From f984402cef930d31182873d3ff6cc6b3cda17f9f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?P=C3=A9ter=20Dimitrov?= Date: Thu, 23 May 2019 16:46:17 +0200 Subject: ssl: Update standards compliance --- lib/ssl/doc/src/standards_compliance.xml | 357 ++++++++++++++++--------------- 1 file changed, 182 insertions(+), 175 deletions(-) (limited to 'lib') diff --git a/lib/ssl/doc/src/standards_compliance.xml b/lib/ssl/doc/src/standards_compliance.xml index ca98385f85..650fcec920 100644 --- a/lib/ssl/doc/src/standards_compliance.xml +++ b/lib/ssl/doc/src/standards_compliance.xml @@ -126,7 +126,7 @@
TLS 1.3 -

OTP-22 introduces basic support for TLS 1.3 on the server side. Basic functionality +

OTP-22 introduces basic support for TLS 1.3. Basic functionality covers a simple TLS 1.3 handshake with support of the mandatory extensions (supported_groups, signature_algorithms, key_share, supported_versions and signature_algorithms_cert). The server supports a selective set of cryptographic algorithms:

@@ -147,8 +147,6 @@

For more detailed information see the Standards Compliance below.

-

Note that the client side is not yet functional. It is planned to be released - later in OTP-22.

The following table describes the current state of standards compliance for TLS 1.3.

(C = Compliant, NC = Non-Compliant, PC = Partially-Compliant, @@ -176,25 +174,25 @@ Version downgrade protection mechanism C - 22 + 22 RSASSA-PSS signature schemes PC - 22 + 22 supported_versions (ClientHello) extension C - 22 + 22 signature_algorithms_cert extension C - 22 + 22 @@ -211,7 +209,7 @@ (EC)DHE C - 22 + 22 @@ -295,8 +293,8 @@ Client - NC - + PC + 22.1 @@ -319,14 +317,14 @@ supported_groups (RFC7919) - NC - + C + 22.1 signature_algorithms (RFC8446) - NC - + C + 22.1 @@ -373,8 +371,8 @@ key_share (RFC8446) - NC - + C + 22.1 @@ -403,8 +401,8 @@ supported_versions (RFC8446) - NC - + C + 22.1 @@ -427,8 +425,8 @@ signature_algorithms_cert (RFC8446) - NC - + C + 22.1 @@ -459,13 +457,13 @@ supported_groups (RFC7919) C - 22 + 22 signature_algorithms (RFC8446) C - 22 + 22 @@ -513,7 +511,7 @@ key_share (RFC8446) C - 22 + 22 @@ -543,7 +541,7 @@ supported_versions (RFC8446) C - 22 + 22 @@ -567,7 +565,7 @@ signature_algorithms_cert (RFC8446) C - 22 + 22 @@ -577,20 +575,20 @@ Client - NC - + PC + 22.1 Version downgrade protection - NC - + C + 22.1 key_share (RFC8446) - NC - + C + 22.1 @@ -601,8 +599,8 @@ supported_versions (RFC8446) - NC - + C + 22.1 @@ -615,13 +613,13 @@ Version downgrade protection C - 22 + 22 key_share (RFC8446) C - 22 + 22 @@ -633,7 +631,7 @@ supported_versions (RFC8446) C - 22 + 22 @@ -650,7 +648,7 @@ key_share (RFC8446) C - 22 + 22 @@ -662,7 +660,7 @@ supported_versions (RFC8446) C - 22 + 22 @@ -672,8 +670,8 @@ Client - NC - + C + 22.1 @@ -706,26 +704,26 @@ Client - NC - + PC + 22.1 rsa_pkcs1_sha256 - NC - + C + 22.1 rsa_pkcs1_sha384 - NC - + C + 22.1 rsa_pkcs1_sha512 - NC - + C + 22.1 @@ -748,20 +746,20 @@ rsa_pss_rsae_sha256 - NC - + C + 22.1 rsa_pss_rsae_sha384 - NC - + C + 22.1 rsa_pss_rsae_sha512 - NC - + C + 22.1 @@ -796,14 +794,14 @@ rsa_pkcs1_sha1 - NC - + C + 22.1 ecdsa_sha1 - NC - + C + 22.1 @@ -816,19 +814,19 @@ rsa_pkcs1_sha256 C - 22 + 22 rsa_pkcs1_sha384 C - 22 + 22 rsa_pkcs1_sha512 C - 22 + 22 @@ -852,19 +850,19 @@ rsa_pss_rsae_sha256 C - 22 + 22 rsa_pss_rsae_sha384 C - 22 + 22 rsa_pss_rsae_sha512 C - 22 + 22 @@ -900,13 +898,13 @@ rsa_pkcs1_sha1 C - 22 + 22 ecdsa_sha1 C - 22 + 22 @@ -973,62 +971,62 @@ secp256r1 - NC - + C + 22.1 secp384r1 - NC - + C + 22.1 secp521r1 - NC - + C + 22.1 x25519 - NC - + C + 22.1 x448 - NC - + C + 22.1 ffdhe2048 - NC - + C + 22.1 ffdhe3072 - NC - + C + 22.1 ffdhe4096 - NC - + C + 22.1 ffdhe6144 - NC - + C + 22.1 ffdhe8192 - NC - + C + 22.1 @@ -1105,8 +1103,8 @@ Client - NC - + C + 22.1 @@ -1224,8 +1222,8 @@ Client - NC - + PC + 22.1 @@ -1362,8 +1360,8 @@ Client - NC - + PC + 22.1 @@ -1374,8 +1372,8 @@ signature_algorithms (RFC8446) - NC - + C + 22.1 @@ -1398,8 +1396,8 @@ signature_algorithms_cert (RFC8446) - NC - + C + 22.1 @@ -1417,8 +1415,8 @@ signature_algorithms (RFC8446) - NC - + C + 22 @@ -1441,8 +1439,8 @@ signature_algorithms_cert (RFC8446) - NC - + C + 22 @@ -1463,8 +1461,8 @@ Client - NC - + PC + 22.1 @@ -1521,73 +1519,82 @@ 4.4.2.2. Server Certificate Selection - Client - NC - + + PC + 22 - certificate type MUST be X.509v3 - NC - + The certificate type MUST be X.509v3, unless explicitly + negotiated otherwise + C + 22 - certificate's public key is compatible - NC - + The server's end-entity certificate's public key (and associated + restrictions) MUST be compatible with the selected authentication + algorithm from the client's "signature_algorithms" extension + (currently RSA, ECDSA, or EdDSA). + C + 22 - The certificate MUST allow the key to be used for signing - NC - + The certificate MUST allow the key to be used for signing + with a signature scheme indicated in the client's "signature_algorithms"/"signature_algorithms_cert" + extensions + C + 22 - server_name and certificate_authorities are used + The "server_name" and "certificate_authorities" + extensions are used to guide certificate selection. As servers + MAY require the presence of the "server_name" extension, clients + SHOULD send this extension, when applicable. NC - + - - Server + + + 4.4.2.3. Client Certificate Selection + + + PC - + 22.1 - certificate type MUST be X.509v3 + The certificate type MUST be X.509v3, unless explicitly + negotiated otherwise C - 22 + 22.1 - certificate's public key is compatible - C - 22 + If the "certificate_authorities" extension in the + CertificateRequest message was present, at least one of the + certificates in the certificate chain SHOULD be issued by one of + the listed CAs. + NC + - The certificate MUST allow the key to be used for signing + The certificates MUST be signed using an acceptable signature + algorithm C - 22 + 22.1 - server_name and certificate_authorities are used - NC - - - - - - - 4.4.2.3. Client Certificate Selection - - - + If the CertificateRequest message contained a non-empty + "oid_filters" extension, the end-entity certificate MUST match the + extension OIDs that are recognized by the client NC @@ -1599,8 +1606,8 @@ Client - NC - + C + 22.1 @@ -1616,8 +1623,8 @@ Client - NC - + C + 22.1 @@ -1633,8 +1640,8 @@ Client - NC - + C + 22.1 @@ -1738,25 +1745,25 @@ MUST NOT be interleaved with other record types C - 22 + 22 MUST NOT span key changes C - 22 + 22 MUST NOT send zero-length fragments C - 22 + 22 Alert messages MUST NOT be fragmented C - 22 + 22 @@ -1807,7 +1814,7 @@ The padding sent is automatically verified C - 22 + 22 @@ -1957,19 +1964,19 @@ MUST implement the TLS_AES_128_GCM_SHA256 C - 22 + 22 SHOULD implement the TLS_AES_256_GCM_SHA384 C - 22 + 22 SHOULD implement the TLS_CHACHA20_POLY1305_SHA256 C - 22 + 22 @@ -1982,13 +1989,13 @@ MUST support rsa_pkcs1_sha256 (for certificates) C - 22 + 22 MUST support rsa_pss_rsae_sha256 (for CertificateVerify and certificates) C - 22 + 22 @@ -2007,13 +2014,13 @@ MUST support key exchange with secp256r1 C - 22 + 22 SHOULD support key exchange with X25519 C - 22 + 22 @@ -2030,7 +2037,7 @@ Supported Versions C - 22 + 22 @@ -2042,25 +2049,25 @@ Signature Algorithms C - 22 + 22 Signature Algorithms Certificate C - 22 + 22 Negotiated Groups C - 22 + 22 Key Share C - 22 + 22 @@ -2072,32 +2079,32 @@ MUST send and use these extensions - C + PC 22 "supported_versions" is REQUIRED for ClientHello, ServerHello and HelloRetryRequest - PC - 22 + C + 22.1 "signature_algorithms" is REQUIRED for certificate authentication C - 22 + 22 "supported_groups" is REQUIRED for ClientHello messages using (EC)DHE key exchange C - 22 + 22 "key_share" is REQUIRED for (EC)DHE key exchange C - 22 + 22 @@ -2115,8 +2122,8 @@ TLS 1.3 ClientHello - NC - + PC + 22.1 @@ -2127,8 +2134,8 @@ If containing a "supported_groups" extension, it MUST also contain a "key_share" extension, and vice versa. An empty KeyShare.client_shares vector is permitted. - NC - + C + 22.1 @@ -2193,25 +2200,25 @@ TLS_AES_128_GCM_SHA256 C - 22 + 22 TLS_AES_256_GCM_SHA384 C - 22 + 22 TLS_CHACHA20_POLY1305_SHA256 C - 22 + 22 TLS_AES_128_CCM_SHA256 C - 22 + 22 -- cgit v1.2.3