sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2026-06-29 00:07:28 +03:00
Code Issues Packages Projects Releases Wiki Activity

[crypto] Add TLS named groups for FFDHE key exchange algorithms

Browse Source 
Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2026-06-17 15:11:43 +01:00
parent daee5deba8
commit 241c36a6a2
9 changed files with 255 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/config/config_crypto.c
+30
View File
@@ -99,6 +99,36 @@ REQUIRE_OBJECT ( oid_p256 );
REQUIRE_OBJECT ( oid_p384 );
#endif
/* FFDHE2048 */
#if defined ( CRYPTO_GROUP_FFDHE2048 )
REQUIRE_OBJECT ( kex_ffdhe2048 );
#endif
/* FFDHE3072 */
#if defined ( CRYPTO_GROUP_FFDHE3072 )
REQUIRE_OBJECT ( kex_ffdhe3072 );
#endif
/* FFDHE4096 */
#if defined ( CRYPTO_GROUP_FFDHE4096 )
REQUIRE_OBJECT ( kex_ffdhe4096 );
#endif
/* MODP2048 */
#if defined ( CRYPTO_GROUP_MODP2048 )
REQUIRE_OBJECT ( kex_modp2048 );
#endif
/* MODP3072 */
#if defined ( CRYPTO_GROUP_MODP3072 )
REQUIRE_OBJECT ( kex_modp3072 );
#endif
/* MODP4096 */
#if defined ( CRYPTO_GROUP_MODP4096 )
REQUIRE_OBJECT ( kex_modp4096 );
#endif
/* AES-CBC */
#if defined ( CRYPTO_CIPHER_AES_CBC )
REQUIRE_OBJECT ( oid_aes_cbc );
src/config/crypto.h
+18
View File
@@ -70,6 +70,24 @@ FILE_SECBOOT ( PERMITTED );
/** P-384 elliptic curve */
#define CRYPTO_CURVE_P384
/** FFDHE2048 finite field */
#define CRYPTO_GROUP_FFDHE2048
/** FFDHE3072 finite field */
#define CRYPTO_GROUP_FFDHE3072
/** FFDHE4096 finite field */
#define CRYPTO_GROUP_FFDHE4096
/** MODP2048 finite field */
#define CRYPTO_GROUP_MODP2048
/** MODP3072 finite field */
#define CRYPTO_GROUP_MODP3072
/** MODP4096 finite field */
#define CRYPTO_GROUP_MODP4096
/** Margin of error (in seconds) allowed in signed timestamps
*
* We default to allowing a reasonable margin of error: 12 hours to
src/crypto/mishmash/kex_ffdhe2048.c
+35
View File
@@ -0,0 +1,35 @@
/*
* Copyright (C) 2026 Michael Brown <mbrown@fensystems.co.uk>.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as
* published by the Free Software Foundation; either version 2 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*
* You can also choose to distribute this program under the terms of
* the Unmodified Binary Distribution Licence (as given in the file
* COPYING.UBDL), provided that you have satisfied its requirements.
*/
FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
FILE_SECBOOT ( PERMITTED );
#include <byteswap.h>
#include <ipxe/ffdhe.h>
#include <ipxe/tls.h>
/** FFDHE2048 named group */
struct tls_named_group tls_ffdhe2048_named_group __tls_named_group ( 03 ) = {
.exchange = &ffdhe2048_algorithm,
.code = htons ( TLS_NAMED_GROUP_FFDHE2048 ),
};
src/crypto/mishmash/kex_ffdhe3072.c
+35
View File
@@ -0,0 +1,35 @@
/*
* Copyright (C) 2026 Michael Brown <mbrown@fensystems.co.uk>.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as
* published by the Free Software Foundation; either version 2 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*
* You can also choose to distribute this program under the terms of
* the Unmodified Binary Distribution Licence (as given in the file
* COPYING.UBDL), provided that you have satisfied its requirements.
