Skip to content

Add TLS 1.3 support (basic) #2146

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Jul 25, 2019
Merged

Conversation

romain-perez
Copy link
Contributor

This PR adds new TLS 1.3 messages and extensions and support only basic 1-RTT handshake :

  • Update the key schedule
  • Update the parsing of TLS 1.3 extensions
  • Add authentication and verification of additional data
  • tls13.uts is test vectors for Simple 1-RTT Handshake (section 3, RFC8448)

TODO (next PRs) :

  • Client and server TLS 1.3 automatons
  • Support for 0-RTT
  • Support HelloRetryRequest
  • Support for client authentication

@romain-perez romain-perez mentioned this pull request Jul 15, 2019
9 tasks
@gpotter2 gpotter2 added the tls label Jul 15, 2019
@guedou
Copy link
Member

guedou commented Jul 16, 2019

It seems that most of the tests fail due to random errors in the TLS 1.3 automaton.

You can fix the tests named py27-linux_non_root_old-cryptography either:

All ways are fine and mean "do not use the old cryptography module to perform TLS 1.3 tests".

@codecov
Copy link

codecov bot commented Jul 16, 2019

Codecov Report

Merging #2146 into master will decrease coverage by 0.36%.
The diff coverage is 49.61%.

@@            Coverage Diff            @@
##           master   #2146      +/-   ##
=========================================
- Coverage   87.36%     87%   -0.37%     
=========================================
  Files         200     200              
  Lines       45454   45617     +163     
=========================================
- Hits        39711   39687      -24     
- Misses       5743    5930     +187
Impacted Files Coverage Δ
scapy/layers/tls/crypto/hkdf.py 82.22% <100%> (-17.78%) ⬇️
scapy/layers/tls/keyexchange.py 82.75% <100%> (-0.22%) ⬇️
scapy/layers/tls/session.py 69.21% <24.63%> (-9.09%) ⬇️
scapy/layers/tls/crypto/cipher_aead.py 81.73% <25%> (-0.2%) ⬇️
scapy/layers/tls/keyexchange_tls13.py 46.11% <31.25%> (-8.54%) ⬇️
scapy/layers/tls/handshake.py 69.72% <49.09%> (-11.35%) ⬇️
scapy/layers/tls/record.py 89.27% <73.33%> (-2.83%) ⬇️
scapy/layers/tls/record_tls13.py 63.33% <78.57%> (+2.97%) ⬆️
scapy/layers/tls/extensions.py 81.04% <96.29%> (+1.25%) ⬆️
... and 13 more

Copy link
Member

@guedou guedou left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome PR! I am glad that we will be able to include it in v2.4.3.

guedou
guedou previously approved these changes Jul 17, 2019
Copy link
Member

@guedou guedou left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice PR thanks for your answers!

@guedou
Copy link
Member

guedou commented Jul 17, 2019

@gpotter2 @p-l- what is your call?

Copy link
Member

@gpotter2 gpotter2 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Really awesome PR !
I only have one comment

@gpotter2 gpotter2 mentioned this pull request Jul 17, 2019
27 tasks
gpotter2
gpotter2 previously approved these changes Jul 24, 2019
@gpotter2 gpotter2 dismissed stale reviews from guedou and themself via 301b2b2 July 24, 2019 20:27
@guedou guedou merged commit 38fcc4a into secdev:master Jul 25, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants