From a66edb8f5fb662cc06244cc373b6d5fe16adaa75 Mon Sep 17 00:00:00 2001 From: Evgeny Date: Fri, 24 Apr 2026 15:43:58 +0300 Subject: [PATCH] Crypto: Added SHA256-based KDF for session key derivation from ECDH shared secret --- src/secure_channel.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/src/secure_channel.c b/src/secure_channel.c index 840741ba..53243b6d 100644 --- a/src/secure_channel.c +++ b/src/secure_channel.c @@ -130,6 +130,18 @@ static sc_status_t verify_and_strip_crc32(uint8_t *plaintext_with_crc, size_t to return SC_OK; } +static void sc_derive_session_key(const uint8_t *shared_secret, uint8_t *session_key) { + SC_SHA256_CTX sha_ctx; + uint8_t hash[SC_HASH_SIZE]; + + sc_sha256_init(&sha_ctx); + sc_sha256_update(&sha_ctx, shared_secret, SC_SHARED_SECRET_SIZE); + sc_sha256_update(&sha_ctx, (const uint8_t *)"uTun-v3-session", 15); + sc_sha256_final(&sha_ctx, hash); + + memcpy(session_key, hash, SC_SESSION_KEY_SIZE); +} + #ifdef USE_OPENSSL // OpenSSL-specific implementations @@ -319,7 +331,7 @@ sc_status_t sc_set_peer_public_key(sc_context_t *ctx, const char *peer_public_ke EC_GROUP_free(group); return SC_ERR_CRYPTO; } - memcpy(ctx->session_key, shared_secret, SC_SESSION_KEY_SIZE); + sc_derive_session_key(shared_secret, ctx->session_key); memcpy(ctx->peer_public_key, peer_public_key, SC_PUBKEY_SIZE); ctx->peer_key_set = 1; ctx->session_ready = 1; @@ -647,8 +659,7 @@ sc_status_t sc_set_peer_public_key(sc_context_t *ctx, const char *peer_public_ke return SC_ERR_CRYPTO; } - /* Derive session key from shared secret (simple copy for demo) */ - memcpy(ctx->session_key, shared_secret, SC_SESSION_KEY_SIZE); + sc_derive_session_key(shared_secret, ctx->session_key); /* Store peer public key */ memcpy(ctx->peer_public_key, peer_public_key, SC_PUBKEY_SIZE);