Skip to content

Conversation

@strayge
Copy link
Contributor

@strayge strayge commented Sep 13, 2020

Checklist:

  • If you are new to Scapy: I have checked CONTRIBUTING.md (esp. section submitting-pull-requests)
  • I squashed commits belonging together
  • I added unit tests or explained why they are not relevant
  • I executed the regression tests for Python2 and Python3 (using tox or, cd test && ./run_tests_py2, cd test && ./run_tests_py3)
  • If the PR is still not finished, please create a Draft Pull Request

Description

Added support Encrypt-then-MAC extension for TLS protocol (RFC 7366).

Required and contains #2797 because openssl don't have command line options to disable Extended-Master-Secred, so test suite contains example with both extensions setted.

Implementation only for block ciphers

Encrypt-Then-Mac not supported by AEAD ciphers (according to RFC).

For TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 (0xccab) and TLS_RSA_WITH_RC4_128_SHA (0x0005) openssl 1.1.1g does not support Encrypt-Then-Mac (presents in ClientHello, but missed in ServerHello response).

Same behaviour for GnuTLS 3.6.13 with TLS_RSA_WITH_RC4_128_SHA (0x0005) and TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8).

So it is looks like currently Encrypt-Then-Mac implemented only for block ciphers.

@strayge strayge changed the title [Draft] TLS: added Encrypt-Thne-MAC extension [Draft] TLS: added Encrypt-Then-MAC extension Sep 13, 2020
@codecov
Copy link

codecov bot commented Sep 13, 2020

Codecov Report

Merging #2811 into master will increase coverage by 0.01%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##           master    #2811      +/-   ##
==========================================
+ Coverage   88.13%   88.15%   +0.01%     
==========================================
  Files         254      254              
  Lines       54189    54196       +7     
==========================================
+ Hits        47762    47776      +14     
+ Misses       6427     6420       -7     
Impacted Files Coverage Δ
scapy/layers/tls/handshake.py 83.84% <100.00%> (+0.01%) ⬆️
scapy/layers/tls/record.py 90.78% <100.00%> (+0.95%) ⬆️
scapy/layers/tls/session.py 83.78% <100.00%> (-0.65%) ⬇️
scapy/arch/bpf/core.py 86.82% <0.00%> (-0.78%) ⬇️
scapy/arch/windows/__init__.py 68.50% <0.00%> (-0.19%) ⬇️
scapy/layers/inet.py 74.13% <0.00%> (+0.16%) ⬆️
scapy/arch/libpcap.py 82.03% <0.00%> (+1.69%) ⬆️
scapy/layers/tls/crypto/cipher_block.py 97.67% <0.00%> (+2.32%) ⬆️

@strayge strayge changed the title [Draft] TLS: added Encrypt-Then-MAC extension TLS: added Encrypt-Then-MAC extension Sep 13, 2020
@strayge strayge marked this pull request as ready for review September 13, 2020 01:27
@gpotter2 gpotter2 self-assigned this Sep 14, 2020
Copy link
Member

@gpotter2 gpotter2 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great PR ! Thanks a lot for this work.
I've rebased it against master, will merge it once the checks pass.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants