Add TLS 1.3 crypto callback pending support for transcript HMAC

Author: dgarske

src/internal.c

@@ -9741,6 +9741,10 @@ void wolfSSL_ResourceFree(WOLFSSL* ssl)
 #ifdef WOLFSSL_ASYNC_IO
     /* Cleanup async */
     FreeAsyncCtx(ssl, 1);
+#endif
+#if defined(WOLFSSL_ASYNC_REINVOKE) && defined(WOLFSSL_TLS13) && \
+    !defined(NO_HMAC)
+    Tls13FreeHsHmac(ssl);
 #endif
     if (ssl->options.weOwnRng) {
         wc_FreeRng(ssl->rng);

src/ssl.c

@@ -5716,6 +5716,9 @@ size_t wolfSSL_get_client_random(const WOLFSSL* ssl, unsigned char* out,
         ssl->kdfDeriveStep = TLS13_SEND_KDF_NONE;
         ssl->kdfMsgStep = TLS13_MSG_KDF_NONE;
         ssl->kdfMsgType = 0;
+        #if defined(WOLFSSL_ASYNC_REINVOKE) && !defined(NO_HMAC)
+        Tls13FreeHsHmac(ssl);
+        #endif
         #ifdef WOLFSSL_ASYNC_CRYPT
         ssl->options.buildArgs13Set = 0;
         /* An abandoned handshake can leave a mid-flight handler resume

src/tls.c

@@ -8750,12 +8750,16 @@ static int TLSX_KeyShare_GenEccKey(WOLFSSL *ssl, KeyShareEntry* kse)
     /* Outside the allocation guard: a WC_PENDING_E retry must regenerate,
      * not export an ungenerated key. The key type marks completion;
      * kse->pubKey covers backends that never touch the ecc_key (TSIP). */
-    if (ret == 0 && eccKey != NULL && kse->pubKey == NULL &&
-            eccKey->type != ECC_PRIVATEKEY &&
-            eccKey->type != ECC_PRIVATEKEY_ONLY) {
+    if (ret == 0 && eccKey != NULL) {
+        /* Outside the generation guard below: the export alloc reads
+         * pubKeyLen even when generation is skipped. */
         kse->keyLen = keySize;
         kse->pubKeyLen = keySize * 2 + 1;
+    }
 
+    if (ret == 0 && eccKey != NULL && kse->pubKey == NULL &&
+            eccKey->type != ECC_PRIVATEKEY &&
+            eccKey->type != ECC_PRIVATEKEY_ONLY) {
     #if defined(WOLFSSL_RENESAS_TSIP_TLS)
         ret = tsip_Tls13GenEccKeyPair(ssl, kse);
         if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE)) {

src/tls13.c

@@ -1505,10 +1505,26 @@ int DeriveResumptionPSK(WOLFSSL* ssl, byte* nonce, byte nonceLen, byte* secret)
  * hash  The hash result - verify data.
  * returns length of verify data generated.
  */
+#if defined(WOLFSSL_ASYNC_REINVOKE) && !defined(NO_HMAC)
+/* Release the held transcript Hmac and its resume state. */
+void Tls13FreeHsHmac(WOLFSSL* ssl)
+{
+    if (ssl->hsHmac != NULL) {
+        wc_HmacFree(ssl->hsHmac);
+        XFREE(ssl->hsHmac, ssl->heap, DYNAMIC_TYPE_HMAC);
+        ssl->hsHmac = NULL;
+    }
+    ssl->hsHmacStep = 0;
+    ssl->hsHmacOut = NULL;
+}
+#endif /* WOLFSSL_ASYNC_REINVOKE && !NO_HMAC */
+
 static int BuildTls13HandshakeHmac(WOLFSSL* ssl, byte* key, byte* hash,
     word32* pHashSz)
 {
+#ifndef WOLFSSL_ASYNC_REINVOKE
     WC_DECLARE_VAR(verifyHmac, Hmac, 1, 0);
+#endif
     int  hashType = WC_SHA256;
     int  hashSz = WC_SHA256_DIGEST_SIZE;
     int  ret = WC_NO_ERR_TRACE(BAD_FUNC_ARG);
@@ -1561,6 +1577,51 @@ static int BuildTls13HandshakeHmac(WOLFSSL* ssl, byte* key, byte* hash,
     WOLFSSL_BUFFER(hash, hashSz);
 #endif
 
