Repository: pion/dtls
Pull request #396 (2021-09-28 21:03:59)

New cipher support ecdhe_ecdsa_with_aes_256_gcm_sha384 ecdhe_rsa_with…
New cipher support ecdhe_ecdsa_with_aes_256_gcm_sha384 ecdhe_rsa_with_aes_256_gcm_sha384

#### Description
This commit add support for new cipher ecdhe_ecdsa_with_aes_256_gcm_sha384 ecdhe_rsa_with_aes_256_gcm_sha384
#### Reference issue
Fixes #...


codecov[bot]: # [Codecov](https://codecov.io/gh/pion/dtls/pull/396?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pion) Report
> Merging [#396](https://codecov.io/gh/pion/dtls/pull/396?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pion) (38f68ec) into [master](https://codecov.io/gh/pion/dtls/commit/96100166cd996c9b0d5a594740a15102bbf8fef7?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pion) (9610016) will **increase** coverage by `0.10%`.
> The diff coverage is `96.66%`.

[![Impacted file tree graph](https://codecov.io/gh/pion/dtls/pull/396/graphs/tree.svg?width=650&height=150&src=pr&token=bcCB2jB88I&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pion)](https://codecov.io/gh/pion/dtls/pull/396?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pion)

```diff
@@            Coverage Diff             @@
##           master     #396      +/-   ##
==========================================
+ Coverage   75.87%   75.98%   +0.10%     
==========================================
  Files          86       88       +2     
  Lines        3673     3698      +25     
==========================================
+ Hits         2787     2810      +23     
- Misses        601      603       +2     
  Partials      285      285              
```

| Flag | Coverage Δ | |
|---|---|---|
| go | `76.00% <96.66%> (+0.10%)` | :arrow_up: |
| wasm | `65.99% <100.00%> (+0.08%)` | :arrow_up: |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pion#carryforward-flags-in-the-pull-request-comment) to find out more.

| [Impacted Files](https://codecov.io/gh/pion/dtls/pull/396?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pion) | Coverage Δ | |
|---|---|---|
| [...phersuite/tls\_ecdhe\_rsa\_with\_aes\_256\_gcm\_sha384.go](https://codecov.io/gh/pion/dtls/pull/396/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pion#diff-aW50ZXJuYWwvY2lwaGVyc3VpdGUvdGxzX2VjZGhlX3JzYV93aXRoX2Flc18yNTZfZ2NtX3NoYTM4NC5nbw==) | `66.66% <66.66%> (ø)` | |
| [cipher\_suite.go](https://codecov.io/gh/pion/dtls/pull/396/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pion#diff-Y2lwaGVyX3N1aXRlLmdv) | `97.87% <100.00%> (+0.19%)` | :arrow_up: |
| [internal/ciphersuite/ciphersuite.go](https://codecov.io/gh/pion/dtls/pull/396/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pion#diff-aW50ZXJuYWwvY2lwaGVyc3VpdGUvY2lwaGVyc3VpdGUuZ28=) | `70.37% <100.00%> (+5.15%)` | :arrow_up: |
| [...ersuite/tls\_ecdhe\_ecdsa\_with\_aes\_128\_gcm\_sha256.go](https://codecov.io/gh/pion/dtls/pull/396/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pion#diff-aW50ZXJuYWwvY2lwaGVyc3VpdGUvdGxzX2VjZGhlX2VjZHNhX3dpdGhfYWVzXzEyOF9nY21fc2hhMjU2Lmdv) | `76.66% <100.00%> (+0.80%)` | :arrow_up: |
| [...ersuite/tls\_ecdhe\_ecdsa\_with\_aes\_256\_gcm\_sha384.go](https://codecov.io/gh/pion/dtls/pull/396/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pion#diff-aW50ZXJuYWwvY2lwaGVyc3VpdGUvdGxzX2VjZGhlX2VjZHNhX3dpdGhfYWVzXzI1Nl9nY21fc2hhMzg0Lmdv) | `100.00% <100.00%> (ø)` | |
| [conn.go](https://codecov.io/gh/pion/dtls/pull/396/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pion#diff-Y29ubi5nbw==) | `82.41% <0.00%> (-0.20%)` | :arrow_down: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/pion/dtls/pull/396?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pion).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pion)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/pion/dtls/pull/396?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pion). Last update [9610016...38f68ec](https://codecov.io/gh/pion/dtls/pull/396?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pion). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=pion).


Patch:
diff --git a/AUTHORS.txt b/AUTHORS.txt
index 69d5b78..825daa0 100644
--- a/AUTHORS.txt
+++ b/AUTHORS.txt
@@ -35,4 +35,5 @@ Sean DuBois <sean@siobud.com>
 Stefan Tatschner <stefan@rumpelsepp.org>
 Vadim <fffilimonov@yandex.ru>
 Vadim Filimonov <fffilimonov@yandex.ru>
+wmiao <wu.miao@viasat.com>
 ZHENK <chengzhenyang@gmail.com>
diff --git a/README.md b/README.md
index 0e20ac7..dd004bb 100644
--- a/README.md
+++ b/README.md
@@ -46,6 +46,8 @@ We would love contributions that fall under the 'Planned Features' and any bug f
 * TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 ([RFC 6655][rfc6655])
 * TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ([RFC 5289][rfc5289])
 * TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ([RFC 5289][rfc5289])
+* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 ([RFC 5289][rfc5289])
+* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ([RFC 5289][rfc5289])
 * TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA ([RFC 8422][rfc8422])
 * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA ([RFC 8422][rfc8422])
 
diff --git a/cipher_suite.go b/cipher_suite.go
index ed10609..3dc1e5b 100644
--- a/cipher_suite.go
+++ b/cipher_suite.go
@@ -22,6 +22,9 @@ const (
 	TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 CipherSuiteID = ciphersuite.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 //nolint:golint,stylecheck
 	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   CipherSuiteID = ciphersuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   //nolint:golint,stylecheck
 
+	TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 CipherSuiteID = ciphersuite.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 //nolint:golint,stylecheck
+	TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384   CipherSuiteID = ciphersuite.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384   //nolint:golint,stylecheck
+
 	// AES-256-CBC-SHA
 	TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA CipherSuiteID = ciphersuite.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA //nolint:golint,stylecheck
 	TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA   CipherSuiteID = ciphersuite.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA   //nolint:golint,stylecheck
@@ -107,6 +110,10 @@ func cipherSuiteForID(id CipherSuiteID, customCiphers func() []CipherSuite) Ciph
 		return &ciphersuite.TLSPskWithAes128GcmSha256{}
 	case TLS_PSK_WITH_AES_128_CBC_SHA256:
 		return &ciphersuite.TLSPskWithAes128CbcSha256{}
+	case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
+		return &ciphersuite.TLSEcdheEcdsaWithAes256GcmSha384{}
+	case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
+		return &ciphersuite.TLSEcdheRsaWithAes256GcmSha384{}
 	}
 
 	if customCiphers != nil {
@@ -127,6 +134,8 @@ func defaultCipherSuites() []CipherSuite {
 		&ciphersuite.TLSEcdheRsaWithAes128GcmSha256{},
 		&ciphersuite.TLSEcdheEcdsaWithAes256CbcSha{},
 		&ciphersuite.TLSEcdheRsaWithAes256CbcSha{},
+		&ciphersuite.TLSEcdheEcdsaWithAes256GcmSha384{},
+		&ciphersuite.TLSEcdheRsaWithAes256GcmSha384{},
 	}
 }
 
@@ -141,6 +150,8 @@ func allCipherSuites() []CipherSuite {
 		ciphersuite.NewTLSPskWithAes128Ccm(),
 		ciphersuite.NewTLSPskWithAes128Ccm8(),
 		&ciphersuite.TLSPskWithAes128GcmSha256{},
+		&ciphersuite.TLSEcdheEcdsaWithAes256GcmSha384{},
+		&ciphersuite.TLSEcdheRsaWithAes256GcmSha384{},
 	}
 }
 
diff --git a/internal/ciphersuite/ciphersuite.go b/internal/ciphersuite/ciphersuite.go
index 3a4fb43..7405792 100644
--- a/internal/ciphersuite/ciphersuite.go
+++ b/internal/ciphersuite/ciphersuite.go
@@ -35,6 +35,10 @@ func (i ID) String() string {
 		return "TLS_PSK_WITH_AES_128_GCM_SHA256"
 	case TLS_PSK_WITH_AES_128_CBC_SHA256:
 		return "TLS_PSK_WITH_AES_128_CBC_SHA256"
+	case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
+		return "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
+	case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
+		return "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
 	default:
 		return fmt.Sprintf("unknown(%v)", uint16(i))
 	}
@@ -50,6 +54,8 @@ const (
 	TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ID = 0xc02b //nolint:golint,stylecheck
 	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ID = 0xc02f //nolint:golint,stylecheck
 
