diff options
author | Todd Short <tshort@akamai.com> | 2017-12-18 16:52:28 -0500 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2018-02-01 17:07:56 +0000 |
commit | 9d75dce3e1f94be6006500089491cb3284f70d06 (patch) | |
tree | 0dbc8c69fd89147a135ea90d8d50d173375b2406 /util | |
parent | 633a8829ffc01952aed1f5040d481a5eeef1670c (diff) |
Add TLSv1.3 post-handshake authentication (PHA)
Add SSL_verify_client_post_handshake() for servers to initiate PHA
Add SSL_force_post_handshake_auth() for clients that don't have certificates
initially configured, but use a certificate callback.
Update SSL_CTX_set_verify()/SSL_set_verify() mode:
* Add SSL_VERIFY_POST_HANDSHAKE to postpone client authentication until after
the initial handshake.
* Update SSL_VERIFY_CLIENT_ONCE now only sends out one CertRequest regardless
of when the certificate authentication takes place; either initial handshake,
re-negotiation, or post-handshake authentication.
Add 'RequestPostHandshake' and 'RequirePostHandshake' SSL_CONF options that
add the SSL_VERIFY_POST_HANDSHAKE to the 'Request' and 'Require' options
Add support to s_client:
* Enabled automatically when cert is configured
* Can be forced enabled via -force_pha
Add support to s_server:
* Use 'c' to invoke PHA in s_server
* Remove some dead code
Update documentation
Update unit tests:
* Illegal use of PHA extension
* TLSv1.3 certificate tests
DTLS and TLS behave ever-so-slightly differently. So, when DTLS1.3 is
implemented, it's PHA support state machine may need to be different.
Add a TODO and a #error
Update handshake context to deal with PHA.
The handshake context for TLSv1.3 post-handshake auth is up through the
ClientFinish message, plus the CertificateRequest message. Subsequent
Certificate, CertificateVerify, and Finish messages are based on this
handshake context (not the Certificate message per se, but it's included
after the hash). KeyUpdate, NewSessionTicket, and prior Certificate
Request messages are not included in post-handshake authentication.
After the ClientFinished message is processed, save off the digest state
for future post-handshake authentication. When post-handshake auth occurs,
copy over the saved handshake context into the "main" handshake digest.
This effectively discards the any KeyUpdate or NewSessionTicket messages
and any prior post-handshake authentication.
This, of course, assumes that the ID-22 did not mean to include any
previous post-handshake authentication into the new handshake transcript.
This is implied by section 4.4.1 that lists messages only up to the
first ClientFinished.
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4964)
Diffstat (limited to 'util')
-rw-r--r-- | util/libssl.num | 2 | ||||
-rw-r--r-- | util/perl/TLSProxy/Message.pm | 1 | ||||
-rw-r--r-- | util/perl/checkhandshake.pm | 3 |
3 files changed, 5 insertions, 1 deletions
diff --git a/util/libssl.num b/util/libssl.num index abaa5bf548..866ff537a5 100644 --- a/util/libssl.num +++ b/util/libssl.num @@ -474,3 +474,5 @@ SSL_CTX_set_tlsext_max_fragment_length 474 1_1_1 EXIST::FUNCTION: SSL_set_tlsext_max_fragment_length 475 1_1_1 EXIST::FUNCTION: SSL_SESSION_get_max_fragment_length 476 1_1_1 EXIST::FUNCTION: SSL_stateless 477 1_1_1 EXIST::FUNCTION: +SSL_verify_client_post_handshake 478 1_1_1 EXIST::FUNCTION: +SSL_force_post_handshake_auth 479 1_1_1 EXIST::FUNCTION: diff --git a/util/perl/TLSProxy/Message.pm b/util/perl/TLSProxy/Message.pm index eea272f653..031149036f 100644 --- a/util/perl/TLSProxy/Message.pm +++ b/util/perl/TLSProxy/Message.pm @@ -79,6 +79,7 @@ use constant { EXT_SUPPORTED_VERSIONS => 43, EXT_COOKIE => 44, EXT_PSK_KEX_MODES => 45, + EXT_POST_HANDSHAKE_AUTH => 49, EXT_SIG_ALGS_CERT => 50, EXT_RENEGOTIATE => 65281, EXT_NPN => 13172, diff --git a/util/perl/checkhandshake.pm b/util/perl/checkhandshake.pm index e1667d5705..2f4a296ad8 100644 --- a/util/perl/checkhandshake.pm +++ b/util/perl/checkhandshake.pm @@ -53,7 +53,8 @@ use constant { KEY_SHARE_SRV_EXTENSION => 0x00020000, PSK_KEX_MODES_EXTENSION => 0x00040000, KEY_SHARE_HRR_EXTENSION => 0x00080000, - SUPPORTED_GROUPS_SRV_EXTENSION => 0x00100000 + SUPPORTED_GROUPS_SRV_EXTENSION => 0x00100000, + POST_HANDSHAKE_AUTH_CLI_EXTENSION => 0x00200000 }; our @handmessages = (); |