Macintosh-SW/tenfourfox
1
0
Fork 0
mirror of https://github.com/classilla/tenfourfox.git synced 2025-01-12 05:30:52 +00:00
Code Issues Projects Releases Wiki Activity

closes #480: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 plus SHA-384 base plumbing from M923089+M1276618+M1278434

Browse Source
This commit is contained in:
Cameron Kaiser 2018-04-10 14:13:39 -07:00
parent 2a28a03ed4
commit 1f117b494f
14 changed files with 190 additions and 63 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
media/mtransport/transportlayerdtls.cpp
View File

@ -673,6 +673,9 @@ static const uint32_t EnabledCiphers[] = {
// Anything outside this list is governed by the usual combination of policy
// and user preferences.
static const uint32_t DisabledCiphers[] = {
// ALL SHA384 ciphers are disabled per bug 1310061.
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,

1
netwerk/base/security-prefs.js
View File

@ -18,6 +18,7 @@ pref("security.ssl.enable_alpn", true);
pref("security.ssl3.ecdhe_rsa_aes_128_gcm_sha256", true);
pref("security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256", true);
pref("security.ssl3.ecdhe_rsa_aes_256_gcm_sha384", true);
pref("security.ssl3.ecdhe_rsa_aes_128_sha", true);
pref("security.ssl3.ecdhe_rsa_aes_128_sha256", true);
pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", true);

1
security/manager/ssl/nsNSSCallbacks.cpp
View File

@ -1080,6 +1080,7 @@ AccumulateCipherSuite(Telemetry::ID probe, const SSLChannelInfo& channelInfo)
case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA: value = 9; break;
case TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA: value = 10; break;
case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: value = 11; break; // just in case, issue 489
case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: value = 14; break; // just in case, issue 480
// DHE key exchange
case TLS_DHE_RSA_WITH_AES_128_CBC_SHA: value = 21; break;
case TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA: value = 22; break;

4
security/manager/ssl/nsNSSComponent.cpp
View File

@ -619,6 +619,10 @@ static const CipherPref sCipherPrefs[] = {
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, true },
{ "security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256",
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, true },
{ "security.ssl3.ecdhe_rsa_aes_256_gcm_sha384",
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, true },
{ "security.ssl3.ecdhe_rsa_aes_128_sha",
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, true },
{ "security.ssl3.ecdhe_ecdsa_aes_128_sha",

3
security/nss/lib/ssl/derive.c
View File

@ -23,6 +23,9 @@
#include "sslerr.h"
#ifndef NO_PKCS11_BYPASS
#error not patched for SHA384, see bug 923089
/* make this a macro! */
#ifdef NOT_A_MACRO
static void

