1*0957b409SSimon J. Gerraty /*
2*0957b409SSimon J. Gerraty * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
3*0957b409SSimon J. Gerraty *
4*0957b409SSimon J. Gerraty * Permission is hereby granted, free of charge, to any person obtaining
5*0957b409SSimon J. Gerraty * a copy of this software and associated documentation files (the
6*0957b409SSimon J. Gerraty * "Software"), to deal in the Software without restriction, including
7*0957b409SSimon J. Gerraty * without limitation the rights to use, copy, modify, merge, publish,
8*0957b409SSimon J. Gerraty * distribute, sublicense, and/or sell copies of the Software, and to
9*0957b409SSimon J. Gerraty * permit persons to whom the Software is furnished to do so, subject to
10*0957b409SSimon J. Gerraty * the following conditions:
11*0957b409SSimon J. Gerraty *
12*0957b409SSimon J. Gerraty * The above copyright notice and this permission notice shall be
13*0957b409SSimon J. Gerraty * included in all copies or substantial portions of the Software.
14*0957b409SSimon J. Gerraty *
15*0957b409SSimon J. Gerraty * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16*0957b409SSimon J. Gerraty * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17*0957b409SSimon J. Gerraty * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
18*0957b409SSimon J. Gerraty * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
19*0957b409SSimon J. Gerraty * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
20*0957b409SSimon J. Gerraty * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
21*0957b409SSimon J. Gerraty * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22*0957b409SSimon J. Gerraty * SOFTWARE.
23*0957b409SSimon J. Gerraty */
24*0957b409SSimon J. Gerraty
25*0957b409SSimon J. Gerraty #include "bearssl.h"
26*0957b409SSimon J. Gerraty
27*0957b409SSimon J. Gerraty /*
28*0957b409SSimon J. Gerraty * A "profile" is an initialisation function for a SSL context, that
29*0957b409SSimon J. Gerraty * configures a list of cipher suites and algorithm implementations.
30*0957b409SSimon J. Gerraty * While BearSSL comes with a few predefined profiles, you might one
31*0957b409SSimon J. Gerraty * to define you own, using the example below as guidance.
32*0957b409SSimon J. Gerraty *
33*0957b409SSimon J. Gerraty * Each individual initialisation call sets a parameter or an algorithm
34*0957b409SSimon J. Gerraty * support. Setting a specific algorithm pulls in the implementation of
35*0957b409SSimon J. Gerraty * that algorithm in the compiled binary, as per static linking
36*0957b409SSimon J. Gerraty * behaviour. Removing some of this calls will then reduce total code
37*0957b409SSimon J. Gerraty * footprint, but also mechanically prevents some features to be
38*0957b409SSimon J. Gerraty * supported (protocol versions and cipher suites).
39*0957b409SSimon J. Gerraty *
40*0957b409SSimon J. Gerraty * The two below define profiles for the client and the server contexts,
41*0957b409SSimon J. Gerraty * respectively. Of course, in a typical size-constrained application,
42*0957b409SSimon J. Gerraty * you would use one or the other, not both, to avoid pulling in code
43*0957b409SSimon J. Gerraty * for both.
44*0957b409SSimon J. Gerraty */
45*0957b409SSimon J. Gerraty
46*0957b409SSimon J. Gerraty void
example_client_profile(br_ssl_client_context * cc)47*0957b409SSimon J. Gerraty example_client_profile(br_ssl_client_context *cc
48*0957b409SSimon J. Gerraty /* and possibly some other arguments */)
49*0957b409SSimon J. Gerraty {
50*0957b409SSimon J. Gerraty /*
51*0957b409SSimon J. Gerraty * A list of cipher suites, by preference (first is most
52*0957b409SSimon J. Gerraty * preferred). The list below contains all cipher suites supported
53*0957b409SSimon J. Gerraty * by BearSSL; trim it done to your needs.
54*0957b409SSimon J. Gerraty */
55*0957b409SSimon J. Gerraty static const uint16_t suites[] = {
56*0957b409SSimon J. Gerraty BR_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
57*0957b409SSimon J. Gerraty BR_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
58*0957b409SSimon J. Gerraty BR_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
59*0957b409SSimon J. Gerraty BR_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
60*0957b409SSimon J. Gerraty BR_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
61*0957b409SSimon J. Gerraty BR_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
62*0957b409SSimon J. Gerraty BR_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
63*0957b409SSimon J. Gerraty BR_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
64*0957b409SSimon J. Gerraty BR_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
65*0957b409SSimon J. Gerraty BR_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
66*0957b409SSimon J. Gerraty BR_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
67*0957b409SSimon J. Gerraty BR_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
68*0957b409SSimon J. Gerraty BR_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
69*0957b409SSimon J. Gerraty BR_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
70*0957b409SSimon J. Gerraty BR_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
71*0957b409SSimon J. Gerraty BR_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,
72*0957b409SSimon J. Gerraty BR_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
73*0957b409SSimon J. Gerraty BR_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,
74*0957b409SSimon J. Gerraty BR_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,
75*0957b409SSimon J. Gerraty BR_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,
76*0957b409SSimon J. Gerraty BR_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,
77*0957b409SSimon J. Gerraty BR_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,
78*0957b409SSimon J. Gerraty BR_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
79*0957b409SSimon J. Gerraty BR_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,
80*0957b409SSimon J. Gerraty BR_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
81*0957b409SSimon J. Gerraty BR_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,
82*0957b409SSimon J. Gerraty BR_TLS_RSA_WITH_AES_128_GCM_SHA256,
83*0957b409SSimon J. Gerraty BR_TLS_RSA_WITH_AES_256_GCM_SHA384,
84*0957b409SSimon J. Gerraty BR_TLS_RSA_WITH_AES_128_CBC_SHA256,
85*0957b409SSimon J. Gerraty BR_TLS_RSA_WITH_AES_256_CBC_SHA256,
86*0957b409SSimon J. Gerraty BR_TLS_RSA_WITH_AES_128_CBC_SHA,
87*0957b409SSimon J. Gerraty BR_TLS_RSA_WITH_AES_256_CBC_SHA,
88*0957b409SSimon J. Gerraty BR_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
89*0957b409SSimon J. Gerraty BR_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
90*0957b409SSimon J. Gerraty BR_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,
91*0957b409SSimon J. Gerraty BR_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,
92*0957b409SSimon J. Gerraty BR_TLS_RSA_WITH_3DES_EDE_CBC_SHA
93*0957b409SSimon J. Gerraty };
94*0957b409SSimon J. Gerraty
95*0957b409SSimon J. Gerraty /*
96*0957b409SSimon J. Gerraty * Client context must be cleared at some point. This sets
97*0957b409SSimon J. Gerraty * every value and pointer to 0 or NULL.
98*0957b409SSimon J. Gerraty */
99*0957b409SSimon J. Gerraty br_ssl_client_zero(cc);
100*0957b409SSimon J. Gerraty
101*0957b409SSimon J. Gerraty /*
102*0957b409SSimon J. Gerraty * Define minimum and maximum protocol versions. Supported
103*0957b409SSimon J. Gerraty * versions are:
104*0957b409SSimon J. Gerraty * BR_TLS10 TLS 1.0
105*0957b409SSimon J. Gerraty * BR_TLS11 TLS 1.1
106*0957b409SSimon J. Gerraty * BR_TLS12 TLS 1.2
107*0957b409SSimon J. Gerraty */
108*0957b409SSimon J. Gerraty br_ssl_engine_set_versions(&cc->eng, BR_TLS10, BR_TLS12);
109*0957b409SSimon J. Gerraty
110*0957b409SSimon J. Gerraty /*
111*0957b409SSimon J. Gerraty * Set the PRF implementation(s).
112*0957b409SSimon J. Gerraty * For TLS 1.0 and 1.1, the "prf10" is needed.
113*0957b409SSimon J. Gerraty * For TLS 1.2, this depends on the cipher suite:
114*0957b409SSimon J. Gerraty * -- cipher suites with a name ending in "SHA384" need "prf_sha384";
115*0957b409SSimon J. Gerraty * -- all others need "prf_sha256".
116*0957b409SSimon J. Gerraty *
117*0957b409SSimon J. Gerraty * Note that a cipher suite like TLS_RSA_WITH_AES_128_CBC_SHA will
118*0957b409SSimon J. Gerraty * use SHA-1 for the per-record MAC (that's what the final "SHA"
119*0957b409SSimon J. Gerraty * means), but still SHA-256 for the PRF when selected along with
120*0957b409SSimon J. Gerraty * the TLS-1.2 protocol version.
121*0957b409SSimon J. Gerraty */
122*0957b409SSimon J. Gerraty br_ssl_engine_set_prf10(&cc->eng, &br_tls10_prf);
123*0957b409SSimon J. Gerraty br_ssl_engine_set_prf_sha256(&cc->eng, &br_tls12_sha256_prf);
124*0957b409SSimon J. Gerraty br_ssl_engine_set_prf_sha384(&cc->eng, &br_tls12_sha384_prf);
125*0957b409SSimon J. Gerraty
126*0957b409SSimon J. Gerraty /*
127*0957b409SSimon J. Gerraty * Set hash functions for the engine. Required hash functions
128*0957b409SSimon J. Gerraty * depend on the protocol and cipher suite:
129*0957b409SSimon J. Gerraty *
130*0957b409SSimon J. Gerraty * -- TLS 1.0 and 1.1 require both MD5 and SHA-1.
131*0957b409SSimon J. Gerraty * -- With TLS 1.2, cipher suites with a name ending in "SHA384"
132*0957b409SSimon J. Gerraty * require SHA-384.
133*0957b409SSimon J. Gerraty * -- With TLS 1.2, cipher suites with a name ending in "SHA256"
134*0957b409SSimon J. Gerraty * require SHA-256.
135*0957b409SSimon J. Gerraty * -- With TLS 1.2, cipher suites with a name ending in "SHA"
136*0957b409SSimon J. Gerraty * require both SHA-256 and SHA-1.
137*0957b409SSimon J. Gerraty *
138*0957b409SSimon J. Gerraty * Moreover, these hash functions are also used to compute
139*0957b409SSimon J. Gerraty * hashes supporting signatures on the server side (for ECDHE_*
140*0957b409SSimon J. Gerraty * cipher suites), and on the client side (for client
141*0957b409SSimon J. Gerraty * certificates, except in the case of full static ECDH). In TLS
142*0957b409SSimon J. Gerraty * 1.0 and 1.1, SHA-1 (and also MD5) will be used, but with TLS
143*0957b409SSimon J. Gerraty * 1.2 these hash functions are negotiated between client and
144*0957b409SSimon J. Gerraty * server; SHA-256 and/or SHA-384 should be sufficient in
145*0957b409SSimon J. Gerraty * practice.
146*0957b409SSimon J. Gerraty *
147*0957b409SSimon J. Gerraty * Note that with current implementations, SHA-224 and SHA-256
148*0957b409SSimon J. Gerraty * share the same file, so if you use one, you may have the other
149*0957b409SSimon J. Gerraty * one with no additional overhead. Similarly, SHA-384 and SHA-512
150*0957b409SSimon J. Gerraty * share the same implementation code.
151*0957b409SSimon J. Gerraty */
152*0957b409SSimon J. Gerraty br_ssl_engine_set_hash(&cc->eng, br_md5_ID, &br_md5_vtable);
153*0957b409SSimon J. Gerraty br_ssl_engine_set_hash(&cc->eng, br_sha1_ID, &br_sha1_vtable);
154*0957b409SSimon J. Gerraty br_ssl_engine_set_hash(&cc->eng, br_sha224_ID, &br_sha224_vtable);
155*0957b409SSimon J. Gerraty br_ssl_engine_set_hash(&cc->eng, br_sha256_ID, &br_sha256_vtable);
156*0957b409SSimon J. Gerraty br_ssl_engine_set_hash(&cc->eng, br_sha384_ID, &br_sha384_vtable);
157*0957b409SSimon J. Gerraty br_ssl_engine_set_hash(&cc->eng, br_sha512_ID, &br_sha512_vtable);
158*0957b409SSimon J. Gerraty
159*0957b409SSimon J. Gerraty /*
160*0957b409SSimon J. Gerraty * Set the cipher suites. All specified cipher suite MUST be
161*0957b409SSimon J. Gerraty * supported, and the relevant algorithms MUST have been
162*0957b409SSimon J. Gerraty * configured (failure to provide needed implementations may
163*0957b409SSimon J. Gerraty * trigger unwanted behaviours like segfaults or overflows).
