1 | /** |
2 | * \file ssl_ciphersuites.h |
3 | * |
4 | * \brief SSL Ciphersuites for mbed TLS |
5 | */ |
6 | /* |
7 | * Copyright The Mbed TLS Contributors |
8 | * SPDX-License-Identifier: Apache-2.0 |
9 | * |
10 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
11 | * not use this file except in compliance with the License. |
12 | * You may obtain a copy of the License at |
13 | * |
14 | * http://www.apache.org/licenses/LICENSE-2.0 |
15 | * |
16 | * Unless required by applicable law or agreed to in writing, software |
17 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
18 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
19 | * See the License for the specific language governing permissions and |
20 | * limitations under the License. |
21 | */ |
22 | #ifndef MBEDTLS_SSL_CIPHERSUITES_H |
23 | #define MBEDTLS_SSL_CIPHERSUITES_H |
24 | |
25 | #if !defined(MBEDTLS_CONFIG_FILE) |
26 | #include "mbedtls/config.h" |
27 | #else |
28 | #include MBEDTLS_CONFIG_FILE |
29 | #endif |
30 | |
31 | #include "mbedtls/pk.h" |
32 | #include "mbedtls/cipher.h" |
33 | #include "mbedtls/md.h" |
34 | |
35 | #ifdef __cplusplus |
36 | extern "C" { |
37 | #endif |
38 | |
39 | /* |
40 | * Supported ciphersuites (Official IANA names) |
41 | */ |
42 | #define MBEDTLS_TLS_RSA_WITH_NULL_MD5 0x01 /**< Weak! */ |
43 | #define MBEDTLS_TLS_RSA_WITH_NULL_SHA 0x02 /**< Weak! */ |
44 | |
45 | #define MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 0x04 |
46 | #define MBEDTLS_TLS_RSA_WITH_RC4_128_SHA 0x05 |
47 | #define MBEDTLS_TLS_RSA_WITH_DES_CBC_SHA 0x09 /**< Weak! Not in TLS 1.2 */ |
48 | |
49 | #define MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA 0x0A |
50 | |
51 | #define MBEDTLS_TLS_DHE_RSA_WITH_DES_CBC_SHA 0x15 /**< Weak! Not in TLS 1.2 */ |
52 | #define MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA 0x16 |
53 | |
54 | #define MBEDTLS_TLS_PSK_WITH_NULL_SHA 0x2C /**< Weak! */ |
55 | #define MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA 0x2D /**< Weak! */ |
56 | #define MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA 0x2E /**< Weak! */ |
57 | #define MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA 0x2F |
58 | |
59 | #define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA 0x33 |
60 | #define MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA 0x35 |
61 | #define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA 0x39 |
62 | |
63 | #define MBEDTLS_TLS_RSA_WITH_NULL_SHA256 0x3B /**< Weak! */ |
64 | #define MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 0x3C /**< TLS 1.2 */ |
65 | #define MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 0x3D /**< TLS 1.2 */ |
66 | |
67 | #define MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 0x41 |
68 | #define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 0x45 |
69 | |
70 | #define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 0x67 /**< TLS 1.2 */ |
71 | #define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 0x6B /**< TLS 1.2 */ |
72 | |
73 | #define MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 0x84 |
74 | #define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 0x88 |
75 | |
76 | #define MBEDTLS_TLS_PSK_WITH_RC4_128_SHA 0x8A |
77 | #define MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA 0x8B |
78 | #define MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA 0x8C |
79 | #define MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA 0x8D |
80 | |
81 | #define MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA 0x8E |
82 | #define MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA 0x8F |
83 | #define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA 0x90 |
84 | #define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA 0x91 |
85 | |
86 | #define MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA 0x92 |
87 | #define MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA 0x93 |
88 | #define MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA 0x94 |
89 | #define MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA 0x95 |
90 | |
91 | #define MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 0x9C /**< TLS 1.2 */ |
92 | #define MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 0x9D /**< TLS 1.2 */ |
93 | #define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 0x9E /**< TLS 1.2 */ |
94 | #define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 0x9F /**< TLS 1.2 */ |
95 | |
96 | #define MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 0xA8 /**< TLS 1.2 */ |
97 | #define MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 0xA9 /**< TLS 1.2 */ |
98 | #define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 0xAA /**< TLS 1.2 */ |
99 | #define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 0xAB /**< TLS 1.2 */ |
100 | #define MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 0xAC /**< TLS 1.2 */ |
101 | #define MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 0xAD /**< TLS 1.2 */ |
102 | |
103 | #define MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 0xAE |
