const size_t epoch_update_label_len = sizeof(epoch_update_label) - 1;
+
+ /* E_N+1 = OVPN-Expand-Label(E_N, "datakey upd", "", 32) */
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_update_label, epoch_update_label_len,
+ NULL, 0,
+ new_epoch_key.epoch_key, sizeof(new_epoch_key.epoch_key));
+ *epoch_key = new_epoch_key;
+}
+
+void
+epoch_data_key_derive(struct key_parameters *key,
+ const struct epoch_key *epoch_key,
+ const struct key_type *kt)
+{
+ key->hmac_size = cipher_kt_iv_size(kt->cipher);
+ key->cipher_size = cipher_kt_key_size(kt->cipher);
+
+ /* Generate data key from epoch key:
+ * K_i = OVPN-Expand-Label(E_i, "data_key", "", key_size)
+ * implicit_iv = OVPN-Expand-Label(E_i, "data_iv", "", implicit_iv_len)
+ */
+
+ const uint8_t epoch_data_key_label[] = "data_key";
+ /* length of the array without extra \0 byte from the string */
+ const size_t epoch_data_key_label_len = sizeof(epoch_data_key_label) - 1;
+
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_data_key_label, epoch_data_key_label_len,
+ NULL, 0,
+ (uint8_t *)(&key->cipher), key->cipher_size);
+
+ const uint8_t epoch_data_iv_label[] = "data_iv";
+ /* length of the array without extra \0 byte from the string */
+ const size_t epoch_data_iv_label_len = sizeof(epoch_data_iv_label) - 1;
+
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_data_iv_label, epoch_data_iv_label_len,
+ NULL, 0,
+ (uint8_t *)(&key->hmac), key->hmac_size);
+ key->epoch = epoch_key->epoch;
+}
+
+static void
+epoch_init_send_key_ctx(struct crypto_options *co)
+{
+ /* Ensure that we are NEVER regenerating the same key that has already
+ * been generated. Since we also reset the packet ID counter this would be
+ * catastrophic as we would do IV reuse which breaks ciphers like AES-GCM */
+ ASSERT(co->key_ctx_bi.encrypt.epoch != co->epoch_key_send.epoch);
+ char name[32] = { 0 };
+ snprintf(name, sizeof(name), "Epoch Data key %" PRIu16, co->epoch_key_send.epoch);
+
+ struct key_parameters send_key = { 0 };
+
+ epoch_data_key_derive(&send_key, &co->epoch_key_send, &co->epoch_key_type);
+
+ init_key_bi_ctx_send(&co->key_ctx_bi.encrypt, &send_key,
+ &co->epoch_key_type, name);
+ reset_packet_id_send(&co->packet_id.send);
+ CLEAR(send_key);
+}
+
+
+static void
+epoch_init_recv_key(struct key_ctx *ctx, struct crypto_options *co)
+{
+ struct key_parameters recv_key = { 0 };
+ epoch_data_key_derive(&recv_key, &co->epoch_key_recv, &co->epoch_key_type);
+
+ char name[32];
+
+ snprintf(name, sizeof(name), "Epoch Data key %" PRIu16, co->epoch_key_recv.epoch);
+
+ init_key_bi_ctx_recv(ctx, &recv_key, &co->epoch_key_type, name);
+ CLEAR(recv_key);
+}
+
+void
+epoch_generate_future_receive_keys(struct crypto_options *co)
+{
+ /* We want the future receive keys to start just after the epoch of
+ * the currently used decryption key. */
+ ASSERT(co->key_ctx_bi.initialized);
+ uint16_t current_decrypt_epoch = co->key_ctx_bi.decrypt.epoch;
+
+ /* Either we have not generated any future keys yet (first initialisation)
+ * or the last index is the same as our current epoch key
+ * (last generated receive epoch key should match the epoch key) */
+ struct key_ctx *highest_future_key = &co->epoch_data_keys_future[co->epoch_data_keys_future_count - 1];
+
+ ASSERT(co->epoch_key_recv.epoch == 1
+ || highest_future_key->epoch == co->epoch_key_recv.epoch);
+
+ /* free the keys that are not used anymore */
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ /* Keys in future keys are always epoch > 1 if initialised */
+ if (co->epoch_data_keys_future[i].epoch > 0
+ && co->epoch_data_keys_future[i].epoch < current_decrypt_epoch)
+ {
+ /* Key is old, free it */
+ free_key_ctx(&co->epoch_data_keys_future[i]);
+ }
+ }
+
+ /* Calculate the number of keys that need to be generated,
+ * if no keys have been generated assume only the first key is defined */
+ uint16_t current_highest_key = highest_future_key->epoch ? highest_future_key->epoch : 1;
+ uint16_t desired_highest_key = current_decrypt_epoch + co->epoch_data_keys_future_count;
+ uint16_t num_keys_generate = desired_highest_key - current_highest_key;
+
+
+ /* Move the old keys out of the way so the order of keys stays strictly
+ * monotonic and consecutive. */
+ /* first check that the destination we are going to overwrite is freed */
+ for (uint16_t i = 0; i < num_keys_generate; i++)
+ {
+ ASSERT(co->epoch_data_keys_future[i].epoch == 0);
+ }
+ memmove(co->epoch_data_keys_future,
+ co->epoch_data_keys_future + num_keys_generate,
+ (co->epoch_data_keys_future_count - num_keys_generate) * sizeof(struct key_ctx));
+
+ /* Clear and regenerate the array elements at the end */
+ for (uint16_t i = co->epoch_data_keys_future_count - num_keys_generate; i < co->epoch_data_keys_future_count; i++)
+ {
+ CLEAR(co->epoch_data_keys_future[i]);
+ epoch_key_iterate(&co->epoch_key_recv);
+
+ epoch_init_recv_key(&co->epoch_data_keys_future[i], co);
+ }
+
+ /* Assert that all keys are initialised */
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ ASSERT(co->epoch_data_keys_future[i].epoch > 0);
+ }
+}
+
+void
+epoch_iterate_send_key(struct crypto_options *co)
+{
+ ASSERT(co->epoch_key_send.epoch < UINT16_MAX);
+ epoch_key_iterate(&co->epoch_key_send);
+ free_key_ctx(&co->key_ctx_bi.encrypt);
+ epoch_init_send_key_ctx(co);
+}
+
+void
+epoch_replace_update_recv_key(struct crypto_options *co,
+ uint16_t new_epoch)
+{
+ /* Find the key of the new epoch in future keys */
+ uint16_t fki;
+ for (fki = 0; fki < co->epoch_data_keys_future_count; fki++)
+ {
+ if (co->epoch_data_keys_future[fki].epoch == new_epoch)
+ {
+ break;
+ }
+ }
+ /* we should only ever be called when we successfully decrypted/authenticated
+ * a packet from a peer, ie the epoch recv key *MUST* be in that
+ * array */
+ ASSERT(fki < co->epoch_data_keys_future_count);
+ ASSERT(co->epoch_data_keys_future[fki].epoch == new_epoch);
+
+ struct key_ctx *new_ctx = &co->epoch_data_keys_future[fki];
+
+ /* Check if the new recv key epoch is higher than the send key epoch. If
+ * yes we will replace the send key as well */
+ if (co->key_ctx_bi.encrypt.epoch < new_epoch)
+ {
+ free_key_ctx(&co->key_ctx_bi.encrypt);
+
+ /* Update the epoch_key for send to match the current key being used.