210
security/nss/lib/ssl/ssl3con.c
View File

@ -97,6 +97,7 @@ static ssl3CipherSuiteCfg cipherSuites[ssl_V3_SUITES_IMPLEMENTED] = {
#ifndef NSS_DISABLE_ECC
{ TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE},
{ TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE},
{ TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, SSL_ALLOWED, PR_TRUE, PR_FALSE},
/* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA is out of order to work around
* bug 946147.
*/
@ -292,6 +293,7 @@ static const ssl3BulkCipherDef bulk_cipher_defs[] = {
{cipher_camellia_256, calg_camellia, 32,32, type_block, 16,16, 0, 0},
{cipher_seed, calg_seed, 16,16, type_block, 16,16, 0, 0},
{cipher_aes_128_gcm, calg_aes_gcm, 16,16, type_aead, 4, 0,16, 8},
{cipher_aes_256_gcm, calg_aes_gcm, 32,32, type_aead, 4, 0,16, 8},
{cipher_missing, calg_null, 0, 0, type_stream, 0, 0, 0, 0},
};
@ -416,8 +418,10 @@ static const ssl3CipherSuiteDef cipher_suite_defs[] =
{TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_dhe_rsa},
{TLS_RSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_rsa},
{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_ecdhe_rsa},
{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_ecdhe_ecdsa},
{TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, cipher_aes_256_gcm, mac_aead, kea_ecdhe_rsa}, // XXX: ssl_hash_sha384 hardcoded, see TenFourFox issue 480
{TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_dhe_dss},
{TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, cipher_aes_128, hmac_sha256, kea_dhe_dss},
@ -496,6 +500,7 @@ static const SSLCipher2Mech alg2Mech[] = {
#define mmech_md5_hmac CKM_MD5_HMAC
#define mmech_sha_hmac CKM_SHA_1_HMAC
#define mmech_sha256_hmac CKM_SHA256_HMAC
#define mmech_sha384_hmac CKM_SHA384_HMAC
static const ssl3MACDef mac_defs[] = { /* indexed by SSL3MACAlgorithm */
/* pad_size is only used for SSL 3.0 MAC. See RFC 6101 Sec. 5.2.3.1. */
@ -507,6 +512,7 @@ static const ssl3MACDef mac_defs[] = { /* indexed by SSL3MACAlgorithm */
{hmac_sha, mmech_sha_hmac, 0, SHA1_LENGTH},
{hmac_sha256, mmech_sha256_hmac, 0, SHA256_LENGTH},
{ mac_aead, mmech_invalid, 0, 0 },
{hmac_sha384, mmech_sha384_hmac, 0, SHA384_LENGTH},
};
/* indexed by SSL3BulkCipher */
@ -666,6 +672,7 @@ ssl3_CipherSuiteAllowedForVersionRange(
case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
case TLS_DHE_DSS_WITH_AES_128_GCM_SHA256:
return vrange->max >= SSL_LIBRARY_VERSION_TLS_1_2;
@ -2214,6 +2221,7 @@ ssl3_InitPendingCipherSpec(sslSocket *ss, PK11SymKey *pms)
#ifndef NO_PKCS11_BYPASS
if (ss->opt.bypassPKCS11 && pwSpec->msItem.len && pwSpec->msItem.data) {
/* Double Bypass succeeded in extracting the master_secret */
#error not patched for SHA384, see bug 923089
const ssl3KEADef * kea_def = ss->ssl3.hs.kea_def;
PRBool isTLS = (PRBool)(kea_def->tls_keygen ||
(pwSpec->version > SSL_LIBRARY_VERSION_3_0));
@ -2348,6 +2356,7 @@ ssl3_ComputeRecordMAC(
case ssl_hmac_sha256: /* used with TLS */
hashObj = HASH_GetRawHashObject(HASH_AlgSHA256);
break;
#error does not yet support SHA384, see bug 923089
default:
break;
}
@ -3592,6 +3601,55 @@ ssl3_HandleChangeCipherSpecs(sslSocket *ss, sslBuffer *buf)
return SECSuccess;
}
/* XXX: These are stubs for TenFourFox issue 480, based on bug 923089.
Instead of using the prf_hash field, these simply check the cipher.
If we add a whole lot of new ciphers, we should probably just bite the
bullet and add the hash field, but for now just hard-code them IN BOTH
PLACES.
We get away with this because the code actually just maps ssl_hash_sha256
and _none to SHA-256, and the only other value is SHA-384 for our
exception ciphers. */
inline static CK_MECHANISM_TYPE
ssl3_GetTls12PrfHashMechanism(sslSocket *ss)
{
#if(0)
// For reference
switch (ss->ssl3.hs.suite_def->prf_hash) {
case ssl_hash_sha384:
return CKM_SHA384;
case ssl_hash_sha256:
case ssl_hash_none:
/* ssl_hash_none is for pre-1.2 suites, which use SHA-256. */
return CKM_SHA256;
default:
PORT_Assert(0);
}
return CKM_SHA256;
#else
if (ss->ssl3.hs.cipher_suite == TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)
return CKM_SHA384;
return CKM_SHA256;
#endif
}
inline static SSLHashType
ssl3_GetSuitePrfHash(sslSocket *ss) {
#if(0)
// For reference
/* ssl_hash_none is for pre-1.2 suites, which use SHA-256. */
if (ss->ssl3.hs.suite_def->prf_hash == ssl_hash_none) {
return ssl_hash_sha256;
}
return ss->ssl3.hs.suite_def->prf_hash;
#else
if (ss->ssl3.hs.cipher_suite == TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)
return ssl_hash_sha384;
return ssl_hash_sha256;
#endif
}
/* This method completes the derivation of the MS from the PMS.
**
** 1. Derive the MS, if possible, else return an error.
@ -3709,7 +3767,7 @@ ssl3_ComputeMasterSecretInt(sslSocket *ss, PK11SymKey *pms,
master_params.RandomInfo.pServerRandom = sr;
master_params.RandomInfo.ulServerRandomLen = SSL3_RANDOM_LENGTH;
if (isTLS12) {
master_params.prfHashMechanism = CKM_SHA256;
master_params.prfHashMechanism = ssl3_GetTls12PrfHashMechanism(ss);
master_params_len = sizeof(CK_TLS12_MASTER_KEY_DERIVE_PARAMS);
} else {
/* prfHashMechanism is not relevant with this PRF */
@ -3767,8 +3825,8 @@ tls_ComputeExtendedMasterSecretInt(sslSocket *ss, PK11SymKey *pms,
}
if (pwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_2) {
/* TLS 1.2 */
extended_master_params.prfHashMechanism = CKM_SHA256;
/* TLS 1.2+ */
extended_master_params.prfHashMechanism = ssl3_GetTls12PrfHashMechanism(ss);
key_derive = CKM_TLS12_KEY_AND_MAC_DERIVE;
} else {
/* TLS < 1.2 */
@ -3954,7 +4012,7 @@ ssl3_DeriveConnectionKeysPKCS11(sslSocket *ss)
if (isTLS12) {
key_derive = CKM_TLS12_KEY_AND_MAC_DERIVE;
key_material_params.prfHashMechanism = CKM_SHA256;
key_material_params.prfHashMechanism = ssl3_GetTls12PrfHashMechanism(ss);
key_material_params_len = sizeof(CK_TLS12_KEY_MAT_PARAMS);
} else if (isTLS) {
key_derive = CKM_TLS_KEY_AND_MAC_DERIVE;
@ -4032,11 +4090,14 @@ ssl3_InitHandshakeHashes(sslSocket *ss)
if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_2) {
/* If we ever support ciphersuites where the PRF hash isn't SHA-256
* then this will need to be updated. */
// We don't build with the bypass enabled, but this is here in case we need to.
#error handling for TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 is incomplete
ss->ssl3.hs.sha_obj = HASH_GetRawHashObject(HASH_AlgSHA256);
if (!ss->ssl3.hs.sha_obj) {
ssl_MapLowLevelError(SSL_ERROR_DIGEST_FAILURE);
return SECFailure;
}
#error see bug 923089
ss->ssl3.hs.sha_clone = (void (*)(void *, void *))SHA256_Clone;
ss->ssl3.hs.hashType = handshake_hash_single;
ss->ssl3.hs.sha_obj->begin(ss->ssl3.hs.sha_cx);
@ -4055,9 +4116,20 @@ ssl3_InitHandshakeHashes(sslSocket *ss)
* that the master secret will wind up in ...
*/
if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_2) {
/* If we ever support ciphersuites where the PRF hash isn't SHA-256
* then this will need to be updated. */
ss->ssl3.hs.sha = PK11_CreateDigestContext(SEC_OID_SHA256);
/* determine the hash from the prf */
const SECOidData *hash_oid =
SECOID_FindOIDByMechanism(ssl3_GetTls12PrfHashMechanism(ss));
/* Get the PKCS #11 mechanism for the Hash from the cipher suite (prf_hash)
* Convert that to the OidTag. We can then use that OidTag to create our
* PK11Context */
PORT_Assert(hash_oid != NULL);
if (hash_oid == NULL) {
ssl_MapLowLevelError(SSL_ERROR_DIGEST_FAILURE);
return SECFailure;
}
ss->ssl3.hs.sha = PK11_CreateDigestContext(hash_oid->offset);
if (ss->ssl3.hs.sha == NULL) {
ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE);
return SECFailure;
@ -4378,6 +4450,12 @@ ssl3_AppendSignatureAndHashAlgorithm(
sslSocket *ss, const SSLSignatureAndHashAlg* sigAndHash)
{
PRUint8 serialized[2];
SECOidTag hashAlg = ssl3_TLSHashAlgorithmToOID(sigAndHash->hashAlg);
if (hashAlg == SEC_OID_UNKNOWN) {
PORT_Assert(0);
PORT_SetError(SSL_ERROR_UNSUPPORTED_HASH_ALGORITHM);
return SECFailure;
}
serialized[0] = (PRUint8)sigAndHash->hashAlg;
serialized[1] = (PRUint8)sigAndHash->sigAlg;
@ -4711,6 +4789,8 @@ ssl3_ComputeHandshakeHashes(sslSocket * ss,
/* If we ever support ciphersuites where the PRF hash isn't SHA-256
* then this will need to be updated. */
hashes->hashAlg = ssl_hash_sha256;
// We don't build with the bypass enabled, but this is here in case we need to.
#error handling for TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 is incomplete
rv = SECSuccess;
} else if (ss->opt.bypassPKCS11) {
/* compute them without PKCS11 */
@ -4818,9 +4898,8 @@ ssl3_ComputeHandshakeHashes(sslSocket * ss,
rv = SECFailure;
goto tls12_loser;
}
/* If we ever support ciphersuites where the PRF hash isn't SHA-256
* then this will need to be updated. */
hashes->hashAlg = ssl_hash_sha256;
hashes->hashAlg = ssl3_GetSuitePrfHash(ss);
rv = SECSuccess;
tls12_loser:
@ -6241,7 +6320,26 @@ loser:
/* Once a cipher suite has been selected, make sure that the necessary secondary
* information is properly set. */
static SECStatus
ssl3_SetCipherSuite(sslSocket *ss, ssl3CipherSuite chosenSuite)
{
ss->ssl3.hs.cipher_suite = chosenSuite;
ss->ssl3.hs.suite_def = ssl_LookupCipherSuiteDef(chosenSuite);
if (!ss->ssl3.hs.suite_def) {
PORT_Assert(0);
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
return SECFailure;
}
// XXX?
ss->ssl3.hs.kea_def = &kea_defs[ss->ssl3.hs.suite_def->key_exchange_alg];
ss->ssl3.hs.preliminaryInfo |= ssl_preinfo_cipher_suite;
/* Now we've have a cipher suite, initialize the handshake hashes. */
return ssl3_InitHandshakeHashes(ss);
}
/* Called from ssl3_HandleServerHelloDone(). */
static SECStatus
@ -6482,13 +6580,6 @@ ssl3_HandleServerHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
ss->ssl3.hs.preliminaryInfo |= ssl_preinfo_version;
isTLS = (ss->version > SSL_LIBRARY_VERSION_3_0);
rv = ssl3_InitHandshakeHashes(ss);
if (rv != SECSuccess) {
desc = internal_error;
errCode = PORT_GetError();
goto alert_loser;
}
rv = ssl3_ConsumeHandshake(
ss, &ss->ssl3.hs.server_random, SSL3_RANDOM_LENGTH, &b, &length);
if (rv != SECSuccess) {
@ -6537,13 +6628,12 @@ ssl3_HandleServerHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
errCode = SSL_ERROR_NO_CYPHER_OVERLAP;
goto alert_loser;
}
ss->ssl3.hs.cipher_suite = (ssl3CipherSuite)temp;
ss->ssl3.hs.suite_def = ssl_LookupCipherSuiteDef((ssl3CipherSuite)temp);
ss->ssl3.hs.preliminaryInfo |= ssl_preinfo_cipher_suite;
PORT_Assert(ss->ssl3.hs.suite_def);
if (!ss->ssl3.hs.suite_def) {
PORT_SetError(errCode = SEC_ERROR_LIBRARY_FAILURE);
goto loser; /* we don't send alerts for our screw-ups. */
rv = ssl3_SetCipherSuite(ss, (ssl3CipherSuite)temp);
if (rv != SECSuccess) {
desc = internal_error;
errCode = PORT_GetError();
goto alert_loser;
}
/* find selected compression method in our list. */
@ -7128,7 +7218,7 @@ done:
/* Destroys the backup handshake hash context if we don't need it. Note that
* this function selects the hash algorithm for client authentication
* signatures; ssl3_SendCertificateVerify uses the presence of the backup hash
* to determine whether to use SHA-1 or SHA-256. */
* to determine whether to use SHA-1, or the PRF hash of the cipher suite. */
static void
ssl3_DestroyBackupHandshakeHashIfNotNeeded(sslSocket *ss,
const SECItem *algorithms)
@ -7137,7 +7227,7 @@ ssl3_DestroyBackupHandshakeHashIfNotNeeded(sslSocket *ss,
SSLSignType sigAlg;
PRBool preferSha1;
PRBool supportsSha1 = PR_FALSE;
PRBool supportsSha256 = PR_FALSE;
PRBool supportsHandshakeHash = PR_FALSE;
PRBool needBackupHash = PR_FALSE;
unsigned int i;
@ -7161,15 +7251,17 @@ ssl3_DestroyBackupHandshakeHashIfNotNeeded(sslSocket *ss,
if (algorithms->data[i+1] == sigAlg) {
if (algorithms->data[i] == ssl_hash_sha1) {
supportsSha1 = PR_TRUE;
} else if (algorithms->data[i] == ssl_hash_sha256) {
supportsSha256 = PR_TRUE;
}
}
} else if (algorithms->data[i] == ssl_hash_sha256 || algorithms->data[i] == ssl_hash_sha384) {
/* XXX: This is wrong, but works. If we implement prf_hash,
we should fix it. See bug 923089. */
supportsHandshakeHash = PR_TRUE;
}
}
}
/* If either the server does not support SHA-256 or the client key prefers
/* If either the server does not support the handshake hash or the client key prefers
* SHA-1, leave the backup hash. */
if (supportsSha1 && (preferSha1 || !supportsSha256)) {
if (supportsSha1 && (preferSha1 || !supportsHandshakeHash)) {
needBackupHash = PR_TRUE;
}
@ -8196,14 +8288,16 @@ ssl3_HandleClientHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
if (!suite->enabled)
break;
#endif
/* Double check that the cached cipher suite is in the client's list */
/* Double check that the cached cipher suite is in the client's
* list. If it isn't, fall through and start a new session. */
for (i = 0; i + 1 < suites.len; i += 2) {
PRUint16 suite_i = (suites.data[i] << 8) | suites.data[i + 1];
if (suite_i == suite->cipher_suite) {
ss->ssl3.hs.cipher_suite = suite->cipher_suite;
ss->ssl3.hs.suite_def =
ssl_LookupCipherSuiteDef(ss->ssl3.hs.cipher_suite);
ss->ssl3.hs.preliminaryInfo |= ssl_preinfo_cipher_suite;
if (ssl3_SetCipherSuite(ss, suite_i) != SECSuccess) {
desc = internal_error;
errCode = PORT_GetError();
goto alert_loser;
}
/* Use the cached compression method. */
ss->ssl3.hs.compression = sid->u.ssl3.compression;
@ -8246,10 +8340,11 @@ ssl3_HandleClientHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
for (i = 0; i + 1 < suites.len; i += 2) {
PRUint16 suite_i = (suites.data[i] << 8) | suites.data[i + 1];
if (suite_i == suite->cipher_suite) {
ss->ssl3.hs.cipher_suite = suite->cipher_suite;
ss->ssl3.hs.suite_def =
ssl_LookupCipherSuiteDef(ss->ssl3.hs.cipher_suite);
ss->ssl3.hs.preliminaryInfo |= ssl_preinfo_cipher_suite;
if (ssl3_SetCipherSuite(ss, suite_i) != SECSuccess) {
desc = internal_error;
errCode = PORT_GetError();
goto alert_loser;
}
goto suite_found;
}
}
@ -8763,13 +8858,6 @@ ssl3_HandleV2ClientHello(sslSocket *ss, unsigned char *buffer, int length)
}
ss->ssl3.hs.preliminaryInfo |= ssl_preinfo_version;
rv = ssl3_InitHandshakeHashes(ss);
if (rv != SECSuccess) {
desc = internal_error;
errCode = PORT_GetError();
goto alert_loser;
}
/* if we get a non-zero SID, just ignore it. */
if (length !=
SSL_HL_CLIENT_HELLO_HBYTES + suite_length + sid_length + rand_length) {
@ -8823,10 +8911,11 @@ ssl3_HandleV2ClientHello(sslSocket *ss, unsigned char *buffer, int length)
for (i = 0; i+2 < suite_length; i += 3) {
PRUint32 suite_i = (suites[i] << 16)|(suites[i+1] << 8)|suites[i+2];
if (suite_i == suite->cipher_suite) {
ss->ssl3.hs.cipher_suite = suite->cipher_suite;
ss->ssl3.hs.suite_def =
ssl_LookupCipherSuiteDef(ss->ssl3.hs.cipher_suite);
ss->ssl3.hs.preliminaryInfo |= ssl_preinfo_cipher_suite;
if (ssl3_SetCipherSuite(ss, suite_i) != SECSuccess) {
desc = internal_error;
errCode = PORT_GetError();
goto alert_loser;
}
goto suite_found;
}
}
@ -9375,6 +9464,8 @@ ssl3_EncodeCertificateRequestSigAlgs(sslSocket *ss, PRUint8 *buf,
unsigned maxLen, PRUint32 *len)
{
unsigned int i;
/* We only track a single hash, the one that is the basis for the PRF. */
SSLHashType suiteHashAlg = ssl3_GetSuitePrfHash(ss);
PORT_Assert(maxLen >= ss->ssl3.signatureAlgorithmCount * 2);
if (maxLen < ss->ssl3.signatureAlgorithmCount * 2) {
@ -9386,9 +9477,9 @@ ssl3_EncodeCertificateRequestSigAlgs(sslSocket *ss, PRUint8 *buf,
for (i = 0; i < ss->ssl3.signatureAlgorithmCount; ++i) {
const SSLSignatureAndHashAlg *alg = &ss->ssl3.signatureAlgorithms[i];
/* Note that we don't support a handshake hash with anything other than
* SHA-256, so asking for a signature from clients for something else
* would be inviting disaster. */
if (alg->hashAlg == ssl_hash_sha256) {
* the PRF hash, so asking for a signature from clients for something
* else would be inviting disaster. */
if (alg->hashAlg == suiteHashAlg) {
buf[(*len)++] = (PRUint8)alg->hashAlg;
buf[(*len)++] = (PRUint8)alg->sigAlg;
}
@ -9764,6 +9855,7 @@ ssl3_HandleRSAClientKeyExchange(sslSocket *ss,
rv = PK11_GenerateRandom(rsaPmsBuf, sizeof rsaPmsBuf);
}
}
#error not patched for SHA384, see bug 923089
/* have PMS, build MS without PKCS11 */
rv = ssl3_MasterSecretDeriveBypass(pwSpec, cr, sr, &pmsItem, isTLS,
PR_TRUE);
@ -10842,7 +10934,7 @@ done:
}
static SECStatus
ssl3_ComputeTLSFinished(ssl3CipherSpec *spec,
ssl3_ComputeTLSFinished(sslSocket *ss, ssl3CipherSpec *spec,
PRBool isServer,
const SSL3Hashes * hashes,
TLSFinished * tlsFinished)
@ -10865,7 +10957,7 @@ ssl3_ComputeTLSFinished(ssl3CipherSpec *spec,
if (spec->version < SSL_LIBRARY_VERSION_TLS_1_2) {
tls_mac_params.prfMechanism = CKM_TLS_PRF;
} else {
tls_mac_params.prfMechanism = CKM_SHA256;
tls_mac_params.prfMechanism = ssl3_GetTls12PrfHashMechanism(ss);
}
tls_mac_params.ulMacLength = 12;
tls_mac_params.ulServerOrClient = isServer ? 1 : 2;
@ -11067,7 +11159,7 @@ ssl3_SendFinished(sslSocket *ss, PRInt32 flags)
isTLS = (PRBool)(cwSpec->version > SSL_LIBRARY_VERSION_3_0);
rv = ssl3_ComputeHandshakeHashes(ss, cwSpec, &hashes, sender);
if (isTLS && rv == SECSuccess) {
rv = ssl3_ComputeTLSFinished(cwSpec, isServer, &hashes, &tlsFinished);
rv = ssl3_ComputeTLSFinished(ss, cwSpec, isServer, &hashes, &tlsFinished);
}
ssl_ReleaseSpecReadLock(ss);
if (rv != SECSuccess) {
@ -11238,7 +11330,7 @@ ssl3_HandleFinished(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
PORT_SetError(SSL_ERROR_RX_MALFORMED_FINISHED);
return SECFailure;
}
rv = ssl3_ComputeTLSFinished(ss->ssl3.crSpec, !isServer,
rv = ssl3_ComputeTLSFinished(ss, ss->ssl3.crSpec, !isServer,
hashes, &tlsFinished);
if (!isServer)
ss->ssl3.hs.finishedMsgs.tFinished[1] = tlsFinished;

2
security/nss/lib/ssl/ssl3ecc.c
View File

@ -930,6 +930,7 @@ static const ssl3CipherSuite ecdhe_rsa_suites[] = {
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
TLS_ECDHE_RSA_WITH_NULL_SHA,
TLS_ECDHE_RSA_WITH_RC4_128_SHA,
@ -949,6 +950,7 @@ static const ssl3CipherSuite ecSuites[] = {
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
TLS_ECDHE_RSA_WITH_NULL_SHA,
TLS_ECDHE_RSA_WITH_RC4_128_SHA,

1
security/nss/lib/ssl/sslenum.c
View File

@ -50,6 +50,7 @@ const PRUint16 SSL_ImplementedCiphers[] = {
#ifndef NSS_DISABLE_ECC
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
/* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA must appear before
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA to work around bug 946147.
*/

6
security/nss/lib/ssl/sslimpl.h
View File

@ -63,6 +63,7 @@ typedef SSLSignType SSL3SignType;
#define hmac_md5 ssl_hmac_md5
#define hmac_sha ssl_hmac_sha
#define hmac_sha256 ssl_hmac_sha256
#define hmac_sha384 ssl_hmac_sha384
#define mac_aead ssl_mac_aead
#define SET_ERROR_CODE /* reminder */
@ -291,7 +292,7 @@ typedef struct {
} ssl3CipherSuiteCfg;
#ifndef NSS_DISABLE_ECC
#define ssl_V3_SUITES_IMPLEMENTED 64
#define ssl_V3_SUITES_IMPLEMENTED 65
#else
#define ssl_V3_SUITES_IMPLEMENTED 40
#endif /* NSS_DISABLE_ECC */
@ -477,6 +478,7 @@ typedef enum {
cipher_camellia_256,
cipher_seed,
cipher_aes_128_gcm,
cipher_aes_256_gcm,
cipher_missing /* reserved for no such supported cipher */
/* This enum must match ssl3_cipherName[] in ssl3con.c. */
} SSL3BulkCipher;
@ -593,7 +595,7 @@ typedef struct {
ssl3KeyMaterial client;
ssl3KeyMaterial server;
SECItem msItem;
unsigned char key_block[NUM_MIXERS * MD5_LENGTH];
unsigned char key_block[NUM_MIXERS * HASH_LENGTH_MAX];
unsigned char raw_master_secret[56];
SECItem srvVirtName; /* for server: name that was negotiated
* with a client. For client - is

