Skip to content

Commit 4fe18b8

Browse files
alexw91alexw91
committed
Migrate PQ Python code to TLS 1.3
1 parent 23209c4 commit 4fe18b8

File tree

2 files changed

+18
-136
lines changed

2 files changed

+18
-136
lines changed

‎tests/integrationv2/common.py

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -318,18 +318,6 @@ class Ciphers(object):
318318

319319
KMS_TLS_1_0_2018_10 = Cipher(
320320
"KMS-TLS-1-0-2018-10", Protocols.TLS10, False, False, s2n=True)
321-
KMS_PQ_TLS_1_0_2019_06 = Cipher(
322-
"KMS-PQ-TLS-1-0-2019-06", Protocols.TLS10, False, False, s2n=True, pq=True)
323-
KMS_PQ_TLS_1_0_2020_02 = Cipher(
324-
"KMS-PQ-TLS-1-0-2020-02", Protocols.TLS10, False, False, s2n=True, pq=True)
325-
KMS_PQ_TLS_1_0_2020_07 = Cipher(
326-
"KMS-PQ-TLS-1-0-2020-07", Protocols.TLS10, False, False, s2n=True, pq=True)
327-
PQ_SIKE_TEST_TLS_1_0_2019_11 = Cipher(
328-
"PQ-SIKE-TEST-TLS-1-0-2019-11", Protocols.TLS10, False, False, s2n=True, pq=True)
329-
PQ_SIKE_TEST_TLS_1_0_2020_02 = Cipher(
330-
"PQ-SIKE-TEST-TLS-1-0-2020-02", Protocols.TLS10, False, False, s2n=True, pq=True)
331-
PQ_TLS_1_0_2020_12 = Cipher(
332-
"PQ-TLS-1-0-2020-12", Protocols.TLS10, False, False, s2n=True, pq=True)
333321
PQ_TLS_1_0_2023_01 = Cipher(
334322
"PQ-TLS-1-0-2023-01-24", Protocols.TLS10, False, False, s2n=True, pq=True)
335323
PQ_TLS_1_3_2023_06_01 = Cipher(

‎tests/integrationv2/test_pq_handshake.py

Lines changed: 18 additions & 124 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,7 @@
1414

1515
CIPHERS = [
1616
None, # `None` will default to the appropriate `test_all` cipher preference in the S2N client provider
17-
Ciphers.KMS_PQ_TLS_1_0_2019_06,
18-
Ciphers.KMS_PQ_TLS_1_0_2020_02,
19-
Ciphers.KMS_PQ_TLS_1_0_2020_07,
20-
Ciphers.PQ_SIKE_TEST_TLS_1_0_2019_11,
21-
Ciphers.PQ_SIKE_TEST_TLS_1_0_2020_02,
2217
Ciphers.KMS_TLS_1_0_2018_10,
23-
Ciphers.PQ_TLS_1_0_2020_12,
2418
Ciphers.PQ_TLS_1_3_2023_06_01,
2519
]
2620

