From 9f39a43e0d728721d5a9e2586ce47a57585591c5 Mon Sep 17 00:00:00 2001 From: Roland Shoemaker Date: Thu, 15 Oct 2020 18:32:20 -0700 Subject: crypto/tls: de-prioritize AES-GCM ciphers when lacking hardware support When either the server or client are lacking hardware support for AES-GCM ciphers, indicated by the server lacking the relevant instructions and by the client not putting AES-GCM ciphers at the top of its preference list, reorder the preference list to de-prioritize AES-GCM based ciphers when they are adjacent to other AEAD ciphers. Also updates a number of recorded openssl TLS tests which previously only specified TLS 1.2 cipher preferences (using -cipher), but not TLS 1.3 cipher preferences (using -ciphersuites), to specify both preferences, making these tests more predictable. Fixes #41181. Change-Id: Ied896c96c095481e755aaff9ff0746fb4cb9568e Reviewed-on: https://go-review.googlesource.com/c/go/+/262857 Run-TryBot: Roland Shoemaker TryBot-Result: Go Bot Reviewed-by: Filippo Valsorda Trust: Roland Shoemaker Trust: Katie Hockman --- src/crypto/tls/handshake_server.go | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'src/crypto/tls/handshake_server.go') diff --git a/src/crypto/tls/handshake_server.go b/src/crypto/tls/handshake_server.go index a7d44144cb..5a572a9db1 100644 --- a/src/crypto/tls/handshake_server.go +++ b/src/crypto/tls/handshake_server.go @@ -303,9 +303,23 @@ func (hs *serverHandshakeState) pickCipherSuite() error { if c.config.PreferServerCipherSuites { preferenceList = c.config.cipherSuites() supportedList = hs.clientHello.cipherSuites + + // If the client does not seem to have hardware support for AES-GCM, + // and the application did not specify a cipher suite preference order, + // prefer other AEAD ciphers even if we prioritized AES-GCM ciphers + // by default. + if c.config.CipherSuites == nil && !aesgcmPreferred(hs.clientHello.cipherSuites) { + preferenceList = deprioritizeAES(preferenceList) + } } else { preferenceList = hs.clientHello.cipherSuites supportedList = c.config.cipherSuites() + + // If we don't have hardware support for AES-GCM, prefer other AEAD + // ciphers even if the client prioritized AES-GCM. + if !hasAESGCMHardwareSupport { + preferenceList = deprioritizeAES(preferenceList) + } } hs.suite = selectCipherSuite(preferenceList, supportedList, hs.cipherSuiteOk) -- cgit v1.3