Skip to content

Commit 0beb210

Browse files
WillChilds-KleinWillChilds-Klein
authored
Offer P521 for signature_algorithms in client Hello (#2572)
1 parent 1a9b344 commit 0beb210

File tree

4 files changed

+20
-16
lines changed

4 files changed

+20
-16
lines changed

‎ssl/extensions.cc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -392,6 +392,7 @@ static const uint16_t kVerifySignatureAlgorithms[] = {
392392
SSL_SIGN_RSA_PSS_RSAE_SHA384,
393393
SSL_SIGN_RSA_PKCS1_SHA384,
394394

395+
SSL_SIGN_ECDSA_SECP521R1_SHA512,
395396
SSL_SIGN_RSA_PSS_RSAE_SHA512,
396397
SSL_SIGN_RSA_PKCS1_SHA512,
397398

‎ssl/ssl_test.cc‎

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -602,20 +602,20 @@ TEST(SSLTest, ClientHello) {
602602
0x0a, 0x00, 0x08, 0x00, 0x06, 0x00, 0x1d, 0x00, 0x17, 0x00, 0x18, 0x00,
603603
0x0b, 0x00, 0x02, 0x01, 0x00, 0x00, 0x23, 0x00, 0x00}},
604604
{TLS1_2_VERSION,
605-
{0x16, 0x03, 0x01, 0x00, 0x86, 0x01, 0x00, 0x00, 0x82, 0x03, 0x03, 0x00,
605+
{0x16, 0x03, 0x01, 0x00, 0x88, 0x01, 0x00, 0x00, 0x84, 0x03, 0x03, 0x00,
606606
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
607607
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
608608
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x22, 0xcc, 0xa9,
609609
0xcc, 0xa8, 0xc0, 0x2b, 0xc0, 0x2f, 0xc0, 0x2c, 0xc0, 0x30, 0xc0, 0x09,
610610
0xc0, 0x13, 0xc0, 0x27, 0xc0, 0x0a, 0xc0, 0x14, 0xc0, 0x28, 0x00, 0x9c,
611-
0x00, 0x9d, 0x00, 0x2f, 0x00, 0x3c, 0x00, 0x35, 0x01, 0x00, 0x00, 0x37,
611+
0x00, 0x9d, 0x00, 0x2f, 0x00, 0x3c, 0x00, 0x35, 0x01, 0x00, 0x00, 0x39,
612612
0x00, 0x17, 0x00, 0x00, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0a, 0x00,
613613
0x08, 0x00, 0x06, 0x00, 0x1d, 0x00, 0x17, 0x00, 0x18, 0x00, 0x0b, 0x00,
614-
0x02, 0x01, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x14, 0x00,
615-
0x12, 0x04, 0x03, 0x08, 0x04, 0x04, 0x01, 0x05, 0x03, 0x08, 0x05, 0x05,
616-
0x01, 0x08, 0x06, 0x06, 0x01, 0x02, 0x01}},
614+
0x02, 0x01, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x16, 0x00,
615+
0x14, 0x04, 0x03, 0x08, 0x04, 0x04, 0x01, 0x05, 0x03, 0x08, 0x05, 0x05,
616+
0x01, 0x06, 0x03, 0x08, 0x06, 0x06, 0x01, 0x02, 0x01}},
617617
{TLS1_3_VERSION,
618-
{0x16, 0x03, 0x01, 0x00, 0xe9, 0x01, 0x00, 0x00, 0xe5, 0x03, 0x03, 0x00,
618+
{0x16, 0x03, 0x01, 0x00, 0xeb, 0x01, 0x00, 0x00, 0xe7, 0x03, 0x03, 0x00,
619619
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
620620
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
621621
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -625,16 +625,17 @@ TEST(SSLTest, ClientHello) {
625625
0xcc, 0xa9, 0xcc, 0xa8, 0xc0, 0x2b, 0xc0, 0x2f, 0xc0, 0x2c, 0xc0, 0x30,
626626
0xc0, 0x09, 0xc0, 0x13, 0xc0, 0x27, 0xc0, 0x0a, 0xc0, 0x14, 0xc0, 0x28,
627627
0x00, 0x9c, 0x00, 0x9d, 0x00, 0x2f, 0x00, 0x3c, 0x00, 0x35, 0x01, 0x00,
628-
0x00, 0x74, 0x00, 0x17, 0x00, 0x00, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00,
628+
0x00, 0x76, 0x00, 0x17, 0x00, 0x00, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00,
629629
0x0a, 0x00, 0x08, 0x00, 0x06, 0x00, 0x1d, 0x00, 0x17, 0x00, 0x18, 0x00,
630630
0x0b, 0x00, 0x02, 0x01, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x0d, 0x00,
631-
0x14, 0x00, 0x12, 0x04, 0x03, 0x08, 0x04, 0x04, 0x01, 0x05, 0x03, 0x08,
632-
0x05, 0x05, 0x01, 0x08, 0x06, 0x06, 0x01, 0x02, 0x01, 0x00, 0x33, 0x00,
633-
0x26, 0x00, 0x24, 0x00, 0x1d, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00,
631+
0x16, 0x00, 0x14, 0x04, 0x03, 0x08, 0x04, 0x04, 0x01, 0x05, 0x03, 0x08,
632+
0x05, 0x05, 0x01, 0x06, 0x03, 0x08, 0x06, 0x06, 0x01, 0x02, 0x01, 0x00,
633+
0x33, 0x00, 0x26, 0x00, 0x24, 0x00, 0x1d, 0x00, 0x20, 0x00, 0x00, 0x00,
634634
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
635635
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
636-
0x00, 0x00, 0x00, 0x00, 0x2d, 0x00, 0x02, 0x01, 0x01, 0x00, 0x2b, 0x00,
637-
0x09, 0x08, 0x03, 0x04, 0x03, 0x03, 0x03, 0x02, 0x03, 0x01}}};
636+
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2d, 0x00, 0x02, 0x01, 0x01, 0x00,
637+
0x2b, 0x00, 0x09, 0x08, 0x03, 0x04, 0x03, 0x03, 0x03, 0x02, 0x03, 0x01}},
638+
};
638639

