sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2026-10-07 15:05:42 +03:00
Code Issues Packages Projects Releases Wiki Activity

[tls] Exclude sequence number from authentication for TLS version 1.3

Browse Source 
The authentication header used for TLS version 1.3 no longer includes
the sequence number, since the use of sequential initialisation
vectors renders it redundant.

Skip authenticating this portion of the authentication header for TLS
version 1.3 or later.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2026-09-14 13:56:25 +01:00
parent 35a1abdbf8
commit 4ac73a5cbb
1 changed files with 15 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/net/tls.c
+15 -4
View File
@@ -3559,8 +3559,14 @@ static int tls_send_record ( struct tls_connection *tls, unsigned int type,
record_len, mac );
}
if ( is_auth_cipher ( cipher ) ) {
cipher_encrypt ( cipher, pipe->ctx, &authhdr, NULL,
sizeof ( authhdr ) );
if ( tls_version ( tls, TLS_VERSION_TLS_1_3 ) ) {
cipher_encrypt ( cipher, pipe->ctx,
&authhdr.header, NULL,
sizeof ( authhdr.header ) );
} else {
cipher_encrypt ( cipher, pipe->ctx, &authhdr,
NULL, sizeof ( authhdr ) );
}
}
/* Calculate encryption length */
@@ -3780,8 +3786,13 @@ static int tls_new_ciphertext ( struct tls_connection *tls,
/* Process authentication data, if applicable */
authhdr.header.length = htons ( len );
if ( is_auth_cipher ( cipher ) ) {
cipher_decrypt ( cipher, pipe->ctx, &authhdr,
NULL, sizeof ( authhdr ) );
if ( tls_version ( tls, TLS_VERSION_TLS_1_3 ) ) {
cipher_decrypt ( cipher, pipe->ctx, &authhdr.header,
NULL, sizeof ( authhdr.header ) );
} else {
cipher_decrypt ( cipher, pipe->ctx, &authhdr,
NULL, sizeof ( authhdr ) );
}
}
/* Decrypt the received data */