From 3bceb302860cbc384620bd3df584be24d63e2d73 Mon Sep 17 00:00:00 2001 From: Adrien Guinet Date: Mon, 29 Jan 2024 09:33:24 +0100 Subject: [PATCH] Update ciphersuites with old drafts + new AEGIS --- scripts/extract-iana-ciphers2.py | 29 ++++++++++++++++++++++++----- scripts/tls-ciphersuites.txt | 27 ++++++++++++++++++--------- src/tls_ciphers.rs | 3 ++- 3 files changed, 44 insertions(+), 15 deletions(-) diff --git a/scripts/extract-iana-ciphers2.py b/scripts/extract-iana-ciphers2.py index fff0709..5fda00d 100755 --- a/scripts/extract-iana-ciphers2.py +++ b/scripts/extract-iana-ciphers2.py @@ -32,6 +32,17 @@ def getCiphers(): val = "%02x%02x" % (rv1, rv2) ciphers.append((val, desc, rfcs)) + # Manually adding ciphers from https://datatracker.ietf.org/doc/html/draft-ietf-tls-56-bit-ciphersuites-01 + ciphers.append(("0062", "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA", "draft-ietf-tls-56-bit-ciphersuites-01")) + ciphers.append(("0064", "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA", "draft-ietf-tls-56-bit-ciphersuites-01")) + ciphers.append(("0063", "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA", "draft-ietf-tls-56-bit-ciphersuites-01")) + ciphers.append(("0065", "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA", "draft-ietf-tls-56-bit-ciphersuites-01")) + ciphers.append(("0066", "TLS_DHE_DSS_WITH_RC4_128_SHA", "draft-ietf-tls-56-bit-ciphersuites-01")) + + # Unsure which RFC these are coming from + ciphers.append(("0060", "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5", "unknown")) + ciphers.append(("0061", "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5", "unknown")) + return ciphers re_tls_with = re.compile('^TLS_(\w+)_WITH_(\w+)_(\w+)$') @@ -44,7 +55,9 @@ def getCiphers(): 'DH_DSS_EXPORT': ['DH', 'DSS'], 'DHE_DSS': ['DHE', 'DSS'], 'DHE_DSS_EXPORT': ['DHE', 'DSS'], + 'DHE_DSS_EXPORT1024': ['DHE', 'DSS'], 'RSA': ['RSA', 'RSA'], + 'RSA_EXPORT1024': ['RSA', 'RSA'], 'DH_RSA': ['DH', 'RSA'], 'DH_RSA_EXPORT': ['DH', 'RSA'], 'DHE_PSK': ['DHE', 'PSK'], @@ -73,6 +86,10 @@ def getCiphers(): 'NULL': ['NULL', '', 0], 'NULL_SHA256': ['NULL', '', 0], '3DES_EDE_CBC': ['3DES', 'CBC', 168], + 'AEGIS_128L': ['AEGIS', 'NULL', 128], + 'AEGIS_128X2': ['AEGIS', 'NULL', 128], + 'AEGIS_256': ['AEGIS', 'NULL', 256], + 'AEGIS_256X2': ['AEGIS', 'NULL', 256], 'AES_128_CBC': ['AES', 'CBC', 128], 'AES_256_CBC': ['AES', 'CBC', 256], 'AES_128_CCM': ['AES', 'CCM', 128], @@ -95,7 +112,9 @@ def getCiphers(): 'DES40_CBC': ['DES', 'CBC', 40], 'IDEA_CBC': ['IDEA', 'CBC', 128], 'RC2_CBC_40': ['RC2', 'CBC', 40], + 'RC2_CBC_56': ['RC2', 'CBC', 56], 'RC4_40': ['RC4', '', 40], + 'RC4_56': ['RC4', '', 56], 'RC4_128': ['RC4', '', 128], 'SEED_CBC': ['SEED', 'CBC', 128], 'SM4_CCM': ['SM4', 'CCM', 128], @@ -114,8 +133,12 @@ def getCiphers(): def extract_ciphersuite_info(desc, rfcs): params = dict() + if desc == "TLS_SHA256_SHA256": + desc = "TLS_TLS13_WITH_NULL_SHA256" + if