Skip to content

Commit a9c8de3

Browse files
author
royb
committed
Updated X9.146 with latests wolfssl and cleaned up testing / interopting
1 parent b3db835 commit a9c8de3

26 files changed

+1543
-608
lines changed

‎tls/src/main/java/org/bouncycastle/tls/HandshakeMessageOutput.java‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,6 @@ static void send(TlsProtocol protocol, short handshakeType, byte[] body)
3737

3838
void send(TlsProtocol protocol) throws IOException
3939
{
40-
{
41-
String isServer = protocol.getContext().isServer() ? "Server" : "Client";
42-
short type = TlsUtils.readUint8(buf, 0);
43-
System.out.println(isServer + "_send_" + HandshakeType.getName(type));
44-
}
45-
4640
// Patch actual length back in
4741
int bodyLength = count - 4;
4842
TlsUtils.checkUint24(bodyLength);

‎tls/src/main/java/org/bouncycastle/tls/SignatureAndHashAlgorithm.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,10 @@ public static SignatureAndHashAlgorithm getHybrid(SignatureAndHashAlgorithm nati
102102
{
103103
return SignatureAndHashAlgorithm.WOLFSSL_HYBRID_P521_MLDSA_LEVEL5;
104104
}
105+
if (nativeAlg.equals(create(SignatureScheme.rsa_pss_rsae_sha256)) && altAlg.equals(SignatureAndHashAlgorithm.DRAFT_mldsa44))
106+
{
107+
return SignatureAndHashAlgorithm.WOLFSSL_HYBRID_RSA3072_MLDSA_LEVEL2;
108+
}
105109
return null;
106110
}
107111
public static SignatureAndHashAlgorithm getInstance(short hashAlgorithm, short signatureAlgorithm)

‎tls/src/main/java/org/bouncycastle/tls/TlsClientProtocol.java‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1622,12 +1622,14 @@ protected void receive13ServerCertificateVerify(ByteArrayInputStream buf)
16221622
// check server extension if alternative algorithm is supported or not
16231623
// if supported and hybrid scheme was not sent throw an error
16241624

1625-
short serverCKS = TlsExtensionsUtils.getCertificationKeySelection(serverExtensions);
1626-
short clientCKS = TlsExtensionsUtils.getCertificationKeySelection(clientExtensions);
1625+
short cksCode = TlsUtils.getCommonCKS(
1626+
TlsExtensionsUtils.getCertificationKeySelection(clientExtensions),
1627+
TlsExtensionsUtils.getCertificationKeySelection(serverExtensions)
1628+
);
16271629

16281630
// TODO: Throw error if server cks != client cks (check if native == default)
16291631

1630-
TlsUtils.verify13CertificateVerifyServer(tlsClientContext, handshakeHash, certificateVerify, clientCKS);
1632+
TlsUtils.verify13CertificateVerifyServer(tlsClientContext, handshakeHash, certificateVerify, cksCode);
16311633

16321634
//TODO[x9.146]: new extension, need more testing/publishing
16331635
// HybridSchemeSignature hybridSchemeSignature = TlsExtensionsUtils.getHybridSchemeSignature(serverExtensions);

‎tls/src/main/java/org/bouncycastle/tls/TlsExtensionsUtils.java‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -545,10 +545,10 @@ public static Vector getTrustedCAKeysExtensionClient(Hashtable extensions)
545545
return extensionData == null ? null : readTrustedCAKeysExtensionClient(extensionData);
546546
}
547547

548-
public static short getCertificationKeySelection(Hashtable extensions) throws IOException
548+
public static short[] getCertificationKeySelection(Hashtable extensions) throws IOException
549549
{
550550
byte[] cksCodeData = TlsUtils.getExtensionData(extensions, EXT_certificate_key_selection);
551-
return cksCodeData == null ? 0 : readCertificationKeySelection(cksCodeData);
551+
return cksCodeData == null ? new short[]{0} : readCertificationKeySelection(cksCodeData);
552552
}
553553

554554
//TODO[x9.146]: new extension, need more testing/publishing
@@ -1625,14 +1625,20 @@ public static boolean readTrustedCAKeysExtensionServer(byte[] extensionData) thr
16251625
return readEmptyExtensionData(extensionData);
16261626
}
16271627

1628-
public static short readCertificationKeySelection(byte[] cksCodeData) throws IOException
1628+
public static short[] readCertificationKeySelection(byte[] cksCodeData) throws IOException
16291629
{
16301630
if (cksCodeData == null)
16311631
{
16321632
throw new IllegalArgumentException("'cksCodeData' cannot be null");
16331633
}
16341634

1635-
return TlsUtils.readUint8(cksCodeData, 0);
1635+
short[] cksCodeList = new short[cksCodeData.length];
1636+
for (int i = 0; i < cksCodeData.length; i++)
1637+
{
1638+
cksCodeList[i] = cksCodeData[i];
1639+
}
1640+
1641+
return cksCodeList;
16361642
}
16371643

16381644
public static int[] readHybridSchemeList(byte[] extensionData) throws IOException

‎tls/src/main/java/org/bouncycastle/tls/TlsProtocol.java‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -946,10 +946,6 @@ protected boolean safeReadFullRecord(byte[] input, int inputOff, int inputLen)
946946
protected void safeWriteRecord(short type, byte[] buf, int offset, int len)
947947
throws IOException
948948
{
949-
950-
{
951-
System.out.println("safeWrite_" + HandshakeType.getName(type) + " : " + Hex.toHexString(buf, offset, len));
952-
}
953949
try
954950
{
955951
recordStream.writeRecord(type, buf, offset, len);
@@ -1113,12 +1109,6 @@ void writeHandshakeMessage(byte[] buf, int off, int len) throws IOException
11131109

11141110
short type = TlsUtils.readUint8(buf, off);
11151111

1116-
1117-
{
1118-
//TODO: delete
1119-
// System.out.println(getContext().isServer()+"Type: " + ExtensionType.getName(type) + " : " + Hex.toHexString(buf, off, len));
1120-
}
1121-
11221112
switch (type)
11231113
{
11241114
/*

‎tls/src/main/java/org/bouncycastle/tls/TlsServerProtocol.java‎

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -427,7 +427,7 @@ else if (NamedGroup.refersToASpecificKem(namedGroup))
427427
TlsUtils.establish13PhaseSecrets(tlsServerContext, pskEarlySecret, sharedSecret);
428428

429429
// X9.146 Add CKS extension to serverHelloExt
430-
short cksCode = TlsExtensionsUtils.getCertificationKeySelection(clientHelloExtensions);
430+
short[] cksCode = TlsExtensionsUtils.getCertificationKeySelection(clientHelloExtensions);
431431
//TODO[x9147]: This throws an error for wolfssl client!
432432
// if (cksCode != 0)
433433
// {
@@ -1591,7 +1591,11 @@ protected void send13ServerHelloCoda(ServerHello serverHello, boolean afterHello
15911591
{
15921592
final SecurityParameters securityParameters = tlsServerContext.getSecurityParametersHandshake();
15931593
// TODO[x9.146]: should ckscode be stored in securityParameters or somewhere else?
1594-
short cksCode = TlsExtensionsUtils.getCertificationKeySelection(clientExtensions);
1594+
short cksCode = TlsUtils.getCommonCKS(
1595+
TlsExtensionsUtils.getCertificationKeySelection(clientExtensions),
1596+
TlsExtensionsUtils.getCertificationKeySelection(serverExtensions)
1597+
);
1598+
15951599
securityParameters.cksCode = cksCode;
15961600

15971601
byte[] serverHelloTranscriptHash = TlsUtils.getCurrentPRFHash(handshakeHash);
@@ -1646,17 +1650,11 @@ protected void send13ServerHelloCoda(ServerHello serverHello, boolean afterHello
16461650
* extension instead.
16471651
*/
16481652

1649-
16501653
Certificate serverCertificate = serverCredentials.getCertificate();
16511654
send13CertificateMessage(serverCertificate);
1652-
//TODO: When generating the hybridSchemeSignature, do we use the prf Hash of the certificateMessage???
1653-
System.out.println(this.connection_state + ": " + Hex.toHexString(TlsUtils.getCurrentPRFHash(handshakeHash)));
1654-
16551655

16561656
securityParameters.tlsServerEndPoint = null;
16571657
this.connection_state = CS_SERVER_CERTIFICATE;
1658-
System.out.println(this.connection_state + ": " + Hex.toHexString(TlsUtils.getCurrentPRFHash(handshakeHash)));
1659-
16601658
}
16611659