104 | #define MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 0xAF |
105 | #define MBEDTLS_TLS_PSK_WITH_NULL_SHA256 0xB0 /**< Weak! */ |
106 | #define MBEDTLS_TLS_PSK_WITH_NULL_SHA384 0xB1 /**< Weak! */ |
107 | |
108 | #define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 0xB2 |
109 | #define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 0xB3 |
110 | #define MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256 0xB4 /**< Weak! */ |
111 | #define MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384 0xB5 /**< Weak! */ |
112 | |
113 | #define MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 0xB6 |
114 | #define MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 0xB7 |
115 | #define MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256 0xB8 /**< Weak! */ |
116 | #define MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384 0xB9 /**< Weak! */ |
117 | |
118 | #define MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xBA /**< TLS 1.2 */ |
119 | #define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xBE /**< TLS 1.2 */ |
120 | |
121 | #define MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 0xC0 /**< TLS 1.2 */ |
122 | #define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 0xC4 /**< TLS 1.2 */ |
123 | |
124 | #define MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA 0xC001 /**< Weak! */ |
125 | #define MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA 0xC002 /**< Not in SSL3! */ |
126 | #define MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA 0xC003 /**< Not in SSL3! */ |
127 | #define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA 0xC004 /**< Not in SSL3! */ |
128 | #define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA 0xC005 /**< Not in SSL3! */ |
129 | |
130 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA 0xC006 /**< Weak! */ |
131 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA 0xC007 /**< Not in SSL3! */ |
132 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA 0xC008 /**< Not in SSL3! */ |
133 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 0xC009 /**< Not in SSL3! */ |
134 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 0xC00A /**< Not in SSL3! */ |
135 | |
136 | #define MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA 0xC00B /**< Weak! */ |
137 | #define MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA 0xC00C /**< Not in SSL3! */ |
138 | #define MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA 0xC00D /**< Not in SSL3! */ |
139 | #define MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA 0xC00E /**< Not in SSL3! */ |
140 | #define MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA 0xC00F /**< Not in SSL3! */ |
141 | |
142 | #define MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA 0xC010 /**< Weak! */ |
143 | #define MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA 0xC011 /**< Not in SSL3! */ |
144 | #define MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 0xC012 /**< Not in SSL3! */ |
145 | #define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 0xC013 /**< Not in SSL3! */ |
146 | #define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 0xC014 /**< Not in SSL3! */ |
147 | |
148 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 0xC023 /**< TLS 1.2 */ |
149 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 0xC024 /**< TLS 1.2 */ |
150 | #define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 0xC025 /**< TLS 1.2 */ |
151 | #define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 0xC026 /**< TLS 1.2 */ |
152 | #define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 0xC027 /**< TLS 1.2 */ |
153 | #define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 0xC028 /**< TLS 1.2 */ |
154 | #define MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 0xC029 /**< TLS 1.2 */ |
155 | #define MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 0xC02A /**< TLS 1.2 */ |
156 | |
157 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0xC02B /**< TLS 1.2 */ |
158 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0xC02C /**< TLS 1.2 */ |
159 | #define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 0xC02D /**< TLS 1.2 */ |
160 | #define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 0xC02E /**< TLS 1.2 */ |
161 | #define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 0xC02F /**< TLS 1.2 */ |
162 | #define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 0xC030 /**< TLS 1.2 */ |
163 | #define MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 0xC031 /**< TLS 1.2 */ |
164 | #define MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 0xC032 /**< TLS 1.2 */ |
165 | |
166 | #define MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA 0xC033 /**< Not in SSL3! */ |
167 | #define MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA 0xC034 /**< Not in SSL3! */ |
168 | #define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA 0xC035 /**< Not in SSL3! */ |
169 | #define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA 0xC036 /**< Not in SSL3! */ |