+ * This is a bit of extra work but since we are a maximum of 16
+ * keys behind, a maximum 16 HMAC invocations are a small price to
+ * pay for not keeping all the old epoch keys around in future_keys
+ * array */
+ while (co->epoch_key_send.epoch < new_epoch)
+ {
+ epoch_key_iterate(&co->epoch_key_send);
+ }
+ epoch_init_send_key_ctx(co);
+ }
+
+ /* Replace receive key */
+ free_key_ctx(&co->epoch_retiring_data_receive_key);
+ co->epoch_retiring_data_receive_key = co->key_ctx_bi.decrypt;
+ packet_id_move_recv(&co->epoch_retiring_key_pid_recv, &co->packet_id.rec);
+
+ co->key_ctx_bi.decrypt = *new_ctx;
+
+ /* Zero the old location instead to of free_key_ctx since we moved the keys
+ * and do not want to free the pointers in the old place */
+ memset(new_ctx, 0, sizeof(struct key_ctx));
+
+ /* Generate new future keys */
+ epoch_generate_future_receive_keys(co);
+}
+
+void
+free_epoch_key_ctx(struct crypto_options *co)
+{
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ free_key_ctx(&co->epoch_data_keys_future[i]);
+ }
+
+ free(co->epoch_data_keys_future);
+ free_key_ctx(&co->epoch_retiring_data_receive_key);
+ free(co->epoch_retiring_key_pid_recv.seq_list);
+ CLEAR(co->epoch_key_recv);
+ CLEAR(co->epoch_key_send);
+}
+
+void
+epoch_init_key_ctx(struct crypto_options *co, const struct key_type *key_type,
+ const struct epoch_key *e1_send,
+ const struct epoch_key *e1_recv,
+ uint16_t future_key_count)
+{
+ ASSERT(e1_send->epoch == 1 && e1_recv->epoch == 1);
+ co->epoch_key_recv = *e1_recv;
+ co->epoch_key_send = *e1_send;
+
+ co->epoch_key_type = *key_type;
+ co->aead_usage_limit = cipher_get_aead_limits(key_type->cipher);
+
+ epoch_init_send_key_ctx(co);
+ epoch_init_recv_key(&co->key_ctx_bi.decrypt, co);
+ co->key_ctx_bi.initialized = true;
+
+ co->epoch_data_keys_future_count = future_key_count;
+ ALLOC_ARRAY_CLEAR(co->epoch_data_keys_future, struct key_ctx, co->epoch_data_keys_future_count);
+ epoch_generate_future_receive_keys(co);
+}
+
+struct key_ctx *
+epoch_lookup_decrypt_key(struct crypto_options *opt, uint16_t epoch)
+{
+ /* Current decrypt key is the most likely one */
+ if (opt->key_ctx_bi.decrypt.epoch == epoch)
+ {
+ return &opt->key_ctx_bi.decrypt;
+ }
+ else if (opt->epoch_retiring_data_receive_key.epoch
+ && opt->epoch_retiring_data_receive_key.epoch == epoch)
+ {
+ return &opt->epoch_retiring_data_receive_key;
+ }
+ else if (epoch > opt->key_ctx_bi.decrypt.epoch
+ && epoch <= opt->key_ctx_bi.decrypt.epoch + opt->epoch_data_keys_future_count)
+ {
+ /* Key in the range of future keys */
+ int index = epoch - (opt->key_ctx_bi.decrypt.epoch + 1);
+
+ /* If we have reached the edge of the valid keys we do not return
+ * the key anymore since regenerating the new keys would move us
+ * over the window of valid keys and would need all kind of
+ * special casing, so we stop returning the key in this case */
+ if (epoch > (UINT16_MAX - opt->epoch_data_keys_future_count - 1))
+ {
+ return NULL;
+ }
+ else
+ {
+ return &opt->epoch_data_keys_future[index];
+ }
+ }
+ else
+ {
+ return NULL;
+ }
+}
+
+
+void
+epoch_check_send_iterate(struct crypto_options *opt)
+{
+ if (opt->epoch_key_send.epoch == UINT16_MAX)
+ {
+ /* limit of epoch keys reached, cannot move to a newer key anymore */
+ return;
+ }
+ if (opt->aead_usage_limit)
+ {
+ if (aead_usage_limit_reached(opt->aead_usage_limit, &opt->key_ctx_bi.encrypt,
+ opt->packet_id.send.id))
+ {
+ /* Send key limit reached */
+ epoch_iterate_send_key(opt);
+ }
+ /* draft 8 of the aead usage limit still had but draft 9 complete
+ * dropped this statement:
+ *
+ * In particular, in two-party communication, one participant cannot
+ * regard apparent overuse of a key by other participants as
+ * being in error, when it could be that the other participant has
+ * better information about bounds.
+ *
+ * OpenVPN 2.x implements a compromise of not regarding this as an
+ * error but still accepting packets of the usage limit but tries to
+ * push the peer to a new epoch key by increasing our own key epoch
+ *
+ * Also try to push the sender to use a new key if we are the
+ * decryption fail warn limit.
+ * */
+ else if (opt->key_ctx_bi.encrypt.epoch == opt->key_ctx_bi.decrypt.epoch
+ && (aead_usage_limit_reached(opt->aead_usage_limit,
+ &opt->key_ctx_bi.decrypt,
+ opt->packet_id.rec.id)
+ || cipher_decrypt_verify_fail_warn(&opt->key_ctx_bi.decrypt)
+ ))
+ {
+ /* Receive key limit reached. Increase our own send key to signal
+ * that we want to use a new epoch. Peer should then also move its
+ * key but is not required to do this */
+ epoch_iterate_send_key(opt);
+ }
+ }
+
+ if (opt->packet_id.send.id == PACKET_ID_EPOCH_MAX)
+ {
+ epoch_iterate_send_key(opt);
+ }
+
+}
diff --git a/src/openvpn/crypto_epoch.h b/src/openvpn/crypto_epoch.h
index e5d0e5d..b2f3d86 100644
--- a/src/openvpn/crypto_epoch.h
+++ b/src/openvpn/crypto_epoch.h
@@ -67,4 +67,94 @@
const uint8_t *context, size_t context_len,
uint8_t *out, uint16_t out_len);
-#endif
+/**
+ * Generate a data channel key pair from the epoch key
+ * @param key Destination for the generated data key
+ * @param epoch_key Epoch key to be used
+ * @parm kt Cipher information to generate the data channel key for
+ */
+void
+epoch_data_key_derive(struct key_parameters *key,
+ const struct epoch_key *epoch_key,
+ const struct key_type *kt);
+
+/**
+ * Generates and fills the epoch_data_keys_future with next valid
+ * future keys in crypto_options using the epoch of the key in
+ * crypto_options.key_ctx_bi.decrypt as starting point
+ *
+ * This assume that the normal key_ctx_bi and epoch keys have been already
+ * setup.
+ *
+ * This method is also called if crypto_options.key_ctx_bi.decrypt is changed.
+ * The method will then change the future keys in epoch_data_keys_future to
+ * free the ones that are older than the crypto_options.key_ctx_bi.decrypt and
+ * generate the keys from the newer epoch.
+ */
+void
+epoch_generate_future_receive_keys(struct crypto_options *co);
+
+
+/** This is called when the peer uses a new send key that is not the default
+ * key. This function ensures the following:
+ * - recv key matches the epoch index provided
+ * - send key epoch is equal or higher than recv_key epoch
+ *
+ * @param new_epoch the new epoch to use for the receive key
+ */
+void
+epoch_replace_update_recv_key(struct crypto_options *co,
+ uint16_t new_epoch);
+
+/**
+ * Updates the send key and send_epoch_key in cryptio_options->key_ctx_bi to
+ * use the next epoch */
+void
+epoch_iterate_send_key(struct crypto_options *co);
+
+/**
+ * Frees the extra data structures used by epoch keys in \c crypto_options
+ */
+void
+free_epoch_key_ctx(struct crypto_options *co);
+
+/**
+ * Initialises data channel keys and internal structures for epoch data keys
+ * using the provided E0 epoch key
+ *
+ * @param co The crypto option struct to initialise the epoch
+ * related fields
+ * @param key_type The parameter of what encryption cipher to use when
+ * initialising the epoch related fields
+ * @param e1_send The E1 send epoch key derived by TLS-EKM
+ * @param e1_recv The E1 receive epoch key derived by TLS-EKM
+ * @param future_key_count the number of future epoch keys that should be
+ * considered valid when receiving data from the peer
+ */
+void
+epoch_init_key_ctx(struct crypto_options *co, const struct key_type *key_type,
+ const struct epoch_key *e1_send, const struct epoch_key *e1_recv,
+ uint16_t future_key_count);
+
+/**
+ * Using an epoch, this function will try to retrieve a decryption
+ * key context that matches that epoch from the \c opt argument
+ * @param opt crypto_options to use to find the decrypt key
+ * @param epoch epoch of the key to lookup
+ * @return the key context with
+ */
+struct key_ctx *
+epoch_lookup_decrypt_key(struct crypto_options *opt, uint16_t epoch);
+
+/**
+ * Checks if we need to iterate the send epoch key. This needs to be in one
+ * of the following condition
+ * - max epoch counter reached
+ * - send key aead usage limit reached (for AES-GCM and similar ciphers)
+ * - recv key usage limit reached
+ */
+void
+epoch_check_send_iterate(struct crypto_options *opt);
+
+
+#endif /* ifndef CRYPTO_EPOCH_H */
diff --git a/src/openvpn/packet_id.c b/src/openvpn/packet_id.c
index 0806e99..149dda2 100644
--- a/src/openvpn/packet_id.c
+++ b/src/openvpn/packet_id.c
@@ -77,6 +77,21 @@
#endif
}
+static void
+packet_id_init_recv(struct packet_id_rec *rec, int seq_backtrack, int time_backtrack, const char *name, int unit)
+{
+ rec->name = name;
+ rec->unit = unit;
+ if (seq_backtrack)
+ {
+ ASSERT(MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
+ ASSERT(MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
+ CIRC_LIST_ALLOC(rec->seq_list, struct seq_list, seq_backtrack);
+ rec->seq_backtrack = seq_backtrack;
+ rec->time_backtrack = time_backtrack;
+ }
+ rec->initialized = true;
+}
void
packet_id_init(struct packet_id *p, int seq_backtrack, int time_backtrack, const char *name, int unit)
{
@@ -87,17 +102,25 @@
ASSERT(p);
CLEAR(*p);
- p->rec.name = name;
- p->rec.unit = unit;
- if (seq_backtrack)
- {
- ASSERT(MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
- ASSERT(MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
- CIRC_LIST_ALLOC(p->rec.seq_list, struct seq_list, seq_backtrack);
- p->rec.seq_backtrack = seq_backtrack;
- p->rec.time_backtrack = time_backtrack;
- }
- p->rec.initialized = true;
+ packet_id_init_recv(&p->rec, seq_backtrack, time_backtrack, name, unit);
+}
+
+void
+packet_id_move_recv(struct packet_id_rec *dest, struct packet_id_rec *src)
+{
+ ASSERT(src);
+ ASSERT(dest);
+ /* clear free any old data in rec list */
+ free(dest->seq_list);
+ CLEAR(*dest);
+
+ /* Copy data to dest */
+ *dest = *src;
+
+ /* Reinitalise the source */
+ CLEAR(*src);
+ packet_id_init_recv(src, dest->seq_backtrack, dest->time_backtrack,
+ dest->name, dest->unit);
}
void
diff --git a/src/openvpn/packet_id.h b/src/openvpn/packet_id.h
index c05ac9a..07e92ff 100644
--- a/src/openvpn/packet_id.h
+++ b/src/openvpn/packet_id.h
@@ -206,6 +206,13 @@
void packet_id_free(struct packet_id *p);
+/**
+ * Move the packet id recv structure from \c src to \c dest. \c src will
+ * be reinitialised. \c dest will be freed before the move.
+ */
+void
+packet_id_move_recv(struct packet_id_rec *dest, struct packet_id_rec *src);
+
/* should we accept an incoming packet id ? */
bool packet_id_test(struct packet_id_rec *p,
const struct packet_id_net *pin);
diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h
index e697d68..e092472 100644
--- a/src/openvpn/ssl_common.h
+++ b/src/openvpn/ssl_common.h
@@ -334,8 +334,8 @@
interval_t packet_timeout;
int64_t renegotiate_bytes;
int64_t renegotiate_packets;
- /** limit for AEAD cipher, this is the sum of packets + blocks
- * that are allowed to be used */
+ /** limit for AEAD cipher when not running in epoch data key mode,
+ * this is the sum of packets + blocks that are allowed to be used */
uint64_t aead_usage_limit;
interval_t renegotiate_seconds;
diff --git a/tests/unit_tests/openvpn/test_crypto.c b/tests/unit_tests/openvpn/test_crypto.c
index e16296b..3d9c99c 100644
--- a/tests/unit_tests/openvpn/test_crypto.c
+++ b/tests/unit_tests/openvpn/test_crypto.c
@@ -613,7 +613,7 @@
0x90, 0xb6, 0xc7, 0x3b, 0xb5, 0x0f, 0x9c, 0x31,
0x22, 0xec, 0x84, 0x4a, 0xd7, 0xc2, 0xb3, 0xe5};
- const uint8_t *label = (const uint8_t *)("unit test");
+ const uint8_t *label = (const uint8_t *) ("unit test");
uint8_t out[16];
ovpn_expand_label(secret, sizeof(secret), label, 9, NULL, 0, out, sizeof(out));
@@ -708,9 +708,242 @@
}
#endif /* if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L */
+struct epoch_test_state
+{
+ struct key_type kt;
+ struct gc_arena gc;
+ struct crypto_options co;
+};
+
+static int
+crypto_test_epoch_setup(void **state)
+{
+ int *num_future_keys = (int *)*state;
+ struct epoch_test_state *data = calloc(1, sizeof(struct epoch_test_state));
+
+ data->gc = gc_new();
+
+ init_key_type(&data->kt, "AES-128-GCM", "none", true, false);
+
+ /* have an epoch key that uses 0x23 for the key for all bytes */
+ struct epoch_key epoch1send = { .epoch = 1, .epoch_key = {0x23} };
+ struct epoch_key epoch1recv = { .epoch = 1, .epoch_key = {0x27} };
+
+ epoch_init_key_ctx(&data->co, &data->kt, &epoch1send,
+ &epoch1recv, *num_future_keys);
+
+ *state = data;
+ return 0;
+}
+
+static int
+crypto_test_epoch_teardown(void **state)
+{
+ struct epoch_test_state *data = *state;
+ free_epoch_key_ctx(&data->co);
+ free_key_ctx_bi(&data->co.key_ctx_bi);
+ gc_free(&data->gc);
+ free(*state);
+ return 0;
+}
+
+void
+crypto_test_epoch_key_generation(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* check the keys look like expect */
+ assert_int_equal(co->epoch_data_keys_future[0].epoch, 2);
+ assert_int_equal(co->epoch_data_keys_future[15].epoch, 17);
+ assert_int_equal(co->epoch_key_send.epoch, 1);
+ assert_int_equal(co->epoch_key_recv.epoch, 17);
+
+ /* Now replace the recv key with the 6th future key (epoch = 8) */
+ free_key_ctx(&co->key_ctx_bi.decrypt);
+ assert_int_equal(co->epoch_data_keys_future[6].epoch, 8);
+ co->key_ctx_bi.decrypt = co->epoch_data_keys_future[6];
+ CLEAR(co->epoch_data_keys_future[6]);
+
+ epoch_generate_future_receive_keys(co);
+ assert_int_equal(co->epoch_data_keys_future[0].epoch, 9);
+ assert_int_equal(co->epoch_data_keys_future[15].epoch, 24);
+}
+
+
+void
+crypto_test_epoch_key_rotation(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* should replace send + key recv */
+ epoch_replace_update_recv_key(co, 9);
+
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 9);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 9);
+ assert_int_equal(co->epoch_key_send.epoch, 9);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 1);
+
+ /* Iterate the data send key four times to get it to 13 */
+ for (int i = 0; i < 4; i++)
+ {
+ epoch_iterate_send_key(co);
+ }
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+
+ epoch_replace_update_recv_key(co, 10);
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 10);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+ assert_int_equal(co->epoch_key_send.epoch, 13);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 9);
+
+ epoch_replace_update_recv_key(co, 12);
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 12);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+ assert_int_equal(co->epoch_key_send.epoch, 13);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 10);
+
+ epoch_iterate_send_key(co);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 14);
+}
+
+void
+crypto_test_epoch_key_receive_lookup(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* lookup some wacky things that should fail */
+ assert_null(epoch_lookup_decrypt_key(co, 2000));
+ assert_null(epoch_lookup_decrypt_key(co, -1));
+ assert_null(epoch_lookup_decrypt_key(co, 0xefff));
+
+ /* Lookup the edges of the current window */
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 0);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 2)->epoch, 2);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 13)->epoch, 13);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 14)->epoch, 14);
+ assert_null(epoch_lookup_decrypt_key(co, 15));
+
+ /* Should move 1 to retiring key but leave 2-6 undefined, 7 as
+ * active and 8-20 as future keys*/
+ epoch_replace_update_recv_key(co, 7);
+
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
+ assert_ptr_equal(epoch_lookup_decrypt_key(co, 1), &co->epoch_retiring_data_receive_key);
+
+ assert_null(epoch_lookup_decrypt_key(co, 2));
+ assert_null(epoch_lookup_decrypt_key(co, 3));
+ assert_null(epoch_lookup_decrypt_key(co, 4));
+ assert_null(epoch_lookup_decrypt_key(co, 5));
+ assert_null(epoch_lookup_decrypt_key(co, 6));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 7)->epoch, 7);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 8)->epoch, 8);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 20)->epoch, 20);
+ assert_null(epoch_lookup_decrypt_key(co, 21));
+ assert_null(epoch_lookup_decrypt_key(co, 22));
+
+
+ /* Should move 7 to retiring key and have 8 as active key and
+ * 9-21 as future keys */
+ epoch_replace_update_recv_key(co, 8);
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_null(epoch_lookup_decrypt_key(co, 1));
+ assert_null(epoch_lookup_decrypt_key(co, 2));
+ assert_null(epoch_lookup_decrypt_key(co, 3));
+ assert_null(epoch_lookup_decrypt_key(co, 4));
+ assert_null(epoch_lookup_decrypt_key(co, 5));
+ assert_null(epoch_lookup_decrypt_key(co, 6));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 7)->epoch, 7);
+ assert_ptr_equal(epoch_lookup_decrypt_key(co, 7), &co->epoch_retiring_data_receive_key);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 8)->epoch, 8);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 20)->epoch, 20);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 21)->epoch, 21);
+ assert_null(epoch_lookup_decrypt_key(co, 22));
+ assert_null(epoch_lookup_decrypt_key(co, 23));
+}
+
+void
+crypto_test_epoch_key_overflow(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* Modify the receive epoch and keys to have a very high epoch to test
+ * the end of array. Iterating through all 16k keys takes a 2-3s, so we
+ * avoid this for the unit test */
+ co->key_ctx_bi.decrypt.epoch = 16000;
+ co->key_ctx_bi.encrypt.epoch = 16000;
+
+ co->epoch_key_send.epoch = 16000;
+ co->epoch_key_recv.epoch = 16000 + co->epoch_data_keys_future_count;
+
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ co->epoch_data_keys_future[i].epoch = 16001 + i;
+ }
+
+ /* Move the last few keys until we are close to the limit */
+ while (co->key_ctx_bi.decrypt.epoch < (UINT16_MAX - 40))
+ {
+ epoch_replace_update_recv_key(co, co->key_ctx_bi.decrypt.epoch + 10);
+ }
+
+ /* Looking up this key should still work as it will not break the limit
+ * when generating keys */
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 34)->epoch, UINT16_MAX - 34);
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 33)->epoch, UINT16_MAX - 33);
+
+ /* This key is no longer eligible for decrypting as the 32 future keys
+ * would be larger than uint16_t maximum */
+ assert_int_equal(co->epoch_data_keys_future_count, 32);
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - co->epoch_data_keys_future_count));
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX));
+
+ /* Check that moving to the last possible epoch works */
+ epoch_replace_update_recv_key(co, UINT16_MAX - 33);
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 33)->epoch, UINT16_MAX - 33);
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - 32));
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX));
+}
+
+void
+epoch_test_derive_data_key(void **state)
+{
+ struct epoch_key e17 = { .epoch = 17, .epoch_key = { 19, 12 }};
+ struct key_type kt = { 0 };
+ struct key_parameters key_parameters = { 0 };
+ init_key_type(&kt, "AES-192-GCM", "none", true, false);
+
+
+ epoch_data_key_derive(&key_parameters, &e17, &kt);
+
+ assert_int_equal(key_parameters.cipher_size, 24);
+ assert_int_equal(key_parameters.hmac_size, 12);
+
+ uint8_t exp_cipherkey[24] =
+ {0xed, 0x85, 0x33, 0xdb, 0x1c, 0x28, 0xac, 0xe4,
+ 0x18, 0xe9, 0x00, 0x6a, 0xb2, 0x9c, 0x17, 0x41,
+ 0x7d, 0x60, 0xeb, 0xe6, 0xcd, 0x90, 0xbf, 0x0a};
+
+ uint8_t exp_impl_iv[12] =
+ {0x86, 0x89, 0x0a, 0xab, 0xf0, 0x32, 0xcb, 0x59, 0xf4, 0xcf, 0xa3, 0x4e};
+
+ assert_memory_equal(key_parameters.cipher, exp_cipherkey, sizeof(exp_cipherkey));
+ assert_memory_equal(key_parameters.hmac, exp_impl_iv, sizeof(exp_impl_iv));
+}
+
int
main(void)
{
+ int prestate_num13 = 13;
+ int prestate_num16 = 16;
+ int prestate_num32 = 32;
+
openvpn_unit_test_setup();
const struct CMUnitTest tests[] = {
cmocka_unit_test(crypto_pem_encode_decode_loopback),
@@ -725,7 +958,24 @@
cmocka_unit_test(crypto_test_hkdf_expand_testa3),
cmocka_unit_test(crypto_test_hkdf_expand_test_ovpn),
cmocka_unit_test(crypto_test_ovpn_label_expand),
- cmocka_unit_test(crypto_test_ovpn_expand_openssl3)
+ cmocka_unit_test(crypto_test_ovpn_expand_openssl3),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_generation,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num16),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_rotation,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num13),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_receive_lookup,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num13),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_overflow,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num32),
+ cmocka_unit_test(epoch_test_derive_data_key)
};
#if defined(ENABLE_CRYPTO_OPENSSL)
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/804?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Gerrit-Change-Number: 804
Gerrit-PatchSet: 13
Gerrit-Owner: plaisthos <arne-openvpn@...1227...>
Gerrit-Reviewer: MaxF <max@...2606...>
Gerrit-Reviewer: flichtenheld <frank@...2641...>
Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net>
Gerrit-MessageType: newpatchset
[-- Attachment #2: Type: text/html, Size: 87847 bytes --]
^ permalink raw reply related [flat|nested] 14+ messages in thread* [Openvpn-devel] [L] Change in openvpn[master]: Implement methods to generate and manage OpenVPN Epoch keys
[not found] <gerrit.1731290343000.Id7d6a576ca8c9560cb2dfae82fc62175820e9b80@...2715...>
` (11 preceding siblings ...)
2025-01-10 7:14 ` [Openvpn-devel] [L] Change in openvpn[master]: " cron2 (Code Review)
@ 2025-01-10 7:14 ` cron2 (Code Review)
12 siblings, 0 replies; 14+ messages in thread
From: cron2 (Code Review) @ 2025-01-10 7:14 UTC (permalink / raw)
To: plaisthos <arne-openvpn@; +Cc: MaxF <max@
[-- Attachment #1: Type: text/plain, Size: 40447 bytes --]
cron2 has submitted this change. ( http://gerrit.openvpn.net/c/openvpn/+/804?usp=email )
Change subject: Implement methods to generate and manage OpenVPN Epoch keys
......................................................................
Implement methods to generate and manage OpenVPN Epoch keys
This implements functions that allow these keys to be generated and
managed. It does not yet implement using them for the data channel.
Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Signed-off-by: Arne Schwabe <arne@...1227...>
Acked-by: MaxF <max@...2606...>
Message-Id: <20250109180537.27686-1-gert@...1296...>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg30390.html
Signed-off-by: Gert Doering <gert@...1296...>
---
M src/openvpn/crypto.c
M src/openvpn/crypto.h
M src/openvpn/crypto_epoch.c
M src/openvpn/crypto_epoch.h
M src/openvpn/packet_id.c
M src/openvpn/packet_id.h
M src/openvpn/ssl_common.h
M tests/unit_tests/openvpn/test_crypto.c
8 files changed, 806 insertions(+), 22 deletions(-)
diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
index ee9b0c6..b107f88 100644
--- a/src/openvpn/crypto.c
+++ b/src/openvpn/crypto.c
@@ -916,14 +916,27 @@
if (cipher_ctx_mode_aead(ctx->cipher))
{
size_t impl_iv_len = 0;
+ size_t impl_iv_offset = 0;
ASSERT(cipher_ctx_iv_length(ctx->cipher) >= OPENVPN_AEAD_MIN_IV_LEN);
- impl_iv_len = cipher_ctx_iv_length(ctx->cipher) - sizeof(packet_id_type);
- ASSERT(impl_iv_len + sizeof(packet_id_type) <= OPENVPN_MAX_IV_LENGTH);
+
+ /* Epoch keys use XOR of full IV length with the packet id to generate
+ * IVs. Old data format uses concatenation instead (XOR with 0 for the
+ * first 4 bytes (sizeof(packet_id_type) */
+ if (key->epoch)
+ {
+ impl_iv_len = cipher_ctx_iv_length(ctx->cipher);
+ impl_iv_offset = 0;
+ }
+ else
+ {
+ impl_iv_len = cipher_ctx_iv_length(ctx->cipher) - sizeof(packet_id_type);
+ impl_iv_offset = sizeof(packet_id_type);
+ }
+ ASSERT(impl_iv_offset + impl_iv_len <= OPENVPN_MAX_IV_LENGTH);
ASSERT(impl_iv_len <= MAX_HMAC_KEY_LENGTH);
ASSERT(impl_iv_len <= key->hmac_size);
CLEAR(ctx->implicit_iv);
- /* The first bytes of the IV are filled with the packet id */
- memcpy(ctx->implicit_iv + sizeof(packet_id_type), key->hmac, impl_iv_len);
+ memcpy(ctx->implicit_iv + impl_iv_offset, key->hmac, impl_iv_len);
}
}
@@ -972,6 +985,7 @@
hmac_ctx_size(ctx->hmac));
}
+ ctx->epoch = key->epoch;
gc_free(&gc);
}
@@ -984,6 +998,7 @@
snprintf(log_prefix, sizeof(log_prefix), "Outgoing %s", name);
init_key_ctx(ctx, key_params, kt, OPENVPN_OP_ENCRYPT, log_prefix);
key_ctx_update_implicit_iv(ctx, key_params);
+ ctx->epoch = key_params->epoch;
}
void
@@ -995,6 +1010,7 @@
snprintf(log_prefix, sizeof(log_prefix), "Incoming %s", name);
init_key_ctx(ctx, key_params, kt, OPENVPN_OP_DECRYPT, log_prefix);
key_ctx_update_implicit_iv(ctx, key_params);
+ ctx->epoch = key_params->epoch;
}
void
@@ -1032,6 +1048,7 @@
}
CLEAR(ctx->implicit_iv);
ctx->plaintext_blocks = 0;
+ ctx->epoch = 0;
}
void
diff --git a/src/openvpn/crypto.h b/src/openvpn/crypto.h
index fe81c7f..a98dca0 100644
--- a/src/openvpn/crypto.h
+++ b/src/openvpn/crypto.h
@@ -171,6 +171,11 @@
/** Number of bytes set in the HMac key material */
int hmac_size;
+
+ /** the epoch of the key. Only defined/non zero if key parameters
+ * represent a data channel epoch key parameters.
