Subversion Repositories Kolibri OS

Rev

Blame | Last modification | View Log | Download | RSS feed

  1. /**
  2.  * \file ssl_ciphersuites.h
  3.  *
  4.  * \brief SSL Ciphersuites for mbed TLS
  5.  */
  6. /*
  7.  *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  8.  *  SPDX-License-Identifier: GPL-2.0
  9.  *
  10.  *  This program is free software; you can redistribute it and/or modify
  11.  *  it under the terms of the GNU General Public License as published by
  12.  *  the Free Software Foundation; either version 2 of the License, or
  13.  *  (at your option) any later version.
  14.  *
  15.  *  This program is distributed in the hope that it will be useful,
  16.  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17.  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18.  *  GNU General Public License for more details.
  19.  *
  20.  *  You should have received a copy of the GNU General Public License along
  21.  *  with this program; if not, write to the Free Software Foundation, Inc.,
  22.  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  23.  *
  24.  *  This file is part of mbed TLS (https://tls.mbed.org)
  25.  */
  26. #ifndef MBEDTLS_SSL_CIPHERSUITES_H
  27. #define MBEDTLS_SSL_CIPHERSUITES_H
  28.  
  29. #if !defined(MBEDTLS_CONFIG_FILE)
  30. #include "config.h"
  31. #else
  32. #include MBEDTLS_CONFIG_FILE
  33. #endif
  34.  
  35. #include "pk.h"
  36. #include "cipher.h"
  37. #include "md.h"
  38.  
  39. #ifdef __cplusplus
  40. extern "C" {
  41. #endif
  42.  
  43. /*
  44.  * Supported ciphersuites (Official IANA names)
  45.  */
  46. #define MBEDTLS_TLS_RSA_WITH_NULL_MD5                    0x01   /**< Weak! */
  47. #define MBEDTLS_TLS_RSA_WITH_NULL_SHA                    0x02   /**< Weak! */
  48.  
  49. #define MBEDTLS_TLS_RSA_WITH_RC4_128_MD5                 0x04
  50. #define MBEDTLS_TLS_RSA_WITH_RC4_128_SHA                 0x05
  51. #define MBEDTLS_TLS_RSA_WITH_DES_CBC_SHA                 0x09   /**< Weak! Not in TLS 1.2 */
  52.  
  53. #define MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA            0x0A
  54.  
  55. #define MBEDTLS_TLS_DHE_RSA_WITH_DES_CBC_SHA             0x15   /**< Weak! Not in TLS 1.2 */
  56. #define MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA        0x16
  57.  
  58. #define MBEDTLS_TLS_PSK_WITH_NULL_SHA                    0x2C   /**< Weak! */
  59. #define MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA                0x2D   /**< Weak! */
  60. #define MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA                0x2E   /**< Weak! */
  61. #define MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA             0x2F
  62.  
  63. #define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA         0x33
  64. #define MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA             0x35
  65. #define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA         0x39
  66.  
  67. #define MBEDTLS_TLS_RSA_WITH_NULL_SHA256                 0x3B   /**< Weak! */
  68. #define MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256          0x3C   /**< TLS 1.2 */
  69. #define MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256          0x3D   /**< TLS 1.2 */
  70.  
  71. #define MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA        0x41
  72. #define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA    0x45
  73.  
  74. #define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256      0x67   /**< TLS 1.2 */
  75. #define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256      0x6B   /**< TLS 1.2 */
  76.  
  77. #define MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA        0x84
  78. #define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA    0x88
  79.  
  80. #define MBEDTLS_TLS_PSK_WITH_RC4_128_SHA                 0x8A
  81. #define MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA            0x8B
  82. #define MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA             0x8C
  83. #define MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA             0x8D
  84.  
  85. #define MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA             0x8E
  86. #define MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA        0x8F
  87. #define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA         0x90
  88. #define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA         0x91
  89.  
  90. #define MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA             0x92
  91. #define MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA        0x93
  92. #define MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA         0x94
  93. #define MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA         0x95
  94.  
  95. #define MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256          0x9C   /**< TLS 1.2 */
  96. #define MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384          0x9D   /**< TLS 1.2 */
  97. #define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256      0x9E   /**< TLS 1.2 */
  98. #define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384      0x9F   /**< TLS 1.2 */
  99.  
