1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
|
package hpke
import (
"encoding/binary"
"errors"
"fmt"
)
func (st state) keySchedule(ss, info, psk, pskID []byte) (*encdecContext, error) {
if err := st.verifyPSKInputs(psk, pskID); err != nil {
return nil, err
}
pskIDHash := st.labeledExtract(nil, []byte("psk_id_hash"), pskID)
infoHash := st.labeledExtract(nil, []byte("info_hash"), info)
keySchCtx := append(append(
[]byte{st.modeID},
pskIDHash...),
infoHash...)
secret := st.labeledExtract(ss, []byte("secret"), psk)
Nk := uint16(st.aeadID.KeySize())
key := st.labeledExpand(secret, []byte("key"), keySchCtx, Nk)
aead, err := st.aeadID.New(key)
if err != nil {
return nil, err
}
Nn := uint16(aead.NonceSize())
baseNonce := st.labeledExpand(secret, []byte("base_nonce"), keySchCtx, Nn)
exporterSecret := st.labeledExpand(
secret,
[]byte("exp"),
keySchCtx,
uint16(st.kdfID.ExtractSize()),
)
return &encdecContext{
st.Suite,
ss,
secret,
keySchCtx,
exporterSecret,
key,
baseNonce,
make([]byte, Nn),
aead,
make([]byte, Nn),
}, nil
}
func (st state) verifyPSKInputs(psk, pskID []byte) error {
gotPSK := psk != nil
gotPSKID := pskID != nil
if gotPSK != gotPSKID {
return errors.New("inconsistent PSK inputs")
}
switch st.modeID {
case modeBase | modeAuth:
if gotPSK {
return errors.New("PSK input provided when not needed")
}
case modePSK | modeAuthPSK:
if !gotPSK {
return errors.New("missing required PSK input")
}
}
return nil
}
// Params returns the codepoints for the algorithms comprising the suite.
func (suite Suite) Params() (KEM, KDF, AEAD) {
return suite.kemID, suite.kdfID, suite.aeadID
}
func (suite Suite) String() string {
return fmt.Sprintf(
"kem_id: %v kdf_id: %v aead_id: %v",
suite.kemID, suite.kdfID, suite.aeadID,
)
}
func (suite Suite) getSuiteID() (id [10]byte) {
id[0], id[1], id[2], id[3] = 'H', 'P', 'K', 'E'
binary.BigEndian.PutUint16(id[4:6], uint16(suite.kemID))
binary.BigEndian.PutUint16(id[6:8], uint16(suite.kdfID))
binary.BigEndian.PutUint16(id[8:10], uint16(suite.aeadID))
return
}
func (suite Suite) isValid() bool {
return suite.kemID.IsValid() &&
suite.kdfID.IsValid() &&
suite.aeadID.IsValid()
}
func (suite Suite) labeledExtract(salt, label, ikm []byte) []byte {
suiteID := suite.getSuiteID()
labeledIKM := append(append(append(append(
make([]byte, 0, len(versionLabel)+len(suiteID)+len(label)+len(ikm)),
versionLabel...),
suiteID[:]...),
label...),
ikm...)
return suite.kdfID.Extract(labeledIKM, salt)
}
func (suite Suite) labeledExpand(prk, label, info []byte, l uint16) []byte {
suiteID := suite.getSuiteID()
labeledInfo := make([]byte,
2, 2+len(versionLabel)+len(suiteID)+len(label)+len(info))
binary.BigEndian.PutUint16(labeledInfo[0:2], l)
labeledInfo = append(append(append(append(labeledInfo,
versionLabel...),
suiteID[:]...),
label...),
info...)
return suite.kdfID.Expand(prk, labeledInfo, uint(l))
}
|
