Skip to content

Commit

Permalink
Update ciphersuites with old drafts + new AEGIS
Browse files Browse the repository at this point in the history
  • Loading branch information
@aguinetsb @chifflier
aguinetsb authored and chifflier committed Mar 1, 2024
1 parent 903bffc commit 3bceb30
Show file tree
Hide file tree
Showing 3 changed files with 44 additions and 15 deletions.
29 changes: 24 additions & 5 deletions scripts/extract-iana-ciphers2.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,17 @@ def getCiphers():
val = "%02x%02x" % (rv1, rv2)
ciphers.append((val, desc, rfcs))

# Manually adding ciphers from https://datatracker.ietf.org/doc/html/draft-ietf-tls-56-bit-ciphersuites-01
ciphers.append(("0062", "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA", "draft-ietf-tls-56-bit-ciphersuites-01"))
ciphers.append(("0064", "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA", "draft-ietf-tls-56-bit-ciphersuites-01"))
ciphers.append(("0063", "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA", "draft-ietf-tls-56-bit-ciphersuites-01"))
ciphers.append(("0065", "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA", "draft-ietf-tls-56-bit-ciphersuites-01"))
ciphers.append(("0066", "TLS_DHE_DSS_WITH_RC4_128_SHA", "draft-ietf-tls-56-bit-ciphersuites-01"))

# Unsure which RFC these are coming from
ciphers.append(("0060", "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5", "unknown"))
ciphers.append(("0061", "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5", "unknown"))

return ciphers

re_tls_with = re.compile('^TLS_(\w+)_WITH_(\w+)_(\w+)$')
Expand All @@ -44,7 +55,9 @@ def getCiphers():
'DH_DSS_EXPORT': ['DH', 'DSS'],
'DHE_DSS': ['DHE', 'DSS'],
'DHE_DSS_EXPORT': ['DHE', 'DSS'],
'DHE_DSS_EXPORT1024': ['DHE', 'DSS'],
'RSA': ['RSA', 'RSA'],
'RSA_EXPORT1024': ['RSA', 'RSA'],
'DH_RSA': ['DH', 'RSA'],
'DH_RSA_EXPORT': ['DH', 'RSA'],
'DHE_PSK': ['DHE', 'PSK'],
Expand Down Expand Up @@ -73,6 +86,10 @@ def getCiphers():
'NULL': ['NULL', '', 0],
'NULL_SHA256': ['NULL', '', 0],
'3DES_EDE_CBC': ['3DES', 'CBC', 168],
'AEGIS_128L': ['AEGIS', 'NULL', 128],
'AEGIS_128X2': ['AEGIS', 'NULL', 128],
'AEGIS_256': ['AEGIS', 'NULL', 256],
'AEGIS_256X2': ['AEGIS', 'NULL', 256],
'AES_128_CBC': ['AES', 'CBC', 128],
'AES_256_CBC': ['AES', 'CBC', 256],
'AES_128_CCM': ['AES', 'CCM', 128],
Expand All @@ -95,7 +112,9 @@ def getCiphers():
'DES40_CBC': ['DES', 'CBC', 40],
'IDEA_CBC': ['IDEA', 'CBC', 128],
'RC2_CBC_40': ['RC2', 'CBC', 40],
'RC2_CBC_56': ['RC2', 'CBC', 56],
'RC4_40': ['RC4', '', 40],
'RC4_56': ['RC4', '', 56],
'RC4_128': ['RC4', '', 128],
'SEED_CBC': ['SEED', 'CBC', 128],
'SM4_CCM': ['SM4', 'CCM', 128],
Expand All @@ -114,8 +133,12 @@ def getCiphers():

def extract_ciphersuite_info(desc, rfcs):
params = dict()
if desc == "TLS_SHA256_SHA256":
desc = "TLS_TLS13_WITH_NULL_SHA256"
if desc == "TLS_SHA384_SHA384":
desc = "TLS_TLS13_WITH_NULL_SHA384"
if not "_WITH_" in desc:
if desc.startswith("TLS_AES") or desc.startswith("TLS_CHACHA20"):
if desc.startswith("TLS_AES") or desc.startswith("TLS_CHACHA20") or desc.startswith("TLS_AEGIS"):
# XXX special case: TLS 1.3: TLS_AES_128_GCM_SHA256 etc.
desc = "TLS_TLS13_WITH_" + desc[4:]
else:
Expand Down Expand Up @@ -175,11 +198,7 @@ def extract_ciphersuite_info(desc, rfcs):
# print("Found {}".format(params))
return params




ciphers = getCiphers()

out = open(sys.argv[1], 'w')

for value, desc, rfcs in ciphers:
Expand Down
27 changes: 18 additions & 9 deletions scripts/tls-ciphersuites.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,26 +5,26 @@
0004:TLS_RSA_WITH_RC4_128_MD5:RSA:RSA:RC4::128:HMAC-MD5:128:DEFAULT:0:rfc5246,rfc6347:0:0300:ffff
0005:TLS_RSA_WITH_RC4_128_SHA:RSA:RSA:RC4::128:HMAC-SHA1:160:DEFAULT:0:rfc5246,rfc6347:0:0300:ffff
0006:TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5:RSA:RSA:RC2:CBC:40:HMAC-MD5:128:DEFAULT:0:rfc4346:1:0300:ffff
0007:TLS_RSA_WITH_IDEA_CBC_SHA:RSA:RSA:IDEA:CBC:128:HMAC-SHA1:160:DEFAULT:0:rfc5469,sc-tls-des-idea-ciphers-to-historic:0:0300:ffff
0007:TLS_RSA_WITH_IDEA_CBC_SHA:RSA:RSA:IDEA:CBC:128:HMAC-SHA1:160:DEFAULT:0:rfc8996:0:0300:ffff
0008:TLS_RSA_EXPORT_WITH_DES40_CBC_SHA:RSA:RSA:DES:CBC:40:HMAC-SHA1:160:DEFAULT:0:rfc4346:1:0300:ffff
0009:TLS_RSA_WITH_DES_CBC_SHA:RSA:RSA:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc5469,sc-tls-des-idea-ciphers-to-historic:0:0300:ffff
0009:TLS_RSA_WITH_DES_CBC_SHA:RSA:RSA:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc8996:0:0300:ffff
000a:TLS_RSA_WITH_3DES_EDE_CBC_SHA:RSA:RSA:3DES:CBC:168:HMAC-SHA1:160:DEFAULT:0:rfc5246:0:0300:ffff
000b:TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA:DH:DSS:DES:CBC:40:HMAC-SHA1:160:DEFAULT:0:rfc4346:1:0300:ffff
000c:TLS_DH_DSS_WITH_DES_CBC_SHA:DH:DSS:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc5469,sc-tls-des-idea-ciphers-to-historic:0:0300:ffff
000c:TLS_DH_DSS_WITH_DES_CBC_SHA:DH:DSS:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc8996:0:0300:ffff
000d:TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA:DH:DSS:3DES:CBC:168:HMAC-SHA1:160:DEFAULT:0:rfc5246:0:0300:ffff
000e:TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA:DH:RSA:DES:CBC:40:HMAC-SHA1:160:DEFAULT:0:rfc4346:1:0300:ffff
000f:TLS_DH_RSA_WITH_DES_CBC_SHA:DH:RSA:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc5469,sc-tls-des-idea-ciphers-to-historic:0:0300:ffff
000f:TLS_DH_RSA_WITH_DES_CBC_SHA:DH:RSA:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc8996:0:0300:ffff
0010:TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA:DH:RSA:3DES:CBC:168:HMAC-SHA1:160:DEFAULT:0:rfc5246:0:0300:ffff
0011:TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA:DHE:DSS:DES:CBC:40:HMAC-SHA1:160:DEFAULT:0:rfc4346:1:0300:ffff
0012:TLS_DHE_DSS_WITH_DES_CBC_SHA:DHE:DSS:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc5469,sc-tls-des-idea-ciphers-to-historic:0:0300:ffff
0012:TLS_DHE_DSS_WITH_DES_CBC_SHA:DHE:DSS:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc8996:0:0300:ffff
0013:TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA:DHE:DSS:3DES:CBC:168:HMAC-SHA1:160:DEFAULT:0:rfc5246:0:0300:ffff