164*0957b409SSimon J. Gerraty */
165*0957b409SSimon J. Gerraty br_ssl_engine_set_suites(&cc->eng, suites,
166*0957b409SSimon J. Gerraty (sizeof suites) / (sizeof suites[0]));
167*0957b409SSimon J. Gerraty
168*0957b409SSimon J. Gerraty /*
169*0957b409SSimon J. Gerraty * Public-key algorithm implementations.
170*0957b409SSimon J. Gerraty *
171*0957b409SSimon J. Gerraty * -- RSA public core ("rsapub") is needed for "RSA" key exchange
172*0957b409SSimon J. Gerraty * (cipher suites whose name starts with TLS_RSA).
173*0957b409SSimon J. Gerraty *
174*0957b409SSimon J. Gerraty * -- RSA signature verification ("rsavrfy") is needed for
175*0957b409SSimon J. Gerraty * "ECDHE_RSA" cipher suites (not ECDH_RSA).
176*0957b409SSimon J. Gerraty *
177*0957b409SSimon J. Gerraty * -- Elliptic curve implementation ("ec") is needed for cipher
178*0957b409SSimon J. Gerraty * suites that use elliptic curves (both "ECDH" and "ECDHE"
179*0957b409SSimon J. Gerraty * cipher suites).
180*0957b409SSimon J. Gerraty *
181*0957b409SSimon J. Gerraty * -- ECDSA signature verification is needed for "ECDHE_ECDSA"
182*0957b409SSimon J. Gerraty * cipher suites (but not for ECDHE_RSA, ECDH_ECDSA or ECDH_RSA).
183*0957b409SSimon J. Gerraty *
184*0957b409SSimon J. Gerraty * Normally, you use the "default" implementations, obtained
185*0957b409SSimon J. Gerraty * through relevant function calls. These functions return
186*0957b409SSimon J. Gerraty * implementations that are deemed "best" for the current
187*0957b409SSimon J. Gerraty * platform, where "best" means "fastest within constant-time
188*0957b409SSimon J. Gerraty * implementations". Selecting the default implementation is a
189*0957b409SSimon J. Gerraty * mixture of compile-time and runtime checks.
190*0957b409SSimon J. Gerraty *
191*0957b409SSimon J. Gerraty * Nevertheless, specific implementations may be selected
192*0957b409SSimon J. Gerraty * explicitly, e.g. to use code which is slower but with a
193*0957b409SSimon J. Gerraty * smaller footprint.
194*0957b409SSimon J. Gerraty *
195*0957b409SSimon J. Gerraty * The RSA code comes in three variants, called "i15", "i31" and
196*0957b409SSimon J. Gerraty * "i32". The "i31" code is somewhat faster than the "i32" code.
197*0957b409SSimon J. Gerraty * Usually, "i31" is faster than "i15", except on some specific
198*0957b409SSimon J. Gerraty * architectures (ARM Cortex M0, M0+, M1 and M3) where the "i15"
199*0957b409SSimon J. Gerraty * should be preferred (the "i15" code is constant-time, while
200*0957b409SSimon J. Gerraty * the "i31" is not, and the "i15" code is faster anyway).
201*0957b409SSimon J. Gerraty *
202*0957b409SSimon J. Gerraty * ECDSA code also comes in "i15" and "i31" variants. As in the
203*0957b409SSimon J. Gerraty * case of RSA, the "i31" code is faster, except on the small
204*0957b409SSimon J. Gerraty * ARM Cortex M, where the "i15" code is faster and safer.
205*0957b409SSimon J. Gerraty *
206*0957b409SSimon J. Gerraty * There are no less than 10 elliptic curve implementations:
207*0957b409SSimon J. Gerraty *
208*0957b409SSimon J. Gerraty * - ec_c25519_i15, ec_c25519_i31, ec_c25519_m15 and ec_c25519_m31
209*0957b409SSimon J. Gerraty * implement Curve25519.
210*0957b409SSimon J. Gerraty *
211*0957b409SSimon J. Gerraty * - ec_p256_m15 and ec_p256_m31 implement NIST curve P-256.
212*0957b409SSimon J. Gerraty *
213*0957b409SSimon J. Gerraty * - ec_prime_i15 and ec_prime_i31 implement NIST curves P-256,
214*0957b409SSimon J. Gerraty * P-384 and P-521.
215*0957b409SSimon J. Gerraty *
216*0957b409SSimon J. Gerraty * - ec_all_m15 is an aggregate implementation that uses
217*0957b409SSimon J. Gerraty * ec_c25519_m15, ec_p256_m15 and ec_prime_i15.
218*0957b409SSimon J. Gerraty *
219*0957b409SSimon J. Gerraty * - ec_all_m31 is an aggregate implementation that uses
220*0957b409SSimon J. Gerraty * ec_c25519_m31, ec_p256_m31 and ec_prime_i31.
221*0957b409SSimon J. Gerraty *
222*0957b409SSimon J. Gerraty * For a given curve, "m15" is faster than "i15" (but possibly
223*0957b409SSimon J. Gerraty * with a larger code footprint) and "m31" is faster than "i31"
224*0957b409SSimon J. Gerraty * (there again with a larger code footprint). For best
225*0957b409SSimon J. Gerraty * performance, use ec_all_m31, except on the small ARM Cortex M
226*0957b409SSimon J. Gerraty * where ec_all_m15 should be used. Referencing the other
227*0957b409SSimon J. Gerraty * implementations directly will result in smaller code, but
228*0957b409SSimon J. Gerraty * support for fewer curves and possibly lower performance.
229*0957b409SSimon J. Gerraty */
230*0957b409SSimon J. Gerraty br_ssl_client_set_default_rsapub(cc);
231*0957b409SSimon J. Gerraty br_ssl_engine_set_default_rsavrfy(&cc->eng);
232*0957b409SSimon J. Gerraty br_ssl_engine_set_default_ecdsa(&cc->eng);
233*0957b409SSimon J. Gerraty /* Alternate: set implementations explicitly.
