crypto/tls: de-prioritize AES-GCM ciphers when lacking hardware support

2020-11-10T01:40:27Z

When either the server or client are lacking hardware support for AES-GCM ciphers, indicated by the server lacking the relevant instructions and by the client not putting AES-GCM ciphers at the top of its preference list, reorder the preference list to de-prioritize AES-GCM based ciphers when they are adjacent to other AEAD ciphers. Also updates a number of recorded openssl TLS tests which previously only specified TLS 1.2 cipher preferences (using -cipher), but not TLS 1.3 cipher preferences (using -ciphersuites), to specify both preferences, making these tests more predictable. Fixes #41181. Change-Id: Ied896c96c095481e755aaff9ff0746fb4cb9568e Reviewed-on: https://go-review.googlesource.com/c/go/+/262857 Run-TryBot: Roland Shoemaker TryBot-Result: Go Bot Reviewed-by: Filippo Valsorda Trust: Roland Shoemaker Trust: Katie Hockman

crypto/tls: take key size into account in signature algorithm selection

2019-11-12T01:09:40Z

Fixes #29793 Change-Id: I6e389d166c2d9a2ba8664a41f4b9569f2481b27f Reviewed-on: https://go-review.googlesource.com/c/go/+/205177 Run-TryBot: Filippo Valsorda TryBot-Result: Gobot Gobot Reviewed-by: Katie Hockman

go/src/crypto/tls/testdata/Server-TLSv13-RSA-RSAPSS-TooSmall, branch makepkg

crypto/tls: de-prioritize AES-GCM ciphers when lacking hardware support

crypto/tls: take key size into account in signature algorithm selection