feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Allow session tickets to properly resume when using PQ KEMs.

Browse Source 
Found with:

```
./configure --with-liboqs --enable-session-ticket
./examples/server/server -v 4 -r --pqc P521_KYBER_LEVEL5
./examples/client/client -v 4 -r --pqc P521_KYBER_LEVEL5
```
This commit is contained in:
Anthony Hu
2022-12-13 11:36:00 -05:00
parent 64ef6aedd6
commit 364835dc9e
2 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
examples/client/client.c
View File

@ -398,7 +398,10 @@ static void SetKeyShare(WOLFSSL* ssl, int onlyKeyShare, int useX25519,
} }
printf("Using Post-Quantum KEM: %s\n", pqcAlg); printf("Using Post-Quantum KEM: %s\n", pqcAlg);
if (wolfSSL_UseKeyShare(ssl, group) != WOLFSSL_SUCCESS) { if (wolfSSL_UseKeyShare(ssl, group) == WOLFSSL_SUCCESS) {
groups[count++] = group;
}
else {
err_sys("unable to use post-quantum KEM"); err_sys("unable to use post-quantum KEM");
} }
} }

13
src/tls.c
View File

@ -8064,7 +8064,7 @@ static int TLSX_KeyShare_Process(WOLFSSL* ssl, KeyShareEntry* keyShareEntry)
int ret; int ret;
#if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK) #if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)
ssl->session->namedGroup = (byte)keyShareEntry->group; ssl->session->namedGroup = keyShareEntry->group;
#endif #endif
/* reset the pre master secret size */ /* reset the pre master secret size */
if (ssl->arrays->preMasterSz == 0) if (ssl->arrays->preMasterSz == 0)
@ -11135,9 +11135,14 @@ int TLSX_PopulateExtensions(WOLFSSL* ssl, byte isServer)
} }
if (namedGroup > 0) { if (namedGroup > 0) {
#ifdef HAVE_PQC #ifdef HAVE_PQC
/* For KEMs, the key share has already been generated. */ /* For KEMs, the key share has already been generated, but not
if (!WOLFSSL_NAMED_GROUP_IS_PQC(namedGroup)) * if we are resuming. */
#endif if (!WOLFSSL_NAMED_GROUP_IS_PQC(namedGroup)
#ifdef HAVE_SESSION_TICKET
|| ssl->options.resuming
#endif /* HAVE_SESSION_TICKET */
)
#endif /* HAVE_PQC */
ret = TLSX_KeyShare_Use(ssl, namedGroup, 0, NULL, NULL); ret = TLSX_KeyShare_Use(ssl, namedGroup, 0, NULL, NULL);
if (ret != 0) if (ret != 0)
return ret; return ret;