git.prognetwork.ru/x0r/utls@v1.3.3/cipher_suites.go (about) 1 // Copyright 2010 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 package tls 6 7 import ( 8 "crypto" 9 "crypto/aes" 10 "crypto/cipher" 11 "crypto/des" 12 "crypto/hmac" 13 14 // "crypto/internal/boring" 15 "crypto/rc4" 16 "crypto/sha1" 17 "crypto/sha256" 18 "fmt" 19 "hash" 20 "runtime" 21 22 "git.prognetwork.ru/x0r/utls/cpu" 23 24 "golang.org/x/crypto/chacha20poly1305" 25 ) 26 27 // CipherSuite is a TLS cipher suite. Note that most functions in this package 28 // accept and expose cipher suite IDs instead of this type. 29 type CipherSuite struct { 30 ID uint16 31 Name string 32 33 // Supported versions is the list of TLS protocol versions that can 34 // negotiate this cipher suite. 35 SupportedVersions []uint16 36 37 // Insecure is true if the cipher suite has known security issues 38 // due to its primitives, design, or implementation. 39 Insecure bool 40 } 41 42 var ( 43 supportedUpToTLS12 = []uint16{VersionTLS10, VersionTLS11, VersionTLS12} 44 supportedOnlyTLS12 = []uint16{VersionTLS12} 45 supportedOnlyTLS13 = []uint16{VersionTLS13} 46 ) 47 48 // CipherSuites returns a list of cipher suites currently implemented by this 49 // package, excluding those with security issues, which are returned by 50 // InsecureCipherSuites. 51 // 52 // The list is sorted by ID. Note that the default cipher suites selected by 53 // this package might depend on logic that can't be captured by a static list, 54 // and might not match those returned by this function. 55 func CipherSuites() []*CipherSuite { 56 return []*CipherSuite{ 57 {TLS_RSA_WITH_AES_128_CBC_SHA, "TLS_RSA_WITH_AES_128_CBC_SHA", supportedUpToTLS12, false}, 58 {TLS_RSA_WITH_AES_256_CBC_SHA, "TLS_RSA_WITH_AES_256_CBC_SHA", supportedUpToTLS12, false}, 59 {TLS_RSA_WITH_AES_128_GCM_SHA256, "TLS_RSA_WITH_AES_128_GCM_SHA256", supportedOnlyTLS12, false}, 60 {TLS_RSA_WITH_AES_256_GCM_SHA384, "TLS_RSA_WITH_AES_256_GCM_SHA384", supportedOnlyTLS12, false}, 61 62 {TLS_AES_128_GCM_SHA256, "TLS_AES_128_GCM_SHA256", supportedOnlyTLS13, false}, 63 {TLS_AES_256_GCM_SHA384, "TLS_AES_256_GCM_SHA384", supportedOnlyTLS13, false}, 64 {TLS_CHACHA20_POLY1305_SHA256, "TLS_CHACHA20_POLY1305_SHA256", supportedOnlyTLS13, false}, 65 66 {TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", supportedUpToTLS12, false}, 67 {TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", supportedUpToTLS12, false}, 68 {TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", supportedUpToTLS12, false}, 69 {TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", supportedUpToTLS12, false}, 70 {TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", supportedOnlyTLS12, false}, 71 {TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", supportedOnlyTLS12, false}, 72 {TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", supportedOnlyTLS12, false}, 73 {TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", supportedOnlyTLS12, false}, 74 {TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", supportedOnlyTLS12, false}, 75 {TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", supportedOnlyTLS12, false}, 76 } 77 } 78 79 // InsecureCipherSuites returns a list of cipher suites currently implemented by 80 // this package and which have security issues. 81 // 82 // Most applications should not use the cipher suites in this list, and should 83 // only use those returned by CipherSuites. 