crypto/tls: ECDHE-RSA-AES256-GCM-SHA384 fails with "input must be hashed message"

[johto]

Hi,

Given this client:

package main

import (
    "crypto/tls"
)

func main() {
    cert, err := tls.LoadX509KeyPair("client.crt", "client.key")
    if err != nil {
        panic(err)
    }
    tlsConf := &tls.Config{
        Certificates: []tls.Certificate{cert},
        InsecureSkipVerify: true,
    }
    c, err := tls.Dial("tcp", "localhost:4433", tlsConf)
    if err != nil {
        panic(err)
    }
    _, err = c.Write([]byte("foo"))
    if err != nil {
        panic(err)
    }
    c.Close()
}

and this command line to run a server:

openssl s_server -serverpref -cipher 'ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256' -Verify 1

the test program fails with:

% go run ~/test.go
panic: tls: failed to sign handshake with client certificate: crypto/rsa: input must be hashed message

This only happens if -serverpref is used. This problem appears to have been introduced by commit f1d669a, and comes from src/crypto/rsa/pkcs1v15.go, line 275 (in HEAD):

    if inLen != hashLen {
        return 0, nil, errors.New("crypto/rsa: input must be hashed message")
    }

openssl s_client appears to have no issues connecting so I'm guessing this is a problem on Go's end.

[jstemmer]

The commit you referenced added support for arbitrary hash functions. I've tracked this issue down to hashForClientCertificate in prf.go that would always return sha256 as its hash function, even if it used a different one to calculate its digest.

I've uploaded a proposed fix: https://go-review.googlesource.com/7040