TLS: Recognise DH parameters from named groups and handle as such
@@ -85,17 +85,41 @@ public static boolean isDHECipherSuite(int cipherSuite)
}
}
+ public static int getNamedGroupForDHParameters(BigInteger p, BigInteger g)
+ {
+ int[] namedGroups = new int[]{ NamedGroup.ffdhe2048, NamedGroup.ffdhe3072, NamedGroup.ffdhe4096,
+ NamedGroup.ffdhe6144, NamedGroup.ffdhe8192 };
+
+ for (int i = 0; i < namedGroups.length; ++i)
+ {
+ int namedGroup = namedGroups[i];
+ DHGroup dhGroup = getNamedDHGroup(namedGroup);
+ if (dhGroup != null && dhGroup.getP().equals(p) && dhGroup.getG().equals(g))
+ {
+ return namedGroup;
+ }
+ }
+
+ return -1;
+ }
+
public static TlsDHConfig readDHConfig(InputStream input) throws IOException
{
BigInteger p = readDHParameter(input);
BigInteger g = readDHParameter(input);
+ int namedGroup = getNamedGroupForDHParameters(p, g);
+ if (namedGroup >= 0)
+ {
+ return new TlsDHConfig(namedGroup);
+ }
+
return new TlsDHConfig(new DHGroup(p, null, g, 0));
}
public static TlsDHConfig receiveDHConfig(TlsDHConfigVerifier dhConfigVerifier, InputStream input) throws IOException
{
- TlsDHConfig dhConfig = TlsDHUtils.readDHConfig(input);
+ TlsDHConfig dhConfig = readDHConfig(input);
if (!dhConfigVerifier.accept(dhConfig))
{
throw new TlsFatalAlert(AlertDescription.insufficient_security);
@@ -111,7 +135,6 @@ public static BigInteger readDHParameter(InputStream input) throws IOException
public static void writeDHConfig(TlsDHConfig dhConfig, OutputStream output)
throws IOException
{
- // TODO[rfc7919] Confirm that named groups have to be explicitly encoded
DHGroup group = getDHGroup(dhConfig);
writeDHParameter(group.getP(), output);
writeDHParameter(group.getG(), output);
