diff options
Diffstat (limited to 'crypto/src/tls')
| -rw-r--r-- | crypto/src/tls/AbstractTlsContext.cs | 6 | ||||
| -rw-r--r-- | crypto/src/tls/crypto/TlsCrypto.cs | 4 | ||||
| -rw-r--r-- | crypto/src/tls/crypto/impl/AbstractTlsCrypto.cs | 4 | ||||
| -rw-r--r-- | crypto/src/tls/crypto/impl/bc/BcTlsCrypto.cs | 27 |
4 files changed, 40 insertions, 1 deletions
diff --git a/crypto/src/tls/AbstractTlsContext.cs b/crypto/src/tls/AbstractTlsContext.cs index 40a8e8f75..fa9bc80cd 100644 --- a/crypto/src/tls/AbstractTlsContext.cs +++ b/crypto/src/tls/AbstractTlsContext.cs @@ -20,9 +20,15 @@ namespace Org.BouncyCastle.Tls private static TlsNonceGenerator CreateNonceGenerator(TlsCrypto crypto, int connectionEnd) { +#if NETCOREAPP2_1_OR_GREATER || NETSTANDARD2_1_OR_GREATER + Span<byte> additionalSeedMaterial = stackalloc byte[16]; + Pack.UInt64_To_BE((ulong)NextCounterValue(), additionalSeedMaterial); + Pack.UInt64_To_BE((ulong)DateTime.UtcNow.Ticks, additionalSeedMaterial[8..]); +#else byte[] additionalSeedMaterial = new byte[16]; Pack.UInt64_To_BE((ulong)NextCounterValue(), additionalSeedMaterial, 0); Pack.UInt64_To_BE((ulong)DateTime.UtcNow.Ticks, additionalSeedMaterial, 8); +#endif additionalSeedMaterial[0] &= 0x7F; additionalSeedMaterial[0] |= (byte)(connectionEnd << 7); diff --git a/crypto/src/tls/crypto/TlsCrypto.cs b/crypto/src/tls/crypto/TlsCrypto.cs index d9c2c0da1..f515a752b 100644 --- a/crypto/src/tls/crypto/TlsCrypto.cs +++ b/crypto/src/tls/crypto/TlsCrypto.cs @@ -180,6 +180,10 @@ namespace Org.BouncyCastle.Tls.Crypto /// <returns>a <see cref="TlsNonceGenerator"/>.</returns> TlsNonceGenerator CreateNonceGenerator(byte[] additionalSeedMaterial); +#if NETCOREAPP2_1_OR_GREATER || NETSTANDARD2_1_OR_GREATER + TlsNonceGenerator CreateNonceGenerator(ReadOnlySpan<byte> additionalSeedMaterial); +#endif + /// <summary>Create an SRP-6 client.</summary> /// <param name="srpConfig">client config.</param> /// <returns>an initialised SRP6 client object.</returns> diff --git a/crypto/src/tls/crypto/impl/AbstractTlsCrypto.cs b/crypto/src/tls/crypto/impl/AbstractTlsCrypto.cs index 607f12778..a8fb26697 100644 --- a/crypto/src/tls/crypto/impl/AbstractTlsCrypto.cs +++ b/crypto/src/tls/crypto/impl/AbstractTlsCrypto.cs @@ -82,6 +82,10 @@ namespace Org.BouncyCastle.Tls.Crypto.Impl public abstract TlsNonceGenerator CreateNonceGenerator(byte[] additionalSeedMaterial); +#if NETCOREAPP2_1_OR_GREATER || NETSTANDARD2_1_OR_GREATER + public abstract TlsNonceGenerator CreateNonceGenerator(ReadOnlySpan<byte> additionalSeedMaterial); +#endif + public abstract TlsSrp6Client CreateSrp6Client(TlsSrpConfig srpConfig); public abstract TlsSrp6Server CreateSrp6Server(TlsSrpConfig srpConfig, BigInteger srpVerifier); diff --git a/crypto/src/tls/crypto/impl/bc/BcTlsCrypto.cs b/crypto/src/tls/crypto/impl/bc/BcTlsCrypto.cs index 3f63f9e83..79c994fc0 100644 --- a/crypto/src/tls/crypto/impl/bc/BcTlsCrypto.cs +++ b/crypto/src/tls/crypto/impl/bc/BcTlsCrypto.cs @@ -148,10 +148,14 @@ namespace Org.BouncyCastle.Tls.Crypto.Impl.BC public override TlsNonceGenerator CreateNonceGenerator(byte[] additionalSeedMaterial) { +#if NETCOREAPP2_1_OR_GREATER || NETSTANDARD2_1_OR_GREATER + return CreateNonceGenerator(Spans.FromNullable(additionalSeedMaterial, 0)); +#else int cryptoHashAlgorithm = CryptoHashAlgorithm.sha256; IDigest digest = CreateDigest(cryptoHashAlgorithm); - byte[] seed = new byte[TlsCryptoUtilities.GetHashOutputSize(cryptoHashAlgorithm)]; + int seedLength = TlsCryptoUtilities.GetHashOutputSize(cryptoHashAlgorithm); + byte[] seed = new byte[seedLength]; SecureRandom.NextBytes(seed); DigestRandomGenerator randomGenerator = new DigestRandomGenerator(digest); @@ -159,8 +163,29 @@ namespace Org.BouncyCastle.Tls.Crypto.Impl.BC randomGenerator.AddSeedMaterial(seed); return new BcTlsNonceGenerator(randomGenerator); +#endif } +#if NETCOREAPP2_1_OR_GREATER || NETSTANDARD2_1_OR_GREATER + public override TlsNonceGenerator CreateNonceGenerator(ReadOnlySpan<byte> additionalSeedMaterial) + { + int cryptoHashAlgorithm = CryptoHashAlgorithm.sha256; + IDigest digest = CreateDigest(cryptoHashAlgorithm); + + int seedLength = TlsCryptoUtilities.GetHashOutputSize(cryptoHashAlgorithm); + Span<byte> seed = seedLength <= 128 + ? stackalloc byte[seedLength] + : new byte[seedLength]; + SecureRandom.NextBytes(seed); + + DigestRandomGenerator randomGenerator = new DigestRandomGenerator(digest); + randomGenerator.AddSeedMaterial(additionalSeedMaterial); + randomGenerator.AddSeedMaterial(seed); + + return new BcTlsNonceGenerator(randomGenerator); + } +#endif + public override bool HasAnyStreamVerifiers(IList<SignatureAndHashAlgorithm> signatureAndHashAlgorithms) { foreach (SignatureAndHashAlgorithm algorithm in signatureAndHashAlgorithms) |