dimpl 0.6.2

DTLS 1.2/1.3 implementation (Sans‑IO, Sync)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140

//! Key exchange group implementations using aws-lc-rs.

use aws_lc_rs::agreement::{ECDH_P256, ECDH_P384, UnparsedPublicKey, X25519};
use aws_lc_rs::agreement::{EphemeralPrivateKey, agree_ephemeral};

use super::super::{ActiveKeyExchange, SupportedKxGroup};
use crate::buffer::Buf;
use crate::types::NamedGroup;

/// ECDHE key exchange implementation.
struct EcdhKeyExchange {
    group: NamedGroup,
    private_key: EphemeralPrivateKey,
    public_key: Buf,
}

impl std::fmt::Debug for EcdhKeyExchange {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("EcdhKeyExchange")
            .field("group", &self.group)
            .field("public_key_len", &self.public_key.len())
            .finish_non_exhaustive()
    }
}

impl EcdhKeyExchange {
    fn new(group: NamedGroup, mut buf: Buf) -> Result<Self, String> {
        let algorithm = match group {
            NamedGroup::X25519 => &X25519,
            NamedGroup::Secp256r1 => &ECDH_P256,
            NamedGroup::Secp384r1 => &ECDH_P384,
            _ => return Err("Unsupported group".to_string()),
        };

        let rng = aws_lc_rs::rand::SystemRandom::new();
        let private_key = EphemeralPrivateKey::generate(algorithm, &rng)
            .map_err(|_| "Failed to generate ephemeral key".to_string())?;

        let pk = private_key
            .compute_public_key()
            .map_err(|_| "Failed to compute public key".to_string())?;

        buf.clear();
        buf.extend_from_slice(pk.as_ref());

        Ok(EcdhKeyExchange {
            group,
            private_key,
            public_key: buf,
        })
    }

    fn algorithm(&self) -> &'static aws_lc_rs::agreement::Algorithm {
        match self.group {
            NamedGroup::X25519 => &X25519,
            NamedGroup::Secp256r1 => &ECDH_P256,
            NamedGroup::Secp384r1 => &ECDH_P384,
            _ => unreachable!("Unsupported group"),
        }
    }
}

impl ActiveKeyExchange for EcdhKeyExchange {
    fn pub_key(&self) -> &[u8] {
        &self.public_key
    }

    fn complete(self: Box<Self>, peer_pub: &[u8], out: &mut Buf) -> Result<(), String> {
        let algorithm = self.algorithm();
        let peer_key = UnparsedPublicKey::new(algorithm, peer_pub);

        // RFC 7748 §6.1: agree_ephemeral rejects non-contributory shared secrets internally
        agree_ephemeral(
            self.private_key,
            peer_key,
            "ECDH agreement failed",
            |secret| {
                out.clear();
                out.extend_from_slice(secret);
                Ok(())
            },
        )
        .map_err(|e| e.to_string())
    }

    fn group(&self) -> NamedGroup {
        self.group
    }
}

/// X25519 key exchange group.
#[derive(Debug)]
struct X25519Kx;

impl SupportedKxGroup for X25519Kx {
    fn name(&self) -> NamedGroup {
        NamedGroup::X25519
    }

    fn start_exchange(&self, buf: Buf) -> Result<Box<dyn ActiveKeyExchange>, String> {
        Ok(Box::new(EcdhKeyExchange::new(NamedGroup::X25519, buf)?))
    }
}

/// P-256 (secp256r1) key exchange group.
#[derive(Debug)]
struct P256;

impl SupportedKxGroup for P256 {
    fn name(&self) -> NamedGroup {
        NamedGroup::Secp256r1
    }

    fn start_exchange(&self, buf: Buf) -> Result<Box<dyn ActiveKeyExchange>, String> {
        Ok(Box::new(EcdhKeyExchange::new(NamedGroup::Secp256r1, buf)?))
    }
}

/// P-384 (secp384r1) key exchange group.
#[derive(Debug)]
struct P384;

impl SupportedKxGroup for P384 {
    fn name(&self) -> NamedGroup {
        NamedGroup::Secp384r1
    }

    fn start_exchange(&self, buf: Buf) -> Result<Box<dyn ActiveKeyExchange>, String> {
        Ok(Box::new(EcdhKeyExchange::new(NamedGroup::Secp384r1, buf)?))
    }
}

/// Static instances of supported key exchange groups.
static KX_GROUP_X25519: X25519Kx = X25519Kx;
static KX_GROUP_P256: P256 = P256;
static KX_GROUP_P384: P384 = P384;

/// All supported key exchange groups.
pub(super) static ALL_KX_GROUPS: &[&dyn SupportedKxGroup] =
    &[&KX_GROUP_X25519, &KX_GROUP_P256, &KX_GROUP_P384];