Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 2db8224

Browse filesBrowse files
peterdettmanpeterdettman
committed
BCJSSE: Enable TLS 1.3 by default
- low-level API defaults to offering (DTLS) 1.2, TLS 13
1 parent 21382c0 commit 2db8224
Copy full SHA for 2db8224

File tree

Expand file treeCollapse file tree

12 files changed

+30
-46
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

12 files changed

+30
-46
lines changed
Open diff view settings
Collapse file

‎docs/releasenotes.html‎

Copy file name to clipboardExpand all lines: docs/releasenotes.html
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ <h3>2.1.2 Defects Fixed</h3>
3030
</ul>
3131
<h3>2.1.3 Additional Features and Functionality</h3>
3232
<ul>
33+
<li>BCJSSE: TLS 1.3 is now enabled by default where no explicit protocols are supplied (e.g. "TLS" or "Default" SSLContext algorithms, or SSLContext.getDefault() method).</li>
34+
<li>(D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are offered now. Earlier versions are still supported if explicitly enabled. Users may need to check they are offering suitable cipher suites for TLS 1.3.</li>
3335
<li>The NIST PQC Alternate Candidate, Picnic, has been added to the low level API and the BCPQC provider.</li>
3436
</ul>
3537

Collapse file

‎tls/src/main/java/org/bouncycastle/jsse/provider/ProvSSLContextSpi.java‎

Copy file name to clipboardExpand all lines: tls/src/main/java/org/bouncycastle/jsse/provider/ProvSSLContextSpi.java
+1-2Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -161,8 +161,7 @@ private static List<String> createDefaultProtocolList(Set<String> supportedProto
161161
{
162162
ArrayList<String> ps = new ArrayList<String>();
163163

164-
// TODO[tls13] Enable TLSv1.3 by default in due course
165-
// ps.add("TLSv1.3");
164+
ps.add("TLSv1.3");
166165
ps.add("TLSv1.2");
167166
ps.add("TLSv1.1");
168167
ps.add("TLSv1");
Collapse file

‎tls/src/main/java/org/bouncycastle/tls/AbstractTlsPeer.java‎

Copy file name to clipboardExpand all lines: tls/src/main/java/org/bouncycastle/tls/AbstractTlsPeer.java
+1-2Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,7 @@ protected AbstractTlsPeer(TlsCrypto crypto)
2929
*/
3030
protected ProtocolVersion[] getSupportedVersions()
3131
{
32-
// TODO[tls13] Enable TLSv13 by default in due course
33-
return ProtocolVersion.TLSv12.downTo(ProtocolVersion.TLSv10);
32+
return ProtocolVersion.TLSv13.downTo(ProtocolVersion.TLSv12);
3433
}
3534

3635
protected abstract int[] getSupportedCipherSuites();
Collapse file

‎tls/src/main/java/org/bouncycastle/tls/DefaultTlsClient.java‎

Copy file name to clipboardExpand all lines: tls/src/main/java/org/bouncycastle/tls/DefaultTlsClient.java
+5-6Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,11 @@ public abstract class DefaultTlsClient
77
{
88
private static final int[] DEFAULT_CIPHER_SUITES = new int[]
99
{
10-
// TODO[tls13]
11-
// /*
12-
// * TLS 1.3
13-
// */
14-
// CipherSuite.TLS_CHACHA20_POLY1305_SHA256,
15-
// CipherSuite.TLS_AES_128_GCM_SHA256,
10+
/*
11+
* TLS 1.3
12+
*/
13+
CipherSuite.TLS_CHACHA20_POLY1305_SHA256,
14+
CipherSuite.TLS_AES_128_GCM_SHA256,
1615

1716
/*
1817
* pre-TLS 1.3
Collapse file

‎tls/src/main/java/org/bouncycastle/tls/DefaultTlsServer.java‎

Copy file name to clipboardExpand all lines: tls/src/main/java/org/bouncycastle/tls/DefaultTlsServer.java
+12-9Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,12 @@ public abstract class DefaultTlsServer
99
{
1010
private static final int[] DEFAULT_CIPHER_SUITES = new int[]
1111
{
12-
// TODO[tls13]
13-
// /*
14-
// * TLS 1.3
15-
// */
16-
// CipherSuite.TLS_CHACHA20_POLY1305_SHA256,
17-
// CipherSuite.TLS_AES_256_GCM_SHA384,
18-
// CipherSuite.TLS_AES_128_GCM_SHA256,
12+
/*
13+
* TLS 1.3
14+
*/
15+
CipherSuite.TLS_CHACHA20_POLY1305_SHA256,
16+
CipherSuite.TLS_AES_256_GCM_SHA384,
17+
CipherSuite.TLS_AES_128_GCM_SHA256,
1918

2019
/*
2120
* pre-TLS 1.3
@@ -79,9 +78,9 @@ protected int[] getSupportedCipherSuites()
7978
public TlsCredentials getCredentials()
8079
throws IOException
8180
{
82-
int keyExchangeAlgorithm = context.getSecurityParametersHandshake().getKeyExchangeAlgorithm();
81+
SecurityParameters securityParameters = context.getSecurityParametersHandshake();
8382

84-
switch (keyExchangeAlgorithm)
83+
switch (securityParameters.getKeyExchangeAlgorithm())
8584
{
8685
case KeyExchangeAlgorithm.DHE_DSS:
8786
return getDSASignerCredentials();
@@ -97,6 +96,10 @@ public TlsCredentials getCredentials()
9796
case KeyExchangeAlgorithm.ECDHE_RSA:
9897
return getRSASignerCredentials();
9998

99+
case KeyExchangeAlgorithm.NULL:
100+
throw new TlsFatalAlert(AlertDescription.internal_error,
101+
securityParameters.getNegotiatedVersion() + " credentials unhandled");
102+
100103
case KeyExchangeAlgorithm.RSA:
101104
return getRSAEncryptionCredentials();
102105

Collapse file

‎tls/src/main/java/org/bouncycastle/tls/PSKTlsClient.java‎

Copy file name to clipboardExpand all lines: tls/src/main/java/org/bouncycastle/tls/PSKTlsClient.java
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ public PSKTlsClient(TlsCrypto crypto, TlsPSKIdentity pskIdentity)
3434

3535
protected ProtocolVersion[] getSupportedVersions()
3636
{
37-
return ProtocolVersion.TLSv12.downTo(ProtocolVersion.TLSv10);
37+
return ProtocolVersion.TLSv12.only();
3838
}
3939

4040
protected int[] getSupportedCipherSuites()
Collapse file

‎tls/src/main/java/org/bouncycastle/tls/PSKTlsServer.java‎

Copy file name to clipboardExpand all lines: tls/src/main/java/org/bouncycastle/tls/PSKTlsServer.java
+1-7Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -39,20 +39,14 @@ protected TlsCredentialedDecryptor getRSAEncryptionCredentials() throws IOExcept
3939

4040
protected ProtocolVersion[] getSupportedVersions()
4141
{
42-
return ProtocolVersion.TLSv12.downTo(ProtocolVersion.TLSv10);
42+
return ProtocolVersion.TLSv12.only();
4343
}
4444

4545
protected int[] getSupportedCipherSuites()
4646
{
4747
return TlsUtils.getSupportedCipherSuites(getCrypto(), DEFAULT_CIPHER_SUITES);
4848
}
4949

50-
/** @deprecated Unused; will be removed */
51-
public ProtocolVersion getMaximumVersion()
52-
{
53-
return ProtocolVersion.TLSv12;
54-
}
55-
5650
public TlsCredentials getCredentials() throws IOException
5751
{
5852
int keyExchangeAlgorithm = context.getSecurityParametersHandshake().getKeyExchangeAlgorithm();
Collapse file

