Back to index...

	/*
	* Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	*
	* This code is free software; you can redistribute it and/or modify it
	* under the terms of the GNU General Public License version 2 only, as
	* published by the Free Software Foundation. Oracle designates this
	* particular file as subject to the "Classpath" exception as provided
	* by Oracle in the LICENSE file that accompanied this code.
	*
	* This code is distributed in the hope that it will be useful, but WITHOUT
	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	* version 2 for more details (a copy is included in the LICENSE file that
	* accompanied this code).
	*
	* You should have received a copy of the GNU General Public License version
	* 2 along with this work; if not, write to the Free Software Foundation,
	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	*
	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	* or visit www.oracle.com if you need additional information or have any
	* questions.
	*/

	package sun.security.ssl;

	import java.io.IOException;
	import java.math.BigInteger;
	import java.security.GeneralSecurityException;
	import java.security.InvalidKeyException;
	import java.security.KeyFactory;
	import java.security.KeyPair;
	import java.security.KeyPairGenerator;
	import java.security.NoSuchAlgorithmException;
	import java.security.PrivateKey;
	import java.security.PublicKey;
	import java.security.SecureRandom;
	import java.security.spec.AlgorithmParameterSpec;
	import java.security.spec.InvalidKeySpecException;
	import javax.crypto.KeyAgreement;
	import javax.crypto.SecretKey;
	import javax.crypto.interfaces.DHPublicKey;
	import javax.crypto.spec.DHParameterSpec;
	import javax.crypto.spec.DHPublicKeySpec;
	import javax.crypto.spec.SecretKeySpec;
	import javax.net.ssl.SSLHandshakeException;
	import sun.security.action.GetPropertyAction;
	import sun.security.ssl.CipherSuite.HashAlg;
	import sun.security.ssl.SupportedGroupsExtension.NamedGroup;
	import sun.security.ssl.SupportedGroupsExtension.NamedGroupType;
	import sun.security.ssl.SupportedGroupsExtension.SupportedGroups;
	import sun.security.ssl.X509Authentication.X509Possession;
	import sun.security.util.KeyUtil;

	final class DHKeyExchange {
	static final SSLPossessionGenerator poGenerator =
	new DHEPossessionGenerator(false);
	static final SSLPossessionGenerator poExportableGenerator =
	new DHEPossessionGenerator(true);
	static final SSLKeyAgreementGenerator kaGenerator =
	new DHEKAGenerator();

	static final class DHECredentials implements SSLCredentials {
	final DHPublicKey popPublicKey;
	final NamedGroup namedGroup;

	DHECredentials(DHPublicKey popPublicKey, NamedGroup namedGroup) {
	this.popPublicKey = popPublicKey;
	this.namedGroup = namedGroup;
	}

	static DHECredentials valueOf(NamedGroup ng,
	byte[] encodedPublic) throws IOException, GeneralSecurityException {

	if (ng.type != NamedGroupType.NAMED_GROUP_FFDHE) {
	throw new RuntimeException(
	"Credentials decoding: Not FFDHE named group");
	}

	if (encodedPublic == null \|\| encodedPublic.length == 0) {
	return null;
	}

	DHParameterSpec params = (DHParameterSpec)ng.getParameterSpec();
	if (params == null) {
	return null;
	}

	KeyFactory kf = JsseJce.getKeyFactory("DiffieHellman");
	DHPublicKeySpec spec = new DHPublicKeySpec(
	new BigInteger(1, encodedPublic),
	params.getP(), params.getG());
	DHPublicKey publicKey =
	(DHPublicKey)kf.generatePublic(spec);

	return new DHECredentials(publicKey, ng);
	}
	}

	static final class DHEPossession implements SSLPossession {
	final PrivateKey privateKey;
	final DHPublicKey publicKey;
	final NamedGroup namedGroup;

	DHEPossession(NamedGroup namedGroup, SecureRandom random) {
	try {
	KeyPairGenerator kpg =
	JsseJce.getKeyPairGenerator("DiffieHellman");
	DHParameterSpec params =
	(DHParameterSpec)namedGroup.getParameterSpec();
	kpg.initialize(params, random);
	KeyPair kp = generateDHKeyPair(kpg);
	if (kp == null) {
	throw new RuntimeException("Could not generate DH keypair");
	}
	privateKey = kp.getPrivate();
	publicKey = (DHPublicKey)kp.getPublic();
	} catch (GeneralSecurityException gse) {
	throw new RuntimeException(
	"Could not generate DH keypair", gse);
	}

	this.namedGroup = namedGroup;
	}

	DHEPossession(int keyLength, SecureRandom random) {
	DHParameterSpec params =
	PredefinedDHParameterSpecs.definedParams.get(keyLength);
	try {
	KeyPairGenerator kpg =
	JsseJce.getKeyPairGenerator("DiffieHellman");
	if (params != null) {
	kpg.initialize(params, random);
	} else {
	kpg.initialize(keyLength, random);
	}

	KeyPair kp = generateDHKeyPair(kpg);
	if (kp == null) {
	throw new RuntimeException(
	"Could not generate DH keypair of " +
	keyLength + " bits");
	}
	privateKey = kp.getPrivate();
	publicKey = (DHPublicKey)kp.getPublic();
	} catch (GeneralSecurityException gse) {
	throw new RuntimeException(
	"Could not generate DH keypair", gse);
	}

	this.namedGroup = NamedGroup.valueOf(publicKey.getParams());
	}

	DHEPossession(DHECredentials credentials, SecureRandom random) {
	try {
	KeyPairGenerator kpg =
	JsseJce.getKeyPairGenerator("DiffieHellman");
	kpg.initialize(credentials.popPublicKey.getParams(), random);
	KeyPair kp = generateDHKeyPair(kpg);
	if (kp == null) {
	throw new RuntimeException("Could not generate DH keypair");
	}
	privateKey = kp.getPrivate();
	publicKey = (DHPublicKey)kp.getPublic();
	} catch (GeneralSecurityException gse) {
	throw new RuntimeException(
	"Could not generate DH keypair", gse);
	}

	this.namedGroup = credentials.namedGroup;
	}

	// Generate and validate DHPublicKeySpec
	private KeyPair generateDHKeyPair(
	KeyPairGenerator kpg) throws GeneralSecurityException {
	boolean doExtraValiadtion =
	(!KeyUtil.isOracleJCEProvider(kpg.getProvider().getName()));
	boolean isRecovering = false;
	for (int i = 0; i <= 2; i++) { // Try to recover from failure.
	KeyPair kp = kpg.generateKeyPair();
	// validate the Diffie-Hellman public key
	if (doExtraValiadtion) {
	DHPublicKeySpec spec = getDHPublicKeySpec(kp.getPublic());
	try {
	KeyUtil.validate(spec);
	} catch (InvalidKeyException ivke) {
	if (isRecovering) {
	throw ivke;
	}
	// otherwise, ignore the exception and try again
	isRecovering = true;
	continue;
	}
	}

	return kp;
	}

	return null;
	}

	private static DHPublicKeySpec getDHPublicKeySpec(PublicKey key) {
	if (key instanceof DHPublicKey) {
	DHPublicKey dhKey = (DHPublicKey)key;
	DHParameterSpec params = dhKey.getParams();
	return new DHPublicKeySpec(dhKey.getY(),
	params.getP(), params.getG());
	}
	try {
	KeyFactory factory = JsseJce.getKeyFactory("DiffieHellman");
	return factory.getKeySpec(key, DHPublicKeySpec.class);
	} catch (NoSuchAlgorithmException \| InvalidKeySpecException e) {
	// unlikely
	throw new RuntimeException("Unable to get DHPublicKeySpec", e);
	}
	}

	@Override
	public byte[] encode() {
	// Note: the DH public value is encoded as a big-endian integer
	// and padded to the left with zeros to the size of p in bytes.
	byte[] encoded = publicKey.getY().toByteArray();
	int pSize = KeyUtil.getKeySize(publicKey);
	if (pSize > 0 && encoded.length < pSize) {
	byte[] buffer = new byte[pSize];
	System.arraycopy(encoded, 0,
	buffer, pSize - encoded.length, encoded.length);
	encoded = buffer;
	}

	return encoded;
	}
	}

	private static final class
	DHEPossessionGenerator implements SSLPossessionGenerator {
	// Flag to use smart ephemeral DH key which size matches the
	// corresponding authentication key
	private static final boolean useSmartEphemeralDHKeys;

	// Flag to use legacy ephemeral DH key which size is 512 bits for
	// exportable cipher suites, and 768 bits for others
	private static final boolean useLegacyEphemeralDHKeys;

	// The customized ephemeral DH key size for non-exportable
	// cipher suites.
	private static final int customizedDHKeySize;

	// Is it for exportable cipher suite?
	private final boolean exportable;

	static {
	String property = GetPropertyAction.privilegedGetProperty(
	"jdk.tls.ephemeralDHKeySize");
	if (property == null \|\| property.length() == 0) {
	useLegacyEphemeralDHKeys = false;
	useSmartEphemeralDHKeys = false;
	customizedDHKeySize = -1;
	} else if ("matched".equals(property)) {
	useLegacyEphemeralDHKeys = false;
	useSmartEphemeralDHKeys = true;
	customizedDHKeySize = -1;
	} else if ("legacy".equals(property)) {
	useLegacyEphemeralDHKeys = true;
	useSmartEphemeralDHKeys = false;
	customizedDHKeySize = -1;
	} else {
	useLegacyEphemeralDHKeys = false;
	useSmartEphemeralDHKeys = false;

	try {
	// DH parameter generation can be extremely slow, best to
	// use one of the supported pre-computed DH parameters
	// (see DHCrypt class).
	customizedDHKeySize = Integer.parseUnsignedInt(property);
	if (customizedDHKeySize < 1024 \|\|
	customizedDHKeySize > 8192 \|\|
	(customizedDHKeySize & 0x3f) != 0) {
	throw new IllegalArgumentException(
	"Unsupported customized DH key size: " +
	customizedDHKeySize + ". " +
	"The key size must be multiple of 64, " +
	"and range from 1024 to 8192 (inclusive)");
	}
	} catch (NumberFormatException nfe) {
	throw new IllegalArgumentException(
	"Invalid system property jdk.tls.ephemeralDHKeySize");
	}
	}
	}

	// Prevent instantiation of this class.
	private DHEPossessionGenerator(boolean exportable) {
	this.exportable = exportable;
	}

	// Used for ServerKeyExchange, TLS 1.2 and prior versions.
	@Override
	public SSLPossession createPossession(HandshakeContext context) {
	NamedGroup preferableNamedGroup = null;
	if (!useLegacyEphemeralDHKeys &&
	(context.clientRequestedNamedGroups != null) &&
	(!context.clientRequestedNamedGroups.isEmpty())) {
	preferableNamedGroup =
	SupportedGroups.getPreferredGroup(
	context.negotiatedProtocol,
	context.algorithmConstraints,
	NamedGroupType.NAMED_GROUP_FFDHE,
	context.clientRequestedNamedGroups);
	if (preferableNamedGroup != null) {
	return new DHEPossession(preferableNamedGroup,
	context.sslContext.getSecureRandom());
	}
	}

