From 5cba65cd46329cb2a5402c72a976ac2bd1fc2abb Mon Sep 17 00:00:00 2001 From: Jason Riddle <2156866+jason-riddle@users.noreply.github.com> Date: Wed, 26 Feb 2020 10:29:40 -0800 Subject: [PATCH] Add additional TLS 1.3 cipher suites (#208) The new TLS 1.3 cipher suites do not specify the key exchange algorithm and as a result "_WITH_" is no longer present. --- lib/tls.go | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/lib/tls.go b/lib/tls.go index f35622b..e05860d 100644 --- a/lib/tls.go +++ b/lib/tls.go @@ -180,10 +180,11 @@ func parseRawSubject(subject []byte) (pkix.Name, error) { // Fill in a human readable name, extracted from the slug func explainCipher(d description) description { kexAndCipher := strings.Split(d.Slug, "_WITH_") - if len(kexAndCipher) < 2 { - return d + if len(kexAndCipher) == 2 { + d.Name = fmt.Sprintf("%s key exchange, %s cipher", kexAndCipher[0][len("TLS_"):], kexAndCipher[1]) + } else { + d.Name = fmt.Sprintf("%s cipher", d.Slug[len("TLS_"):]) } - d.Name = fmt.Sprintf("%s key exchange, %s cipher", kexAndCipher[0][len("TLS_"):], kexAndCipher[1]) return d } @@ -210,4 +211,10 @@ var cipherSuites = map[uint16]description{ tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: {"", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", good}, tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305: {"", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", good}, tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305: {"", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", good}, + + tls.TLS_AES_128_GCM_SHA256: {"", "TLS_AES_128_GCM_SHA256", good}, + tls.TLS_AES_256_GCM_SHA384: {"", "TLS_AES_256_GCM_SHA384", good}, + tls.TLS_CHACHA20_POLY1305_SHA256: {"", "TLS_CHACHA20_POLY1305_SHA256", good}, + + tls.TLS_FALLBACK_SCSV: {"", "TLS_FALLBACK_SCSV", insecure}, }