add("TLS_DH_anon_WITH_AES_256_CBC_SHA256", 0x006d, --p, K_DH_ANON, B_AES_256, N, max, tls12, P_SHA256); add("TLS_ECDH_anon_WITH_AES_256_CBC_SHA", 0xC019, --p, K_ECDH_ANON, B_AES_256, T); add("TLS_DH_anon_WITH_AES_256_CBC_SHA", 0x003a, --p, K_DH_ANON, B_AES_256, N); add("TLS_DH_anon_WITH_AES_128_CBC_SHA256", 0x006c, --p, K_DH_ANON, B_AES_128, N, max, tls12, P_SHA256); add("TLS_ECDH_anon_WITH_AES_128_CBC_SHA", 0xC018, --p, K_ECDH_ANON, B_AES_128, T); add("TLS_DH_anon_WITH_AES_128_CBC_SHA", 0x0034, --p, K_DH_ANON, B_AES_128, N); add("TLS_ECDH_anon_WITH_RC4_128_SHA", 0xC016, --p, K_ECDH_ANON, B_RC4_128, N); add("SSL_DH_anon_WITH_RC4_128_MD5", 0x0018, --p, K_DH_ANON, B_RC4_128, N); add("TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA", 0xC017, --p, K_ECDH_ANON, B_3DES, T); add("SSL_DH_anon_WITH_3DES_EDE_CBC_SHA", 0x001b, --p, K_DH_ANON, B_3DES, N); add("TLS_RSA_WITH_NULL_SHA256", 0x003b, --p, K_RSA, B_NULL, N, max, tls12, P_SHA256); add("TLS_ECDHE_ECDSA_WITH_NULL_SHA", 0xC006, --p, K_ECDHE_ECDSA, B_NULL, N); add("TLS_ECDHE_RSA_WITH_NULL_SHA", 0xC010, --p, K_ECDHE_RSA, B_NULL, N); add("SSL_RSA_WITH_NULL_SHA", 0x0002, --p, K_RSA, B_NULL, N); add("TLS_ECDH_ECDSA_WITH_NULL_SHA", 0xC001, --p, K_ECDH_ECDSA, B_NULL, N); add("TLS_ECDH_RSA_WITH_NULL_SHA", 0xC00B, --p, K_ECDH_RSA, B_NULL, N); add("TLS_ECDH_anon_WITH_NULL_SHA", 0xC015, --p, K_ECDH_ANON, B_NULL, N); add("SSL_RSA_WITH_NULL_MD5", 0x0001, --p, K_RSA, B_NULL, N); // weak cipher suites obsoleted in TLS 1.2 add("SSL_RSA_WITH_DES_CBC_SHA", 0x0009, --p, K_RSA, B_DES, N, tls12); add("SSL_DHE_RSA_WITH_DES_CBC_SHA", 0x0015, --p, K_DHE_RSA, B_DES, N, tls12); add("SSL_DHE_DSS_WITH_DES_CBC_SHA", 0x0012, --p, K_DHE_DSS, B_DES, N, tls12); add("SSL_DH_anon_WITH_DES_CBC_SHA", 0x001a, --p, K_DH_ANON, B_DES, N, tls12); // weak cipher suites obsoleted in TLS 1.1 add("SSL_RSA_EXPORT_WITH_RC4_40_MD5", 0x0003, --p, K_RSA_EXPORT, B_RC4_40, N, tls11); add("SSL_DH_anon_EXPORT_WITH_RC4_40_MD5", 0x0017, --p, K_DH_ANON, B_RC4_40, N, tls11); add("SSL_RSA_EXPORT_WITH_DES40_CBC_SHA", 0x0008, --p, K_RSA_EXPORT, B_DES_40, N, tls11); add("SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA", 0x0014, --p, K_DHE_RSA, B_DES_40, N, tls11); add("SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA", 0x0011, --p, K_DHE_DSS, B_DES_40, N, tls11); add("SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA", 0x0019, --p, K_DH_ANON, B_DES_40, N, tls11); // Supported Kerberos ciphersuites from RFC2712 add("TLS_KRB5_WITH_RC4_128_SHA", 0x0020, --p, K_KRB5, B_RC4_128, N); add("TLS_KRB5_WITH_RC4_128_MD5", 0x0024, --p, K_KRB5, B_RC4_128, N); add("TLS_KRB5_WITH_3DES_EDE_CBC_SHA", 0x001f, --p, K_KRB5, B_3DES, N); add("TLS_KRB5_WITH_3DES_EDE_CBC_MD5", 0x0023, --p, K_KRB5, B_3DES, N); add("TLS_KRB5_WITH_DES_CBC_SHA", 0x001e, --p, K_KRB5, B_DES, N, tls12); add("TLS_KRB5_WITH_DES_CBC_MD5", 0x0022, --p, K_KRB5, B_DES, N, tls12); add("TLS_KRB5_EXPORT_WITH_RC4_40_SHA", 0x0028, --p, K_KRB5_EXPORT, B_RC4_40, N, tls11); add("TLS_KRB5_EXPORT_WITH_RC4_40_MD5", 0x002b, --p, K_KRB5_EXPORT, B_RC4_40, N, tls11); add("TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA", 0x0026, --p, K_KRB5_EXPORT, B_DES_40, N, tls11); add("TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5", 0x0029, --p, K_KRB5_EXPORT, B_DES_40, N, tls11); /* * Other values from the TLS Cipher Suite Registry, as of August 2010. * * http://www.iana.org/assignments/tls-parameters/tls-parameters.xml * * Range Registration Procedures Notes * 000-191 Standards Action Refers to value of first byte * 192-254 Specification Required Refers to value of