diff options
| author |   jsing <jsing@openbsd.org> | 2014-06-13 13:28:53 +0000 |
|---|---|---|
| committer | jsing <jsing@openbsd.org> | 2014-06-13 13:28:53 +0000 |
| commit | 12fc33de51667f44bceb50217dd9653817d9edd7 (patch) | |
| tree | 45d050ee3055d9a212876b3f8460e1030f79a005 /lib/libssl/ssl_ciph.c | |
| parent | Switch the AES-GCM cipher suites to SSL_CIPHER_ALGORITHM2_AEAD. (diff) | |
| download | wireguard-openbsd-12fc33de51667f44bceb50217dd9653817d9edd7.tar.xz wireguard-openbsd-12fc33de51667f44bceb50217dd9653817d9edd7.zip | |
Add ChaCha20-Poly1305 based ciphersuites.
Based on Adam Langley's chromium patches.
Tested by and ok sthen@
Diffstat (limited to 'lib/libssl/ssl_ciph.c')
| -rw-r--r-- | lib/libssl/ssl_ciph.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/lib/libssl/ssl_ciph.c b/lib/libssl/ssl_ciph.c index 25291bfd4ac..a89c8253c8f 100644 --- a/lib/libssl/ssl_ciph.c +++ b/lib/libssl/ssl_ciph.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_ciph.c,v 1.52 2014/06/12 15:49:31 deraadt Exp $ */ +/* $OpenBSD: ssl_ciph.c,v 1.53 2014/06/13 13:28:53 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -916,6 +916,11 @@ ssl_cipher_get_evp_aead(const SSL_SESSION *s, const EVP_AEAD **aead) *aead = EVP_aead_aes_256_gcm(); return 1; #endif +#if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305) + case SSL_CHACHA20POLY1305: + *aead = EVP_aead_chacha20_poly1305(); + return 1; +#endif default: break; } @@ -1617,7 +1622,11 @@ ssl_create_cipher_list(const SSL_METHOD *ssl_method, ssl_cipher_apply_rule(0, SSL_kEECDH, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail); ssl_cipher_apply_rule(0, SSL_kEECDH, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail); - /* AES is our preferred symmetric cipher */ + /* + * CHACHA20 is fast and safe on all hardware and is thus our preferred + * symmetric cipher, with AES second. + */ + ssl_cipher_apply_rule(0, 0, 0, SSL_CHACHA20POLY1305, 0, 0, 0, CIPHER_ADD, -1, &head, &tail); ssl_cipher_apply_rule(0, 0, 0, SSL_AES, 0, 0, 0, CIPHER_ADD, -1, &head, &tail); /* Temporarily enable everything else for sorting */ @@ -1871,6 +1880,9 @@ SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len) case SSL_SEED: enc="SEED(128)"; break; + case SSL_CHACHA20POLY1305: + enc = "ChaCha20-Poly1305"; + break; default: enc="unknown"; break; |