desc == "TLS_SHA384_SHA384": + desc = "TLS_TLS13_WITH_NULL_SHA384" if not "_WITH_" in desc: - if desc.startswith("TLS_AES") or desc.startswith("TLS_CHACHA20"): + if desc.startswith("TLS_AES") or desc.startswith("TLS_CHACHA20") or desc.startswith("TLS_AEGIS"): # XXX special case: TLS 1.3: TLS_AES_128_GCM_SHA256 etc. desc = "TLS_TLS13_WITH_" + desc[4:] else: @@ -175,11 +198,7 @@ def extract_ciphersuite_info(desc, rfcs): # print("Found {}".format(params)) return params - - - ciphers = getCiphers() - out = open(sys.argv[1], 'w') for value, desc, rfcs in ciphers: diff --git a/scripts/tls-ciphersuites.txt b/scripts/tls-ciphersuites.txt index f34fca9..4c39453 100644 --- a/scripts/tls-ciphersuites.txt +++ b/scripts/tls-ciphersuites.txt @@ -5,26 +5,26 @@ 0004:TLS_RSA_WITH_RC4_128_MD5:RSA:RSA:RC4::128:HMAC-MD5:128:DEFAULT:0:rfc5246,rfc6347:0:0300:ffff 0005:TLS_RSA_WITH_RC4_128_SHA:RSA:RSA:RC4::128:HMAC-SHA1:160:DEFAULT:0:rfc5246,rfc6347:0:0300:ffff 0006:TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5:RSA:RSA:RC2:CBC:40:HMAC-MD5:128:DEFAULT:0:rfc4346:1:0300:ffff -0007:TLS_RSA_WITH_IDEA_CBC_SHA:RSA:RSA:IDEA:CBC:128:HMAC-SHA1:160:DEFAULT:0:rfc5469,sc-tls-des-idea-ciphers-to-historic:0:0300:ffff +0007:TLS_RSA_WITH_IDEA_CBC_SHA:RSA:RSA:IDEA:CBC:128:HMAC-SHA1:160:DEFAULT:0:rfc8996:0:0300:ffff 0008:TLS_RSA_EXPORT_WITH_DES40_CBC_SHA:RSA:RSA:DES:CBC:40:HMAC-SHA1:160:DEFAULT:0:rfc4346:1:0300:ffff -0009:TLS_RSA_WITH_DES_CBC_SHA:RSA:RSA:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc5469,sc-tls-des-idea-ciphers-to-historic:0:0300:ffff +0009:TLS_RSA_WITH_DES_CBC_SHA:RSA:RSA:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc8996:0:0300:ffff 000a:TLS_RSA_WITH_3DES_EDE_CBC_SHA:RSA:RSA:3DES:CBC:168:HMAC-SHA1:160:DEFAULT:0:rfc5246:0:0300:ffff 000b:TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA:DH:DSS:DES:CBC:40:HMAC-SHA1:160:DEFAULT:0:rfc4346:1:0300:ffff -000c:TLS_DH_DSS_WITH_DES_CBC_SHA:DH:DSS:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc5469,sc-tls-des-idea-ciphers-to-historic:0:0300:ffff +000c:TLS_DH_DSS_WITH_DES_CBC_SHA:DH:DSS:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc8996:0:0300:ffff 000d:TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA:DH:DSS:3DES:CBC:168:HMAC-SHA1:160:DEFAULT:0:rfc5246:0:0300:ffff 000e:TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA:DH:RSA:DES:CBC:40:HMAC-SHA1:160:DEFAULT:0:rfc4346:1:0300:ffff -000f:TLS_DH_RSA_WITH_DES_CBC_SHA:DH:RSA:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc5469,sc-tls-des-idea-ciphers-to-historic:0:0300:ffff +000f:TLS_DH_RSA_WITH_DES_CBC_SHA:DH:RSA:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc8996:0:0300:ffff 0010:TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA:DH:RSA:3DES:CBC:168:HMAC-SHA1:160:DEFAULT:0:rfc5246:0:0300:ffff 0011:TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA:DHE:DSS:DES:CBC:40:HMAC-SHA1:160:DEFAULT:0:rfc4346:1:0300:ffff -0012:TLS_DHE_DSS_WITH_DES_CBC_SHA:DHE:DSS:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc5469,sc-tls-des-idea-ciphers-to-historic:0:0300:ffff +0012:TLS_DHE_DSS_WITH_DES_CBC_SHA:DHE:DSS:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc8996:0:0300:ffff 0013:TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA:DHE:DSS:3DES:CBC:168:HMAC-SHA1:160:DEFAULT:0:rfc5246:0:0300:ffff 0014:TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA:DHE:RSA:DES:CBC:40:HMAC-SHA1:160:DEFAULT:0:rfc4346:1:0300:ffff -0015:TLS_DHE_RSA_WITH_DES_CBC_SHA:DHE:RSA:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc5469,sc-tls-des-idea-ciphers-to-historic:0:0300:ffff +0015:TLS_DHE_RSA_WITH_DES_CBC_SHA:DHE:RSA:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc8996:0:0300:ffff 0016:TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA:DHE:RSA:3DES:CBC:168:HMAC-SHA1:160:DEFAULT:0:rfc5246:0:0300:ffff 0017:TLS_DH_anon_EXPORT_WITH_RC4_40_MD5:DH:NULL:RC4::40:HMAC-MD5:128:DEFAULT:0:rfc4346,rfc6347:1:0300:ffff 0018:TLS_DH_anon_WITH_RC4_128_MD5:DH:NULL:RC4::128:HMAC-MD5:128:DEFAULT:0:rfc5246,rfc6347:0:0300:ffff 0019:TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA:DH:NULL:DES:CBC:40:HMAC-SHA1:160:DEFAULT:0:rfc4346:1:0300:ffff -001a:TLS_DH_anon_WITH_DES_CBC_SHA:DH:NULL:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc5469,sc-tls-des-idea-ciphers-to-historic:0:0300:ffff +001a:TLS_DH_anon_WITH_DES_CBC_SHA:DH:NULL:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc8996:0:0300:ffff 001b:TLS_DH_anon_WITH_3DES_EDE_CBC_SHA:DH:NULL:3DES:CBC:168:HMAC-SHA1:160:DEFAULT:0:rfc5246:0:0300:ffff 001e:TLS_KRB5_WITH_DES_CBC_SHA:KRB5:KRB5:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:rfc2712:0:0300:ffff 001f:TLS_KRB5_WITH_3DES_EDE_CBC_SHA:KRB5:KRB5:3DES:CBC:168:HMAC-SHA1:160:DEFAULT:0:rfc2712:0:0300:ffff @@ -148,6 +148,8 @@ 1303:TLS_CHACHA20_POLY1305_SHA256:TLS13:TLS13:CHACHA20_POLY1305::128:AEAD:128:SHA256:256:rfc8446:0:0300:ffff 1304:TLS_AES_128_CCM_SHA256:TLS13:TLS13:AES:CCM:128:AEAD:128:SHA256:256:rfc8446:0:0300:ffff 1305:TLS_AES_128_CCM_8_SHA256:TLS13:TLS13:AES:CCM:128:AEAD:128:SHA256:256:rfc8446,iesg action 2018-08-16:0:0300:ffff +1306:TLS_AEGIS_256_SHA512:TLS13:TLS13:AEGIS:NULL:256:HMAC-SHA512:512:SHA512:512:draft-irtf-cfrg-aegis-aead-08:0:0300:ffff +1307:TLS_AEGIS_128L_SHA256:TLS13:TLS13:AEGIS:NULL:128:HMAC-SHA256:256:SHA256:256:draft-irtf-cfrg-aegis-aead-08:0:0300:ffff 5600:TLS_FALLBACK_SCSV:NULL:NULL:NULL::0:NULL:0:NULL:0:[RFC7507]:0:0:0 c001:TLS_ECDH_ECDSA_WITH_NULL_SHA:ECDH:ECDSA:NULL::0:HMAC-SHA1:160:DEFAULT:0:rfc8422:0:0300:ffff c002:TLS_ECDH_ECDSA_WITH_RC4_128_SHA:ECDH:ECDSA:RC4::128:HMAC-SHA1:160:DEFAULT:0:rfc8422,rfc6347:0:0300:ffff @@ -328,8 +330,8 @@ c0b0:TLS_ECCPWD_WITH_AES_128_GCM_SHA256:ECCPWD:ECCPWD:AES:GCM:128:AEAD:128:SHA25 c0b1:TLS_ECCPWD_WITH_AES_256_GCM_SHA384:ECCPWD:ECCPWD:AES:GCM:256:AEAD:256:SHA384:384:rfc8492:0:0300:ffff c0b2:TLS_ECCPWD_WITH_AES_128_CCM_SHA256:ECCPWD:ECCPWD:AES:CCM:128:AEAD:128:SHA256:256:rfc8492:0:0300:ffff c0b3:TLS_ECCPWD_WITH_AES_256_CCM_SHA384:ECCPWD:ECCPWD:AES:CCM:256:AEAD:256:SHA384:384:rfc8492:0:0300:ffff -c0b4:TLS_SHA256_SHA256:TLS13:TLS13:NULL::0:HMAC-SHA256:256:SHA256:256:rfc-camwinget-tls-ts13-macciphersuites-12:0:0300:ffff -c0b5:TLS_SHA384_SHA384:TLS13:TLS13:NULL::0:HMAC-SHA384:384:SHA384:384:rfc-camwinget-tls-ts13-macciphersuites-12:0:0300:ffff +c0b4:TLS_SHA256_SHA256:TLS13:TLS13:NULL::0:HMAC-SHA256:256:SHA256:256:rfc9150:0:0300:ffff +c0b5:TLS_SHA384_SHA384:TLS13:TLS13:NULL::0:HMAC-SHA384:384:SHA384:384:rfc9150:0:0300:ffff cca8:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:ECDHE:RSA:CHACHA20_POLY1305::128:AEAD:128:SHA256:256:rfc7905:0:0300:ffff cca9:TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:ECDHE:ECDSA:CHACHA20_POLY1305::128:AEAD:128:SHA256:256:rfc7905:0:0300:ffff ccaa:TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:DHE:RSA:CHACHA20_POLY1305::128:AEAD:128:SHA256:256:rfc7905:0:0300:ffff @@ -341,3 +343,10 @@ d001:TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256:ECDHE:PSK:AES:GCM:128:AEAD:128:SHA256 d002:TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384:ECDHE:PSK:AES:GCM:256:AEAD:256:SHA384:384:rfc8442:0:0300:ffff d003:TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256:ECDHE:PSK:AES:CCM:128:AEAD:128:SHA256:256:rfc8442:0:0300:ffff d005:TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256:ECDHE:PSK:AES:CCM:128:AEAD:128:SHA256:256:rfc8442:0:0300:ffff +0062:TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA:RSA:RSA:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:draft-ietf-tls-56-bit-ciphersuites-01:0:0300:ffff +0064:TLS_RSA_EXPORT1024_WITH_RC4_56_SHA:RSA:RSA:RC4::56:HMAC-SHA1:160:DEFAULT:0:draft-ietf-tls-56-bit-ciphersuites-01:0:0300:ffff +0063:TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA:DHE:DSS:DES:CBC:56:HMAC-SHA1:160:DEFAULT:0:draft-ietf-tls-56-bit-ciphersuites-01:0:0300:ffff +0065:TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA:DHE:DSS:RC4::56:HMAC-SHA1:160:DEFAULT:0:draft-ietf-tls-56-bit-ciphersuites-01:0:0300:ffff +0066:TLS_DHE_DSS_WITH_RC4_128_SHA:DHE:DSS:RC4::128:HMAC-SHA1:160:DEFAULT:0:draft-ietf-tls-56-bit-ciphersuites-01:0:0300:ffff +0060:TLS_RSA_EXPORT1024_WITH_RC4_56_MD5:RSA:RSA:RC4::56:HMAC-MD5:128:DEFAULT:0:unknown:0:0300:ffff +0061:TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5:RSA:RSA:RC2:CBC:56:HMAC-MD5:128:DEFAULT:0:unknown:0:0300:ffff diff --git a/src/tls_ciphers.rs b/src/tls_ciphers.rs index ad5cdac..4cd9e9e 100644 --- a/src/tls_ciphers.rs +++ b/src/tls_ciphers.rs @@ -68,6 +68,7 @@ pub enum TlsCipherEnc { Camellia, Chacha20_Poly1305, Sm4, + Aegis, } /// Encryption modes @@ -167,7 +168,7 @@ impl TlsCipherSuite { | TlsCipherEnc::Seed | TlsCipherEnc::Sm4 => 16, // stream ciphers - TlsCipherEnc::Chacha20_Poly1305 | TlsCipherEnc::Rc4 => 0, + TlsCipherEnc::Chacha20_Poly1305 | TlsCipherEnc::Rc4 | TlsCipherEnc::Aegis => 0, } }