first byte * 255 Reserved for Private Use Refers to value of first byte */ // Register the names of a few additional CipherSuites. // Makes them show up as names instead of numbers in // the debug output. // remaining unsupported ciphersuites defined in RFC2246. add("SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5", 0x0006); add("SSL_RSA_WITH_IDEA_CBC_SHA", 0x0007); add("SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA", 0x000b); add("SSL_DH_DSS_WITH_DES_CBC_SHA", 0x000c); add("SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA", 0x000d); add("SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA", 0x000e); add("SSL_DH_RSA_WITH_DES_CBC_SHA", 0x000f); add("SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA", 0x0010); // SSL 3.0 Fortezza ciphersuites add("SSL_FORTEZZA_DMS_WITH_NULL_SHA", 0x001c); add("SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA", 0x001d); // 1024/56 bit exportable ciphersuites from expired internet draft add("SSL_RSA_EXPORT1024_WITH_DES_CBC_SHA", 0x0062); add("SSL_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA", 0x0063); add("SSL_RSA_EXPORT1024_WITH_RC4_56_SHA", 0x0064); add("SSL_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA", 0x0065); add("SSL_DHE_DSS_WITH_RC4_128_SHA", 0x0066); // Netscape old and new SSL 3.0 FIPS ciphersuites // see http://www.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html add("NETSCAPE_RSA_FIPS_WITH_3DES_EDE_CBC_SHA", 0xffe0); add("NETSCAPE_RSA_FIPS_WITH_DES_CBC_SHA", 0xffe1); add("SSL_RSA_FIPS_WITH_DES_CBC_SHA", 0xfefe); add("SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA", 0xfeff); // Unsupported Kerberos cipher suites from RFC 2712 add("TLS_KRB5_WITH_IDEA_CBC_SHA", 0x0021); add("TLS_KRB5_WITH_IDEA_CBC_MD5", 0x0025); add("TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA", 0x0027); add("TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5", 0x002a); // Unsupported cipher suites from RFC 4162 add("TLS_RSA_WITH_SEED_CBC_SHA", 0x0096); add("TLS_DH_DSS_WITH_SEED_CBC_SHA", 0x0097); add("TLS_DH_RSA_WITH_SEED_CBC_SHA", 0x0098); add("TLS_DHE_DSS_WITH_SEED_CBC_SHA", 0x0099); add("TLS_DHE_RSA_WITH_SEED_CBC_SHA", 0x009a); add("TLS_DH_anon_WITH_SEED_CBC_SHA", 0x009b); // Unsupported cipher suites from RFC 4279 add("TLS_PSK_WITH_RC4_128_SHA", 0x008a); add("TLS_PSK_WITH_3DES_EDE_CBC_SHA", 0x008b); add("TLS_PSK_WITH_AES_128_CBC_SHA", 0x008c); add("TLS_PSK_WITH_AES_256_CBC_SHA", 0x008d); add("TLS_DHE_PSK_WITH_RC4_128_SHA", 0x008e); add("TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA", 0x008f); add("TLS_DHE_PSK_WITH_AES_128_CBC_SHA", 0x0090); add("TLS_DHE_PSK_WITH_AES_256_CBC_SHA", 0x0091); add("TLS_RSA_PSK_WITH_RC4_128_SHA", 0x0092); add("TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA", 0x0093); add("TLS_RSA_PSK_WITH_AES_128_CBC_SHA", 0x0094); add("TLS_RSA_PSK_WITH_AES_256_CBC_SHA", 0x0095); // Unsupported cipher suites from RFC 4785 add("TLS_PSK_WITH_NULL_SHA", 0x002c); add("TLS_DHE_PSK_WITH_NULL_SHA", 0x002d); add("TLS_RSA_PSK_WITH_NULL_SHA", 0x002e); // Unsupported cipher suites from RFC 5246 add("TLS_DH_DSS_WITH_AES_128_CBC_SHA", 0x0030); add("TLS_DH_RSA_WITH_AES_128_CBC_SHA", 0x0031); add("TLS_DH_DSS_WITH_AES_256_CBC_SHA", 0x0036); add("TLS_DH_RSA_WITH_AES_256_CBC_SHA", 0x0037); add("TLS_DH_DSS_WITH_AES_128_CBC_SHA256", 0x003e); add("TLS_DH_RSA_WITH_AES_128_CBC_SHA256", 0x003f); add("TLS_DH_DSS_WITH_AES_256_CBC_SHA256", 0x0068); add("TLS_DH_RSA_WITH_AES_256_CBC_SHA256", 0x0069); // Unsupported cipher suites from RFC 5288 add("TLS_RSA_WITH_AES_128_GCM_SHA256", 0x009c); add("TLS_RSA_WITH_AES_256_GCM_SHA384", 0x009d); add("TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", 0x009e); add("TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", 0x009f); add("TLS_DH_RSA_WITH_AES_128_GCM_SHA256", 0x00a0); add("TLS_DH_RSA_WITH_AES_256_GCM_SHA384", 0x00a1); add("TLS_DHE_DSS_WITH_AES_128_GCM_SHA256", 0x00a2); add("TLS_DHE_DSS_WITH_AES_256_GCM_SHA384", 0x00a3); add("TLS_DH_DSS_WITH_AES_128_GCM_SHA256", 0x00a4); add("TLS_DH_DSS_WITH_AES_256_GCM_SHA384", 0x00a5); add("TLS_DH_anon_WITH_AES_128_GCM_SHA256", 0x00a6); add("TLS_DH_anon_WITH_AES_256_GCM_SHA384", 0x00a7); // Unsupported cipher suites from RFC 5487 add("TLS_PSK_WITH_AES_128_GCM_SHA256", 0x00a8); add("TLS_PSK_WITH_AES_256_GCM_SHA384", 0x00a9); add("TLS_DHE_PSK_WITH_AES_128_GCM_SHA256", 0x00aa); add("TLS_DHE_PSK_WITH_AES_256_GCM_SHA384", 0x00ab); add("TLS_RSA_PSK_WITH_AES_128_GCM_SHA256", 0x00ac); add("TLS_RSA_PSK_WITH_AES_256_GCM_SHA384", 0x00ad); add("TLS_PSK_WITH_AES_128_CBC_SHA256", 0x00ae); add("TLS_PSK_WITH_AES_256_CBC_SHA384", 0x00af); add("TLS_PSK_WITH_NULL_SHA256", 0x00b0); add("TLS_PSK_WITH_NULL_SHA384", 0x00b1); add("TLS_DHE_PSK_WITH_AES_128_CBC_SHA256", 0x00b2); add("TLS_DHE_PSK_WITH_AES_256_CBC_SHA384", 0x00b3); add("TLS_DHE_PSK_WITH_NULL_SHA256", 0x00b4); add("TLS_DHE_PSK_WITH_NULL_SHA384", 0x00b5); add("TLS_RSA_PSK_WITH_AES_128_CBC_SHA256", 0x00b6); add("TLS_RSA_PSK_WITH_AES_256_CBC_SHA384", 0x00b7); add("TLS_RSA_PSK_WITH_NULL_SHA256", 0x00b8); add("TLS_RSA_PSK_WITH_NULL_SHA384", 0x00b9); // Unsupported cipher suites from RFC 5932 add("TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", 0x0041); add("TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA", 0x0042); add("TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA", 0x0043); add("TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA", 0x0044); add("TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", 0x0045); add("TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA", 0x0046); add("TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", 0x0084); add("TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA", 0x0085); add("TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA", 0x0086); add("TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA", 0x0087); add("TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", 0x0088); add("TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA", 0x0089); add("TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", 0x00ba); add("TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256", 0x00bb); add("TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256", 0x00bc); add("TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256", 0x00bd); add("TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", 0x00be); add("TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256", 0x00bf); add("TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", 0x00c0); add("TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256", 0x00c1); add("TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256", 0x00c2); add("TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256", 0x00c3); add("TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", 0x00c4); add("TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256", 0x00c5); // Unsupported cipher suites from RFC 5054 add("TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA", 0xc01a); add("TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA", 0xc01b); add("TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA", 0xc01c); add("TLS_SRP_SHA_WITH_AES_128_CBC_SHA", 0xc01d); add("TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA", 0xc01e); add("TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA", 0xc01f); add("TLS_SRP_SHA_WITH_AES_256_CBC_SHA", 0xc020); add("TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA", 0xc021); add("TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA", 0xc022); // Unsupported cipher suites from RFC 5289 add("TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", 0xc02b); add("TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", 0xc02c); add("TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256", 0xc02d); add("TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384", 0xc02e); add("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", 0xc02f); add("TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", 0xc030); add("TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256", 0xc031); add("TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384", 0xc032); // Unsupported cipher suites from RFC 5489 add("TLS_ECDHE_PSK_WITH_RC4_128_SHA", 0xc033); add("TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA", 0xc034); add("TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA", 0xc035); add("TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA", 0xc036); add("TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256", 0xc037); add("TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384", 0xc038); add("TLS_ECDHE_PSK_WITH_NULL_SHA", 0xc039); add("TLS_ECDHE_PSK_WITH_NULL_SHA256", 0xc03a); add("TLS_ECDHE_PSK_WITH_NULL_SHA384", 0xc03b); } // ciphersuite SSL_NULL_WITH_NULL_NULL final static CipherSuite C_NULL = CipherSuite.valueOf(0, 0); // ciphersuite TLS_EMPTY_RENEGOTIATION_INFO_SCSV final static CipherSuite C_SCSV = CipherSuite.valueOf(0x00, 0xff);}Lines 1001–1274 of 1274. Previous lines
add("TLS_DH_anon_WITH_AES_256_CBC_SHA256", 0x006d, --p, K_DH_ANON, B_AES_256, N, max, tls12, P_SHA256); add("TLS_ECDH_anon_WITH_AES_256_CBC_SHA", 0xC019, --p, K_ECDH_ANON, B_AES_256, T); add("TLS_DH_anon_WITH_AES_256_CBC_SHA", 0x003a, --p, K_DH_ANON, B_AES_256, N); add("TLS_DH_anon_WITH_AES_128_CBC_SHA256", 0x006c, --p, K_DH_ANON, B_AES_128, N, max, tls12, P_SHA256); add("TLS_ECDH_anon_WITH_AES_128_CBC_SHA", 0xC018, --p, K_ECDH_ANON, B_AES_128, T); add("TLS_DH_anon_WITH_AES_128_CBC_SHA", 0x0034, --p, K_DH_ANON, B_AES_128, N); add("TLS_ECDH_anon_WITH_RC4_128_SHA", 0xC016, --p, K_ECDH_ANON, B_RC4_128, N); add("SSL_DH_anon_WITH_RC4_128_MD5", 0x0018, --p, K_DH_ANON, B_RC4_128, N); add("TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA", 0xC017, --p, K_ECDH_ANON, B_3DES, T); add("SSL_DH_anon_WITH_3DES_EDE_CBC_SHA", 0x001b, --p, K_DH_ANON, B_3DES, N); add("TLS_RSA_WITH_NULL_SHA256", 0x003b, --p, K_RSA, B_NULL, N, max, tls12, P_SHA256); add("TLS_ECDHE_ECDSA_WITH_NULL_SHA", 0xC006, --p, K_ECDHE_ECDSA, B_NULL, N); add("TLS_ECDHE_RSA_WITH_NULL_SHA", 0xC010, --p, K_ECDHE_RSA, B_NULL, N); add("SSL_RSA_WITH_NULL_SHA", 0x0002, --p, K_RSA, B_NULL, N); add("TLS_ECDH_ECDSA_WITH_NULL_SHA", 0xC001, --p, K_ECDH_ECDSA, B_NULL, N); add("TLS_ECDH_RSA_WITH_NULL_SHA", 0xC00B, --p, K_ECDH_RSA, B_NULL, N); add("TLS_ECDH_anon_WITH_NULL_SHA", 0xC015, --p, K_ECDH_ANON, B_NULL, N); add("SSL_RSA_WITH_NULL_MD5", 0x0001, --p, K_RSA, B_NULL, N); // weak cipher suites obsoleted in TLS 1.2 add("SSL_RSA_WITH_DES_CBC_SHA", 0x0009, --p, K_RSA, B_DES, N, tls12); add("SSL_DHE_RSA_WITH_DES_CBC_SHA", 0x0015, --p, K_DHE_RSA, B_DES, N, tls12); add("SSL_DHE_DSS_WITH_DES_CBC_SHA", 0x0012, --p, K_DHE_DSS, B_DES, N, tls12); add("SSL_DH_anon_WITH_DES_CBC_SHA", 0x001a, --p, K_DH_ANON, B_DES, N, tls12); // weak cipher suites obsoleted in TLS 1.1 add("SSL_RSA_EXPORT_WITH_RC4_40_MD5", 0x0003, --p, K_RSA_EXPORT, B_RC4_40, N, tls11); add("SSL_DH_anon_EXPORT_WITH_RC4_40_MD5", 0x0017, --p, K_DH_ANON, B_RC4_40, N, tls11); add("SSL_RSA_EXPORT_WITH_DES40_CBC_SHA", 0x0008, --p, K_RSA_EXPORT, B_DES_40, N, tls11); add("SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA", 0x0014, --p, K_DHE_RSA, B_DES_40, N, tls11); add("SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA", 0x0011, --p, K_DHE_DSS, B_DES_40, N, tls11); add("SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA", 0x0019, --p, K_DH_ANON, B_DES_40, N, tls11); // Supported Kerberos ciphersuites from RFC2712 add("TLS_KRB5_WITH_RC4_128_SHA", 0x0020, --p, K_KRB5, B_RC4_128, N); add("TLS_KRB5_WITH_RC4_128_MD5", 0x0024, --p, K_KRB5, B_RC4_128, N); add("TLS_KRB5_WITH_3DES_EDE_CBC_SHA", 0x001f, --p, K_KRB5, B_3DES, N); add("TLS_KRB5_WITH_3DES_EDE_CBC_MD5", 0x0023, --p, K_KRB5, B_3DES, N); add("TLS_KRB5_WITH_DES_CBC_SHA", 0x001e, --p, K_KRB5, B_DES, N, tls12); add("TLS_KRB5_WITH_DES_CBC_MD5", 0x0022, --p, K_KRB5, B_DES, N, tls12); add("TLS_KRB5_EXPORT_WITH_RC4_40_SHA", 0x0028, --p, K_KRB5_EXPORT, B_RC4_40, N, tls11); add("TLS_KRB5_EXPORT_WITH_RC4_40_MD5", 0x002b, --p, K_KRB5_EXPORT, B_RC4_40, N, tls11); add("TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA", 0x0026, --p, K_KRB5_EXPORT, B_DES_40, N, tls11); add("TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5", 0x0029, --p, K_KRB5_EXPORT, B_DES_40, N, tls11); /* * Other values from the TLS Cipher Suite Registry, as of August 2010. * * http://www.iana.org/assignments/tls-parameters/tls-parameters.xml * * Range Registration Procedures Notes * 000-191 Standards Action Refers to value of first byte * 192-254 Specification Required Refers to value of first byte * 255 Reserved for Private Use Refers to value of first byte */ // Register the names of a few additional CipherSuites. // Makes them show up as names instead of numbers in // the debug output. // remaining unsupported ciphersuites defined in RFC2246. add("SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5", 0x0006); add("SSL_RSA_WITH_IDEA_CBC_SHA", 0x0007); add("SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA", 0x000b); add("SSL_DH_DSS_WITH_DES_CBC_SHA", 0x000c); add("SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA", 0x000d); add("SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA", 0x000e); add("SSL_DH_RSA_WITH_DES_CBC_SHA", 0x000f); add("SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA", 0x0010); // SSL 3.0 Fortezza ciphersuites add("SSL_FORTEZZA_DMS_WITH_NULL_SHA", 0x001c); add("SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA", 0x001d); // 1024/56 bit exportable ciphersuites from expired internet draft add("SSL_RSA_EXPORT1024_WITH_DES_CBC_SHA", 0x0062); add("SSL_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA", 0x0063); add("SSL_RSA_EXPORT1024_WITH_RC4_56_SHA", 0x0064); add("SSL_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA", 0x0065); add("SSL_DHE_DSS_WITH_RC4_128_SHA", 0x0066); // Netscape old and new SSL 3.0 FIPS ciphersuites // see http://www.