Add TLS 1.3 crypto callback pending support for transcript HMAC

Author: dgarske

src/internal.c

@@ -9741,6 +9741,13 @@ void wolfSSL_ResourceFree(WOLFSSL* ssl)
 #ifdef WOLFSSL_ASYNC_IO
     /* Cleanup async */
     FreeAsyncCtx(ssl, 1);
+#endif
+#ifdef WOLFSSL_ASYNC_REINVOKE
+    if (ssl->hsHmac != NULL) {
+        wc_HmacFree(ssl->hsHmac);
+        XFREE(ssl->hsHmac, ssl->heap, DYNAMIC_TYPE_HMAC);
+        ssl->hsHmac = NULL;
+    }
 #endif
     if (ssl->options.weOwnRng) {
         wc_FreeRng(ssl->rng);

src/ssl.c

@@ -5716,6 +5716,14 @@ size_t wolfSSL_get_client_random(const WOLFSSL* ssl, unsigned char* out,
         ssl->kdfDeriveStep = TLS13_SEND_KDF_NONE;
         ssl->kdfMsgStep = TLS13_MSG_KDF_NONE;
         ssl->kdfMsgType = 0;
+        #ifdef WOLFSSL_ASYNC_REINVOKE
+        if (ssl->hsHmac != NULL) {
+            wc_HmacFree(ssl->hsHmac);
+            XFREE(ssl->hsHmac, ssl->heap, DYNAMIC_TYPE_HMAC);
+            ssl->hsHmac = NULL;
+        }
+        ssl->hsHmacStep = 0;
+        #endif
         #ifdef WOLFSSL_ASYNC_CRYPT
         ssl->options.buildArgs13Set = 0;
         /* An abandoned handshake can leave a mid-flight handler resume

src/tls13.c

@@ -1508,7 +1508,9 @@ int DeriveResumptionPSK(WOLFSSL* ssl, byte* nonce, byte nonceLen, byte* secret)
 static int BuildTls13HandshakeHmac(WOLFSSL* ssl, byte* key, byte* hash,
     word32* pHashSz)
 {
+#ifndef WOLFSSL_ASYNC_REINVOKE
     WC_DECLARE_VAR(verifyHmac, Hmac, 1, 0);
+#endif
     int  hashType = WC_SHA256;
     int  hashSz = WC_SHA256_DIGEST_SIZE;
     int  ret = WC_NO_ERR_TRACE(BAD_FUNC_ARG);
@@ -1561,6 +1563,48 @@ static int BuildTls13HandshakeHmac(WOLFSSL* ssl, byte* key, byte* hash,
     WOLFSSL_BUFFER(hash, hashSz);
 #endif
 
+#ifdef WOLFSSL_ASYNC_REINVOKE
+    /* Held on the SSL object so a crypto callback WC_PENDING_E resumes by
+     * re-invoking the same Hmac with identical arguments; the transcript
+     * hash input is recomputed deterministically by the caller's retry. */
+    if (ssl->hsHmac == NULL) {
+        ssl->hsHmac = (Hmac*)XMALLOC(sizeof(Hmac), ssl->heap,
+                                     DYNAMIC_TYPE_HMAC);
+        if (ssl->hsHmac == NULL)
+            return MEMORY_E;
+        ret = wc_HmacInit(ssl->hsHmac, ssl->heap, ssl->devId);
+        if (ret == 0)
+            ret = wc_HmacSetKey(ssl->hsHmac, hashType, key,
+                                ssl->specs.hash_size);
+        if (ret != 0) {
+            XFREE(ssl->hsHmac, ssl->heap, DYNAMIC_TYPE_HMAC);
+            ssl->hsHmac = NULL;
+            return ret;
+        }
+        ssl->hsHmacStep = 0;
+    }
+    ret = 0;
+    if (ssl->hsHmacStep == 0) {
+        ret = wc_HmacUpdate(ssl->hsHmac, hash, (word32)hashSz);
+        if (ret == 0)
+            ssl->hsHmacStep = 1;
+    }
+    if (ret == 0 && ssl->hsHmacStep == 1)
+        ret = wc_HmacFinal(ssl->hsHmac, hash);
+    if (ret == WC_NO_ERR_TRACE(WC_PENDING_E)) {
+        int aret = Tls13KdfAsyncInit(ssl);
+        if (aret != 0)
+            ret = aret;
+        else
+            ret = wolfSSL_AsyncPush(ssl, &ssl->kdfAsyncDev);
+    }
+    if (ret != WC_NO_ERR_TRACE(WC_PENDING_E)) {
+        wc_HmacFree(ssl->hsHmac);
+        XFREE(ssl->hsHmac, ssl->heap, DYNAMIC_TYPE_HMAC);
+        ssl->hsHmac = NULL;
+        ssl->hsHmacStep = 0;
+    }
+#else
     WC_ALLOC_VAR_EX(verifyHmac, Hmac, 1, NULL, DYNAMIC_TYPE_HMAC,
         return MEMORY_E);
 
@@ -1576,6 +1620,7 @@ static int BuildTls13HandshakeHmac(WOLFSSL* ssl, byte* key, byte* hash,
     }
 
     WC_FREE_VAR_EX(verifyHmac, NULL, DYNAMIC_TYPE_HMAC);
+#endif /* WOLFSSL_ASYNC_REINVOKE */
 