234*0957b409SSimon J. Gerraty br_ssl_client_set_rsapub(cc, &br_rsa_i31_public);
235*0957b409SSimon J. Gerraty br_ssl_client_set_rsavrfy(cc, &br_rsa_i31_pkcs1_vrfy);
236*0957b409SSimon J. Gerraty br_ssl_engine_set_ec(&cc->eng, &br_ec_all_m31);
237*0957b409SSimon J. Gerraty br_ssl_engine_set_ecdsa(&cc->eng, &br_ecdsa_i31_vrfy_asn1);
238*0957b409SSimon J. Gerraty */
239*0957b409SSimon J. Gerraty
240*0957b409SSimon J. Gerraty /*
241*0957b409SSimon J. Gerraty * Record handler:
242*0957b409SSimon J. Gerraty * -- Cipher suites in AES_128_CBC, AES_256_CBC and 3DES_EDE_CBC
243*0957b409SSimon J. Gerraty * need the CBC record handler ("set_cbc").
244*0957b409SSimon J. Gerraty * -- Cipher suites in AES_128_GCM and AES_256_GCM need the GCM
245*0957b409SSimon J. Gerraty * record handler ("set_gcm").
246*0957b409SSimon J. Gerraty * -- Cipher suites in CHACHA20_POLY1305 need the ChaCha20+Poly1305
247*0957b409SSimon J. Gerraty * record handler ("set_chapol").
248*0957b409SSimon J. Gerraty */
249*0957b409SSimon J. Gerraty br_ssl_engine_set_cbc(&cc->eng,
250*0957b409SSimon J. Gerraty &br_sslrec_in_cbc_vtable,
251*0957b409SSimon J. Gerraty &br_sslrec_out_cbc_vtable);
252*0957b409SSimon J. Gerraty br_ssl_engine_set_gcm(&cc->eng,
253*0957b409SSimon J. Gerraty &br_sslrec_in_gcm_vtable,
254*0957b409SSimon J. Gerraty &br_sslrec_out_gcm_vtable);
255*0957b409SSimon J. Gerraty br_ssl_engine_set_chapol(&cc->eng,
256*0957b409SSimon J. Gerraty &br_sslrec_in_chapol_vtable,
257*0957b409SSimon J. Gerraty &br_sslrec_out_chapol_vtable);
258*0957b409SSimon J. Gerraty
259*0957b409SSimon J. Gerraty /*
260*0957b409SSimon J. Gerraty * Symmetric encryption:
261*0957b409SSimon J. Gerraty * -- AES_128_CBC and AES_256_CBC require an "aes_cbc" implementation
262*0957b409SSimon J. Gerraty * (actually two implementations, for encryption and decryption).
263*0957b409SSimon J. Gerraty * -- 3DES_EDE_CBC requires a "des_cbc" implementation
264*0957b409SSimon J. Gerraty * (actually two implementations, for encryption and decryption).
265*0957b409SSimon J. Gerraty * -- AES_128_GCM and AES_256_GCM require an "aes_ctr" imeplementation
266*0957b409SSimon J. Gerraty * and also a GHASH implementation.
267*0957b409SSimon J. Gerraty *
268*0957b409SSimon J. Gerraty * Two 3DES implementations are provided:
269*0957b409SSimon J. Gerraty *
270*0957b409SSimon J. Gerraty * des_tab Classical table-based implementation; it is
271*0957b409SSimon J. Gerraty * not constant-time.
272*0957b409SSimon J. Gerraty *
273*0957b409SSimon J. Gerraty * dest_ct Constant-time DES/3DES implementation. It is
274*0957b409SSimon J. Gerraty * slower than des_tab.
275*0957b409SSimon J. Gerraty *
276*0957b409SSimon J. Gerraty * Four AES implementations are provided:
277*0957b409SSimon J. Gerraty *
278*0957b409SSimon J. Gerraty * aes_ct Constant-time AES implementation, for 32-bit
279*0957b409SSimon J. Gerraty * systems.
280*0957b409SSimon J. Gerraty *
281*0957b409SSimon J. Gerraty * aes_ct64 Constant-time AES implementation, for 64-bit
282*0957b409SSimon J. Gerraty * systems. It actually also runs on 32-bit systems,
283*0957b409SSimon J. Gerraty * but, on such systems, it yields larger code and
284*0957b409SSimon J. Gerraty * slightly worse performance. On 64-bit systems,
285*0957b409SSimon J. Gerraty * aes_ct64 is about twice faster than aes_ct for
286*0957b409SSimon J. Gerraty * CTR processing (GCM encryption and decryption),
287*0957b409SSimon J. Gerraty * and for CBC (decryption only).
288*0957b409SSimon J. Gerraty *
289*0957b409SSimon J. Gerraty * aes_small Smallest implementation provided, but also the
290*0957b409SSimon J. Gerraty * slowest, and it is not constant-time. Use it
291*0957b409SSimon J. Gerraty * only if desperate for code size.
292*0957b409SSimon J. Gerraty *
293*0957b409SSimon J. Gerraty * aes_big Classical table-based AES implementation. This
294*0957b409SSimon J. Gerraty * is decently fast and still resonably compact,
295*0957b409SSimon J. Gerraty * but it is not constant-time.
296*0957b409SSimon J. Gerraty *
297*0957b409SSimon J. Gerraty * aes_x86ni Very fast implementation that uses the AES-NI
298*0957b409SSimon J. Gerraty * opcodes on recent x86 CPU. But it may not be
299*0957b409SSimon J. Gerraty * compiled in the library if the compiler or
300*0957b409SSimon J. Gerraty * architecture is not supported; and the CPU
301*0957b409SSimon J. Gerraty * may also not support the opcodes. Selection
302*0957b409SSimon J. Gerraty * functions are provided to test for availability
303*0957b409SSimon J. Gerraty * of the code and the opcodes.
