TLS1.3に関するまとめ

enum {
    invalid(0),
    change_cipher_spec(20),
    alert(21),
    handshake(22),
    application_data(23),
    heartbeat(24),  /* RFC 6520：2014年Heartbleed脆弱性の原因 */
    (255)
} ContentType;

// ハンドシェイク開始時点
struct {
    ContentType type;
    ProtocolVersion legacy_record_version;
    uint16 length;
    opaque fragment[TLSPlaintext.length];
} TLSPlaintext;

// パラメータのネゴシエーション完了後
struct {
    ContentType opaque_type = application_data; /* 23 */
    ProtocolVersion legacy_record_version = 0x0303; /* TLS v1.2 */
    uint16 length;
    opaque encrypted_record[TLSCiphertext.length];
} TLSCiphertext;

// 暗号化されるペイロード：いずれかのサブプロトコルのデータ
struct {
    opaque content[TLSPlaintext.length];
    ContentType type;
    uint8 zeros[length_of_padding];
} TLSInnerPlaintext;

AEADEncrypted = AEAD-Encrypt(write_key, nonce, plaintext, additional_data)

additional_data = TLSCiphertext.opaque_type ||
                  TLSCiphertext.legacy_record_version ||
                  TLSCiphertext.length

plaintext of encrypted_record =
    AEAD-Decrypt(peer_write_key, nonce,
                 additional_data, AEADEncrypted)

       Client                                           Server

鍵  ^ ClientHello
交 | + key_share*
換 | + signature_algorithms*
     | + psk_key_exchange_modes*
     v + pre_shared_key*       -------->
                                                  ServerHello  ^ 鍵
                                                 + key_share*  | 交
                                            + pre_shared_key*  v 換
                                        {EncryptedExtensions}  ^  サーバ
                                        {CertificateRequest*}  v  パラメータ
                                               {Certificate*}  ^
                                         {CertificateVerify*}  | 認証
                                                   {Finished}  v
                               <--------  [Application Data*]
     ^ {Certificate*}
認証 | {CertificateVerify*}
     v {Finished}              -------->
       [Application Data]      <------->  [Application Data]

          Client                                               Server

   初回:
          ClientHello
          + key_share               -------->
                                                          ServerHello
                                                          + key_share
                                                {EncryptedExtensions}
                                                {CertificateRequest*}
                                                       {Certificate*}
                                                 {CertificateVerify*}
                                                           {Finished}
                                    <--------     [Application Data*]
          {Certificate*}
          {CertificateVerify*}
          {Finished}                -------->
                                    <--------      [NewSessionTicket]
          [Application Data]        <------->      [Application Data]


   2回目以降:
          ClientHello
          + key_share*
          + pre_shared_key          -------->
                                                          ServerHello
                                                     + pre_shared_key
                                                         + key_share*
                                                {EncryptedExtensions}
                                                           {Finished}
                                    <--------     [Application Data*]
          {Finished}                -------->
          [Application Data]        <------->      [Application Data]

         Client                                               Server

         ClientHello
         + early_data
         + key_share*
         + psk_key_exchange_modes
         + pre_shared_key
         (Application Data*)     -------->
                                                         ServerHello
                                                    + pre_shared_key
                                                        + key_share*
                                               {EncryptedExtensions}
                                                       + early_data*
                                                          {Finished}
                                 <--------       [Application Data*]
         (EndOfEarlyData)
         {Finished}              -------->
         [Application Data]      <------->        [Application Data]

      struct {
          KeyShareEntry client_shares<0..2^16-1>;
      } KeyShareClientHello;

      struct {
          NamedGroup group;
          opaque key_exchange<1..2^16-1>;
      } KeyShareEntry;

      enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode;

      struct {
          PskKeyExchangeMode ke_modes<1..255>;
      } PskKeyExchangeModes;

   psk_ke:  PSK-only key establishment.  In this mode, the server
      MUST NOT supply a "key_share" value.

   psk_dhe_ke:  PSK with (EC)DHE key establishment. 

      struct {
          opaque identity<1..2^16-1>;
          uint32 obfuscated_ticket_age;
      } PskIdentity;

      opaque PskBinderEntry<32..255>;

      struct {
          PskIdentity identities<7..2^16-1>;
          PskBinderEntry binders<33..2^16-1>;
      } OfferedPsks;

      struct {
          select (Handshake.msg_type) {
              case client_hello: OfferedPsks;
              case server_hello: uint16 selected_identity;
          };
      } PreSharedKeyExtension;

      uint16 ProtocolVersion;
      opaque Random[32];

      uint8 CipherSuite[2];    /* Cryptographic suite selector */

      struct {
          ProtocolVersion legacy_version = 0x0303;    /* TLS v1.2 */
          Random random;
          opaque legacy_session_id<0..32>;
          CipherSuite cipher_suites<2..2^16-2>;
          opaque legacy_compression_methods<1..2^8-1>;
          Extension extensions<8..2^16-1>;
      } ClientHello;

      struct {
          ProtocolVersion legacy_version = 0x0303;    /* TLS v1.2 */
          Random random;
          opaque legacy_session_id_echo<0..32>;
          CipherSuite cipher_suite;
          uint8 legacy_compression_method = 0;
          Extension extensions<6..2^16-1>;
      } ServerHello;

     // HelloRetryRequestのSHA-256ハッシュ値
     CF 21 AD 74 E5 9A 61 11 BE 1D 8C 02 1E 65 B8 91
     C2 A2 11 16 7A BB 8C 5E 07 9E 09 E2 C8 A8 33 9C

    struct {
        ExtensionType extension_type;
        opaque extension_data<0..2^16-1>;
    } Extension;

    enum {
        server_name(0),                             /* RFC 6066 CH, EE */
        max_fragment_length(1),                     /* RFC 6066  CH, EE  */
        status_request(5),                          /* RFC 6066 CH, CR, CT */
        supported_groups(10),                       /* RFC 8422, 7919 CH, EE */
        signature_algorithms(13),                   /* RFC 8446 CH, CR */
        use_srtp(14),                               /* RFC 5764 CH, EE */
        heartbeat(15),                              /* RFC 6520 CH, EE */
        application_layer_protocol_negotiation(16), /* RFC 7301 CH, EE */
        signed_certificate_timestamp(18),           /* RFC 6962 CH, CR, CT */
        client_certificate_type(19),                /* RFC 7250 CH, EE */
        server_certificate_type(20),                /* RFC 7250 CH, EE */
        padding(21),                                /* RFC 7685 CH */
        pre_shared_key(41),                         /* RFC 8446 CH, SH */
        early_data(42),                             /* RFC 8446 */
        supported_versions(43),                     /* RFC 8446 CH, SH, HRR*/
        cookie(44),                                 /* RFC 8446 HRR */
        psk_key_exchange_modes(45),                 /* RFC 8446 CH */
        certificate_authorities(47),                /* RFC 8446 CR */
        oid_filters(48),                            /* RFC 8446 CR */
        post_handshake_auth(49),                    /* RFC 8446 CH */
        signature_algorithms_cert(50),              /* RFC 8446 CH, CR */
        key_share(51),                              /* RFC 8446 CH, SH, HRR  */
        (65535)
    } ExtensionType;

      uint16 ProtocolVersion;
      struct {
          select (Handshake.msg_type) {
              case client_hello:
                   ProtocolVersion versions<2..254>;

              case server_hello: /* and HelloRetryRequest */
                   ProtocolVersion selected_version;
          };
      } SupportedVersions;

      enum {
          X509(0),
          RawPublicKey(2),
          (255)
      } CertificateType;

      struct {
          select (certificate_type) {
              case RawPublicKey:
                /* From RFC 7250 ASN.1_subjectPublicKeyInfo */
                opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;

              case X509:
                opaque cert_data<1..2^24-1>;
          };
          Extension extensions<0..2^16-1>;
      } CertificateEntry;

      struct {
          opaque certificate_request_context<0..2^8-1>;
          CertificateEntry certificate_list<0..2^24-1>;
      } Certificate;

// TLS1.3
      struct {
          SignatureScheme algorithm;
          opaque signature<0..2^16-1>;
      } CertificateVerify;

// TLS1.2
      struct {
           digitally-signed struct {
               opaque handshake_messages[handshake_messages_length];
           }
      } CertificateVerify;

// TLS1.3のCertificateRequest
      struct {
          opaque certificate_request_context<0..2^8-1>; // クライアントのCertificateメッセージにエコーされリプレイ攻撃を防止
          Extension extensions<2..2^16-1>;
      } CertificateRequest;

// TLS1.2のCertificateRequest
      struct {
          ClientCertificateType certificate_types<1..2^8-1>;
          SignatureAndHashAlgorithm
            supported_signature_algorithms<2^16-1>; // TLS1.3ではsignature_algorithmsまたはsignature_algorithms_cert拡張を利用
          DistinguishedName certificate_authorities<0..2^16-1>; // TLS1.3では同名の拡張を利用
      } CertificateRequest;
      enum {
          rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
          rsa_ephemeral_dh_RESERVED(5), dss_ephemeral_dh_RESERVED(6),
          fortezza_dms_RESERVED(20), (255)
      } ClientCertificateType;

struct {
    opaque verify_data[Hash.length];
} Finished;

verify_data =
    HMAC(finished_key,
         Transcript-Hash(Handshake Context,
                       Certificate*, CertificateVerify*))
*は任意

finished_key =
   HKDF-Expand-Label(BaseKey, "finished", "", Hash.length)
// キーについては鍵スケジュールの節で後述

enum { 
  psk_ke(0), // PFSなし
  psk_dhe_ke(1), // PFSあり。ECDHE鍵交換にも対応
  (255) } PskKeyExchangeMode;