16621660
// CertificateVerify
@@ -1672,9 +1670,6 @@ protected void send13ServerHelloCoda(ServerHello serverHello, boolean afterHello
16721670
//TODO[x9.146]: How do we select which cksCode to use if multiple is sent?
16731671
// (find first mutual cksCode supported by both client and server?)
16741672

1675-
//HERE
1676-
// System.out.println(this.connection_state + ": " + Hex.toHexString(TlsUtils.getCurrentPRFHash(handshakeHash)));
1677-
16781673
//TODO[x9.146]: new extension, need more testing/publishing
16791674
// HybridSchemeSignature hybridSchemeSignature = TlsUtils.generateHybridSchemeSignature(tlsServerContext, serverCredentials, handshakeHash);
16801675
// TlsExtensionsUtils.addHybridSchemeSignature(serverExtensions, hybridSchemeSignature);

‎tls/src/main/java/org/bouncycastle/tls/TlsUtils.java‎

Lines changed: 24 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2558,10 +2558,6 @@ private static byte[] generate13CertificateVerify(TlsCrypto crypto, TlsCredentia
25582558

25592559
byte[] header = getCertificateVerifyHeader(contextString);
25602560
byte[] prfHash = getCurrentPRFHash(handshakeHash);
2561-
System.out.println("In Generate");
2562-
System.out.println("header: " + Hex.toHexString(header));
2563-
System.out.println("prfHash: " + Hex.toHexString(prfHash));
2564-
25652561

25662562
if (null != streamSigner)
25672563
{
@@ -2792,12 +2788,8 @@ private static void verify13CertificateVerify(Vector supportedAlgorithms, String
27922788
{
27932789
Tls13Verifier verifier = certificate.createVerifier(signatureScheme);
27942790

2795-
27962791
byte[] header = getCertificateVerifyHeader(contextString);
2797-
System.out.println("header: " + Hex.toHexString(header));
2798-
27992792
byte[] prfHash = getCurrentPRFHash(handshakeHash);
2800-
System.out.println("prfHash: " + Hex.toHexString(prfHash));
28012793

28022794
OutputStream output = verifier.getOutputStream();
28032795
output.write(header, 0, header.length);
@@ -2811,13 +2803,7 @@ private static void verify13CertificateVerify(Vector supportedAlgorithms, String
28112803
Tls13Verifier altVerifier = certificate.createAltVerifier(signatureScheme);
28122804

28132805
byte[] header = getCertificateVerifyHeader(contextString);
2814-
System.out.println("header: " + Hex.toHexString(header));
2815-
28162806
byte[] prfHash = getCurrentPRFHash(handshakeHash);
2817-
System.out.println("prfHash: " + Hex.toHexString(prfHash));
2818-
2819-
System.out.println("nativeSignature: " + Hex.toHexString(nativeSignature));
2820-
System.out.println("altSignature: " + Hex.toHexString(altSignature));
28212807

28222808
OutputStream output = altVerifier.getOutputStream();
28232809
output.write(header, 0, header.length);
@@ -2981,6 +2967,25 @@ public static Vector vectorOfOne(Object obj)
29812967
return v;
29822968
}
29832969

2970+
public static short getCommonCKS(short[] clientCKS, short[] serverCKS)
2971+
{
2972+
if (clientCKS == null || serverCKS == null)
2973+
{
2974+
return 0;
2975+
}
2976+
for (short client : clientCKS)
2977+
{
2978+
for (short server : serverCKS)
2979+
{
2980+
if (client == server)
2981+
{
2982+
return client;
2983+
}
2984+
}
2985+
}
2986+
return 0;
2987+
}
2988+
29842989
public static int getCipherType(int cipherSuite)
29852990
{
29862991
int encryptionAlgorithm = getEncryptionAlgorithm(cipherSuite);
@@ -5188,7 +5193,11 @@ static void processServerCertificate(TlsClientContext clientContext,
51885193
{
51895194
SecurityParameters securityParameters = clientContext.getSecurityParametersHandshake();
51905195
boolean isTLSv13 = isTLSv13(securityParameters.getNegotiatedVersion());
5191-
short cksCode = TlsExtensionsUtils.getCertificationKeySelection(clientExtensions);
5196+
short cksCode = TlsUtils.getCommonCKS(
5197+
TlsExtensionsUtils.getCertificationKeySelection(clientExtensions),
5198+
TlsExtensionsUtils.getCertificationKeySelection(serverExtensions)
5199+
);
5200+
51925201
boolean usingAltCerts = cksCode > 1;
51935202