@@ -33,109 +27,9 @@
3327

3428
EXPECTED_RESULTS = {
3529
# The tuple keys have the form (client_{cipher, kem_group}, server_{cipher, kem_group})
36-
(Ciphers.KMS_PQ_TLS_1_0_2019_06, Ciphers.KMS_PQ_TLS_1_0_2019_06):
37-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
38-
"kem": None, "kem_group": None},
39-
(Ciphers.KMS_PQ_TLS_1_0_2019_06, Ciphers.KMS_PQ_TLS_1_0_2020_02):
40-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
41-
"kem": None, "kem_group": None},
42-
(Ciphers.KMS_PQ_TLS_1_0_2019_06, Ciphers.KMS_PQ_TLS_1_0_2020_07):
43-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
44-
"kem": None, "kem_group": None},
45-
46-
(Ciphers.KMS_PQ_TLS_1_0_2020_02, Ciphers.KMS_PQ_TLS_1_0_2019_06):
47-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
48-
"kem": None, "kem_group": None},
49-
(Ciphers.KMS_PQ_TLS_1_0_2020_02, Ciphers.KMS_PQ_TLS_1_0_2020_02):
50-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
51-
"kem": None, "kem_group": None},
52-
(Ciphers.KMS_PQ_TLS_1_0_2020_02, Ciphers.KMS_PQ_TLS_1_0_2020_07):
53-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
54-
"kem": None, "kem_group": None},
55-
56-
(Ciphers.KMS_PQ_TLS_1_0_2020_07, Ciphers.KMS_PQ_TLS_1_0_2019_06):
57-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
58-
"kem": None, "kem_group": None},
59-
(Ciphers.KMS_PQ_TLS_1_0_2020_07, Ciphers.KMS_PQ_TLS_1_0_2020_02):
60-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
61-
"kem": None, "kem_group": None},
62-
(Ciphers.KMS_PQ_TLS_1_0_2020_07, Ciphers.KMS_PQ_TLS_1_0_2020_07):
63-
{"cipher": "ECDHE-KYBER-RSA-AES256-GCM-SHA384",
64-
"kem": "kyber512r3", "kem_group": None},
65-
66-
(Ciphers.PQ_SIKE_TEST_TLS_1_0_2019_11, Ciphers.KMS_PQ_TLS_1_0_2019_06):
67-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
68-
"kem": None, "kem_group": None},
69-
(Ciphers.PQ_SIKE_TEST_TLS_1_0_2019_11, Ciphers.KMS_PQ_TLS_1_0_2020_02):
70-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
71-
"kem": None, "kem_group": None},
72-
(Ciphers.PQ_SIKE_TEST_TLS_1_0_2019_11, Ciphers.KMS_PQ_TLS_1_0_2020_07):
73-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
74-
"kem": None, "kem_group": None},
75-
76-
(Ciphers.PQ_SIKE_TEST_TLS_1_0_2020_02, Ciphers.KMS_PQ_TLS_1_0_2019_06):
77-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
78-
"kem": None, "kem_group": None},
79-
(Ciphers.PQ_SIKE_TEST_TLS_1_0_2020_02, Ciphers.KMS_PQ_TLS_1_0_2020_02):
80-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
81-
"kem": None, "kem_group": None},
82-
(Ciphers.PQ_SIKE_TEST_TLS_1_0_2020_02, Ciphers.KMS_PQ_TLS_1_0_2020_07):
83-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
84-
"kem": None, "kem_group": None},
85-
86-
(Ciphers.KMS_PQ_TLS_1_0_2019_06, Ciphers.KMS_TLS_1_0_2018_10):
87-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
88-
"kem": None, "kem_group": None},
89-
(Ciphers.KMS_PQ_TLS_1_0_2020_02, Ciphers.KMS_TLS_1_0_2018_10):
90-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
91-
"kem": None, "kem_group": None},
92-
(Ciphers.KMS_PQ_TLS_1_0_2020_07, Ciphers.KMS_TLS_1_0_2018_10):
93-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
94-
"kem": None, "kem_group": None},
95-
96-
(Ciphers.KMS_TLS_1_0_2018_10, Ciphers.KMS_PQ_TLS_1_0_2019_06):
97-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
98-
"kem": None, "kem_group": None},
99-
(Ciphers.KMS_TLS_1_0_2018_10, Ciphers.KMS_PQ_TLS_1_0_2020_02):
100-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
101-
"kem": None, "kem_group": None},
102-
(Ciphers.KMS_TLS_1_0_2018_10, Ciphers.KMS_PQ_TLS_1_0_2020_07):
103-
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
104-
"kem": None, "kem_group": None},
105-
106-
# The expected kem_group string for this case purposefully excludes a curve;
107-
# depending on how s2n was compiled, the curve may be either x25519 or one
108-
# of the NIST curves.
109-
(Ciphers.PQ_TLS_1_0_2020_12, Ciphers.PQ_TLS_1_0_2020_12):
110-
{"cipher": "TLS_AES_256_GCM_SHA384",
111-
"kem": None, "kem_group": "_kyber-512-r3"},
112-
(Ciphers.PQ_TLS_1_0_2020_12, Ciphers.PQ_TLS_1_0_2023_01):
113-
{"cipher": "TLS_AES_256_GCM_SHA384",
114-
"kem": None, "kem_group": "_kyber-512-r3"},
11530
(Ciphers.PQ_TLS_1_0_2023_01, Ciphers.PQ_TLS_1_0_2023_01):
11631
{"cipher": "TLS_AES_256_GCM_SHA384",
11732
"kem": None, "kem_group": "_kyber-512-r3"},
118-
(Ciphers.PQ_TLS_1_0_2023_01, Ciphers.PQ_TLS_1_0_2020_12):
119-
{"cipher": "TLS_AES_256_GCM_SHA384",
120-
"kem": None, "kem_group": "_kyber-512-r3"},
121-
(Ciphers.PQ_TLS_1_0_2020_12, Ciphers.KMS_PQ_TLS_1_0_2020_07):
122-
{"cipher": "ECDHE-KYBER-RSA-AES256-GCM-SHA384",
123-
"kem": "kyber512r3", "kem_group": None},
124-
(Ciphers.KMS_PQ_TLS_1_0_2020_07, Ciphers.PQ_TLS_1_0_2020_12):
125-
{"cipher": "ECDHE-KYBER-RSA-AES256-GCM-SHA384",
126-
"kem": "kyber512r3", "kem_group": None},
127-
(Ciphers.PQ_TLS_1_0_2020_12, KemGroups.P256_KYBER512R3):
128-
{"cipher": "AES256_GCM_SHA384", "kem": None,
129-
"kem_group": "secp256r1_kyber-512-r3"},
130-
(KemGroups.P256_KYBER512R3, Ciphers.PQ_TLS_1_0_2020_12):
131-
{"cipher": "AES256_GCM_SHA384", "kem": None,
132-
"kem_group": "secp256r1_kyber-512-r3"},
133-
(KemGroups.P256_KYBER512R3, Ciphers.PQ_TLS_1_0_2023_01):
134-
{"cipher": "AES256_GCM_SHA384", "kem": None,
135-
"kem_group": "secp256r1_kyber-512-r3"},
136-
(KemGroups.P256_KYBER512R3, Ciphers.PQ_TLS_1_3_2023_06_01):
137-
{"cipher": "AES256_GCM_SHA384", "kem": None,
138-
"kem_group": "secp256r1_kyber-512-r3"},
13933
(KemGroups.P384_KYBER768R3, Ciphers.PQ_TLS_1_3_2023_06_01):
14034
{"cipher": "AES256_GCM_SHA384", "kem": None,
14135
"kem_group": "secp384r1_kyber-768-r3"},
@@ -150,6 +44,22 @@
15044
{"cipher": "TLS_AES_256_GCM_SHA384",
15145
"kem": None,
15246
"kem_group": "SecP256r1Kyber768Draft00"},
47+
(Ciphers.PQ_TLS_1_3_2023_06_01, Ciphers.PQ_TLS_1_3_2023_06_01):
48+
{"cipher": "TLS_AES_256_GCM_SHA384",
49+
"kem": None,
50+
"kem_group": "SecP256r1Kyber768Draft00"},
51+
(Ciphers.PQ_TLS_1_3_2023_06_01, Ciphers.KMS_TLS_1_0_2018_10):
52+
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
53+
"kem": None,
54+
"kem_group": None},
55+
(Ciphers.KMS_TLS_1_0_2018_10, Ciphers.PQ_TLS_1_3_2023_06_01):
56+
{"cipher": "ECDHE-RSA-AES128-GCM-SHA256",
57+
"kem": None,
58+
"kem_group": None},
59+
(Ciphers.KMS_TLS_1_0_2018_10, Ciphers.KMS_TLS_1_0_2018_10):
60+
{"cipher": "ECDHE-RSA-AES256-GCM-SHA384",
61+
"kem": None,
62+
"kem_group": None},
15363
}
15464

15565
"""
@@ -224,22 +134,6 @@ def test_nothing():
224134
@pytest.mark.parametrize("other_provider", [S2N], ids=get_parameter_name)
225135
def test_s2nc_to_s2nd_pq_handshake(managed_process, protocol, certificate, client_cipher, server_cipher, provider,
226136
other_provider):
227-
# Incorrect cipher is negotiated when both ciphers are PQ_TLS_1_0_2020_12 with
228-
# openssl 1.0.2, boringssl, and libressl libcryptos
229-
if all([
230-
client_cipher == Ciphers.PQ_TLS_1_0_2020_12,
231-
server_cipher == Ciphers.PQ_TLS_1_0_2020_12,
232-
any([
233-
libcrypto in get_flag(S2N_PROVIDER_VERSION)
234-
for libcrypto in [
235-
"boringssl",
236-
"libressl",
237-
"openssl-1.0.2"
238-
]
239-
])
240-
]):
241-
pytest.skip()
242-
243137
port = next(available_ports)
244138

245139
client_options = ProviderOptions(
@@ -359,7 +253,7 @@ def test_s2nd_to_awslc_pq_handshake(managed_process, s2n_server_policy, awslc_cl
359253

360254
@pytest.mark.uncollect_if(func=invalid_test_parameters)
361255
@pytest.mark.parametrize("protocol", [Protocols.TLS13], ids=get_parameter_name)
362-
@pytest.mark.parametrize("cipher", [Ciphers.PQ_TLS_1_0_2020_12], ids=get_parameter_name)
256+
@pytest.mark.parametrize("cipher", [Ciphers.PQ_TLS_1_3_2023_06_01], ids=get_parameter_name)
363257
@pytest.mark.parametrize("kem_group", KEM_GROUPS, ids=get_parameter_name)
364258
def test_s2nc_to_oqs_openssl_pq_handshake(managed_process, protocol, cipher, kem_group):
365259
# If PQ is not enabled in s2n, there is no reason to test against oqs_openssl
@@ -401,7 +295,7 @@ def test_s2nc_to_oqs_openssl_pq_handshake(managed_process, protocol, cipher, kem
401295

402296
@pytest.mark.uncollect_if(func=invalid_test_parameters)
403297
@pytest.mark.parametrize("protocol", [Protocols.TLS13], ids=get_parameter_name)
404-
@pytest.mark.parametrize("cipher", [Ciphers.PQ_TLS_1_0_2020_12], ids=get_parameter_name)
298+
@pytest.mark.parametrize("cipher", [Ciphers.PQ_TLS_1_3_2023_06_01], ids=get_parameter_name)
405299
@pytest.mark.parametrize("kem_group", KEM_GROUPS, ids=get_parameter_name)
406300
def test_oqs_openssl_to_s2nd_pq_handshake(managed_process, protocol, cipher, kem_group):
407301
# If PQ is not enabled in s2n, there is no reason to test against oqs_openssl

0 commit comments

Comments
 (0)