Skip to content

Commit d2e43c5

Browse files
Tobias WaurickTobTheRock
Tobias Waurick
authored and
TobTheRock
committed
refactor: KeyExpansion trait
Now is implemented by cipher suite. this makes it easier to extract another secret for auth tag shortening
1 parent 0af96e6 commit d2e43c5

File tree

7 files changed

+47
-49
lines changed

7 files changed

+47
-49
lines changed

‎src/crypto/aead.rs

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,8 @@ mod test {
3939
crypto::{
4040
aead::AeadEncrypt,
4141
cipher_suite::{CipherSuite, CipherSuiteVariant},
42-
key_expansion::{ExpandAsSecret, KeyMaterial},
42+
key_expansion::KeyExpansion,
43+
secret::Secret,
4344
},
4445
header::{Header, HeaderFields},
4546
};
@@ -52,9 +53,7 @@ mod test {
5253
thread_rng().fill(data.as_mut_slice());
5354
let header = Header::default();
5455
let cipher_suite = CipherSuite::from(CipherSuiteVariant::AesGcm256Sha512);
55-
let secret = KeyMaterial(KEY_MATERIAL.as_bytes())
56-
.expand_as_secret(&cipher_suite)
57-
.unwrap();
56+
let secret = Secret::expand_from(&cipher_suite, KEY_MATERIAL.as_bytes()).unwrap();
5857

5958
let _tag = cipher_suite
6059
.encrypt(

‎src/crypto/key_expansion.rs

Lines changed: 11 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,10 @@
44
use super::{cipher_suite::CipherSuite, secret::Secret};
55
use crate::error::Result;
66

7-
#[derive(Debug, Default, Clone, Copy)]
8-
pub struct KeyMaterial<'a>(pub &'a [u8]);
9-
10-
pub trait ExpandAsSecret {
11-
fn expand_as_secret(&self, cipher_suite: &CipherSuite) -> Result<Secret>;
7+
pub trait KeyExpansion {
8+
fn expand_from<T>(cipher_suite: &CipherSuite, key_material: T) -> Result<Secret>
9+
where
10+
T: AsRef<[u8]>;
1211
}
1312

1413
pub const SFRAME_HKDF_SALT: &[u8] = "SFrame10".as_bytes();
@@ -17,23 +16,19 @@ pub const SFRAME_HDKF_SALT_EXPAND_INFO: &[u8] = "salt".as_bytes();
1716

1817
#[cfg(test)]
1918
mod test {
19+
use crate::crypto::cipher_suite::CipherSuite;
20+
use crate::crypto::secret::Secret;
2021
use crate::test_vectors::get_test_vector;
2122

22-
use crate::{
23-
crypto::{
24-
cipher_suite::{CipherSuite, CipherSuiteVariant},
25-
key_expansion::KeyMaterial,
26-
},
27-
util::test::assert_bytes_eq,
28-
};
23+
use crate::{crypto::cipher_suite::CipherSuiteVariant, util::test::assert_bytes_eq};
2924

30-
use super::ExpandAsSecret;
25+
use super::KeyExpansion;
3126

3227
fn derive_correct_keys(variant: CipherSuiteVariant) {
3328
let test_vector = get_test_vector(&variant.to_string());
34-
let secret = KeyMaterial(&test_vector.key_material)
35-
.expand_as_secret(&CipherSuite::from(variant))
36-
.unwrap();
29+
let secret =
30+
Secret::expand_from(&CipherSuite::from(variant), &test_vector.key_material).unwrap();
31+
3732
assert_bytes_eq(&secret.key, &test_vector.key);
3833
assert_bytes_eq(&secret.salt, &test_vector.salt);
3934
}

‎src/crypto/openssl/key_expansion.rs

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,26 +5,29 @@ use crate::{
55
crypto::{
66
cipher_suite::{CipherSuite, CipherSuiteVariant},
77
key_expansion::{
8-
ExpandAsSecret, KeyMaterial, SFRAME_HDKF_SALT_EXPAND_INFO, SFRAME_HKDF_KEY_EXPAND_INFO,
8+
KeyExpansion, SFRAME_HDKF_SALT_EXPAND_INFO, SFRAME_HKDF_KEY_EXPAND_INFO,
99
SFRAME_HKDF_SALT,
1010
},
1111
secret::Secret,
1212
},
1313
error::{Result, SframeError},
1414
};
1515

16-
impl ExpandAsSecret for KeyMaterial<'_> {
17-
fn expand_as_secret(&self, cipher_suite: &CipherSuite) -> Result<Secret> {
16+
impl KeyExpansion for Secret {
17+
fn expand_from<T>(cipher_suite: &CipherSuite, key_material: T) -> Result<Secret>
18+
where
19+
T: AsRef<[u8]>,
20+
{
1821
let try_expand = || {
19-
let prk = extract_prk(cipher_suite, self.0)?;
22+
let prk = extract_prk(&cipher_suite, key_material.as_ref())?;
2023
let key = expand_key(
21-
cipher_suite,
24+
&cipher_suite,
2225
&prk,
2326
SFRAME_HKDF_KEY_EXPAND_INFO,
2427
cipher_suite.key_len,
2528
)?;
2629
let salt = expand_key(
27-
cipher_suite,
30+
&cipher_suite,
2831
&prk,
2932
SFRAME_HDKF_SALT_EXPAND_INFO,
3033
cipher_suite.nonce_len,