2
security/nss/lib/ssl/sslinfo.c
View File

@ -159,6 +159,7 @@ SSL_GetPreliminaryChannelInfo(PRFileDesc *fd,
#define B_0 0, 0, 0
#define M_AEAD_128 "AEAD", ssl_mac_aead, 128
#define M_SHA384 "SHA384", ssl_hmac_sha384, 384
#define M_SHA256 "SHA256", ssl_hmac_sha256, 256
#define M_SHA "SHA1", ssl_mac_sha, 160
#define M_MD5 "MD5", ssl_mac_md5, 128
@ -215,6 +216,7 @@ static const SSLCipherSuiteInfo suiteInfo[] = {
#ifndef NSS_DISABLE_ECC
/* ECC cipher suites */
{0,CS(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256), S_RSA, K_ECDHE, C_AESGCM, B_128, M_AEAD_128, 1, 0, 0, },
{0,CS(TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384), S_RSA, K_ECDHE, C_AESGCM, B_256, M_AEAD_128, 1, 0, 0, },
{0,CS(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256), S_ECDSA, K_ECDHE, C_AESGCM, B_128, M_AEAD_128, 1, 0, 0, },
{0,CS(TLS_ECDH_ECDSA_WITH_NULL_SHA), S_ECDSA, K_ECDH, C_NULL, B_0, M_SHA, 0, 0, 0, },

1
security/nss/lib/ssl/sslproto.h
View File

@ -258,6 +258,7 @@
#define TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0xC02B
#define TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 0xC02D
#define TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 0xC02F
#define TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 0xC030
#define TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 0xC031
/* Netscape "experimental" cipher suites. */

3
security/nss/lib/ssl/sslt.h
View File

@ -114,7 +114,8 @@ typedef enum {
ssl_hmac_md5 = 3, /* TLS HMAC version of mac_md5 */
ssl_hmac_sha = 4, /* TLS HMAC version of mac_sha */
ssl_hmac_sha256 = 5,
ssl_mac_aead = 6
ssl_mac_aead = 6,
ssl_hmac_sha384 = 7
} SSLMACAlgorithm;
typedef enum {

12
security/nss/lib/util/secoid.c
View File

@ -466,6 +466,7 @@ CONST_OID aes128_OFB[] = { AES, 3 };
CONST_OID aes128_CFB[] = { AES, 4 };
#endif
CONST_OID aes128_KEY_WRAP[] = { AES, 5 };
CONST_OID aes128_GCM[] = { AES, 6 };
CONST_OID aes192_ECB[] = { AES, 21 };
CONST_OID aes192_CBC[] = { AES, 22 };
@ -474,6 +475,7 @@ CONST_OID aes192_OFB[] = { AES, 23 };
CONST_OID aes192_CFB[] = { AES, 24 };
#endif
CONST_OID aes192_KEY_WRAP[] = { AES, 25 };
CONST_OID aes192_GCM[] = { AES, 26 };
CONST_OID aes256_ECB[] = { AES, 41 };
CONST_OID aes256_CBC[] = { AES, 42 };
@ -482,6 +484,7 @@ CONST_OID aes256_OFB[] = { AES, 43 };
CONST_OID aes256_CFB[] = { AES, 44 };
#endif
CONST_OID aes256_KEY_WRAP[] = { AES, 45 };
CONST_OID aes256_GCM[] = { AES, 46 };
CONST_OID camellia128_CBC[] = { CAMELLIA_ENCRYPT_OID, 2};
CONST_OID camellia192_CBC[] = { CAMELLIA_ENCRYPT_OID, 3};
@ -1639,7 +1642,14 @@ const static SECOidData oids[SEC_OID_TOTAL] = {
"Microsoft Trust List Signing",
CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
OD( x520Name, SEC_OID_AVA_NAME,
"X520 Name", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION )
"X520 Name", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
OD( aes128_GCM, SEC_OID_AES_128_GCM,
"AES-128-GCM", CKM_AES_GCM, INVALID_CERT_EXTENSION ),
OD( aes192_GCM, SEC_OID_AES_192_GCM,
"AES-192-GCM", CKM_AES_GCM, INVALID_CERT_EXTENSION ),
OD( aes256_GCM, SEC_OID_AES_256_GCM,
"AES-256-GCM", CKM_AES_GCM, INVALID_CERT_EXTENSION )
};
/* PRIVATE EXTENDED SECOID Table

4
security/nss/lib/util/secoidt.h
View File

@ -443,6 +443,10 @@ typedef enum {
/* The 'name' attribute type in X.520 */
SEC_OID_AVA_NAME = 317,
SEC_OID_AES_128_GCM = 318,
SEC_OID_AES_192_GCM = 319,
SEC_OID_AES_256_GCM = 320,
SEC_OID_TOTAL
} SECOidTag;