| 46 | } |
| 47 | |
| 48 | func (ka rsaKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) { |
| 49 | if len(ckx.ciphertext) < 2 { |
| 50 | return nil, errClientKeyExchange |
| 51 | } |
| 52 | ciphertextLen := int(ckx.ciphertext[0])<<8 | int(ckx.ciphertext[1]) |
| 53 | if ciphertextLen != len(ckx.ciphertext)-2 { |
| 54 | return nil, errClientKeyExchange |
| 55 | } |
| 56 | ciphertext := ckx.ciphertext[2:] |
| 57 | |
| 58 | priv, ok := cert.PrivateKey.(crypto.Decrypter) |
| 59 | if !ok { |
| 60 | return nil, errors.New("tls: certificate private key does not implement crypto.Decrypter") |
| 61 | } |
| 62 | // Perform constant time RSA PKCS #1 v1.5 decryption |
| 63 | preMasterSecret, err := priv.Decrypt(config.rand(), ciphertext, &rsa.PKCS1v15DecryptOptions{SessionKeyLen: 48}) |
| 64 | if err != nil { |
| 65 | return nil, err |
| 66 | } |
| 67 | // We don't check the version number in the premaster secret. For one, |
| 68 | // by checking it, we would leak information about the validity of the |
| 69 | // encrypted pre-master secret. Secondly, it provides only a small |
| 70 | // benefit against a downgrade attack and some implementations send the |
| 71 | // wrong version anyway. See the discussion at the end of section |
| 72 | // 7.4.7.1 of RFC 4346. |
| 73 | return preMasterSecret, nil |
| 74 | } |
| 75 | |
| 76 | func (ka rsaKeyAgreement) processServerKeyExchange(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, cert *x509.Certificate, skx *serverKeyExchangeMsg) error { |
| 77 | return errors.New("tls: unexpected ServerKeyExchange") |