304*0957b409SSimon J. Gerraty *
305*0957b409SSimon J. Gerraty * Whether having constant-time implementations is absolutely
306*0957b409SSimon J. Gerraty * required for security depends on the context (in particular
307*0957b409SSimon J. Gerraty * whether the target architecture actually has cache memory),
308*0957b409SSimon J. Gerraty * and while side-channel analysis for non-constant-time AES
309*0957b409SSimon J. Gerraty * code has been demonstrated in lab conditions, it certainly
310*0957b409SSimon J. Gerraty * does not apply to all actual usages, and it has never been
311*0957b409SSimon J. Gerraty * spotted in the wild. It is still considered cautious to use
312*0957b409SSimon J. Gerraty * constant-time code by default, and to consider the other
313*0957b409SSimon J. Gerraty * implementations only if duly measured performance issues make
314*0957b409SSimon J. Gerraty * it mandatory.
315*0957b409SSimon J. Gerraty */
316*0957b409SSimon J. Gerraty br_ssl_engine_set_aes_cbc(&cc->eng,
317*0957b409SSimon J. Gerraty &br_aes_ct_cbcenc_vtable,
318*0957b409SSimon J. Gerraty &br_aes_ct_cbcdec_vtable);
319*0957b409SSimon J. Gerraty br_ssl_engine_set_aes_ctr(&cc->eng,
320*0957b409SSimon J. Gerraty &br_aes_ct_ctr_vtable);
321*0957b409SSimon J. Gerraty /* Alternate: aes_ct64
322*0957b409SSimon J. Gerraty br_ssl_engine_set_aes_cbc(&cc->eng,
323*0957b409SSimon J. Gerraty &br_aes_ct64_cbcenc_vtable,
324*0957b409SSimon J. Gerraty &br_aes_ct64_cbcdec_vtable);
325*0957b409SSimon J. Gerraty br_ssl_engine_set_aes_ctr(&cc->eng,
326*0957b409SSimon J. Gerraty &br_aes_ct64_ctr_vtable);
327*0957b409SSimon J. Gerraty */
328*0957b409SSimon J. Gerraty /* Alternate: aes_small
329*0957b409SSimon J. Gerraty br_ssl_engine_set_aes_cbc(&cc->eng,
330*0957b409SSimon J. Gerraty &br_aes_small_cbcenc_vtable,
331*0957b409SSimon J. Gerraty &br_aes_small_cbcdec_vtable);
332*0957b409SSimon J. Gerraty br_ssl_engine_set_aes_ctr(&cc->eng,
333*0957b409SSimon J. Gerraty &br_aes_small_ctr_vtable);
334*0957b409SSimon J. Gerraty */
335*0957b409SSimon J. Gerraty /* Alternate: aes_big
336*0957b409SSimon J. Gerraty br_ssl_engine_set_aes_cbc(&cc->eng,
337*0957b409SSimon J. Gerraty &br_aes_big_cbcenc_vtable,
338*0957b409SSimon J. Gerraty &br_aes_big_cbcdec_vtable);
339*0957b409SSimon J. Gerraty br_ssl_engine_set_aes_ctr(&cc->eng,
340*0957b409SSimon J. Gerraty &br_aes_big_ctr_vtable);
341*0957b409SSimon J. Gerraty */
342*0957b409SSimon J. Gerraty br_ssl_engine_set_des_cbc(&cc->eng,
343*0957b409SSimon J. Gerraty &br_des_ct_cbcenc_vtable,
344*0957b409SSimon J. Gerraty &br_des_ct_cbcdec_vtable);
345*0957b409SSimon J. Gerraty /* Alternate: des_tab
346*0957b409SSimon J. Gerraty br_ssl_engine_set_des_cbc(&cc->eng,
347*0957b409SSimon J. Gerraty &br_des_tab_cbcenc_vtable,
348*0957b409SSimon J. Gerraty &br_des_tab_cbcdec_vtable);
349*0957b409SSimon J. Gerraty */
350*0957b409SSimon J. Gerraty
351*0957b409SSimon J. Gerraty /*
352*0957b409SSimon J. Gerraty * GHASH is needed for AES_128_GCM and AES_256_GCM. Three
353*0957b409SSimon J. Gerraty * implementations are provided:
354*0957b409SSimon J. Gerraty *
355*0957b409SSimon J. Gerraty * ctmul Uses 32-bit multiplications with a 64-bit result.
356*0957b409SSimon J. Gerraty *
357*0957b409SSimon J. Gerraty * ctmul32 Uses 32-bit multiplications with a 32-bit result.
358*0957b409SSimon J. Gerraty *
359*0957b409SSimon J. Gerraty * ctmul64 Uses 64-bit multiplications with a 64-bit result.
360*0957b409SSimon J. Gerraty *
361*0957b409SSimon J. Gerraty * On 64-bit platforms, ctmul64 is the smallest and fastest of
362*0957b409SSimon J. Gerraty * the three. On 32-bit systems, ctmul should be preferred. The
363*0957b409SSimon J. Gerraty * ctmul32 implementation is meant to be used for the specific
364*0957b409SSimon J. Gerraty * 32-bit systems that do not have a 32x32->64 multiplier (i.e.
365*0957b409SSimon J. Gerraty * the ARM Cortex-M0 and Cortex-M0+).
366*0957b409SSimon J. Gerraty *
367*0957b409SSimon J. Gerraty * These implementations are all constant-time as long as the
368*0957b409SSimon J. Gerraty * underlying multiplication opcode is constant-time (which is
369*0957b409SSimon J. Gerraty * true for all modern systems, but not for older architectures
370*0957b409SSimon J. Gerraty * such that ARM9 or 80486).
371*0957b409SSimon J. Gerraty */
372*0957b409SSimon J. Gerraty br_ssl_engine_set_ghash(&cc->eng,
373*0957b409SSimon J. Gerraty &br_ghash_ctmul);
374*0957b409SSimon J. Gerraty /* Alternate: ghash_ctmul32
375*0957b409SSimon J. Gerraty br_ssl_engine_set_ghash(&cc->eng,
376*0957b409SSimon J. Gerraty &br_ghash_ctmul32);
377*0957b409SSimon J. Gerraty */
378*0957b409SSimon J. Gerraty /* Alternate: ghash_ctmul64
379*0957b409SSimon J. Gerraty br_ssl_engine_set_ghash(&cc->eng,
380*0957b409SSimon J. Gerraty &br_ghash_ctmul64);
381*0957b409SSimon J. Gerraty */
382*0957b409SSimon J. Gerraty
383*0957b409SSimon J. Gerraty #if 0
384*0957b409SSimon J. Gerraty /*
385*0957b409SSimon J. Gerraty * For a client, the normal case is to validate the server
386*0957b409SSimon J. Gerraty * certificate with regards to a set of trust anchors. This
387*0957b409SSimon J. Gerraty * entails using a br_x509_minimal_context structure, configured
388*0957b409SSimon J. Gerraty * with the relevant algorithms, as shown below.
389*0957b409SSimon J. Gerraty *
390*0957b409SSimon J. Gerraty * Alternatively, the client could "know" the intended server
391*0957b409SSimon J. Gerraty * public key through an out-of-band mechanism, in which case
392*0957b409SSimon J. Gerraty * a br_x509_knownkey_context is appropriate, for a much reduced
393*0957b409SSimon J. Gerraty * code footprint.
394*0957b409SSimon J. Gerraty *
395*0957b409SSimon J. Gerraty * We assume here that the following extra parameters have been
396*0957b409SSimon J. Gerraty * provided:
397*0957b409SSimon J. Gerraty *
398*0957b409SSimon J. Gerraty * xc engine context (br_x509_minimal_context *)
399*0957b409SSimon J. Gerraty * trust_anchors trust anchors (br_x509_trust_anchor *)
400*0957b409SSimon J. Gerraty * trust_anchors_num number of trust anchors (size_t)
401*0957b409SSimon J. Gerraty */
402*0957b409SSimon J. Gerraty
403*0957b409SSimon J. Gerraty /*
404*0957b409SSimon J. Gerraty * The X.509 engine needs a hash function for processing the
405*0957b409SSimon J. Gerraty * subject and issuer DN of certificates and trust anchors. Any
406*0957b409SSimon J. Gerraty * supported hash function is appropriate; here we use SHA-256.
407*0957b409SSimon J. Gerraty * The trust an
408*0957b409SSimon J. Gerraty */
409*0957b409SSimon J. Gerraty br_x509_minimal_init(xc, &br_sha256_vtable,
410*0957b409SSimon J. Gerraty trust_anchors, trust_anchors_num);
411*0957b409SSimon J. Gerraty
412*0957b409SSimon J. Gerraty /*
413*0957b409SSimon J. Gerraty * Set suites and asymmetric crypto implementations. We use the
414*0957b409SSimon J. Gerraty * "i31" code for RSA (it is somewhat faster than the "i32"
415*0957b409SSimon J. Gerraty * implementation). These implementations are used for
416*0957b409SSimon J. Gerraty * signature verification on certificates, but not for the
417*0957b409SSimon J. Gerraty * SSL-specific usage of the server's public key. For instance,
418*0957b409SSimon J. Gerraty * if the server has an EC public key but the rest of the chain
419*0957b409SSimon J. Gerraty * (intermediate CA, root...) use RSA, then you would need only
420*0957b409SSimon J. Gerraty * the RSA verification function below.
421*0957b409SSimon J. Gerraty */
422*0957b409SSimon J. Gerraty br_x509_minimal_set_rsa(xc, &br_rsa_i31_pkcs1_vrfy);
423*0957b409SSimon J. Gerraty br_x509_minimal_set_ecdsa(xc,
424*0957b409SSimon J. Gerraty &br_ec_prime_i31, &br_ecdsa_i31_vrfy_asn1);
425*0957b409SSimon J. Gerraty
426*0957b409SSimon J. Gerraty /*
427*0957b409SSimon J. Gerraty * Set supported hash functions. These are for signatures on
428*0957b409SSimon J. Gerraty * certificates. There again, you only need the hash functions
429*0957b409SSimon J. Gerraty * that are actually used in certificates, but if a given
430*0957b409SSimon J. Gerraty * function was included for the SSL engine, you may as well
431*0957b409SSimon J. Gerraty * add it here.
432*0957b409SSimon J. Gerraty *
433*0957b409SSimon J. Gerraty * Note: the engine explicitly rejects signatures that use MD5.
434*0957b409SSimon J. Gerraty * Thus, there is no need for MD5 here.
435*0957b409SSimon J. Gerraty */
436*0957b409SSimon J. Gerraty br_ssl_engine_set_hash(xc, br_sha1_ID, &br_sha1_vtable);
437*0957b409SSimon J. Gerraty br_ssl_engine_set_hash(xc, br_sha224_ID, &br_sha224_vtable);
438*0957b409SSimon J. Gerraty br_ssl_engine_set_hash(xc, br_sha256_ID, &br_sha256_vtable);
439*0957b409SSimon J. Gerraty br_ssl_engine_set_hash(xc, br_sha384_ID, &br_sha384_vtable);
440*0957b409SSimon J. Gerraty br_ssl_engine_set_hash(xc, br_sha512_ID, &br_sha512_vtable);
441*0957b409SSimon J. Gerraty
442*0957b409SSimon J. Gerraty /*
443*0957b409SSimon J. Gerraty * Link the X.509 engine in the SSL engine.
444*0957b409SSimon J. Gerraty */
445*0957b409SSimon J. Gerraty br_ssl_engine_set_x509(&cc->eng, &xc->vtable);
446*0957b409SSimon J. Gerraty #endif
447*0957b409SSimon J. Gerraty }
448*0957b409SSimon J. Gerraty
449*0957b409SSimon J. Gerraty /*
450*0957b409SSimon J. Gerraty * Example server profile. Most of it is shared with the client
451*0957b409SSimon J. Gerraty * profile, so see the comments in the client function for details.
452*0957b409SSimon J. Gerraty *
453*0957b409SSimon J. Gerraty * This example function assumes a server with a (unique) RSA private
454*0957b409SSimon J. Gerraty * key, so the list of cipher suites is trimmed down for RSA.
