1/* 2 * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org> 3 * 4 * Permission is hereby granted, free of charge, to any person obtaining 5 * a copy of this software and associated documentation files (the 6 * "Software"), to deal in the Software without restriction, including 7 * without limitation the rights to use, copy, modify, merge, publish, 8 * distribute, sublicense, and/or sell copies of the Software, and to 9 * permit persons to whom the Software is furnished to do so, subject to 10 * the following conditions: 11 * 12 * The above copyright notice and this permission notice shall be 13 * included in all copies or substantial portions of the Software. 14 * 15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 16 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 17 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 18 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS 19 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN 20 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 21 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 22 * SOFTWARE. 23 */ 24 25#include "bearssl.h" 26 27/* 28 * A "profile" is an initialisation function for a SSL context, that 29 * configures a list of cipher suites and algorithm implementations. 30 * While BearSSL comes with a few predefined profiles, you might one 31 * to define you own, using the example below as guidance. 32 * 33 * Each individual initialisation call sets a parameter or an algorithm 34 * support. Setting a specific algorithm pulls in the implementation of 35 * that algorithm in the compiled binary, as per static linking 36 * behaviour. Removing some of this calls will then reduce total code 37 * footprint, but also mechanically prevents some features to be 38 * supported (protocol versions and cipher suites). 39 * 40 * The two below define profiles for the client and the server contexts, 41 * respectively. Of course, in a typical size-constrained application, 42 * you would use one or the other, not both, to avoid pulling in code 43 * for both. 44 */ 45 46void 47example_client_profile(br_ssl_client_context *cc 48 /* and possibly some other arguments */) 49{ 50 /* 51 * A list of cipher suites, by preference (first is most 52 * preferred). The list below contains all cipher suites supported 53 * by BearSSL; trim it done to your needs. 54 */ 55 static const uint16_t suites[] = { 56 BR_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, 57 BR_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, 58 BR_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 59 BR_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 60 BR_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, 61 BR_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, 62 BR_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, 63 BR_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, 64 BR_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, 65 BR_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, 66 BR_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, 67 BR_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, 68 BR_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, 69 BR_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, 70 BR_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, 71 BR_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, 72 BR_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, 73 BR_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, 74 BR_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, 75 BR_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, 76 BR_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, 77 BR_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, 78 BR_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, 79 BR_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, 80 BR_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, 81 BR_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, 82 BR_TLS_RSA_WITH_AES_128_GCM_SHA256, 83 BR_TLS_RSA_WITH_AES_256_GCM_SHA384, 84 BR_TLS_RSA_WITH_AES_128_CBC_SHA256, 85 BR_TLS_RSA_WITH_AES_256_CBC_SHA256, 86 BR_TLS_RSA_WITH_AES_128_CBC_SHA, 87 BR_TLS_RSA_WITH_AES_256_CBC_SHA, 88 BR_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, 89 BR_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, 90 BR_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, 91 BR_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, 92 BR_TLS_RSA_WITH_3DES_EDE_CBC_SHA 93 }; 94 95 /* 96 * Client context must be cleared at some point. This sets 97 * every value and pointer to 0 or NULL. 98 */ 99 br_ssl_client_zero(cc); 100 101 /* 102 * Define minimum and maximum protocol versions. Supported 103 * versions are: 104 * BR_TLS10 TLS 1.0 105 * BR_TLS11 TLS 1.1 106 * BR_TLS12 TLS 1.2 107 */ 108 br_ssl_engine_set_versions(&cc->eng, BR_TLS10, BR_TLS12); 109 110 /* 111 * Set the PRF implementation(s). 112 * For TLS 1.0 and 1.1, the "prf10" is needed. 113 * For TLS 1.2, this depends on the cipher suite: 114 * -- cipher suites with a name ending in "SHA384" need "prf_sha384"; 115 * -- all others need "prf_sha256". 116 * 117 * Note that a cipher suite like TLS_RSA_WITH_AES_128_CBC_SHA will 118 * use SHA-1 for the per-record MAC (that's what the final "SHA" 119 * means), but still SHA-256 for the PRF when selected along with 120 * the TLS-1.2 protocol version. 121 */ 122 br_ssl_engine_set_prf10(&cc->eng, &br_tls10_prf); 123 br_ssl_engine_set_prf_sha256(&cc->eng, &br_tls12_sha256_prf); 124 br_ssl_engine_set_prf_sha384(&cc->eng, &br_tls12_sha384_prf); 125 126 /* 127 * Set hash functions for the engine. Required hash functions 128 * depend on the protocol and cipher suite: 129 * 130 * -- TLS 1.0 and 1.1 require both MD5 and SHA-1. 131 * -- With TLS 1.2, cipher suites with a name ending in "SHA384" 132 * require SHA-384. 133 * -- With TLS 1.2, cipher suites with a name ending in "SHA256" 134 * require SHA-256. 135 * -- With TLS 1.2, cipher suites with a name ending in "SHA" 136 * require both SHA-256 and SHA-1. 137 * 138 * Moreover, these hash functions are also used to compute 139 * hashes supporting signatures on the server side (for ECDHE_* 140 * cipher suites), and on the client side (for client 141 * certificates, except in the case of full static ECDH). In TLS 142 * 1.0 and 1.1, SHA-1 (and also MD5) will be used, but with TLS 143 * 1.2 these hash functions are negotiated between client and 144 * server; SHA-256 and/or SHA-384 should be sufficient in 145 * practice. 146 * 147 * Note that with current implementations, SHA-224 and SHA-256 148 * share the same file, so if you use one, you may have the other 149 * one with no additional overhead. Similarly, SHA-384 and SHA-512 150 * share the same implementation code. 151 */ 152 br_ssl_engine_set_hash(&cc->eng, br_md5_ID, &br_md5_vtable); 153 br_ssl_engine_set_hash(&cc->eng, br_sha1_ID, &br_sha1_vtable); 154 br_ssl_engine_set_hash(&cc->eng, br_sha224_ID, &br_sha224_vtable); 155 br_ssl_engine_set_hash(&cc->eng, br_sha256_ID, &br_sha256_vtable); 156 br_ssl_engine_set_hash(&cc->eng, br_sha384_ID, &br_sha384_vtable); 157 br_ssl_engine_set_hash(&cc->eng, br_sha512_ID, &br_sha512_vtable); 158 159 /* 160 * Set the cipher suites. All specified cipher suite MUST be 161 * supported, and the relevant algorithms MUST have been 162 * configured (failure to provide needed implementations may 163 * trigger unwanted behaviours like segfaults or overflows). 164 */ 165 br_ssl_engine_set_suites(&cc->eng, suites, 166 (sizeof suites) / (sizeof suites[0])); 167 168 /* 169 * Public-key algorithm implementations. 170 * 171 * -- RSA public core ("rsapub") is needed for "RSA" key exchange 172 * (cipher suites whose name starts with TLS_RSA). 173 * 174 * -- RSA signature verification ("rsavrfy") is needed for 175 * "ECDHE_RSA" cipher suites (not ECDH_RSA). 176 * 177 * -- Elliptic curve implementation ("ec") is needed for cipher 178 * suites that use elliptic curves (both "ECDH" and "ECDHE" 179 * cipher suites). 180 * 181 * -- ECDSA signature verification is needed for "ECDHE_ECDSA" 182 * cipher suites (but not for ECDHE_RSA, ECDH_ECDSA or ECDH_RSA). 183 * 184 * Normally, you use the "default" implementations, obtained 185 * through relevant function calls. These functions return 186 * implementations that are deemed "best" for the current 187 * platform, where "best" means "fastest within constant-time 188 * implementations". Selecting the default implementation is a 189 * mixture of compile-time and runtime checks. 190 * 191 * Nevertheless, specific implementations may be selected 192 * explicitly, e.g. to use code which is slower but with a 193 * smaller footprint. 194 * 195 * The RSA code comes in three variants, called "i15", "i31" and 196 * "i32". The "i31" code is somewhat faster than the "i32" code. 197 * Usually, "i31" is faster than "i15", except on some specific 198 * architectures (ARM Cortex M0, M0+, M1 and M3) where the "i15" 199 * should be preferred (the "i15" code is constant-time, while 200 * the "i31" is not, and the "i15" code is faster anyway). 201 * 202 * ECDSA code also comes in "i15" and "i31" variants. As in the 203 * case of RSA, the "i31" code is faster, except on the small 204 * ARM Cortex M, where the "i15" code is faster and safer. 205 * 206 * There are no less than 10 elliptic curve implementations: 207 * 208 * - ec_c25519_i15, ec_c25519_i31, ec_c25519_m15 and ec_c25519_m31 209 * implement Curve25519. 210 * 211 * - ec_p256_m15 and ec_p256_m31 implement NIST curve P-256. 212 * 213 * - ec_prime_i15 and ec_prime_i31 implement NIST curves P-256, 214 * P-384 and P-521. 215 * 216 * - ec_all_m15 is an aggregate implementation that uses 217 * ec_c25519_m15, ec_p256_m15 and ec_prime_i15. 218 * 219 * - ec_all_m31 is an aggregate implementation that uses 220 * ec_c25519_m31, ec_p256_m31 and ec_prime_i31. 221 * 222 * For a given curve, "m15" is faster than "i15" (but possibly 223 * with a larger code footprint) and "m31" is faster than "i31" 224 * (there again with a larger code footprint). For best 225 * performance, use ec_all_m31, except on the small ARM Cortex M 226 * where ec_all_m15 should be used. Referencing the other 227 * implementations directly will result in smaller code, but 228 * support for fewer curves and possibly lower performance. 229 */ 230 br_ssl_client_set_default_rsapub(cc); 231 br_ssl_engine_set_default_rsavrfy(&cc->eng); 232 br_ssl_engine_set_default_ecdsa(&cc->eng); 233 /* Alternate: set implementations explicitly. 234 br_ssl_client_set_rsapub(cc, &br_rsa_i31_public); 235 br_ssl_client_set_rsavrfy(cc, &br_rsa_i31_pkcs1_vrfy); 236 br_ssl_engine_set_ec(&cc->eng, &br_ec_all_m31); 237 br_ssl_engine_set_ecdsa(&cc->eng, &br_ecdsa_i31_vrfy_asn1); 238 */ 239 240 /* 241 * Record handler: 242 * -- Cipher suites in AES_128_CBC, AES_256_CBC and 3DES_EDE_CBC 243 * need the CBC record handler ("set_cbc"). 244 * -- Cipher suites in AES_128_GCM and AES_256_GCM need the GCM 245 * record handler ("set_gcm"). 246 * -- Cipher suites in CHACHA20_POLY1305 need the ChaCha20+Poly1305 247 * record handler ("set_chapol"). 248 */ 249 br_ssl_engine_set_cbc(&cc->eng, 250 &br_sslrec_in_cbc_vtable, 251 &br_sslrec_out_cbc_vtable); 252 br_ssl_engine_set_gcm(&cc->eng, 253 &br_sslrec_in_gcm_vtable, 254 &br_sslrec_out_gcm_vtable); 255 br_ssl_engine_set_chapol(&cc->eng, 256 &br_sslrec_in_chapol_vtable, 257 &br_sslrec_out_chapol_vtable); 258 259 /* 260 * Symmetric encryption: 261 * -- AES_128_CBC and AES_256_CBC require an "aes_cbc" implementation 262 * (actually two implementations, for encryption and decryption). 263 * -- 3DES_EDE_CBC requires a "des_cbc" implementation 264 * (actually two implementations, for encryption and decryption). 265 * -- AES_128_GCM and AES_256_GCM require an "aes_ctr" imeplementation 266 * and also a GHASH implementation. 267 * 268 * Two 3DES implementations are provided: 269 * 270 * des_tab Classical table-based implementation; it is 271 * not constant-time. 272 * 273 * dest_ct Constant-time DES/3DES implementation. It is 274 * slower than des_tab. 275 * 276 * Four AES implementations are provided: 277 * 278 * aes_ct Constant-time AES implementation, for 32-bit 279 * systems. 280 * 281 * aes_ct64 Constant-time AES implementation, for 64-bit 282 * systems. It actually also runs on 32-bit systems, 283 * but, on such systems, it yields larger code and 284 * slightly worse performance. On 64-bit systems, 285 * aes_ct64 is about twice faster than aes_ct for 286 * CTR processing (GCM encryption and decryption), 287 * and for CBC (decryption only). 288 * 289 * aes_small Smallest implementation provided, but also the 290 * slowest, and it is not constant-time. Use it 291 * only if desperate for code size. 292 * 293 * aes_big Classical table-based AES implementation. This 294 * is decently fast and still resonably compact, 295 * but it is not constant-time. 296 * 297 * aes_x86ni Very fast implementation that uses the AES-NI 298 * opcodes on recent x86 CPU. But it may not be 299 * compiled in the library if the compiler or 300 * architecture is not supported; and the CPU 301 * may also not support the opcodes. Selection 302 * functions are provided to test for availability 303 * of the code and the opcodes. 304 * 305 * Whether having constant-time implementations is absolutely 306 * required for security depends on the context (in particular 307 * whether the target architecture actually has cache memory), 308 * and while side-channel analysis for non-constant-time AES 309 * code has been demonstrated in lab conditions, it certainly 310 * does not apply to all actual usages, and it has never been 311 * spotted in the wild. It is still considered cautious to use 312 * constant-time code by default, and to consider the other 313 * implementations only if duly measured performance issues make 314 * it mandatory. 