+ * Other uses of this struct leave this zero. */
+ uint16_t epoch;
};
/**
@@ -183,6 +188,11 @@
void
key_parameters_from_key(struct key_parameters *key_params, const struct key *key);
+struct epoch_key {
+ uint8_t epoch_key[SHA256_DIGEST_LENGTH];
+ uint16_t epoch;
+};
+
/**
* Container for one set of cipher and/or HMAC contexts.
* @ingroup control_processor
@@ -211,6 +221,10 @@
uint64_t plaintext_blocks;
/** number of failed verification using this cipher */
uint64_t failed_verifications;
+ /** OpenVPN data channel epoch, this variable holds the
+ * epoch number this key belongs to. Note that epoch 0 is not used
+ * and epoch is always non-zero for epoch key contexts */
+ uint16_t epoch;
};
#define KEY_DIRECTION_BIDIRECTIONAL 0 /* same keys for both directions */
@@ -280,6 +294,39 @@
/**< OpenSSL cipher and HMAC contexts for
* both sending and receiving
* directions. */
+
+ /** last epoch_key used for generation of the current send data keys.
+ * As invariant, the epoch of epoch_key_send is always kept >= the epoch of
+ * epoch_key_recv */
+ struct epoch_key epoch_key_send;
+
+ /** epoch_key used for the highest receive epoch keys */
+ struct epoch_key epoch_key_recv;
+
+ /** the key_type that is used to generate the epoch keys */
+ struct key_type epoch_key_type;
+
+ /** The limit for AEAD cipher, this is the sum of packets + blocks
+ * that are allowed to be used. Will switch to a new epoch if this
+ * limit is reached*/
+ uint64_t aead_usage_limit;
+
+ /** Keeps the future epoch data keys for decryption. The current one
+ * that is expected to be used is stored in key_ctx_bi.
+ *
+ * for encryption keys this is not needed as we only need the current
+ * and move to another key by iteration and we never need to go back
+ * to an older key.
+ */
+ struct key_ctx *epoch_data_keys_future;
+
+ /** number of keys stored in \c epoch_data_keys_future */
+ uint16_t epoch_data_keys_future_count;
+
+ /** The old key before the sender switched to a new epoch data key */
+ struct key_ctx epoch_retiring_data_receive_key;
+ struct packet_id_rec epoch_retiring_key_pid_recv;
+
struct packet_id packet_id; /**< Current packet ID state for both
* sending and receiving directions.
*
@@ -288,7 +335,7 @@
*
* The packet id also used as the IV
* for AEAD/OFB/CFG ciphers.
- * */
+ */
struct packet_id_persist *pid_persist;
/**< Persistent packet ID state for
* keeping state between successive
@@ -482,7 +529,8 @@
* @return true if packet ID is validated to be not a replay, false otherwise.
*/
bool crypto_check_replay(struct crypto_options *opt,
- const struct packet_id_net *pin, const char *error_prefix,
+ const struct packet_id_net *pin,
+ const char *error_prefix,
struct gc_arena *gc);
diff --git a/src/openvpn/crypto_epoch.c b/src/openvpn/crypto_epoch.c
index 667e12a6..67bc910 100644
--- a/src/openvpn/crypto_epoch.c
+++ b/src/openvpn/crypto_epoch.c
@@ -29,7 +29,13 @@
#endif
#include <inttypes.h>
+#include <string.h>
+#include <stdlib.h>
+
#include "crypto_backend.h"
+#include "packet_id.h"
+#include "crypto.h"
+#include "crypto_epoch.h"
#include "buffer.h"
#include "integer.h"
@@ -112,3 +118,346 @@
gc_free(&gc);
return true;
}
+
+/**
+ * Iterates the epoch key to make it E_n+1, ie increase the epoch by one
+ * and derive the new key material accordingly
+ * @param epoch_key epoch key to iterate
+ */
+static void
+epoch_key_iterate(struct epoch_key *epoch_key)
+{
+ struct epoch_key new_epoch_key = { 0 };
+ new_epoch_key.epoch = epoch_key->epoch + 1;
+ const uint8_t epoch_update_label[] = "datakey upd";
+ /* length of the array without extra \0 byte from the string */
+ const size_t epoch_update_label_len = sizeof(epoch_update_label) - 1;
+
+ /* E_N+1 = OVPN-Expand-Label(E_N, "datakey upd", "", 32) */
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_update_label, epoch_update_label_len,
+ NULL, 0,
+ new_epoch_key.epoch_key, sizeof(new_epoch_key.epoch_key));
+ *epoch_key = new_epoch_key;
+}
+
+void
+epoch_data_key_derive(struct key_parameters *key,
+ const struct epoch_key *epoch_key,
+ const struct key_type *kt)
+{
+ key->hmac_size = cipher_kt_iv_size(kt->cipher);
+ key->cipher_size = cipher_kt_key_size(kt->cipher);
+
+ /* Generate data key from epoch key:
+ * K_i = OVPN-Expand-Label(E_i, "data_key", "", key_size)
+ * implicit_iv = OVPN-Expand-Label(E_i, "data_iv", "", implicit_iv_len)
+ */
+
+ const uint8_t epoch_data_key_label[] = "data_key";
+ /* length of the array without extra \0 byte from the string */
+ const size_t epoch_data_key_label_len = sizeof(epoch_data_key_label) - 1;
+
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_data_key_label, epoch_data_key_label_len,
+ NULL, 0,
+ (uint8_t *)(&key->cipher), key->cipher_size);
+
+ const uint8_t epoch_data_iv_label[] = "data_iv";
+ /* length of the array without extra \0 byte from the string */
+ const size_t epoch_data_iv_label_len = sizeof(epoch_data_iv_label) - 1;
+
+ ovpn_expand_label(epoch_key->epoch_key, sizeof(epoch_key->epoch_key),
+ epoch_data_iv_label, epoch_data_iv_label_len,
+ NULL, 0,
+ (uint8_t *)(&key->hmac), key->hmac_size);
+ key->epoch = epoch_key->epoch;
+}
+
+static void
+epoch_init_send_key_ctx(struct crypto_options *co)
+{
+ /* Ensure that we are NEVER regenerating the same key that has already
+ * been generated. Since we also reset the packet ID counter this would be
+ * catastrophic as we would do IV reuse which breaks ciphers like AES-GCM */
+ ASSERT(co->key_ctx_bi.encrypt.epoch != co->epoch_key_send.epoch);
+ char name[32] = { 0 };
+ snprintf(name, sizeof(name), "Epoch Data key %" PRIu16, co->epoch_key_send.epoch);
+
+ struct key_parameters send_key = { 0 };
+
+ epoch_data_key_derive(&send_key, &co->epoch_key_send, &co->epoch_key_type);
+
+ init_key_bi_ctx_send(&co->key_ctx_bi.encrypt, &send_key,
+ &co->epoch_key_type, name);
+ reset_packet_id_send(&co->packet_id.send);
+ CLEAR(send_key);
+}
+
+
+static void
+epoch_init_recv_key(struct key_ctx *ctx, struct crypto_options *co)
+{
+ struct key_parameters recv_key = { 0 };
+ epoch_data_key_derive(&recv_key, &co->epoch_key_recv, &co->epoch_key_type);
+
+ char name[32];
+
+ snprintf(name, sizeof(name), "Epoch Data key %" PRIu16, co->epoch_key_recv.epoch);
+
+ init_key_bi_ctx_recv(ctx, &recv_key, &co->epoch_key_type, name);
+ CLEAR(recv_key);
+}
+
+void
+epoch_generate_future_receive_keys(struct crypto_options *co)
+{
+ /* We want the future receive keys to start just after the epoch of
+ * the currently used decryption key. */
+ ASSERT(co->key_ctx_bi.initialized);
+ uint16_t current_decrypt_epoch = co->key_ctx_bi.decrypt.epoch;
+
+ /* Either we have not generated any future keys yet (first initialisation)
+ * or the last index is the same as our current epoch key
+ * (last generated receive epoch key should match the epoch key) */
+ struct key_ctx *highest_future_key = &co->epoch_data_keys_future[co->epoch_data_keys_future_count - 1];
+
+ ASSERT(co->epoch_key_recv.epoch == 1
+ || highest_future_key->epoch == co->epoch_key_recv.epoch);
+
+ /* free the keys that are not used anymore */
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ /* Keys in future keys are always epoch > 1 if initialised */
+ if (co->epoch_data_keys_future[i].epoch > 0
+ && co->epoch_data_keys_future[i].epoch < current_decrypt_epoch)
+ {
+ /* Key is old, free it */
+ free_key_ctx(&co->epoch_data_keys_future[i]);
+ }
+ }
+
+ /* Calculate the number of keys that need to be generated,
+ * if no keys have been generated assume only the first key is defined */
+ uint16_t current_highest_key = highest_future_key->epoch ? highest_future_key->epoch : 1;
+ uint16_t desired_highest_key = current_decrypt_epoch + co->epoch_data_keys_future_count;
+ uint16_t num_keys_generate = desired_highest_key - current_highest_key;
+
+
+ /* Move the old keys out of the way so the order of keys stays strictly
+ * monotonic and consecutive. */
+ /* first check that the destination we are going to overwrite is freed */
+ for (uint16_t i = 0; i < num_keys_generate; i++)
+ {
+ ASSERT(co->epoch_data_keys_future[i].epoch == 0);
+ }
+ memmove(co->epoch_data_keys_future,
+ co->epoch_data_keys_future + num_keys_generate,
+ (co->epoch_data_keys_future_count - num_keys_generate) * sizeof(struct key_ctx));
+
+ /* Clear and regenerate the array elements at the end */
+ for (uint16_t i = co->epoch_data_keys_future_count - num_keys_generate; i < co->epoch_data_keys_future_count; i++)
+ {
+ CLEAR(co->epoch_data_keys_future[i]);
+ epoch_key_iterate(&co->epoch_key_recv);
+
+ epoch_init_recv_key(&co->epoch_data_keys_future[i], co);
+ }
+
+ /* Assert that all keys are initialised */
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ ASSERT(co->epoch_data_keys_future[i].epoch > 0);
+ }
+}
+
+void
+epoch_iterate_send_key(struct crypto_options *co)
+{
+ ASSERT(co->epoch_key_send.epoch < UINT16_MAX);
+ epoch_key_iterate(&co->epoch_key_send);
+ free_key_ctx(&co->key_ctx_bi.encrypt);
+ epoch_init_send_key_ctx(co);
+}
+
+void
+epoch_replace_update_recv_key(struct crypto_options *co,
+ uint16_t new_epoch)
+{
+ /* Find the key of the new epoch in future keys */
+ uint16_t fki;
+ for (fki = 0; fki < co->epoch_data_keys_future_count; fki++)
+ {
+ if (co->epoch_data_keys_future[fki].epoch == new_epoch)
+ {
+ break;
+ }
+ }
+ /* we should only ever be called when we successfully decrypted/authenticated
+ * a packet from a peer, ie the epoch recv key *MUST* be in that
+ * array */
+ ASSERT(fki < co->epoch_data_keys_future_count);
+ ASSERT(co->epoch_data_keys_future[fki].epoch == new_epoch);
+
+ struct key_ctx *new_ctx = &co->epoch_data_keys_future[fki];
+
+ /* Check if the new recv key epoch is higher than the send key epoch. If
+ * yes we will replace the send key as well */
+ if (co->key_ctx_bi.encrypt.epoch < new_epoch)
+ {
+ free_key_ctx(&co->key_ctx_bi.encrypt);
+
+ /* Update the epoch_key for send to match the current key being used.
+ * This is a bit of extra work but since we are a maximum of 16
+ * keys behind, a maximum 16 HMAC invocations are a small price to
+ * pay for not keeping all the old epoch keys around in future_keys
+ * array */
+ while (co->epoch_key_send.epoch < new_epoch)
+ {
+ epoch_key_iterate(&co->epoch_key_send);
+ }
+ epoch_init_send_key_ctx(co);
+ }
+
+ /* Replace receive key */
+ free_key_ctx(&co->epoch_retiring_data_receive_key);
+ co->epoch_retiring_data_receive_key = co->key_ctx_bi.decrypt;
+ packet_id_move_recv(&co->epoch_retiring_key_pid_recv, &co->packet_id.rec);
+
+ co->key_ctx_bi.decrypt = *new_ctx;
+
+ /* Zero the old location instead to of free_key_ctx since we moved the keys
+ * and do not want to free the pointers in the old place */
+ memset(new_ctx, 0, sizeof(struct key_ctx));
+
+ /* Generate new future keys */
+ epoch_generate_future_receive_keys(co);
+}
+
+void
+free_epoch_key_ctx(struct crypto_options *co)
+{
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ free_key_ctx(&co->epoch_data_keys_future[i]);
+ }
+
+ free(co->epoch_data_keys_future);
+ free_key_ctx(&co->epoch_retiring_data_receive_key);
+ free(co->epoch_retiring_key_pid_recv.seq_list);
+ CLEAR(co->epoch_key_recv);
+ CLEAR(co->epoch_key_send);
+}
+
+void
+epoch_init_key_ctx(struct crypto_options *co, const struct key_type *key_type,
+ const struct epoch_key *e1_send,
+ const struct epoch_key *e1_recv,
+ uint16_t future_key_count)
+{
+ ASSERT(e1_send->epoch == 1 && e1_recv->epoch == 1);
+ co->epoch_key_recv = *e1_recv;
+ co->epoch_key_send = *e1_send;
+
+ co->epoch_key_type = *key_type;
+ co->aead_usage_limit = cipher_get_aead_limits(key_type->cipher);
+
+ epoch_init_send_key_ctx(co);
+ epoch_init_recv_key(&co->key_ctx_bi.decrypt, co);
+ co->key_ctx_bi.initialized = true;
+
+ co->epoch_data_keys_future_count = future_key_count;
+ ALLOC_ARRAY_CLEAR(co->epoch_data_keys_future, struct key_ctx, co->epoch_data_keys_future_count);
+ epoch_generate_future_receive_keys(co);
+}
+
+struct key_ctx *
+epoch_lookup_decrypt_key(struct crypto_options *opt, uint16_t epoch)
+{
+ /* Current decrypt key is the most likely one */
+ if (opt->key_ctx_bi.decrypt.epoch == epoch)
+ {
+ return &opt->key_ctx_bi.decrypt;
+ }
+ else if (opt->epoch_retiring_data_receive_key.epoch
+ && opt->epoch_retiring_data_receive_key.epoch == epoch)
+ {
+ return &opt->epoch_retiring_data_receive_key;
+ }
+ else if (epoch > opt->key_ctx_bi.decrypt.epoch
+ && epoch <= opt->key_ctx_bi.decrypt.epoch + opt->epoch_data_keys_future_count)
+ {
+ /* Key in the range of future keys */
+ int index = epoch - (opt->key_ctx_bi.decrypt.epoch + 1);
+
+ /* If we have reached the edge of the valid keys we do not return
+ * the key anymore since regenerating the new keys would move us
+ * over the window of valid keys and would need all kind of
+ * special casing, so we stop returning the key in this case */
+ if (epoch > (UINT16_MAX - opt->epoch_data_keys_future_count - 1))
+ {
+ return NULL;
+ }
+ else
+ {
+ return &opt->epoch_data_keys_future[index];
+ }
+ }
+ else
+ {
+ return NULL;
+ }
+}
+
+
+void
+epoch_check_send_iterate(struct crypto_options *opt)
+{
+ if (opt->epoch_key_send.epoch == UINT16_MAX)
+ {
+ /* limit of epoch keys reached, cannot move to a newer key anymore */
+ return;
+ }
+ if (opt->aead_usage_limit)
+ {
+ if (aead_usage_limit_reached(opt->aead_usage_limit, &opt->key_ctx_bi.encrypt,
+ opt->packet_id.send.id))
+ {
+ /* Send key limit reached */
+ epoch_iterate_send_key(opt);
+ }
+ /* draft 8 of the aead usage limit still had but draft 9 complete
+ * dropped this statement:
+ *
+ * In particular, in two-party communication, one participant cannot
+ * regard apparent overuse of a key by other participants as
+ * being in error, when it could be that the other participant has
+ * better information about bounds.
+ *
+ * OpenVPN 2.x implements a compromise of not regarding this as an
+ * error but still accepting packets of the usage limit but tries to
+ * push the peer to a new epoch key by increasing our own key epoch
+ *
+ * Also try to push the sender to use a new key if we are the
+ * decryption fail warn limit.
+ * */
+ else if (opt->key_ctx_bi.encrypt.epoch == opt->key_ctx_bi.decrypt.epoch
+ && (aead_usage_limit_reached(opt->aead_usage_limit,
+ &opt->key_ctx_bi.decrypt,
+ opt->packet_id.rec.id)
+ || cipher_decrypt_verify_fail_warn(&opt->key_ctx_bi.decrypt)
+ ))
+ {
+ /* Receive key limit reached. Increase our own send key to signal
+ * that we want to use a new epoch. Peer should then also move its
+ * key but is not required to do this */
+ epoch_iterate_send_key(opt);
+ }
+ }
+
+ if (opt->packet_id.send.id == PACKET_ID_EPOCH_MAX)
+ {
+ epoch_iterate_send_key(opt);
+ }
+
+}
diff --git a/src/openvpn/crypto_epoch.h b/src/openvpn/crypto_epoch.h
index e5d0e5d..b2f3d86 100644
--- a/src/openvpn/crypto_epoch.h
+++ b/src/openvpn/crypto_epoch.h
@@ -67,4 +67,94 @@
const uint8_t *context, size_t context_len,
uint8_t *out, uint16_t out_len);
-#endif
+/**
+ * Generate a data channel key pair from the epoch key
+ * @param key Destination for the generated data key
+ * @param epoch_key Epoch key to be used
+ * @parm kt Cipher information to generate the data channel key for
+ */
+void
+epoch_data_key_derive(struct key_parameters *key,
+ const struct epoch_key *epoch_key,
+ const struct key_type *kt);
+
+/**
+ * Generates and fills the epoch_data_keys_future with next valid
+ * future keys in crypto_options using the epoch of the key in
+ * crypto_options.key_ctx_bi.decrypt as starting point
+ *
+ * This assume that the normal key_ctx_bi and epoch keys have been already
+ * setup.