170 | #define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 0xC037 /**< Not in SSL3! */ |
171 | #define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 0xC038 /**< Not in SSL3! */ |
172 | #define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA 0xC039 /**< Weak! No SSL3! */ |
173 | #define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256 0xC03A /**< Weak! No SSL3! */ |
174 | #define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384 0xC03B /**< Weak! No SSL3! */ |
175 | |
176 | #define MBEDTLS_TLS_RSA_WITH_ARIA_128_CBC_SHA256 0xC03C /**< TLS 1.2 */ |
177 | #define MBEDTLS_TLS_RSA_WITH_ARIA_256_CBC_SHA384 0xC03D /**< TLS 1.2 */ |
178 | #define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256 0xC044 /**< TLS 1.2 */ |
179 | #define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384 0xC045 /**< TLS 1.2 */ |
180 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256 0xC048 /**< TLS 1.2 */ |
181 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384 0xC049 /**< TLS 1.2 */ |
182 | #define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256 0xC04A /**< TLS 1.2 */ |
183 | #define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384 0xC04B /**< TLS 1.2 */ |
184 | #define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256 0xC04C /**< TLS 1.2 */ |
185 | #define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384 0xC04D /**< TLS 1.2 */ |
186 | #define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256 0xC04E /**< TLS 1.2 */ |
187 | #define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384 0xC04F /**< TLS 1.2 */ |
188 | #define MBEDTLS_TLS_RSA_WITH_ARIA_128_GCM_SHA256 0xC050 /**< TLS 1.2 */ |
189 | #define MBEDTLS_TLS_RSA_WITH_ARIA_256_GCM_SHA384 0xC051 /**< TLS 1.2 */ |
190 | #define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 0xC052 /**< TLS 1.2 */ |
191 | #define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 0xC053 /**< TLS 1.2 */ |
192 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 0xC05C /**< TLS 1.2 */ |
193 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 0xC05D /**< TLS 1.2 */ |
194 | #define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256 0xC05E /**< TLS 1.2 */ |
195 | #define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384 0xC05F /**< TLS 1.2 */ |
196 | #define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 0xC060 /**< TLS 1.2 */ |
197 | #define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 0xC061 /**< TLS 1.2 */ |
198 | #define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256 0xC062 /**< TLS 1.2 */ |
199 | #define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384 0xC063 /**< TLS 1.2 */ |
200 | #define MBEDTLS_TLS_PSK_WITH_ARIA_128_CBC_SHA256 0xC064 /**< TLS 1.2 */ |
201 | #define MBEDTLS_TLS_PSK_WITH_ARIA_256_CBC_SHA384 0xC065 /**< TLS 1.2 */ |
202 | #define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256 0xC066 /**< TLS 1.2 */ |
203 | #define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384 0xC067 /**< TLS 1.2 */ |
204 | #define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256 0xC068 /**< TLS 1.2 */ |
205 | #define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384 0xC069 /**< TLS 1.2 */ |
206 | #define MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256 0xC06A /**< TLS 1.2 */ |
207 | #define MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384 0xC06B /**< TLS 1.2 */ |
208 | #define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256 0xC06C /**< TLS 1.2 */ |
209 | #define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384 0xC06D /**< TLS 1.2 */ |
210 | #define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256 0xC06E /**< TLS 1.2 */ |
211 | #define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384 0xC06F /**< TLS 1.2 */ |
212 | #define MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256 0xC070 /**< TLS 1.2 */ |
213 | #define MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384 0xC071 /**< TLS 1.2 */ |
214 | |
215 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC072 /**< Not in SSL3! */ |
216 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0xC073 /**< Not in SSL3! */ |
217 | #define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC074 /**< Not in SSL3! */ |
218 | #define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0xC075 /**< Not in SSL3! */ |
219 | #define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xC076 /**< Not in SSL3! */ |
220 | #define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 0xC077 /**< Not in SSL3! */ |
221 | #define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xC078 /**< Not in SSL3! */ |
222 | #define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 0xC079 /**< Not in SSL3! */ |
223 | |
224 | #define MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC07A /**< TLS 1.2 */ |
225 | #define MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC07B /**< TLS 1.2 */ |
226 | #define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC07C /**< TLS 1.2 */ |
227 | #define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC07D /**< TLS 1.2 */ |
228 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 0xC086 /**< TLS 1.2 */ |
229 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 0xC087 /**< TLS 1.2 */ |
230 | #define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 0xC088 /**< TLS 1.2 */ |
231 | #define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 0xC089 /**< TLS 1.2 */ |
232 | #define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC08A /**< TLS 1.2 */ |
233 | #define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC08B /**< TLS 1.2 */ |
234 | #define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC08C /**< TLS 1.2 */ |
235 | #define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC08D /**< TLS 1.2 */ |
236 | |
237 | #define MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 0xC08E /**< TLS 1.2 */ |
238 | #define MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 0xC08F /**< TLS 1.2 */ |
239 | #define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 0xC090 /**< TLS 1.2 */ |
240 | #define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 0xC091 /**< TLS 1.2 */ |
241 | #define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 0xC092 /**< TLS 1.2 */ |
242 | #define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 0xC093 /**< TLS 1.2 */ |
243 | |
244 | #define MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC094 |
245 | #define MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC095 |
246 | #define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC096 |
247 | #define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC097 |
248 | #define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC098 |
249 | #define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC099 |
250 | #define MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC09A /**< Not in SSL3! */ |
251 | #define MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC09B /**< Not in SSL3! */ |
252 | |
253 | #define MBEDTLS_TLS_RSA_WITH_AES_128_CCM 0xC09C /**< TLS 1.2 */ |
254 | #define MBEDTLS_TLS_RSA_WITH_AES_256_CCM 0xC09D /**< TLS 1.2 */ |
255 | #define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM 0xC09E /**< TLS 1.2 */ |
256 | #define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM 0xC09F /**< TLS 1.2 */ |
257 | #define MBEDTLS_TLS_RSA_WITH_AES_128_CCM_8 0xC0A0 /**< TLS 1.2 */ |
258 | #define MBEDTLS_TLS_RSA_WITH_AES_256_CCM_8 0xC0A1 /**< TLS 1.2 */ |
259 | #define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM_8 0xC0A2 /**< TLS 1.2 */ |
260 | #define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM_8 0xC0A3 /**< TLS 1.2 */ |
261 | #define MBEDTLS_TLS_PSK_WITH_AES_128_CCM 0xC0A4 /**< TLS 1.2 */ |
262 | #define MBEDTLS_TLS_PSK_WITH_AES_256_CCM 0xC0A5 /**< TLS 1.2 */ |
263 | #define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM 0xC0A6 /**< TLS 1.2 */ |
264 | #define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM 0xC0A7 /**< TLS 1.2 */ |
265 | #define MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8 0xC0A8 /**< TLS 1.2 */ |
266 | #define MBEDTLS_TLS_PSK_WITH_AES_256_CCM_8 0xC0A9 /**< TLS 1.2 */ |
267 | #define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM_8 0xC0AA /**< TLS 1.2 */ |
268 | #define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM_8 0xC0AB /**< TLS 1.2 */ |
269 | /* The last two are named with PSK_DHE in the RFC, which looks like a typo */ |
270 | |
271 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM 0xC0AC /**< TLS 1.2 */ |
272 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM 0xC0AD /**< TLS 1.2 */ |
273 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 0xC0AE /**< TLS 1.2 */ |
274 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 0xC0AF /**< TLS 1.2 */ |
275 | |
276 | #define MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8 0xC0FF /**< experimental */ |
277 | |
278 | /* RFC 7905 */ |
279 | #define MBEDTLS_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 0xCCA8 /**< TLS 1.2 */ |
280 | #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 0xCCA9 /**< TLS 1.2 */ |
281 | #define MBEDTLS_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 0xCCAA /**< TLS 1.2 */ |
282 | #define MBEDTLS_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAB /**< TLS 1.2 */ |
283 | #define MBEDTLS_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAC /**< TLS 1.2 */ |
284 | #define MBEDTLS_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAD /**< TLS 1.2 */ |
285 | #define MBEDTLS_TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAE /**< TLS 1.2 */ |
286 | |
287 | /* Reminder: update mbedtls_ssl_premaster_secret when adding a new key exchange. |
288 | * Reminder: update MBEDTLS_KEY_EXCHANGE__xxx below |
289 | */ |
290 | typedef enum { |
291 | MBEDTLS_KEY_EXCHANGE_NONE = 0, |
292 | MBEDTLS_KEY_EXCHANGE_RSA, |
293 | MBEDTLS_KEY_EXCHANGE_DHE_RSA, |
294 | MBEDTLS_KEY_EXCHANGE_ECDHE_RSA, |
295 | MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA, |
296 | MBEDTLS_KEY_EXCHANGE_PSK, |