  100. #define MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256          0xA8   /**< TLS 1.2 */
  101. #define MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384          0xA9   /**< TLS 1.2 */
  102. #define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256      0xAA   /**< TLS 1.2 */
  103. #define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384      0xAB   /**< TLS 1.2 */
  104. #define MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256      0xAC   /**< TLS 1.2 */
  105. #define MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384      0xAD   /**< TLS 1.2 */
  106.  
  107. #define MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256          0xAE
  108. #define MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384          0xAF
  109. #define MBEDTLS_TLS_PSK_WITH_NULL_SHA256                 0xB0   /**< Weak! */
  110. #define MBEDTLS_TLS_PSK_WITH_NULL_SHA384                 0xB1   /**< Weak! */
  111.  
  112. #define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256      0xB2
  113. #define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384      0xB3
  114. #define MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256             0xB4   /**< Weak! */
  115. #define MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384             0xB5   /**< Weak! */
  116.  
  117. #define MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256      0xB6
  118. #define MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384      0xB7
  119. #define MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256             0xB8   /**< Weak! */
  120. #define MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384             0xB9   /**< Weak! */
  121.  
  122. #define MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256     0xBA   /**< TLS 1.2 */
  123. #define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xBE   /**< TLS 1.2 */
  124.  
  125. #define MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256     0xC0   /**< TLS 1.2 */
  126. #define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 0xC4   /**< TLS 1.2 */
  127.  
  128. #define MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA             0xC001 /**< Weak! */
  129. #define MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA          0xC002 /**< Not in SSL3! */
  130. #define MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA     0xC003 /**< Not in SSL3! */
  131. #define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA      0xC004 /**< Not in SSL3! */
  132. #define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA      0xC005 /**< Not in SSL3! */
  133.  
  134. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA            0xC006 /**< Weak! */
  135. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA         0xC007 /**< Not in SSL3! */
  136. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA    0xC008 /**< Not in SSL3! */
  137. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA     0xC009 /**< Not in SSL3! */
  138. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA     0xC00A /**< Not in SSL3! */
  139.  
  140. #define MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA               0xC00B /**< Weak! */
  141. #define MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA            0xC00C /**< Not in SSL3! */
  142. #define MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA       0xC00D /**< Not in SSL3! */
  143. #define MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA        0xC00E /**< Not in SSL3! */
  144. #define MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA        0xC00F /**< Not in SSL3! */
  145.  
  146. #define MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA              0xC010 /**< Weak! */
  147. #define MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA           0xC011 /**< Not in SSL3! */
  148. #define MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA      0xC012 /**< Not in SSL3! */
  149. #define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA       0xC013 /**< Not in SSL3! */
  150. #define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA       0xC014 /**< Not in SSL3! */
  151.  
  152. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256  0xC023 /**< TLS 1.2 */
  153. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384  0xC024 /**< TLS 1.2 */
  154. #define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256   0xC025 /**< TLS 1.2 */
  155. #define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384   0xC026 /**< TLS 1.2 */
  156. #define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256    0xC027 /**< TLS 1.2 */
  157. #define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384    0xC028 /**< TLS 1.2 */
  158. #define MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256     0xC029 /**< TLS 1.2 */
  159. #define MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384     0xC02A /**< TLS 1.2 */
  160.  
  161. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256  0xC02B /**< TLS 1.2 */
  162. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384  0xC02C /**< TLS 1.2 */
  163. #define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256   0xC02D /**< TLS 1.2 */
  164. #define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384   0xC02E /**< TLS 1.2 */
  165. #define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256    0xC02F /**< TLS 1.2 */
  166. #define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384    0xC030 /**< TLS 1.2 */
  167. #define MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256     0xC031 /**< TLS 1.2 */
  168. #define MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384     0xC032 /**< TLS 1.2 */
  169.  
  170. #define MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA           0xC033 /**< Not in SSL3! */
  171. #define MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA      0xC034 /**< Not in SSL3! */
  172. #define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA       0xC035 /**< Not in SSL3! */
  173. #define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA       0xC036 /**< Not in SSL3! */
  174. #define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256    0xC037 /**< Not in SSL3! */
  175. #define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384    0xC038 /**< Not in SSL3! */
  176. #define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA              0xC039 /**< Weak! No SSL3! */
  177. #define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256           0xC03A /**< Weak! No SSL3! */
  178. #define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384           0xC03B /**< Weak! No SSL3! */
  179.  
