Skip to content

Commit

Permalink
Reimplement brainpool TLSv1.3 support group support
Browse files Browse the repository at this point in the history 
Create new TLS_GROUP_ENTRY values for these groups.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from #19315)
  • Loading branch information
@mattcaswell
mattcaswell committed Oct 7, 2022
1 parent 16f0e91 commit c9ee6e3
Show file tree
Hide file tree
Showing 9 changed files with 52 additions and 11 deletions.
15 changes: 12 additions & 3 deletions crypto/objects/obj_dat.h
View file
Expand Up @@ -1154,7 +1154,7 @@ static const unsigned char so[8356] = {
0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x09,0x10,0x01,0x32, /* [ 8344] OBJ_id_ct_signedTAL */
};

#define NUM_NID 1285
#define NUM_NID 1288
static const ASN1_OBJECT nid_objs[NUM_NID] = {
{"UNDEF", "undefined", NID_undef},
{"rsadsi", "RSA Data Security, Inc.", NID_rsadsi, 6, &so[0]},
Expand Down Expand Up @@ -2441,9 +2441,12 @@ static const ASN1_OBJECT nid_objs[NUM_NID] = {
{"oracle-organization", "Oracle organization", NID_oracle, 7, &so[8325]},
{"oracle-jdk-trustedkeyusage", "Trusted key usage (Oracle)", NID_oracle_jdk_trustedkeyusage, 12, &so[8332]},
{"id-ct-signedTAL", "id-ct-signedTAL", NID_id_ct_signedTAL, 11, &so[8344]},
{"brainpoolP256r1tls13", "brainpoolP256r1tls13", NID_brainpoolP256r1tls13},
{"brainpoolP384r1tls13", "brainpoolP384r1tls13", NID_brainpoolP384r1tls13},
{"brainpoolP512r1tls13", "brainpoolP512r1tls13", NID_brainpoolP512r1tls13},
};

#define NUM_SN 1276
#define NUM_SN 1279
static const unsigned int sn_objs[NUM_SN] = {
364, /* "AD_DVCS" */
419, /* "AES-128-CBC" */
Expand Down Expand Up @@ -2781,12 +2784,15 @@ static const unsigned int sn_objs[NUM_SN] = {
925, /* "brainpoolP224r1" */
926, /* "brainpoolP224t1" */
927, /* "brainpoolP256r1" */
1285, /* "brainpoolP256r1tls13" */
928, /* "brainpoolP256t1" */
929, /* "brainpoolP320r1" */
930, /* "brainpoolP320t1" */
931, /* "brainpoolP384r1" */
1286, /* "brainpoolP384r1tls13" */
932, /* "brainpoolP384t1" */
933, /* "brainpoolP512r1" */
1287, /* "brainpoolP512r1tls13" */
934, /* "brainpoolP512t1" */
494, /* "buildingName" */
860, /* "businessCategory" */
Expand Down Expand Up @@ -3723,7 +3729,7 @@ static const unsigned int sn_objs[NUM_SN] = {
1093, /* "x509ExtAdmission" */
};

#define NUM_LN 1276
#define NUM_LN 1279
static const unsigned int ln_objs[NUM_LN] = {
363, /* "AD Time Stamping" */
405, /* "ANSI X9.62" */
Expand Down Expand Up @@ -4057,12 +4063,15 @@ static const unsigned int ln_objs[NUM_LN] = {
925, /* "brainpoolP224r1" */
926, /* "brainpoolP224t1" */
927, /* "brainpoolP256r1" */
1285, /* "brainpoolP256r1tls13" */
928, /* "brainpoolP256t1" */
929, /* "brainpoolP320r1" */
930, /* "brainpoolP320t1" */
931, /* "brainpoolP384r1" */
1286, /* "brainpoolP384r1tls13" */
932, /* "brainpoolP384t1" */
933, /* "brainpoolP512r1" */
1287, /* "brainpoolP512r1tls13" */
934, /* "brainpoolP512t1" */
494, /* "buildingName" */
860, /* "businessCategory" */
Expand Down
3 changes: 3 additions & 0 deletions crypto/objects/obj_mac.num
View file
Expand Up @@ -1282,3 +1282,6 @@ hmacWithSM3 1281
oracle 1282
oracle_jdk_trustedkeyusage 1283
id_ct_signedTAL 1284
brainpoolP256r1tls13 1285
brainpoolP384r1tls13 1286
brainpoolP512r1tls13 1287
6 changes: 6 additions & 0 deletions crypto/objects/objects.txt
View file
Expand Up @@ -1643,12 +1643,18 @@ ISO-US 10046 2 1 : dhpublicnumber : X9.42 DH
1 3 36 3 3 2 8 1 1 5 : brainpoolP224r1
1 3 36 3 3 2 8 1 1 6 : brainpoolP224t1
1 3 36 3 3 2 8 1 1 7 : brainpoolP256r1
# Alternate NID to represent the TLSv1.3 brainpoolP256r1 group
: brainpoolP256r1tls13
1 3 36 3 3 2 8 1 1 8 : brainpoolP256t1
1 3 36 3 3 2 8 1 1 9 : brainpoolP320r1
1 3 36 3 3 2 8 1 1 10 : brainpoolP320t1
1 3 36 3 3 2 8 1 1 11 : brainpoolP384r1
# Alternate NID to represent the TLSv1.3 brainpoolP384r1 group
: brainpoolP384r1tls13
1 3 36 3 3 2 8 1 1 12 : brainpoolP384t1
1 3 36 3 3 2 8 1 1 13 : brainpoolP512r1
# Alternate NID to represent the TLSv1.3 brainpoolP512r1 group
: brainpoolP512r1tls13
1 3 36 3 3 2 8 1 1 14 : brainpoolP512t1

