Add 1.3 cipher suite secret init

Co-authored-by: Julia <supa@juliaelena.ro>
Co-authored-by: Julia <git@juliapixel.com>
Co-authored-by: Jade <jadey@tutanota.com>

Author: 4 people

internal/ciphersuite/tls_13.go

@@ -5,16 +5,25 @@ package ciphersuite
 
 import (
 	"fmt"
+	"sync/atomic"
 
 	dtlserrors "github.com/pion/dtls/v3/internal/errors"
 	"github.com/pion/dtls/v3/pkg/crypto/clientcertificate"
 	"github.com/pion/dtls/v3/pkg/protocol/recordlayer"
 )
 
+// CipherSuiteTLS13 is the DTLS 1.3-specific cipher suite surface.
+type CipherSuiteTLS13 interface {
+	CipherSuite
+	InitFromTrafficSecrets13(clientSecret, serverSecret []byte, isClient bool) error
+}
+
 // TLS13CipherSuite provides behavior common to TLS 1.3 cipher suites. TLS 1.3
 // cipher suites only identify the AEAD and hash; authentication and key
 // exchange are negotiated independently.
-type TLS13CipherSuite struct{}
+type TLS13CipherSuite struct {
+	recordProtection atomic.Value // *recordProtection13
+}
 
 func (c *TLS13CipherSuite) CertificateType() clientcertificate.Type {
 	return 0
@@ -33,7 +42,33 @@ func (c *TLS13CipherSuite) AuthenticationType() AuthenticationType {
 }
 
 func (c *TLS13CipherSuite) IsInitialized() bool {
-	return false
+	return c.recordProtection.Load() != nil
+}
+
+func (c *TLS13CipherSuite) initFromTrafficSecrets13(
+	clientSecret, serverSecret []byte,
+	isClient bool,
+	newRecordProtection func(localTrafficSecret, remoteTrafficSecret []byte) (*recordProtection13, error),
+) error {
+	if newRecordProtection == nil {
+		return dtlserrors.ErrCipherSuiteRecordProtectionNotImplemented
+	}
+
+	localSecret, remoteSecret := localRemoteTrafficSecrets13(clientSecret, serverSecret, isClient)
+	protection, err := newRecordProtection(localSecret, remoteSecret)
+	if err != nil {
+		return err
+	}
+
+	c.recordProtection.Store(protection)
+
+	return nil
+}
+
+func (c *TLS13CipherSuite) getRecordProtection13() (*recordProtection13, bool) {
+	protection, ok := c.recordProtection.Load().(*recordProtection13)
+
+	return protection, ok
 }
 
 func (c *TLS13CipherSuite) Init(_, _, _ []byte, _ bool) error {
@@ -47,3 +82,14 @@ func (c *TLS13CipherSuite) Encrypt(_ *recordlayer.RecordLayer, _ []byte) ([]byte
 func (c *TLS13CipherSuite) Decrypt(_ recordlayer.Header, _ []byte) ([]byte, error) {
 	return nil, fmt.Errorf("%w, unable to decrypt", dtlserrors.ErrCipherSuiteRecordProtectionNotImplemented)
 }
+
+func localRemoteTrafficSecrets13(
+	clientSecret, serverSecret []byte,
+	isClient bool,
+) (localSecret, remoteSecret []byte) {
+	if isClient {
+		return clientSecret, serverSecret
+	}
+
+	return serverSecret, clientSecret
+}

internal/ciphersuite/tls_13_record_protection_test.go

@@ -28,7 +28,7 @@ type recordProtection13TestCase struct {
 }
 
 type tls13RecordProtectionSuite interface {
-	CipherSuite
+	CipherSuiteTLS13
 	newRecordProtection(localTrafficSecret, remoteTrafficSecret []byte) (*recordProtection13, error)
 }
 
@@ -89,6 +89,46 @@ func trafficSecret13(suite tls13RecordProtectionSuite, fill byte) []byte {
 	return bytes.Repeat([]byte{fill}, hashFunc().Size())
 }
 
+func newRecordProtection13TestSuite(t *testing.T, name string) tls13RecordProtectionSuite {
+	t.Helper()
+
+	for _, testCase := range recordProtection13TestCases() {
+		if testCase.name == name {
+			return testCase.suite
+		}
+	}
+
+	assert.FailNowf(t, "unknown TLS 1.3 test suite", "name: %s", name)
+
+	return nil
+}
+
+func requireRecordProtection13(t *testing.T, suite tls13RecordProtectionSuite) *recordProtection13 {
+	t.Helper()
+
+	switch s := suite.(type) {
+	case *TLSAes128GcmSha256:
+		protection, ok := s.getRecordProtection13()
+		require.True(t, ok)
+
+		return protection
+	case *TLSAes256GcmSha384:
+		protection, ok := s.getRecordProtection13()
+		require.True(t, ok)
+
+		return protection
+	case *TLSChacha20Poly1305Sha256:
+		protection, ok := s.getRecordProtection13()
+		require.True(t, ok)
+
+		return protection
+	default:
+		assert.FailNowf(t, "unknown TLS 1.3 test suite", "suite: %T", suite)
+
+		return nil
+	}
+}
+
 func TestDeriveRecordTrafficKeys13Suites(t *testing.T) {
 	for _, testCase := range recordProtection13TestCases() {
 		t.Run(testCase.name, func(t *testing.T) {
@@ -171,6 +211,44 @@ func TestTLS13CipherSuiteNewRecordProtectionSuites(t *testing.T) {
 	}
 }
 
+func TestTLS13CipherSuiteInitFromTrafficSecrets13(t *testing.T) {
+	for _, testCase := range recordProtection13TestCases() {
+		t.Run(testCase.name, func(t *testing.T) {
+			clientSuite := testCase.suite
+			serverSuite := newRecordProtection13TestSuite(t, testCase.name)
+
+			clientSecret := trafficSecret13(testCase.suite, 0xa6)
+			serverSecret := trafficSecret13(testCase.suite, 0xb6)
+
+			require.False(t, clientSuite.IsInitialized())
+			require.False(t, serverSuite.IsInitialized())
+
+			require.NoError(t, clientSuite.InitFromTrafficSecrets13(clientSecret, serverSecret, true))
+			require.NoError(t, serverSuite.InitFromTrafficSecrets13(clientSecret, serverSecret, false))
+
+			require.True(t, clientSuite.IsInitialized())
+			require.True(t, serverSuite.IsInitialized())
+
+			clientProtection := requireRecordProtection13(t, clientSuite)
+			serverProtection := requireRecordProtection13(t, serverSuite)
+			header := recordlayer.UnifiedHeader{
+				SequenceNumber: 0x1234,
+				EpochLow:       2,
+			}
+			sequenceNumber := uint64(0x0102030405060708)
+			plaintext := []byte("traffic-secret initialized payload")
+
+			record, err := clientProtection.seal(header, sequenceNumber, protocol.ContentTypeApplicationData, plaintext)
+			require.NoError(t, err)
+
+			innerPlaintext, err := serverProtection.open(record.Header, sequenceNumber, record.EncryptedRecord)
+			require.NoError(t, err)
+			assert.Equal(t, plaintext, innerPlaintext.Content)
+			assert.Equal(t, protocol.ContentTypeApplicationData, innerPlaintext.RealType)
+		})
+	}
+}
+
 func TestRecordProtection13SealOpenSyntheticTrafficSecret(t *testing.T) {
 	for _, testCase := range recordProtection13TestCases() {
 		t.Run(testCase.name, func(t *testing.T) {

internal/ciphersuite/tls_aes_128_gcm_sha256.go

@@ -32,6 +32,12 @@ func (c *TLSAes128GcmSha256) HashFunc() func() hash.Hash {
 	return sha256.New
 }
 
+// InitFromTrafficSecrets13 initializes DTLS 1.3 record protection from the
+// negotiated client and server handshake/application traffic secrets.
+func (c *TLSAes128GcmSha256) InitFromTrafficSecrets13(clientSecret, serverSecret []byte, isClient bool) error {
+	return c.initFromTrafficSecrets13(clientSecret, serverSecret, isClient, c.newRecordProtection)
+}
+
 func (c *TLSAes128GcmSha256) newRecordProtection(
 	localTrafficSecret, remoteTrafficSecret []byte,
 ) (*recordProtection13, error) {

internal/ciphersuite/tls_aes_256_gcm_sha384.go

@@ -32,6 +32,12 @@ func (c *TLSAes256GcmSha384) HashFunc() func() hash.Hash {
 	return sha512.New384
 }
 
+// InitFromTrafficSecrets13 initializes DTLS 1.3 record protection from the
+// negotiated client and server handshake/application traffic secrets.
+func (c *TLSAes256GcmSha384) InitFromTrafficSecrets13(clientSecret, serverSecret []byte, isClient bool) error {
+	return c.initFromTrafficSecrets13(clientSecret, serverSecret, isClient, c.newRecordProtection)
+}
+
 func (c *TLSAes256GcmSha384) newRecordProtection(
 	localTrafficSecret, remoteTrafficSecret []byte,
 ) (*recordProtection13, error) {

internal/ciphersuite/tls_chacha20_poly1305_sha256.go

@@ -32,6 +32,12 @@ func (c *TLSChacha20Poly1305Sha256) HashFunc() func() hash.Hash {
 	return sha256.New
 }
 
+// InitFromTrafficSecrets13 initializes DTLS 1.3 record protection from the
+// negotiated client and server handshake/application traffic secrets.
+func (c *TLSChacha20Poly1305Sha256) InitFromTrafficSecrets13(clientSecret, serverSecret []byte, isClient bool) error {
+	return c.initFromTrafficSecrets13(clientSecret, serverSecret, isClient, c.newRecordProtection)
+}
+
 func (c *TLSChacha20Poly1305Sha256) newRecordProtection(
 	localTrafficSecret, remoteTrafficSecret []byte,
 ) (*recordProtection13, error) {