	/*
	* 768 bits ephemeral DH private keys were used to be used in
	* ServerKeyExchange except that exportable ciphers max out at 512
	* bits modulus values. We still adhere to this behavior in legacy
	* mode (system property "jdk.tls.ephemeralDHKeySize" is defined
	* as "legacy").
	*
	* Old JDK (JDK 7 and previous) releases don't support DH keys
	* bigger than 1024 bits. We have to consider the compatibility
	* requirement. 1024 bits DH key is always used for non-exportable
	* cipher suites in default mode (system property
	* "jdk.tls.ephemeralDHKeySize" is not defined).
	*
	* However, if applications want more stronger strength, setting
	* system property "jdk.tls.ephemeralDHKeySize" to "matched"
	* is a workaround to use ephemeral DH key which size matches the
	* corresponding authentication key. For example, if the public key
	* size of an authentication certificate is 2048 bits, then the
	* ephemeral DH key size should be 2048 bits accordingly unless
	* the cipher suite is exportable. This key sizing scheme keeps
	* the cryptographic strength consistent between authentication
	* keys and key-exchange keys.
	*
	* Applications may also want to customize the ephemeral DH key
	* size to a fixed length for non-exportable cipher suites. This
	* can be approached by setting system property
	* "jdk.tls.ephemeralDHKeySize" to a valid positive integer between
	* 1024 and 8192 bits, inclusive.
	*
	* Note that the minimum acceptable key size is 1024 bits except
	* exportable cipher suites or legacy mode.
	*
	* Note that per RFC 2246, the key size limit of DH is 512 bits for
	* exportable cipher suites. Because of the weakness, exportable
	* cipher suites are deprecated since TLS v1.1 and they are not
	* enabled by default in Oracle provider. The legacy behavior is
	* reserved and 512 bits DH key is always used for exportable
	* cipher suites.
	*/
	int keySize = exportable ? 512 : 1024; // default mode
	if (!exportable) {
	if (useLegacyEphemeralDHKeys) { // legacy mode
	keySize = 768;
	} else if (useSmartEphemeralDHKeys) { // matched mode
	PrivateKey key = null;
	ServerHandshakeContext shc =
	(ServerHandshakeContext)context;
	if (shc.interimAuthn instanceof X509Possession) {
	key = ((X509Possession)shc.interimAuthn).popPrivateKey;
	}

	if (key != null) {
	int ks = KeyUtil.getKeySize(key);

	// DH parameter generation can be extremely slow, make
	// sure to use one of the supported pre-computed DH
	// parameters.
	//
	// Old deployed applications may not be ready to
	// support DH key sizes bigger than 2048 bits. Please
	// DON'T use value other than 1024 and 2048 at present.
	// May improve the underlying providers and key size
	// limit in the future when the compatibility and
	// interoperability impact is limited.
	keySize = ks <= 1024 ? 1024 : 2048;
	} // Otherwise, anonymous cipher suites, 1024-bit is used.
	} else if (customizedDHKeySize > 0) { // customized mode
	keySize = customizedDHKeySize;
	}
	}

	return new DHEPossession(
	keySize, context.sslContext.getSecureRandom());
	}
	}

	private static final
	class DHEKAGenerator implements SSLKeyAgreementGenerator {
	static private DHEKAGenerator instance = new DHEKAGenerator();

	// Prevent instantiation of this class.
	private DHEKAGenerator() {
	// blank
	}

	@Override
	public SSLKeyDerivation createKeyDerivation(
	HandshakeContext context) throws IOException {
	DHEPossession dhePossession = null;
	DHECredentials dheCredentials = null;
	for (SSLPossession poss : context.handshakePossessions) {
	if (!(poss instanceof DHEPossession)) {
	continue;
	}

	DHEPossession dhep = (DHEPossession)poss;
	for (SSLCredentials cred : context.handshakeCredentials) {
	if (!(cred instanceof DHECredentials)) {
	continue;
	}
	DHECredentials dhec = (DHECredentials)cred;
	if (dhep.namedGroup != null && dhec.namedGroup != null) {
	if (dhep.namedGroup.equals(dhec.namedGroup)) {
	dheCredentials = (DHECredentials)cred;
	break;
	}
	} else {
	DHParameterSpec pps = dhep.publicKey.getParams();
	DHParameterSpec cps = dhec.popPublicKey.getParams();
	if (pps.getP().equals(cps.getP()) &&
	pps.getG().equals(cps.getG())) {
	dheCredentials = (DHECredentials)cred;
	break;
	}
	}
	}

	if (dheCredentials != null) {
	dhePossession = (DHEPossession)poss;
	break;
	}
	}

	if (dhePossession == null \|\| dheCredentials == null) {
	context.conContext.fatal(Alert.HANDSHAKE_FAILURE,
	"No sufficient DHE key agreement parameters negotiated");
	}

	return new DHEKAKeyDerivation(context,
	dhePossession.privateKey, dheCredentials.popPublicKey);
	}

	private static final
	class DHEKAKeyDerivation implements SSLKeyDerivation {
	private final HandshakeContext context;
	private final PrivateKey localPrivateKey;
	private final PublicKey peerPublicKey;

	DHEKAKeyDerivation(HandshakeContext context,
	PrivateKey localPrivateKey,
	PublicKey peerPublicKey) {
	this.context = context;
	this.localPrivateKey = localPrivateKey;
	this.peerPublicKey = peerPublicKey;
	}

	@Override
	public SecretKey deriveKey(String algorithm,
	AlgorithmParameterSpec params) throws IOException {
	if (!context.negotiatedProtocol.useTLS13PlusSpec()) {
	return t12DeriveKey(algorithm, params);
	} else {
	return t13DeriveKey(algorithm, params);
	}
	}

	private SecretKey t12DeriveKey(String algorithm,
	AlgorithmParameterSpec params) throws IOException {
	try {
	KeyAgreement ka = JsseJce.getKeyAgreement("DiffieHellman");
	ka.init(localPrivateKey);
	ka.doPhase(peerPublicKey, true);
	SecretKey preMasterSecret =
	ka.generateSecret("TlsPremasterSecret");
	SSLMasterKeyDerivation mskd =
	SSLMasterKeyDerivation.valueOf(
	context.negotiatedProtocol);
	if (mskd == null) {
	// unlikely
	throw new SSLHandshakeException(
	"No expected master key derivation for protocol: " +
	context.negotiatedProtocol.name);
	}
	SSLKeyDerivation kd = mskd.createKeyDerivation(
	context, preMasterSecret);
	return kd.deriveKey("MasterSecret", params);
	} catch (GeneralSecurityException gse) {
	throw (SSLHandshakeException) new SSLHandshakeException(
	"Could not generate secret").initCause(gse);
	}
	}

	private SecretKey t13DeriveKey(String algorithm,
	AlgorithmParameterSpec params) throws IOException {
	try {
	KeyAgreement ka = JsseJce.getKeyAgreement("DiffieHellman");
	ka.init(localPrivateKey);
	ka.doPhase(peerPublicKey, true);
	SecretKey sharedSecret =
	ka.generateSecret("TlsPremasterSecret");

	HashAlg hashAlg = context.negotiatedCipherSuite.hashAlg;
	SSLKeyDerivation kd = context.handshakeKeyDerivation;
	HKDF hkdf = new HKDF(hashAlg.name);
	if (kd == null) { // No PSK is in use.
	// If PSK is not in use Early Secret will still be
	// HKDF-Extract(0, 0).
	byte[] zeros = new byte[hashAlg.hashLength];
	SecretKeySpec ikm =
	new SecretKeySpec(zeros, "TlsPreSharedSecret");
	SecretKey earlySecret =
	hkdf.extract(zeros, ikm, "TlsEarlySecret");
	kd = new SSLSecretDerivation(context, earlySecret);
	}

	// derive salt secret
	SecretKey saltSecret = kd.deriveKey("TlsSaltSecret", null);

	// derive handshake secret
	return hkdf.extract(saltSecret, sharedSecret, algorithm);
	} catch (GeneralSecurityException gse) {
	throw (SSLHandshakeException) new SSLHandshakeException(
	"Could not generate secret").initCause(gse);
	}
	}
	}
	}
	}

Back to index...