diff options
| author | Juraj Somorovsky <[email protected]> | 2016-05-09 00:48:13 +0200 |
|---|---|---|
| committer | Juraj Somorovsky <[email protected]> | 2016-05-11 07:55:02 +0200 |
| commit | 7c7fcecbe6a94ffaba5752175d8da5e33fbf0d7b (patch) | |
| tree | 5ed7b29e5d3441c26b8aa6b5520ab589f9e05377 /src/lib/tls/msg_client_hello.cpp | |
| parent | 6d327f879c608908ca2c6b9b99f7fd74d498b4ef (diff) | |
Encrypt-then-MAC extension (RFC 7366)
Introduced a countermeasure against the logjam attack
Short TLS records (AES-CBC) now return BAD_RECORD_MAC
Fixed a compatibility problem with OpenSSL and TLS 1.0 (BEAST countermeasure)
Diffstat (limited to 'src/lib/tls/msg_client_hello.cpp')
| -rw-r--r-- | src/lib/tls/msg_client_hello.cpp | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/lib/tls/msg_client_hello.cpp b/src/lib/tls/msg_client_hello.cpp index 23807215f..d2b1a166e 100644 --- a/src/lib/tls/msg_client_hello.cpp +++ b/src/lib/tls/msg_client_hello.cpp @@ -96,6 +96,9 @@ Client_Hello::Client_Hello(Handshake_IO& io, if(reneg_info.empty() && !next_protocols.empty()) m_extensions.add(new Application_Layer_Protocol_Notification(next_protocols)); + + if(policy.negotiate_encrypt_then_mac()) + m_extensions.add(new Encrypt_then_MAC); #if defined(BOTAN_HAS_SRP6) m_extensions.add(new SRP_Identifier(srp_identifier)); @@ -155,6 +158,9 @@ Client_Hello::Client_Hello(Handshake_IO& io, if(reneg_info.empty() && !next_protocols.empty()) m_extensions.add(new Application_Layer_Protocol_Notification(next_protocols)); + + if(policy.negotiate_encrypt_then_mac()) + m_extensions.add(new Encrypt_then_MAC); #if defined(BOTAN_HAS_SRP6) m_extensions.add(new SRP_Identifier(session.srp_identifier())); |