1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
|
/***************************************************************************
* Copyright (c) 2024 Microsoft Corporation
* Copyright (c) 2025-present Eclipse ThreadX Contributors
*
* This program and the accompanying materials are made available under the
* terms of the MIT License which is available at
* https://opensource.org/licenses/MIT.
*
* SPDX-License-Identifier: MIT
**************************************************************************/
/**************************************************************************/
/**************************************************************************/
/** */
/** NetX Secure Component */
/** */
/** Transport Layer Security (TLS) */
/** */
/**************************************************************************/
/**************************************************************************/
#define NX_SECURE_SOURCE_CODE
#include "nx_secure_tls.h"
#if (NX_SECURE_TLS_TLS_1_3_ENABLED)
extern NX_SECURE_TLS_ECC _nx_secure_tls_ecc_info;
#endif
/**************************************************************************/
/* */
/* FUNCTION RELEASE */
/* */
/* _nx_secure_tls_1_3_crypto_init PORTABLE C */
/* 6.4.3 */
/* AUTHOR */
/* */
/* Timothy Stapko, Microsoft Corporation */
/* */
/* DESCRIPTION */
/* */
/* TLS 1.3 introduces the concept of a partially-encrypted handshake, */
/* utilizing cryptographic primitives sent in the initial ClientHello */
/* message. In order to properly handle these primitives, certain */
/* initialization must be done prior to sending the ClientHello */
/* message. For example, if ECDHE is an option supported by the client,*/
/* the ECC public key must be generated before the ClientHello is */
/* generated and sent. All pre-handshake initialization of that nature */
/* for TLS 1.3 should be done here. */
/* */
/* INPUT */
/* */
/* tls_session TLS control block */
/* */
/* OUTPUT */
/* */
/* status Completion status */
/* */
/* CALLS */
/* */
/* */
/* CALLED BY */
/* */
/* */
/* */
/**************************************************************************/
#if (NX_SECURE_TLS_TLS_1_3_ENABLED)
UINT _nx_secure_tls_1_3_crypto_init(NX_SECURE_TLS_SESSION *tls_session)
{
UINT status = NX_NOT_SUCCESSFUL;
NX_SECURE_TLS_ECDHE_HANDSHAKE_DATA *ecdhe_data;
UINT length;
UINT i;
NX_SECURE_TLS_ECC *ecc_info;
if (tls_session == NX_NULL)
{
return(NX_PTR_ERROR);
}
/* Get ECC information from our TLS session. It should have been initialized
by the application already. */
ecc_info = &(tls_session -> nx_secure_tls_ecc);
/* Loop through all supported ECC curves in this session. */
for (i = 0; i < ecc_info -> nx_secure_tls_ecc_supported_groups_count; i++)
{
/* Get the method for this curve. */
//curve_method = ((NX_CRYPTO_METHOD **)ecc_info -> nx_secure_tls_ecc_curves)[i];
/* Get the ECDHE structure for our key output. */
ecdhe_data = &tls_session -> nx_secure_tls_key_material.nx_secure_tls_ecc_key_data[i];
/* Save off the curve ID so we can select the server's chosen key/curve later. */
ecdhe_data -> nx_secure_tls_ecdhe_named_curve = ecc_info -> nx_secure_tls_ecc_supported_groups[i];
/* Output the public key to our handshake data structure - we need the length of that buffer. */
length = sizeof(ecdhe_data -> nx_secure_tls_ecdhe_public_key);
/* Generate ECC keys and store in our TLS session. */
status = _nx_secure_tls_ecc_generate_keys(tls_session -> nx_secure_tls_session_ciphersuite, tls_session -> nx_secure_tls_protocol_version,
tls_session -> nx_secure_tls_1_3, tls_session -> nx_secure_tls_crypto_table,
&tls_session -> nx_secure_tls_handshake_hash, ecc_info, &tls_session -> nx_secure_tls_key_material,
&tls_session -> nx_secure_tls_credentials, ecdhe_data -> nx_secure_tls_ecdhe_named_curve, NX_FALSE,
ecdhe_data -> nx_secure_tls_ecdhe_public_key, &length, ecdhe_data,
tls_session -> nx_secure_public_cipher_metadata_area,
tls_session -> nx_secure_public_cipher_metadata_size,
tls_session -> nx_secure_public_auth_metadata_area,
tls_session -> nx_secure_public_auth_metadata_size);
/* Set the actual length of the generated key. */
ecdhe_data -> nx_secure_tls_ecdhe_public_key_length = (USHORT)length;
if (status != NX_SUCCESS)
{
return(status);
}
}
return(status);
}
#endif
|
