mirror of
https://github.com/golang/go.git
synced 2025-12-08 06:10:04 +00:00
crypto/tls: use standard chacha20-poly1305 cipher suite names
The different chacha20-poly1305 cipher suites were renamed to include the _SHA256 suffix, which is the canonical naming convention. The occurrences of the old names were still not updated, which can lead to confusion when searching for the canonical names in the codebase. Change-Id: I4f90e9cbedc3552c3481c8b0c616b6f915ddd345 Reviewed-on: https://go-review.googlesource.com/c/go/+/689135 Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Michael Knyszek <mknyszek@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
This commit is contained in:
qmuntal
Quim Muntal
parent
8330fb48a6
commit
2174a7936c
3 changed files with 28 additions and 28 deletions
|
|
@ -149,8 +149,8 @@ type cipherSuite struct {
|
|||
}
|
||||
|
||||
var cipherSuites = []*cipherSuite{ // TODO: replace with a map, since the order doesn't matter.
|
||||
{TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, 32, 0, 12, ecdheRSAKA, suiteECDHE | suiteTLS12, nil, nil, aeadChaCha20Poly1305},
|
||||
{TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, 32, 0, 12, ecdheECDSAKA, suiteECDHE | suiteECSign | suiteTLS12, nil, nil, aeadChaCha20Poly1305},
|
||||
{TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, 32, 0, 12, ecdheRSAKA, suiteECDHE | suiteTLS12, nil, nil, aeadChaCha20Poly1305},
|
||||
{TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, 32, 0, 12, ecdheECDSAKA, suiteECDHE | suiteECSign | suiteTLS12, nil, nil, aeadChaCha20Poly1305},
|
||||
{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 16, 0, 4, ecdheRSAKA, suiteECDHE | suiteTLS12, nil, nil, aeadAESGCM},
|
||||
{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 16, 0, 4, ecdheECDSAKA, suiteECDHE | suiteECSign | suiteTLS12, nil, nil, aeadAESGCM},
|
||||
{TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, 32, 0, 4, ecdheRSAKA, suiteECDHE | suiteTLS12 | suiteSHA384, nil, nil, aeadAESGCM},
|
||||
|
|
@ -284,7 +284,7 @@ var cipherSuitesPreferenceOrder = []uint16{
|
|||
// AEADs w/ ECDHE
|
||||
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
|
||||
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
|
||||
// CBC w/ ECDHE
|
||||
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
|
||||
|
|
@ -313,7 +313,7 @@ var cipherSuitesPreferenceOrder = []uint16{
|
|||
|
||||
var cipherSuitesPreferenceOrderNoAES = []uint16{
|
||||
// ChaCha20Poly1305
|
||||
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
|
||||
// AES-GCM w/ ECDHE
|
||||
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
|
|
|
|||
|
|
@ -638,7 +638,7 @@ func TestHandshakeClientHelloRetryRequest(t *testing.T) {
|
|||
|
||||
func TestHandshakeClientECDHERSAChaCha20(t *testing.T) {
|
||||
config := testConfig.Clone()
|
||||
config.CipherSuites = []uint16{TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305}
|
||||
config.CipherSuites = []uint16{TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256}
|
||||
|
||||
test := &clientTest{
|
||||
name: "ECDHE-RSA-CHACHA20-POLY1305",
|
||||
|
|
@ -651,7 +651,7 @@ func TestHandshakeClientECDHERSAChaCha20(t *testing.T) {
|
|||
|
||||
func TestHandshakeClientECDHEECDSAChaCha20(t *testing.T) {
|
||||
config := testConfig.Clone()
|
||||
config.CipherSuites = []uint16{TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305}
|
||||
config.CipherSuites = []uint16{TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256}
|
||||
|
||||
test := &clientTest{
|
||||
name: "ECDHE-ECDSA-CHACHA20-POLY1305",
|
||||
|
|
|
|||
|
|
@ -1379,31 +1379,31 @@ func BenchmarkHandshakeServer(b *testing.B) {
|
|||
})
|
||||
b.Run("ECDHE-P256-RSA", func(b *testing.B) {
|
||||
b.Run("TLSv13", func(b *testing.B) {
|
||||
benchmarkHandshakeServer(b, VersionTLS13, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
benchmarkHandshakeServer(b, VersionTLS13, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
CurveP256, testRSACertificate, testRSAPrivateKey)
|
||||
})
|
||||
b.Run("TLSv12", func(b *testing.B) {
|
||||
benchmarkHandshakeServer(b, VersionTLS12, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
benchmarkHandshakeServer(b, VersionTLS12, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
CurveP256, testRSACertificate, testRSAPrivateKey)
|
||||
})
|
||||
})
|
||||
b.Run("ECDHE-P256-ECDSA-P256", func(b *testing.B) {
|
||||
b.Run("TLSv13", func(b *testing.B) {
|
||||
benchmarkHandshakeServer(b, VersionTLS13, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
|
||||
benchmarkHandshakeServer(b, VersionTLS13, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
CurveP256, testP256Certificate, testP256PrivateKey)
|
||||
})
|
||||
b.Run("TLSv12", func(b *testing.B) {
|
||||
benchmarkHandshakeServer(b, VersionTLS12, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