0014:TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA:DHE:RSA:DES:CBC:40:HMAC-SHA1:160:DEFAULT:0:rfc4346:1:0300:ffff
0015:TLS_DHE_RSA_WITH_DES_CBC_SHA:DHE:RSA:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc5469,sc-tls-des-idea-ciphers-to-historic:0:0300:ffff
0015:TLS_DHE_RSA_WITH_DES_CBC_SHA:DHE:RSA:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc8996:0:0300:ffff
0016:TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA:DHE:RSA:3DES:CBC:168:HMAC-SHA1:160:DEFAULT:0:rfc5246:0:0300:ffff
0017:TLS_DH_anon_EXPORT_WITH_RC4_40_MD5:DH:NULL:RC4::40:HMAC-MD5:128:DEFAULT:0:rfc4346,rfc6347:1:0300:ffff
0018:TLS_DH_anon_WITH_RC4_128_MD5:DH:NULL:RC4::128:HMAC-MD5:128:DEFAULT:0:rfc5246,rfc6347:0:0300:ffff
0019:TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA:DH:NULL:DES:CBC:40:HMAC-SHA1:160:DEFAULT:0:rfc4346:1:0300:ffff
001a:TLS_DH_anon_WITH_DES_CBC_SHA:DH:NULL:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc5469,sc-tls-des-idea-ciphers-to-historic:0:0300:ffff
001a:TLS_DH_anon_WITH_DES_CBC_SHA:DH:NULL:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc8996:0:0300:ffff
001b:TLS_DH_anon_WITH_3DES_EDE_CBC_SHA:DH:NULL:3DES:CBC:168:HMAC-SHA1:160:DEFAULT:0:rfc5246:0:0300:ffff
001e:TLS_KRB5_WITH_DES_CBC_SHA:KRB5:KRB5:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc2712:0:0300:ffff
001f:TLS_KRB5_WITH_3DES_EDE_CBC_SHA:KRB5:KRB5:3DES:CBC:168:HMAC-SHA1:160:DEFAULT:0:rfc2712:0:0300:ffff
Expand Down Expand Up @@ -148,6 +148,8 @@
1303:TLS_CHACHA20_POLY1305_SHA256:TLS13:TLS13:CHACHA20_POLY1305::128:AEAD:128:SHA256:256:rfc8446:0:0300:ffff
1304:TLS_AES_128_CCM_SHA256:TLS13:TLS13:AES:CCM:128:AEAD:128:SHA256:256:rfc8446:0:0300:ffff
1305:TLS_AES_128_CCM_8_SHA256:TLS13:TLS13:AES:CCM:128:AEAD:128:SHA256:256:rfc8446,iesg action 2018-08-16:0:0300:ffff
1306:TLS_AEGIS_256_SHA512:TLS13:TLS13:AEGIS:NULL:256:HMAC-SHA512:512:SHA512:512:draft-irtf-cfrg-aegis-aead-08:0:0300:ffff
1307:TLS_AEGIS_128L_SHA256:TLS13:TLS13:AEGIS:NULL:128:HMAC-SHA256:256:SHA256:256:draft-irtf-cfrg-aegis-aead-08:0:0300:ffff
5600:TLS_FALLBACK_SCSV:NULL:NULL:NULL::0:NULL:0:NULL:0:[RFC7507]:0:0:0
c001:TLS_ECDH_ECDSA_WITH_NULL_SHA:ECDH:ECDSA:NULL::0:HMAC-SHA1:160:DEFAULT:0:rfc8422:0:0300:ffff
c002:TLS_ECDH_ECDSA_WITH_RC4_128_SHA:ECDH:ECDSA:RC4::128:HMAC-SHA1:160:DEFAULT:0:rfc8422,rfc6347:0:0300:ffff
Expand Down Expand Up @@ -328,8 +330,8 @@ c0b0:TLS_ECCPWD_WITH_AES_128_GCM_SHA256:ECCPWD:ECCPWD:AES:GCM:128:AEAD:128:SHA25
c0b1:TLS_ECCPWD_WITH_AES_256_GCM_SHA384:ECCPWD:ECCPWD:AES:GCM:256:AEAD:256:SHA384:384:rfc8492:0:0300:ffff
c0b2:TLS_ECCPWD_WITH_AES_128_CCM_SHA256:ECCPWD:ECCPWD:AES:CCM:128:AEAD:128:SHA256:256:rfc8492:0:0300:ffff
c0b3:TLS_ECCPWD_WITH_AES_256_CCM_SHA384:ECCPWD:ECCPWD:AES:CCM:256:AEAD:256:SHA384:384:rfc8492:0:0300:ffff
c0b4:TLS_SHA256_SHA256:TLS13:TLS13:NULL::0:HMAC-SHA256:256:SHA256:256:rfc-camwinget-tls-ts13-macciphersuites-12:0:0300:ffff
