Upgrade TLS1.2 to TLS1.3 #1101
Closed
Upgrade TLS1.2 to TLS1.3 #1101
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
(Seems unavoidable since HKDF is used in TLS1.3's key schedule)
Note: this is the commit that was really needed to swap for TLS1.3; all previous commits were an attempt to patch the current implementation towards 1.3, but that was long and error-prone. This is a clean change on top of the copy-pasted reference implementation Note2: Grading is still not updated to 1.3 Note3: I didn't update/run the tests (which the reference implementation do not have)
This was referenced Apr 22, 2020
|
Hi, @lbarman ! I'll probably will start working on these tasks to finish this PR.. is it ok with you? |
|
Hey @claucece, absolutely! thanks :) |
|
@lbarman I see why is needed now: because of go 1.12 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello, this is a work in progress which aims at upgrading the TLS version to 1.3 in the scan functionality. This follows issue #1089.
I'll update this PR with the relevant info as I progress. Comments along the way are welcome !
This superseeds #1098
Warning
This PR updates replaces the current TLS1.2 implementation with the TLS1.3 implementation from Go 1.13.9. It is enabled by default.
It adds the following modules:
Roadmap
My goal:
cfssl scan -family TLSHandshake google.comworks and uses TLS1.3 instead of 1.2Status
cfssl scan -family TLSSession google.com:TODOs:
cfsslscanto work with the interface of TLS1.3 (slightly different than 1.2)Questions / Decisions to be made
Add a CLI option to explicitly scan in 1.2 or 1.3 ?