From 0d5175f6b4560573e659c7a8ae17a0b1512805bf Mon Sep 17 00:00:00 2001 From: yuhan6665 <1588741+yuhan6665@users.noreply.github.com> Date: Sat, 14 Oct 2023 03:27:56 -0400 Subject: [PATCH] crypto/tls: fix PSK binder calculation When server and client have mismatch in curve preference, the server will send HelloRetryRequest during TLSv1.3 PSK resumption. There was a bug introduced by Go1.19.6 or later and Go1.20.1 or later, that makes the client calculate the PSK binder hash incorrectly. Server will reject the TLS handshake by sending alert: invalid PSK binder. Fixes #59424 Change-Id: I2ca8948474275740a36d991c057b62a13392dbb9 GitHub-Last-Rev: 1aad9bc GitHub-Pull-Request: #59425 Reviewed-on: https://go-review.googlesource.com/c/go/+/481955 Reviewed-by: Roland Shoemaker Reviewed-by: Dmitri Shuralyov Run-TryBot: Roland Shoemaker TryBot-Result: Gopher Robot Auto-Submit: Roland Shoemaker --- handshake_client_tls13.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/handshake_client_tls13.go b/handshake_client_tls13.go index f03aeec..12815b3 100644 --- a/handshake_client_tls13.go +++ b/handshake_client_tls13.go @@ -259,7 +259,7 @@ func (hs *clientHandshakeStateTLS13) processHelloRetryRequest() error { transcript := hs.suite.hash.New() transcript.Write([]byte{typeMessageHash, 0, 0, uint8(len(chHash))}) transcript.Write(chHash) - if err := transcriptMsg(hs.serverHello, hs.transcript); err != nil { + if err := transcriptMsg(hs.serverHello, transcript); err != nil { return err } helloBytes, err := hs.hello.marshalWithoutBinders()