*/
FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
FILE_SECBOOT ( PERMITTED );
#include <byteswap.h>
#include <ipxe/ffdhe.h>
#include <ipxe/tls.h>
/** FFDHE3072 named group */
struct tls_named_group tls_ffdhe3072_named_group __tls_named_group ( 03 ) = {
.exchange = &ffdhe3072_algorithm,
.code = htons ( TLS_NAMED_GROUP_FFDHE3072 ),
};
src/crypto/mishmash/kex_ffdhe4096.c
+35
View File
@@ -0,0 +1,35 @@
/*
* Copyright (C) 2026 Michael Brown <mbrown@fensystems.co.uk>.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as
* published by the Free Software Foundation; either version 2 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*
* You can also choose to distribute this program under the terms of
* the Unmodified Binary Distribution Licence (as given in the file
* COPYING.UBDL), provided that you have satisfied its requirements.
*/
FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
FILE_SECBOOT ( PERMITTED );
#include <byteswap.h>
#include <ipxe/ffdhe.h>
#include <ipxe/tls.h>
/** FFDHE4096 named group */
struct tls_named_group tls_ffdhe4096_named_group __tls_named_group ( 03 ) = {
.exchange = &ffdhe4096_algorithm,
.code = htons ( TLS_NAMED_GROUP_FFDHE4096 ),
};
src/crypto/mishmash/kex_modp2048.c
+33
View File
@@ -0,0 +1,33 @@
/*
* Copyright (C) 2026 Michael Brown <mbrown@fensystems.co.uk>.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as
* published by the Free Software Foundation; either version 2 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*
* You can also choose to distribute this program under the terms of
* the Unmodified Binary Distribution Licence (as given in the file
* COPYING.UBDL), provided that you have satisfied its requirements.
*/
FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
FILE_SECBOOT ( PERMITTED );
#include <ipxe/ffdhe.h>
#include <ipxe/tls.h>
/** MODP2048 anonymous named group */
struct tls_named_group tls_modp2048_named_group __tls_anon_named_group = {
.exchange = &modp2048_algorithm,
};
src/crypto/mishmash/kex_modp3072.c
+33
View File
@@ -0,0 +1,33 @@
/*
* Copyright (C) 2026 Michael Brown <mbrown@fensystems.co.uk>.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as
* published by the Free Software Foundation; either version 2 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*
* You can also choose to distribute this program under the terms of
* the Unmodified Binary Distribution Licence (as given in the file
* COPYING.UBDL), provided that you have satisfied its requirements.
*/
FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
FILE_SECBOOT ( PERMITTED );
#include <ipxe/ffdhe.h>
#include <ipxe/tls.h>
/** MODP3072 anonymous named group */
struct tls_named_group tls_modp3072_named_group __tls_anon_named_group = {
.exchange = &modp3072_algorithm,
};
src/crypto/mishmash/kex_modp4096.c
+33
View File
@@ -0,0 +1,33 @@
/*
* Copyright (C) 2026 Michael Brown <mbrown@fensystems.co.uk>.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as
* published by the Free Software Foundation; either version 2 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*
* You can also choose to distribute this program under the terms of
* the Unmodified Binary Distribution Licence (as given in the file
* COPYING.UBDL), provided that you have satisfied its requirements.
*/
FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
FILE_SECBOOT ( PERMITTED );
#include <ipxe/ffdhe.h>
#include <ipxe/tls.h>
/** MODP4096 anonymous named group */
struct tls_named_group tls_modp4096_named_group __tls_anon_named_group = {
.exchange = &modp4096_algorithm,
};
src/include/ipxe/tls.h
+3
View File
@@ -146,6 +146,9 @@ struct tls_header {
#define TLS_NAMED_GROUP_SECP256R1 23
#define TLS_NAMED_GROUP_SECP384R1 24
#define TLS_NAMED_GROUP_X25519 29
#define TLS_NAMED_GROUP_FFDHE2048 256
#define TLS_NAMED_GROUP_FFDHE3072 257
#define TLS_NAMED_GROUP_FFDHE4096 258
/* TLS signature algorithms extension */
#define TLS_SIGNATURE_ALGORITHMS 13