51945203
if (null == clientAuthentication)

‎tls/src/main/java/org/bouncycastle/tls/crypto/impl/bc/BcTlsRawKeyCertificate.java‎

Lines changed: 6 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -262,63 +262,26 @@ public Tls13Verifier createAltVerifier(SubjectPublicKeyInfo keyInfo, int signatu
262262

263263
return new BcTls13PQVerifier(verifier);
264264
}
265-
// case SignatureScheme.dilithiumr3_2:
266-
// case SignatureScheme.dilithiumr3_3:
267-
// case SignatureScheme.dilithiumr3_5:
268-
// {
269-
// DilithiumSigner verifier = new DilithiumSigner();
270-
// DilithiumPublicKeyParameters pubKey = getPubKeyDilithium(keyInfo);
271-
// verifier.init(false, getPubKeyDilithium(keyInfo));
272-
//
273-
// return new BcTls13PQVerifier(verifier);
274-
// }
275265
case SignatureScheme.OQS_CODEPOINT_P256_MLDSA44:
266+
case SignatureScheme.OQS_CODEPOINT_RSA3072_MLDSA44:
276267
case SignatureScheme.WOLFSSL_HYBRID_P256_MLDSA_LEVEL2:
277268
case SignatureScheme.WOLFSSL_HYBRID_RSA3072_MLDSA_LEVEL2:
278269
case SignatureScheme.mldsa44_ecdsa_secp256r1_sha256:
279270
case SignatureScheme.mldsa65_ecdsa_secp384r1_sha384:
280271
case SignatureScheme.mldsa44_ed25519:
281-
// case SignatureScheme.mldsa44_rsa2048_pkcs1_sha256:
282-
// case SignatureScheme.mldsa44_rsa2048_pss_pss_sha256:
272+
case SignatureScheme.mldsa44_rsa2048_pkcs1_sha256:
273+
case SignatureScheme.mldsa44_rsa2048_pss_pss_sha256:
283274
return createAltVerifier(SignatureScheme.DRAFT_mldsa44);
284275
case SignatureScheme.mldsa65_ed25519:
285276
case SignatureScheme.WOLFSSL_HYBRID_P384_MLDSA_LEVEL3:
286277
case SignatureScheme.OQS_CODEPOINT_P384_MLDSA65:
287-
// case SignatureScheme.mldsa65_rsa3072_pkcs1_sha256:
288-
// case SignatureScheme.mldsa65_rsa4096_pkcs1_sha384:
289-
// case SignatureScheme.mldsa65_rsa3072_pss_pss_sha256:
290-
// case SignatureScheme.mldsa65_rsa4096_pss_pss_sha384:
291278
return createAltVerifier(SignatureScheme.DRAFT_mldsa65);
292279
case SignatureScheme.OQS_CODEPOINT_P521_MLDSA87:
293280
case SignatureScheme.WOLFSSL_HYBRID_P521_MLDSA_LEVEL5:
294281
case SignatureScheme.mldsa87_ecdsa_secp521r1_sha51:
295282
case SignatureScheme.mldsa87_ed448:
296283
return createAltVerifier(SignatureScheme.DRAFT_mldsa87);
297284