639640
for (const auto &t : kTests) {
640641
SCOPED_TRACE(t.max_version);
@@ -669,7 +670,7 @@ TEST(SSLTest, ClientHello) {
669670
OPENSSL_memset(client_hello.data() + kRandomOffset, 0,
670671
SSL3_RANDOM_SIZE + 1 + SSL3_SESSION_ID_SIZE);
671672
// Jump to key share extension and zero out the key
672-
OPENSSL_memset(client_hello.data() + 187, 0, 32);
673+
OPENSSL_memset(client_hello.data() + 189, 0, 32);
673674
} else {
674675
ASSERT_GE(client_hello.size(), kRandomOffset + SSL3_RANDOM_SIZE);
675676
OPENSSL_memset(client_hello.data() + kRandomOffset, 0, SSL3_RANDOM_SIZE);
@@ -681,7 +682,7 @@ TEST(SSLTest, ClientHello) {
681682
ADD_FAILURE() << "ClientHellos did not match.";
682683
// Print the value manually so it is easier to update the test vector.
683684
for (size_t i = 0; i < client_hello.size(); i += 12) {
684-
printf(" %c", i == 0 ? '{' : ' ');
685+
printf(" %c", i == 0 ? '{' : ' ');
685686
for (size_t j = i; j < client_hello.size() && j < i + 12; j++) {
686687
if (j > i) {
687688
printf(" ");

‎ssl/test/runner/runner.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10105,8 +10105,8 @@ func addSignatureAlgorithmTests() {
1010510105
shouldFail = true
1010610106
}
1010710107

10108-
// By default, BoringSSL does not enable ecdsa_sha1, ecdsa_secp521_sha512, and ed25519.
10109-
if alg.id == signatureECDSAWithSHA1 || alg.id == signatureECDSAWithP521AndSHA512 || alg.id == signatureEd25519 {
10108+
// By default, AWS-LC does not enable ecdsa_sha1 and ed25519.
10109+
if alg.id == signatureECDSAWithSHA1 || alg.id == signatureEd25519 {
1011010110
rejectByDefault = true
1011110111
}
1011210112

‎ssl/test/runner/ssl_transfer/test_case_names.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -639,6 +639,8 @@ Server-VerifyDefault-ECDSA_P256_SHA256-TLS12
639639
Server-VerifyDefault-ECDSA_P256_SHA256-TLS13
640640
Server-VerifyDefault-ECDSA_P384_SHA384-TLS12
641641
Server-VerifyDefault-ECDSA_P384_SHA384-TLS13
642+
Server-VerifyDefault-ECDSA_P521_SHA512-TLS12
643+
Server-VerifyDefault-ECDSA_P521_SHA512-TLS13
642644
Server-VerifyDefault-RSA_PKCS1_SHA1-TLS12
643645
Server-VerifyDefault-RSA_PKCS1_SHA256-TLS12
644646
Server-VerifyDefault-RSA_PKCS1_SHA384-TLS12

0 commit comments

Comments
 (0)