/
githubmirror
/
nmap
Обзор
Документация
Войти
/
githubmirror
/
nmap
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
master
nselib/tls.lua
2 073 строки
74 KB
dmiller
Offer more ciphers by default in NSE TLS
02 июн 2025, 17:31
02 июн 2025, 17:31
4add494
Код
Авторство
О чём код?
--- -- A library providing functions for doing TLS/SSL communications -- -- These functions will build strings and process buffers. Socket communication -- is left to the script to implement. -- -- @args tls.servername Hostname to use in the Server Name Indication (SNI) -- extension. Overrides the target name given on the -- command line and affects all targets. -- @author Daniel Miller local stdnse = require "stdnse" local string = require "string" local stringaux = require "stringaux" local math = require "math" local os = require "os" local table = require "table" local tableaux = require "tableaux" local rand = require "rand" _ENV = stdnse.module("tls", stdnse.seeall) local pack = string.pack local unpack = string.unpack local tostring = tostring local concat = table.concat local insert = table.insert -- Most of the values in the tables below are from: -- http://www.iana.org/assignments/tls-parameters/ PROTOCOLS = { ["SSLv3"] = 0x0300, ["TLSv1.0"] = 0x0301, ["TLSv1.1"] = 0x0302, ["TLSv1.2"] = 0x0303, ["TLSv1.3"] = 0x0304, } HIGHEST_PROTOCOL = "TLSv1.3" local TLS_PROTOCOL_VERSIONS = tableaux.invert(PROTOCOLS) -- -- TLS Record Types -- TLS_RECORD_HEADER_LENGTH = 5 TLS_CONTENTTYPE_REGISTRY = { ["change_cipher_spec"] = 20, ["alert"] = 21, ["handshake"] = 22, ["application_data"] = 23, ["heartbeat"] = 24, ["tls12_cid"] = 25, ["ACK"] = 26, } local TLS_CONTENTTYPES = tableaux.invert(TLS_CONTENTTYPE_REGISTRY) -- -- TLS Alert Levels -- TLS_ALERT_LEVELS = { ["warning"] = 1, ["fatal"] = 2, } -- -- TLS Alert Record Types -- TLS_ALERT_REGISTRY = { ["close_notify"] = 0, ["unexpected_message"] = 10, ["bad_record_mac"] = 20, ["decryption_failed"] = 21, ["record_overflow"] = 22, ["decompression_failure"] = 30, ["handshake_failure"] = 40, ["no_certificate"] = 41, ["bad_certificate"] = 42, ["unsupported_certificate"] = 43, ["certificate_revoked"] = 44, ["certificate_expired"] = 45, ["certificate_unknown"] = 46, ["illegal_parameter"] = 47, ["unknown_ca"] = 48, ["access_denied"] = 49, ["decode_error"] = 50, ["decrypt_error"] = 51, ["too_many_cids_requested"] = 52, ["export_restriction"] = 60, ["protocol_version"] = 70, ["insufficient_security"] = 71, ["internal_error"] = 80, ["inappropriate_fallback"] = 86, ["user_canceled"] = 90, ["no_renegotiation"] = 100, ["missing_extension"] = 109, ["unsupported_extension"] = 110, ["certificate_unobtainable"] = 111, ["unrecognized_name"] = 112, ["bad_certificate_status_response"] = 113, ["bad_certificate_hash_value"] = 114, ["unknown_psk_identity"] = 115, ["certificate_required"] = 116, ["no_application_protocol"] = 120, } -- -- TLS Handshake Record Types -- TLS_HANDSHAKETYPE_REGISTRY = { ["hello_request"] = 0, ["client_hello"] = 1, ["server_hello"] = 2, ["hello_verify_request"] = 3, ["NewSessionTicket"] = 4, ["end_of_early_data"] = 5, ["hello_retry_request"] = 6, ["encrypted_extensions"] = 8, ["request_connection_id"] = 9, ["new_connection_id"] = 10, ["certificate"] = 11, ["server_key_exchange"] = 12, ["certificate_request"] = 13, ["server_hello_done"] = 14, ["certificate_verify"] = 15, ["client_key_exchange"] = 16, ["client_certificate_request"] = 17, ["finished"] = 20, ["certificate_url"] = 21, ["certificate_status"] = 22, ["supplemental_data"] = 23, ["key_update"] = 24, ["compressed_certificate"] = 25, ["ekt_key"] = 26, ["next_protocol"] = 67, ["message_hash"] = 254, } -- -- Compression Algorithms -- http://www.iana.org/assignments/comp-meth-ids -- COMPRESSORS = { ["NULL"] = 0, ["DEFLATE"] = 1, ["LZS"] = 64 } --- -- TLS Supported Groups -- RFC 4492 section 5.1.1 "Supported Elliptic Curves Extension". ELLIPTIC_CURVES = { sect163k1 = 1, --deprecated sect163r1 = 2, --deprecated sect163r2 = 3, --deprecated sect193r1 = 4, --deprecated sect193r2 = 5, --deprecated sect233k1 = 6, --deprecated sect233r1 = 7, --deprecated sect239k1 = 8, --deprecated sect283k1 = 9, --deprecated sect283r1 = 10, --deprecated sect409k1 = 11, --deprecated sect409r1 = 12, --deprecated sect571k1 = 13, --deprecated sect571r1 = 14, --deprecated secp160k1 = 15, --deprecated secp160r1 = 16, --deprecated secp160r2 = 17, --deprecated secp192k1 = 18, --deprecated secp192r1 = 19, --deprecated secp224k1 = 20, --deprecated secp224r1 = 21, --deprecated secp256k1 = 22, --deprecated secp256r1 = 23, secp384r1 = 24, secp521r1 = 25, brainpoolP256r1 = 26, --RFC7027 brainpoolP384r1 = 27, brainpoolP512r1 = 28, ecdh_x25519 = 29, -- rfc8422 ecdh_x448 = 30, -- rfc8422 brainpoolP256r1tls13 = 31, --RFC8734 brainpoolP384r1tls13 = 32, brainpoolP512r1tls13 = 33, GC256A = 34, -- RFC9189 GC256B = 35, GC256C = 36, GC256D = 37, GC512A = 38, GC512B = 39, GC512C = 40, curveSM2 = 41, -- RFC 8998 ffdhe2048 = 0x0100, --RFC7919 ffdhe3072 = 0x0101, --RFC7919 ffdhe4096 = 0x0102, --RFC7919 ffdhe6144 = 0x0103, --RFC7919 ffdhe8192 = 0x0104, --RFC7919 MLKEM512 = 512, --draft-connolly-tls-mlkem-key-agreement-03 MLKEM768 = 513, --draft-connolly-tls-mlkem-key-agreement-03 MLKEM1024 = 514, --draft-connolly-tls-mlkem-key-agreement-03 SecP256r1MLKEM768 = 4587, --draft-kwiatkowski-tls-ecdhe-mlkem-03 secp256r1 ECDH with ML-KEM-768 X25519MLKEM768 = 4588, --draft-kwiatkowski-tls-ecdhe-mlkem-03 X25519 ECDH with ML-KEM-768 SecP384r1MLKEM1024 = 4589, --draft-kwiatkowski-tls-ecdhe-mlkem-03 secp384r1 ECDH with ML-KEM-1024 arbitrary_explicit_prime_curves = 0xFF01, arbitrary_explicit_char2_curves = 0xFF02, } -- Most likely set, supported by Firefox and Chrome DEFAULT_ELLIPTIC_CURVES = { "secp256r1", "secp384r1", "secp521r1", "ecdh_x25519", "ffdhe2048", -- added for TLSv1.3 "X25519MLKEM768", -- Chrome offers this one } --- -- RFC 4492 section 5.1.2 "Supported Point Formats Extension". EC_POINT_FORMATS = { uncompressed = 0, ansiX962_compressed_prime = 1, ansiX962_compressed_char2 = 2, } --- -- RFC 5246 section 7.4.1.4.1. Signature Algorithms HashAlgorithms = { none = 0, md5 = 1, sha1 = 2, sha224 = 3, sha256 = 4, sha384 = 5, sha512 = 6, intrinsic = 8, } SignatureAlgorithms = { anonymous = 0, rsa = 1, dsa = 2, ecdsa = 3, ed25519 = 7, ed448 = 8, gostr34102012_256 = 64, gostr34102012_512 = 65, } --- -- TLS v1.3 Signature Algorithms SignatureSchemes = { -- RSASSA-PKCS1-v1_5 algorithms rsa_pkcs1_sha256 = 0x0401, rsa_pkcs1_sha384 = 0x0501, rsa_pkcs1_sha512 = 0x0601, -- ECDSA algorithms ecdsa_secp256r1_sha256 = 0x0403, ecdsa_secp384r1_sha384 = 0x0503, ecdsa_secp521r1_sha512 = 0x0603, -- draft-wang-tls-raw-public-key-with-ibc eccsi_sha256 = 0x0704, iso_ibs1 = 0x0705, iso_ibs2 = 0x0706, iso_chinese_ibs = 0x0707, -- RFC8998 sm2sig_sm3 = 0x0708, -- draft-smyshlyaev-tls13-gost-suites gostr34102012_256a = 0x0709, gostr34102012_256b = 0x070A, gostr34102012_256c = 0x070B, gostr34102012_256d = 0x070C, gostr34102012_512a = 0x070D, gostr34102012_512b = 0x070E, gostr34102012_512c = 0x070F, -- RSASSA-PSS algorithms with public key OID rsaEncryption rsa_pss_rsae_sha256 = 0x0804, rsa_pss_rsae_sha384 = 0x0805, rsa_pss_rsae_sha512 = 0x0806, -- EdDSA algorithms ed25519 = 0x0807, ed448 = 0x0808, -- RSASSA-PSS algorithms with public key OID RSASSA-PSS rsa_pss_pss_sha256 = 0x0809, rsa_pss_pss_sha384 = 0x080a, rsa_pss_pss_sha512 = 0x080b, -- ECC Brainpool curves ecdsa_brainpoolP256r1tls13_sha256 = 0x081a, ecdsa_brainpoolP384r1tls13_sha384 = 0x081b, ecdsa_brainpoolP512r1tls13_sha512 = 0x081c, -- draft-tls-westerbaan-mldsa mldsa44 = 0x0904, mldsa65 = 0x0905, mldsa87 = 0x0906, -- Legacy algorithms rsa_pkcs1_sha1 = 0x0201, ecdsa_sha1 = 0x0203, -- draft-ietf-tls-tls13-pkcs1 rsa_pkcs1_sha256_legacy = 0x0420, rsa_pkcs1_sha384_legacy = 0x0520, rsa_pkcs1_sha512_legacy = 0x0620, } --- -- Extensions -- RFC 6066, draft-agl-tls-nextprotoneg-03 -- https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml -- EXTENSIONS = { ["server_name"] = 0, ["max_fragment_length"] = 1, ["client_certificate_url"] = 2, ["trusted_ca_keys"] = 3, ["truncated_hmac"] = 4, ["status_request"] = 5, ["user_mapping"] = 6, ["client_authz"] = 7, ["server_authz"] = 8, ["cert_type"] = 9, ["elliptic_curves"] = 10, -- TLS 1.3 calls this supported_groups ["ec_point_formats"] = 11, ["srp"] = 12, ["signature_algorithms"] = 13, -- TLSv1.3 changed the format for this extension. It's just more convenient -- to call it something else. ["signature_algorithms_13"] = 13, ["use_srtp"] = 14, ["heartbeat"] = 15, ["application_layer_protocol_negotiation"] = 16, ["status_request_v2"] = 17, ["signed_certificate_timestamp"] = 18, ["client_certificate_type"] = 19, ["server_certificate_type"] = 20, ["padding"] = 21, -- rfc7685 ["encrypt_then_mac"] = 22, -- rfc7366 ["extended_master_secret"] = 23, -- rfc7627 ["token_binding"] = 24, -- Temporary, expires 2018-02-04 ["cached_info"] = 25, -- rfc7924 ["tls_lts"] = 26, -- draft-gutmann-tls-lts ["compress_certificate"] = 27, -- rfc8879 ["record_size_limit"] = 28, -- rfc8449 ["pwd_protect"] = 29, -- rfc8492 ["pwd_clear"] = 30, -- rfc8492 ["password_salt"] = 31, -- rfc8492 ["ticket_pinning"] = 32, ["tls_cert_with_extern_psk"] = 33, ["delegated_credentials"] = 34, ["TLMSP"] = 35, ["TLMSP_proxying"] = 36, ["TLMSP_delegate"] = 37, ["supported_ekt_ciphers"] = 38, ["SessionTicket TLS"] = 39, -- TLSv1.3 ["pre_shared_key"] = 41, ["early_data"] = 42, ["supported_versions"] = 43, ["cookie"] = 44, ["psk_key_exchange_modes"] = 45, ["certificate_authorities"] = 47, ["oid_filters"] = 48, ["post_handshake_auth"] = 49, ["signature_algorithms_cert"] = 50, ["key_share"] = 51, ["transparency_info"] = 52, ["connection_id-deprecated"] = 53, ["connection_id"] = 54, ["external_id_hash"] = 55, ["external_session_id"] = 56, ["quic_transport_parameters"] = 57, ["ticket_request"] = 58, ["dnssec_chain"] = 59, -- ["next_protocol_negotiation"] = 13172, ["renegotiation_info"] = 65281, } --- -- Builds data for each extension -- Defaults to tostring (i.e. pass in the packed data you want directly) EXTENSION_HELPERS = { ["server_name"] = function (server_name) -- Only supports host_name type (0), as per RFC -- Support for other types could be added later return pack(">s2", pack(">Bs2", 0, server_name)) end, ["max_fragment_length"] = tostring, ["client_certificate_url"] = tostring, ["trusted_ca_keys"] = tostring, ["truncated_hmac"] = tostring, ["status_request"] = tostring, ["elliptic_curves"] = function (elliptic_curves) local list = {} for _, name in ipairs(elliptic_curves) do list[#list+1] = pack(">I2", ELLIPTIC_CURVES[name]) end return pack(">s2", concat(list)) end, ["ec_point_formats"] = function (ec_point_formats) local list = {} for _, format in ipairs(ec_point_formats) do list[#list+1] = pack(">B", EC_POINT_FORMATS[format]) end return pack(">s1", concat(list)) end, ["signature_algorithms"] = function(signature_algorithms) local list = {} for _, pair in ipairs(signature_algorithms) do list[#list+1] = pack(">BB", HashAlgorithms[pair[1]] or pair[1], SignatureAlgorithms[pair[2]] or pair[2] ) end return pack(">s2", concat(list)) end, ["signature_algorithms_13"] = function (signature_schemes) local list = {} for _, name in ipairs(signature_schemes) do list[#list+1] = pack(">I2", SignatureSchemes[name]) end return pack(">s2", concat(list)) end, ["application_layer_protocol_negotiation"] = function(protocols) local list = {} for _, proto in ipairs(protocols) do list[#list+1] = pack(">s1", proto) end return pack(">s2", concat(list)) end, ["next_protocol_negotiation"] = tostring, ["supported_versions"] = function(versions) local list = {} for _, name in ipairs(versions) do list[#list+1] = pack(">I2", PROTOCOLS[name]) end return pack(">s1", concat(list)) end, } -- -- Encryption Algorithms -- CIPHERS = { ["TLS_NULL_WITH_NULL_NULL"] = 0x0000, ["TLS_RSA_WITH_NULL_MD5"] = 0x0001, ["TLS_RSA_WITH_NULL_SHA"] = 0x0002, ["TLS_RSA_EXPORT_WITH_RC4_40_MD5"] = 0x0003, ["TLS_RSA_WITH_RC4_128_MD5"] = 0x0004, ["TLS_RSA_WITH_RC4_128_SHA"] = 0x0005, ["TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5"] = 0x0006, ["TLS_RSA_WITH_IDEA_CBC_SHA"] = 0x0007, ["TLS_RSA_EXPORT_WITH_DES40_CBC_SHA"] = 0x0008, ["TLS_RSA_WITH_DES_CBC_SHA"] = 0x0009, ["TLS_RSA_WITH_3DES_EDE_CBC_SHA"] = 0x000A, ["TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA"] = 0x000B, ["TLS_DH_DSS_WITH_DES_CBC_SHA"] = 0x000C, ["TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA"] = 0x000D, ["TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA"] = 0x000E, ["TLS_DH_RSA_WITH_DES_CBC_SHA"] = 0x000F, ["TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA"] = 0x0010, ["TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA"] = 0x0011, ["TLS_DHE_DSS_WITH_DES_CBC_SHA"] = 0x0012, ["TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA"] = 0x0013, ["TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA"] = 0x0014, ["TLS_DHE_RSA_WITH_DES_CBC_SHA"] = 0x0015, ["TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA"] = 0x0016, ["TLS_DH_anon_EXPORT_WITH_RC4_40_MD5"] = 0x0017, ["TLS_DH_anon_WITH_RC4_128_MD5"] = 0x0018, ["TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA"] = 0x0019, ["TLS_DH_anon_WITH_DES_CBC_SHA"] = 0x001A, ["TLS_DH_anon_WITH_3DES_EDE_CBC_SHA"] = 0x001B, ["SSL_FORTEZZA_KEA_WITH_NULL_SHA"] = 0x001C, ["SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA"] = 0x001D, ["TLS_KRB5_WITH_DES_CBC_SHA-or-SSL_FORTEZZA_KEA_WITH_RC4_128_SHA"] = 0x001E, --TLS vs SSLv3 ["TLS_KRB5_WITH_3DES_EDE_CBC_SHA"] = 0x001F, ["TLS_KRB5_WITH_RC4_128_SHA"] = 0x0020, ["TLS_KRB5_WITH_IDEA_CBC_SHA"] = 0x0021, ["TLS_KRB5_WITH_DES_CBC_MD5"] = 0x0022, ["TLS_KRB5_WITH_3DES_EDE_CBC_MD5"] = 0x0023, ["TLS_KRB5_WITH_RC4_128_MD5"] = 0x0024, ["TLS_KRB5_WITH_IDEA_CBC_MD5"] = 0x0025, ["TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA"] = 0x0026, ["TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA"] = 0x0027, ["TLS_KRB5_EXPORT_WITH_RC4_40_SHA"] = 0x0028, ["TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5"] = 0x0029, ["TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5"] = 0x002A, ["TLS_KRB5_EXPORT_WITH_RC4_40_MD5"] = 0x002B, ["TLS_PSK_WITH_NULL_SHA"] = 0x002C, ["TLS_DHE_PSK_WITH_NULL_SHA"] = 0x002D, ["TLS_RSA_PSK_WITH_NULL_SHA"] = 0x002E, ["TLS_RSA_WITH_AES_128_CBC_SHA"] = 0x002F, ["TLS_DH_DSS_WITH_AES_128_CBC_SHA"] = 0x0030, ["TLS_DH_RSA_WITH_AES_128_CBC_SHA"] = 0x0031, ["TLS_DHE_DSS_WITH_AES_128_CBC_SHA"] = 0x0032, ["TLS_DHE_RSA_WITH_AES_128_CBC_SHA"] = 0x0033, ["TLS_DH_anon_WITH_AES_128_CBC_SHA"] = 0x0034, ["TLS_RSA_WITH_AES_256_CBC_SHA"] = 0x0035, ["TLS_DH_DSS_WITH_AES_256_CBC_SHA"] = 0x0036, ["TLS_DH_RSA_WITH_AES_256_CBC_SHA"] = 0x0037, ["TLS_DHE_DSS_WITH_AES_256_CBC_SHA"] = 0x0038, ["TLS_DHE_RSA_WITH_AES_256_CBC_SHA"] = 0x0039, ["TLS_DH_anon_WITH_AES_256_CBC_SHA"] = 0x003A, ["TLS_RSA_WITH_NULL_SHA256"] = 0x003B, ["TLS_RSA_WITH_AES_128_CBC_SHA256"] = 0x003C, ["TLS_RSA_WITH_AES_256_CBC_SHA256"] = 0x003D, ["TLS_DH_DSS_WITH_AES_128_CBC_SHA256"] = 0x003E, ["TLS_DH_RSA_WITH_AES_128_CBC_SHA256"] = 0x003F, ["TLS_DHE_DSS_WITH_AES_128_CBC_SHA256"] = 0x0040, ["TLS_RSA_WITH_CAMELLIA_128_CBC_SHA"] = 0x0041, ["TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA"] = 0x0042, ["TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA"] = 0x0043, ["TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA"] = 0x0044, ["TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA"] = 0x0045, ["TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA"] = 0x0046, ["TLS_ECDH_ECDSA_WITH_NULL_SHA-draft"] = 0x0047, --draft-ietf-tls-ecc-00 ["TLS_ECDH_ECDSA_WITH_RC4_128_SHA-draft"] = 0x0048, --draft-ietf-tls-ecc-00 ["TLS_ECDH_ECDSA_WITH_DES_CBC_SHA-draft"] = 0x0049, --draft-ietf-tls-ecc-00 ["TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA-draft"] = 0x004A, --draft-ietf-tls-ecc-00 ["TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA-draft"] = 0x004B, --draft-ietf-tls-ecc-00 ["TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA-draft"] = 0x004C, --draft-ietf-tls-ecc-00 ["TLS_ECDH_ECNRA_WITH_DES_CBC_SHA-draft"] = 0x004D, --draft-ietf-tls-ecc-00 ["TLS_ECDH_ECNRA_WITH_3DES_EDE_CBC_SHA-draft"] = 0x004E, --draft-ietf-tls-ecc-00 ["TLS_ECMQV_ECDSA_NULL_SHA-draft"] = 0x004F, --draft-ietf-tls-ecc-00 ["TLS_ECMQV_ECDSA_WITH_RC4_128_SHA-draft"] = 0x0050, --draft-ietf-tls-ecc-00 ["TLS_ECMQV_ECDSA_WITH_DES_CBC_SHA-draft"] = 0x0051, --draft-ietf-tls-ecc-00 ["TLS_ECMQV_ECDSA_WITH_3DES_EDE_CBC_SHA-draft"] = 0x0052, --draft-ietf-tls-ecc-00 ["TLS_ECMQV_ECNRA_NULL_SHA-draft"] = 0x0053, --draft-ietf-tls-ecc-00 ["TLS_ECMQV_ECNRA_WITH_RC4_128_SHA-draft"] = 0x0054, --draft-ietf-tls-ecc-00 ["TLS_ECMQV_ECNRA_WITH_DES_CBC_SHA-draft"] = 0x0055, --draft-ietf-tls-ecc-00 ["TLS_ECMQV_ECNRA_WITH_3DES_EDE_CBC_SHA-draft"] = 0x0056, --draft-ietf-tls-ecc-00 ["TLS_ECDH_anon_NULL_WITH_SHA-draft"] = 0x0057, --draft-ietf-tls-ecc-00 ["TLS_ECDH_anon_WITH_RC4_128_SHA-draft"] = 0x0058, --draft-ietf-tls-ecc-00 ["TLS_ECDH_anon_WITH_DES_CBC_SHA-draft"] = 0x0059, --draft-ietf-tls-ecc-00 ["TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA-draft"] = 0x005A, --draft-ietf-tls-ecc-00 ["TLS_ECDH_anon_EXPORT_WITH_DES40_CBC_SHA-draft"] = 0x005B, --draft-ietf-tls-ecc-00 ["TLS_ECDH_anon_EXPORT_WITH_RC4_40_SHA-draft"] = 0x005C, --draft-ietf-tls-ecc-00 ["TLS_RSA_EXPORT1024_WITH_RC4_56_MD5"] = 0x0060, ["TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5"] = 0x0061, ["TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA"] = 0x0062, ["TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA"] = 0x0063, ["TLS_RSA_EXPORT1024_WITH_RC4_56_SHA"] = 0x0064, ["TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA"] = 0x0065, ["TLS_DHE_DSS_WITH_RC4_128_SHA"] = 0x0066, ["TLS_DHE_RSA_WITH_AES_128_CBC_SHA256"] = 0x0067, ["TLS_DH_DSS_WITH_AES_256_CBC_SHA256"] = 0x0068, ["TLS_DH_RSA_WITH_AES_256_CBC_SHA256"] = 0x0069, ["TLS_DHE_DSS_WITH_AES_256_CBC_SHA256"] = 0x006A, ["TLS_DHE_RSA_WITH_AES_256_CBC_SHA256"] = 0x006B, ["TLS_DH_anon_WITH_AES_128_CBC_SHA256"] = 0x006C, ["TLS_DH_anon_WITH_AES_256_CBC_SHA256"] = 0x006D, ["TLS_DHE_DSS_WITH_3DES_EDE_CBC_RMD-draft"] = 0x0072, --draft-ietf-tls-openpgp-keys-05 ["TLS_DHE_DSS_WITH_AES_128_CBC_RMD-draft"] = 0x0073, --draft-ietf-tls-openpgp-keys-05 ["TLS_DHE_DSS_WITH_AES_256_CBC_RMD-draft"] = 0x0074, --draft-ietf-tls-openpgp-keys-05 ["TLS_DHE_RSA_WITH_3DES_EDE_CBC_RMD-draft"] = 0x0077, --draft-ietf-tls-openpgp-keys-05 ["TLS_DHE_RSA_WITH_AES_128_CBC_RMD-draft"] = 0x0078, --draft-ietf-tls-openpgp-keys-05 ["TLS_DHE_RSA_WITH_AES_256_CBC_RMD-draft"] = 0x0079, --draft-ietf-tls-openpgp-keys-05 ["TLS_RSA_WITH_3DES_EDE_CBC_RMD-draft"] = 0x007C, --draft-ietf-tls-openpgp-keys-05 ["TLS_RSA_WITH_AES_128_CBC_RMD-draft"] = 0x007D, --draft-ietf-tls-openpgp-keys-05 ["TLS_RSA_WITH_AES_256_CBC_RMD-draft"] = 0x007E, --draft-ietf-tls-openpgp-keys-05 ["TLS_GOSTR341094_WITH_28147_CNT_IMIT-draft"] = 0x0080, --draft-chudov-cryptopro-cptls-04 ["TLS_GOSTR341001_WITH_28147_CNT_IMIT-draft"] = 0x0081, --draft-chudov-cryptopro-cptls-04 ["TLS_GOSTR341094_WITH_NULL_GOSTR3411-draft"] = 0x0082, --draft-chudov-cryptopro-cptls-04 ["TLS_GOSTR341001_WITH_NULL_GOSTR3411-draft"] = 0x0083, --draft-chudov-cryptopro-cptls-04 ["TLS_RSA_WITH_CAMELLIA_256_CBC_SHA"] = 0x0084, ["TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA"] = 0x0085, ["TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA"] = 0x0086, ["TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA"] = 0x0087, ["TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA"] = 0x0088, ["TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA"] = 0x0089, ["TLS_PSK_WITH_RC4_128_SHA"] = 0x008A, ["TLS_PSK_WITH_3DES_EDE_CBC_SHA"] = 0x008B, ["TLS_PSK_WITH_AES_128_CBC_SHA"] = 0x008C, ["TLS_PSK_WITH_AES_256_CBC_SHA"] = 0x008D, ["TLS_DHE_PSK_WITH_RC4_128_SHA"] = 0x008E, ["TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA"] = 0x008F, ["TLS_DHE_PSK_WITH_AES_128_CBC_SHA"] = 0x0090, ["TLS_DHE_PSK_WITH_AES_256_CBC_SHA"] = 0x0091, ["TLS_RSA_PSK_WITH_RC4_128_SHA"] = 0x0092, ["TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA"] = 0x0093, ["TLS_RSA_PSK_WITH_AES_128_CBC_SHA"] = 0x0094, ["TLS_RSA_PSK_WITH_AES_256_CBC_SHA"] = 0x0095, ["TLS_RSA_WITH_SEED_CBC_SHA"] = 0x0096, ["TLS_DH_DSS_WITH_SEED_CBC_SHA"] = 0x0097, ["TLS_DH_RSA_WITH_SEED_CBC_SHA"] = 0x0098, ["TLS_DHE_DSS_WITH_SEED_CBC_SHA"] = 0x0099, ["TLS_DHE_RSA_WITH_SEED_CBC_SHA"] = 0x009A, ["TLS_DH_anon_WITH_SEED_CBC_SHA"] = 0x009B, ["TLS_RSA_WITH_AES_128_GCM_SHA256"] = 0x009C, ["TLS_RSA_WITH_AES_256_GCM_SHA384"] = 0x009D, ["TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"] = 0x009E, ["TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"] = 0x009F, ["TLS_DH_RSA_WITH_AES_128_GCM_SHA256"] = 0x00A0, ["TLS_DH_RSA_WITH_AES_256_GCM_SHA384"] = 0x00A1, ["TLS_DHE_DSS_WITH_AES_128_GCM_SHA256"] = 0x00A2, ["TLS_DHE_DSS_WITH_AES_256_GCM_SHA384"] = 0x00A3, ["TLS_DH_DSS_WITH_AES_128_GCM_SHA256"] = 0x00A4, ["TLS_DH_DSS_WITH_AES_256_GCM_SHA384"] = 0x00A5, ["TLS_DH_anon_WITH_AES_128_GCM_SHA256"] = 0x00A6, ["TLS_DH_anon_WITH_AES_256_GCM_SHA384"] = 0x00A7, ["TLS_PSK_WITH_AES_128_GCM_SHA256"] = 0x00A8, ["TLS_PSK_WITH_AES_256_GCM_SHA384"] = 0x00A9, ["TLS_DHE_PSK_WITH_AES_128_GCM_SHA256"] = 0x00AA, ["TLS_DHE_PSK_WITH_AES_256_GCM_SHA384"] = 0x00AB, ["TLS_RSA_PSK_WITH_AES_128_GCM_SHA256"] = 0x00AC, ["TLS_RSA_PSK_WITH_AES_256_GCM_SHA384"] = 0x00AD, ["TLS_PSK_WITH_AES_128_CBC_SHA256"] = 0x00AE, ["TLS_PSK_WITH_AES_256_CBC_SHA384"] = 0x00AF, ["TLS_PSK_WITH_NULL_SHA256"] = 0x00B0, ["TLS_PSK_WITH_NULL_SHA384"] = 0x00B1, ["TLS_DHE_PSK_WITH_AES_128_CBC_SHA256"] = 0x00B2, ["TLS_DHE_PSK_WITH_AES_256_CBC_SHA384"] = 0x00B3, ["TLS_DHE_PSK_WITH_NULL_SHA256"] = 0x00B4, ["TLS_DHE_PSK_WITH_NULL_SHA384"] = 0x00B5, ["TLS_RSA_PSK_WITH_AES_128_CBC_SHA256"] = 0x00B6, ["TLS_RSA_PSK_WITH_AES_256_CBC_SHA384"] = 0x00B7, ["TLS_RSA_PSK_WITH_NULL_SHA256"] = 0x00B8, ["TLS_RSA_PSK_WITH_NULL_SHA384"] = 0x00B9, ["TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256"] = 0x00BA, ["TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256"] = 0x00BB, ["TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256"] = 0x00BC, ["TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256"] = 0x00BD, ["TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256"] = 0x00BE, ["TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256"] = 0x00BF, ["TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256"] = 0x00C0, ["TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256"] = 0x00C1, ["TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256"] = 0x00C2, ["TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256"] = 0x00C3, ["TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256"] = 0x00C4, ["TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256"] = 0x00C5, ["TLS_ECDH_ECDSA_WITH_NULL_SHA"] = 0xC001, ["TLS_ECDH_ECDSA_WITH_RC4_128_SHA"] = 0xC002, ["TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA"] = 0xC003, ["TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA"] = 0xC004, ["TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA"] = 0xC005, ["TLS_ECDHE_ECDSA_WITH_NULL_SHA"] = 0xC006, ["TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"] = 0xC007, ["TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA"] = 0xC008, ["TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA"] = 0xC009, ["TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"] = 0xC00A, ["TLS_ECDH_RSA_WITH_NULL_SHA"] = 0xC00B, ["TLS_ECDH_RSA_WITH_RC4_128_SHA"] = 0xC00C, ["TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA"] = 0xC00D, ["TLS_ECDH_RSA_WITH_AES_128_CBC_SHA"] = 0xC00E, ["TLS_ECDH_RSA_WITH_AES_256_CBC_SHA"] = 0xC00F, ["TLS_ECDHE_RSA_WITH_NULL_SHA"] = 0xC010, ["TLS_ECDHE_RSA_WITH_RC4_128_SHA"] = 0xC011, ["TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"] = 0xC012, ["TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"] = 0xC013, ["TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"] = 0xC014, ["TLS_ECDH_anon_WITH_NULL_SHA"] = 0xC015, ["TLS_ECDH_anon_WITH_RC4_128_SHA"] = 0xC016, ["TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA"] = 0xC017, ["TLS_ECDH_anon_WITH_AES_128_CBC_SHA"] = 0xC018, ["TLS_ECDH_anon_WITH_AES_256_CBC_SHA"] = 0xC019, ["TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA"] = 0xC01A, ["TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA"] = 0xC01B, ["TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA"] = 0xC01C, ["TLS_SRP_SHA_WITH_AES_128_CBC_SHA"] = 0xC01D, ["TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA"] = 0xC01E, ["TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA"] = 0xC01F, ["TLS_SRP_SHA_WITH_AES_256_CBC_SHA"] = 0xC020, ["TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA"] = 0xC021, ["TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA"] = 0xC022, ["TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"] = 0xC023, ["TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384"] = 0xC024, ["TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256"] = 0xC025, ["TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384"] = 0xC026, ["TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"] = 0xC027, ["TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"] = 0xC028, ["TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256"] = 0xC029, ["TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384"] = 0xC02A, ["TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"] = 0xC02B, ["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"] = 0xC02C, ["TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256"] = 0xC02D, ["TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384"] = 0xC02E, ["TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"] = 0xC02F, ["TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"] = 0xC030, ["TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256"] = 0xC031, ["TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384"] = 0xC032, ["TLS_ECDHE_PSK_WITH_RC4_128_SHA"] = 0xC033, ["TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA"] = 0xC034, ["TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA"] = 0xC035, ["TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA"] = 0xC036, ["TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256"] = 0xC037, ["TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384"] = 0xC038, ["TLS_ECDHE_PSK_WITH_NULL_SHA"] = 0xC039, ["TLS_ECDHE_PSK_WITH_NULL_SHA256"] = 0xC03A, ["TLS_ECDHE_PSK_WITH_NULL_SHA384"] = 0xC03B, ["TLS_RSA_WITH_ARIA_128_CBC_SHA256"] = 0xC03C, ["TLS_RSA_WITH_ARIA_256_CBC_SHA384"] = 0xC03D, ["TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256"] = 0xC03E, ["TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384"] = 0xC03F, ["TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256"] = 0xC040, ["TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384"] = 0xC041, ["TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256"] = 0xC042, ["TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384"] = 0xC043, ["TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256"] = 0xC044, ["TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384"] = 0xC045, ["TLS_DH_anon_WITH_ARIA_128_CBC_SHA256"] = 0xC046, ["TLS_DH_anon_WITH_ARIA_256_CBC_SHA384"] = 0xC047, ["TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256"] = 0xC048, ["TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384"] = 0xC049, ["TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256"] = 0xC04A, ["TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384"] = 0xC04B, ["TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256"] = 0xC04C, ["TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384"] = 0xC04D, ["TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256"] = 0xC04E, ["TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384"] = 0xC04F, ["TLS_RSA_WITH_ARIA_128_GCM_SHA256"] = 0xC050, ["TLS_RSA_WITH_ARIA_256_GCM_SHA384"] = 0xC051, ["TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256"] = 0xC052, ["TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384"] = 0xC053, ["TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256"] = 0xC054, ["TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384"] = 0xC055, ["TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256"] = 0xC056, ["TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384"] = 0xC057, ["TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256"] = 0xC058, ["TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384"] = 0xC059, ["TLS_DH_anon_WITH_ARIA_128_GCM_SHA256"] = 0xC05A, ["TLS_DH_anon_WITH_ARIA_256_GCM_SHA384"] = 0xC05B, ["TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256"] = 0xC05C, ["TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384"] = 0xC05D, ["TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256"] = 0xC05E, ["TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384"] = 0xC05F, ["TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256"] = 0xC060, ["TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384"] = 0xC061, ["TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256"] = 0xC062, ["TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384"] = 0xC063, ["TLS_PSK_WITH_ARIA_128_CBC_SHA256"] = 0xC064, ["TLS_PSK_WITH_ARIA_256_CBC_SHA384"] = 0xC065, ["TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256"] = 0xC066, ["TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384"] = 0xC067, ["TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256"] = 0xC068, ["TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384"] = 0xC069, ["TLS_PSK_WITH_ARIA_128_GCM_SHA256"] = 0xC06A, ["TLS_PSK_WITH_ARIA_256_GCM_SHA384"] = 0xC06B, ["TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256"] = 0xC06C, ["TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384"] = 0xC06D, ["TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256"] = 0xC06E, ["TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384"] = 0xC06F, ["TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256"] = 0xC070, ["TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384"] = 0xC071, ["TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256"] = 0xC072, ["TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384"] = 0xC073, ["TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256"] = 0xC074, ["TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384"] = 0xC075, ["TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256"] = 0xC076, ["TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384"] = 0xC077, ["TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256"] = 0xC078, ["TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384"] = 0xC079, ["TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256"] = 0xC07A, ["TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384"] = 0xC07B, ["TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256"] = 0xC07C, ["TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384"] = 0xC07D, ["TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256"] = 0xC07E, ["TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384"] = 0xC07F, ["TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256"] = 0xC080, ["TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384"] = 0xC081, ["TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256"] = 0xC082, ["TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384"] = 0xC083, ["TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256"] = 0xC084, ["TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384"] = 0xC085, ["TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256"] = 0xC086, ["TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384"] = 0xC087, ["TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256"] = 0xC088, ["TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384"] = 0xC089, ["TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256"] = 0xC08A, ["TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384"] = 0xC08B, ["TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256"] = 0xC08C, ["TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384"] = 0xC08D, ["TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256"] = 0xC08E, ["TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384"] = 0xC08F, ["TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256"] = 0xC090, ["TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384"] = 0xC091, ["TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256"] = 0xC092, ["TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384"] = 0xC093, ["TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256"] = 0xC094, ["TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384"] = 0xC095, ["TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256"] = 0xC096, ["TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384"] = 0xC097, ["TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256"] = 0xC098, ["TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384"] = 0xC099, ["TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256"] = 0xC09A, ["TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384"] = 0xC09B, ["TLS_RSA_WITH_AES_128_CCM"] = 0xC09C, ["TLS_RSA_WITH_AES_256_CCM"] = 0xC09D, ["TLS_DHE_RSA_WITH_AES_128_CCM"] = 0xC09E, ["TLS_DHE_RSA_WITH_AES_256_CCM"] = 0xC09F, ["TLS_RSA_WITH_AES_128_CCM_8"] = 0xC0A0, ["TLS_RSA_WITH_AES_256_CCM_8"] = 0xC0A1, ["TLS_DHE_RSA_WITH_AES_128_CCM_8"] = 0xC0A2, ["TLS_DHE_RSA_WITH_AES_256_CCM_8"] = 0xC0A3, ["TLS_PSK_WITH_AES_128_CCM"] = 0xC0A4, ["TLS_PSK_WITH_AES_256_CCM"] = 0xC0A5, ["TLS_DHE_PSK_WITH_AES_128_CCM"] = 0xC0A6, ["TLS_DHE_PSK_WITH_AES_256_CCM"] = 0xC0A7, ["TLS_PSK_WITH_AES_128_CCM_8"] = 0xC0A8, ["TLS_PSK_WITH_AES_256_CCM_8"] = 0xC0A9, ["TLS_PSK_DHE_WITH_AES_128_CCM_8"] = 0xC0AA, ["TLS_PSK_DHE_WITH_AES_256_CCM_8"] = 0xC0AB, ["TLS_ECDHE_ECDSA_WITH_AES_128_CCM"] = 0xC0AC, ["TLS_ECDHE_ECDSA_WITH_AES_256_CCM"] = 0xC0AD, ["TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8"] = 0xC0AE, ["TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8"] = 0xC0AF, ["TLS_ECCPWD_WITH_AES_128_GCM_SHA256"] = 0xC0B0, -- RFC8492 ["TLS_ECCPWD_WITH_AES_256_GCM_SHA384"] = 0xC0B1, -- RFC8492 ["TLS_ECCPWD_WITH_AES_128_CCM_SHA256"] = 0xC0B2, -- RFC8492 ["TLS_ECCPWD_WITH_AES_256_CCM_SHA384"] = 0xC0B3, -- RFC8492 ["TLS_AKE_WITH_NULL_SHA256"] = 0xC0B4, -- RFC9150 ["TLS_AKE_WITH_NULL_SHA384"] = 0xC0B5, -- RFC9150 ["TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC"] = 0xC100, -- RFC9189 ["TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC"] = 0xC101, -- RFC9189 ["TLS_GOSTR341112_256_WITH_28147_CNT_IMIT"] = 0xC102, -- RFC9189 ["TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_L"] = 0xC103, -- RFC9367 ["TLS_GOSTR341112_256_WITH_MAGMA_MGM_L"] = 0xC104, -- RFC9367 ["TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_S"] = 0xC105, -- RFC9367 ["TLS_GOSTR341112_256_WITH_MAGMA_MGM_S"] = 0xC106, -- RFC9367 ["TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256-draft"] = 0xCC13, -- RFC7905 superseded ["TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256-draft"] = 0xCC14, -- RFC7905 superseded ["TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256-draft"] = 0xCC15, -- RFC7905 superseded ["TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"] = 0xCCA8, ["TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"] = 0xCCA9, ["TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256"] = 0xCCAA, ["TLS_PSK_WITH_CHACHA20_POLY1305_SHA256"] = 0xCCAB, ["TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256"] = 0xCCAC, ["TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256"] = 0xCCAD, ["TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256"] = 0xCCAE, ["TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256"] = 0xD001, -- RFC 8442 ["TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384"] = 0xD002, -- RFC 8442 ["TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256"] = 0xD003, -- RFC 8442 ["TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256"] = 0xD005, -- RFC 8442 ["SSL_RSA_FIPS_WITH_DES_CBC_SHA"] = 0xFEFE, ["SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA"] = 0xFEFF, -- TLSv1.3: -- "Although TLS 1.3 uses the same cipher suite space as previous versions of -- TLS, TLS 1.3 cipher suites are defined differently, only specifying the -- symmetric ciphers, and cannot be used for TLS 1.2. Similarly, TLS 1.2 and -- lower cipher suites cannot be used with TLS 1.3." -- We designate these as AKE (Authenticated Key Exchange) ciphersuites, in -- order to simplify use of the cipher_info function. TLS_AKE_WITH_AES_128_GCM_SHA256 = 0x1301, TLS_AKE_WITH_AES_256_GCM_SHA384 = 0x1302, TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 = 0x1303, TLS_AKE_WITH_AES_128_CCM_SHA256 = 0x1304, TLS_AKE_WITH_AES_128_CCM_8_SHA256 = 0x1305, TLS_AKE_WITH_AEGIS_256_SHA512 = 0x1306, -- draft-irtf-cfrg-aegis-aead-08 TLS_AKE_WITH_AEGIS_128L_SHA256 = 0x1307, -- draft-irtf-cfrg-aegis-aead-08 TLS_AKE_WITH_SM4_GCM_SM3 = 0x00C6, -- RFC 8998 TLS_AKE_WITH_SM4_CCM_SM3 = 0x00C7, -- RFC 8998 } -- Default ciphers sent by tls.client_hello for TLSv1.2 or earlier DEFAULT_TLS12_CIPHERS = { "TLS_RSA_WITH_AES_128_CBC_SHA", -- mandatory TLSv1.2 "TLS_RSA_WITH_3DES_EDE_CBC_SHA", -- mandatory TLSv1.1 "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", -- mandatory TLSv1.0 "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", -- DHE with strong AES "TLS_RSA_WITH_RC4_128_MD5", -- Weak and old, but likely supported on old stuff -- The following are sent by Chrome 136: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_256_CBC_SHA", } -- Same, but for TLSv1.3 DEFAULT_TLS13_CIPHERS = { "TLS_AKE_WITH_AES_128_GCM_SHA256", -- mandatory TLSv1.3 "TLS_AKE_WITH_AES_256_GCM_SHA384", -- stronger TLSv1.3 "TLS_AKE_WITH_CHACHA20_POLY1305_SHA256", -- alternate TLSv1.3 } -- Same, but for handshakes compatible with any TLS version local DEFAULT_CIPHERS = { table.unpack(DEFAULT_TLS13_CIPHERS) } for _, c in ipairs(DEFAULT_TLS12_CIPHERS) do insert(DEFAULT_CIPHERS, c) end local function find_key(t, value) local found, v = tableaux.contains(t, value) return v end -- Keep this local to enforce use of the cipher_info function local cipher_info_cache = { -- pre-populate the special cases that break the parser below ["TLS_ECDH_anon_NULL_WITH_SHA-draft"] = { kex = "ECDH", dh = true, ec = true, anon = true, cipher = "NULL", hash = "SHA", draft = true }, ["TLS_ECMQV_ECDSA_NULL_SHA-draft"] = { kex = "ECMQV", ec = true, cipher = "NULL", hash = "SHA", draft = true }, ["TLS_ECMQV_ECNRA_NULL_SHA-draft"] = { kex = "ECMQV", ec = true, cipher = "NULL", hash = "SHA", draft = true }, ["TLS_GOSTR341094_WITH_28147_CNT_IMIT-draft"] = { kex = "GOSTR341094", cipher = "GOST28147", hash = "IMIT_GOST28147", draft = true }, ["TLS_GOSTR341001_WITH_28147_CNT_IMIT-draft"] = { kex = "GOSTR341001", cipher = "GOST28147", hash = "IMIT_GOST28147", draft = true }, ["TLS_GOSTR341094_WITH_NULL_GOSTR3411-draft"] = { kex = "GOSTR341094", cipher = "NULL", hash = "HMAC_GOSTR3411", draft = true }, ["TLS_GOSTR341001_WITH_NULL_GOSTR3411-draft"] = { kex = "GOSTR341001", cipher = "NULL", hash = "HMAC_GOSTR3411", draft = true }, ["TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC"] = { kex = "GOST_DH", cipher = "KUZNYECHIK", mode = "stream", hash = "GOSTR341112", size = 256 }, ["TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC"] = { kex = "GOST_DH", cipher = "MAGMA", mode = "stream", hash = "GOSTR341112", size = 256 }, ["TLS_GOSTR341112_256_WITH_28147_CNT_IMIT"] = { kex = "GOST_DH", cipher = "KUZNYECHIK", mode = "stream", hash = "GOSTR341112", size = 256 }, ["TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_L"] = { kex = "AKE", cipher = "KUZNYECHIK", mode = "MGM", hash = "GOSTR341112", tls13ok = true, tls13only = true, size = 256, block_size = 128, }, ["TLS_GOSTR341112_256_WITH_MAGMA_MGM_L"] = { kex = "AKE", cipher = "MAGMA", mode = "MGM", hash = "GOSTR341112", tls13ok = true, tls13only = true, size = 256, block_size = 64, }, ["TLS_GOSTR341112_256_WITH_KUZNYECHIK_MGM_S"] = { kex = "AKE", cipher = "KUZNYECHIK", mode = "MGM", hash = "GOSTR341112", tls13ok = true, tls13only = true, size = 256, block_size = 128, }, ["TLS_GOSTR341112_256_WITH_MAGMA_MGM_S"] = { kex = "AKE", cipher = "MAGMA", mode = "MGM", hash = "GOSTR341112", tls13ok = true, tls13only = true, size = 256, block_size = 64, }, } -- A couple helpers for server_key_exchange parsing local function unpack_dhparams (blob, pos) local p, g, y p, g, y, pos = unpack(">s2s2s2", blob, pos) return pos, {p=p, g=g, y=y}, #p * 8 end local function named_group_info (group) if group:match("^arbitrary") then return "ec" end local ktype, size = group:match("^(%D+)(%d+)") assert(ktype and size, ("Invalid named group: %s"):format(group)) size = tonumber(size) if ktype == "ffdhe" then ktype = "dh" else if group == "ecdh_x25519" or group == "curveSM2" then size = 256 end ktype = "ec" end return ktype, size end local function unpack_ecdhparams (blob, pos) local eccurvetype eccurvetype, pos = unpack("B", blob, pos) local ret = {} local strength if eccurvetype == 1 then local p, a, b, base, order, cofactor p, a, b, base, order, cofactor, pos = unpack("s1s1s1s1s1s1", blob, pos) strength = math.log(order, 2) ret.curve_params = { ec_curve_type = "explicit_prime", prime_p=p, curve={a=a, b=b}, base=base, order=order, cofactor=cofactor } elseif eccurvetype == 2 then local p = {} local m, basis m, basis, pos = unpack(">I2B", blob, pos) if basis == 1 then -- ec_trinomial p.k, pos = unpack("s1", blob, pos) elseif basis == 2 then -- ec_pentanomial p.k1, p.k2, p.k3, pos = unpack("s1s1s1", blob, pos) end local a, b, base, order, cofactor a, b, base, order, cofactor, pos = unpack("s1s1s1s1s1", blob, pos) strength = math.log(order, 2) ret.curve_params = { ec_curve_type = "explicit_char2", m=m, basis=basis, field=p, curve={a=a, b=b}, base=base, order=order, cofactor=cofactor } elseif eccurvetype == 3 then local curve curve, pos = unpack(">I2", blob, pos) ret.curve_params = { ec_curve_type = "namedcurve", curve = find_key(ELLIPTIC_CURVES, curve) } local _ _, strength = named_group_info(ret.curve_params.curve) end ret.public, pos = unpack("s1", blob, pos) return pos, ret, strength end local function unpack_signed (blob, pos, protocol) if pos > #blob then -- not-signed return pos, nil end local hash_alg, sig_alg, sig -- TLSv1.2 changed to allow arbitrary hash and sig algorithms if protocol and PROTOCOLS[protocol] >= 0x0303 then hash_alg, sig_alg, sig, pos = unpack(">BBs2", blob, pos) else sig, pos = unpack(">s2", blob, pos) end return pos, {hash_algorithm=hash_alg, signature_algorithm=sig_alg, signature=sig} end --- Get the strength-equivalent RSA key size -- -- Based on NIST SP800-57 part 1 rev 3 -- @param ktype Key type ("dh", "ec", "rsa", "dsa") -- @param bits Size of key in bits -- @return Size in bits of RSA key with equivalent strength function rsa_equiv (ktype, bits) if ktype == "rsa" or ktype == "dsa" or ktype == "dh" then return bits elseif ktype == "ec" then if bits < 160 then return 512 -- Possibly down to 0, but details not published elseif bits < 224 then return 1024 elseif bits < 256 then return 2048 elseif bits < 384 then return 3072 elseif bits < 512 then return 7680 else -- 512+ return 15360 end end return nil end KEX_ALGORITHMS = {} -- RFC 5246 KEX_ALGORITHMS.NULL = { anon = true } KEX_ALGORITHMS.DH_anon = { anon = true, type = "dh", server_key_exchange = function (blob, protocol) local pos local ret = {} pos, ret.dhparams, ret.strength = unpack_dhparams(blob) return ret end } KEX_ALGORITHMS.DH_anon_EXPORT = { anon=true, export=true, type = "dh", server_key_exchange = KEX_ALGORITHMS.DH_anon.server_key_exchange } KEX_ALGORITHMS.ECDH_anon = { anon=true, type = "ec", server_key_exchange = function (blob, protocol) local pos local ret = {} pos, ret.ecdhparams, ret.strength = unpack_ecdhparams(blob) return ret end } KEX_ALGORITHMS.ECDH_anon_EXPORT = { anon=true, export=true, type = "ec", server_key_exchange = KEX_ALGORITHMS.ECDH_anon.server_key_exchange } KEX_ALGORITHMS.RSA = { pubkey="rsa", } -- http://www-archive.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html KEX_ALGORITHMS.RSA_FIPS = KEX_ALGORITHMS.RSA KEX_ALGORITHMS.RSA_EXPORT = { export=true, pubkey="rsa", type = "rsa", server_key_exchange = function (blob, protocol) local pos local ret = {rsa={}} ret.rsa.modulus, ret.rsa.exponent, pos = unpack(">s2s2", blob) pos, ret.signed = unpack_signed(blob, pos, protocol) ret.strength = #ret.rsa.modulus return ret end } KEX_ALGORITHMS.RSA_EXPORT1024 = KEX_ALGORITHMS.RSA_EXPORT KEX_ALGORITHMS.DHE_RSA={ pubkey="rsa", type = "dh", pfs = true, server_key_exchange = function (blob, protocol) local pos local ret = {} pos, ret.dhparams, ret.strength = unpack_dhparams(blob) pos, ret.signed = unpack_signed(blob, pos, protocol) return ret end } KEX_ALGORITHMS.DHE_RSA_EXPORT={ export=true, pubkey="rsa", type = "dh", pfs = true, server_key_exchange = KEX_ALGORITHMS.DHE_RSA.server_key_exchange } KEX_ALGORITHMS.DHE_DSS={ pubkey="dsa", type = "dh", pfs = true, server_key_exchange = KEX_ALGORITHMS.DHE_RSA.server_key_exchange } KEX_ALGORITHMS.DHE_DSS_EXPORT={ export=true, pubkey="dsa", type = "dh", pfs = true, server_key_exchange = KEX_ALGORITHMS.DHE_RSA.server_key_exchange } KEX_ALGORITHMS.DHE_DSS_EXPORT1024 = KEX_ALGORITHMS.DHE_DSS_EXPORT1024 KEX_ALGORITHMS.DH_DSS={ pubkey="dh", } KEX_ALGORITHMS.DH_DSS_EXPORT={ export=true, pubkey="dh", } KEX_ALGORITHMS.DH_RSA={ pubkey="dh", } KEX_ALGORITHMS.DH_RSA_EXPORT={ export=true, pubkey="dh", } KEX_ALGORITHMS.ECDHE_RSA={ pubkey="rsa", type = "ec", pfs = true, server_key_exchange = function (blob, protocol) local pos local ret = {} pos, ret.ecdhparams, ret.strength = unpack_ecdhparams(blob) pos, ret.signed = unpack_signed(blob, pos, protocol) return ret end } KEX_ALGORITHMS.ECDHE_ECDSA={ pubkey="ec", type = "ec", pfs = true, server_key_exchange = KEX_ALGORITHMS.ECDHE_RSA.server_key_exchange } KEX_ALGORITHMS.ECDH_ECDSA={ pubkey="ec", } KEX_ALGORITHMS.ECDH_RSA={ pubkey="ec", } -- draft-ietf-tls-ecc-00 KEX_ALGORITHMS.ECDH_ECNRA={ pubkey="ec", } KEX_ALGORITHMS.ECMQV_ECDSA={ pubkey="ec", type = "ecmqv", server_key_exchange = function (blob, protocol) local pos local ret = {} ret.mqvparams, pos = unpack("s1", blob) return ret end } KEX_ALGORITHMS.ECMQV_ECNRA={ pubkey="ec", } -- rfc4279 KEX_ALGORITHMS.PSK = { type = "psk", server_key_exchange = function (blob, protocol) local hint, pos = unpack(">s2", blob) return {psk_identity_hint=hint} end } KEX_ALGORITHMS.RSA_PSK = { pubkey="rsa", type = "psk", server_key_exchange = KEX_ALGORITHMS.PSK.server_key_exchange } KEX_ALGORITHMS.DHE_PSK = { type = "dh", pfs = true, server_key_exchange = function (blob, protocol) local pos local ret = {} ret.psk_identity_hint, pos = unpack(">s2", blob) pos, ret.dhparams, ret.strength = unpack_dhparams(blob, pos) return ret end } --nomenclature change KEX_ALGORITHMS.PSK_DHE = KEX_ALGORITHMS.DHE_PSK --rfc5489 KEX_ALGORITHMS.ECDHE_PSK={ type = "ec", pfs = true, server_key_exchange = function (blob, protocol) local pos local ret = {} ret.psk_identity_hint, pos = unpack(">s2", blob) pos, ret.ecdhparams, ret.strength = unpack_ecdhparams(blob, pos) return ret end } -- RFC 5054 KEX_ALGORITHMS.SRP_SHA = { type = "srp", pfs = true, server_key_exchange = function (blob, protocol) local pos local ret = {srp={}} ret.srp.N, ret.srp.g, ret.srp.s, ret.srp.B, pos = unpack(">s2s2s1s2", blob) pos, ret.signed = unpack_signed(blob, pos, protocol) ret.strength = #ret.srp.N return ret end } KEX_ALGORITHMS.SRP_SHA_DSS = { pubkey="dsa", type = "srp", pfs = true, server_key_exchange = KEX_ALGORITHMS.SRP_SHA.server_key_exchange } KEX_ALGORITHMS.SRP_SHA_RSA = { pubkey="rsa", type = "srp", pfs = true, server_key_exchange = KEX_ALGORITHMS.SRP_SHA.server_key_exchange } -- RFC 6101 KEX_ALGORITHMS.FORTEZZA_KEA={} -- RFC 4491 KEX_ALGORITHMS.GOSTR341001={} KEX_ALGORITHMS.GOSTR341094={} -- RFC 2712 KEX_ALGORITHMS.KRB5={} KEX_ALGORITHMS.KRB5_EXPORT={ export=true, } -- TLSv1.3 KEX_ALGORITHMS.AKE = { tls13ok=true, tls13only=true, pfs=true, -- TLSv1.3 swaps the ServerKeyExchange message for the key_share extension. -- We'll just pretend that's what this is: server_key_exchange = function (blob, protocol) local named_group, pos = unpack(">I2", blob) stdnse.debug1("named_group = %d", named_group) named_group = find_key(ELLIPTIC_CURVES, named_group) local gtype, strength = named_group_info(named_group) return { type = gtype, strength = strength, ecdhparams={ -- Not always ECC, but reusing structure simplifies things curve_params={ ec_curve_type = "namedcurve", curve = named_group, } } } end, } -- RFC 8492 KEX_ALGORITHMS.ECCPWD = { tls13ok=true, tls13only=false, } local algorithms = { ["3DES"] = {s=112, b=64}, --NIST SP 800-57 CHACHA20 = {s=256, b=128}, IDEA = {s=128, b=64}, SEED = {s=128, b=128}, FORTEZZA = {s=80, b=64}, DES = {s=56, b=64}, RC2 = {s=40, b=64}, DES40 = {s=40, b=64}, NULL = {s=0}, CAMELLIA = {b=128}, ARIA = {b=128}, AES = {b=128}, SM4 = {s=128, b=128}, AEGIS_256 = {s=256, b=128}, AEGIS_128L = {s=128, b=256}, } --- Get info about a cipher suite -- -- Returned table has "kex", "cipher", "mode", "size", and -- "hash" keys, as well as boolean flag "draft". The "draft" -- flag is only supported for some suites that have different enumeration -- values in draft versus final RFC. -- @param c The cipher suite name, e.g. TLS_RSA_WITH_AES_128_GCM_SHA256 -- @return A table of info as described above. function cipher_info (c) local info = cipher_info_cache[c] if info then return info end local tokens = stringaux.strsplit("_", c) local i = 1 if tokens[i] ~= "TLS" and tokens[i] ~= "SSL" then stdnse.debug2("cipher_info: Not a TLS ciphersuite: %s", c) return nil end -- kex, cipher, size, mode, hash i = i + 1 while tokens[i] and tokens[i] ~= "WITH" do i = i + 1 end local kex = concat(tokens, "_", 2, i-1) info = KEX_ALGORITHMS[kex] if info then info = tableaux.tcopy(info) info.kex = kex else info = {kex = kex} end if tokens[i] and tokens[i] ~= "WITH" then stdnse.debug2("cipher_info: Can't parse (no WITH): %s", c) return nil end -- cipher i = i + 1 local t = tokens[i] info.cipher = t if t == "3DES" then i = i + 1 -- 3DES_EDE elseif t == "AEGIS" then i = i + 1 t = ("%s_%s"):format(t, tokens[i]) end -- key size local tmp = algorithms[t] if tmp then info.size = tmp.s info.block_size = tmp.b end if info.size == nil then i = i + 1 info.size = tonumber(tokens[i]) end -- stream ciphers don't have a mode if info.cipher == "RC4" then info.mode = "stream" elseif info.cipher == "CHACHA20" then i = i + 1 info.cipher = "CHACHA20-POLY1305" info.mode = "stream" elseif info.cipher ~= "NULL" then i = i + 1 info.mode = tokens[i] end -- export key size override if info.export and tonumber(tokens[i+1]) then i = i + 1 info.size = tonumber(tokens[i]) end -- Other key size overrides if info.cipher == "RC4" then -- RFC 7465 prohibits RC4 in TLS info.size = math.min(info.size or 80, 80) -- Equivalently caps to C grade? end -- hash if info.mode == "CCM" then info.hash = "SHA256" end i = i + 1 if i <= #tokens then if tokens[i] == "8" and info.mode == "CCM" then info.mode = "CCM_8" i = i + 1 elseif info.export and (tokens[i]):match("^%d+$") then info.size = tonumber(tokens[i]) i = i + 1 end if i <= #tokens then local t, w = (tokens[i]):match("(.+)%-([a-z]+)") if t then if w == "draft" then info.draft = true end -- else "or" else t = tokens[i] end info.hash = t end end cipher_info_cache[c] = info return info end SCSVS = { ["TLS_EMPTY_RENEGOTIATION_INFO_SCSV"] = 0x00FF, -- rfc5746 ["TLS_FALLBACK_SCSV"] = 0x5600, -- rfc7507 } handshake_parse = { server_hello = function (buffer, j, msg_end, protocol) local b = {} -- Parse body. b.protocol, b.time, b.random, b.session_id, j = unpack(">I2 I4 c28 s1", buffer, j) b.cipher, b.compressor, j = unpack(">I2 B", buffer, j) -- Optional extensions for TLS only if j < msg_end and protocol ~= "SSLv3" then local num_exts b["extensions"] = {} num_exts, j = unpack(">I2", buffer, j) for e = 0, num_exts do if j >= msg_end then break end local extcode, datalen extcode, j = unpack(">I2", buffer, j) extcode = find_key(EXTENSIONS, extcode) or extcode b["extensions"][extcode], j = unpack(">s2", buffer, j) end end -- Convert to human-readable form. b["protocol"] = find_key(PROTOCOLS, b["protocol"]) b["cipher"] = find_key(CIPHERS, b["cipher"]) b["compressor"] = find_key(COMPRESSORS, b["compressor"]) -- RFC 8446: HelloRetryRequest message uses the same structure as the -- ServerHello, but with Random set to the special value of the SHA-256 -- of "HelloRetryRequest" if b.protocol == "TLSv1.2" -- TLSv1.3 legacy version and b.random == "\xCF\x21\xAD\x74\xE5\x9A\x61\x11\xBE\x1D\x8C\x02\x1E\x65\xB8\x91\xC2\xA2\x11\x16\x7A\xBB\x8C\x5E\x07\x9E\x09\xE2\xC8\xA8\x33\x9C" then b.helloretry = true end -- RFC 8446: "the legacy_version field MUST be set to 0x0303, -- which is the version number for TLS 1.2" if (b.protocol == "TLSv1.2" and b.extensions and b.extensions.supported_versions == "\x03\x04") then b.protocol = "TLSv1.3" end return b, j end, certificate = function (buffer, j, msg_end, protocol) local cert_end cert_end, j = unpack(">I3", buffer, j) cert_end = cert_end + j if cert_end > msg_end then stdnse.debug2("server_certificate length > handshake body length!") end local b = {certificates = {}} while j < cert_end do local cert_len = unpack(">I3", buffer, j) if cert_len + 3 + j > cert_end then stdnse.debug1("server_certificate parsing error!") j = cert_end break end local cert cert, j = unpack(">s3", buffer, j) -- parse these with sslcert.parse_ssl_certificate insert(b["certificates"], cert) end return b, j end, NewSessionTicket = function (buffer, j, msg_end, protocol) -- Need 4 bytes for parsing. local have = #buffer - j + 1 if have < 4 then return nil, j, 4 end local b = {} -- Parse body. b.ticket_lifetime_hint, b.ticket, j = unpack(">I4 s2", buffer, j) return b, j end, } message_parse = { alert = function (buffer, j) local b = {} -- Parse body. b.level, b.description, j = unpack("BB", buffer, j) -- Convert to human-readable form. b["level"] = find_key(TLS_ALERT_LEVELS, b["level"]) b["description"] = find_key(TLS_ALERT_REGISTRY, b["description"]) return b, j end, handshake = function (buffer, j, protocol) -- Check for message fragmentation. -- Need 4 bytes for message header with length local have = #buffer - j + 1 if have < 4 then return nil, j, 4 end -- Parse body. local btype, len btype, len, j = unpack("B>I3", buffer, j) local msg_end = len + j -- Convert to human-readable form. btype = find_key(TLS_HANDSHAKETYPE_REGISTRY, btype) -- Check for message fragmentation. -- Need 4 bytes for header plus length of message if have < len + 4 then return nil, j - 4, len + 4 end local parser = handshake_parse[btype] local b if parser then b, j = parser(buffer, j, msg_end, protocol) b.type = btype else -- TODO: implement other handshake message types b = { type = btype } stdnse.debug2("Unknown handshake message type: %s", b["type"]) b.data, j = unpack("c" .. msg_end - j, buffer, j) end return b, j end, heartbeat = function (buffer, j) local b = {} b.type, b.payload, j = unpack(">B s2", buffer, j) -- Heartbeat messages are one per record; consume the rest of the record as padding. b.padding = buffer:sub(j) return b, #buffer + 1 end, } --- Parse a series of TLS messages from a buffer --@param mbuffer The buffer to parse --@param mi The index into that buffer to begin parsing --@param h The TLS/DTLS header. Must contain "type" and "protocol" fields --@return A table of parsed messages --@return The position where parsing stopped function parse_messages (mbuffer, mi, h) local messages = {} while mi < #mbuffer do -- RFC 2246, 6.2.1 "multiple client messages of the same ContentType may -- be coalesced into a single TLSPlaintext record" local parser = message_parse[h.type] if not parser then stdnse.debug1("Unknown message type: %s", h["type"]) break end local b, need b, mi, need = parser(mbuffer, mi, h.protocol) if b then messages[#messages+1] = b elseif need then -- Can't finish parsing this message, it'll be left in the fragment break end end return messages, mi end --- -- Read a SSL/TLS record -- @param buffer The read buffer -- @param i The position in the buffer to start reading (default: 1) -- @param fragment Message fragment left over from previous record (nil if none) -- @return The current position in the buffer -- @return The record that was read, as a table -- @return Whether parsing can continue if more data becomes available. function record_read(buffer, i, fragment) i = i or 1 -- Ensure we have enough data for the header. if #buffer - i < TLS_RECORD_HEADER_LENGTH then return i, nil, true end -- Parse header. local h = {} local typ, proto, rlength, j = unpack(">B I2 I2", buffer, i) h.length = rlength local name = find_key(TLS_CONTENTTYPE_REGISTRY, typ) if name == nil then stdnse.debug1("Unknown TLS ContentType: %d", typ) return j, nil, false end h["type"] = name name = find_key(PROTOCOLS, proto) if name == nil then stdnse.debug1("Unknown TLS Protocol: 0x%04x", proto) return j, nil, false end h["protocol"] = name -- Ensure we have enough data for the body. if #buffer < j + rlength - 1 then return i, nil, true end -- Adjust buffer and length to account for message fragment left over -- from last record. local mbuffer if fragment then mbuffer = fragment .. buffer:sub(j, j + rlength) else mbuffer = buffer:sub(j, j + rlength) end -- Body local mi = 1 h.body, mi = parse_messages(mbuffer, mi, h) if mi < #mbuffer then -- Fragmented message h.fragment = mbuffer:sub(mi) end -- Skip to the end of the record. Ignore unparsed bytes. -- These should be handled as fragmentation above j = j + rlength return j, h, true end --- -- Get the record version field appropriate for the protocol version -- -- TLSv1.3 introduced a change in the interpretation of the record version -- field. Previously, this was an indication of the TLS protocol, but now it is -- frozen at TLSv1.2. -- @param proto_version The numeric value of the protocol, e.g. 0x0303 for TLSv1.2 -- @return The numeric value that should be used in the record layer version field local function legacy_version (proto_version) -- TLSv1.2 was the last version where protocol version was negotiated via the -- record layer version. Later versions use the supported_versions extension return proto_version <= 0x0303 and proto_version or 0x0303 end function record_version_ok(received_version, proto_version) if proto_version == "TLSv1.3" then return received_version == "TLSv1.2" end return proto_version == received_version end --- -- Build a SSL/TLS record -- @param type The type of record ("handshake", "change_cipher_spec", etc.) -- @param protocol The protocol and version ("SSLv3", "TLSv1.0", etc.) -- @param b The record body -- @return The SSL/TLS record as a string function record_write(type, protocol, b) return concat({ -- Set the header as a handshake. pack("B", TLS_CONTENTTYPE_REGISTRY[type]), -- Set the protocol. pack(">I2", legacy_version(PROTOCOLS[protocol])), -- Set the length of the header body. pack(">s2", b) }) end -- Claim to support common hash and signature algorithm combinations (TLSv1.2 only) -- local DEFAULT_SIGALGS do local sigalgs = { -- most likely signature is rsa, so even use it for weak hashes {"md5","rsa"}, {"sha1","rsa"}, {"sha224","rsa"}, -- most likely is sha256 {"sha256","rsa"}, {"sha256","dsa"}, {"sha256","ecdsa"}, {"sha384","rsa"}, {"sha384","ecdsa"}, {"sha512","rsa"}, {"sha512","ecdsa"}, {"intrinsic","ed25519"}, {"intrinsic","ed448"}, } DEFAULT_SIGALGS = EXTENSION_HELPERS["signature_algorithms"](sigalgs) end -- Equivalent for TLSv1.3 is SignatureScheme -- We'll offer all the sha256 and sha512 variants, plus a few extra local DEFAULT_SIGSCHEMES do local sigalgs = { "rsa_pkcs1_sha256", "rsa_pkcs1_sha512", "ecdsa_secp256r1_sha256", "ecdsa_secp521r1_sha512", "rsa_pss_rsae_sha256", "rsa_pss_rsae_sha512", "ed25519", "ed448", "rsa_pss_pss_sha256", "rsa_pss_pss_sha512", "rsa_pkcs1_sha1", "ecdsa_sha1", "mldsa44", } DEFAULT_SIGSCHEMES = EXTENSION_HELPERS["signature_algorithms_13"](sigalgs) end --- -- Build a client_hello