 #ifdef WOLFSSL_DEBUG_TLS
     WOLFSSL_MSG("  Hash");

tests/api/test_tls13.c

@@ -9543,7 +9543,8 @@ enum TestTls13PendTarget {
     TEST_TLS13_PEND_ECC_KEYGEN,
     TEST_TLS13_PEND_ECDSA_SIGN,
     TEST_TLS13_PEND_ECDSA_VERIFY,
-    TEST_TLS13_PEND_KDF
+    TEST_TLS13_PEND_KDF,
+    TEST_TLS13_PEND_HMAC
 };
 
 typedef struct TestTls13PendCtx {
@@ -9585,6 +9586,9 @@ static int TestTls13PendMatches(int target, wc_CryptoInfo* info)
         case TEST_TLS13_PEND_KDF:
             match = (info->algo_type == WC_ALGO_TYPE_KDF);
             break;
+        case TEST_TLS13_PEND_HMAC:
+            match = (info->algo_type == WC_ALGO_TYPE_HMAC);
+            break;
         default:
             break;
     }
@@ -9615,10 +9619,43 @@ static int TestTls13PendCb(int devIdArg, wc_CryptoInfo* info, void* ctx)
 
     if (info == NULL || c == NULL)
         return WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE);
+#if defined(HAVE_HKDF) && !defined(NO_HMAC) && !defined(HAVE_SELFTEST) && \
+    (!defined(HAVE_FIPS) || FIPS_VERSION_GE(7,0))
+    if (c->target == TEST_TLS13_PEND_HMAC &&
+            info->algo_type == WC_ALGO_TYPE_KDF) {
+        /* Serve the key schedule synchronously in software; falling back
+         * with the devId set would route its internal HMACs back here and
+         * those cannot resume (see wolfcrypt/src/hmac.c). Only the
+         * TLS-layer transcript HMACs are left to pend. */
+        if (info->kdf.type == WC_KDF_TYPE_HKDF_EXTRACT) {
+            return wc_HKDF_Extract_ex(info->kdf.hkdf_extract.hashType,
+                info->kdf.hkdf_extract.salt, info->kdf.hkdf_extract.saltSz,
+                info->kdf.hkdf_extract.inKey, info->kdf.hkdf_extract.inKeySz,
+                info->kdf.hkdf_extract.out, NULL, INVALID_DEVID);
+        }
+        if (info->kdf.type == WC_KDF_TYPE_HKDF_EXPAND) {
+            return wc_HKDF_Expand_ex(info->kdf.hkdf_expand.hashType,
+                info->kdf.hkdf_expand.inKey, info->kdf.hkdf_expand.inKeySz,
+                info->kdf.hkdf_expand.info, info->kdf.hkdf_expand.infoSz,
+                info->kdf.hkdf_expand.out, info->kdf.hkdf_expand.outSz,
+                NULL, INVALID_DEVID);
+        }
+        if (info->kdf.type == WC_KDF_TYPE_HKDF) {
+            return wc_HKDF_ex(info->kdf.hkdf.hashType,
+                info->kdf.hkdf.inKey, info->kdf.hkdf.inKeySz,
+                info->kdf.hkdf.salt, info->kdf.hkdf.saltSz,
+                info->kdf.hkdf.info, info->kdf.hkdf.infoSz,
+                info->kdf.hkdf.out, info->kdf.hkdf.outSz,
+                NULL, INVALID_DEVID);
+        }
+    }
+#endif
+
     if (!TestTls13PendMatches(c->target, info))
         return WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE);
 
     c->seen++;
+
     h = TestTls13PendHash(info);
     for (i = 0; i < c->jobCount; i++) {
         if (c->jobs[i] == h) {
@@ -9849,6 +9886,14 @@ int test_tls13_cryptocb_async(void)
         TEST_SUCCESS);
     ExpectIntEQ(test_tls13_cryptocb_pend_one(TEST_TLS13_PEND_KDF, 1),
         TEST_SUCCESS);
+#if !defined(HAVE_SELFTEST) && \
+    (!defined(HAVE_FIPS) || FIPS_VERSION_GE(7,0))
+    /* Transcript HMACs (Finished verify_data) pending on both sides. */
+    ExpectIntEQ(test_tls13_cryptocb_pend_one(TEST_TLS13_PEND_HMAC, 0),
+        TEST_SUCCESS);
+    ExpectIntEQ(test_tls13_cryptocb_pend_one(TEST_TLS13_PEND_HMAC, 1),
+        TEST_SUCCESS);
+#endif
 #endif
 #endif
     return EXPECT_RESULT();

wolfssl/internal.h

@@ -7076,6 +7076,12 @@ struct WOLFSSL {
     byte kdfDeriveStep;  /* enum Tls13KdfSendStep (send side) */
     byte kdfMsgStep;     /* enum Tls13KdfMsgStep (receive side) */
     byte kdfMsgType;     /* handshake type kdfMsgStep belongs to */
+#ifdef WOLFSSL_ASYNC_REINVOKE
+    /* Transcript HMAC (Finished verify_data, PSK binders) held across a
+     * WC_PENDING_E so the retry re-invokes the same object and arguments. */
+    Hmac* hsHmac;
+    byte  hsHmacStep;
+#endif
 };
 
 #if defined(WOLFSSL_SYS_CRYPTO_POLICY)