+	TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 ID = 0xc02c //nolint:golint,stylecheck
+	TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384   ID = 0xc030 //nolint:golint,stylecheck
 	// AES-256-CBC-SHA
 	TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA ID = 0xc00a //nolint:golint,stylecheck
 	TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA   ID = 0xc014 //nolint:golint,stylecheck
diff --git a/internal/ciphersuite/tls_ecdhe_ecdsa_with_aes_128_gcm_sha256.go b/internal/ciphersuite/tls_ecdhe_ecdsa_with_aes_128_gcm_sha256.go
index b491320..ede12bb 100644
--- a/internal/ciphersuite/tls_ecdhe_ecdsa_with_aes_128_gcm_sha256.go
+++ b/internal/ciphersuite/tls_ecdhe_ecdsa_with_aes_128_gcm_sha256.go
@@ -47,15 +47,8 @@ func (c *TLSEcdheEcdsaWithAes128GcmSha256) IsInitialized() bool {
 	return c.gcm.Load() != nil
 }
 
-// Init initializes the internal Cipher with keying material
-func (c *TLSEcdheEcdsaWithAes128GcmSha256) Init(masterSecret, clientRandom, serverRandom []byte, isClient bool) error {
-	const (
-		prfMacLen = 0
-		prfKeyLen = 16
-		prfIvLen  = 4
-	)
-
-	keys, err := prf.GenerateEncryptionKeys(masterSecret, clientRandom, serverRandom, prfMacLen, prfKeyLen, prfIvLen, c.HashFunc())
+func (c *TLSEcdheEcdsaWithAes128GcmSha256) init(masterSecret, clientRandom, serverRandom []byte, isClient bool, prfMacLen, prfKeyLen, prfIvLen int, hashFunc func() hash.Hash) error {
+	keys, err := prf.GenerateEncryptionKeys(masterSecret, clientRandom, serverRandom, prfMacLen, prfKeyLen, prfIvLen, hashFunc)
 	if err != nil {
 		return err
 	}
@@ -67,10 +60,20 @@ func (c *TLSEcdheEcdsaWithAes128GcmSha256) Init(masterSecret, clientRandom, serv
 		gcm, err = ciphersuite.NewGCM(keys.ServerWriteKey, keys.ServerWriteIV, keys.ClientWriteKey, keys.ClientWriteIV)
 	}
 	c.gcm.Store(gcm)
-
 	return err
 }
 
