Skip to content

Commit c866921

Browse files
WillChilds-Kleingoatgoosedougch
authored
Add AWS-CRT-SDK-TLSv1.0-2025-PQ (#5403)
Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> Co-authored-by: Doug Chapman <54039637+dougch@users.noreply.github.com>
1 parent 4d44185 commit c866921

File tree

5 files changed

+179
-0
lines changed

5 files changed

+179
-0
lines changed

‎tests/policy_snapshot/snapshots/AWS-CRT-SDK-TLSv1.0-2025-PQ‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: AWS-CRT-SDK-TLSv1.0-2025-PQ
2+
min version: TLS1.0
3+
rules:
4+
- Perfect Forward Secrecy: no
5+
- FIPS 140-3 (2019): no
6+
cipher suites:
7+
- TLS_AES_128_GCM_SHA256
8+
- TLS_AES_256_GCM_SHA384
9+
- TLS_CHACHA20_POLY1305_SHA256
10+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
11+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
12+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
13+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
14+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
15+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
16+
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
17+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
18+
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
19+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
20+
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
21+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
22+
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
23+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
24+
- TLS_RSA_WITH_AES_128_GCM_SHA256
25+
- TLS_RSA_WITH_AES_256_GCM_SHA384
26+
- TLS_RSA_WITH_AES_128_CBC_SHA256
27+
- TLS_RSA_WITH_AES_256_CBC_SHA256
28+
- TLS_RSA_WITH_AES_128_CBC_SHA
29+
- TLS_RSA_WITH_AES_256_CBC_SHA
30+
signature schemes:
31+
- rsa_pss_pss_sha256
32+
- rsa_pss_pss_sha384
33+
- rsa_pss_pss_sha512
34+
- rsa_pss_rsae_sha256
35+
- rsa_pss_rsae_sha384
36+
- rsa_pss_rsae_sha512
37+
- rsa_pkcs1_sha256
38+
- rsa_pkcs1_sha384
39+
- rsa_pkcs1_sha512
40+
- legacy_rsa_pkcs1_sha224
41+
- ecdsa_sha256
42+
- ecdsa_sha384
43+
- ecdsa_sha512
44+
- legacy_ecdsa_sha224
45+
- rsa_pkcs1_sha1
46+
- ecdsa_sha1
47+
curves:
48+
- secp256r1
49+
- x25519
50+
- secp384r1
51+
pq:
52+
- revision: 5
53+
- kem groups:
54+
-- X25519MLKEM768
55+
-- SecP256r1MLKEM768
56+
-- SecP384r1MLKEM1024

‎tests/policy_snapshot/snapshots/AWS-CRT-SDK-TLSv1.2-2025-PQ‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: AWS-CRT-SDK-TLSv1.2-2025-PQ
2+
min version: TLS1.2
3+
rules:
4+
- Perfect Forward Secrecy: no
5+
- FIPS 140-3 (2019): no
6+
cipher suites:
7+
- TLS_AES_128_GCM_SHA256
8+
- TLS_AES_256_GCM_SHA384
9+
- TLS_CHACHA20_POLY1305_SHA256
10+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
11+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
12+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
13+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
14+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
15+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
16+
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
17+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
18+
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
19+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
20+
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
21+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
22+
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
23+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
24+
- TLS_RSA_WITH_AES_128_GCM_SHA256
25+
- TLS_RSA_WITH_AES_256_GCM_SHA384
26+
- TLS_RSA_WITH_AES_128_CBC_SHA256
27+
- TLS_RSA_WITH_AES_256_CBC_SHA256
28+
- TLS_RSA_WITH_AES_128_CBC_SHA
29+
- TLS_RSA_WITH_AES_256_CBC_SHA
30+
signature schemes:
31+
- rsa_pss_pss_sha256
32+
- rsa_pss_pss_sha384
33+
- rsa_pss_pss_sha512
34+
- rsa_pss_rsae_sha256
35+
- rsa_pss_rsae_sha384
36+
- rsa_pss_rsae_sha512
37+
- rsa_pkcs1_sha256
38+
- rsa_pkcs1_sha384
39+
- rsa_pkcs1_sha512
40+
- legacy_rsa_pkcs1_sha224
41+
- ecdsa_sha256
42+
- ecdsa_sha384
43+
- ecdsa_sha512
44+
- legacy_ecdsa_sha224
45+
- rsa_pkcs1_sha1
46+
- ecdsa_sha1
47+
curves:
48+
- secp256r1
49+
- x25519
50+
- secp384r1
51+
pq:
52+
- revision: 5
53+
- kem groups:
54+
-- X25519MLKEM768
55+
-- SecP256r1MLKEM768
56+
-- SecP384r1MLKEM1024

‎tests/policy_snapshot/snapshots/AWS-CRT-SDK-TLSv1.3-2025-PQ‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: AWS-CRT-SDK-TLSv1.3-2025-PQ
2+
min version: TLS1.3
3+
rules:
4+
- Perfect Forward Secrecy: no
5+
- FIPS 140-3 (2019): no
6+
cipher suites:
7+
- TLS_AES_128_GCM_SHA256
8+
- TLS_AES_256_GCM_SHA384
9+
- TLS_CHACHA20_POLY1305_SHA256
10+
signature schemes:
11+
- rsa_pss_pss_sha256
12+
- rsa_pss_pss_sha384
13+
- rsa_pss_pss_sha512
14+
- rsa_pss_rsae_sha256
15+
- rsa_pss_rsae_sha384
16+
- rsa_pss_rsae_sha512
17+
- rsa_pkcs1_sha256
18+
- rsa_pkcs1_sha384
19+
- rsa_pkcs1_sha512
20+
- legacy_rsa_pkcs1_sha224
21+
- ecdsa_sha256
22+
- ecdsa_sha384
23+
- ecdsa_sha512
24+
- legacy_ecdsa_sha224
25+
- rsa_pkcs1_sha1
26+
- ecdsa_sha1
27+
curves:
28+
- secp256r1
29+
- x25519
30+
- secp384r1
31+
pq:
32+
- revision: 5
33+
- kem groups:
34+
-- X25519MLKEM768
35+
-- SecP256r1MLKEM768
36+
-- SecP384r1MLKEM1024

‎tests/unit/s2n_pq_mlkem_policies_test.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,7 @@ const char *cipher_exceptions[] = {
111111

112112
/* List of s2n TLS Security Policies that are allowed to have a minimum TLS Version below TLS 1.2 and support ML-KEM */
113113
const char *tls_version_exceptions[] = {
114+
"AWS-CRT-SDK-TLSv1.0-2025-PQ",
114115
"test_all",
115116
};
116117

‎tls/s2n_security_policies.c‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -887,6 +887,33 @@ const struct s2n_security_policy security_policy_pq_20231215 = {
887887
},
888888
};
889889

890+
/* Same as security_policy_aws_crt_sdk_tls_10_06_23 but with (IETF-standardized) ML-KEM Support */
891+
const struct s2n_security_policy security_policy_aws_crt_sdk_tls_10_07_25_pq = {
892+
.minimum_protocol_version = S2N_TLS10,
893+
.cipher_preferences = &cipher_preferences_aws_crt_sdk_default,
894+
.kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2025_07,
895+
.signature_preferences = &s2n_signature_preferences_20200207,
896+
.ecc_preferences = &s2n_ecc_preferences_20230623,
897+
};
898+
899+
/* Same as security_policy_aws_crt_sdk_tls_12_06_23 but with (IETF-standardized) ML-KEM Support */
900+
const struct s2n_security_policy security_policy_aws_crt_sdk_tls_12_07_25_pq = {
901+
.minimum_protocol_version = S2N_TLS12,
902+
.cipher_preferences = &cipher_preferences_aws_crt_sdk_default,
903+
.kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2025_07,
904+
.signature_preferences = &s2n_signature_preferences_20200207,
905+
.ecc_preferences = &s2n_ecc_preferences_20230623,
906+
};
907+
908+
/* Same as security_policy_aws_crt_sdk_tls_13_06_23 but with (IETF-standardized) ML-KEM Support */
909+
const struct s2n_security_policy security_policy_aws_crt_sdk_tls_13_07_25_pq = {
910+
.minimum_protocol_version = S2N_TLS13,
911+
.cipher_preferences = &cipher_preferences_aws_crt_sdk_tls_13,
912+
.kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2025_07,
913+
.signature_preferences = &s2n_signature_preferences_20200207,
914+
.ecc_preferences = &s2n_ecc_preferences_20230623,
915+
};
916+
890917
/* Same as security_policy_aws_crt_sdk_tls_12_06_23 but with ML-KEM Support */
891918
const struct s2n_security_policy security_policy_aws_crt_sdk_tls_12_06_23_pq = {
892919
.minimum_protocol_version = S2N_TLS12,
@@ -1347,11 +1374,14 @@ struct s2n_security_policy_selection security_policy_selection[] = {
13471374
{ .version = "AWS-CRT-SDK-TLSv1.3", .security_policy = &security_policy_aws_crt_sdk_tls_13, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
13481375
{ .version = "AWS-CRT-SDK-SSLv3.0-2023", .security_policy = &security_policy_aws_crt_sdk_ssl_v3_06_23, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
13491376
{ .version = "AWS-CRT-SDK-TLSv1.0-2023", .security_policy = &security_policy_aws_crt_sdk_tls_10_06_23, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1377+
{ .version = "AWS-CRT-SDK-TLSv1.0-2025-PQ", .security_policy = &security_policy_aws_crt_sdk_tls_10_07_25_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
13501378
{ .version = "AWS-CRT-SDK-TLSv1.1-2023", .security_policy = &security_policy_aws_crt_sdk_tls_11_06_23, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
13511379
{ .version = "AWS-CRT-SDK-TLSv1.2-2023", .security_policy = &security_policy_aws_crt_sdk_tls_12_06_23, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
13521380
{ .version = "AWS-CRT-SDK-TLSv1.2-2023-PQ", .security_policy = &security_policy_aws_crt_sdk_tls_12_06_23_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
13531381
{ .version = "AWS-CRT-SDK-TLSv1.2-2025", .security_policy = &security_policy_aws_crt_sdk_tls_30_06_25, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1382+
{ .version = "AWS-CRT-SDK-TLSv1.2-2025-PQ", .security_policy = &security_policy_aws_crt_sdk_tls_12_07_25_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
13541383
{ .version = "AWS-CRT-SDK-TLSv1.3-2023", .security_policy = &security_policy_aws_crt_sdk_tls_13_06_23, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1384+
{ .version = "AWS-CRT-SDK-TLSv1.3-2025-PQ", .security_policy = &security_policy_aws_crt_sdk_tls_13_07_25_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
13551385
/* KMS TLS Policies*/
13561386
{ .version = "KMS-TLS-1-0-2018-10", .security_policy = &security_policy_kms_tls_1_0_2018_10, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
13571387
{ .version = "KMS-TLS-1-0-2021-08", .security_policy = &security_policy_kms_tls_1_0_2021_08, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },

0 commit comments

Comments
 (0)