From aff809de7530bc424bee096a88f916aa6a728a86 Mon Sep 17 00:00:00 2001 From: Peter Dettman Date: Wed, 11 May 2022 15:05:33 +0700 Subject: (D)TLS: now defaults to offering (D)TLS 1.2, TLS 13 --- crypto/Readme.html | 22 ++++++++++++++++++++++ crypto/src/tls/AbstractTlsPeer.cs | 3 +-- crypto/src/tls/DefaultTlsClient.cs | 6 +++--- crypto/src/tls/DefaultTlsServer.cs | 8 ++++---- crypto/src/tls/PskTlsClient.cs | 2 +- crypto/src/tls/PskTlsServer.cs | 2 +- crypto/src/tls/SrpTlsClient.cs | 2 +- crypto/src/tls/SrpTlsServer.cs | 2 +- crypto/test/src/tls/test/MockDtlsClient.cs | 2 +- crypto/test/src/tls/test/MockDtlsServer.cs | 2 +- 10 files changed, 36 insertions(+), 15 deletions(-) diff --git a/crypto/Readme.html b/crypto/Readme.html index ac9efdb33..f7d2fec3f 100644 --- a/crypto/Readme.html +++ b/crypto/Readme.html @@ -30,6 +30,8 @@
  • Notes:
      +
    1. + Release 2.0.0
    2. Release 1.9.0
    3. @@ -310,6 +312,26 @@ We state, where EC MQV has not otherwise been disabled or removed:

      Notes:

      +

      Release 2.0.0, TBD

      + +
      Defects Fixed
      +
        +
      +
      Additional Features and Functionality
      +
        +
      • + (D)TLS: By default, only (D)TLS 1.2 and TLS 1.3 are offered now. Earlier versions are still supported + if explicitly enabled. Users may need to check they are offering suitable cipher suites for TLS 1.3. +
        • +
      +
      Additional Notes
      +
        +
      • + See the (cumulative) list of GitHub pull requests that we have accepted at + bcgit/bc-csharp. +
        • +
      +

      Release 1.9.0, Sunday October 17, 2021

      Defects Fixed
      diff --git a/crypto/src/tls/AbstractTlsPeer.cs b/crypto/src/tls/AbstractTlsPeer.cs index 6d29953ee..4e1b28e58 100644 --- a/crypto/src/tls/AbstractTlsPeer.cs +++ b/crypto/src/tls/AbstractTlsPeer.cs @@ -26,8 +26,7 @@ namespace Org.BouncyCastle.Tls /// an array of supported values. protected virtual ProtocolVersion[] GetSupportedVersions() { - // TODO[tls13] Enable TLSv13 by default in due course - return ProtocolVersion.TLSv12.DownTo(ProtocolVersion.TLSv10); + return ProtocolVersion.TLSv13.DownTo(ProtocolVersion.TLSv12); } protected abstract int[] GetSupportedCipherSuites(); diff --git a/crypto/src/tls/DefaultTlsClient.cs b/crypto/src/tls/DefaultTlsClient.cs index a2a742633..00827b5e7 100644 --- a/crypto/src/tls/DefaultTlsClient.cs +++ b/crypto/src/tls/DefaultTlsClient.cs @@ -10,10 +10,10 @@ namespace Org.BouncyCastle.Tls private static readonly int[] DefaultCipherSuites = new int[] { /* - * TODO[tls13] TLS 1.3 + * TLS 1.3 */ - //CipherSuite.TLS_CHACHA20_POLY1305_SHA256, - //CipherSuite.TLS_AES_128_GCM_SHA256, + CipherSuite.TLS_CHACHA20_POLY1305_SHA256, + CipherSuite.TLS_AES_128_GCM_SHA256, /* * pre-TLS 1.3 diff --git a/crypto/src/tls/DefaultTlsServer.cs b/crypto/src/tls/DefaultTlsServer.cs index de8a3f4a0..edab24b71 100644 --- a/crypto/src/tls/DefaultTlsServer.cs +++ b/crypto/src/tls/DefaultTlsServer.cs @@ -11,11 +11,11 @@ namespace Org.BouncyCastle.Tls private static readonly int[] DefaultCipherSuites = new int[] { /* - * TODO[tls13] TLS 1.3 + * TLS 1.3 */ - //CipherSuite.TLS_CHACHA20_POLY1305_SHA256, - //CipherSuite.TLS_AES_256_GCM_SHA384, - //CipherSuite.TLS_AES_128_GCM_SHA256, + CipherSuite.TLS_CHACHA20_POLY1305_SHA256, + CipherSuite.TLS_AES_256_GCM_SHA384, + CipherSuite.TLS_AES_128_GCM_SHA256, /* * pre-TLS 1.3 diff --git a/crypto/src/tls/PskTlsClient.cs b/crypto/src/tls/PskTlsClient.cs index 3e9a00390..c475be63b 100644 --- a/crypto/src/tls/PskTlsClient.cs +++ b/crypto/src/tls/PskTlsClient.cs @@ -34,7 +34,7 @@ namespace Org.BouncyCastle.Tls protected override ProtocolVersion[] GetSupportedVersions() { - return ProtocolVersion.TLSv12.DownTo(ProtocolVersion.TLSv10); + return ProtocolVersion.TLSv12.Only(); } protected override int[] GetSupportedCipherSuites() diff --git a/crypto/src/tls/PskTlsServer.cs b/crypto/src/tls/PskTlsServer.cs index 7197b6ad8..968cd5ce3 100644 --- a/crypto/src/tls/PskTlsServer.cs +++ b/crypto/src/tls/PskTlsServer.cs @@ -40,7 +40,7 @@ namespace Org.BouncyCastle.Tls protected override ProtocolVersion[] GetSupportedVersions() { - return ProtocolVersion.TLSv12.DownTo(ProtocolVersion.TLSv10); + return ProtocolVersion.TLSv12.Only(); } protected override int[] GetSupportedCipherSuites() diff --git a/crypto/src/tls/SrpTlsClient.cs b/crypto/src/tls/SrpTlsClient.cs index a2b0e9461..f6f6472bc 100644 --- a/crypto/src/tls/SrpTlsClient.cs +++ b/crypto/src/tls/SrpTlsClient.cs @@ -34,7 +34,7 @@ namespace Org.BouncyCastle.Tls protected override ProtocolVersion[] GetSupportedVersions() { - return ProtocolVersion.TLSv12.DownTo(ProtocolVersion.TLSv10); + return ProtocolVersion.TLSv12.Only(); } protected virtual bool RequireSrpServerExtension diff --git a/crypto/src/tls/SrpTlsServer.cs b/crypto/src/tls/SrpTlsServer.cs index 58f89ee22..1e2f09e03 100644 --- a/crypto/src/tls/SrpTlsServer.cs +++ b/crypto/src/tls/SrpTlsServer.cs @@ -44,7 +44,7 @@ namespace Org.BouncyCastle.Tls protected override ProtocolVersion[] GetSupportedVersions() { - return ProtocolVersion.TLSv12.DownTo(ProtocolVersion.TLSv10); + return ProtocolVersion.TLSv12.Only(); } protected override int[] GetSupportedCipherSuites() diff --git a/crypto/test/src/tls/test/MockDtlsClient.cs b/crypto/test/src/tls/test/MockDtlsClient.cs index 5aa1ebbd3..deef119ca 100644 --- a/crypto/test/src/tls/test/MockDtlsClient.cs +++ b/crypto/test/src/tls/test/MockDtlsClient.cs @@ -109,7 +109,7 @@ namespace Org.BouncyCastle.Tls.Tests protected override ProtocolVersion[] GetSupportedVersions() { - return ProtocolVersion.DTLSv12.DownTo(ProtocolVersion.DTLSv10); + return ProtocolVersion.DTLSv12.Only(); } internal class MyTlsAuthentication diff --git a/crypto/test/src/tls/test/MockDtlsServer.cs b/crypto/test/src/tls/test/MockDtlsServer.cs index 18e53628e..b3ea7f91c 100644 --- a/crypto/test/src/tls/test/MockDtlsServer.cs +++ b/crypto/test/src/tls/test/MockDtlsServer.cs @@ -140,7 +140,7 @@ namespace Org.BouncyCastle.Tls.Tests protected override ProtocolVersion[] GetSupportedVersions() { - return ProtocolVersion.DTLSv12.DownTo(ProtocolVersion.DTLSv10); + return ProtocolVersion.DTLSv12.Only(); } } } -- cgit 1.5.1