diff options
author | Dr. Stephen Henson <steve@openssl.org> | 2001-02-07 18:15:18 +0000 |
---|---|---|
committer | Dr. Stephen Henson <steve@openssl.org> | 2001-02-07 18:15:18 +0000 |
commit | deb2c1a1c58fb738b3216b663212572170de8183 (patch) | |
tree | f6aa0527d08b8fdcf4ce63eaf85aa3d6a73b1c34 /ssl | |
parent | d4219c485b34818df8aa530f7d8d1c1daff44306 (diff) | |
download | openssl-new-deb2c1a1c58fb738b3216b663212572170de8183.tar.gz |
Fix AES code.
Update Rijndael source to v3.0
Add AES OIDs.
Change most references of Rijndael to AES.
Add new draft AES ciphersuites.
Diffstat (limited to 'ssl')
-rw-r--r-- | ssl/s3_lib.c | 160 | ||||
-rw-r--r-- | ssl/ssl.h | 2 | ||||
-rw-r--r-- | ssl/ssl_algs.c | 9 | ||||
-rw-r--r-- | ssl/ssl_ciph.c | 40 | ||||
-rw-r--r-- | ssl/ssl_locl.h | 2 | ||||
-rw-r--r-- | ssl/tls1.h | 34 |
6 files changed, 209 insertions, 38 deletions
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c index c4239f3ca6..700a4ddbbf 100644 --- a/ssl/s3_lib.c +++ b/ssl/s3_lib.c @@ -615,6 +615,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={ SSL_ALL_STRENGTHS, }, #endif /* NO_KRB5 */ + + #if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES /* New TLS Export CipherSuites */ /* Cipher 60 */ @@ -708,20 +710,166 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={ SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS }, - /* Cipher ?? */ +#endif + /* New AES ciphersuites */ + + /* Cipher 2F */ { 1, - TLS1_TXT_RSA_WITH_RD_128_SHA, - TLS1_CK_RSA_WITH_RD_128_SHA, - SSL_kRSA|SSL_aRSA|SSL_RD|SSL_SHA |SSL_TLSV1, - SSL_NOT_EXP|SSL_HIGH, + TLS1_TXT_RSA_WITH_AES_128_SHA, + TLS1_CK_RSA_WITH_AES_128_SHA, + SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1, + SSL_NOT_EXP|SSL_MEDIUM, 0, 128, 128, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS, }, -#endif + /* Cipher 30 */ + { + 0, + TLS1_TXT_DH_DSS_WITH_AES_128_SHA, + TLS1_CK_DH_DSS_WITH_AES_128_SHA, + SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1, + SSL_NOT_EXP|SSL_MEDIUM, + 0, + 128, + 128, + SSL_ALL_CIPHERS, + SSL_ALL_STRENGTHS, + }, + /* Cipher 31 */ + { + 0, + TLS1_TXT_DH_RSA_WITH_AES_128_SHA, + TLS1_CK_DH_RSA_WITH_AES_128_SHA, + SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1, + SSL_NOT_EXP|SSL_MEDIUM, + 0, + 128, + 128, + SSL_ALL_CIPHERS, + SSL_ALL_STRENGTHS, + }, + /* Cipher 32 */ + { + 1, + TLS1_TXT_DHE_DSS_WITH_AES_128_SHA, + TLS1_CK_DHE_DSS_WITH_AES_128_SHA, + SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1, + SSL_NOT_EXP|SSL_MEDIUM, + 0, + 128, + 128, + SSL_ALL_CIPHERS, + SSL_ALL_STRENGTHS, + }, + /* Cipher 33 */ + { + 1, + TLS1_TXT_DHE_RSA_WITH_AES_128_SHA, + TLS1_CK_DHE_RSA_WITH_AES_128_SHA, + SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1, + SSL_NOT_EXP|SSL_MEDIUM, + 0, + 128, + 128, + SSL_ALL_CIPHERS, + SSL_ALL_STRENGTHS, + }, + /* Cipher 34 */ + { + 1, + TLS1_TXT_ADH_WITH_AES_128_SHA, + TLS1_CK_ADH_WITH_AES_128_SHA, + SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1, + SSL_NOT_EXP|SSL_MEDIUM, + 0, + 128, + 128, + SSL_ALL_CIPHERS, + SSL_ALL_STRENGTHS, + }, + + /* Cipher 35 */ + { + 1, + TLS1_TXT_RSA_WITH_AES_256_SHA, + TLS1_CK_RSA_WITH_AES_256_SHA, + SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1, + SSL_NOT_EXP|SSL_HIGH, + 0, + 256, + 256, + SSL_ALL_CIPHERS, + SSL_ALL_STRENGTHS, + }, + /* Cipher 36 */ + { + 0, + TLS1_TXT_DH_DSS_WITH_AES_256_SHA, + TLS1_CK_DH_DSS_WITH_AES_256_SHA, + SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1, + SSL_NOT_EXP|SSL_HIGH, + 0, + 256, + 256, + SSL_ALL_CIPHERS, + SSL_ALL_STRENGTHS, + }, + /* Cipher 37 */ + { + 0, + TLS1_TXT_DH_RSA_WITH_AES_256_SHA, + TLS1_CK_DH_RSA_WITH_AES_256_SHA, + SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1, + SSL_NOT_EXP|SSL_HIGH, + 0, + 256, + 256, + SSL_ALL_CIPHERS, + SSL_ALL_STRENGTHS, + }, + /* Cipher 38 */ + { + 1, + TLS1_TXT_DHE_DSS_WITH_AES_256_SHA, + TLS1_CK_DHE_DSS_WITH_AES_256_SHA, + SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1, + SSL_NOT_EXP|SSL_HIGH, + 0, + 256, + 256, + SSL_ALL_CIPHERS, + SSL_ALL_STRENGTHS, + }, + /* Cipher 39 */ + { + 1, + TLS1_TXT_DHE_RSA_WITH_AES_256_SHA, + TLS1_CK_DHE_RSA_WITH_AES_256_SHA, + SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1, + SSL_NOT_EXP|SSL_HIGH, + 0, + 256, + 256, + SSL_ALL_CIPHERS, + SSL_ALL_STRENGTHS, + }, + /* Cipher 3A */ + { + 1, + TLS1_TXT_ADH_WITH_AES_256_SHA, + TLS1_CK_ADH_WITH_AES_256_SHA, + SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1, + SSL_NOT_EXP|SSL_HIGH, + 0, + 256, + 256, + SSL_ALL_CIPHERS, + SSL_ALL_STRENGTHS, + }, /* end of list */ }; @@ -153,7 +153,7 @@ extern "C" { #define SSL_TXT_RC4 "RC4" #define SSL_TXT_RC2 "RC2" #define SSL_TXT_IDEA "IDEA" -#define SSL_TXT_RD "RD" +#define SSL_TXT_AES "AES" #define SSL_TXT_MD5 "MD5" #define SSL_TXT_SHA1 "SHA1" #define SSL_TXT_SHA "SHA" diff --git a/ssl/ssl_algs.c b/ssl/ssl_algs.c index 52d127ed67..549c3e8d5e 100644 --- a/ssl/ssl_algs.c +++ b/ssl/ssl_algs.c @@ -63,7 +63,6 @@ int SSL_library_init(void) { - int k; #ifndef NO_DES EVP_add_cipher(EVP_des_cbc()); @@ -78,9 +77,11 @@ int SSL_library_init(void) #ifndef NO_RC2 EVP_add_cipher(EVP_rc2_cbc()); #endif - for(k=0 ; k < 2 ; ++k) - EVP_add_cipher(EVP_rijndael_cbc(0,k)); - +#ifndef NO_AES + EVP_add_cipher(EVP_aes_128_cbc()); + EVP_add_cipher(EVP_aes_192_cbc()); + EVP_add_cipher(EVP_aes_256_cbc()); +#endif #ifndef NO_MD2 EVP_add_digest(EVP_md2()); #endif diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c index cb9a725327..368f90e3b8 100644 --- a/ssl/ssl_ciph.c +++ b/ssl/ssl_ciph.c @@ -68,10 +68,9 @@ #define SSL_ENC_IDEA_IDX 4 #define SSL_ENC_eFZA_IDX 5 #define SSL_ENC_NULL_IDX 6 -#define SSL_ENC_RD128_IDX 7 -#define SSL_ENC_RD192_IDX 8 -#define SSL_ENC_RD256_IDX 9 -#define SSL_ENC_NUM_IDX 10 +#define SSL_ENC_AES128_IDX 7 +#define SSL_ENC_AES256_IDX 8 +#define SSL_ENC_NUM_IDX 9 static const EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX]={ NULL,NULL,NULL,NULL,NULL,NULL, @@ -127,7 +126,7 @@ static const SSL_CIPHER cipher_aliases[]={ {0,SSL_TXT_IDEA,0,SSL_IDEA, 0,0,0,0,SSL_ENC_MASK,0}, {0,SSL_TXT_eNULL,0,SSL_eNULL,0,0,0,0,SSL_ENC_MASK,0}, {0,SSL_TXT_eFZA,0,SSL_eFZA, 0,0,0,0,SSL_ENC_MASK,0}, - {0,SSL_TXT_RD, 0,SSL_RD, 0,0,0,0,SSL_ENC_MASK,0}, + {0,SSL_TXT_AES, 0,SSL_AES, 0,0,0,0,SSL_ENC_MASK,0}, {0,SSL_TXT_MD5, 0,SSL_MD5, 0,0,0,0,SSL_MAC_MASK,0}, {0,SSL_TXT_SHA1,0,SSL_SHA1, 0,0,0,0,SSL_MAC_MASK,0}, @@ -167,12 +166,10 @@ static void load_ciphers(void) EVP_get_cipherbyname(SN_rc2_cbc); ssl_cipher_methods[SSL_ENC_IDEA_IDX]= EVP_get_cipherbyname(SN_idea_cbc); - ssl_cipher_methods[SSL_ENC_RD128_IDX]= - EVP_get_cipherbyname(SN_rd128_cbc_b128); - ssl_cipher_methods[SSL_ENC_RD192_IDX]= - EVP_get_cipherbyname(SN_rd192_cbc_b128); - ssl_cipher_methods[SSL_ENC_RD256_IDX]= - EVP_get_cipherbyname(SN_rd256_cbc_b128); + ssl_cipher_methods[SSL_ENC_AES128_IDX]= + EVP_get_cipherbyname(SN_aes_128_cbc); + ssl_cipher_methods[SSL_ENC_AES256_IDX]= + EVP_get_cipherbyname(SN_aes_256_cbc); ssl_digest_methods[SSL_MD_MD5_IDX]= EVP_get_digestbyname(SN_md5); @@ -233,12 +230,11 @@ int ssl_cipher_get_evp(SSL_SESSION *s, const EVP_CIPHER **enc, case SSL_eNULL: i=SSL_ENC_NULL_IDX; break; - case SSL_RD: + case SSL_AES: switch(c->alg_bits) { - case 128: i=SSL_ENC_RD128_IDX; break; - case 192: i=SSL_ENC_RD192_IDX; break; - case 256: i=SSL_ENC_RD256_IDX; break; + case 128: i=SSL_ENC_AES128_IDX; break; + case 256: i=SSL_ENC_AES256_IDX; break; default: i=-1; break; } break; @@ -327,7 +323,7 @@ static unsigned long ssl_cipher_get_disabled(void) mask |= (ssl_cipher_methods[SSL_ENC_RC2_IDX ] == NULL) ? SSL_RC2 :0; mask |= (ssl_cipher_methods[SSL_ENC_IDEA_IDX] == NULL) ? SSL_IDEA:0; mask |= (ssl_cipher_methods[SSL_ENC_eFZA_IDX] == NULL) ? SSL_eFZA:0; - mask |= (ssl_cipher_methods[SSL_ENC_RD128_IDX] == NULL) ? SSL_RD:0; + mask |= (ssl_cipher_methods[SSL_ENC_AES128_IDX] == NULL) ? SSL_AES:0; mask |= (ssl_digest_methods[SSL_MD_MD5_IDX ] == NULL) ? SSL_MD5 :0; mask |= (ssl_digest_methods[SSL_MD_SHA1_IDX] == NULL) ? SSL_SHA1:0; @@ -999,13 +995,13 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len) case SSL_eNULL: enc="None"; break; - case SSL_RD: - switch(cipher->strength_bits == 128) + case SSL_AES: + switch(cipher->strength_bits) { - case 128: enc="Rijndael(128)"; break; - case 192: enc="Rijndael(192)"; break; - case 256: enc="Rijndael(256)"; break; - default: enc="Rijndael(???)"; break; + case 128: enc="AES(128)"; break; + case 192: enc="AES(192)"; break; + case 256: enc="AES(256)"; break; + default: enc="AES(???)"; break; } break; default: diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index 3ab23ded24..cc45cbddd0 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -259,7 +259,7 @@ #define SSL_IDEA 0x00010000L #define SSL_eFZA 0x00020000L #define SSL_eNULL 0x00040000L -#define SSL_RD 0x00800000L +#define SSL_AES 0x00800000L #define SSL_MAC_MASK 0x00180000L #define SSL_MD5 0x00080000L diff --git a/ssl/tls1.h b/ssl/tls1.h index 0ee8207612..ac5410b472 100644 --- a/ssl/tls1.h +++ b/ssl/tls1.h @@ -95,8 +95,22 @@ extern "C" { #define TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA 0x03000064 #define TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA 0x03000065 #define TLS1_CK_DHE_DSS_WITH_RC4_128_SHA 0x03000066 - /* not yet real */ -#define TLS1_CK_RSA_WITH_RD_128_SHA 0x03000067 + + /* AES ciphersuites from draft ietf-tls-ciphersuite-03.txt */ + +#define TLS1_CK_RSA_WITH_AES_128_SHA 0x0300002F +#define TLS1_CK_DH_DSS_WITH_AES_128_SHA 0x03000030 +#define TLS1_CK_DH_RSA_WITH_AES_128_SHA 0x03000031 +#define TLS1_CK_DHE_DSS_WITH_AES_128_SHA 0x03000032 +#define TLS1_CK_DHE_RSA_WITH_AES_128_SHA 0x03000033 +#define TLS1_CK_ADH_WITH_AES_128_SHA 0x03000034 + +#define TLS1_CK_RSA_WITH_AES_256_SHA 0x03000035 +#define TLS1_CK_DH_DSS_WITH_AES_256_SHA 0x03000036 +#define TLS1_CK_DH_RSA_WITH_AES_256_SHA 0x03000037 +#define TLS1_CK_DHE_DSS_WITH_AES_256_SHA 0x03000038 +#define TLS1_CK_DHE_RSA_WITH_AES_256_SHA 0x03000039 +#define TLS1_CK_ADH_WITH_AES_256_SHA 0x0300003A /* XXX * Inconsistency alert: @@ -112,8 +126,20 @@ extern "C" { #define TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA "EXP1024-RC4-SHA" #define TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA "EXP1024-DHE-DSS-RC4-SHA" #define TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA "DHE-DSS-RC4-SHA" - /* Not yet real */ -#define TLS1_TXT_RSA_WITH_RD_128_SHA "RD128-SHA" + /* AES ciphersuites from draft ietf-tls-ciphersuite-03.txt */ +#define TLS1_TXT_RSA_WITH_AES_128_SHA "AES128-SHA" +#define TLS1_TXT_DH_DSS_WITH_AES_128_SHA "DH-DSS-AES128-SHA" +#define TLS1_TXT_DH_RSA_WITH_AES_128_SHA "DH-RSA-AES128-SHA" +#define TLS1_TXT_DHE_DSS_WITH_AES_128_SHA "DHE-DSS-AES128-SHA" +#define TLS1_TXT_DHE_RSA_WITH_AES_128_SHA "DHE-RSA-AES128-SHA" +#define TLS1_TXT_ADH_WITH_AES_128_SHA "ADH-AES128-SHA" + +#define TLS1_TXT_RSA_WITH_AES_256_SHA "AES256-SHA" +#define TLS1_TXT_DH_DSS_WITH_AES_256_SHA "DH-DSS-AES256-SHA" +#define TLS1_TXT_DH_RSA_WITH_AES_256_SHA "DH-RSA-AES256-SHA" +#define TLS1_TXT_DHE_DSS_WITH_AES_256_SHA "DHE-DSS-AES256-SHA" +#define TLS1_TXT_DHE_RSA_WITH_AES_256_SHA "DHE-RSA-AES256-SHA" +#define TLS1_TXT_ADH_WITH_AES_256_SHA "ADH-AES256-SHA" #define TLS_CT_RSA_SIGN 1 |