297 | MBEDTLS_KEY_EXCHANGE_DHE_PSK, |
298 | MBEDTLS_KEY_EXCHANGE_RSA_PSK, |
299 | MBEDTLS_KEY_EXCHANGE_ECDHE_PSK, |
300 | MBEDTLS_KEY_EXCHANGE_ECDH_RSA, |
301 | MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA, |
302 | MBEDTLS_KEY_EXCHANGE_ECJPAKE, |
303 | } mbedtls_key_exchange_type_t; |
304 | |
305 | /* Key exchanges using a certificate */ |
306 | #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ |
307 | defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ |
308 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ |
309 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ |
310 | defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \ |
311 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ |
312 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) |
313 | #define MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED |
314 | #endif |
315 | |
316 | /* Key exchanges allowing client certificate requests */ |
317 | #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ |
318 | defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ |
319 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ |
320 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ |
321 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) || \ |
322 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) |
323 | #define MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED |
324 | #endif |
325 | |
326 | /* Key exchanges involving server signature in ServerKeyExchange */ |
327 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ |
328 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ |
329 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) |
330 | #define MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED |
331 | #endif |
332 | |
333 | /* Key exchanges using ECDH */ |
334 | #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ |
335 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) |
336 | #define MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED |
337 | #endif |
338 | |
339 | /* Key exchanges that don't involve ephemeral keys */ |
340 | #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ |
341 | defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \ |
342 | defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \ |
343 | defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED) |
344 | #define MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED |
345 | #endif |
346 | |
347 | /* Key exchanges that involve ephemeral keys */ |
348 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ |
349 | defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ |
350 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ |
351 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \ |
352 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ |
353 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
354 | #define MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED |
355 | #endif |
356 | |
357 | /* Key exchanges using a PSK */ |
358 | #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \ |
359 | defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) || \ |
360 | defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ |
361 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) |
362 | #define MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED |
363 | #endif |
364 | |
365 | /* Key exchanges using DHE */ |
366 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ |
367 | defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) |
368 | #define MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED |
369 | #endif |
370 | |
371 | /* Key exchanges using ECDHE */ |
372 | #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ |
373 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ |
374 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) |
375 | #define MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED |
376 | #endif |
377 | |
378 | typedef struct mbedtls_ssl_ciphersuite_t mbedtls_ssl_ciphersuite_t; |
379 | |
380 | #define MBEDTLS_CIPHERSUITE_WEAK 0x01 /**< Weak ciphersuite flag */ |
381 | #define MBEDTLS_CIPHERSUITE_SHORT_TAG 0x02 /**< Short authentication tag, |
382 | eg for CCM_8 */ |
383 | #define MBEDTLS_CIPHERSUITE_NODTLS 0x04 /**< Can't be used with DTLS */ |
384 | |
385 | /** |
386 | * \brief This structure is used for storing ciphersuite information |
387 | */ |
388 | struct mbedtls_ssl_ciphersuite_t { |
389 | int id; |
390 | const char *name; |
391 | |
392 | mbedtls_cipher_type_t cipher; |
393 | mbedtls_md_type_t mac; |
394 | mbedtls_key_exchange_type_t key_exchange; |
395 | |
396 | int min_major_ver; |
397 | int min_minor_ver; |
398 | int max_major_ver; |
399 | int max_minor_ver; |
400 | |
401 | unsigned char flags; |
402 | }; |
403 | |
404 | const int *mbedtls_ssl_list_ciphersuites(void); |
405 | |
406 | const mbedtls_ssl_ciphersuite_t *mbedtls_ssl_ciphersuite_from_string(const char *ciphersuite_name); |
407 | const mbedtls_ssl_ciphersuite_t *mbedtls_ssl_ciphersuite_from_id(int ciphersuite_id); |
408 | |
409 | #if defined(MBEDTLS_PK_C) |
410 | mbedtls_pk_type_t mbedtls_ssl_get_ciphersuite_sig_pk_alg(const mbedtls_ssl_ciphersuite_t *info); |
411 | mbedtls_pk_type_t mbedtls_ssl_get_ciphersuite_sig_alg(const mbedtls_ssl_ciphersuite_t *info); |
412 | #endif |
413 | |
414 | int mbedtls_ssl_ciphersuite_uses_ec(const mbedtls_ssl_ciphersuite_t *info); |
415 | int mbedtls_ssl_ciphersuite_uses_psk(const mbedtls_ssl_ciphersuite_t *info); |
416 | |
417 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED) |
418 | static inline int mbedtls_ssl_ciphersuite_has_pfs(const mbedtls_ssl_ciphersuite_t *info) |
419 | { |
420 | switch (info->key_exchange) { |
421 | case MBEDTLS_KEY_EXCHANGE_DHE_RSA: |
422 | case MBEDTLS_KEY_EXCHANGE_DHE_PSK: |
423 | case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: |
424 | case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK: |
425 | case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: |
426 | case MBEDTLS_KEY_EXCHANGE_ECJPAKE: |
427 | return 1; |
428 | |
429 | default: |
430 | return 0; |
431 | } |
432 | } |
433 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED */ |
434 | |
435 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED) |
436 | static inline int mbedtls_ssl_ciphersuite_no_pfs(const mbedtls_ssl_ciphersuite_t *info) |
437 | { |
438 | switch (info->key_exchange) { |
439 | case MBEDTLS_KEY_EXCHANGE_ECDH_RSA: |
440 | case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: |
441 | case MBEDTLS_KEY_EXCHANGE_RSA: |
442 | case MBEDTLS_KEY_EXCHANGE_PSK: |
443 | case MBEDTLS_KEY_EXCHANGE_RSA_PSK: |
444 | return 1; |
445 | |
446 | default: |
447 | return 0; |
448 | } |
449 | } |
450 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */ |
451 | |
452 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED) |
453 | static inline int mbedtls_ssl_ciphersuite_uses_ecdh(const mbedtls_ssl_ciphersuite_t *info) |
454 | { |
455 | switch (info->key_exchange) { |
456 | case MBEDTLS_KEY_EXCHANGE_ECDH_RSA: |
457 | case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: |
458 | return 1; |
459 | |
460 | default: |
461 | return 0; |
462 | } |
463 | } |
464 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED */ |
465 | |
466 | static inline int mbedtls_ssl_ciphersuite_cert_req_allowed(const mbedtls_ssl_ciphersuite_t *info) |
467 | { |
468 | switch (info->key_exchange) { |
469 | case MBEDTLS_KEY_EXCHANGE_RSA: |
470 | case MBEDTLS_KEY_EXCHANGE_DHE_RSA: |
471 | case MBEDTLS_KEY_EXCHANGE_ECDH_RSA: |
472 | case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: |
473 | case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: |
474 | case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: |
475 | return 1; |
476 | |
477 | default: |
478 | return 0; |
479 | } |
480 | } |
481 | |
482 | static inline int mbedtls_ssl_ciphersuite_uses_srv_cert(const mbedtls_ssl_ciphersuite_t *info) |
483 | { |
484 | switch (info->key_exchange) { |
485 | case MBEDTLS_KEY_EXCHANGE_RSA: |
486 | case MBEDTLS_KEY_EXCHANGE_RSA_PSK: |
487 | case MBEDTLS_KEY_EXCHANGE_DHE_RSA: |
488 | case MBEDTLS_KEY_EXCHANGE_ECDH_RSA: |
489 | case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: |
490 | case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: |
491 | case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: |
492 | return 1; |
493 | |
494 | default: |
495 | return 0; |
496 | } |
497 | } |
498 | |
499 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED) |
500 | static inline int mbedtls_ssl_ciphersuite_uses_dhe(const mbedtls_ssl_ciphersuite_t *info) |
501 | { |
502 | switch (info->key_exchange) { |
503 | case MBEDTLS_KEY_EXCHANGE_DHE_RSA: |
504 | case MBEDTLS_KEY_EXCHANGE_DHE_PSK: |
505 | return 1; |
506 | |
507 | default: |
508 | return 0; |
509 | } |
510 | } |
511 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED) */ |
512 | |
513 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) |
514 | static inline int mbedtls_ssl_ciphersuite_uses_ecdhe(const mbedtls_ssl_ciphersuite_t *info) |
515 | { |
516 | switch (info->key_exchange) { |
517 | case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: |
518 | case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: |
519 | case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK: |
520 | return 1; |
521 | |
522 | default: |
523 | return 0; |
524 | } |
525 | } |
526 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) */ |
527 | |
528 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) |
529 | static inline int mbedtls_ssl_ciphersuite_uses_server_signature( |
530 | const mbedtls_ssl_ciphersuite_t *info) |
531 | { |
532 | switch (info->key_exchange) { |
533 | case MBEDTLS_KEY_EXCHANGE_DHE_RSA: |
534 | case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: |
535 | case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: |
536 | return 1; |
537 | |
538 | default: |
539 | return 0; |
540 | } |
541 | } |
542 | #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ |
543 | |
544 | #ifdef __cplusplus |
545 | } |
546 | #endif |
547 | |
548 | #endif /* ssl_ciphersuites.h */ |
549 | |