|
||||
benchmarkHandshakeServer(b, VersionTLS12, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
CurveP256, testP256Certificate, testP256PrivateKey)
|
||||
})
|
||||
})
|
||||
b.Run("ECDHE-X25519-ECDSA-P256", func(b *testing.B) {
|
||||
b.Run("TLSv13", func(b *testing.B) {
|
||||
benchmarkHandshakeServer(b, VersionTLS13, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
|
||||
benchmarkHandshakeServer(b, VersionTLS13, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
X25519, testP256Certificate, testP256PrivateKey)
|
||||
})
|
||||
b.Run("TLSv12", func(b *testing.B) {
|
||||
benchmarkHandshakeServer(b, VersionTLS12, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
|
||||
benchmarkHandshakeServer(b, VersionTLS12, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
X25519, testP256Certificate, testP256PrivateKey)
|
||||
})
|
||||
})
|
||||
|
|
@ -1412,11 +1412,11 @@ func BenchmarkHandshakeServer(b *testing.B) {
|
|||
b.Fatal("test ECDSA key doesn't use curve P-521")
|
||||
}
|
||||
b.Run("TLSv13", func(b *testing.B) {
|
||||
benchmarkHandshakeServer(b, VersionTLS13, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
|
||||
benchmarkHandshakeServer(b, VersionTLS13, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
CurveP521, testECDSACertificate, testECDSAPrivateKey)
|
||||
})
|
||||
b.Run("TLSv12", func(b *testing.B) {
|
||||
benchmarkHandshakeServer(b, VersionTLS12, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
|
||||
benchmarkHandshakeServer(b, VersionTLS12, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
CurveP521, testECDSACertificate, testECDSAPrivateKey)
|
||||
})
|
||||
})
|
||||
|
|
@ -1792,28 +1792,28 @@ func TestAESCipherReordering(t *testing.T) {
|
|||
{
|
||||
name: "server has hardware AES, client doesn't (pick ChaCha)",
|
||||
clientCiphers: []uint16{
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_RSA_WITH_AES_128_CBC_SHA,
|
||||
},
|
||||
serverHasAESGCM: true,
|
||||
expectedCipher: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
expectedCipher: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
},
|
||||
{
|
||||
name: "client prefers AES-GCM, server doesn't have hardware AES (pick ChaCha)",
|
||||
clientCiphers: []uint16{
|
||||
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
TLS_RSA_WITH_AES_128_CBC_SHA,
|
||||
},
|
||||
serverHasAESGCM: false,
|
||||
expectedCipher: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
expectedCipher: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
},
|
||||
{
|
||||
name: "client prefers AES-GCM, server has hardware AES (pick AES-GCM)",
|
||||
clientCiphers: []uint16{
|
||||
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
TLS_RSA_WITH_AES_128_CBC_SHA,
|
||||
},
|
||||
serverHasAESGCM: true,
|
||||
|
|
@ -1824,7 +1824,7 @@ func TestAESCipherReordering(t *testing.T) {
|
|||
clientCiphers: []uint16{
|
||||
0x0A0A, // GREASE value
|
||||
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
TLS_RSA_WITH_AES_128_CBC_SHA,
|
||||
},
|
||||
serverHasAESGCM: true,
|
||||
|
|
@ -1845,27 +1845,27 @@ func TestAESCipherReordering(t *testing.T) {
|
|||
clientCiphers: []uint16{
|
||||
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_RSA_WITH_AES_128_CBC_SHA,
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
},
|
||||
serverHasAESGCM: false,
|
||||
expectedCipher: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
expectedCipher: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
},
|
||||
{
|
||||
name: "client prefers AES-GCM over ChaCha and sends GREASE, server doesn't have hardware AES (pick ChaCha)",
|
||||
clientCiphers: []uint16{
|
||||
0x0A0A, // GREASE value
|
||||
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
TLS_RSA_WITH_AES_128_CBC_SHA,
|
||||
},
|
||||
serverHasAESGCM: false,
|
||||
expectedCipher: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
expectedCipher: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
},
|
||||
{
|
||||
name: "client supports multiple AES-GCM, server doesn't have hardware AES and doesn't support ChaCha (AES-GCM)",
|
||||
clientCiphers: []uint16{
|
||||
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
},
|
||||
serverHasAESGCM: false,
|
||||
|
|
@ -1879,14 +1879,14 @@ func TestAESCipherReordering(t *testing.T) {
|
|||
name: "client prefers AES-GCM, server has hardware but doesn't support AES (pick ChaCha)",
|
||||
clientCiphers: []uint16{
|
||||
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
TLS_RSA_WITH_AES_128_CBC_SHA,
|
||||
},
|
||||
serverHasAESGCM: true,
|
||||
serverCiphers: []uint16{
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
},
|
||||
expectedCipher: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
expectedCipher: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
},
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue