crypto.h

Go to the documentation of this file.

 
#ifndef IMQUIC_CRYPTO_H
#define IMQUIC_CRYPTO_H
 
#include <stdint.h>
 
#include <glib.h>
 
#include <openssl/ssl.h>
#include <openssl/crypto.h>
#include <openssl/evp.h>
#ifdef IMQUIC_BORINGSSL
#include <openssl/hkdf.h>
#else
#include <openssl/kdf.h>
#endif
#include <openssl/err.h>

const char *imquic_encryption_level_str(enum ssl_encryption_level_t level);
const char *imquic_encryption_key_type_str(enum ssl_encryption_level_t level, gboolean server);

int imquic_tls_init(const char *secrets_log);
void imquic_tls_deinit(void);

typedef struct imquic_tls {
        gboolean is_server;
        SSL_CTX *ssl_ctx;
        char *key_pwd;
        gboolean early_data;
        char *ticket_file;
} imquic_tls;

imquic_tls *imquic_tls_create(gboolean is_server, const char *server_pem, const char *server_key, const char *password, gboolean verify);
int imquic_tls_enable_early_data(imquic_tls *tls, const char *ticket_file);
SSL *imquic_tls_new_ssl(imquic_tls *tls);
void imquic_tls_destroy(imquic_tls *tls);

typedef struct imquic_encryption {
        const EVP_MD *md;
        uint8_t secret[2][48];
        size_t secret_len;
        uint8_t key[2][32];
        size_t key_len;
        uint8_t iv[2][12];
        size_t iv_len;
        uint8_t hp[32];
        size_t hp_len;
} imquic_encryption;

typedef struct imquic_protection {
        imquic_encryption local;
        imquic_encryption remote;
} imquic_protection;


int imquic_build_hkdf_label(const char *label, uint8_t *hkdf_label, size_t buflen, size_t outlen);
int imquic_hkdf_extract(const EVP_MD *digest, uint8_t *key, size_t keylen, uint8_t *out, size_t *outlen);
int imquic_hkdf_expand_label(const EVP_MD *digest, uint8_t *key, size_t keylen, const char *label, uint8_t *out, size_t outlen);
int imquic_derive_initial_secret(imquic_protection *p, uint8_t *dcid, size_t dcid_len, gboolean is_server);
int imquic_expand_secret(const char *name, imquic_encryption *e, gboolean expand_hp, gboolean phase);

int imquic_update_keys(imquic_protection *p, gboolean phase);


int imquic_unprotect_header(uint8_t *bytes, size_t blen, size_t pn_offset, uint8_t *hp, size_t hp_len);
int imquic_protect_header(uint8_t *bytes, size_t blen, size_t pn_offset, uint8_t *hp, size_t hp_len);


int imquic_decrypt_payload(uint8_t *bytes, size_t blen, uint8_t *to, size_t tlen, uint8_t *header, size_t hlen, uint64_t pn, uint8_t *key, size_t key_len, uint8_t *iv, size_t iv_len);
int imquic_encrypt_payload(uint8_t *bytes, size_t blen, uint8_t *to, size_t tlen, uint8_t *header, size_t hlen, uint64_t pn, uint8_t *key, size_t key_len, uint8_t *iv, size_t iv_len);

int imquic_verify_retry(uint8_t *bytes, size_t blen, uint8_t *dcid, size_t dcid_len);
 
#endif