  180. #define MBEDTLS_TLS_RSA_WITH_ARIA_128_CBC_SHA256         0xC03C /**< TLS 1.2 */
  181. #define MBEDTLS_TLS_RSA_WITH_ARIA_256_CBC_SHA384         0xC03D /**< TLS 1.2 */
  182. #define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256     0xC044 /**< TLS 1.2 */
  183. #define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384     0xC045 /**< TLS 1.2 */
  184. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256 0xC048 /**< TLS 1.2 */
  185. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384 0xC049 /**< TLS 1.2 */
  186. #define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256  0xC04A /**< TLS 1.2 */
  187. #define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384  0xC04B /**< TLS 1.2 */
  188. #define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256   0xC04C /**< TLS 1.2 */
  189. #define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384   0xC04D /**< TLS 1.2 */
  190. #define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256    0xC04E /**< TLS 1.2 */
  191. #define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384    0xC04F /**< TLS 1.2 */
  192. #define MBEDTLS_TLS_RSA_WITH_ARIA_128_GCM_SHA256         0xC050 /**< TLS 1.2 */
  193. #define MBEDTLS_TLS_RSA_WITH_ARIA_256_GCM_SHA384         0xC051 /**< TLS 1.2 */
  194. #define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256     0xC052 /**< TLS 1.2 */
  195. #define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384     0xC053 /**< TLS 1.2 */
  196. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 0xC05C /**< TLS 1.2 */
  197. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 0xC05D /**< TLS 1.2 */
  198. #define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256  0xC05E /**< TLS 1.2 */
  199. #define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384  0xC05F /**< TLS 1.2 */
  200. #define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256   0xC060 /**< TLS 1.2 */
  201. #define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384   0xC061 /**< TLS 1.2 */
  202. #define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256    0xC062 /**< TLS 1.2 */
  203. #define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384    0xC063 /**< TLS 1.2 */
  204. #define MBEDTLS_TLS_PSK_WITH_ARIA_128_CBC_SHA256         0xC064 /**< TLS 1.2 */
  205. #define MBEDTLS_TLS_PSK_WITH_ARIA_256_CBC_SHA384         0xC065 /**< TLS 1.2 */
  206. #define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256     0xC066 /**< TLS 1.2 */
  207. #define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384     0xC067 /**< TLS 1.2 */
  208. #define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256     0xC068 /**< TLS 1.2 */
  209. #define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384     0xC069 /**< TLS 1.2 */
  210. #define MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256         0xC06A /**< TLS 1.2 */
  211. #define MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384         0xC06B /**< TLS 1.2 */
  212. #define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256     0xC06C /**< TLS 1.2 */
  213. #define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384     0xC06D /**< TLS 1.2 */
  214. #define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256     0xC06E /**< TLS 1.2 */
  215. #define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384     0xC06F /**< TLS 1.2 */
  216. #define MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256   0xC070 /**< TLS 1.2 */
  217. #define MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384   0xC071 /**< TLS 1.2 */
  218.  
  219. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC072 /**< Not in SSL3! */
  220. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0xC073 /**< Not in SSL3! */
  221. #define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256  0xC074 /**< Not in SSL3! */
  222. #define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384  0xC075 /**< Not in SSL3! */
  223. #define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256   0xC076 /**< Not in SSL3! */
  224. #define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384   0xC077 /**< Not in SSL3! */
  225. #define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256    0xC078 /**< Not in SSL3! */
  226. #define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384    0xC079 /**< Not in SSL3! */
  227.  
  228. #define MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256         0xC07A /**< TLS 1.2 */
  229. #define MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384         0xC07B /**< TLS 1.2 */
  230. #define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256     0xC07C /**< TLS 1.2 */
  231. #define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384     0xC07D /**< TLS 1.2 */
  232. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 0xC086 /**< TLS 1.2 */
  233. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 0xC087 /**< TLS 1.2 */
  234. #define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256  0xC088 /**< TLS 1.2 */
  235. #define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384  0xC089 /**< TLS 1.2 */
  236. #define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256   0xC08A /**< TLS 1.2 */
  237. #define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384   0xC08B /**< TLS 1.2 */
  238. #define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256    0xC08C /**< TLS 1.2 */
  239. #define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384    0xC08D /**< TLS 1.2 */
  240.  
  241. #define MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256       0xC08E /**< TLS 1.2 */
  242. #define MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384       0xC08F /**< TLS 1.2 */
  243. #define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256   0xC090 /**< TLS 1.2 */
  244. #define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384   0xC091 /**< TLS 1.2 */
  245. #define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256   0xC092 /**< TLS 1.2 */
  246. #define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384   0xC093 /**< TLS 1.2 */
  247.  
  248. #define MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256       0xC094
  249. #define MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384       0xC095
  250. #define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256   0xC096
  251. #define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384   0xC097
  252. #define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256   0xC098
  253. #define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384   0xC099
  254. #define MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC09A /**< Not in SSL3! */
  255. #define MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC09B /**< Not in SSL3! */
  256.  
  257. #define MBEDTLS_TLS_RSA_WITH_AES_128_CCM                0xC09C  /**< TLS 1.2 */
  258. #define MBEDTLS_TLS_RSA_WITH_AES_256_CCM                0xC09D  /**< TLS 1.2 */
  259. #define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM            0xC09E  /**< TLS 1.2 */
  260. #define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM            0xC09F  /**< TLS 1.2 */
  261. #define MBEDTLS_TLS_RSA_WITH_AES_128_CCM_8              0xC0A0  /**< TLS 1.2 */
  262. #define MBEDTLS_TLS_RSA_WITH_AES_256_CCM_8              0xC0A1  /**< TLS 1.2 */
  263. #define MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM_8          0xC0A2  /**< TLS 1.2 */
  264. #define MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM_8          0xC0A3  /**< TLS 1.2 */
  265. #define MBEDTLS_TLS_PSK_WITH_AES_128_CCM                0xC0A4  /**< TLS 1.2 */
  266. #define MBEDTLS_TLS_PSK_WITH_AES_256_CCM                0xC0A5  /**< TLS 1.2 */
  267. #define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM            0xC0A6  /**< TLS 1.2 */
  268. #define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM            0xC0A7  /**< TLS 1.2 */
  269. #define MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8              0xC0A8  /**< TLS 1.2 */
  270. #define MBEDTLS_TLS_PSK_WITH_AES_256_CCM_8              0xC0A9  /**< TLS 1.2 */
  271. #define MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM_8          0xC0AA  /**< TLS 1.2 */
  272. #define MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM_8          0xC0AB  /**< TLS 1.2 */
  273. /* The last two are named with PSK_DHE in the RFC, which looks like a typo */
  274.  
  275. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM        0xC0AC  /**< TLS 1.2 */
  276. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM        0xC0AD  /**< TLS 1.2 */
  277. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8      0xC0AE  /**< TLS 1.2 */
  278. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8      0xC0AF  /**< TLS 1.2 */
  279.  
  280. #define MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8          0xC0FF  /**< experimental */
  281.  
  282. /* RFC 7905 */
  283. #define MBEDTLS_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256   0xCCA8 /**< TLS 1.2 */
  284. #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 0xCCA9 /**< TLS 1.2 */
  285. #define MBEDTLS_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256     0xCCAA /**< TLS 1.2 */
  286. #define MBEDTLS_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256         0xCCAB /**< TLS 1.2 */
  287. #define MBEDTLS_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256   0xCCAC /**< TLS 1.2 */
  288. #define MBEDTLS_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256     0xCCAD /**< TLS 1.2 */
  289. #define MBEDTLS_TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256     0xCCAE /**< TLS 1.2 */
  290.  
  291. /* Reminder: update mbedtls_ssl_premaster_secret when adding a new key exchange.
  292.  * Reminder: update MBEDTLS_KEY_EXCHANGE__xxx below
  293.  */
  294. typedef enum {
  295.     MBEDTLS_KEY_EXCHANGE_NONE = 0,
  296.     MBEDTLS_KEY_EXCHANGE_RSA,
  297.     MBEDTLS_KEY_EXCHANGE_DHE_RSA,
  298.     MBEDTLS_KEY_EXCHANGE_ECDHE_RSA,
  299.     MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA,
  300.     MBEDTLS_KEY_EXCHANGE_PSK,
  301.     MBEDTLS_KEY_EXCHANGE_DHE_PSK,
  302.     MBEDTLS_KEY_EXCHANGE_RSA_PSK,
  303.     MBEDTLS_KEY_EXCHANGE_ECDHE_PSK,
  304.     MBEDTLS_KEY_EXCHANGE_ECDH_RSA,
  305.     MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA,
  306.     MBEDTLS_KEY_EXCHANGE_ECJPAKE,
  307. } mbedtls_key_exchange_type_t;
  308.  
  309. /* Key exchanges using a certificate */
  310. #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)           || \
  311.     defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)       || \
  312.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED)     || \
  313.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)   || \
  314.     defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)       || \
  315.     defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED)      || \
  316.     defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
  317. #define MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED
  318. #endif
  319.  
  320. /* Key exchanges allowing client certificate requests */
  321. #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)           ||       \
  322.     defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)       ||       \
  323.     defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED)      ||       \
  324.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED)     ||       \
  325.     defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)    ||       \
  326.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
  327. #define MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED
  328. #endif
  329.  
  330. /* Key exchanges involving server signature in ServerKeyExchange */
  331. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)       || \
  332.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED)     || \
  333.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
  334. #define MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED
  335. #endif
  336.  
  337. /* Key exchanges using ECDH */
  338. #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED)      || \
  339.     defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
  340. #define MBEDTLS_KEY_EXCHANGE__SOME__ECDH_ENABLED
  341. #endif
  342.  
  343. /* Key exchanges that don't involve ephemeral keys */
  344. #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)           || \
  345.     defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)           || \
  346.     defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)       || \
  347.     defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDH_ENABLED)
  348. #define MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED
  349. #endif
  350.  
  351. /* Key exchanges that involve ephemeral keys */
  352. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)       || \
  353.     defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)       || \
  354.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED)     || \
  355.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)     || \
  356.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)   || \
  357.     defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  358. #define MBEDTLS_KEY_EXCHANGE__SOME_PFS__ENABLED
  359. #endif
  360.  
  361. /* Key exchanges using a PSK */
  362. #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)           || \
  363.     defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)       || \
  364.     defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)       || \
  365.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
  366. #define MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED
  367. #endif
  368.  
  369. /* Key exchanges using DHE */
  370. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)       || \
  371.     defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
  372. #define MBEDTLS_KEY_EXCHANGE__SOME__DHE_ENABLED
  373. #endif
  374.  
  375. /* Key exchanges using ECDHE */
  376. #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED)     || \
  377.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)   || \
  378.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
  379. #define MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED
  380. #endif
  381.  
  382. typedef struct mbedtls_ssl_ciphersuite_t mbedtls_ssl_ciphersuite_t;
  383.  
  384. #define MBEDTLS_CIPHERSUITE_WEAK       0x01    /**< Weak ciphersuite flag  */
  385. #define MBEDTLS_CIPHERSUITE_SHORT_TAG  0x02    /**< Short authentication tag,
  386.                                                      eg for CCM_8 */
  387. #define MBEDTLS_CIPHERSUITE_NODTLS     0x04    /**< Can't be used with DTLS */
  388.  
  389. /**
  390.  * \brief   This structure is used for storing ciphersuite information
  391.  */
  392. struct mbedtls_ssl_ciphersuite_t
  393. {
  394.     int id;
  395.     const char * name;
  396.  
  397.     mbedtls_cipher_type_t cipher;
  398.     mbedtls_md_type_t mac;
  399.     mbedtls_key_exchange_type_t key_exchange;
  400.  
  401.     int min_major_ver;
  402.     int min_minor_ver;
  403.     int max_major_ver;
  404.     int max_minor_ver;
  405.  
  406.     unsigned char flags;
  407. };
  408.  
  409. const int *mbedtls_ssl_list_ciphersuites( void );
  410.  
  411. const mbedtls_ssl_ciphersuite_t *mbedtls_ssl_ciphersuite_from_string( const char *ciphersuite_name );
  412. const mbedtls_ssl_ciphersuite_t *mbedtls_ssl_ciphersuite_from_id( int ciphersuite_id );
  413.  
  414. #if defined(MBEDTLS_PK_C)
  415. mbedtls_pk_type_t mbedtls_ssl_get_ciphersuite_sig_pk_alg( const mbedtls_ssl_ciphersuite_t *info );
  416. mbedtls_pk_type_t mbedtls_ssl_get_ciphersuite_sig_alg( const mbedtls_ssl_ciphersuite_t *info );
  417. #endif
  418.  
  419. int mbedtls_ssl_ciphersuite_uses_ec( const mbedtls_ssl_ciphersuite_t *info );
  420. int mbedtls_ssl_ciphersuite_uses_psk( const mbedtls_ssl_ciphersuite_t *info );
  421.  
  422. #if defined(MBEDTLS_KEY_EXCHANGE__SOME_PFS__ENABLED)
  423. static inline int mbedtls_ssl_ciphersuite_has_pfs( const mbedtls_ssl_ciphersuite_t *info )
  424. {
  425.     switch( info->key_exchange )
  426.     {
  427.         case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
  428.         case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
  429.         case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
  430.         case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
  431.         case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
  432.         case MBEDTLS_KEY_EXCHANGE_ECJPAKE:
  433.             return( 1 );
  434.  
  435.         default:
  436.             return( 0 );
  437.     }
  438. }
  439. #endif /* MBEDTLS_KEY_EXCHANGE__SOME_PFS__ENABLED */
  440.  
  441. #if defined(MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED)
  442. static inline int mbedtls_ssl_ciphersuite_no_pfs( const mbedtls_ssl_ciphersuite_t *info )
  443. {
  444.     switch( info->key_exchange )
  445.     {
  446.         case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
  447.         case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
  448.         case MBEDTLS_KEY_EXCHANGE_RSA:
  449.         case MBEDTLS_KEY_EXCHANGE_PSK:
  450.         case MBEDTLS_KEY_EXCHANGE_RSA_PSK:
  451.             return( 1 );
  452.  
  453.         default:
  454.             return( 0 );
  455.     }
  456. }
  457. #endif /* MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED */
  458.  
  459. #if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDH_ENABLED)
  460. static inline int mbedtls_ssl_ciphersuite_uses_ecdh( const mbedtls_ssl_ciphersuite_t *info )
  461. {
  462.     switch( info->key_exchange )
  463.     {
  464.         case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
  465.         case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
  466.             return( 1 );
  467.  
  468.         default:
  469.             return( 0 );
  470.     }
  471. }
  472. #endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDH_ENABLED */
  473.  
  474. static inline int mbedtls_ssl_ciphersuite_cert_req_allowed( const mbedtls_ssl_ciphersuite_t *info )
  475. {
  476.     switch( info->key_exchange )
  477.     {
  478.         case MBEDTLS_KEY_EXCHANGE_RSA:
  479.         case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
  480.         case MBEDTLS_KEY_EXCHANGE_ECDH_RSA:
  481.         case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
  482.         case MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA:
  483.         case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
  484.             return( 1 );
  485.  
  486.         default:
  487.             return( 0 );
  488.     }
  489. }
  490.  
  491. #if defined(MBEDTLS_KEY_EXCHANGE__SOME__DHE_ENABLED)
  492. static inline int mbedtls_ssl_ciphersuite_uses_dhe( const mbedtls_ssl_ciphersuite_t *info )
  493. {
  494.     switch( info->key_exchange )
  495.     {
  496.         case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
  497.         case MBEDTLS_KEY_EXCHANGE_DHE_PSK:
  498.             return( 1 );
  499.  
  500.         default:
  501.             return( 0 );
  502.     }
  503. }
  504. #endif /* MBEDTLS_KEY_EXCHANGE__SOME__DHE_ENABLED) */
  505.  
  506. #if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED)
  507. static inline int mbedtls_ssl_ciphersuite_uses_ecdhe( const mbedtls_ssl_ciphersuite_t *info )
  508. {
  509.     switch( info->key_exchange )
  510.     {
  511.         case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
  512.         case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
  513.         case MBEDTLS_KEY_EXCHANGE_ECDHE_PSK:
  514.             return( 1 );
  515.  
  516.         default:
  517.             return( 0 );
  518.     }
  519. }
  520. #endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED) */
  521.  
  522. #if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
  523. static inline int mbedtls_ssl_ciphersuite_uses_server_signature( const mbedtls_ssl_ciphersuite_t *info )
  524. {
  525.     switch( info->key_exchange )
  526.     {
  527.         case MBEDTLS_KEY_EXCHANGE_DHE_RSA:
  528.         case MBEDTLS_KEY_EXCHANGE_ECDHE_RSA:
  529.         case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
  530.             return( 1 );
  531.  
  532.         default:
  533.             return( 0 );
  534.     }
  535. }
  536. #endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
  537.  
  538. #ifdef __cplusplus
  539. }
  540. #endif
  541.  
  542. #endif /* ssl_ciphersuites.h */
  543.