tls_ticket.h
Go to the documentation of this file.
1 /**
2  * @file tls_ticket.h
3  * @brief TLS session tickets
4  *
5  * @section License
6  *
7  * SPDX-License-Identifier: GPL-2.0-or-later
8  *
9  * Copyright (C) 2010-2024 Oryx Embedded SARL. All rights reserved.
10  *
11  * This file is part of CycloneSSL Open.
12  *
13  * This program is free software; you can redistribute it and/or
14  * modify it under the terms of the GNU General Public License
15  * as published by the Free Software Foundation; either version 2
16  * of the License, or (at your option) any later version.
17  *
18  * This program is distributed in the hope that it will be useful,
19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21  * GNU General Public License for more details.
22  *
23  * You should have received a copy of the GNU General Public License
24  * along with this program; if not, write to the Free Software Foundation,
25  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
26  *
27  * @author Oryx Embedded SARL (www.oryx-embedded.com)
28  * @version 2.4.0
29  **/
30 
31 #ifndef _TLS_TICKET_H
32 #define _TLS_TICKET_H
33 
34 //Dependencies
35 #include "tls.h"
36 #include "cipher/aes.h"
37 #include "aead/gcm.h"
38 
39 //Size of ticket key names
40 #ifndef TLS_TICKET_KEY_NAME_SIZE
41  #define TLS_TICKET_KEY_NAME_SIZE 16
42 #elif (TLS_TICKET_KEY_NAME_SIZE < 1)
43  #error TLS_TICKET_KEY_NAME_SIZE parameter is not valid
44 #endif
45 
46 //Size of ticket keys
47 #ifndef TLS_TICKET_KEY_SIZE
48  #define TLS_TICKET_KEY_SIZE 32
49 #elif (TLS_TICKET_KEY_SIZE < 1)
50  #error TLS_TICKET_KEY_SIZE parameter is not valid
51 #endif
52 
53 //Size of ticket IVs
54 #ifndef TLS_TICKET_IV_SIZE
55  #define TLS_TICKET_IV_SIZE 12
56 #elif (TLS_TICKET_IV_SIZE < 1)
57  #error TLS_TICKET_IV_SIZE parameter is not valid
58 #endif
59 
60 //Size of ticket authentication tags
61 #ifndef TLS_TICKET_TAG_SIZE
62  #define TLS_TICKET_TAG_SIZE 16
63 #elif (TLS_TICKET_TAG_SIZE < 1)
64  #error TLS_TICKET_TAG_SIZE parameter is not valid
65 #endif
66 
67 //C++ guard
68 #ifdef __cplusplus
69 extern "C" {
70 #endif
71 
72 
73 /**
74  * @brief Session ticket encryption state
75  **/
76 
77 typedef struct
78 {
79  bool_t valid; ///<Valid set of keys
80  systime_t timestamp; ///<Generation time
81  uint8_t keyName[TLS_TICKET_KEY_NAME_SIZE]; ///<Key identifier
82  uint8_t key[TLS_TICKET_KEY_SIZE]; ///<Encryption key
84 
85 
86 /**
87  * @brief Session ticket encryption context
88  **/
89 
90 typedef struct
91 {
92  OsMutex mutex; ///<Mutex preventing simultaneous access to the context
93  TlsTicketEncryptionState encryptionState; ///<Current set of keys
95  AesContext aesContext; ///<AES context
96  GcmContext gcmContext; ///<GCM context
98 
99 
100 //TLS related functions
102 
103 error_t tlsEncryptTicket(TlsContext *context, const uint8_t *plaintext,
104  size_t plaintextLen, uint8_t *ciphertext, size_t *ciphertextLen, void *param);
105 
106 error_t tlsDecryptTicket(TlsContext *context, const uint8_t *ciphertext,
107  size_t ciphertextLen, uint8_t *plaintext, size_t *plaintextLen, void *param);
108 
110  const PrngAlgo *prngAlgo, void *prngContext);
111 
113 
114 bool_t tlsCompareTicketKeyName(const uint8_t *ticket, size_t ticketLen,
115  const TlsTicketEncryptionState *state);
116 
117 void tlsFreeTicketContext(TlsTicketContext *ticketContext);
118 
119 //C++ guard
120 #ifdef __cplusplus
121 }
122 #endif
123 
124 #endif
AES (Advanced Encryption Standard)
int bool_t
Definition: compiler_port.h:53
#define PrngAlgo
Definition: crypto.h:917
error_t
Error codes.
Definition: error.h:43
Galois/Counter Mode (GCM)
uint32_t systime_t
System time.
AES algorithm context.
Definition: aes.h:58
GCM context.
Definition: gcm.h:64
Mutex object.
Session ticket encryption context.
Definition: tls_ticket.h:91
AesContext aesContext
AES context.
Definition: tls_ticket.h:95
TlsTicketEncryptionState prevEncryptionState
Previous set of keys.
Definition: tls_ticket.h:94
GcmContext gcmContext
GCM context.
Definition: tls_ticket.h:96
TlsTicketEncryptionState encryptionState
Current set of keys.
Definition: tls_ticket.h:93
OsMutex mutex
Mutex preventing simultaneous access to the context.
Definition: tls_ticket.h:92
Session ticket encryption state.
Definition: tls_ticket.h:78
systime_t timestamp
Generation time.
Definition: tls_ticket.h:80
bool_t valid
Valid set of keys.
Definition: tls_ticket.h:79
TLS (Transport Layer Security)
uint8_t ticket[]
Definition: tls.h:1827
uint16_t ticketLen
Definition: tls.h:1826
#define TlsContext
Definition: tls.h:36
#define TLS_TICKET_KEY_NAME_SIZE
Definition: tls_ticket.h:41
#define TLS_TICKET_KEY_SIZE
Definition: tls_ticket.h:48
error_t tlsInitTicketContext(TlsTicketContext *ticketContext)
Initialize ticket encryption context.
Definition: tls_ticket.c:49
error_t tlsEncryptTicket(TlsContext *context, const uint8_t *plaintext, size_t plaintextLen, uint8_t *ciphertext, size_t *ciphertextLen, void *param)
Session ticket encryption.
Definition: tls_ticket.c:81
void tlsCheckTicketKeyLifetime(TlsTicketEncryptionState *state)
Check the validity of a given set of keys.
Definition: tls_ticket.c:387
error_t tlsDecryptTicket(TlsContext *context, const uint8_t *ciphertext, size_t ciphertextLen, uint8_t *plaintext, size_t *plaintextLen, void *param)
Session ticket decryption.
Definition: tls_ticket.c:221
void tlsFreeTicketContext(TlsTicketContext *ticketContext)
Properly dispose ticket encryption context.
Definition: tls_ticket.c:448
bool_t tlsCompareTicketKeyName(const uint8_t *ticket, size_t ticketLen, const TlsTicketEncryptionState *state)
Key name comparison.
Definition: tls_ticket.c:414
error_t tlsGenerateTicketKeys(TlsTicketContext *ticketContext, const PrngAlgo *prngAlgo, void *prngContext)
Generate a new set of keys.
Definition: tls_ticket.c:346