Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing Algorithms / Cipher Suites #1

Open
pinkforest opened this issue Sep 15, 2023 · 9 comments
Open

Missing Algorithms / Cipher Suites #1

pinkforest opened this issue Sep 15, 2023 · 9 comments

Comments

@pinkforest
Copy link
Contributor

pinkforest commented Sep 15, 2023

TBD - Just putting this up and working up what peeps may want

Assuming upstreamed impl:

RFC/IANA

Configurations

TLS 1.3 - Cipher Suites

Cipher Suite RFC Implemented
TLS_AES_128_GCM_SHA256 Must ✔️
TLS_AES_256_GCM_SHA384 Should ✔️
TLS_AES_128_CCM_SHA256 Should
TLS_CHACHA20_POLY1305_SHA256 Should ✔️
AEGIS .. - ?

TLS 1.3 - Algorithms

Algorithm RFC Scope Implemented Which Impl
rsa_pkcs1_sha256 Must certificates ✔️
rsa_pss_rsae_sha256 Must CertificateVerify and certificates ✔️
ecdsa_secp256r1_sha256 Must CertificateVerify and certificates ✔️
secp256r1 (NIST P-256) Must Key Exchange ✔️
X25519 (RFC7748) Should Key Exchange ✔️
X448 (RFC8418) draft Key Exchange

TLS 1.2 - Cipher Suites

Cipher Suite RFC Implemented Which Impl
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 ✔️
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA25 ✔️
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 Recommended 🤔
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 Recommended 🤔
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 Recommended 🤔
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 Recommended 🤔

Browser Support

Stats

@tarcieri
Copy link
Member

Re: TLS_DHE_* ciphersuites, we don't currently have an implementation of FFDH(E). I'm also not super enthusiastic about adding such support as it's effectively been obsoleted by the TLS_ECDHE_* ciphersuites.

@newpavlov
Copy link
Member

It would be nice to add the GOST cipher suite described in the RFC 9367, though we currently do not have implementation of the GOST curves (it should be relatively easy to add them based on the primeorder crate).

@ctz
Copy link

ctz commented Sep 26, 2023

It would be nice to add the GOST cipher suite

But... why? It's not widely deployed, and not really meaningfully better than the widely deployed alternatives (though admittedly I am not up to date on the literature there).

@newpavlov
Copy link
Member

newpavlov commented Sep 26, 2023

It's the same story as with FIPS, in some cases you don't have choice but to use it (and BTW I do dislike the MGM mode with its 127-bit nonces and lack of misuse resistance despite using two block cipher invocations per block). If someone is interested in implementing other regional standards, I think we should include them as well. Attracting such captive audience could be quite useful for additional security audits of the whole stack, since they often have to pass through a rigorous certification process.

@pinkforest
Copy link
Contributor Author

Does anyone remember know / what happened at IETF with OCB getting it to TLS 1.3 ?

Like after draft-zauner-tls-aes-ocb-04
Or https://mailarchive.ietf.org/arch/msg/tls/qZiGzQiePuURYTZrd3bHUFKrtD4/

I'm keen getting AEGIS supported given CAESAR entry and some draft activity in IETF + implementations picking up

Frank wrote Portable C libaegis and Zig AEGIS-..-X which ended into Zig std and picotls has implementation and BoringSSL has experimental etc. etc.

@tarcieri
Copy link
Member

I've recently asked about it. It's possible work might resume.

@pinkforest
Copy link
Contributor Author

When doing #66 it reminded OpenSSL has Goldilocks / curve448 supported group - since 2018 and FIPS 186-5 / RFC8418

@tarcieri
Copy link
Member

tarcieri commented May 3, 2024

There was some discussion of upstreaming an Ed448 implementation here: RustCrypto/elliptic-curves#114 (comment)

@pinkforest
Copy link
Contributor Author

pinkforest commented Jun 26, 2024

Frank has brought in Rust AEGIS here: https://github.com/jedisct1/rust-aegis

Would love to compose these things universaly via cfg's coming together at the rustls using binary - so raised issue:

Inspired by that - raised which begs overall configuration for CryptoProvider bringing it all together for the binary:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants