-
Notifications
You must be signed in to change notification settings - Fork 724
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
refactor: add libcrypto PRF impl for openssl-3.0-fips #5158
Conversation
8201d5c
to
206fdfa
Compare
206fdfa
to
302ce4a
Compare
#if defined(OPENSSL_IS_AWSLC) | ||
|
||
/* The AWSLC TLS PRF API is exported in all AWSLC versions. However, in the AWSLC FIPS branch, this |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I didn't modify any of the AWSLC PRF code. I just moved it.
const char *digest_name = "MD5-SHA1"; | ||
const char *fetch_properties = "-fips"; | ||
|
||
if (conn->actual_protocol_version == S2N_TLS12) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nit: What do you think about making the version handling explicit? I think is implicitly
if protocol == TLS10 || protocol == TLS11 {
md5-sha1
} if protocol == TLS12 {
cipher_specific
} else {
unreachable(?)
}
I think this is also a nice bit of documentation about where this code is called from (e.g. not TLS 1.3 or SSLv3?)
Release Summary:
Resolved issues:
resolves #5143
Description of changes:
Add a new libcrypto PRF using openssl-3.0's EVP_KDF methods and "EVP_KDF-TLS1_PRF" algorithm:
https://docs.openssl.org/3.4/man3/EVP_KDF/
https://docs.openssl.org/3.4/man7/EVP_KDF-TLS1_PRF/
I also moved the libcrypto PRFs to a separate file. I think it belongs in the crypto folder?
Testing:
I mostly reused the existing tests, but with some improvements to make them more useful:
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.