# ECDH schemes from RFC5753
Expand Down
9 changes: 9 additions & 0 deletions include/openssl/obj_mac.h
View file
Expand Up @@ -5171,6 +5171,9 @@
#define NID_brainpoolP256r1 927
#define OBJ_brainpoolP256r1 1L,3L,36L,3L,3L,2L,8L,1L,1L,7L

#define SN_brainpoolP256r1tls13 "brainpoolP256r1tls13"
#define NID_brainpoolP256r1tls13 1285

#define SN_brainpoolP256t1 "brainpoolP256t1"
#define NID_brainpoolP256t1 928
#define OBJ_brainpoolP256t1 1L,3L,36L,3L,3L,2L,8L,1L,1L,8L
Expand All @@ -5187,6 +5190,9 @@
#define NID_brainpoolP384r1 931
#define OBJ_brainpoolP384r1 1L,3L,36L,3L,3L,2L,8L,1L,1L,11L

#define SN_brainpoolP384r1tls13 "brainpoolP384r1tls13"
#define NID_brainpoolP384r1tls13 1286

#define SN_brainpoolP384t1 "brainpoolP384t1"
#define NID_brainpoolP384t1 932
#define OBJ_brainpoolP384t1 1L,3L,36L,3L,3L,2L,8L,1L,1L,12L
Expand All @@ -5195,6 +5201,9 @@
#define NID_brainpoolP512r1 933
#define OBJ_brainpoolP512r1 1L,3L,36L,3L,3L,2L,8L,1L,1L,13L

#define SN_brainpoolP512r1tls13 "brainpoolP512r1tls13"
#define NID_brainpoolP512r1tls13 1287

#define SN_brainpoolP512t1 "brainpoolP512t1"
#define NID_brainpoolP512t1 934
#define OBJ_brainpoolP512t1 1L,3L,36L,3L,3L,2L,8L,1L,1L,14L
Expand Down
20 changes: 14 additions & 6 deletions providers/common/capabilities.c
View file
Expand Up @@ -30,7 +30,7 @@ typedef struct tls_group_constants_st {
int maxdtls; /* Maximum DTLS version (or 0 for undefined) */
} TLS_GROUP_CONSTANTS;

