mirror of
https://github.com/drwetter/testssl.sh.git
synced 2025-03-31 06:53:38 +02:00
Support draft-connolly-tls-mlkem-key-agreement
This commit adds support for the three code points in draft-connolly-tls-mlkem-key-agreement.
This commit is contained in:
David Cooper
parent
f34b81ed8f
commit
683f028164
@ -45,6 +45,9 @@
|
||||
0x01,0x02 - ffdhe4096 ffdhe4096
|
||||
0x01,0x03 - ffdhe6144 ffdhe6144
|
||||
0x01,0x04 - ffdhe8192 ffdhe8192
|
||||
0x02,0x00 - MLKEM512 MLKEM512
|
||||
0x02,0x01 - MLKEM768 MLKEM768
|
||||
0x02,0x02 - MLKEM1024 MLKEM1024
|
||||
0x11,0xeb - SecP256r1MLKEM768 SecP256r1MLKEM768
|
||||
0x11,0xec - X25519MLKEM768 X25519MLKEM768
|
||||
0x11,0xed - SecP384r1MLKEM1024 SecP384r1MLKEM1024
|
||||
|
||||
File diff suppressed because one or more lines are too long
30
testssl.sh
30
testssl.sh
@ -6550,10 +6550,13 @@ pr_kem_param_set_quality() {
|
||||
local -i bits=0
|
||||
|
||||
case "$kem" in
|
||||
"SecP256r1MLKEM768") bits=192 ;;
|
||||
"X25519MLKEM768") bits=192 ;;
|
||||
"MLKEM512") bits=128 ;;
|
||||
"MLKEM768") bits=192 ;;
|
||||
"MLKEM1024") bits=256 ;;
|
||||
"SecP256r1MLKEM768") bits=192 ;;
|
||||
"X25519MLKEM768") bits=192 ;;
|
||||
"SecP384r1MLKEM1024") bits=256 ;;
|
||||
"X25519Kyber768Draft00") bits=128 ;;
|
||||
"X25519Kyber768Draft00") bits=128 ;;
|
||||
esac
|
||||
pr_kem_quality "$bits" "$kem"
|
||||
}
|
||||
@ -10552,13 +10555,13 @@ run_fs() {
|
||||
local fs_cipher_list="DHE-DSS-AES128-GCM-SHA256:DHE-DSS-AES128-SHA256:DHE-DSS-AES128-SHA:DHE-DSS-AES256-GCM-SHA384:DHE-DSS-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-DSS-CAMELLIA128-SHA256:DHE-DSS-CAMELLIA128-SHA:DHE-DSS-CAMELLIA256-SHA256:DHE-DSS-CAMELLIA256-SHA:DHE-DSS-SEED-SHA:DHE-RSA-AES128-CCM8:DHE-RSA-AES128-CCM:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-CCM8:DHE-RSA-AES256-CCM:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA128-SHA256:DHE-RSA-CAMELLIA128-SHA:DHE-RSA-CAMELLIA256-SHA256:DHE-RSA-CAMELLIA256-SHA:DHE-RSA-CHACHA20-POLY1305-OLD:DHE-RSA-CHACHA20-POLY1305:DHE-RSA-SEED-SHA:ECDHE-ECDSA-AES128-CCM8:ECDHE-ECDSA-AES128-CCM:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-CCM8:ECDHE-ECDSA-AES256-CCM:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-CAMELLIA128-SHA256:ECDHE-ECDSA-CAMELLIA256-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305-OLD:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-RSA-CAMELLIA128-SHA256:ECDHE-RSA-CAMELLIA256-SHA384:ECDHE-RSA-CHACHA20-POLY1305-OLD:ECDHE-RSA-CHACHA20-POLY1305"
|
||||
local fs_hex_cipher_list="" ciphers_to_test tls13_ciphers_to_test
|
||||
local ecdhe_cipher_list="" tls13_cipher_list="" ecdhe_cipher_list_hex="" ffdhe_cipher_list_hex=""
|
||||
local curves_hex=("00,01" "00,02" "00,03" "00,04" "00,05" "00,06" "00,07" "00,08" "00,09" "00,0a" "00,0b" "00,0c" "00,0d" "00,0e" "00,0f" "00,10" "00,11" "00,12" "00,13" "00,14" "00,15" "00,16" "00,17" "00,18" "00,19" "00,1a" "00,1b" "00,1c" "00,1d" "00,1e" "00,1f" "00,20" "00,21" "11,eb" "11,ec" "11,ed" "63,99")
|
||||
local -a curves_ossl=("sect163k1" "sect163r1" "sect163r2" "sect193r1" "sect193r2" "sect233k1" "sect233r1" "sect239k1" "sect283k1" "sect283r1" "sect409k1" "sect409r1" "sect571k1" "sect571r1" "secp160k1" "secp160r1" "secp160r2" "secp192k1" "prime192v1" "secp224k1" "secp224r1" "secp256k1" "prime256v1" "secp384r1" "secp521r1" "brainpoolP256r1" "brainpoolP384r1" "brainpoolP512r1" "X25519" "X448" "brainpoolP256r1tls13" "brainpoolP384r1tls13" "brainpoolP512r1tls13" "SecP256r1MLKEM768" "X25519MLKEM768" "SecP384r1MLKEM1024" "X25519Kyber768Draft00")
|
||||
local -a curves_ossl_output=("K-163" "sect163r1" "B-163" "sect193r1" "sect193r2" "K-233" "B-233" "sect239k1" "K-283" "B-283" "K-409" "B-409" "K-571" "B-571" "secp160k1" "secp160r1" "secp160r2" "secp192k1" "P-192" "secp224k1" "P-224" "secp256k1" "P-256" "P-384" "P-521" "brainpoolP256r1" "brainpoolP384r1" "brainpoolP512r1" "X25519" "X448" "brainpoolP256r1tls13" "brainpoolP384r1tls13" "brainpoolP512r1tls13" "SecP256r1MLKEM768" "X25519MLKEM768" "SecP384r1MLKEM1024" "X25519Kyber768Draft00")
|
||||
local -ai curves_bits=(163 162 163 193 193 232 233 238 281 282 407 409 570 570 161 161 161 192 192 225 224 256 256 384 521 256 384 512 253 448 256 384 512 192 192 256 128)
|
||||
local curves_hex=("00,01" "00,02" "00,03" "00,04" "00,05" "00,06" "00,07" "00,08" "00,09" "00,0a" "00,0b" "00,0c" "00,0d" "00,0e" "00,0f" "00,10" "00,11" "00,12" "00,13" "00,14" "00,15" "00,16" "00,17" "00,18" "00,19" "00,1a" "00,1b" "00,1c" "00,1d" "00,1e" "00,1f" "00,20" "00,21" "02,00" "02,01" "02,02" "11,eb" "11,ec" "11,ed" "63,99")
|
||||
local -a curves_ossl=("sect163k1" "sect163r1" "sect163r2" "sect193r1" "sect193r2" "sect233k1" "sect233r1" "sect239k1" "sect283k1" "sect283r1" "sect409k1" "sect409r1" "sect571k1" "sect571r1" "secp160k1" "secp160r1" "secp160r2" "secp192k1" "prime192v1" "secp224k1" "secp224r1" "secp256k1" "prime256v1" "secp384r1" "secp521r1" "brainpoolP256r1" "brainpoolP384r1" "brainpoolP512r1" "X25519" "X448" "brainpoolP256r1tls13" "brainpoolP384r1tls13" "brainpoolP512r1tls13" "MLKEM512" "MLKEM768" "MLKEM1024" "SecP256r1MLKEM768" "X25519MLKEM768" "SecP384r1MLKEM1024" "X25519Kyber768Draft00")
|
||||
local -a curves_ossl_output=("K-163" "sect163r1" "B-163" "sect193r1" "sect193r2" "K-233" "B-233" "sect239k1" "K-283" "B-283" "K-409" "B-409" "K-571" "B-571" "secp160k1" "secp160r1" "secp160r2" "secp192k1" "P-192" "secp224k1" "P-224" "secp256k1" "P-256" "P-384" "P-521" "brainpoolP256r1" "brainpoolP384r1" "brainpoolP512r1" "X25519" "X448" "brainpoolP256r1tls13" "brainpoolP384r1tls13" "brainpoolP512r1tls13" "MLKEM512" "MLKEM768" "MLKEM1024" "SecP256r1MLKEM768" "X25519MLKEM768" "SecP384r1MLKEM1024" "X25519Kyber768Draft00")
|
||||
local -ai curves_bits=(163 162 163 193 193 232 233 238 281 282 407 409 570 570 161 161 161 192 192 225 224 256 256 384 521 256 384 512 253 448 256 384 512 128 192 256 192 192 256 128)
|
||||
# Many curves have been deprecated, and RFC 8446, Appendix B.3.1.4, states
|
||||
# that these curves MUST NOT be offered in a TLS 1.3 ClientHello.
|
||||
local -a curves_deprecated=("true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "false" "false" "false" "true" "true" "true" "false" "false" "false" "false" "false" "false" "false" "false" "false")
|
||||
local -a curves_deprecated=("true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "true" "false" "false" "false" "true" "true" "true" "false" "false" "false" "false" "false" "false" "false" "false" "false" "false" "false" "false")
|
||||
local -a ffdhe_groups_hex=("01,00" "01,01" "01,02" "01,03" "01,04")
|
||||
local -a ffdhe_groups_output=("ffdhe2048" "ffdhe3072" "ffdhe4096" "ffdhe6144" "ffdhe8192")
|
||||
local -a supported_curve
|
||||
@ -14668,6 +14671,9 @@ parse_tls_serverhello() {
|
||||
"0102") echo -n "ffdhe4096" >> $TMPFILE ;;
|
||||
"0103") echo -n "ffdhe6144" >> $TMPFILE ;;
|
||||
"0104") echo -n "ffdhe8192" >> $TMPFILE ;;
|
||||
"0200") echo -n "MLKEM512" >> $TMPFILE ;;
|
||||
"0201") echo -n "MLKEM768" >> $TMPFILE ;;
|
||||
"0202") echo -n "MLKEM1024" >> $TMPFILE ;;
|
||||
"11EB") echo -n "SecP256r1MLKEM768" >> $TMPFILE ;;
|
||||
"11EC") echo -n "X25519MLKEM768" >> $TMPFILE ;;
|
||||
"11ED") echo -n "SecP384r1MLKEM1024" >> $TMPFILE ;;
|
||||
@ -14767,6 +14773,9 @@ parse_tls_serverhello() {
|
||||
258) dh_bits=4096 ; named_curve_str="ffdhe4096" ;;
|
||||
259) dh_bits=6144 ; named_curve_str="ffdhe6144" ;;
|
||||
260) dh_bits=8192 ; named_curve_str="ffdhe8192" ;;
|
||||
512) dh_bits=128 ; named_curve_str="MLKEM512" ;;
|
||||
513) dh_bits=192 ; named_curve_str="MLKEM768" ;;
|
||||
514) dh_bits=256 ; named_curve_str="MLKEM1024" ;;
|
||||
4587) dh_bits=192 ; named_curve_str="SecP256r1MLKEM768" ;;
|
||||
4588) dh_bits=192 ; named_curve_str="X25519MLKEM768" ;;
|
||||
4589) dh_bits=256 ; named_curve_str="SecP384r1MLKEM1024" ;;
|
||||
@ -15797,9 +15806,10 @@ prepare_tls_clienthello() {
|
||||
if [[ ! "$process_full" =~ all ]]; then
|
||||
extension_supported_groups="
|
||||
00,0a, # Type: Supported Groups, see RFC 8446
|
||||
00,1e, 00,1c, # lengths
|
||||
00,24, 00,22, # lengths
|
||||
00,1d, 00,17, 00,1e, 00,18, 00,19, 00,1f, 00,20, 00,21,
|
||||
01,00, 01,01, 11,eb, 11,ec, 11,ed, 63,99"
|
||||
01,00, 01,01, 02,00, 02,01, 02,02, 11,eb, 11,ec, 11,ed,
|
||||
63,99"
|
||||
# Only include ML-KEM and Kyber hybrids as options if the response does
|
||||
# not need to be decrypted.
|
||||
elif [[ ! "$process_full" =~ all ]] || { "$HAS_X25519" && "$HAS_X448"; }; then
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user