‎src/crypto/ring/key_expansion.rs

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,21 @@ use crate::{
55
crypto::{
66
cipher_suite::{CipherSuite, CipherSuiteVariant},
77
key_expansion::{
8-
ExpandAsSecret, KeyMaterial, SFRAME_HDKF_SALT_EXPAND_INFO, SFRAME_HKDF_KEY_EXPAND_INFO,
8+
KeyExpansion, SFRAME_HDKF_SALT_EXPAND_INFO, SFRAME_HKDF_KEY_EXPAND_INFO,
99
SFRAME_HKDF_SALT,
1010
},
1111
secret::Secret,
1212
},
1313
error::{Result, SframeError},
1414
};
1515

16-
impl ExpandAsSecret for KeyMaterial<'_> {
17-
fn expand_as_secret(&self, cipher_suite: &CipherSuite) -> Result<Secret> {
18-
let algorithm = cipher_suite.into();
19-
let prk = ring::hkdf::Salt::new(algorithm, SFRAME_HKDF_SALT).extract(self.0);
16+
impl KeyExpansion for Secret {
17+
fn expand_from<T>(cipher_suite: &CipherSuite, key_material: T) -> Result<Secret>
18+
where
19+
T: AsRef<[u8]>,
20+
{
21+
let algorithm = cipher_suite.variant.into();
22+
let prk = ring::hkdf::Salt::new(algorithm, SFRAME_HKDF_SALT).extract(key_material.as_ref());
2023

2124
let key = expand_key(&prk, SFRAME_HKDF_KEY_EXPAND_INFO, cipher_suite.key_len)?;
2225
let salt = expand_key(&prk, SFRAME_HDKF_SALT_EXPAND_INFO, cipher_suite.nonce_len)?;
@@ -33,9 +36,9 @@ impl ring::hkdf::KeyType for OkmKeyLength {
3336
}
3437
}
3538

36-
impl From<&CipherSuite> for ring::hkdf::Algorithm {
37-
fn from(cipher_suite: &CipherSuite) -> Self {
38-
match cipher_suite.variant {
39+
impl From<CipherSuiteVariant> for ring::hkdf::Algorithm {
40+
fn from(variant: CipherSuiteVariant) -> Self {
41+
match variant {
3942
CipherSuiteVariant::AesGcm128Sha256 => ring::hkdf::HKDF_SHA256,
4043
CipherSuiteVariant::AesGcm256Sha512 => ring::hkdf::HKDF_SHA512,
4144
}

‎src/crypto/secret.rs

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -27,25 +27,24 @@ impl Secret {
2727

2828
#[cfg(test)]
2929
mod test {
30-
use crate::crypto::key_expansion::ExpandAsSecret;
30+
use crate::crypto::cipher_suite::CipherSuite;
31+
use crate::crypto::key_expansion::KeyExpansion;
3132
use crate::test_vectors::get_test_vector;
3233

3334
use crate::{
34-
crypto::{cipher_suite::CipherSuiteVariant, key_expansion::KeyMaterial},
35-
header::FrameCount,
36-
util::test::assert_bytes_eq,
35+
crypto::cipher_suite::CipherSuiteVariant, header::FrameCount, util::test::assert_bytes_eq,
3736
};
3837

38+
use super::Secret;
39+
3940
const NONCE_LEN: usize = 12;
4041

41-
fn test_nonce(cipher_suite_variant: CipherSuiteVariant) {
42-
let tv = get_test_vector(&cipher_suite_variant.to_string());
43-
let cipher_suite = cipher_suite_variant.into();
42+
fn test_nonce(variant: CipherSuiteVariant) {
43+
let tv = get_test_vector(&variant.to_string());
4444

4545
for enc in &tv.encryptions {
46-
let secret = KeyMaterial(&tv.key_material)
47-
.expand_as_secret(&cipher_suite)
48-
.unwrap();
46+
let secret =
47+
Secret::expand_from(&CipherSuite::from(variant), &tv.key_material).unwrap();
4948
let nonce: [u8; NONCE_LEN] = secret.create_nonce(&FrameCount::from(enc.frame_count));
5049
assert_bytes_eq(&nonce, &enc.nonce);
5150
}

‎src/receiver.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ use crate::{
77
crypto::{
88
aead::AeadDecrypt,
99
cipher_suite::{CipherSuite, CipherSuiteVariant},
10-
key_expansion::{ExpandAsSecret, KeyMaterial},
10+
key_expansion::KeyExpansion,
1111
secret::Secret,
1212
},
1313
error::{Result, SframeError},
@@ -109,7 +109,7 @@ impl Receiver {
109109
{
110110
self.secrets.insert(
111111
key_id.into(),
112-
KeyMaterial(key_material.as_ref()).expand_as_secret(&self.options.cipher_suite)?,
112+
Secret::expand_from(&self.options.cipher_suite, key_material)?,
113113
);
114114
Ok(())
115115
}

‎src/sender.rs

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ use crate::{
55
crypto::{
66
aead::AeadEncrypt,
77
cipher_suite::{CipherSuite, CipherSuiteVariant},
8-
key_expansion::{ExpandAsSecret, KeyMaterial},
8+
key_expansion::KeyExpansion,
99
secret::Secret,
1010
},
1111
error::{Result, SframeError},
@@ -108,8 +108,7 @@ impl Sender {
108108
where
109109
KeyMaterial: AsRef<[u8]> + ?Sized,
110110
{
111-
self.secret =
112-
Some(KeyMaterial(key_material.as_ref()).expand_as_secret(&self.cipher_suite)?);
111+
self.secret = Some(Secret::expand_from(&self.cipher_suite, key_material)?);
113112
Ok(())
114113
}
115114
}

0 commit comments

Comments
 (0)