‎tls/src/main/java/org/bouncycastle/tls/SRPTlsClient.java‎

Copy file name to clipboardExpand all lines: tls/src/main/java/org/bouncycastle/tls/SRPTlsClient.java
+1-7Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ protected int[] getSupportedCipherSuites()
3434

3535
protected ProtocolVersion[] getSupportedVersions()
3636
{
37-
return ProtocolVersion.TLSv12.downTo(ProtocolVersion.TLSv10);
37+
return ProtocolVersion.TLSv12.only();
3838
}
3939

4040
protected boolean requireSRPServerExtension()
@@ -43,12 +43,6 @@ protected boolean requireSRPServerExtension()
4343
return false;
4444
}
4545

46-
/** @deprecated Unused; will be removed */
47-
public ProtocolVersion getClientVersion()
48-
{
49-
return ProtocolVersion.TLSv12;
50-
}
51-
5246
public Hashtable getClientExtensions()
5347
throws IOException
5448
{
Collapse file

‎tls/src/main/java/org/bouncycastle/tls/SRPTlsServer.java‎

Copy file name to clipboardExpand all lines: tls/src/main/java/org/bouncycastle/tls/SRPTlsServer.java
+1-7Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -44,20 +44,14 @@ protected TlsCredentialedSigner getRSASignerCredentials()
4444

4545
protected ProtocolVersion[] getSupportedVersions()
4646
{
47-
return ProtocolVersion.TLSv12.downTo(ProtocolVersion.TLSv10);
47+
return ProtocolVersion.TLSv12.only();
4848
}
4949

5050
protected int[] getSupportedCipherSuites()
5151
{
5252
return TlsUtils.getSupportedCipherSuites(getCrypto(), DEFAULT_CIPHER_SUITES);
5353
}
5454

55-
/** @deprecated Unused; will be removed */
56-
public ProtocolVersion getMaximumVersion()
57-
{
58-
return ProtocolVersion.TLSv12;
59-
}
60-
6155
public void processClientExtensions(Hashtable clientExtensions) throws IOException
6256
{
6357
super.processClientExtensions(clientExtensions);
Collapse file

‎tls/src/test/java/org/bouncycastle/jsse/provider/test/KeyManagerFactoryTest.java‎

Copy file name to clipboardExpand all lines: tls/src/test/java/org/bouncycastle/jsse/provider/test/KeyManagerFactoryTest.java
+3-3Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ public void testRSAServer()
7373

7474
trustManagerFactory.init(trustStore);
7575

76-
SSLContext context = SSLContext.getInstance("TLS", ProviderUtils.PROVIDER_NAME_BCJSSE);
76+
SSLContext context = SSLContext.getInstance("TLSv1.2", ProviderUtils.PROVIDER_NAME_BCJSSE);
7777

7878
context.init(null, trustManagerFactory.getTrustManagers(), null);
7979

@@ -119,7 +119,7 @@ public void testRSAServerTrustEE()
119119
ProviderUtils.PROVIDER_NAME_BCJSSE);
120120
trustManagerFactory.init(trustStore);
121121

122-
SSLContext context = SSLContext.getInstance("TLS", ProviderUtils.PROVIDER_NAME_BCJSSE);
122+
SSLContext context = SSLContext.getInstance("TLSv1.2", ProviderUtils.PROVIDER_NAME_BCJSSE);
123123

124124
context.init(null, trustManagerFactory.getTrustManagers(), null);
125125

@@ -158,7 +158,7 @@ public void testRSAServerWithClientAuth()
158158
ProviderUtils.PROVIDER_NAME_BCJSSE);
159159
trustManagerFactory.init(clientTS);
160160

161-
SSLContext context = SSLContext.getInstance("TLS", ProviderUtils.PROVIDER_NAME_BCJSSE);
161+
SSLContext context = SSLContext.getInstance("TLSv1.2", ProviderUtils.PROVIDER_NAME_BCJSSE);
162162

163163
context.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), null);
164164

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.