c0b5:TLS_SHA384_SHA384:TLS13:TLS13:NULL::0:HMAC-SHA384:384:SHA384:384:rfc-camwinget-tls-ts13-macciphersuites-12:0:0300:ffff
c0b4:TLS_SHA256_SHA256:TLS13:TLS13:NULL::0:HMAC-SHA256:256:SHA256:256:rfc9150:0:0300:ffff
c0b5:TLS_SHA384_SHA384:TLS13:TLS13:NULL::0:HMAC-SHA384:384:SHA384:384:rfc9150:0:0300:ffff
cca8:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:ECDHE:RSA:CHACHA20_POLY1305::128:AEAD:128:SHA256:256:rfc7905:0:0300:ffff
cca9:TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:ECDHE:ECDSA:CHACHA20_POLY1305::128:AEAD:128:SHA256:256:rfc7905:0:0300:ffff
ccaa:TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:DHE:RSA:CHACHA20_POLY1305::128:AEAD:128:SHA256:256:rfc7905:0:0300:ffff
Expand All @@ -341,3 +343,10 @@ d001:TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256:ECDHE:PSK:AES:GCM:128:AEAD:128:SHA256
d002:TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384:ECDHE:PSK:AES:GCM:256:AEAD:256:SHA384:384:rfc8442:0:0300:ffff
d003:TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256:ECDHE:PSK:AES:CCM:128:AEAD:128:SHA256:256:rfc8442:0:0300:ffff
d005:TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256:ECDHE:PSK:AES:CCM:128:AEAD:128:SHA256:256:rfc8442:0:0300:ffff
0062:TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA:RSA:RSA:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:draft-ietf-tls-56-bit-ciphersuites-01:0:0300:ffff
0064:TLS_RSA_EXPORT1024_WITH_RC4_56_SHA:RSA:RSA:RC4::56:HMAC-SHA1:160:DEFAULT:0:draft-ietf-tls-56-bit-ciphersuites-01:0:0300:ffff
0063:TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA:DHE:DSS:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:draft-ietf-tls-56-bit-ciphersuites-01:0:0300:ffff
0065:TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA:DHE:DSS:RC4::56:HMAC-SHA1:160:DEFAULT:0:draft-ietf-tls-56-bit-ciphersuites-01:0:0300:ffff
0066:TLS_DHE_DSS_WITH_RC4_128_SHA:DHE:DSS:RC4::128:HMAC-SHA1:160:DEFAULT:0:draft-ietf-tls-56-bit-ciphersuites-01:0:0300:ffff
0060:TLS_RSA_EXPORT1024_WITH_RC4_56_MD5:RSA:RSA:RC4::56:HMAC-MD5:128:DEFAULT:0:unknown:0:0300:ffff
0061:TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5:RSA:RSA:RC2:CBC:56:HMAC-MD5:128:DEFAULT:0:unknown:0:0300:ffff
3 changes: 2 additions & 1 deletion src/tls_ciphers.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,7 @@ pub enum TlsCipherEnc {
Camellia,
Chacha20_Poly1305,
Sm4,
Aegis,
}

/// Encryption modes
Expand Down Expand Up @@ -167,7 +168,7 @@ impl TlsCipherSuite {
| TlsCipherEnc::Seed
| TlsCipherEnc::Sm4 => 16,
// stream ciphers
TlsCipherEnc::Chacha20_Poly1305 | TlsCipherEnc::Rc4 => 0,
TlsCipherEnc::Chacha20_Poly1305 | TlsCipherEnc::Rc4 | TlsCipherEnc::Aegis => 0,
}
}

Expand Down

0 comments on commit 3bceb30

Please sign in to comment.