Skip to content

Commit f6fba0f

Browse files
ianbotsfianbotsf
authored
fix: update supported TLS cipher preferences (#148)
1 parent 49c98f4 commit f6fba0f

File tree

5 files changed

+35
-27
lines changed

5 files changed

+35
-27
lines changed

‎.changes/3d6fffae-2ce4-478f-b410-fce0afe16588.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"id": "3d6fffae-2ce4-478f-b410-fce0afe16588",
3+
"type": "bugfix",
4+
"description": "Update the set of supported `TlsCipherPreference` values to reflect the latest capabilities/support from CRT"
5+
}

‎aws-crt-kotlin/api/aws-crt-kotlin.api‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -815,6 +815,8 @@ public final class aws/sdk/kotlin/crt/io/TlsCipherPreference : java/lang/Enum {
815815
public static final field KMS_PQ_TLS_V1_0_2019_06 Laws/sdk/kotlin/crt/io/TlsCipherPreference;
816816
public static final field KMS_PQ_TLS_V1_0_2020_02 Laws/sdk/kotlin/crt/io/TlsCipherPreference;
817817
public static final field KMS_PQ_TLS_V1_0_2020_07 Laws/sdk/kotlin/crt/io/TlsCipherPreference;
818+
public static final field PQ_DEFAULT Laws/sdk/kotlin/crt/io/TlsCipherPreference;
819+
public static final field PQ_TLSV1_2_2024_10 Laws/sdk/kotlin/crt/io/TlsCipherPreference;
818820
public static final field PQ_TLS_V1_0_2021_05 Laws/sdk/kotlin/crt/io/TlsCipherPreference;
819821
public static final field SYSTEM_DEFAULT Laws/sdk/kotlin/crt/io/TlsCipherPreference;
820822
public static fun getEntries ()Lkotlin/enums/EnumEntries;

‎aws-crt-kotlin/common/src/aws/sdk/kotlin/crt/io/TlsCipherPreference.kt‎

Lines changed: 25 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -19,54 +19,53 @@ public enum class TlsCipherPreference(public val value: Int) {
1919
SYSTEM_DEFAULT(0),
2020

2121
/**
22-
* This cipher preference is no longer supported. Use PQ_TLS_V1_0_2021_05 instead.
22+
* This cipher preference is no longer supported. Use PQ_TLSV1_2_2024_10 instead.
2323
*/
24-
@Deprecated("This cipher preference is no longer supported. Use PQ_TLS_V1_0_2021_05 instead.")
24+
@Deprecated("This cipher preference is no longer supported. Use PQ_TLSV1_2_2024_10 instead.")
2525
KMS_PQ_TLS_V1_0_2019_06(1),
2626

2727
/**
28-
* This cipher preference is no longer supported. Use PQ_TLS_V1_0_2021_05 instead.
28+
* This cipher preference is no longer supported. Use PQ_TLSV1_2_2024_10 instead.
2929
*/
30-
@Deprecated("This cipher preference is no longer supported. Use PQ_TLS_V1_0_2021_05 instead.")
30+
@Deprecated("This cipher preference is no longer supported. Use PQ_TLSV1_2_2024_10 instead.")
3131
KMS_PQ_SIKE_TLS_V1_0_2019_11(2),
3232

3333
/**
34-
* This cipher preference is no longer supported. Use PQ_TLS_V1_0_2021_05 instead.
34+
* This cipher preference is no longer supported. Use PQ_TLSV1_2_2024_10 instead.
3535
*/
36-
@Deprecated("This cipher preference is no longer supported. Use PQ_TLS_V1_0_2021_05 instead.")
36+
@Deprecated("This cipher preference is no longer supported. Use PQ_TLSV1_2_2024_10 instead.")
3737
KMS_PQ_TLS_V1_0_2020_02(3),
3838

3939
/**
40-
* This cipher preference is no longer supported. Use PQ_TLS_V1_0_2021_05 instead.
40+
* This cipher preference is no longer supported. Use PQ_TLSV1_2_2024_10 instead.
4141
*/
42-
@Deprecated("This cipher preference is no longer supported. Use PQ_TLS_V1_0_2021_05 instead.")
42+
@Deprecated("This cipher preference is no longer supported. Use PQ_TLSV1_2_2024_10 instead.")
4343
KMS_PQ_SIKE_TLS_V1_0_2020_02(4),
4444