struct {
    PskKeyExchangeMode ke_modes<1..255>;
} PskKeyExchangeModes;

      struct {
          opaque identity<1..2^16-1>; // クライアントの持つセッション情報またはサーバに保管されたセッションを特定するラベル(NewSessionTicket.ticket)
          uint32 obfuscated_ticket_age; // クライアントから見たCHの鮮度:リプライ攻撃防御
      } PskIdentity;

      opaque PskBinderEntry<32..255>;
      // 事前共有鍵の所有を示すHMACの値

      struct {
          PskIdentity identities<7..2^16-1>;// 事前共有鍵のID(複数可)
          PskBinderEntry binders<33..2^16-1>;
      } OfferedPsks;

      struct {
          select (Handshake.msg_type) {
              case client_hello: OfferedPsks;
              case server_hello: uint16 selected_identity;
          };
      } PreSharedKeyExtension;

struct {
    uint32 ticket_lifetime; // 寿命を秒数で表す、7日以内
    uint32 ticket_age_add; // obfuscated_tikcet_ageが平文で送信される際のフィンガープリンティング防止の値
    opaque ticket_nonce<0..255>;
    opaque ticket<1..2^16-1>;
    Extension extensions<0..2^16-2>;
} NewSessionTicket;

# 事前共有鍵の計算で利用
HKDF-Expand-Label(
        resumption_master_secret, // 鍵スケジュールで生成
        "resumption", ticket_nonce, Hash.length)

      struct {} Empty;

      struct {
          select (Handshake.msg_type) {
              // 0-RTTで転送可能なデータ量を指定
              case new_session_ticket:   uint32 max_early_data_size;
              case client_hello:         Empty;
              case encrypted_extensions: Empty;
          };
      } EarlyDataIndication;

      // 同一の入力から別用途の鍵を複数生成できる
       HKDF-Expand-Label(Secret, Label, Context, Length) =
            HKDF-Expand(Secret, HkdfLabel, Length)

       struct {
           uint16 length = Length;
           opaque label<7..255> = "tls13 " + Label;
           opaque context<0..255> = Context;
       } HkdfLabel;

       Derive-Secret(Secret, Label, Messages) =
            HKDF-Expand-Label(Secret, Label,
                              Transcript-Hash(Messages), Hash.length)

             0
             |
             v
   PSK ->  HKDF-Extract = Early Secret 
             | // まずEarly Secretを生成し、3つの鍵をexpansionする
             +-----> Derive-Secret(., "ext binder" | "res binder", "")
             |                     = binder_key
             |
             +-----> Derive-Secret(., "c e traffic", ClientHello)
             |                     = client_early_traffic_secret
             |
             +-----> Derive-Secret(., "e exp master", ClientHello)
             |                     = early_exporter_master_secret
             v // 状態の再利用を防ぐためにexpansionし、出力を次のブロックのソルトとする
       Derive-Secret(., "derived", "")
             |
             v

       Derive-Secret(., "derived", "") // 先頭ブロックの最後の処理
             |
             v
   (EC)DHE -> HKDF-Extract = Handshake Secret
             | // Handshake Secretを生成し、2つの鍵をexpansion
             +-----> Derive-Secret(., "c hs traffic",
             |                     ClientHello...ServerHello)
             |                     = client_handshake_traffic_secret
             |
             +-----> Derive-Secret(., "s hs traffic",
             |                     ClientHello...ServerHello)
             |                     = server_handshake_traffic_secret
             v // 先頭ブロック同様に再利用を防ぐexpansion
       Derive-Secret(., "derived", "")
             |
             v

      Derive-Secret(., "derived", "") // 2つめのブロックの最後の処理
             |
             v
   0 -> HKDF-Extract = Master Secret
             | // Master Secretを生成し、expansionする
             +-----> Derive-Secret(., "c ap traffic",
             |                     ClientHello...server Finished)
             |                     = client_application_traffic_secret_0
             |
             +-----> Derive-Secret(., "s ap traffic",
             |                     ClientHello...server Finished)
             |                     = server_application_traffic_secret_0
             |
             +-----> Derive-Secret(., "exp master",
             |                     ClientHello...server Finished)
             |                     = exporter_master_secret
             |
             +-----> Derive-Secret(., "res master",
                                   ClientHello...client Finished)
                                   = resumption_master_secret

       application_traffic_secret_N+1 =
           HKDF-Expand-Label(application_traffic_secret_N,
                             "traffic upd", "", Hash.length)

      enum {
          update_not_requested(0), update_requested(1), (255)
      } KeyUpdateRequest;

      struct {
          KeyUpdateRequest request_update;
      } KeyUpdate;

   finished_key =
       HKDF-Expand-Label(BaseKey, 
              "finished", "", Hash.length)

      struct {
          opaque verify_data[Hash.length];
      } Finished;

      verify_data =
          HMAC(finished_key,
               Transcript-Hash(Handshake Context,
                               Certificate*, CertificateVerify*))