ServeHello selected PSK handling
@@ -995,41 +995,64 @@ protected void process13ServerHello(ServerHello serverHello, boolean afterHelloR
*/
securityParameters.statusRequestVersion = clientExtensions.containsKey(TlsExtensionsUtils.EXT_status_request) ? 1 : 0;
- // TODO[tls13-psk] Use PSK early secret if negotiated
TlsSecret pskEarlySecret = null;
+ {
+ int selected_identity = TlsExtensionsUtils.getPreSharedKeyServerHello(extensions);
+ TlsPSK selectedPSK = null;
- if (null != clientBinders)
+ if (selected_identity >= 0)
{
- // TODO[tls13-psk] Process the server's pre_shared_key response, if any
-// int selected_identity = TlsExtensionsUtils.getPreSharedKeyServerHello(extensions);
+ if (null == clientBinders || selected_identity >= clientBinders.psks.length)
+ {
+ throw new TlsFatalAlert(AlertDescription.illegal_parameter);
+ }
- // TODO[tls13-psk] Notify client of selected PSK
- // pskEarlySecret = ...;
+ selectedPSK = clientBinders.psks[selected_identity];
+ if (selectedPSK.getPRFAlgorithm() != securityParameters.getPRFAlgorithm())
+ {
+ throw new TlsFatalAlert(AlertDescription.illegal_parameter);
+ }
- this.clientBinders = null;
+ pskEarlySecret = clientBinders.earlySecrets[selected_identity];
}
- TlsSecret sharedSecret = null;
+ tlsClient.notifySelectedPSK(selectedPSK);
+ }
+ TlsSecret sharedSecret = null;
{
KeyShareEntry keyShareEntry = TlsExtensionsUtils.getKeyShareServerHello(extensions);
if (null == keyShareEntry)
{
- // TODO[tls13-psk] This would be OK for PskKeyExchangeMode.psk_ke (and not after HRR)
+ if (afterHelloRetryRequest
+ || null == pskEarlySecret
+ || !Arrays.contains(clientBinders.pskKeyExchangeModes, PskKeyExchangeMode.psk_ke))
+ {
+ throw new TlsFatalAlert(AlertDescription.illegal_parameter);
+ }
+ }
+ else
+ {
+ if (null != pskEarlySecret
+ && !Arrays.contains(clientBinders.pskKeyExchangeModes, PskKeyExchangeMode.psk_dhe_ke))
+ {
throw new TlsFatalAlert(AlertDescription.illegal_parameter);
}
- TlsAgreement agreement = (TlsAgreement)clientAgreements.get(Integers.valueOf(keyShareEntry.getNamedGroup()));
+ int namedGroup = keyShareEntry.getNamedGroup();
+ TlsAgreement agreement = (TlsAgreement)clientAgreements.get(Integers.valueOf(namedGroup));
if (null == agreement)
{
throw new TlsFatalAlert(AlertDescription.illegal_parameter);
}
- this.clientAgreements = null;
-
agreement.receivePeerValue(keyShareEntry.getKeyExchange());
sharedSecret = agreement.calculateSecret();
}
+ }
+
+ this.clientAgreements = null;
+ this.clientBinders = null;
TlsUtils.establish13PhaseSecrets(tlsClientContext, pskEarlySecret, sharedSecret);