+ *
+ * This method is also called if crypto_options.key_ctx_bi.decrypt is changed.
+ * The method will then change the future keys in epoch_data_keys_future to
+ * free the ones that are older than the crypto_options.key_ctx_bi.decrypt and
+ * generate the keys from the newer epoch.
+ */
+void
+epoch_generate_future_receive_keys(struct crypto_options *co);
+
+
+/** This is called when the peer uses a new send key that is not the default
+ * key. This function ensures the following:
+ * - recv key matches the epoch index provided
+ * - send key epoch is equal or higher than recv_key epoch
+ *
+ * @param new_epoch the new epoch to use for the receive key
+ */
+void
+epoch_replace_update_recv_key(struct crypto_options *co,
+ uint16_t new_epoch);
+
+/**
+ * Updates the send key and send_epoch_key in cryptio_options->key_ctx_bi to
+ * use the next epoch */
+void
+epoch_iterate_send_key(struct crypto_options *co);
+
+/**
+ * Frees the extra data structures used by epoch keys in \c crypto_options
+ */
+void
+free_epoch_key_ctx(struct crypto_options *co);
+
+/**
+ * Initialises data channel keys and internal structures for epoch data keys
+ * using the provided E0 epoch key
+ *
+ * @param co The crypto option struct to initialise the epoch
+ * related fields
+ * @param key_type The parameter of what encryption cipher to use when
+ * initialising the epoch related fields
+ * @param e1_send The E1 send epoch key derived by TLS-EKM
+ * @param e1_recv The E1 receive epoch key derived by TLS-EKM
+ * @param future_key_count the number of future epoch keys that should be
+ * considered valid when receiving data from the peer
+ */
+void
+epoch_init_key_ctx(struct crypto_options *co, const struct key_type *key_type,
+ const struct epoch_key *e1_send, const struct epoch_key *e1_recv,
+ uint16_t future_key_count);
+
+/**
+ * Using an epoch, this function will try to retrieve a decryption
+ * key context that matches that epoch from the \c opt argument
+ * @param opt crypto_options to use to find the decrypt key
+ * @param epoch epoch of the key to lookup
+ * @return the key context with
+ */
+struct key_ctx *
+epoch_lookup_decrypt_key(struct crypto_options *opt, uint16_t epoch);
+
+/**
+ * Checks if we need to iterate the send epoch key. This needs to be in one
+ * of the following condition
+ * - max epoch counter reached
+ * - send key aead usage limit reached (for AES-GCM and similar ciphers)
+ * - recv key usage limit reached
+ */
+void
+epoch_check_send_iterate(struct crypto_options *opt);
+
+
+#endif /* ifndef CRYPTO_EPOCH_H */
diff --git a/src/openvpn/packet_id.c b/src/openvpn/packet_id.c
index 0806e99..149dda2 100644
--- a/src/openvpn/packet_id.c
+++ b/src/openvpn/packet_id.c
@@ -77,6 +77,21 @@
#endif
}
+static void
+packet_id_init_recv(struct packet_id_rec *rec, int seq_backtrack, int time_backtrack, const char *name, int unit)
+{
+ rec->name = name;
+ rec->unit = unit;
+ if (seq_backtrack)
+ {
+ ASSERT(MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
+ ASSERT(MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
+ CIRC_LIST_ALLOC(rec->seq_list, struct seq_list, seq_backtrack);
+ rec->seq_backtrack = seq_backtrack;
+ rec->time_backtrack = time_backtrack;
+ }
+ rec->initialized = true;
+}
void
packet_id_init(struct packet_id *p, int seq_backtrack, int time_backtrack, const char *name, int unit)
{
@@ -87,17 +102,25 @@
ASSERT(p);
CLEAR(*p);
- p->rec.name = name;
- p->rec.unit = unit;
- if (seq_backtrack)
- {
- ASSERT(MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
- ASSERT(MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
- CIRC_LIST_ALLOC(p->rec.seq_list, struct seq_list, seq_backtrack);
- p->rec.seq_backtrack = seq_backtrack;
- p->rec.time_backtrack = time_backtrack;
- }
- p->rec.initialized = true;
+ packet_id_init_recv(&p->rec, seq_backtrack, time_backtrack, name, unit);
+}
+
+void
+packet_id_move_recv(struct packet_id_rec *dest, struct packet_id_rec *src)
+{
+ ASSERT(src);
+ ASSERT(dest);
+ /* clear free any old data in rec list */
+ free(dest->seq_list);
+ CLEAR(*dest);
+
+ /* Copy data to dest */
+ *dest = *src;
+
+ /* Reinitalise the source */
+ CLEAR(*src);
+ packet_id_init_recv(src, dest->seq_backtrack, dest->time_backtrack,
+ dest->name, dest->unit);
}
void
diff --git a/src/openvpn/packet_id.h b/src/openvpn/packet_id.h
index c05ac9a..07e92ff 100644
--- a/src/openvpn/packet_id.h
+++ b/src/openvpn/packet_id.h
@@ -206,6 +206,13 @@
void packet_id_free(struct packet_id *p);
+/**
+ * Move the packet id recv structure from \c src to \c dest. \c src will
+ * be reinitialised. \c dest will be freed before the move.
+ */
+void
+packet_id_move_recv(struct packet_id_rec *dest, struct packet_id_rec *src);
+
/* should we accept an incoming packet id ? */
bool packet_id_test(struct packet_id_rec *p,
const struct packet_id_net *pin);
diff --git a/src/openvpn/ssl_common.h b/src/openvpn/ssl_common.h
index e697d68..e092472 100644
--- a/src/openvpn/ssl_common.h
+++ b/src/openvpn/ssl_common.h
@@ -334,8 +334,8 @@
interval_t packet_timeout;
int64_t renegotiate_bytes;
int64_t renegotiate_packets;
- /** limit for AEAD cipher, this is the sum of packets + blocks
- * that are allowed to be used */
+ /** limit for AEAD cipher when not running in epoch data key mode,
+ * this is the sum of packets + blocks that are allowed to be used */
uint64_t aead_usage_limit;
interval_t renegotiate_seconds;
diff --git a/tests/unit_tests/openvpn/test_crypto.c b/tests/unit_tests/openvpn/test_crypto.c
index e16296b..3d9c99c 100644
--- a/tests/unit_tests/openvpn/test_crypto.c
+++ b/tests/unit_tests/openvpn/test_crypto.c
@@ -613,7 +613,7 @@
0x90, 0xb6, 0xc7, 0x3b, 0xb5, 0x0f, 0x9c, 0x31,
0x22, 0xec, 0x84, 0x4a, 0xd7, 0xc2, 0xb3, 0xe5};
- const uint8_t *label = (const uint8_t *)("unit test");
+ const uint8_t *label = (const uint8_t *) ("unit test");
uint8_t out[16];
ovpn_expand_label(secret, sizeof(secret), label, 9, NULL, 0, out, sizeof(out));
@@ -708,9 +708,242 @@
}
#endif /* if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L */
+struct epoch_test_state
+{
+ struct key_type kt;
+ struct gc_arena gc;
+ struct crypto_options co;
+};
+
+static int
+crypto_test_epoch_setup(void **state)
+{
+ int *num_future_keys = (int *)*state;
+ struct epoch_test_state *data = calloc(1, sizeof(struct epoch_test_state));
+
+ data->gc = gc_new();
+
+ init_key_type(&data->kt, "AES-128-GCM", "none", true, false);
+
+ /* have an epoch key that uses 0x23 for the key for all bytes */
+ struct epoch_key epoch1send = { .epoch = 1, .epoch_key = {0x23} };
+ struct epoch_key epoch1recv = { .epoch = 1, .epoch_key = {0x27} };
+
+ epoch_init_key_ctx(&data->co, &data->kt, &epoch1send,
+ &epoch1recv, *num_future_keys);
+
+ *state = data;
+ return 0;
+}
+
+static int
+crypto_test_epoch_teardown(void **state)
+{
+ struct epoch_test_state *data = *state;
+ free_epoch_key_ctx(&data->co);
+ free_key_ctx_bi(&data->co.key_ctx_bi);
+ gc_free(&data->gc);
+ free(*state);
+ return 0;
+}
+
+void
+crypto_test_epoch_key_generation(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* check the keys look like expect */
+ assert_int_equal(co->epoch_data_keys_future[0].epoch, 2);
+ assert_int_equal(co->epoch_data_keys_future[15].epoch, 17);
+ assert_int_equal(co->epoch_key_send.epoch, 1);
+ assert_int_equal(co->epoch_key_recv.epoch, 17);
+
+ /* Now replace the recv key with the 6th future key (epoch = 8) */
+ free_key_ctx(&co->key_ctx_bi.decrypt);
+ assert_int_equal(co->epoch_data_keys_future[6].epoch, 8);
+ co->key_ctx_bi.decrypt = co->epoch_data_keys_future[6];
+ CLEAR(co->epoch_data_keys_future[6]);
+
+ epoch_generate_future_receive_keys(co);
+ assert_int_equal(co->epoch_data_keys_future[0].epoch, 9);
+ assert_int_equal(co->epoch_data_keys_future[15].epoch, 24);
+}
+
+
+void
+crypto_test_epoch_key_rotation(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* should replace send + key recv */
+ epoch_replace_update_recv_key(co, 9);
+
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 9);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 9);
+ assert_int_equal(co->epoch_key_send.epoch, 9);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 1);
+
+ /* Iterate the data send key four times to get it to 13 */
+ for (int i = 0; i < 4; i++)
+ {
+ epoch_iterate_send_key(co);
+ }
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+
+ epoch_replace_update_recv_key(co, 10);
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 10);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+ assert_int_equal(co->epoch_key_send.epoch, 13);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 9);
+
+ epoch_replace_update_recv_key(co, 12);
+ assert_int_equal(co->key_ctx_bi.decrypt.epoch, 12);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 13);
+ assert_int_equal(co->epoch_key_send.epoch, 13);
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 10);
+
+ epoch_iterate_send_key(co);
+ assert_int_equal(co->key_ctx_bi.encrypt.epoch, 14);
+}
+
+void
+crypto_test_epoch_key_receive_lookup(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* lookup some wacky things that should fail */
+ assert_null(epoch_lookup_decrypt_key(co, 2000));
+ assert_null(epoch_lookup_decrypt_key(co, -1));
+ assert_null(epoch_lookup_decrypt_key(co, 0xefff));
+
+ /* Lookup the edges of the current window */
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_int_equal(co->epoch_retiring_data_receive_key.epoch, 0);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 2)->epoch, 2);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 13)->epoch, 13);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 14)->epoch, 14);
+ assert_null(epoch_lookup_decrypt_key(co, 15));
+
+ /* Should move 1 to retiring key but leave 2-6 undefined, 7 as
+ * active and 8-20 as future keys*/
+ epoch_replace_update_recv_key(co, 7);
+
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 1)->epoch, 1);
+ assert_ptr_equal(epoch_lookup_decrypt_key(co, 1), &co->epoch_retiring_data_receive_key);
+
+ assert_null(epoch_lookup_decrypt_key(co, 2));
+ assert_null(epoch_lookup_decrypt_key(co, 3));
+ assert_null(epoch_lookup_decrypt_key(co, 4));
+ assert_null(epoch_lookup_decrypt_key(co, 5));
+ assert_null(epoch_lookup_decrypt_key(co, 6));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 7)->epoch, 7);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 8)->epoch, 8);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 20)->epoch, 20);
+ assert_null(epoch_lookup_decrypt_key(co, 21));
+ assert_null(epoch_lookup_decrypt_key(co, 22));
+
+
+ /* Should move 7 to retiring key and have 8 as active key and
+ * 9-21 as future keys */
+ epoch_replace_update_recv_key(co, 8);
+ assert_null(epoch_lookup_decrypt_key(co, 0));
+ assert_null(epoch_lookup_decrypt_key(co, 1));
+ assert_null(epoch_lookup_decrypt_key(co, 2));
+ assert_null(epoch_lookup_decrypt_key(co, 3));
+ assert_null(epoch_lookup_decrypt_key(co, 4));
+ assert_null(epoch_lookup_decrypt_key(co, 5));
+ assert_null(epoch_lookup_decrypt_key(co, 6));
+ assert_int_equal(epoch_lookup_decrypt_key(co, 7)->epoch, 7);
+ assert_ptr_equal(epoch_lookup_decrypt_key(co, 7), &co->epoch_retiring_data_receive_key);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 8)->epoch, 8);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 20)->epoch, 20);
+ assert_int_equal(epoch_lookup_decrypt_key(co, 21)->epoch, 21);
+ assert_null(epoch_lookup_decrypt_key(co, 22));
+ assert_null(epoch_lookup_decrypt_key(co, 23));
+}
+
+void
+crypto_test_epoch_key_overflow(void **state)
+{
+ struct epoch_test_state *data = *state;
+ struct crypto_options *co = &data->co;
+
+ /* Modify the receive epoch and keys to have a very high epoch to test
+ * the end of array. Iterating through all 16k keys takes a 2-3s, so we
+ * avoid this for the unit test */
+ co->key_ctx_bi.decrypt.epoch = 16000;
+ co->key_ctx_bi.encrypt.epoch = 16000;
+
+ co->epoch_key_send.epoch = 16000;
+ co->epoch_key_recv.epoch = 16000 + co->epoch_data_keys_future_count;
+
+ for (uint16_t i = 0; i < co->epoch_data_keys_future_count; i++)
+ {
+ co->epoch_data_keys_future[i].epoch = 16001 + i;
+ }
+
+ /* Move the last few keys until we are close to the limit */
+ while (co->key_ctx_bi.decrypt.epoch < (UINT16_MAX - 40))
+ {
+ epoch_replace_update_recv_key(co, co->key_ctx_bi.decrypt.epoch + 10);
+ }
+
+ /* Looking up this key should still work as it will not break the limit
+ * when generating keys */
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 34)->epoch, UINT16_MAX - 34);
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 33)->epoch, UINT16_MAX - 33);
+
+ /* This key is no longer eligible for decrypting as the 32 future keys
+ * would be larger than uint16_t maximum */
+ assert_int_equal(co->epoch_data_keys_future_count, 32);
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - co->epoch_data_keys_future_count));
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX));
+
+ /* Check that moving to the last possible epoch works */
+ epoch_replace_update_recv_key(co, UINT16_MAX - 33);
+ assert_int_equal(epoch_lookup_decrypt_key(co, UINT16_MAX - 33)->epoch, UINT16_MAX - 33);
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX - 32));
+ assert_null(epoch_lookup_decrypt_key(co, UINT16_MAX));
+}
+
+void
+epoch_test_derive_data_key(void **state)
+{
+ struct epoch_key e17 = { .epoch = 17, .epoch_key = { 19, 12 }};
+ struct key_type kt = { 0 };
+ struct key_parameters key_parameters = { 0 };
+ init_key_type(&kt, "AES-192-GCM", "none", true, false);
+
+
+ epoch_data_key_derive(&key_parameters, &e17, &kt);
+
+ assert_int_equal(key_parameters.cipher_size, 24);
+ assert_int_equal(key_parameters.hmac_size, 12);
+
+ uint8_t exp_cipherkey[24] =
+ {0xed, 0x85, 0x33, 0xdb, 0x1c, 0x28, 0xac, 0xe4,
+ 0x18, 0xe9, 0x00, 0x6a, 0xb2, 0x9c, 0x17, 0x41,
+ 0x7d, 0x60, 0xeb, 0xe6, 0xcd, 0x90, 0xbf, 0x0a};
+
+ uint8_t exp_impl_iv[12] =
+ {0x86, 0x89, 0x0a, 0xab, 0xf0, 0x32, 0xcb, 0x59, 0xf4, 0xcf, 0xa3, 0x4e};
+
+ assert_memory_equal(key_parameters.cipher, exp_cipherkey, sizeof(exp_cipherkey));
+ assert_memory_equal(key_parameters.hmac, exp_impl_iv, sizeof(exp_impl_iv));
+}
+
int
main(void)
{
+ int prestate_num13 = 13;
+ int prestate_num16 = 16;
+ int prestate_num32 = 32;
+
openvpn_unit_test_setup();
const struct CMUnitTest tests[] = {
cmocka_unit_test(crypto_pem_encode_decode_loopback),
@@ -725,7 +958,24 @@
cmocka_unit_test(crypto_test_hkdf_expand_testa3),
cmocka_unit_test(crypto_test_hkdf_expand_test_ovpn),
cmocka_unit_test(crypto_test_ovpn_label_expand),
- cmocka_unit_test(crypto_test_ovpn_expand_openssl3)
+ cmocka_unit_test(crypto_test_ovpn_expand_openssl3),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_generation,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num16),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_rotation,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num13),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_receive_lookup,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num13),
+ cmocka_unit_test_prestate_setup_teardown(crypto_test_epoch_key_overflow,
+ crypto_test_epoch_setup,
+ crypto_test_epoch_teardown,
+ &prestate_num32),
+ cmocka_unit_test(epoch_test_derive_data_key)
};
#if defined(ENABLE_CRYPTO_OPENSSL)
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/804?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Id7d6a576ca8c9560cb2dfae82fc62175820e9b80
Gerrit-Change-Number: 804
Gerrit-PatchSet: 13
Gerrit-Owner: plaisthos <arne-openvpn@...1227...>
Gerrit-Reviewer: MaxF <max@...2606...>
Gerrit-Reviewer: flichtenheld <frank@...2641...>
Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net>
Gerrit-MessageType: merged
[-- Attachment #2: Type: text/html, Size: 87603 bytes --]
^ permalink raw reply related [flat|nested] 14+ messages in thread