From 9f39a43e0d728721d5a9e2586ce47a57585591c5 Mon Sep 17 00:00:00 2001 From: Roland Shoemaker Date: Thu, 15 Oct 2020 18:32:20 -0700 Subject: crypto/tls: de-prioritize AES-GCM ciphers when lacking hardware support When either the server or client are lacking hardware support for AES-GCM ciphers, indicated by the server lacking the relevant instructions and by the client not putting AES-GCM ciphers at the top of its preference list, reorder the preference list to de-prioritize AES-GCM based ciphers when they are adjacent to other AEAD ciphers. Also updates a number of recorded openssl TLS tests which previously only specified TLS 1.2 cipher preferences (using -cipher), but not TLS 1.3 cipher preferences (using -ciphersuites), to specify both preferences, making these tests more predictable. Fixes #41181. Change-Id: Ied896c96c095481e755aaff9ff0746fb4cb9568e Reviewed-on: https://go-review.googlesource.com/c/go/+/262857 Run-TryBot: Roland Shoemaker TryBot-Result: Go Bot Reviewed-by: Filippo Valsorda Trust: Roland Shoemaker Trust: Katie Hockman --- .../tls/testdata/Server-TLSv12-RSA-RSAPKCS1v15 | 63 ++++++++++------------ 1 file changed, 29 insertions(+), 34 deletions(-) (limited to 'src/crypto/tls/testdata/Server-TLSv12-RSA-RSAPKCS1v15') diff --git a/src/crypto/tls/testdata/Server-TLSv12-RSA-RSAPKCS1v15 b/src/crypto/tls/testdata/Server-TLSv12-RSA-RSAPKCS1v15 index 0e9be7fbdb..b193771e4e 100644 --- a/src/crypto/tls/testdata/Server-TLSv12-RSA-RSAPKCS1v15 +++ b/src/crypto/tls/testdata/Server-TLSv12-RSA-RSAPKCS1v15 @@ -1,18 +1,14 @@ >>> Flow 1 (client to server) -00000000 16 03 01 00 91 01 00 00 8d 03 03 84 aa e5 17 f4 |................| -00000010 80 c4 fb ca 14 f7 c9 d9 55 f0 8e 63 f9 e1 7e ad |........U..c..~.| -00000020 e7 5e 60 e9 2b dd 22 dd d1 11 93 00 00 2a c0 30 |.^`.+."......*.0| -00000030 00 9f cc a8 cc aa c0 2f 00 9e c0 28 00 6b c0 27 |......./...(.k.'| -00000040 00 67 c0 14 00 39 c0 13 00 33 00 9d 00 9c 00 3d |.g...9...3.....=| -00000050 00 3c 00 35 00 2f 00 ff 01 00 00 3a 00 00 00 0e |.<.5./.....:....| -00000060 00 0c 00 00 09 31 32 37 2e 30 2e 30 2e 31 00 0b |.....127.0.0.1..| -00000070 00 04 03 00 01 02 00 0a 00 0c 00 0a 00 1d 00 17 |................| -00000080 00 1e 00 19 00 18 00 16 00 00 00 17 00 00 00 0d |................| -00000090 00 04 00 02 04 01 |......| +00000000 16 03 01 00 59 01 00 00 55 03 03 60 c3 e9 6a 99 |....Y...U..`..j.| +00000010 72 7a 1c b9 1e 10 4b 9a 82 d5 ea b9 b0 6f 1e 05 |rz....K......o..| +00000020 74 a4 35 bb 71 c7 d2 56 87 b8 69 00 00 04 cc a8 |t.5.q..V..i.....| +00000030 00 ff 01 00 00 28 00 0b 00 04 03 00 01 02 00 0a |.....(..........| +00000040 00 0c 00 0a 00 1d 00 17 00 1e 00 19 00 18 00 16 |................| +00000050 00 00 00 17 00 00 00 0d 00 04 00 02 04 01 |..............| >>> Flow 2 (server to client) 00000000 16 03 03 00 37 02 00 00 33 03 03 00 00 00 00 00 |....7...3.......| 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| -00000020 00 00 00 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 |...DOWNGRD...0..| +00000020 00 00 00 44 4f 57 4e 47 52 44 01 00 cc a8 00 00 |...DOWNGRD......| 00000030 0b ff 01 00 01 00 00 0b 00 02 01 00 16 03 03 02 |................| 00000040 59 0b 00 02 55 00 02 52 00 02 4f 30 82 02 4b 30 |Y...U..R..O0..K0| 00000050 82 01 b4 a0 03 02 01 02 02 09 00 e8 f0 9d 3f e2 |..............?.| @@ -54,29 +50,28 @@ 00000290 13 60 84 5c 21 d3 3b e9 fa e7 16 03 03 00 ac 0c |.`.\!.;.........| 000002a0 00 00 a8 03 00 1d 20 2f e5 7d a3 47 cd 62 43 15 |...... /.}.G.bC.| 000002b0 28 da ac 5f bb 29 07 30 ff f6 84 af c4 cf c2 ed |(.._.).0........| -000002c0 90 99 5f 58 cb 3b 74 04 01 00 80 2c d2 21 86 4f |.._X.;t....,.!.O| -000002d0 e0 b7 f1 7d f8 8f ca b3 e7 ef 34 e5 ea 78 12 b1 |...}......4..x..| -000002e0 92 1b 1b 7f 35 da 38 cb a9 1a 52 97 0e df 33 83 |....5.8...R...3.| -000002f0 e2 10 cb 72 78 41 66 9b 55 c9 a3 0b de ef b5 f3 |...rxAf.U.......| -00000300 8e 11 fa 5c a5 2a 93 29 b0 e2 42 9b 07 55 bd 6c |...\.*.)..B..U.l| -00000310 fa 3e a5 5b 2c 5b 3e d8 fa 76 6b d4 63 2c 47 22 |.>.[,[>..vk.c,G"| -00000320 17 92 9c 40 a4 f3 b3 a4 6d 12 da f7 d9 58 11 3f |...@....m....X.?| -00000330 1a 12 8a c8 19 a6 f8 e0 49 b8 6b 79 34 5f f2 46 |........I.ky4_.F| -00000340 27 62 e2 0e 13 93 74 b5 0b 63 8a 16 03 03 00 04 |'b....t..c......| +000002c0 90 99 5f 58 cb 3b 74 04 01 00 80 4e c9 fd 39 89 |.._X.;t....N..9.| +000002d0 52 c1 6b ba 3b c9 02 35 89 e8 e3 f8 41 15 ee 6d |R.k.;..5....A..m| +000002e0 f6 08 6d 1a 47 aa 3b 5c 1d 9b 42 9b 50 85 af 56 |..m.G.;\..B.P..V| +000002f0 a3 99 78 84 7f 06 91 97 e9 33 0d 1d 9b 17 ce 3b |..x......3.....;| +00000300 30 f2 d0 10 1c b6 e2 7d fd b3 e1 bc 14 7a 1a 96 |0......}.....z..| +00000310 be b9 dc 0d 29 33 84 5f d1 77 91 0a a1 f2 2b cc |....)3._.w....+.| +00000320 dc 5e 9b f9 8b e3 34 d2 bd f3 46 b4 0d 97 de 44 |.^....4...F....D| +00000330 aa 83 10 82 bd ca 83 27 d0 40 a7 b1 64 15 dd 84 |.......'.@..d...| +00000340 5f 3c d9 62 42 0d 8f a6 19 0f b1 16 03 03 00 04 |_<.bB...........| 00000350 0e 00 00 00 |....| >>> Flow 3 (client to server) -00000000 16 03 03 00 25 10 00 00 21 20 0a 81 a9 76 78 5f |....%...! ...vx_| -00000010 f2 35 87 19 ed 3d 0b 1c 51 ff b7 51 c9 03 5a de |.5...=..Q..Q..Z.| -00000020 04 e6 47 3c d0 fe 32 75 64 28 14 03 03 00 01 01 |..G<..2ud(......| -00000030 16 03 03 00 28 90 38 86 3b 34 cf 30 74 00 91 55 |....(.8.;4.0t..U| -00000040 82 bd 9b 3a 78 34 09 3f a6 33 3f 7a 77 a5 53 67 |...:x4.?.3?zw.Sg| -00000050 30 94 30 cb 19 0c a8 ac 10 54 b8 90 57 |0.0......T..W| +00000000 16 03 03 00 25 10 00 00 21 20 82 3a 50 41 f7 b1 |....%...! .:PA..| +00000010 0f 97 ba 38 04 db f3 a6 ec 8b d1 db 06 c1 84 89 |...8............| +00000020 a0 53 84 92 27 a2 53 e8 5d 21 14 03 03 00 01 01 |.S..'.S.]!......| +00000030 16 03 03 00 20 7d 80 6d 7f a9 28 d6 0d 50 d6 b4 |.... }.m..(..P..| +00000040 24 d3 92 f8 0b 8e 6b d8 7c 64 9e 6c 87 a9 8e 37 |$.....k.|d.l...7| +00000050 9e 1b 0b 2d a5 |...-.| >>> Flow 4 (server to client) -00000000 14 03 03 00 01 01 16 03 03 00 28 00 00 00 00 00 |..........(.....| -00000010 00 00 00 e5 08 6e 55 df 84 0e 16 f9 e2 b0 44 3c |.....nU.......D<| -00000020 e7 e4 a1 e2 61 ee 18 cb bd c1 71 8f aa 23 c7 e1 |....a.....q..#..| -00000030 de ab 86 17 03 03 00 25 00 00 00 00 00 00 00 01 |.......%........| -00000040 6d 0c 13 09 51 5e 5b e8 2a 85 c6 99 7e 9a 7d 79 |m...Q^[.*...~.}y| -00000050 45 9b 63 18 d0 41 3d e7 78 24 93 52 11 15 03 03 |E.c..A=.x$.R....| -00000060 00 1a 00 00 00 00 00 00 00 02 ec a4 cf b9 7a 35 |..............z5| -00000070 9b 64 01 f4 7e 7d f0 08 05 79 7b 46 |.d..~}...y{F| +00000000 14 03 03 00 01 01 16 03 03 00 20 e4 58 cf fb 81 |.......... .X...| +00000010 be dd 5b 98 97 bd bd 6a f0 76 92 b6 bb 2c 8f a3 |..[....j.v...,..| +00000020 e5 52 5b 1d f4 17 7b 2a a8 40 26 17 03 03 00 1d |.R[...{*.@&.....| +00000030 58 ef 4f 1d 98 0f 3d 59 88 df 6e ac c9 37 43 d5 |X.O...=Y..n..7C.| +00000040 f5 58 b3 7a 62 a3 7d 26 a2 a2 80 23 ef 15 03 03 |.X.zb.}&...#....| +00000050 00 12 05 b8 57 6a 80 71 b6 a4 58 94 15 f4 2f 0c |....Wj.q..X.../.| +00000060 8e 76 b2 aa |.v..| -- cgit v1.3