84 func InsecureCipherSuites() []*CipherSuite { 85 // This list includes RC4, CBC_SHA256, and 3DES cipher suites. See 86 // cipherSuitesPreferenceOrder for details. 87 return []*CipherSuite{ 88 {TLS_RSA_WITH_RC4_128_SHA, "TLS_RSA_WITH_RC4_128_SHA", supportedUpToTLS12, true}, 89 {TLS_RSA_WITH_3DES_EDE_CBC_SHA, "TLS_RSA_WITH_3DES_EDE_CBC_SHA", supportedUpToTLS12, true}, 90 {TLS_RSA_WITH_AES_128_CBC_SHA256, "TLS_RSA_WITH_AES_128_CBC_SHA256", supportedOnlyTLS12, true}, 91 {TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", supportedUpToTLS12, true}, 92 {TLS_ECDHE_RSA_WITH_RC4_128_SHA, "TLS_ECDHE_RSA_WITH_RC4_128_SHA", supportedUpToTLS12, true}, 93 {TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", supportedUpToTLS12, true}, 94 {TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", supportedOnlyTLS12, true}, 95 {TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", supportedOnlyTLS12, true}, 96 } 97 } 98 99 // CipherSuiteName returns the standard name for the passed cipher suite ID 100 // (e.g. "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"), or a fallback representation 101 // of the ID value if the cipher suite is not implemented by this package. 102 func CipherSuiteName(id uint16) string { 103 for _, c := range CipherSuites() { 104 if c.ID == id { 105 return c.Name 106 } 107 } 108 for _, c := range InsecureCipherSuites() { 109 if c.ID == id { 110 return c.Name 111 } 112 } 113 return fmt.Sprintf("0x%04X", id) 114 } 115 116 const ( 117 // suiteECDHE indicates that the cipher suite involves elliptic curve 118 // Diffie-Hellman. This means that it should only be selected when the 119 // client indicates that it supports ECC with a curve and point format 120 // that we're happy with. 121 suiteECDHE = 1 << iota 122 // suiteECSign indicates that the cipher suite involves an ECDSA or 123 // EdDSA signature and therefore may only be selected when the server's 124 // certificate is ECDSA or EdDSA. If this is not set then the cipher suite 125 // is RSA based. 126 suiteECSign 127 // suiteTLS12 indicates that the cipher suite should only be advertised 128 // and accepted when using TLS 1.2. 129 suiteTLS12 130 // suiteSHA384 indicates that the cipher suite uses SHA384 as the 131 // handshake hash. 132 suiteSHA384 133 ) 134 135 // A cipherSuite is a TLS 1.0–1.2 cipher suite, and defines the key exchange 136 // mechanism, as well as the cipher+MAC pair or the AEAD. 137 type cipherSuite struct { 138 id uint16 139 // the lengths, in bytes, of the key material needed for each component. 140 keyLen int 141 macLen int 142 ivLen int 143 ka func(version uint16) keyAgreement 144 // flags is a bitmask of the suite* values, above. 145 flags int 146 cipher func(key, iv []byte, isRead bool) any 147 mac func(key []byte) hash.Hash 148 aead func(key, fixedNonce []byte) aead 149 } 150 151 var cipherSuites = []*cipherSuite{ // TODO: replace with a map, since the order doesn't matter. 152 {TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, 32, 0, 12, ecdheRSAKA, suiteECDHE | suiteTLS12, nil, nil, aeadChaCha20Poly1305}, 153 {TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, 32, 0, 12, ecdheECDSAKA, suiteECDHE | suiteECSign | suiteTLS12, nil, nil, aeadChaCha20Poly1305}, 154 {TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 16, 0, 4, ecdheRSAKA, suiteECDHE | suiteTLS12, nil, nil, aeadAESGCM}, 155 {TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 16, 0, 4, ecdheECDSAKA, suiteECDHE | suiteECSign | suiteTLS12, nil, nil, aeadAESGCM}, 156 {TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, 32, 0, 4, ecdheRSAKA, suiteECDHE | suiteTLS12 | suiteSHA384, nil, nil, aeadAESGCM}, 157 {TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, 32, 0, 4, ecdheECDSAKA, suiteECDHE | suiteECSign | suiteTLS12 | suiteSHA384, nil, nil, aeadAESGCM}, 158 {TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, 16, 32, 16, ecdheRSAKA, suiteECDHE | suiteTLS12, cipherAES, macSHA256, nil}, 159 {TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, 16, 20, 16, ecdheRSAKA, suiteECDHE, cipherAES, macSHA1, nil}, 160 {TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, 16, 32, 16, ecdheECDSAKA, suiteECDHE | suiteECSign | suiteTLS12, cipherAES, macSHA256, nil}, 161 {TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, 16, 20, 16, ecdheECDSAKA, suiteECDHE | suiteECSign, cipherAES, macSHA1, nil}, 162 {TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, 32, 20, 16, ecdheRSAKA, suiteECDHE, cipherAES, macSHA1, nil}, 163 {TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, 32, 20, 16, ecdheECDSAKA, suiteECDHE | suiteECSign, cipherAES, macSHA1, nil}, 164 {TLS_RSA_WITH_AES_128_GCM_SHA256, 16, 0, 4, rsaKA, suiteTLS12, nil, nil, aeadAESGCM}, 165 {TLS_RSA_WITH_AES_256_GCM_SHA384, 32, 0, 4, rsaKA, suiteTLS12 | suiteSHA384, nil, nil, aeadAESGCM}, 166 {TLS_RSA_WITH_AES_128_CBC_SHA256, 16, 32, 16, rsaKA, suiteTLS12, cipherAES, macSHA256, nil}, 167 {TLS_RSA_WITH_AES_128_CBC_SHA, 16, 20, 16, rsaKA, 0, cipherAES, macSHA1, nil}, 168 {TLS_RSA_WITH_AES_256_CBC_SHA, 32, 20, 16, rsaKA, 0, cipherAES, macSHA1, nil}, 169 {TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, 24, 20, 8, ecdheRSAKA, suiteECDHE, cipher3DES, macSHA1, nil}, 170 {TLS_RSA_WITH_3DES_EDE_CBC_SHA, 24, 20, 8, rsaKA, 0, cipher3DES, macSHA1, nil}, 171 {TLS_RSA_WITH_RC4_128_SHA, 16, 20, 0, rsaKA, 0, cipherRC4, macSHA1, nil}, 172 {TLS_ECDHE_RSA_WITH_RC4_128_SHA, 16, 20, 0, ecdheRSAKA, suiteECDHE, cipherRC4, macSHA1, nil}, 173 {TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, 16, 20, 0, ecdheECDSAKA, suiteECDHE | suiteECSign, cipherRC4, macSHA1, nil}, 174 } 175 176 // selectCipherSuite returns the first TLS 1.0–1.2 cipher suite from ids which 177 // is also in supportedIDs and passes the ok filter. 178 func selectCipherSuite(ids, supportedIDs []uint16, ok func(*cipherSuite) bool) *cipherSuite { 179 for _, id := range ids { 180 candidate := cipherSuiteByID(id) 181 if candidate == nil || !ok(candidate) { 182 continue 183 } 184 185 for _, suppID := range supportedIDs { 186 if id == suppID { 187 return candidate 188 } 189 } 190 } 191 return nil 192 } 193 194 // A cipherSuiteTLS13 defines only the pair of the AEAD algorithm and hash 195 // algorithm to be used with HKDF. See RFC 8446, Appendix B.4. 196 type cipherSuiteTLS13 struct { 197 id uint16 198 keyLen int 199 aead func(key, fixedNonce []byte) aead 200 hash crypto.Hash 201 } 202 203 var cipherSuitesTLS13 = []*cipherSuiteTLS13{ // TODO: replace with a map. 204 {TLS_AES_128_GCM_SHA256, 16, aeadAESGCMTLS13, crypto.SHA256}, 205 {TLS_CHACHA20_POLY1305_SHA256, 32, aeadChaCha20Poly1305, crypto.SHA256}, 206 {TLS_AES_256_GCM_SHA384, 32, aeadAESGCMTLS13, crypto.SHA384}, 207 } 208 209 // cipherSuitesPreferenceOrder is the order in which we'll select (on the 210 // server) or advertise (on the client) TLS 1.0–1.2 cipher suites. 