315 */ 316 br_ssl_engine_set_aes_cbc(&cc->eng, 317 &br_aes_ct_cbcenc_vtable, 318 &br_aes_ct_cbcdec_vtable); 319 br_ssl_engine_set_aes_ctr(&cc->eng, 320 &br_aes_ct_ctr_vtable); 321 /* Alternate: aes_ct64 322 br_ssl_engine_set_aes_cbc(&cc->eng, 323 &br_aes_ct64_cbcenc_vtable, 324 &br_aes_ct64_cbcdec_vtable); 325 br_ssl_engine_set_aes_ctr(&cc->eng, 326 &br_aes_ct64_ctr_vtable); 327 */ 328 /* Alternate: aes_small 329 br_ssl_engine_set_aes_cbc(&cc->eng, 330 &br_aes_small_cbcenc_vtable, 331 &br_aes_small_cbcdec_vtable); 332 br_ssl_engine_set_aes_ctr(&cc->eng, 333 &br_aes_small_ctr_vtable); 334 */ 335 /* Alternate: aes_big 336 br_ssl_engine_set_aes_cbc(&cc->eng, 337 &br_aes_big_cbcenc_vtable, 338 &br_aes_big_cbcdec_vtable); 339 br_ssl_engine_set_aes_ctr(&cc->eng, 340 &br_aes_big_ctr_vtable); 341 */ 342 br_ssl_engine_set_des_cbc(&cc->eng, 343 &br_des_ct_cbcenc_vtable, 344 &br_des_ct_cbcdec_vtable); 345 /* Alternate: des_tab 346 br_ssl_engine_set_des_cbc(&cc->eng, 347 &br_des_tab_cbcenc_vtable, 348 &br_des_tab_cbcdec_vtable); 349 */ 350 351 /* 352 * GHASH is needed for AES_128_GCM and AES_256_GCM. Three 353 * implementations are provided: 354 * 355 * ctmul Uses 32-bit multiplications with a 64-bit result. 356 * 357 * ctmul32 Uses 32-bit multiplications with a 32-bit result. 358 * 359 * ctmul64 Uses 64-bit multiplications with a 64-bit result. 360 * 361 * On 64-bit platforms, ctmul64 is the smallest and fastest of 362 * the three. On 32-bit systems, ctmul should be preferred. The 363 * ctmul32 implementation is meant to be used for the specific 364 * 32-bit systems that do not have a 32x32->64 multiplier (i.e. 365 * the ARM Cortex-M0 and Cortex-M0+). 366 * 367 * These implementations are all constant-time as long as the 368 * underlying multiplication opcode is constant-time (which is 369 * true for all modern systems, but not for older architectures 370 * such that ARM9 or 80486). 371 */ 372 br_ssl_engine_set_ghash(&cc->eng, 373 &br_ghash_ctmul); 374 /* Alternate: ghash_ctmul32 375 br_ssl_engine_set_ghash(&cc->eng, 376 &br_ghash_ctmul32); 377 */ 378 /* Alternate: ghash_ctmul64 379 br_ssl_engine_set_ghash(&cc->eng, 380 &br_ghash_ctmul64); 381 */ 382 383#if 0 384 /* 385 * For a client, the normal case is to validate the server 386 * certificate with regards to a set of trust anchors. This 387 * entails using a br_x509_minimal_context structure, configured 388 * with the relevant algorithms, as shown below. 389 * 390 * Alternatively, the client could "know" the intended server 391 * public key through an out-of-band mechanism, in which case 392 * a br_x509_knownkey_context is appropriate, for a much reduced 393 * code footprint. 394 * 395 * We assume here that the following extra parameters have been 396 * provided: 397 * 398 * xc engine context (br_x509_minimal_context *) 399 * trust_anchors trust anchors (br_x509_trust_anchor *) 400 * trust_anchors_num number of trust anchors (size_t) 401 */ 402 403 /* 404 * The X.509 engine needs a hash function for processing the 405 * subject and issuer DN of certificates and trust anchors. Any 406 * supported hash function is appropriate; here we use SHA-256. 407 * The trust an 408 */ 409 br_x509_minimal_init(xc, &br_sha256_vtable, 410 trust_anchors, trust_anchors_num); 411 412 /* 413 * Set suites and asymmetric crypto implementations. We use the 414 * "i31" code for RSA (it is somewhat faster than the "i32" 415 * implementation). These implementations are used for 416 * signature verification on certificates, but not for the 417 * SSL-specific usage of the server's public key. For instance, 418 * if the server has an EC public key but the rest of the chain 419 * (intermediate CA, root...) use RSA, then you would need only 420 * the RSA verification function below. 421 */ 422 br_x509_minimal_set_rsa(xc, &br_rsa_i31_pkcs1_vrfy); 423 br_x509_minimal_set_ecdsa(xc, 424 &br_ec_prime_i31, &br_ecdsa_i31_vrfy_asn1); 425 426 /* 427 * Set supported hash functions. These are for signatures on 428 * certificates. There again, you only need the hash functions 429 * that are actually used in certificates, but if a given 430 * function was included for the SSL engine, you may as well 431 * add it here. 432 * 433 * Note: the engine explicitly rejects signatures that use MD5. 434 * Thus, there is no need for MD5 here. 435 */ 436 br_ssl_engine_set_hash(xc, br_sha1_ID, &br_sha1_vtable); 437 br_ssl_engine_set_hash(xc, br_sha224_ID, &br_sha224_vtable); 438 br_ssl_engine_set_hash(xc, br_sha256_ID, &br_sha256_vtable); 439 br_ssl_engine_set_hash(xc, br_sha384_ID, &br_sha384_vtable); 440 br_ssl_engine_set_hash(xc, br_sha512_ID, &br_sha512_vtable); 441 442 /* 443 * Link the X.509 engine in the SSL engine. 444 */ 445 br_ssl_engine_set_x509(&cc->eng, &xc->vtable); 446#endif 447} 448 449/* 450 * Example server profile. Most of it is shared with the client 451 * profile, so see the comments in the client function for details. 452 * 453 * This example function assumes a server with a (unique) RSA private 454 * key, so the list of cipher suites is trimmed down for RSA. 455 */ 456void 457example_server_profile(br_ssl_server_context *cc, 458 const br_x509_certificate *chain, size_t chain_len, 459 const br_rsa_private_key *sk) 460{ 461 static const uint16_t suites[] = { 462 BR_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 463 BR_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, 464 BR_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, 465 BR_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, 466 BR_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, 467 BR_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, 468 BR_TLS_RSA_WITH_AES_128_GCM_SHA256, 469 BR_TLS_RSA_WITH_AES_256_GCM_SHA384, 470 BR_TLS_RSA_WITH_AES_128_CBC_SHA256, 471 BR_TLS_RSA_WITH_AES_256_CBC_SHA256, 472 BR_TLS_RSA_WITH_AES_128_CBC_SHA, 473 BR_TLS_RSA_WITH_AES_256_CBC_SHA, 474 BR_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, 475 BR_TLS_RSA_WITH_3DES_EDE_CBC_SHA 476 }; 477 478 br_ssl_server_zero(cc); 479 br_ssl_engine_set_versions(&cc->eng, BR_TLS10, BR_TLS12); 480 481 br_ssl_engine_set_prf10(&cc->eng, &br_tls10_prf); 482 br_ssl_engine_set_prf_sha256(&cc->eng, &br_tls12_sha256_prf); 483 br_ssl_engine_set_prf_sha384(&cc->eng, &br_tls12_sha384_prf); 484 485 /* 486 * Apart from the requirements listed in the client side, these 487 * hash functions are also used by the server to compute its 488 * signature on ECDHE parameters. Which functions are needed 489 * depends on what the client may support; furthermore, the 490 * client may fail to send the relevant extension, in which 491 * case the server will default to whatever it can (as per the 492 * standard, it should be SHA-1 in that case). 