+// Init initializes the internal Cipher with keying material
+func (c *TLSEcdheEcdsaWithAes128GcmSha256) Init(masterSecret, clientRandom, serverRandom []byte, isClient bool) error {
+	const (
+		prfMacLen = 0
+		prfKeyLen = 16
+		prfIvLen  = 4
+	)
+
+	return c.init(masterSecret, clientRandom, serverRandom, isClient, prfMacLen, prfKeyLen, prfIvLen, c.HashFunc())
+}
+
 // Encrypt encrypts a single TLS RecordLayer
 func (c *TLSEcdheEcdsaWithAes128GcmSha256) Encrypt(pkt *recordlayer.RecordLayer, raw []byte) ([]byte, error) {
 	gcm := c.gcm.Load()
diff --git a/internal/ciphersuite/tls_ecdhe_ecdsa_with_aes_256_gcm_sha384.go b/internal/ciphersuite/tls_ecdhe_ecdsa_with_aes_256_gcm_sha384.go
new file mode 100644
index 0000000..a2fe302
--- /dev/null
+++ b/internal/ciphersuite/tls_ecdhe_ecdsa_with_aes_256_gcm_sha384.go
@@ -0,0 +1,36 @@
+package ciphersuite
+
+import (
+	"crypto/sha512"
+	"hash"
+)
+
+// TLSEcdheEcdsaWithAes256GcmSha384  represents a TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 CipherSuite
+type TLSEcdheEcdsaWithAes256GcmSha384 struct {
+	TLSEcdheEcdsaWithAes128GcmSha256
+}
+
+// ID returns the ID of the CipherSuite
+func (c *TLSEcdheEcdsaWithAes256GcmSha384) ID() ID {
+	return TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+}
+
+func (c *TLSEcdheEcdsaWithAes256GcmSha384) String() string {
+	return "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
+}
+
+// HashFunc returns the hashing func for this CipherSuite
+func (c *TLSEcdheEcdsaWithAes256GcmSha384) HashFunc() func() hash.Hash {
+	return sha512.New384
+}
+
+// Init initializes the internal Cipher with keying material
+func (c *TLSEcdheEcdsaWithAes256GcmSha384) Init(masterSecret, clientRandom, serverRandom []byte, isClient bool) error {
+	const (
+		prfMacLen = 0
+		prfKeyLen = 32
+		prfIvLen  = 4
+	)
+
+	return c.init(masterSecret, clientRandom, serverRandom, isClient, prfMacLen, prfKeyLen, prfIvLen, c.HashFunc())
+}
diff --git a/internal/ciphersuite/tls_ecdhe_rsa_with_aes_256_gcm_sha384.go b/internal/ciphersuite/tls_ecdhe_rsa_with_aes_256_gcm_sha384.go
new file mode 100644
index 0000000..3473527
--- /dev/null
+++ b/internal/ciphersuite/tls_ecdhe_rsa_with_aes_256_gcm_sha384.go
@@ -0,0 +1,22 @@
+package ciphersuite
+
+import "github.com/pion/dtls/v2/pkg/crypto/clientcertificate"
+
+// TLSEcdheRsaWithAes256GcmSha384 implements the TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 CipherSuite
+type TLSEcdheRsaWithAes256GcmSha384 struct {
+	TLSEcdheEcdsaWithAes256GcmSha384
+}
+
+// CertificateType returns what type of certificate this CipherSuite exchanges
+func (c *TLSEcdheRsaWithAes256GcmSha384) CertificateType() clientcertificate.Type {
+	return clientcertificate.RSASign
+}
+
+// ID returns the ID of the CipherSuite
+func (c *TLSEcdheRsaWithAes256GcmSha384) ID() ID {
+	return TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+}
+
+func (c *TLSEcdheRsaWithAes256GcmSha384) String() string {
+	return "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
+}


Test patch:
diff --git a/e2e/e2e_openssl_test.go b/e2e/e2e_openssl_test.go
index fd2e60f..09fdff9 100644
--- a/e2e/e2e_openssl_test.go
+++ b/e2e/e2e_openssl_test.go
@@ -170,6 +170,8 @@ func ciphersOpenSSL(cfg *dtls.Config) string {
 		dtls.TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8:      "ECDHE-ECDSA-AES128-CCM8",
 		dtls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: "ECDHE-ECDSA-AES128-GCM-SHA256",
 		dtls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:   "ECDHE-RSA-AES128-GCM-SHA256",
+		dtls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: "ECDHE-ECDSA-AES256-GCM-SHA384",
+		dtls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:   "ECDHE-RSA-AES256-GCM-SHA384",
 
 		dtls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: "ECDHE-ECDSA-AES256-SHA",
 		dtls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:   "ECDHE-RSA-AES128-SHA",
diff --git a/e2e/e2e_test.go b/e2e/e2e_test.go
index 1a77b3b..8f99c4e 100644
--- a/e2e/e2e_test.go
+++ b/e2e/e2e_test.go
@@ -226,6 +226,7 @@ func testPionE2ESimple(t *testing.T, server, client func(*comm)) {
 
 	for _, cipherSuite := range []dtls.CipherSuiteID{
 		dtls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+		dtls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
 		dtls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
 	} {
 		cipherSuite := cipherSuite
diff --git a/e2e/e2e_v113_test.go b/e2e/e2e_v113_test.go
index 5d7243f..aa81241 100644
--- a/e2e/e2e_v113_test.go
+++ b/e2e/e2e_v113_test.go
@@ -29,6 +29,8 @@ func testPionE2ESimpleED25519(t *testing.T, server, client func(*comm)) {
 		dtls.TLS_ECDHE_ECDSA_WITH_AES_128_CCM,
 		dtls.TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8,
 		dtls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+		dtls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+		dtls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
 		dtls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
 	} {
 		cipherSuite := cipherSuite