Skip to content

Commit 61fab10

Browse files
dongbeioubadongbeiouba
committed
Use SM2 and SM3 algorithms in TLS 1.3 as required in RFC 8998
Check signature_algorithms, signature_algorithms_cert and key_share extensions according to RFC 8998. Replace draft-yang-tls-tls13-sm-suites-* to RFC 8998.
1 parent 34d2e67 commit 61fab10

26 files changed

+718
-154
lines changed

‎CHANGES.BabaSSL

+1-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535

3636
*) Fix up problems of CVE-2019-1551
3737

38-
*) Support TLS1.3-GM ciphersuite, see https://datatracker.ietf.org/doc/draft-yang-tls-tls13-sm-suites/ for more information
38+
*) Support TLS1.3-GM cipher suite, see https://datatracker.ietf.org/doc/html/rfc8998 for more information
3939

4040
*) Support global session cache, asynchronous session lookup
4141

‎apps/speed.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -3381,7 +3381,7 @@ int speed_main(int argc, char **argv)
33813381
}
33823382
/*
33833383
* No need to allow user to set an explicit ID here, just use
3384-
* the one defined in the 'draft-yang-tls-tl13-sm-suites' I-D.
3384+
* the one defined in the RFC 8998.
33853385
*/
33863386
if (EVP_PKEY_CTX_set1_id(sm2_pctx, SM2_ID, SM2_ID_LEN) != 1) {
33873387
st = 0;

‎crypto/err/openssl.txt

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved.
1+
# Copyright 1999-2022 The OpenSSL Project Authors. All Rights Reserved.
22
#
33
# Licensed under the OpenSSL license (the "License"). You may not use
44
# this file except in compliance with the License. You can obtain a copy
@@ -2982,6 +2982,8 @@ SSL_R_AT_LEAST_TLS_1_0_NEEDED_IN_FIPS_MODE:143:\
29822982
at least TLS 1.0 needed in FIPS mode
29832983
SSL_R_AT_LEAST_TLS_1_2_NEEDED_IN_SUITEB_MODE:158:\
29842984
at least (D)TLS 1.2 needed in Suite B mode
2985+
SSL_R_BAD_CERTIFICATE_SIGNATURE_TYPE:295:bad certificate signature type
2986+
SSL_R_BAD_CERTIFICATE_USAGE:296:bad certificate usage
29852987
SSL_R_BAD_CHANGE_CIPHER_SPEC:103:bad change cipher spec
29862988
SSL_R_BAD_CIPHER:186:bad cipher
29872989
SSL_R_BAD_DATA:390:bad data

‎crypto/evp/evp_err.c

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
* Generated by util/mkerr.pl DO NOT EDIT
3-
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
3+
* Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
44
*
55
* Licensed under the OpenSSL license (the "License"). You may not use
66
* this file except in compliance with the License. You can obtain a copy
@@ -247,10 +247,10 @@ static const ERR_STRING_DATA EVP_str_reasons[] = {
247247
"operation not supported for this keytype"},
248248
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_OPERATON_NOT_INITIALIZED),
249249
"operaton not initialized"},
250-
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PARAMETER_TOO_LARGE),
251-
"parameter too large"},
252250
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_OUTPUT_WOULD_OVERFLOW),
253251
"output would overflow"},
252+
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PARAMETER_TOO_LARGE),
253+
"parameter too large"},
254254
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PARTIALLY_OVERLAPPING),
255255
"partially overlapping buffers"},
256256
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_PBKDF2_ERROR), "pbkdf2 error"},

‎include/openssl/evperr.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
* Generated by util/mkerr.pl DO NOT EDIT
3-
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
3+
* Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
44
*
55
* Licensed under the OpenSSL license (the "License"). You may not use
66
* this file except in compliance with the License. You can obtain a copy
@@ -184,8 +184,8 @@ int ERR_load_EVP_strings(void);
184184
# define EVP_R_ONLY_ONESHOT_SUPPORTED 177
185185
# define EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE 150
186186
# define EVP_R_OPERATON_NOT_INITIALIZED 151
187-
# define EVP_R_PARAMETER_TOO_LARGE 187
188187
# define EVP_R_OUTPUT_WOULD_OVERFLOW 184
188+
# define EVP_R_PARAMETER_TOO_LARGE 187
189189
# define EVP_R_PARTIALLY_OVERLAPPING 162
190190
# define EVP_R_PBKDF2_ERROR 181
191191
# define EVP_R_PKEY_APPLICATION_ASN1_METHOD_ALREADY_REGISTERED 179

‎include/openssl/kdferr.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
* Generated by util/mkerr.pl DO NOT EDIT
3-
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
3+
* Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
44
*
55
* Licensed under the OpenSSL license (the "License"). You may not use
66
* this file except in compliance with the License. You can obtain a copy
@@ -22,11 +22,11 @@ int ERR_load_KDF_strings(void);
2222
* KDF function codes.
2323
*/
2424
# define KDF_F_HKDF_EXTRACT 112
25-
# define KDF_F_KDF_CIPHER2CTRL 134
2625
# define KDF_F_KBKDF_CTRL 144
2726
# define KDF_F_KBKDF_CTRL_STR 145
2827
# define KDF_F_KBKDF_DERIVE 146
2928
# define KDF_F_KBKDF_NEW 147
29+
# define KDF_F_KDF_CIPHER2CTRL 134
3030
# define KDF_F_KDF_HKDF_DERIVE 113
3131
# define KDF_F_KDF_HKDF_NEW 114
3232
# define KDF_F_KDF_HKDF_SIZE 115

‎include/openssl/sslerr.h

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
* Generated by util/mkerr.pl DO NOT EDIT
3-
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
3+
* Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
44
*
55
* Licensed under the OpenSSL license (the "License"). You may not use
66
* this file except in compliance with the License. You can obtain a copy
@@ -699,6 +699,8 @@ int ERR_load_SSL_strings(void);
699699
# define SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT 272
700700
# define SSL_R_AT_LEAST_TLS_1_0_NEEDED_IN_FIPS_MODE 143
701701
# define SSL_R_AT_LEAST_TLS_1_2_NEEDED_IN_SUITEB_MODE 158
702+
# define SSL_R_BAD_CERTIFICATE_SIGNATURE_TYPE 295
703+
# define SSL_R_BAD_CERTIFICATE_USAGE 296
702704
# define SSL_R_BAD_CHANGE_CIPHER_SPEC 103
703705
# define SSL_R_BAD_CIPHER 186
704706
# define SSL_R_BAD_DATA 390

‎include/openssl/tls1.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,7 @@ extern "C" {
223223
# define TLSEXT_curve_P_256 23
224224
# define TLSEXT_curve_P_384 24
225225

226-
/* define in draft-yang-tls-tls13-sm-suites-01 */
226+
/* defined in RFC 8998 */
227227
# ifndef OPENSSL_NO_SM2
228228
# define TLSEXT_curve_SM2 41
229229
# endif

‎ssl/s3_lib.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ static SSL_CIPHER tls13_ciphers[] = {
114114
},
115115
#if (!defined OPENSSL_NO_SM2) && (!defined OPENSSL_NO_SM3) \
116116
&& (!defined OPENSSL_NO_SM4)
117-
/* Cipher 0x00C6 and 0x00C7, Reference to draft-yang-tls-sm-suites-01*/
117+
/* Cipher 0x00C6 and 0x00C7, Reference to RFC 8998 */
118118
{
119119
1,
120120
TLS1_3_RFC_SM4_GCM_SM3,
@@ -4120,7 +4120,7 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
41204120

41214121
#ifndef OPENSSL_NO_SM2
41224122
/*
4123-
* draft-yang-tls-tls13-sm-suites-02 demand that server can use
4123+
* RFC 8998 demand that server can use
41244124
* "TLS_SM4_GCM_SM3" and "TLS_SM4_CCM_SM3" with sm2 cert only
41254125
*/
41264126
if (s->enable_sm_tls13_strict) {