+#ifdef WOLFSSL_ASYNC_REINVOKE
+    /* Held on the SSL object so a crypto callback WC_PENDING_E resumes by
+     * re-invoking the same Hmac with identical arguments; the transcript
+     * hash input is recomputed deterministically by the caller's retry.
+     * Bound to the output buffer: a replayed caller that computes several
+     * HMACs (the PSK binder list) must not resume one request against
+     * another's key, so a different output discards the held state. */
+    if (ssl->hsHmac != NULL && ssl->hsHmacOut != hash)
+        Tls13FreeHsHmac(ssl);
+    if (ssl->hsHmac == NULL) {
+        ssl->hsHmac = (Hmac*)XMALLOC(sizeof(Hmac), ssl->heap,
+                                     DYNAMIC_TYPE_HMAC);
+        if (ssl->hsHmac == NULL)
+            return MEMORY_E;
+        ret = wc_HmacInit(ssl->hsHmac, ssl->heap, ssl->devId);
+        if (ret != 0) {
+            Tls13FreeHsHmac(ssl);
+            return ret;
+        }
+        ssl->hsHmacStep = 0;
+        ssl->hsHmacOut = hash;
+    }
+    /* Armed before the operations, matching the HKDF helpers. */
+    ret = Tls13KdfAsyncInit(ssl);
+    if (ret != 0) {
+        Tls13FreeHsHmac(ssl);
+        return ret;
+    }
+    if (ssl->hsHmacStep == 0) {
+        ret = wc_HmacSetKey(ssl->hsHmac, hashType, key,
+                            ssl->specs.hash_size);
+        if (ret == 0)
+            ssl->hsHmacStep = 1;
+    }
+    if (ret == 0 && ssl->hsHmacStep == 1) {
+        ret = wc_HmacUpdate(ssl->hsHmac, hash, (word32)hashSz);
+        if (ret == 0)
+            ssl->hsHmacStep = 2;
+    }
+    if (ret == 0 && ssl->hsHmacStep == 2)
+        ret = wc_HmacFinal(ssl->hsHmac, hash);
+    if (ret == WC_NO_ERR_TRACE(WC_PENDING_E))
+        return wolfSSL_AsyncPush(ssl, &ssl->kdfAsyncDev);
+    Tls13FreeHsHmac(ssl);
+#else
     WC_ALLOC_VAR_EX(verifyHmac, Hmac, 1, NULL, DYNAMIC_TYPE_HMAC,
         return MEMORY_E);
 
@@ -1576,6 +1637,7 @@ static int BuildTls13HandshakeHmac(WOLFSSL* ssl, byte* key, byte* hash,
     }
 
     WC_FREE_VAR_EX(verifyHmac, NULL, DYNAMIC_TYPE_HMAC);
+#endif /* WOLFSSL_ASYNC_REINVOKE */
 
 #ifdef WOLFSSL_DEBUG_TLS
     WOLFSSL_MSG("  Hash");
@@ -14031,6 +14093,7 @@ static int DoTls13NewSessionTicket(WOLFSSL* ssl, const byte* input,
 static int ExpectedResumptionSecret(WOLFSSL* ssl)
 {
     int         ret;
+    int         saveRet = 0;
     word32      finishedSz = 0;
     byte        mac[WC_MAX_DIGEST_SIZE];
     Digest      digest;
@@ -14094,6 +14157,9 @@ static int ExpectedResumptionSecret(WOLFSSL* ssl)
 
     /* Restore the hash inline with currently seen messages. */
 restore:
+    /* The restore result must not mask the error that got here, or a
+     * WC_PENDING_E would be reported as success with the derive skipped. */
+    saveRet = ret;
     switch (ssl->specs.mac_algorithm) {
     #ifndef NO_SHA256
         case sha256_mac:
@@ -14124,6 +14190,8 @@ static int ExpectedResumptionSecret(WOLFSSL* ssl)
             break;
     #endif
     }
+    if (saveRet != 0)
+        ret = saveRet;
 
     ForceZero(mac, sizeof(mac));
     return ret;

tests/api/test_tls13.c

@@ -9543,7 +9543,8 @@ enum TestTls13PendTarget {
     TEST_TLS13_PEND_ECC_KEYGEN,
     TEST_TLS13_PEND_ECDSA_SIGN,
     TEST_TLS13_PEND_ECDSA_VERIFY,
-    TEST_TLS13_PEND_KDF
+    TEST_TLS13_PEND_KDF,
+    TEST_TLS13_PEND_HMAC
 };
 
 typedef struct TestTls13PendCtx {
@@ -9585,6 +9586,9 @@ static int TestTls13PendMatches(int target, wc_CryptoInfo* info)
         case TEST_TLS13_PEND_KDF:
             match = (info->algo_type == WC_ALGO_TYPE_KDF);
             break;
+        case TEST_TLS13_PEND_HMAC:
+            match = (info->algo_type == WC_ALGO_TYPE_HMAC);
+            break;
         default:
             break;
     }
@@ -9615,6 +9619,38 @@ static int TestTls13PendCb(int devIdArg, wc_CryptoInfo* info, void* ctx)
 
     if (info == NULL || c == NULL)
         return WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE);
+#if defined(HAVE_HKDF) && !defined(NO_HMAC) && !defined(HAVE_SELFTEST) && \
+    (!defined(HAVE_FIPS) || FIPS_VERSION_GE(7,0))
+    if (c->target == TEST_TLS13_PEND_HMAC &&
+            info->algo_type == WC_ALGO_TYPE_KDF) {
+        /* Serve the key schedule synchronously in software; falling back
+         * with the devId set would route its internal HMACs back here and
+         * those cannot resume (see wolfcrypt/src/hmac.c). Only the
+         * TLS-layer transcript HMACs are left to pend. */
+        if (info->kdf.type == WC_KDF_TYPE_HKDF_EXTRACT) {
+            return wc_HKDF_Extract_ex(info->kdf.hkdf_extract.hashType,
+                info->kdf.hkdf_extract.salt, info->kdf.hkdf_extract.saltSz,
+                info->kdf.hkdf_extract.inKey, info->kdf.hkdf_extract.inKeySz,
+                info->kdf.hkdf_extract.out, NULL, INVALID_DEVID);
+        }
+        if (info->kdf.type == WC_KDF_TYPE_HKDF_EXPAND) {
+            return wc_HKDF_Expand_ex(info->kdf.hkdf_expand.hashType,
+                info->kdf.hkdf_expand.inKey, info->kdf.hkdf_expand.inKeySz,
+                info->kdf.hkdf_expand.info, info->kdf.hkdf_expand.infoSz,
+                info->kdf.hkdf_expand.out, info->kdf.hkdf_expand.outSz,
+                NULL, INVALID_DEVID);
+        }
+        if (info->kdf.type == WC_KDF_TYPE_HKDF) {
+            return wc_HKDF_ex(info->kdf.hkdf.hashType,
+                info->kdf.hkdf.inKey, info->kdf.hkdf.inKeySz,
+                info->kdf.hkdf.salt, info->kdf.hkdf.saltSz,
+                info->kdf.hkdf.info, info->kdf.hkdf.infoSz,
+                info->kdf.hkdf.out, info->kdf.hkdf.outSz,
+                NULL, INVALID_DEVID);
+        }
+    }
+#endif
+
     if (!TestTls13PendMatches(c->target, info))
         return WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE);
 
