diff options
| -rw-r--r-- | rustls/src/client/tls13.rs | 4 | ||||
| -rw-r--r-- | rustls/src/server/tls13.rs | 4 | ||||
| -rw-r--r-- | rustls/src/tls13/mod.rs | 45 |
3 files changed, 35 insertions, 18 deletions
diff --git a/rustls/src/client/tls13.rs b/rustls/src/client/tls13.rs index 066640c4..48ab32cc 100644 --- a/rustls/src/client/tls13.rs +++ b/rustls/src/client/tls13.rs @@ -1115,7 +1115,7 @@ impl State<ClientConnectionData> for ExpectCertificateVerify<'_> { .config .verifier .verify_tls13_signature( - &construct_server_verify_message(&handshake_hash), + construct_server_verify_message(&handshake_hash).as_ref(), end_entity, cert_verify, ) @@ -1204,7 +1204,7 @@ fn emit_certverify_tls13( let message = construct_client_verify_message(&flight.transcript.current_hash()); let scheme = signer.scheme(); - let sig = signer.sign(&message)?; + let sig = signer.sign(message.as_ref())?; let dss = DigitallySignedStruct::new(scheme, sig); flight.add(HandshakeMessagePayload { diff --git a/rustls/src/server/tls13.rs b/rustls/src/server/tls13.rs index 656186ad..c67fe783 100644 --- a/rustls/src/server/tls13.rs +++ b/rustls/src/server/tls13.rs @@ -796,7 +796,7 @@ mod client_hello { })?; let scheme = signer.scheme(); - let sig = signer.sign(&message)?; + let sig = signer.sign(message.as_ref())?; let cv = DigitallySignedStruct::new(scheme, sig); @@ -1160,7 +1160,7 @@ impl State<ServerConnectionData> for ExpectCertificateVerify { self.config .verifier - .verify_tls13_signature(&msg, &certs[0], sig) + .verify_tls13_signature(msg.as_ref(), &certs[0], sig) }; if let Err(e) = rc { diff --git a/rustls/src/tls13/mod.rs b/rustls/src/tls13/mod.rs index 25834c63..ab55c889 100644 --- a/rustls/src/tls13/mod.rs +++ b/rustls/src/tls13/mod.rs @@ -1,4 +1,3 @@ -use alloc::vec::Vec; use core::fmt; use crate::crypto; @@ -87,22 +86,40 @@ impl fmt::Debug for Tls13CipherSuite { } /// Constructs the signature message specified in section 4.4.3 of RFC8446. -pub(crate) fn construct_client_verify_message(handshake_hash: &hash::Output) -> Vec<u8> { - construct_verify_message(handshake_hash, b"TLS 1.3, client CertificateVerify\x00") +pub(crate) fn construct_client_verify_message(handshake_hash: &hash::Output) -> VerifyMessage { + VerifyMessage::new(handshake_hash, CLIENT_CONSTANT) } /// Constructs the signature message specified in section 4.4.3 of RFC8446. -pub(crate) fn construct_server_verify_message(handshake_hash: &hash::Output) -> Vec<u8> { - construct_verify_message(handshake_hash, b"TLS 1.3, server CertificateVerify\x00") +pub(crate) fn construct_server_verify_message(handshake_hash: &hash::Output) -> VerifyMessage { + VerifyMessage::new(handshake_hash, SERVER_CONSTANT) } -fn construct_verify_message( - handshake_hash: &hash::Output, - context_string_with_0: &[u8], -) -> Vec<u8> { - let mut msg = Vec::new(); - msg.resize(64, 0x20u8); - msg.extend_from_slice(context_string_with_0); - msg.extend_from_slice(handshake_hash.as_ref()); - msg +pub(crate) struct VerifyMessage { + buf: [u8; MAX_VERIFY_MSG], + used: usize, } + +impl VerifyMessage { + fn new(handshake_hash: &hash::Output, context_string_with_0: &[u8; 34]) -> Self { + let used = 64 + context_string_with_0.len() + handshake_hash.as_ref().len(); + let mut buf = [0x20u8; MAX_VERIFY_MSG]; + + let (_spaces, context) = buf.split_at_mut(64); + let (context, hash) = context.split_at_mut(34); + context.copy_from_slice(context_string_with_0); + hash[..handshake_hash.as_ref().len()].copy_from_slice(handshake_hash.as_ref()); + + Self { buf, used } + } +} + +impl AsRef<[u8]> for VerifyMessage { + fn as_ref(&self) -> &[u8] { + &self.buf[..self.used] + } +} + +const SERVER_CONSTANT: &[u8; 34] = b"TLS 1.3, server CertificateVerify\x00"; +const CLIENT_CONSTANT: &[u8; 34] = b"TLS 1.3, client CertificateVerify\x00"; +const MAX_VERIFY_MSG: usize = 64 + CLIENT_CONSTANT.len() + hash::Output::MAX_LEN; |