493 */ 494 br_ssl_engine_set_hash(&cc->eng, br_md5_ID, &br_md5_vtable); 495 br_ssl_engine_set_hash(&cc->eng, br_sha1_ID, &br_sha1_vtable); 496 br_ssl_engine_set_hash(&cc->eng, br_sha224_ID, &br_sha224_vtable); 497 br_ssl_engine_set_hash(&cc->eng, br_sha256_ID, &br_sha256_vtable); 498 br_ssl_engine_set_hash(&cc->eng, br_sha384_ID, &br_sha384_vtable); 499 br_ssl_engine_set_hash(&cc->eng, br_sha512_ID, &br_sha512_vtable); 500 501 br_ssl_engine_set_suites(&cc->eng, suites, 502 (sizeof suites) / (sizeof suites[0])); 503 504 /* 505 * Elliptic curve implementation is used for ECDHE suites (but 506 * not for ECDH). 507 */ 508 br_ssl_engine_set_ec(&cc->eng, &br_ec_prime_i31); 509 510 /* 511 * Set the "server policy": handler for the certificate chain 512 * and private key operations. Here, we indicate that the RSA 513 * private key is fit for both signing and decrypting, and we 514 * provide the two relevant implementations. 515 516 * BR_KEYTYPE_KEYX allows TLS_RSA_*, BR_KEYTYPE_SIGN allows 517 * TLS_ECDHE_RSA_*. 518 */ 519 br_ssl_server_set_single_rsa(cc, chain, chain_len, sk, 520 BR_KEYTYPE_KEYX | BR_KEYTYPE_SIGN, 521 br_rsa_i31_private, br_rsa_i31_pkcs1_sign); 522 /* 523 * If the server used an EC private key, this call would look 524 * like this: 525 526 br_ssl_server_set_single_ec(cc, chain, chain_len, sk, 527 BR_KEYTYPE_KEYX | BR_KEYTYPE_SIGN, 528 cert_issuer_key_type, 529 &br_ec_prime_i31, br_ecdsa_i31_sign_asn1); 530 531 * Note the tricky points: 532 * 533 * -- "ECDH" cipher suites use only the EC code (&br_ec_prime_i31); 534 * the ECDHE_ECDSA cipher suites need both the EC code and 535 * the ECDSA signature implementation. 536 * 537 * -- For "ECDH" (not "ECDHE") cipher suites, the engine must 538 * know the key type (RSA or EC) for the intermediate CA that 539 * issued the server's certificate; this is an artefact of 540 * how the protocol is defined. BearSSL won't try to decode 541 * the server's certificate to obtain that information (it 542 * could do that, the code is there, but it would increase the 543 * footprint). So this must be provided by the caller. 544 * 545 * -- BR_KEYTYPE_KEYX allows ECDH, BR_KEYTYPE_SIGN allows 546 * ECDHE_ECDSA. 547 */ 548 549 br_ssl_engine_set_cbc(&cc->eng, 550 &br_sslrec_in_cbc_vtable, 551 &br_sslrec_out_cbc_vtable); 552 br_ssl_engine_set_gcm(&cc->eng, 553 &br_sslrec_in_gcm_vtable, 554 &br_sslrec_out_gcm_vtable); 555 556 br_ssl_engine_set_aes_cbc(&cc->eng, 557 &br_aes_ct_cbcenc_vtable, 558 &br_aes_ct_cbcdec_vtable); 559 br_ssl_engine_set_aes_ctr(&cc->eng, 560 &br_aes_ct_ctr_vtable); 561 /* Alternate: aes_ct64 562 br_ssl_engine_set_aes_cbc(&cc->eng, 563 &br_aes_ct64_cbcenc_vtable, 564 &br_aes_ct64_cbcdec_vtable); 565 br_ssl_engine_set_aes_ctr(&cc->eng, 566 &br_aes_ct64_ctr_vtable); 567 */ 568 /* Alternate: aes_small 569 br_ssl_engine_set_aes_cbc(&cc->eng, 570 &br_aes_small_cbcenc_vtable, 571 &br_aes_small_cbcdec_vtable); 572 br_ssl_engine_set_aes_ctr(&cc->eng, 573 &br_aes_small_ctr_vtable); 574 */ 575 /* Alternate: aes_big 576 br_ssl_engine_set_aes_cbc(&cc->eng, 577 &br_aes_big_cbcenc_vtable, 578 &br_aes_big_cbcdec_vtable); 579 br_ssl_engine_set_aes_ctr(&cc->eng, 580 &br_aes_big_ctr_vtable); 581 */ 582 br_ssl_engine_set_des_cbc(&cc->eng, 583 &br_des_ct_cbcenc_vtable, 584 &br_des_ct_cbcdec_vtable); 585 /* Alternate: des_tab 586 br_ssl_engine_set_des_cbc(&cc->eng, 587 &br_des_tab_cbcenc_vtable, 588 &br_des_tab_cbcdec_vtable); 589 */ 590 591 br_ssl_engine_set_ghash(&cc->eng, 592 &br_ghash_ctmul); 593 /* Alternate: ghash_ctmul32 594 br_ssl_engine_set_ghash(&cc->eng, 595 &br_ghash_ctmul32); 596 */ 597 /* Alternate: ghash_ctmul64 598 br_ssl_engine_set_ghash(&cc->eng, 599 &br_ghash_ctmul64); 600 */ 601} 602