message -- -- The options table has the following keys: -- * <code>"protocol"</code> - The TLS protocol version string for the client_hello. This indicates the highest protocol version supported. -- * <code>"record_protocol"</code> - The TLS protocol version string for the TLS record. This indicates the lowest protocol version supported. -- * <code>"ciphers"</code> - a table containing the cipher suite names. Defaults to the NULL cipher -- * <code>"compressors"</code> - a table containing the compressor names. Default: NULL -- * <code>"extensions"</code> - a table containing the extension names. Default: no extensions -- @param t Table of options -- @return The client_hello record as a string function client_hello(t) local b, ciphers, compressor, compressors, h, len t = t or {} ---------- -- Body -- ---------- b = {} -- Set the protocol. local protocol = t["protocol"] or HIGHEST_PROTOCOL insert(b, pack(">I2 I4", legacy_version(PROTOCOLS[protocol]), -- Set the random data. os.time() )) local record_proto = t.record_protocol -- Set the random data. insert(b, rand.random_string(28)) -- Set the session ID. local sid = t["session_id"] or "" insert(b, pack(">s1", sid)) local eccpwd = false local shangmi = false -- Cipher suites. ciphers = {} -- Add specified ciphers. for _, cipher in pairs(t.ciphers -- user-specified list or (record_proto == "TLSv1.3" and DEFAULT_TLS13_CIPHERS) -- TLSv1.3 only or (PROTOCOLS[protocol] < PROTOCOLS["TLSv1.3"] and DEFAULT_TLS12_CIPHERS) -- non-TLSv1.3 or DEFAULT_CIPHERS) -- combined/compatible handshake do if type(cipher) == "string" then if cipher:match("^TLS_ECCPWD_") then -- RFC 8492 has specific requirements eccpwd = true elseif protocol == "TLSv1.3" and cipher:match("_SM3$") then -- RFC 8998 has specific requirements shangmi = true end cipher = CIPHERS[cipher] or SCSVS[cipher] end if type(cipher) == "number" and cipher >= 0 and cipher <= 0xffff then insert(ciphers, pack(">I2", cipher)) else stdnse.debug1("Unknown cipher in client_hello: %s", cipher) end end insert(b, pack(">s2", concat(ciphers))) -- Compression methods. compressors = {} if t["compressors"] ~= nil then -- Add specified compressors. for _, compressor in pairs(t["compressors"]) do if compressor ~= "NULL" then insert(compressors, pack("B", COMPRESSORS[compressor])) end end end -- Always include NULL as last choice insert(compressors, pack("B", COMPRESSORS["NULL"])) insert(b, pack("s1", concat(compressors))) -- TLS extensions local proto_ver = PROTOCOLS[protocol] if proto_ver and protocol ~= "SSLv3" then local extensions = {} -- TLSv1.3 requires supported_versions and key_share extensions -- OpenSSL also appears to want supported_groups in some cases? local need_supported_versions = (proto_ver >= PROTOCOLS["TLSv1.3"]) local need_key_share = need_supported_versions local need_elliptic_curves = need_supported_versions -- Do we need to add the signature_algorithms extension? local need_sigalg = (proto_ver >= PROTOCOLS["TLSv1.2"]) -- Add specified extensions. if t.extensions then for extension, data in pairs(t["extensions"]) do if type(extension) == "number" then insert(extensions, pack(">I2", extension)) else if extension == "signature_algorithms" or extension == "signature_algorithms_13" then need_sigalg = false if shangmi then local sm2sig_sm3 = pack(">I2", SignatureSchemes.sm2sig_sm3) if not data:match("^..(..)*" .. sm2sig_sm3) then data = pack(">s2", data:sub(3) .. sm2sig_sm3) end end elseif extension == "supported_versions" then need_supported_versions = false elseif extension == "key_share" then need_key_share = false elseif extension == "elliptic_curves" then need_elliptic_curves = false if shangmi then -- For now, RFC 8998 is the only one that enforces particular curves local curveSM2 = pack(">I2", ELLIPTIC_CURVES.curveSM2) if not data:match("^..(..)*" .. curveSM2) then data = pack(">s2", data:sub(3) .. curveSM2) end end end insert(extensions, pack(">I2", EXTENSIONS[extension])) end insert(extensions, pack(">s2", data)) end end if need_supported_versions then insert(extensions, pack(">I2", EXTENSIONS["supported_versions"])) -- We'd prefer TLS 1.2 or 1.1, since we've tested our scripts on those. insert(extensions, pack(">s2", EXTENSION_HELPERS["supported_versions"]({"TLSv1.2", "TLSv1.1", "TLSv1.3", "SSLv3"}))) end if need_sigalg then insert(extensions, pack(">I2", EXTENSIONS["signature_algorithms"])) local data = proto_ver >= PROTOCOLS["TLSv1.3"] and DEFAULT_SIGSCHEMES or DEFAULT_SIGALGS if shangmi then data = pack(">s2", data:sub(3) .. pack(">I2", SignatureSchemes.sm2sig_sm3)) end insert(extensions, pack(">s2", data)) end if need_key_share then -- RFC 8446: Clients MAY send an empty client_shares vector in order to request -- group selection from the server, at the cost of an additional round trip insert(extensions, pack(">I2", EXTENSIONS["key_share"])) insert(extensions, pack(">s2", "\0\0")) end if need_elliptic_curves then local curves = {table.unpack(DEFAULT_ELLIPTIC_CURVES)} if shangmi then curves[#curves+1] = "curveSM2" end insert(extensions, pack(">I2", EXTENSIONS["elliptic_curves"])) insert(extensions, pack(">s2", EXTENSION_HELPERS["elliptic_curves"](curves))) end -- Extensions are optional if #extensions ~= 0 then insert(b, pack(">s2", concat(extensions))) end end ------------ -- Header -- ------------ b = concat(b) h = {} -- Set type to ClientHello. insert(h, pack("B", TLS_HANDSHAKETYPE_REGISTRY["client_hello"])) -- Set the length of the body. insert(h, pack(">s3", b)) -- Record layer version should be SSLv3 (lowest compatible record version) -- But some implementations (OpenSSL) will not finish a handshake that could -- be downgraded by a MITM to SSLv3. So we use TLSv1.0 unless the caller -- explicitly tries to set SSLv3.0 somewhere (t.record_protocol or -- t.protocol) if not record_proto then record_proto = (t.protocol == "SSLv3") and "SSLv3" or "TLSv1.0" elseif record_proto == "TLSv1.3" then -- RFC 8446: "MUST be set to 0x0303 for all records generated by a TLS 1.3 -- implementation other than an initial ClientHello (i.e., one not generated -- after a HelloRetryRequest), where it MAY also be 0x0301 for compatibility -- purposes. record_proto = "TLSv1.2" end return record_write("handshake", record_proto, concat(h)) end local function read_atleast(s, n) local buf = {} local count = 0 while count < n do local status, data = s:receive_bytes(n - count) if not status then return status, data, concat(buf) end buf[#buf+1] = data count = count + #data end return true, concat(buf) end --- Get an entire record into a buffer -- -- Caller is responsible for closing the socket if necessary. -- @param sock The socket to read additional data from -- @param buffer The string buffer holding any previously-read data -- (default: "") -- @param i The position in the buffer where the record should start -- (default: 1) -- @return status Socket status -- @return Buffer containing at least 1 record if status is true -- @return Error text if there was an error function record_buffer(sock, buffer, i) buffer = buffer or "" i = i or 1 local count = #buffer:sub(i) local status, resp, rem if count < TLS_RECORD_HEADER_LENGTH then status, resp, rem = read_atleast(sock, TLS_RECORD_HEADER_LENGTH - count) if not status then return false, buffer .. rem, resp end buffer = buffer .. resp count = count + #resp end -- ContentType, ProtocolVersion, length local ctype, pversion, len = unpack(">BI2I2", buffer, i) if not TLS_PROTOCOL_VERSIONS[pversion] or not TLS_CONTENTTYPES[ctype] then return false, buffer, "Unknown TLS protocol version or content type" end if count < TLS_RECORD_HEADER_LENGTH + len then status, resp = read_atleast(sock, TLS_RECORD_HEADER_LENGTH + len - count) if not status then return false, buffer, resp end buffer = buffer .. resp end return true, buffer end -- Get a server_name for use with the TLS Server Name Indication extension. -- -- This returns the value of the script argument "tls.servername" if given. Otherwise, it -- returns the target name of the host parameter. -- -- @param host Host table as received by the action function -- @return String of the selected host name function servername(host) local script_arg = stdnse.get_script_args("tls.servername") if script_arg then return script_arg elseif type(host) == "table" then return host.targetname end end local unittest = require "unittest" if not unittest.testing() then return _ENV end test_suite = unittest.TestSuite:new() for name, code in pairs(CIPHERS) do test_suite:add_test(unittest.not_nil(cipher_info(name).kex), name .. ".kex") end return _ENV;