455*0957b409SSimon J. Gerraty */
456*0957b409SSimon J. Gerraty void
example_server_profile(br_ssl_server_context * cc,const br_x509_certificate * chain,size_t chain_len,const br_rsa_private_key * sk)457*0957b409SSimon J. Gerraty example_server_profile(br_ssl_server_context *cc,
458*0957b409SSimon J. Gerraty const br_x509_certificate *chain, size_t chain_len,
459*0957b409SSimon J. Gerraty const br_rsa_private_key *sk)
460*0957b409SSimon J. Gerraty {
461*0957b409SSimon J. Gerraty static const uint16_t suites[] = {
462*0957b409SSimon J. Gerraty BR_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
463*0957b409SSimon J. Gerraty BR_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
464*0957b409SSimon J. Gerraty BR_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
465*0957b409SSimon J. Gerraty BR_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
466*0957b409SSimon J. Gerraty BR_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
467*0957b409SSimon J. Gerraty BR_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
468*0957b409SSimon J. Gerraty BR_TLS_RSA_WITH_AES_128_GCM_SHA256,
469*0957b409SSimon J. Gerraty BR_TLS_RSA_WITH_AES_256_GCM_SHA384,
470*0957b409SSimon J. Gerraty BR_TLS_RSA_WITH_AES_128_CBC_SHA256,
471*0957b409SSimon J. Gerraty BR_TLS_RSA_WITH_AES_256_CBC_SHA256,
472*0957b409SSimon J. Gerraty BR_TLS_RSA_WITH_AES_128_CBC_SHA,
473*0957b409SSimon J. Gerraty BR_TLS_RSA_WITH_AES_256_CBC_SHA,
474*0957b409SSimon J. Gerraty BR_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
475*0957b409SSimon J. Gerraty BR_TLS_RSA_WITH_3DES_EDE_CBC_SHA
476*0957b409SSimon J. Gerraty };
477*0957b409SSimon J. Gerraty
478*0957b409SSimon J. Gerraty br_ssl_server_zero(cc);
479*0957b409SSimon J. Gerraty br_ssl_engine_set_versions(&cc->eng, BR_TLS10, BR_TLS12);
480*0957b409SSimon J. Gerraty
481*0957b409SSimon J. Gerraty br_ssl_engine_set_prf10(&cc->eng, &br_tls10_prf);
482*0957b409SSimon J. Gerraty br_ssl_engine_set_prf_sha256(&cc->eng, &br_tls12_sha256_prf);
483*0957b409SSimon J. Gerraty br_ssl_engine_set_prf_sha384(&cc->eng, &br_tls12_sha384_prf);
484*0957b409SSimon J. Gerraty
485*0957b409SSimon J. Gerraty /*
486*0957b409SSimon J. Gerraty * Apart from the requirements listed in the client side, these
487*0957b409SSimon J. Gerraty * hash functions are also used by the server to compute its
488*0957b409SSimon J. Gerraty * signature on ECDHE parameters. Which functions are needed
489*0957b409SSimon J. Gerraty * depends on what the client may support; furthermore, the
490*0957b409SSimon J. Gerraty * client may fail to send the relevant extension, in which
491*0957b409SSimon J. Gerraty * case the server will default to whatever it can (as per the
492*0957b409SSimon J. Gerraty * standard, it should be SHA-1 in that case).
493*0957b409SSimon J. Gerraty */
494*0957b409SSimon J. Gerraty br_ssl_engine_set_hash(&cc->eng, br_md5_ID, &br_md5_vtable);
495*0957b409SSimon J. Gerraty br_ssl_engine_set_hash(&cc->eng, br_sha1_ID, &br_sha1_vtable);
496*0957b409SSimon J. Gerraty br_ssl_engine_set_hash(&cc->eng, br_sha224_ID, &br_sha224_vtable);
497*0957b409SSimon J. Gerraty br_ssl_engine_set_hash(&cc->eng, br_sha256_ID, &br_sha256_vtable);
498*0957b409SSimon J. Gerraty br_ssl_engine_set_hash(&cc->eng, br_sha384_ID, &br_sha384_vtable);
499*0957b409SSimon J. Gerraty br_ssl_engine_set_hash(&cc->eng, br_sha512_ID, &br_sha512_vtable);
500*0957b409SSimon J. Gerraty
501*0957b409SSimon J. Gerraty br_ssl_engine_set_suites(&cc->eng, suites,
502*0957b409SSimon J. Gerraty (sizeof suites) / (sizeof suites[0]));
503*0957b409SSimon J. Gerraty
504*0957b409SSimon J. Gerraty /*
505*0957b409SSimon J. Gerraty * Elliptic curve implementation is used for ECDHE suites (but
506*0957b409SSimon J. Gerraty * not for ECDH).
507*0957b409SSimon J. Gerraty */
508*0957b409SSimon J. Gerraty br_ssl_engine_set_ec(&cc->eng, &br_ec_prime_i31);
509*0957b409SSimon J. Gerraty
510*0957b409SSimon J. Gerraty /*
511*0957b409SSimon J. Gerraty * Set the "server policy": handler for the certificate chain
512*0957b409SSimon J. Gerraty * and private key operations. Here, we indicate that the RSA
513*0957b409SSimon J. Gerraty * private key is fit for both signing and decrypting, and we
514*0957b409SSimon J. Gerraty * provide the two relevant implementations.
515*0957b409SSimon J. Gerraty
516*0957b409SSimon J. Gerraty * BR_KEYTYPE_KEYX allows TLS_RSA_*, BR_KEYTYPE_SIGN allows
517*0957b409SSimon J. Gerraty * TLS_ECDHE_RSA_*.
518*0957b409SSimon J. Gerraty */
519*0957b409SSimon J. Gerraty br_ssl_server_set_single_rsa(cc, chain, chain_len, sk,
520*0957b409SSimon J. Gerraty BR_KEYTYPE_KEYX | BR_KEYTYPE_SIGN,
521*0957b409SSimon J. Gerraty br_rsa_i31_private, br_rsa_i31_pkcs1_sign);
522*0957b409SSimon J. Gerraty /*
523*0957b409SSimon J. Gerraty * If the server used an EC private key, this call would look
524*0957b409SSimon J. Gerraty * like this:
525*0957b409SSimon J. Gerraty
526*0957b409SSimon J. Gerraty br_ssl_server_set_single_ec(cc, chain, chain_len, sk,
527*0957b409SSimon J. Gerraty BR_KEYTYPE_KEYX | BR_KEYTYPE_SIGN,
528*0957b409SSimon J. Gerraty cert_issuer_key_type,
529*0957b409SSimon J. Gerraty &br_ec_prime_i31, br_ecdsa_i31_sign_asn1);
530*0957b409SSimon J. Gerraty
531*0957b409SSimon J. Gerraty * Note the tricky points:
532*0957b409SSimon J. Gerraty *
533*0957b409SSimon J. Gerraty * -- "ECDH" cipher suites use only the EC code (&br_ec_prime_i31);
534*0957b409SSimon J. Gerraty * the ECDHE_ECDSA cipher suites need both the EC code and
535*0957b409SSimon J. Gerraty * the ECDSA signature implementation.