211 // 212 // Cipher suites are filtered but not reordered based on the application and 213 // peer's preferences, meaning we'll never select a suite lower in this list if 214 // any higher one is available. This makes it more defensible to keep weaker 215 // cipher suites enabled, especially on the server side where we get the last 216 // word, since there are no known downgrade attacks on cipher suites selection. 217 // 218 // The list is sorted by applying the following priority rules, stopping at the 219 // first (most important) applicable one: 220 // 221 // - Anything else comes before RC4 222 // 223 // RC4 has practically exploitable biases. See https://www.rc4nomore.com. 224 // 225 // - Anything else comes before CBC_SHA256 226 // 227 // SHA-256 variants of the CBC ciphersuites don't implement any Lucky13 228 // countermeasures. See http://www.isg.rhul.ac.uk/tls/Lucky13.html and 229 // https://www.imperialviolet.org/2013/02/04/luckythirteen.html. 230 // 231 // - Anything else comes before 3DES 232 // 233 // 3DES has 64-bit blocks, which makes it fundamentally susceptible to 234 // birthday attacks. See https://sweet32.info. 235 // 236 // - ECDHE comes before anything else 237 // 238 // Once we got the broken stuff out of the way, the most important 239 // property a cipher suite can have is forward secrecy. We don't 240 // implement FFDHE, so that means ECDHE. 241 // 242 // - AEADs come before CBC ciphers 243 // 244 // Even with Lucky13 countermeasures, MAC-then-Encrypt CBC cipher suites 245 // are fundamentally fragile, and suffered from an endless sequence of 246 // padding oracle attacks. See https://eprint.iacr.org/2015/1129, 247 // https://www.imperialviolet.org/2014/12/08/poodleagain.html, and 248 // https://blog.cloudflare.com/yet-another-padding-oracle-in-openssl-cbc-ciphersuites/. 249 // 250 // - AES comes before ChaCha20 251 // 252 // When AES hardware is available, AES-128-GCM and AES-256-GCM are faster 253 // than ChaCha20Poly1305. 254 // 255 // When AES hardware is not available, AES-128-GCM is one or more of: much 256 // slower, way more complex, and less safe (because not constant time) 257 // than ChaCha20Poly1305. 258 // 259 // We use this list if we think both peers have AES hardware, and 260 // cipherSuitesPreferenceOrderNoAES otherwise. 261 // 262 // - AES-128 comes before AES-256 263 // 264 // The only potential advantages of AES-256 are better multi-target 265 // margins, and hypothetical post-quantum properties. Neither apply to 266 // TLS, and AES-256 is slower due to its four extra rounds (which don't 267 // contribute to the advantages above). 268 // 269 // - ECDSA comes before RSA 270 // 271 // The relative order of ECDSA and RSA cipher suites doesn't matter, 272 // as they depend on the certificate. Pick one to get a stable order. 273 var cipherSuitesPreferenceOrder = []uint16{ 274 // AEADs w/ ECDHE 275 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 276 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, 277 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, 278 279 // CBC w/ ECDHE 280 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, 281 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, 282 283 // AEADs w/o ECDHE 284 TLS_RSA_WITH_AES_128_GCM_SHA256, 285 TLS_RSA_WITH_AES_256_GCM_SHA384, 286 287 // CBC w/o ECDHE 288 TLS_RSA_WITH_AES_128_CBC_SHA, 289 TLS_RSA_WITH_AES_256_CBC_SHA, 290 291 // 3DES 292 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, 293 TLS_RSA_WITH_3DES_EDE_CBC_SHA, 294 295 // CBC_SHA256 296 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, 297 TLS_RSA_WITH_AES_128_CBC_SHA256, 298 299 // RC4 300 TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, 301 TLS_RSA_WITH_RC4_128_SHA, 302 } 303 304 var cipherSuitesPreferenceOrderNoAES = []uint16{ 305 // ChaCha20Poly1305 306 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, 307 308 // AES-GCM w/ ECDHE 309 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 310 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, 311 312 // The rest of cipherSuitesPreferenceOrder. 313 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, 314 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, 315 TLS_RSA_WITH_AES_128_GCM_SHA256, 316 TLS_RSA_WITH_AES_256_GCM_SHA384, 317 TLS_RSA_WITH_AES_128_CBC_SHA, 318 TLS_RSA_WITH_AES_256_CBC_SHA, 319 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, 320 TLS_RSA_WITH_3DES_EDE_CBC_SHA, 321 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, 322 TLS_RSA_WITH_AES_128_CBC_SHA256, 323 TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, 324 TLS_RSA_WITH_RC4_128_SHA, 325 } 326 327 // disabledCipherSuites are not used unless explicitly listed in 328 // Config.CipherSuites. They MUST be at the end of cipherSuitesPreferenceOrder. 329 var disabledCipherSuites = []uint16{ 330 // CBC_SHA256 331 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, 332 TLS_RSA_WITH_AES_128_CBC_SHA256, 333 334 // RC4 335 TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, 336 TLS_RSA_WITH_RC4_128_SHA, 337 } 338 339 var ( 340 defaultCipherSuitesLen = len(cipherSuitesPreferenceOrder) - len(disabledCipherSuites) 341 defaultCipherSuites = cipherSuitesPreferenceOrder[:defaultCipherSuitesLen] 342 ) 343 344 // defaultCipherSuitesTLS13 is also the preference order, since there are no 345 // disabled by default TLS 1.3 cipher suites. The same AES vs ChaCha20 logic as 346 // cipherSuitesPreferenceOrder applies. 347 var defaultCipherSuitesTLS13 = []uint16{ 348 TLS_AES_128_GCM_SHA256, 349 TLS_AES_256_GCM_SHA384, 350 TLS_CHACHA20_POLY1305_SHA256, 351 } 352 353 var defaultCipherSuitesTLS13NoAES = []uint16{ 354 TLS_CHACHA20_POLY1305_SHA256, 355 TLS_AES_128_GCM_SHA256, 356 TLS_AES_256_GCM_SHA384, 357 } 358 359 var ( 360 hasGCMAsmAMD64 = cpu.X86.HasAES && cpu.X86.HasPCLMULQDQ 361 hasGCMAsmARM64 = cpu.ARM64.HasAES && cpu.ARM64.HasPMULL 362 // Keep in sync with crypto/aes/cipher_s390x.go. 363 hasGCMAsmS390X = cpu.S390X.HasAES && cpu.S390X.HasAESCBC && cpu.S390X.HasAESCTR && 364 (cpu.S390X.HasGHASH || cpu.S390X.HasAESGCM) 365 366 hasAESGCMHardwareSupport = runtime.GOARCH == "amd64" && hasGCMAsmAMD64 || 367 runtime.GOARCH == "arm64" && hasGCMAsmARM64 || 368 runtime.GOARCH == "s390x" && hasGCMAsmS390X 369 ) 370 371 var aesgcmCiphers = map[uint16]bool{ 372 // TLS 1.2 373 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: true, 374 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: true, 375 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: true, 376 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: true, 377 // TLS 1.3 378 TLS_AES_128_GCM_SHA256: true, 379 TLS_AES_256_GCM_SHA384: true, 380 } 381 382 var nonAESGCMAEADCiphers = map[uint16]bool{ 383 // TLS 1.2 384 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305: true, 385 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305: true, 386 // TLS 1.3 387 TLS_CHACHA20_POLY1305_SHA256: true, 388 } 389 390 // aesgcmPreferred returns whether the first known cipher in the preference list 391 // is an AES-GCM cipher, implying the peer has hardware support for it. 392 func aesgcmPreferred(ciphers []uint16) bool { 393 for _, cID := range ciphers { 394 if c := cipherSuiteByID(cID); c != nil { 395 return aesgcmCiphers[cID] 396 } 397 if c := cipherSuiteTLS13ByID(cID); c != nil { 398 return aesgcmCiphers[cID] 399 } 400 } 401 return false 402 } 403 404 func cipherRC4(key, iv []byte, isRead bool) any { 405 cipher, _ := rc4.NewCipher(key) 406 return cipher 407 } 408 409 func cipher3DES(key, iv []byte, isRead bool) any { 410 block, _ := des.NewTripleDESCipher(key) 411 if isRead { 412 return cipher.NewCBCDecrypter(block, iv) 413 } 414 return cipher.NewCBCEncrypter(block, iv) 415 } 416 417 func cipherAES(key, iv []byte, isRead bool) any { 418 block, _ := aes.NewCipher(key) 419 if isRead { 420 return cipher.NewCBCDecrypter(block, iv) 421 } 422 return cipher.NewCBCEncrypter(block, iv) 423 } 424 425 // macSHA1 returns a SHA-1 based constant time MAC. 426 func macSHA1(key []byte) hash.Hash { 427 h := sha1.New 428 // The BoringCrypto SHA1 does not have a constant-time 429 // checksum function, so don't try to use it. 430 if !boring.Enabled { 431 h = newConstantTimeHash(h) 432 } 433 return hmac.New(h, key) 434 } 435 436 // macSHA256 returns a SHA-256 based MAC. This is only supported in TLS 1.2 and 437 // is currently only used in disabled-by-default cipher suites. 438 func macSHA256(key []byte) hash.Hash { 439 return hmac.New(sha256.New, key) 440 } 441 442 type aead interface { 443 cipher.AEAD 444 445 // explicitNonceLen returns the number of bytes of explicit nonce 446 // included in each record. This is eight for older AEADs and 447 // zero for modern ones. 448 explicitNonceLen() int 449 } 450 451 const ( 452 aeadNonceLength = 12 453 noncePrefixLength = 4 454 ) 455 456 // prefixNonceAEAD wraps an AEAD and prefixes a fixed portion of the nonce to 457 // each call. 458 type prefixNonceAEAD struct { 459 // nonce contains the fixed part of the nonce in the first four bytes. 460 nonce [aeadNonceLength]byte 461 aead cipher.AEAD 462 } 463 464 func (f *prefixNonceAEAD) NonceSize() int { return aeadNonceLength - noncePrefixLength } 465 func (f *prefixNonceAEAD) Overhead() int { return f.aead.Overhead() } 466 func (f *prefixNonceAEAD) explicitNonceLen() int { return f.NonceSize() } 467 468 func (f *prefixNonceAEAD) Seal(out, nonce, plaintext, additionalData []byte) []byte { 469 copy(f.nonce[4:], nonce) 470 return f.aead.Seal(out, f.nonce[:], plaintext, additionalData) 471 } 472 473 func (f *prefixNonceAEAD) Open(out, nonce, ciphertext, additionalData []byte) ([]byte, error) { 474 copy(f.nonce[4:], nonce) 475 return f.aead.Open(out, f.nonce[:], ciphertext, additionalData) 476 } 477 478 // xoredNonceAEAD wraps an AEAD by XORing in a fixed pattern to the nonce 479 // before each call. 480 type xorNonceAEAD struct { 481 nonceMask [aeadNonceLength]byte 482 aead cipher.AEAD 483 } 484 485 func (f *xorNonceAEAD) NonceSize() int { return 8 } // 64-bit sequence number 486 func (f *xorNonceAEAD) Overhead() int { return f.aead.Overhead() } 487 func (f *xorNonceAEAD) explicitNonceLen() int { return 0 } 488 489 func (f *xorNonceAEAD) Seal(out, nonce, plaintext, additionalData []byte) []byte { 490 for i, b := range nonce { 491 f.nonceMask[4+i] ^= b 492 } 493 result := f.aead.Seal(out, f.nonceMask[:], plaintext, additionalData) 494 for i, b := range nonce { 495 f.nonceMask[4+i] ^= b 496 } 497 498 return result 499 } 500 501 func (f *xorNonceAEAD) Open(out, nonce, ciphertext, additionalData []byte) ([]byte, error) { 502 for i, b := range nonce { 503 f.nonceMask[4+i] ^= b 504 } 505 result, err := f.aead.Open(out, f.nonceMask[:], ciphertext, additionalData) 506 for i, b := range nonce { 507 f.nonceMask[4+i] ^= b 508 } 509 510 return result, err 511 } 512 513 func aeadAESGCM(key, noncePrefix []byte) aead { 514 if len(noncePrefix) != noncePrefixLength { 515 panic("tls: internal error: wrong nonce length") 516 } 517 aes, err := aes.NewCipher(key) 518 if err != nil { 519 panic(err) 520 } 521 var aead cipher.AEAD 522 if boring.Enabled { 523 aead, err = boring.NewGCMTLS(aes) 524 } else { 525 boring.Unreachable() 526 aead, err = cipher.NewGCM(aes) 527 } 528 if err != nil { 529 panic(err) 530 } 531 532 ret := &prefixNonceAEAD{aead: aead} 533 copy(ret.nonce[:], noncePrefix) 534 return ret 535 } 536 537 func aeadAESGCMTLS13(key, nonceMask []byte) aead { 538 if len(nonceMask) != aeadNonceLength { 539 panic("tls: internal error: wrong nonce length") 540 } 541 aes, err := aes.NewCipher(key) 542 if err != nil { 543 panic(err) 544 } 545 aead, err := cipher.NewGCM(aes) 546 if err != nil { 547 panic(err) 548 } 549 550 ret := &xorNonceAEAD{aead: aead} 551 copy(ret.nonceMask[:], nonceMask) 552 return ret 553 } 554 555 func aeadChaCha20Poly1305(key, nonceMask []byte) aead { 556 if len(nonceMask) != aeadNonceLength { 557 panic("tls: internal error: wrong nonce length") 558 } 559 aead, err := chacha20poly1305.New(key) 560 if err != nil { 561 panic(err) 562 } 563 564 ret := &xorNonceAEAD{aead: aead} 565 copy(ret.nonceMask[:], nonceMask) 566 return ret 567 } 568 569 type constantTimeHash interface { 570 hash.Hash 571 ConstantTimeSum(b []byte) []byte 572 } 573 574 // cthWrapper wraps any hash.Hash that implements ConstantTimeSum, and replaces 575 // with that all calls to Sum. It's used to obtain a ConstantTimeSum-based HMAC. 576 type cthWrapper struct { 577 h constantTimeHash 578 } 579 580 func (c *cthWrapper) Size() int { return c.h.Size() } 581 func (c *cthWrapper) BlockSize() int { return c.h.BlockSize() } 582 func (c *cthWrapper) Reset() { c.h.Reset() } 583 func (c *cthWrapper) Write(p []byte) (int, error) { return c.h.Write(p) } 584 func (c *cthWrapper) Sum(b []byte) []byte { return c.h.ConstantTimeSum(b) } 585 586 func newConstantTimeHash(h func() hash.Hash) func() hash.Hash { 587 boring.Unreachable() 588 return func() hash.Hash { 589 return &cthWrapper{h().(constantTimeHash)} 590 } 591 } 592 593 // tls10MAC implements the TLS 1.0 MAC function. RFC 2246, Section 6.2.3. 594 func tls10MAC(h hash.Hash, out, seq, header, data, extra []byte) []byte { 595 h.Reset() 596 h.Write(seq) 597 h.Write(header) 598 h.Write(data) 599 res := h.Sum(out) 600 if extra != nil { 601 h.Write(extra) 602 } 603 return res 604 } 605 606 func rsaKA(version uint16) keyAgreement { 607 return rsaKeyAgreement{} 608 } 609 610 func ecdheECDSAKA(version uint16) keyAgreement { 611 return &ecdheKeyAgreement{ 612 isRSA: false, 613 version: version, 614 } 615 } 616 617 func ecdheRSAKA(version uint16) keyAgreement { 618 return &ecdheKeyAgreement{ 619 isRSA: true, 620 version: version, 621 } 622 } 623 624 // mutualCipherSuite returns a cipherSuite given a list of supported 625 // ciphersuites and the id requested by the peer. 626 func mutualCipherSuite(have []uint16, want uint16) *cipherSuite { 627 for _, id := range have { 628 if id == want { 629 return cipherSuiteByID(id) 630 } 631 } 632 return nil 633 } 634 635 func cipherSuiteByID(id uint16) *cipherSuite { 636 for _, cipherSuite := range utlsSupportedCipherSuites { 637 if cipherSuite.id == id { 638 return cipherSuite 639 } 640 } 641 return nil 642 } 643 644 func mutualCipherSuiteTLS13(have []uint16, want uint16) *cipherSuiteTLS13 { 645 for _, id := range have { 646 if id == want { 647 return cipherSuiteTLS13ByID(id) 648 } 649 } 650 return nil 651 } 652 653 func cipherSuiteTLS13ByID(id uint16) *cipherSuiteTLS13 { 654 for _, cipherSuite := range cipherSuitesTLS13 { 655 if cipherSuite.id == id { 656 return cipherSuite 657 } 658 } 659 return nil 660 } 661 662 // A list of cipher suite IDs that are, or have been, implemented by this 663 // package. 664 // 665 // See https://www.iana.org/assignments/tls-parameters/tls-parameters.xml 666 const ( 667 // TLS 1.0 - 1.2 cipher suites. 668 TLS_RSA_WITH_RC4_128_SHA uint16 = 0x0005 669 TLS_RSA_WITH_3DES_EDE_CBC_SHA uint16 = 0x000a 670 TLS_RSA_WITH_AES_128_CBC_SHA uint16 = 0x002f 671 TLS_RSA_WITH_AES_256_CBC_SHA uint16 = 0x0035 672 TLS_RSA_WITH_AES_128_CBC_SHA256 uint16 = 0x003c 673 TLS_RSA_WITH_AES_128_GCM_SHA256 uint16 = 0x009c 674 TLS_RSA_WITH_AES_256_GCM_SHA384 uint16 = 0x009d 675 TLS_ECDHE_ECDSA_WITH_RC4_128_SHA uint16 = 0xc007 676 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA uint16 = 0xc009 677 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA uint16 = 0xc00a 678 TLS_ECDHE_RSA_WITH_RC4_128_SHA uint16 = 0xc011 679 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA uint16 = 0xc012 680 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA uint16 = 0xc013 681 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA uint16 = 0xc014 682 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 uint16 = 0xc023 683 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 uint16 = 0xc027 684 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 uint16 = 0xc02f 685 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 uint16 = 0xc02b 686 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 uint16 = 0xc030 687 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 uint16 = 0xc02c 688 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 uint16 = 0xcca8 689 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 uint16 = 0xcca9 690 691 // TLS 1.3 cipher suites. 692 TLS_AES_128_GCM_SHA256 uint16 = 0x1301 693 TLS_AES_256_GCM_SHA384 uint16 = 0x1302 694 TLS_CHACHA20_POLY1305_SHA256 uint16 = 0x1303 695 696 // TLS_FALLBACK_SCSV isn't a standard cipher suite but an indicator 697 // that the client is doing version fallback. See RFC 7507. 698 TLS_FALLBACK_SCSV uint16 = 0x5600 699 700 // Legacy names for the corresponding cipher suites with the correct _SHA256 701 // suffix, retained for backward compatibility. 702 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 = TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 703 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 = TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 704 )