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html add("NETSCAPE_RSA_FIPS_WITH_3DES_EDE_CBC_SHA", 0xffe0); add("NETSCAPE_RSA_FIPS_WITH_DES_CBC_SHA", 0xffe1); add("SSL_RSA_FIPS_WITH_DES_CBC_SHA", 0xfefe); add("SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA", 0xfeff); // Unsupported Kerberos cipher suites from RFC 2712 add("TLS_KRB5_WITH_IDEA_CBC_SHA", 0x0021); add("TLS_KRB5_WITH_IDEA_CBC_MD5", 0x0025); add("TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA", 0x0027); add("TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5", 0x002a); // Unsupported cipher suites from RFC 4162 add("TLS_RSA_WITH_SEED_CBC_SHA", 0x0096); add("TLS_DH_DSS_WITH_SEED_CBC_SHA", 0x0097); add("TLS_DH_RSA_WITH_SEED_CBC_SHA", 0x0098); add("TLS_DHE_DSS_WITH_SEED_CBC_SHA", 0x0099); add("TLS_DHE_RSA_WITH_SEED_CBC_SHA", 0x009a); add("TLS_DH_anon_WITH_SEED_CBC_SHA", 0x009b); // Unsupported cipher suites from RFC 4279 add("TLS_PSK_WITH_RC4_128_SHA", 0x008a); add("TLS_PSK_WITH_3DES_EDE_CBC_SHA", 0x008b); add("TLS_PSK_WITH_AES_128_CBC_SHA", 0x008c); add("TLS_PSK_WITH_AES_256_CBC_SHA", 0x008d); add("TLS_DHE_PSK_WITH_RC4_128_SHA", 0x008e); add("TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA", 0x008f); add("TLS_DHE_PSK_WITH_AES_128_CBC_SHA", 0x0090); add("TLS_DHE_PSK_WITH_AES_256_CBC_SHA", 0x0091); add("TLS_RSA_PSK_WITH_RC4_128_SHA", 0x0092); add("TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA", 0x0093); add("TLS_RSA_PSK_WITH_AES_128_CBC_SHA", 0x0094); add("TLS_RSA_PSK_WITH_AES_256_CBC_SHA", 0x0095); // Unsupported cipher suites from RFC 4785 add("TLS_PSK_WITH_NULL_SHA", 0x002c); add("TLS_DHE_PSK_WITH_NULL_SHA", 0x002d); add("TLS_RSA_PSK_WITH_NULL_SHA", 0x002e); // Unsupported cipher suites from RFC 5246 add("TLS_DH_DSS_WITH_AES_128_CBC_SHA", 0x0030); add("TLS_DH_RSA_WITH_AES_128_CBC_SHA", 0x0031); add("TLS_DH_DSS_WITH_AES_256_CBC_SHA", 0x0036); add("TLS_DH_RSA_WITH_AES_256_CBC_SHA", 0x0037); add("TLS_DH_DSS_WITH_AES_128_CBC_SHA256", 0x003e); add("TLS_DH_RSA_WITH_AES_128_CBC_SHA256", 0x003f); add("TLS_DH_DSS_WITH_AES_256_CBC_SHA256", 0x0068); add("TLS_DH_RSA_WITH_AES_256_CBC_SHA256", 0x0069); // Unsupported cipher suites from RFC 5288 add("TLS_RSA_WITH_AES_128_GCM_SHA256", 0x009c); add("TLS_RSA_WITH_AES_256_GCM_SHA384", 0x009d); add("TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", 0x009e); add("TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", 0x009f); add("TLS_DH_RSA_WITH_AES_128_GCM_SHA256", 0x00a0); add("TLS_DH_RSA_WITH_AES_256_GCM_SHA384", 0x00a1); add("TLS_DHE_DSS_WITH_AES_128_GCM_SHA256", 0x00a2); add("TLS_DHE_DSS_WITH_AES_256_GCM_SHA384", 0x00a3); add("TLS_DH_DSS_WITH_AES_128_GCM_SHA256", 0x00a4); add("TLS_DH_DSS_WITH_AES_256_GCM_SHA384", 0x00a5); add("TLS_DH_anon_WITH_AES_128_GCM_SHA256", 0x00a6); add("TLS_DH_anon_WITH_AES_256_GCM_SHA384", 0x00a7); // Unsupported cipher suites from RFC 5487 add("TLS_PSK_WITH_AES_128_GCM_SHA256", 0x00a8); add("TLS_PSK_WITH_AES_256_GCM_SHA384", 0x00a9); add("TLS_DHE_PSK_WITH_AES_128_GCM_SHA256", 0x00aa); add("TLS_DHE_PSK_WITH_AES_256_GCM_SHA384", 0x00ab); add("TLS_RSA_PSK_WITH_AES_128_GCM_SHA256", 0x00ac); add("TLS_RSA_PSK_WITH_AES_256_GCM_SHA384", 0x00ad); add("TLS_PSK_WITH_AES_128_CBC_SHA256", 0x00ae); add("TLS_PSK_WITH_AES_256_CBC_SHA384", 0x00af); add("TLS_PSK_WITH_NULL_SHA256", 0x00b0); add("TLS_PSK_WITH_NULL_SHA384", 0x00b1); add("TLS_DHE_PSK_WITH_AES_128_CBC_SHA256", 0x00b2); add("TLS_DHE_PSK_WITH_AES_256_CBC_SHA384", 0x00b3); add("TLS_DHE_PSK_WITH_NULL_SHA256", 0x00b4); add("TLS_DHE_PSK_WITH_NULL_SHA384", 0x00b5); add("TLS_RSA_PSK_WITH_AES_128_CBC_SHA256", 0x00b6); add("TLS_RSA_PSK_WITH_AES_256_CBC_SHA384", 0x00b7); add("TLS_RSA_PSK_WITH_NULL_SHA256", 0x00b8); add("TLS_RSA_PSK_WITH_NULL_SHA384", 0x00b9); // Unsupported cipher suites from RFC 5932 add("TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", 0x0041); add("TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA", 0x0042); add("TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA", 0x0043); add("TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA", 0x0044); add("TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", 0x0045); add("TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA", 0x0046); add("TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", 0x0084); add("TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA", 0x0085); add("TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA", 0x0086); add("TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA", 0x0087); add("TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", 0x0088); add("TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA", 0x0089); add("TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", 0x00ba); add("TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256", 0x00bb); add("TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256", 0x00bc); add("TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256", 0x00bd); add("TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", 0x00be); add("TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256", 0x00bf); add("TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", 0x00c0); add("TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256", 0x00c1); add("TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256", 0x00c2); add("TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256", 0x00c3); add("TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", 0x00c4); add("TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256", 0x00c5); // Unsupported cipher suites from RFC 5054 add("TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA", 0xc01a); add("TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA", 0xc01b); add("TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA", 0xc01c); add("TLS_SRP_SHA_WITH_AES_128_CBC_SHA", 0xc01d); add("TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA", 0xc01e); add("TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA", 0xc01f); add("TLS_SRP_SHA_WITH_AES_256_CBC_SHA", 0xc020); add("TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA", 0xc021); add("TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA", 0xc022); // Unsupported cipher suites from RFC 5289 add("TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", 0xc02b); add("TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", 0xc02c); add("TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256", 0xc02d); add("TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384", 0xc02e); add("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", 0xc02f); add("TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", 0xc030); add("TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256", 0xc031); add("TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384", 0xc032); // Unsupported cipher suites from RFC 5489 add("TLS_ECDHE_PSK_WITH_RC4_128_SHA", 0xc033); add("TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA", 0xc034); add("TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA", 0xc035); add("TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA", 0xc036); add("TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256", 0xc037); add("TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384", 0xc038); add("TLS_ECDHE_PSK_WITH_NULL_SHA", 0xc039); add("TLS_ECDHE_PSK_WITH_NULL_SHA256", 0xc03a); add("TLS_ECDHE_PSK_WITH_NULL_SHA384", 0xc03b); } // ciphersuite SSL_NULL_WITH_NULL_NULL final static CipherSuite C_NULL = CipherSuite.valueOf(0, 0); // ciphersuite TLS_EMPTY_RENEGOTIATION_INFO_SCSV final static CipherSuite C_SCSV = CipherSuite.valueOf(0x00, 0xff); }