536*0957b409SSimon J. Gerraty *
537*0957b409SSimon J. Gerraty * -- For "ECDH" (not "ECDHE") cipher suites, the engine must
538*0957b409SSimon J. Gerraty * know the key type (RSA or EC) for the intermediate CA that
539*0957b409SSimon J. Gerraty * issued the server's certificate; this is an artefact of
540*0957b409SSimon J. Gerraty * how the protocol is defined. BearSSL won't try to decode
541*0957b409SSimon J. Gerraty * the server's certificate to obtain that information (it
542*0957b409SSimon J. Gerraty * could do that, the code is there, but it would increase the
543*0957b409SSimon J. Gerraty * footprint). So this must be provided by the caller.
544*0957b409SSimon J. Gerraty *
545*0957b409SSimon J. Gerraty * -- BR_KEYTYPE_KEYX allows ECDH, BR_KEYTYPE_SIGN allows
546*0957b409SSimon J. Gerraty * ECDHE_ECDSA.
547*0957b409SSimon J. Gerraty */
548*0957b409SSimon J. Gerraty
549*0957b409SSimon J. Gerraty br_ssl_engine_set_cbc(&cc->eng,
550*0957b409SSimon J. Gerraty &br_sslrec_in_cbc_vtable,
551*0957b409SSimon J. Gerraty &br_sslrec_out_cbc_vtable);
552*0957b409SSimon J. Gerraty br_ssl_engine_set_gcm(&cc->eng,
553*0957b409SSimon J. Gerraty &br_sslrec_in_gcm_vtable,
554*0957b409SSimon J. Gerraty &br_sslrec_out_gcm_vtable);
555*0957b409SSimon J. Gerraty
556*0957b409SSimon J. Gerraty br_ssl_engine_set_aes_cbc(&cc->eng,
557*0957b409SSimon J. Gerraty &br_aes_ct_cbcenc_vtable,
558*0957b409SSimon J. Gerraty &br_aes_ct_cbcdec_vtable);
559*0957b409SSimon J. Gerraty br_ssl_engine_set_aes_ctr(&cc->eng,
560*0957b409SSimon J. Gerraty &br_aes_ct_ctr_vtable);
561*0957b409SSimon J. Gerraty /* Alternate: aes_ct64
562*0957b409SSimon J. Gerraty br_ssl_engine_set_aes_cbc(&cc->eng,
563*0957b409SSimon J. Gerraty &br_aes_ct64_cbcenc_vtable,
564*0957b409SSimon J. Gerraty &br_aes_ct64_cbcdec_vtable);
565*0957b409SSimon J. Gerraty br_ssl_engine_set_aes_ctr(&cc->eng,
566*0957b409SSimon J. Gerraty &br_aes_ct64_ctr_vtable);
567*0957b409SSimon J. Gerraty */
568*0957b409SSimon J. Gerraty /* Alternate: aes_small
569*0957b409SSimon J. Gerraty br_ssl_engine_set_aes_cbc(&cc->eng,
570*0957b409SSimon J. Gerraty &br_aes_small_cbcenc_vtable,
571*0957b409SSimon J. Gerraty &br_aes_small_cbcdec_vtable);
572*0957b409SSimon J. Gerraty br_ssl_engine_set_aes_ctr(&cc->eng,
573*0957b409SSimon J. Gerraty &br_aes_small_ctr_vtable);
574*0957b409SSimon J. Gerraty */
575*0957b409SSimon J. Gerraty /* Alternate: aes_big
576*0957b409SSimon J. Gerraty br_ssl_engine_set_aes_cbc(&cc->eng,
577*0957b409SSimon J. Gerraty &br_aes_big_cbcenc_vtable,
578*0957b409SSimon J. Gerraty &br_aes_big_cbcdec_vtable);
579*0957b409SSimon J. Gerraty br_ssl_engine_set_aes_ctr(&cc->eng,
580*0957b409SSimon J. Gerraty &br_aes_big_ctr_vtable);
581*0957b409SSimon J. Gerraty */
582*0957b409SSimon J. Gerraty br_ssl_engine_set_des_cbc(&cc->eng,
583*0957b409SSimon J. Gerraty &br_des_ct_cbcenc_vtable,
584*0957b409SSimon J. Gerraty &br_des_ct_cbcdec_vtable);
585*0957b409SSimon J. Gerraty /* Alternate: des_tab
586*0957b409SSimon J. Gerraty br_ssl_engine_set_des_cbc(&cc->eng,
587*0957b409SSimon J. Gerraty &br_des_tab_cbcenc_vtable,
588*0957b409SSimon J. Gerraty &br_des_tab_cbcdec_vtable);
589*0957b409SSimon J. Gerraty */
590*0957b409SSimon J. Gerraty
591*0957b409SSimon J. Gerraty br_ssl_engine_set_ghash(&cc->eng,
592*0957b409SSimon J. Gerraty &br_ghash_ctmul);
593*0957b409SSimon J. Gerraty /* Alternate: ghash_ctmul32
594*0957b409SSimon J. Gerraty br_ssl_engine_set_ghash(&cc->eng,
595*0957b409SSimon J. Gerraty &br_ghash_ctmul32);
596*0957b409SSimon J. Gerraty */
597*0957b409SSimon J. Gerraty /* Alternate: ghash_ctmul64
598*0957b409SSimon J. Gerraty br_ssl_engine_set_ghash(&cc->eng,
599*0957b409SSimon J. Gerraty &br_ghash_ctmul64);
600*0957b409SSimon J. Gerraty */
601*0957b409SSimon J. Gerraty }
602