4545
/**
46-
* This cipher preference is no longer supported. Use PQ_TLS_V1_0_2021_05 instead.
46+
* This cipher preference is no longer supported. Use PQ_TLSV1_2_2024_10 instead.
4747
*/
48-
@Deprecated("This cipher preference is no longer supported. Use PQ_TLS_V1_0_2021_05 instead.")
48+
@Deprecated("This cipher preference is no longer supported. Use PQ_TLSV1_2_2024_10 instead.")
4949
KMS_PQ_TLS_V1_0_2020_07(5),
5050

5151
/**
52-
* This TlsCipherPreference supports TLS 1.0 through TLS 1.3, and contains Kyber Round 3 as its highest priority
53-
* PQ algorithm. PQ algorithms in this preference list will be used in hybrid mode, and will be combined with a
54-
* classical ECDHE key exchange.
55-
*
56-
* NIST has announced that Kyber will be first post-quantum key-agreement algorithm that it will standardize.
57-
* However, the NIST standardization process might introduce minor changes that may cause the final Kyber standard
58-
* to differ from the Kyber Round 3 implementation available in this preference list.
59-
*
60-
* Since this TlsCipherPreference contains algorithms that have not yet been officially standardized by NIST, this
61-
* preference list, and any of the PQ algorithms in it, may stop being supported at any time.
62-
*
63-
* For more info see:
64-
* - https://tools.ietf.org/html/draft-campagna-tls-bike-sike-hybrid
65-
* - https://datatracker.ietf.org/doc/html/draft-ietf-tls-hybrid-design
66-
* - https://aws.amazon.com/blogs/security/how-to-tune-tls-for-hybrid-post-quantum-cryptography-with-kyber/
67-
* - https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8413.pdf
52+
* This cipher preference is no longer supported. Use PQ_TLSV1_2_2024_10 instead.
6853
*/
54+
@Deprecated("This cipher preference is no longer supported. Use PQ_TLSV1_2_2024_10 instead.")
6955
PQ_TLS_V1_0_2021_05(6),
56+
57+
/**
58+
* This TLS cipher preference list contains post-quantum key exchange algorithms that have been standardized by
59+
* NIST. PQ algorithms in this preference list will be used in hybrid mode, and always combined with a classical
60+
* ECDHE key exchange.
61+
*/
62+
PQ_TLSV1_2_2024_10(7),
63+
64+
/**
65+
* Recommended default policy with post-quantum algorithm support. This policy may change over time.
66+
*/
67+
PQ_DEFAULT(8),
68+
7069
;
7170

7271
/**

‎aws-crt-kotlin/jvm/src/aws/sdk/kotlin/crt/io/TlsContextJVM.kt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@ private fun TlsCipherPreference.into(): TlsCipherPreferenceJni = when (this) {
3636
TlsCipherPreference.KMS_PQ_SIKE_TLS_V1_0_2020_02 -> TlsCipherPreferenceJni.TLS_CIPHER_PREF_KMS_PQ_SIKE_TLSv1_0_2020_02
3737
TlsCipherPreference.KMS_PQ_TLS_V1_0_2020_07 -> TlsCipherPreferenceJni.TLS_CIPHER_PREF_KMS_PQ_TLSv1_0_2020_07
3838
TlsCipherPreference.PQ_TLS_V1_0_2021_05 -> TlsCipherPreferenceJni.TLS_CIPHER_PREF_PQ_TLSv1_0_2021_05
39+
TlsCipherPreference.PQ_TLSV1_2_2024_10 -> TlsCipherPreferenceJni.TLS_CIPHER_PREF_PQ_TLSv1_2_2023
40+
TlsCipherPreference.PQ_DEFAULT -> TlsCipherPreferenceJni.TLS_CIPHER_PQ_DEFAULT
3941
}
4042

4143
private fun TlsVersion.into(): TlsVersionJni = when (this) {

‎gradle/libs.versions.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ kotlin-version = "2.1.0"
44
aws-kotlin-repo-tools-version = "0.4.22"
55

66
# libs
7-
crt-java-version = "0.33.10"
7+
crt-java-version = "0.38.1"
88
coroutines-version = "1.9.0"
99
binary-compatibility-validator-version = "0.16.3"
1010

0 commit comments

Comments
 (0)