tls-tris

Filippo Valsorda b5fd625da3 crypto/tls: disable CBC cipher suites with SHA-256 by default As is, they were fully vulnerable to the Lucky13 attack. The SHA1 variants implement limited countermeasures (see f28cf8346c4) but the SHA256 ones are apparently used rarely enough (see 8741504888b) that it's not worth the extra code. Instead, disable them by default and update the warning. Updates #13385 Updates #15487 Change-Id: I45b8b716001e2fa0811b17e25be76e2512e5abb2 Reviewed-on: https://go-review.googlesource.com/35290 Reviewed-by: Adam Langley <alangley@gmail.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Matt Layher <mdlayher@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org>		vor 7 Jahren
testdata	crypto/tls: enable ChaCha20-Poly1305 cipher suites by default.	vor 8 Jahren
alert.go	crypto/tls: switch to OpenSSL 1.1.0 for test data.	vor 8 Jahren
cipher_suites.go	crypto/tls: disable CBC cipher suites with SHA-256 by default	vor 7 Jahren
common.go	crypto/{cipher,tls,internal/cryptohw}: prioritise AES-GCM when hardware support is present.	vor 8 Jahren
conn.go	crypto/tls: fix a typo	vor 7 Jahren
conn_test.go	crypto/tls: implement countermeasures against CBC padding oracles	vor 8 Jahren
example_test.go	crypto/tls: add example for Config KeyLogWriter	vor 8 Jahren
generate_cert.go	crypto/tls: Support ECDSA keys in generate_cert.go	vor 10 Jahren
handshake_client.go	cmd/gofmt, crypto/tls: fix typos	vor 8 Jahren
handshake_client_test.go	cmd/gofmt, crypto/tls: fix typos	vor 8 Jahren
handshake_messages.go	crypto/tls: reject zero-length SCTs.	vor 8 Jahren
handshake_messages_test.go	crypto/tls: reject zero-length SCTs.	vor 8 Jahren
handshake_server.go	crypto/tls: add a SignatureScheme type.	vor 8 Jahren
handshake_server_test.go	all: don't call t.Fatal from a goroutine	vor 8 Jahren
handshake_test.go	crypto/tls: switch to OpenSSL 1.1.0 for test data.	vor 8 Jahren
key_agreement.go	crypto/tls: support X25519.	vor 8 Jahren
prf.go	all: standardize RFC mention format	vor 8 Jahren
prf_test.go	crypto/tls: decouple handshake signatures from the handshake hash.	vor 9 Jahren
ticket.go	crypto/tls: minor refactors for readability	vor 8 Jahren
tls.go	crypto/tls: disable CBC cipher suites with SHA-256 by default	vor 7 Jahren
tls_test.go	all: don't call t.Fatal from a goroutine	vor 8 Jahren