298-
// case SignatureScheme.X9146_falcon512:
299-
// case SignatureScheme.X9146_falcon1024:
300-
// {
301-
// FalconSigner verifier = new FalconSigner();
302-
// FalconPublicKeyParameters pubKey = getPubKeyFalcon(keyInfo);
303-
// verifier.init(false, getPubKeyFalcon(keyInfo));
304-
//
305-
// return new BcTls13PQVerifier(verifier);
306-
// }
307-
//TODO[x9146]: alt will always be pqc
308-
// case SignatureScheme.OQS_P256_MLDSA44:
309-
// case SignatureScheme.OQS_RSA3072_MLDSA44:
310-
// return createAltVerifier(keyInfo, SignatureScheme.DRAFT_mldsa44);
311-
// case SignatureScheme.OQS_P384_MLDSA65:
312-
// return createAltVerifier(keyInfo, SignatureScheme.DRAFT_mldsa65);
313-
// case SignatureScheme.OQS_P521_MLDSA87:
314-
// return createAltVerifier(keyInfo, SignatureScheme.DRAFT_mldsa87);
315-
// case SignatureScheme.X9146_HYBRID_P256_falcon512:
316-
// case SignatureScheme.X9146_HYBRID_RSA3072_falcon512:
317-
// return createAltVerifier(keyInfo, SignatureScheme.X9146_falcon512);
318-
// case SignatureScheme.X9146_HYBRID_P521_falcon1024:
319-
// return createAltVerifier(keyInfo, SignatureScheme.X9146_falcon1024);
320-
321-
322285
// TODO[RFC 8998]
323286
// case SignatureScheme.sm2sig_sm3:
324287
// {
@@ -469,6 +432,9 @@ public Tls13Verifier createVerifier(int signatureScheme) throws IOException
469432
case SignatureScheme.OQS_CODEPOINT_P521_MLDSA87:
470433
case SignatureScheme.WOLFSSL_HYBRID_P521_MLDSA_LEVEL5:
471434
return createVerifier(SignatureScheme.ecdsa_secp521r1_sha512);
435+
case SignatureScheme.OQS_CODEPOINT_RSA3072_MLDSA44:
436+
case SignatureScheme.WOLFSSL_HYBRID_RSA3072_MLDSA_LEVEL2:
437+
return createVerifier(SignatureScheme.rsa_pss_rsae_sha256);
472438

473439
case SignatureScheme.mldsa44_ecdsa_secp256r1_sha256:
474440
return createVerifier(SignatureScheme.ecdsa_secp256r1_sha256);
@@ -481,27 +447,6 @@ public Tls13Verifier createVerifier(int signatureScheme) throws IOException
481447
return createVerifier(SignatureScheme.ed25519);
482448
case SignatureScheme.mldsa87_ed448:
483449
return createVerifier(SignatureScheme.ed448);
484-
//TODO[x9146]: add corresponding rsa verifier
485-
// case SignatureScheme.mldsa44_rsa2048_pkcs1_sha256:
486-
// case SignatureScheme.mldsa44_rsa2048_pss_pss_sha256:
487-
// case SignatureScheme.mldsa65_rsa3072_pkcs1_sha256:
488-
// case SignatureScheme.mldsa65_rsa4096_pkcs1_sha384:
489-
// case SignatureScheme.mldsa65_rsa3072_pss_pss_sha256:
490-
// case SignatureScheme.mldsa65_rsa4096_pss_pss_sha384:
491-
492-
//TODO[x9146]: nonalt will always be native
493-
// case SignatureScheme.OQS_P256_MLDSA44:
494-
// case SignatureScheme.X9146_HYBRID_P256_falcon512:
495-
// return createVerifier(SignatureScheme.ecdsa_secp256r1_sha256);
496-
// case SignatureScheme.OQS_P384_MLDSA65:
497-
// return createVerifier(SignatureScheme.ecdsa_secp384r1_sha384);
498-
// case SignatureScheme.OQS_P521_MLDSA87:
499-
// case SignatureScheme.X9146_HYBRID_P521_falcon1024:
500-
// return createVerifier(SignatureScheme.ecdsa_secp521r1_sha512);
501-
// case SignatureScheme.OQS_RSA3072_MLDSA44:
502-
// case SignatureScheme.X9146_HYBRID_RSA3072_falcon512:
503-
// return createVerifier(SignatureScheme.rsa_pss_pss_sha256);
504-
505450
default:
506451
throw new TlsFatalAlert(AlertDescription.internal_error);
507452
}
@@ -684,23 +629,6 @@ public Ed448PublicKeyParameters getPubKeyEd448() throws IOException
684629
return getPubKeyEd448(this.keyInfo);
685630
}
686631

687-
private DilithiumPublicKeyParameters getPubKeyDilithium(SubjectPublicKeyInfo keyInfo) throws IOException
688-
{
689-
try
690-
{
691-
return (DilithiumPublicKeyParameters) getPQCPublicKey(keyInfo);
692-
}
693-
catch (ClassCastException e)
694-
{
695-
throw new TlsFatalAlert(AlertDescription.certificate_unknown, e);
696-
}
697-
}
698-
699-
public DilithiumPublicKeyParameters getPubKeyDilithium() throws IOException
700-
{
701-
return getPubKeyDilithium(this.keyInfo);
702-
}
703-
704632
public MLDSAPublicKeyParameters getPubKeyMLDSA(SubjectPublicKeyInfo keyInfo) throws IOException
705633
{
706634
try

0 commit comments

Comments
 (0)