Add new security policy

[lrstewart]

Description of changes:

Adds a new versioned security policy intended to be FIPS compliant and support >=TLS1.2. Basically, I intend this policy as a sane default for customers that don't need to worry about supporting older peers. In particular, this should be useful for customers that own both the clients and servers in their system.

Call-outs:

I don't think these "sane defaults" should be too controversial, but I did:

• Exclude DHE. It requires additional configuration that customers need to manage, and ECDHE should really be preferred at this point.
• Prefer PSS over PKCS1 for RSA signatures, even for TLS1.2. I think this is the right choice, since PSS is more secure.
• Include CBC mode. I went back and forth on this one; GCM is preferred, but FIPS still includes CBC, so I ultimately decided to include it.

Testing:

I added some simple handshake tests to verify that handshake are possible between the new policy and existing defaults.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[torben-hansen]

looks good from my point of view

[toidiu]

Are you working from a FIPS RFC/compliance document when choosing these options?

[toidiu]

Are you working from a FIPS RFC/compliance document when choosing these options?

s2n-tls/tls/s2n_ecc_preferences.c

Lines 37 to 40 in f2faa0e

	* These curves were chosen based on the following specification:
	* https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf
	*/
	const struct s2n_ecc_named_curve *const s2n_ecc_pref_list_default_fips[] = {

I believe the document is https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf

Should the name of the policy then be some derivation of NIST.SP.800-52r2?

[lrstewart]

Are you working from a FIPS RFC/compliance document when choosing these options?

s2n-tls/tls/s2n_ecc_preferences.c

Lines 37 to 40 in f2faa0e

	* These curves were chosen based on the following specification:
	* https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf
	*/
	const struct s2n_ecc_named_curve *const s2n_ecc_pref_list_default_fips[] = {

I believe the document is https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf

Should the name of the policy then be some derivation of NIST.SP.800-52r2?

This policy is not explicitly following that standard document. It conforms to FIPS requirements, but only provides a subset of the available options. For example, it doesn't support DHE. We also won't update it, even in a way compliant with NIST.SP.800-52r2. It's intended as a default rather than a fips-only option; customers looking for any sane policy should choose it, rather than customer looking for FIPS. Therefore, I think it needs to be a traditionally named versioned policy.

[raycoll]

aes-cbc-hmac256 is typically a lot slower than aes-cbc-hmac-sha1 but pretty much all modern clients that care about performance support GCM anyway