static const TLS_GROUP_CONSTANTS group_list[35] = {
static const TLS_GROUP_CONSTANTS group_list[] = {
{ OSSL_TLS_GROUP_ID_sect163k1, 80, TLS1_VERSION, TLS1_2_VERSION,
DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_sect163r1, 80, TLS1_VERSION, TLS1_2_VERSION,
Expand Down Expand Up @@ -86,6 +86,9 @@ static const TLS_GROUP_CONSTANTS group_list[35] = {
DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_x25519, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
{ OSSL_TLS_GROUP_ID_x448, 224, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
{ OSSL_TLS_GROUP_ID_brainpoolP256r1_tls13, 128, TLS1_3_VERSION, 0, -1, -1 },
{ OSSL_TLS_GROUP_ID_brainpoolP384r1_tls13, 192, TLS1_3_VERSION, 0, -1, -1 },
{ OSSL_TLS_GROUP_ID_brainpoolP512r1_tls13, 256, TLS1_3_VERSION, 0, -1, -1 },
/* Security bit values as given by BN_security_bits() */
{ OSSL_TLS_GROUP_ID_ffdhe2048, 112, TLS1_3_VERSION, 0, -1, -1 },
{ OSSL_TLS_GROUP_ID_ffdhe3072, 128, TLS1_3_VERSION, 0, -1, -1 },
Expand Down Expand Up @@ -189,14 +192,19 @@ static const OSSL_PARAM param_group_list[][10] = {
# endif
TLS_GROUP_ENTRY("x25519", "X25519", "X25519", 28),
TLS_GROUP_ENTRY("x448", "X448", "X448", 29),
# ifndef FIPS_MODULE
TLS_GROUP_ENTRY("brainpoolP256r1tls13", "brainpoolP256r1", "EC", 30),
TLS_GROUP_ENTRY("brainpoolP384r1tls13", "brainpoolP384r1", "EC", 31),
TLS_GROUP_ENTRY("brainpoolP512r1tls13", "brainpoolP512r1", "EC", 32),
# endif
# endif /* OPENSSL_NO_EC */
# ifndef OPENSSL_NO_DH
/* Security bit values for FFDHE groups are as per RFC 7919 */
TLS_GROUP_ENTRY("ffdhe2048", "ffdhe2048", "DH", 30),
TLS_GROUP_ENTRY("ffdhe3072", "ffdhe3072", "DH", 31),
TLS_GROUP_ENTRY("ffdhe4096", "ffdhe4096", "DH", 32),
TLS_GROUP_ENTRY("ffdhe6144", "ffdhe6144", "DH", 33),
TLS_GROUP_ENTRY("ffdhe8192", "ffdhe8192", "DH", 34),
TLS_GROUP_ENTRY("ffdhe2048", "ffdhe2048", "DH", 33),
TLS_GROUP_ENTRY("ffdhe3072", "ffdhe3072", "DH", 34),
TLS_GROUP_ENTRY("ffdhe4096", "ffdhe4096", "DH", 35),
TLS_GROUP_ENTRY("ffdhe6144", "ffdhe6144", "DH", 36),
TLS_GROUP_ENTRY("ffdhe8192", "ffdhe8192", "DH", 37),
# endif
};
#endif /* !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH) */
Expand Down
3 changes: 3 additions & 0 deletions ssl/t1_lib.c
View file
Expand Up @@ -181,6 +181,9 @@ static struct {
{NID_brainpoolP512r1, OSSL_TLS_GROUP_ID_brainpoolP512r1},
{EVP_PKEY_X25519, OSSL_TLS_GROUP_ID_x25519},
{EVP_PKEY_X448, OSSL_TLS_GROUP_ID_x448},
{NID_brainpoolP256r1tls13, OSSL_TLS_GROUP_ID_brainpoolP256r1_tls13},
{NID_brainpoolP384r1tls13, OSSL_TLS_GROUP_ID_brainpoolP384r1_tls13},
{NID_brainpoolP512r1tls13, OSSL_TLS_GROUP_ID_brainpoolP512r1_tls13},
{NID_id_tc26_gost_3410_2012_256_paramSetA, OSSL_TLS_GROUP_ID_gc256A},
{NID_id_tc26_gost_3410_2012_256_paramSetB, OSSL_TLS_GROUP_ID_gc256B},
{NID_id_tc26_gost_3410_2012_256_paramSetC, OSSL_TLS_GROUP_ID_gc256C},
Expand Down
3 changes: 3 additions & 0 deletions ssl/t1_trce.c
View file
Expand Up @@ -525,6 +525,9 @@ static const ssl_trace_tbl ssl_groups_tbl[] = {
{28, "brainpoolP512r1"},
{29, "ecdh_x25519"},
{30, "ecdh_x448"},
{31, "brainpoolP256r1tls13"},
{32, "brainpoolP384r1tls13"},
{33, "brainpoolP512r1tls13"},
{34, "GC256A"},
{35, "GC256B"},
{36, "GC256C"},
Expand Down
2 changes: 1 addition & 1 deletion test/ssl-tests/20-cert-select.cnf
View file
Expand Up @@ -1728,7 +1728,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer

[test-52]
ExpectedResult = ServerFail
ExpectedResult = ClientFail


# ===========================================================
Expand Down
2 changes: 1 addition & 1 deletion test/ssl-tests/20-cert-select.cnf.in
View file
Expand Up @@ -914,7 +914,7 @@ my @tests_tls_1_3_non_fips = (
#We only configured brainpoolP256r1 on the client side, but TLSv1.3
#is enabled and this group is not allowed in TLSv1.3. Therefore this
#should fail
"ExpectedResult" => "ServerFail"
"ExpectedResult" => "ClientFail"
},
},
{
Expand Down

0 comments on commit c9ee6e3

Please sign in to comment.