denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
17,753 Commits 1 Branch 0 Tags
328d7af6d2ed029f35e218df6085400792968fa4
Commit Graph
7 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Pascal Knecht 328d7af6d2 tls-crypto: Rename parameter to be more consistent 
Also add missing parameter in documentation of calculate_finished method.
 2021-02-12 14:35:23 +01:00
Pascal Knecht 6549adb608 tls-crypto: Fix invalid signature algorithm list building 
List building also added an additional length field which is required by
client-side TLS extensions but not for server-side certificate request
extension. Now the method only returns a list of supported signature
algorithms and the implementation is responsible to add additional
length fields.

Fixes: 07f826af67 ("Fixed encoding of TLS extensions (elliptic_curves and signature_algorithms)")
 2021-02-12 14:35:23 +01:00
Pascal Knecht f81c04e9e3 libtls: Add missing cipher suite and TLS extension constants 
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
- TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256

- Encrypt then MAC
- Extended master secret
- Session ticket

and also add missing suites in the unit test.
 2021-02-12 14:35:23 +01:00
Pascal Knecht d107198fcb tls-crypto: Rework cipher suite preference order 
The reworked list follows the order of modern browsers such as
Firefox. The new order prefers more secure ciphers over weaker ones.
 2021-02-12 14:35:23 +01:00
Pascal Knecht 8a6edc08a4 tls-crypto: Check if TLS versions and cipher suites match 
Only suggest TLS versions of supported cipher suites.  For instance, do not
suggest TLS 1.3 if none of its cipher suites (requiring GCM/CCM or
ChaPoly) are available.
 2021-02-12 14:35:23 +01:00
Pascal Knecht f920125304 tls-peer: Don't initiate TLS connection if no cipher suites are supported 
If zero cipher suites are left after all filters, tls-peer does not
try to establish a connection to the server anymore.
 2021-02-12 14:35:23 +01:00
Pascal Kandbytinbit 02d7405512 libtls: Implement HKDF for TLS 1.3 
TLS 1.3 uses HMAC-based Extract-and-Expand Key Derivation Function (HKDF)
as defined in RFC 5869 to compute traffic secrets.

Co-authored-by: bytinbit <[email protected]>
 2021-02-12 11:45:44 +01:00