diff options
| author | Denys Vlasenko | 2018-11-25 17:27:48 +0100 |
|---|---|---|
| committer | Denys Vlasenko | 2018-11-25 17:27:48 +0100 |
| commit | 330d7f53f7890c0fbafa5b4769ce4ef23e734659 (patch) | |
| tree | 1154517106f5e1c87f1139e3192d3badbcc2d4b2 /networking/tls.c | |
| parent | a6192f347fb87289c9cfdc4d57b126d704eba0de (diff) | |
| download | busybox-330d7f53f7890c0fbafa5b4769ce4ef23e734659.zip busybox-330d7f53f7890c0fbafa5b4769ce4ef23e734659.tar.gz | |
tls: add a comment on expanding list of supported ciphers
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat (limited to 'networking/tls.c')
| -rw-r--r-- | networking/tls.c | 37 |
1 files changed, 30 insertions, 7 deletions
diff --git a/networking/tls.c b/networking/tls.c index 9833a0a..e64e84f 100644 --- a/networking/tls.c +++ b/networking/tls.c @@ -50,17 +50,39 @@ // ok: openssl s_client -connect cdn.kernel.org:443 -debug -tls1_2 -no_tls1 -no_tls1_1 -cipher AES128-GCM-SHA256 // ok: openssl s_client -connect cdn.kernel.org:443 -debug -tls1_2 -no_tls1 -no_tls1_1 -cipher AES128-SHA // (TLS_RSA_WITH_AES_128_CBC_SHA - in TLS 1.2 it's mandated to be always supported) -#define CIPHER_ID1 TLS_RSA_WITH_AES_256_CBC_SHA256 // no SERVER_KEY_EXCHANGE from peer +#define CIPHER_ID1 TLS_RSA_WITH_AES_256_CBC_SHA256 //0x003D // Works with "wget https://cdn.kernel.org/pub/linux/kernel/v4.x/linux-4.9.5.tar.xz" -#define CIPHER_ID2 TLS_RSA_WITH_AES_128_CBC_SHA +#define CIPHER_ID2 TLS_RSA_WITH_AES_128_CBC_SHA //0x003C // bug #11456: // ftp.openbsd.org only supports ECDHE-RSA-AESnnn-GCM-SHAnnn or ECDHE-RSA-CHACHA20-POLY1305 -#define CIPHER_ID3 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 +#define CIPHER_ID3 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 //0xC02F // host is.gd accepts only ECDHE-ECDSA-foo (the simplest which works: ECDHE-ECDSA-AES128-SHA 0xC009) -#define CIPHER_ID4 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA +#define CIPHER_ID4 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA //0xC009 #define NUM_CIPHERS 4 +//TODO: we can support all these: +// TLS_RSA_WITH_AES_128_CBC_SHA256 0x003C +// TLS_RSA_WITH_AES_256_CBC_SHA256 0x003D +// TLS_RSA_WITH_AES_128_GCM_SHA256 0x009C +// TLS_RSA_WITH_AES_256_GCM_SHA384 0x009D +// TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 0xC009 +// TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 0xC00A +// TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 0xC013 +// TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 0xC014 +// TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 0xC023 +////TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 0xC024 - can't do SHA384 yet +// TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 0xC027 +////TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 0xC028 - can't do SHA384 yet +// TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0xC02B +// TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0xC02C +// TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 0xC02F +// TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 0xC030 +//possibly these too: +// TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA 0xC035 +// TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA 0xC036 +// TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 0xC037 +////TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 0xC038 - can't do SHA384 yet #define TLS_DEBUG 0 @@ -142,6 +164,10 @@ #define TLS_DHE_PSK_WITH_AES_128_CBC_SHA 0x0090 /* 144 */ #define TLS_DHE_PSK_WITH_AES_256_CBC_SHA 0x0091 /* 145 */ #define TLS_RSA_WITH_SEED_CBC_SHA 0x0096 /* 150 */ +#define TLS_RSA_WITH_AES_128_GCM_SHA256 0x009C /*TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(128) Mac=AEAD */ +#define TLS_RSA_WITH_AES_256_GCM_SHA384 0x009D /*TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(256) Mac=AEAD */ +#define TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 0x009E /*TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(128) Mac=AEAD */ +#define TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 0x009F /*TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(256) Mac=AEAD */ #define TLS_PSK_WITH_AES_128_CBC_SHA256 0x00AE /* 174 */ #define TLS_PSK_WITH_AES_256_CBC_SHA384 0x00AF /* 175 */ #define TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA 0xC004 /* 49156 */ @@ -161,10 +187,7 @@ #define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 0xC028 /*TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384 */ #define TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 0xC029 /* 49193 */ #define TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 0xC02A /* 49194 */ - /* RFC 5288 "AES Galois Counter Mode (GCM) Cipher Suites for TLS" */ -#define TLS_RSA_WITH_AES_128_GCM_SHA256 0x009C /*TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(128) Mac=AEAD */ -#define TLS_RSA_WITH_AES_256_GCM_SHA384 0x009D /*TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(256) Mac=AEAD */ #define TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0xC02B /*TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD */ #define TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0xC02C /*TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD */ #define TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 0xC02D /* 49197 */ |