@@ -9849,6 +9885,14 @@ int test_tls13_cryptocb_async(void)
         TEST_SUCCESS);
     ExpectIntEQ(test_tls13_cryptocb_pend_one(TEST_TLS13_PEND_KDF, 1),
         TEST_SUCCESS);
+#if !defined(HAVE_SELFTEST) && \
+    (!defined(HAVE_FIPS) || FIPS_VERSION_GE(7,0))
+    /* Transcript HMACs (Finished verify_data) pending on both sides. */
+    ExpectIntEQ(test_tls13_cryptocb_pend_one(TEST_TLS13_PEND_HMAC, 0),
+        TEST_SUCCESS);
+    ExpectIntEQ(test_tls13_cryptocb_pend_one(TEST_TLS13_PEND_HMAC, 1),
+        TEST_SUCCESS);
+#endif
 #endif
 #endif
     return EXPECT_RESULT();

wolfssl/internal.h

@@ -2366,6 +2366,18 @@ WOLFSSL_LOCAL int ChachaAEADDecrypt(WOLFSSL* ssl, byte* plain, const byte* input
 WOLFSSL_LOCAL int  DecryptTls13(WOLFSSL* ssl, byte* output, const byte* input,
                                 word16 sz, const byte* aad, word16 aadSz);
 WOLFSSL_LOCAL int  DoTls13MsgDerives(WOLFSSL* ssl, byte type);
+/* A crypto/PK callback pending is finished by re-invoking the provider:
+ * wolfSSL_AsyncPoll() never runs a callback. Exported so tests compile in
+ * only where a callback pend is resumable. */
+#if defined(WOLFSSL_ASYNC_CRYPT) && \
+    (defined(WOLF_CRYPTO_CB) || defined(HAVE_PK_CALLBACKS)) && \
+    !defined(WOLFSSL_ASYNC_CRYPT_SW) && !defined(HAVE_INTEL_QA) && \
+    !defined(HAVE_CAVIUM)
+    #define WOLFSSL_ASYNC_REINVOKE
+#endif
+#if defined(WOLFSSL_ASYNC_REINVOKE) && !defined(NO_HMAC)
+WOLFSSL_LOCAL void Tls13FreeHsHmac(WOLFSSL* ssl);
+#endif
 WOLFSSL_LOCAL int  DoTls13HandShakeMsgType(WOLFSSL* ssl, byte* input,
                                            word32* inOutIdx, byte type,
                                            word32 size, word32 totalSz);
@@ -6424,16 +6436,6 @@ enum ConnectionIdUsage {
 
 /* wolfSSL ssl type */
 
-/* A crypto/PK callback pending is finished by re-invoking the provider:
- * wolfSSL_AsyncPoll() never runs a callback. Exported so tests compile in
- * only where a callback pend is resumable. */
-#if defined(WOLFSSL_ASYNC_CRYPT) && \
-    (defined(WOLF_CRYPTO_CB) || defined(HAVE_PK_CALLBACKS)) && \
-    !defined(WOLFSSL_ASYNC_CRYPT_SW) && !defined(HAVE_INTEL_QA) && \
-    !defined(HAVE_CAVIUM)
-    #define WOLFSSL_ASYNC_REINVOKE
-#endif
-
 /* TLS 1.3 key-schedule resume steps (kdfMsgStep/kdfDeriveStep). A value is
  * recorded after its named operation completes ("step <= X" = X not done);
  * 0 = sequence not entered or finished. Values repeat across sequences. */
@@ -7076,6 +7078,15 @@ struct WOLFSSL {
     byte kdfDeriveStep;  /* enum Tls13KdfSendStep (send side) */
     byte kdfMsgStep;     /* enum Tls13KdfMsgStep (receive side) */
     byte kdfMsgType;     /* handshake type kdfMsgStep belongs to */
+#if defined(WOLFSSL_ASYNC_REINVOKE) && defined(WOLFSSL_TLS13) && \
+    !defined(NO_HMAC)
+    /* Transcript HMAC (Finished verify_data, PSK binders) held across a
+     * WC_PENDING_E so the retry re-invokes the same object and arguments,
+     * bound to its output buffer. */
+    Hmac* hsHmac;
+    byte* hsHmacOut;
+    byte  hsHmacStep;
+#endif
 };
 
 #if defined(WOLFSSL_SYS_CRYPTO_POLICY)