‎ssl/ssl_err.c

+7-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
* Generated by util/mkerr.pl DO NOT EDIT
3-
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
3+
* Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
44
*
55
* Licensed under the OpenSSL license (the "License"). You may not use
66
* this file except in compliance with the License. You can obtain a copy
@@ -289,6 +289,8 @@ static const ERR_STRING_DATA SSL_str_functs[] = {
289289
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_WRITE_BYTES, 0), "ssl3_write_bytes"},
290290
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_WRITE_PENDING, 0), "ssl3_write_pending"},
291291
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_ADD_CERT_CHAIN, 0), "ssl_add_cert_chain"},
292+
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_ADD_CERT_CHAIN_NTLS, 0),
293+
"ssl_add_cert_chain_ntls"},
292294
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_ADD_CERT_COMPRESSION_ALG, 0),
293295
"SSL_add_cert_compression_alg"},
294296
{ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_ADD_CERT_TO_BUF, 0), ""},
@@ -1205,6 +1207,10 @@ static const ERR_STRING_DATA SSL_str_reasons[] = {
12051207
"at least TLS 1.0 needed in FIPS mode"},
12061208
{ERR_PACK(ERR_LIB_SSL, 0, SSL_R_AT_LEAST_TLS_1_2_NEEDED_IN_SUITEB_MODE),
12071209
"at least (D)TLS 1.2 needed in Suite B mode"},
1210+
{ERR_PACK(ERR_LIB_SSL, 0, SSL_R_BAD_CERTIFICATE_SIGNATURE_TYPE),
1211+
"bad certificate signature type"},
1212+
{ERR_PACK(ERR_LIB_SSL, 0, SSL_R_BAD_CERTIFICATE_USAGE),
1213+
"bad certificate usage"},
12081214
{ERR_PACK(ERR_LIB_SSL, 0, SSL_R_BAD_CHANGE_CIPHER_SPEC),
12091215
"bad change cipher spec"},
12101216
{ERR_PACK(ERR_LIB_SSL, 0, SSL_R_BAD_CIPHER), "bad cipher"},

‎ssl/ssl_local.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -1136,7 +1136,7 @@ struct ssl_ctx_st {
11361136

11371137
#ifndef OPENSSL_NO_SM2
11381138
/*
1139-
* tag of determining whether we should strict follow draft-yang-tls-tls13-sm-suites,
1139+
* tag of determining whether we should strict follow RFC 8998,
11401140
* when this tag set to 1, we will reject "TLS_SM4_GCM_SM3" and "TLS_SM4_CCM_SM3"
11411141
* without sm2 cert at server. This tag set to 0 default
11421142
*/
@@ -1619,7 +1619,7 @@ struct ssl_st {
16191619

16201620
#ifndef OPENSSL_NO_SM2
16211621
/*
1622-
* tag of determining whether we should strict follow draft-yang-tls-tls13-sm-suites,
1622+
* tag of determining whether we should strict follow RFC 8998,
16231623
* when this tag set to 1, we will reject "TLS_SM4_GCM_SM3" and "TLS_SM4_CCM_SM3"
16241624
* without sm2 cert at server. This tag set to 0 default
16251625
*/

‎ssl/statem/statem_clnt.c

+100
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
#include <openssl/dh.h>
2323
#include <openssl/bn.h>
2424
#include <openssl/engine.h>
25+
#include <openssl/x509v3.h>
2526
#include <internal/cryptlib.h>
2627

2728
static MSG_PROCESS_RETURN tls_process_as_hello_retry_request(SSL *s, PACKET *pkt);
@@ -1728,6 +1729,28 @@ MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt)
17281729
goto err;
17291730
}
17301731

1732+
#ifndef OPENSSL_NO_SM2
1733+
/*
1734+
* To use the cipher suites TLS_SM4_GCM_SM3 and TLS_SM4_CCM_SM3,
1735+
* RFC 8998 demand that:
1736+
* For the key_share extension, a KeyShareEntry with SM2-related
1737+
* values MUST be added.
1738+
*/
1739+
if (SSL_IS_TLS13(s) && s->enable_sm_tls13_strict == 1) {
1740+
const SSL_CIPHER *cipher = s->s3->tmp.new_cipher;
1741+
1742+
if (cipher->id == TLS1_3_CK_SM4_GCM_SM3
1743+
|| cipher->id == TLS1_3_CK_SM4_CCM_SM3) {
1744+
if (s->s3->group_id != TLSEXT_curve_SM2) {
1745+
SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1746+
SSL_F_TLS_PROCESS_SERVER_HELLO,
1747+
SSL_R_BAD_KEY_SHARE);
1748+
goto err;
1749+
}
1750+
}
1751+
}
1752+
#endif
1753+
17311754
#ifndef OPENSSL_NO_SCTP
17321755
if (SSL_IS_DTLS(s) && s->hit) {
17331756
unsigned char sctpauthkey[64];
@@ -2030,6 +2053,48 @@ MSG_PROCESS_RETURN tls_process_server_certificate(SSL *s, PACKET *pkt)
20302053
goto err;
20312054
}
20322055
}
2056+
2057+
#ifndef OPENSSL_NO_SM2
2058+
/*
2059+
* RFC 8998 requires that
2060+
* The public key in the certificate MUST be a valid SM2 public key.
2061+
* The signature algorithm used by the CA to sign the current
2062+
* certificate MUST be "sm2sig_sm3".
2063+
* The certificate MUST be capable of signing; e.g., the digitalSignature
2064+
* bit of X.509's Key Usage extension is set.
2065+
*/
2066+
if (SSL_IS_TLS13(s) && s->enable_sm_tls13_strict == 1) {
2067+
const SSL_CIPHER *cipher = s->s3->tmp.new_cipher;
2068+
2069+
if (cipher->id == TLS1_3_CK_SM4_GCM_SM3
2070+
|| cipher->id == TLS1_3_CK_SM4_CCM_SM3) {
2071+
if (EVP_PKEY_id(pkey) != EVP_PKEY_SM2) {
2072+
x = NULL;
2073+
SSLfatal(s, SSL_AD_BAD_CERTIFICATE,
2074+
SSL_F_TLS_PROCESS_SERVER_CERTIFICATE,
2075+
SSL_R_WRONG_CERTIFICATE_TYPE);
2076+
goto err;
2077+
}
2078+
2079+
if (X509_get_signature_nid(x) != NID_SM2_with_SM3) {
2080+
x = NULL;
2081+
SSLfatal(s, SSL_AD_BAD_CERTIFICATE,
2082+
SSL_F_TLS_PROCESS_SERVER_CERTIFICATE,
2083+
SSL_R_BAD_CERTIFICATE_SIGNATURE_TYPE);
2084+
goto err;
2085+
}
2086+
2087+
if ((X509_get_key_usage(x) & X509v3_KU_DIGITAL_SIGNATURE) == 0) {
2088+
x = NULL;
2089+
SSLfatal(s, SSL_AD_BAD_CERTIFICATE,
2090+
SSL_F_TLS_PROCESS_SERVER_CERTIFICATE,
2091+
SSL_R_BAD_CERTIFICATE_USAGE);
2092+
goto err;
2093+
}
2094+
}
2095+
}
2096+
#endif
2097+
20332098
s->session->peer_type = certidx;
20342099

20352100
X509_free(s->session->peer);
@@ -2587,6 +2652,41 @@ MSG_PROCESS_RETURN tls_process_certificate_request(SSL *s, PACKET *pkt)
25872652
return MSG_PROCESS_ERROR;
25882653
}
25892654
OPENSSL_free(rawexts);
2655+
#ifndef OPENSSL_NO_SM2
2656+
/*
2657+
* RFC 8998 requires that
2658+
* if the server chooses TLS_SM4_GCM_SM3 or TLS_SM4_CCM_SM3,
2659+
* the only valid signature algorithm present in
2660+
* "signature_algorithms" extension MUST be "sm2sig_sm3".
2661+
*/
2662+
if (s->enable_sm_tls13_strict == 1) {
2663+
const SSL_CIPHER *cipher = s->s3->tmp.new_cipher;
2664+
2665+
if (cipher->id == TLS1_3_CK_SM4_GCM_SM3
2666+
|| cipher->id == TLS1_3_CK_SM4_CCM_SM3) {
2667+
2668+
if (s->s3->tmp.peer_sigalgslen > 0
2669+
&& (s->s3->tmp.peer_sigalgslen != 1
2670+
|| s->s3->tmp.peer_sigalgs[0] != TLSEXT_SIGALG_sm2sig_sm3))
2671+
{
2672+
SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
2673+
SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST,
2674+
SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
2675+
return MSG_PROCESS_ERROR;
2676+
}
2677+
2678+
if (s->s3->tmp.peer_cert_sigalgslen > 0
2679+
&& (s->s3->tmp.peer_cert_sigalgslen != 1
2680+
|| s->s3->tmp.peer_cert_sigalgs[0] != TLSEXT_SIGALG_sm2sig_sm3))
2681+
{
2682+
SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
2683+
SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST,
2684+
SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM);
2685+
return MSG_PROCESS_ERROR;
2686+
}
2687+
}
2688+
}
2689+
#endif
25902690
if (!tls1_process_sigalgs(s)) {
25912691
SSLfatal(s, SSL_AD_INTERNAL_ERROR,
25922692
SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST,

‎ssl/statem/statem_local.h

+1-2
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,7 @@
3434

3535
#ifndef OPENSSL_NO_SM2
3636
/*
37-
*standard handshake sm2-id and cert verify id is defined
38-
* in IETF draft-yang-tls-tls13-sm-suites-01
37+
* standard handshake sm2-id and cert verify id is defined in RFC 8998
3938
*/
4039
# define HANDSHAKE_SM2_ID "TLSv1.3+GM+Cipher+Suite"
4140
# define HANDSHAKE_SM2_ID_LEN sizeof(HANDSHAKE_SM2_ID) - 1

0 commit comments

Comments
 (0)