From 1c16fd1f033816c98b96a41691625c0c2788e805 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Sat, 24 Nov 2012 00:59:51 +0000 Subject: [PATCH] add Suite B 128 bit mode offering only combination 2 --- ssl/ssl_ciph.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c index fbd0c21207..084e8bbb1b 100644 --- a/ssl/ssl_ciph.c +++ b/ssl/ssl_ciph.c @@ -1354,11 +1354,16 @@ static int ssl_cipher_process_rulestr(const char *rule_str, static int check_suiteb_cipher_list(const SSL_METHOD *meth, CERT *c, const char **prule_str) { - unsigned int suiteb_flags = 0; + unsigned int suiteb_flags = 0, suiteb_comb2 = 0; if (!strcmp(*prule_str, "SUITEB128")) suiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS; else if (!strcmp(*prule_str, "SUITEB128ONLY")) suiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS_ONLY; + else if (!strcmp(*prule_str, "SUITEB128C2")) + { + suiteb_comb2 = 1; + suiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS; + } else if (!strcmp(*prule_str, "SUITEB192")) suiteb_flags = SSL_CERT_FLAG_SUITEB_192_LOS; @@ -1377,7 +1382,10 @@ static int check_suiteb_cipher_list(const SSL_METHOD *meth, CERT *c, switch(suiteb_flags) { case SSL_CERT_FLAG_SUITEB_128_LOS: - *prule_str = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384"; + if (suiteb_comb2) + *prule_str = "ECDHE-ECDSA-AES256-GCM-SHA384"; + else + *prule_str = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384"; break; case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY: *prule_str = "ECDHE-ECDSA-AES128-GCM-SHA256"; -- 2.34.1