wolfssl/tests/test-tls13.conf

# server TLSv1.3 TLS13-CHACHA20-POLY1305-SHA256
-v 4
-l TLS13-CHACHA20-POLY1305-SHA256

# client TLSv1.3 TLS13-CHACHA20-POLY1305-SHA256
-v 4
-l TLS13-CHACHA20-POLY1305-SHA256

# server TLSv1.3 TLS13-AES128-GCM-SHA256
-v 4
-l TLS13-AES128-GCM-SHA256
-6

# client TLSv1.3 TLS13-AES128-GCM-SHA256
-v 4
-l TLS13-AES128-GCM-SHA256
-6

# server TLSv1.3 TLS13-AES256-GCM-SHA384
-v 4
-l TLS13-AES256-GCM-SHA384

# client TLSv1.3 TLS13-AES256-GCM-SHA384
-v 4
-l TLS13-AES256-GCM-SHA384

# server TLSv1.3 TLS13-AES128-CCM-SHA256
-v 4
-l TLS13-AES128-CCM-SHA256

# client TLSv1.3 TLS13-AES128-CCM-SHA256
-v 4
-l TLS13-AES128-CCM-SHA256

# server TLSv1.3 TLS13-AES128-CCM-8-SHA256
-v 4
-l TLS13-AES128-CCM-8-SHA256

# client TLSv1.3 TLS13-AES128-CCM-8-SHA256
-v 4
-l TLS13-AES128-CCM-8-SHA256

# server TLSv1.3 TLS13-AES128-CCM8-SHA256 (OpenSSL-compat alias)
-v 4
-l TLS13-AES128-CCM8-SHA256

# client TLSv1.3 TLS13-AES128-CCM8-SHA256 (OpenSSL-compat alias)
-v 4
-l TLS13-AES128-CCM8-SHA256

# server TLSv1.3 resumption
-v 4
-l TLS13-AES128-GCM-SHA256
-r

# client TLSv1.3 resumption
-v 4
-l TLS13-AES128-GCM-SHA256
-r

# server TLSv1.3 resumption - SHA384
-v 4
-l TLS13-AES256-GCM-SHA384
-r

# client TLSv1.3 resumption - SHA384
-v 4
-l TLS13-AES256-GCM-SHA384
-r

# server TLSv1.3 PSK without (EC)DHE
-v 4
-l TLS13-AES128-GCM-SHA256
-r

# client TLSv1.3 PSK without (EC)DHE
-v 4
-l TLS13-AES128-GCM-SHA256
-r
-K

# server TLSv1.3 accepting EarlyData
-v 4
-l TLS13-AES128-GCM-SHA256
-r
-0

# client TLSv1.3 sending EarlyData
-v 4
-l TLS13-AES128-GCM-SHA256
-r
-0

# server TLSv1.3 not accepting EarlyData
-v 4
-l TLS13-AES128-GCM-SHA256
-r

# client TLSv1.3 sending EarlyData
-v 4
-l TLS13-AES128-GCM-SHA256
-r
-0

# server TLSv1.3 accepting EarlyData
-v 4
-l TLS13-AES128-GCM-SHA256
-r
-0

# client TLSv1.3 not sending EarlyData
-v 4
-l TLS13-AES128-GCM-SHA256
-r

# server TLSv1.3
-v 4
-l TLS13-AES128-GCM-SHA256

# client TLSv1.3 Fragments
-v 4
-l TLS13-AES128-GCM-SHA256
-F 1

# server TLSv1.3
-v 4
-l TLS13-AES128-GCM-SHA256

# client TLSv1.3 HelloRetryRequest to negotiate Key Exchange algorithm
-v 4
-l TLS13-AES128-GCM-SHA256
-J

# server TLSv1.3
-v 4
-l TLS13-AES128-GCM-SHA256
-J

# client TLSv1.3 HelloRetryRequest with cookie
-v 4
-l TLS13-AES128-GCM-SHA256
-J

# server TLSv1.3
-v 4
-l TLS13-AES128-GCM-SHA256

# client TLSv1.3 DH key exchange
-v 4
-l TLS13-AES128-GCM-SHA256
-y

# server TLSv1.3
-v 4
-l TLS13-AES128-GCM-SHA256

# client TLSv1.3 ECC key exchange
-v 4
-l TLS13-AES128-GCM-SHA256
-Y

# server TLSv1.3
-v 4
-l TLS13-AES128-GCM-SHA256

# client TLSv1.3 ECC key exchange
-v 4
-l TLS13-AES128-GCM-SHA256
-Y

# server TLSv1.3 multiple cipher suites
-v 4
-l TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES128-CCM-SHA256:TLS13-AES128-CCM-8-SHA256

# client TLSv1.3
-v 4
-l TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES128-CCM-SHA256:TLS13-AES128-CCM-8-SHA256

# server TLSv1.3 KeyUpdate
-v 4
-l TLS13-AES128-GCM-SHA256
-U

# client TLSv1.3 KeyUpdate
-v 4
-l TLS13-AES128-GCM-SHA256
-I

# server TLSv1.3 No session ticket
-v 4
-l TLS13-AES128-GCM-SHA256
-T

# client TLSv1.3  No session ticket
-v 4
-l TLS13-AES128-GCM-SHA256

# server TLSv1.3 Post-Handshake Authentication
-v 4
-l TLS13-AES128-GCM-SHA256
-Q

# client TLSv1.3 Post-Handshake Authentication
-v 4
-l TLS13-AES128-GCM-SHA256
-Q

# server TLSv1.3 Send Ticket explicitly
-v 4
-l TLS13-AES128-GCM-SHA256
--send-ticket

# client TLSv1.3 Send Ticket explicitly
-v 4
-l TLS13-AES128-GCM-SHA256

# server TLSv1.3 Integrity-only SHA256
-v 4
-l TLS13-SHA256-SHA256

# client TLSv1.3 Integrity-only SHA256
-v 4
-l TLS13-SHA256-SHA256

# server TLSv1.3 Integrity-only SHA384
-v 4
-l TLS13-SHA384-SHA384

# client TLSv1.3 Integrity-only SHA384
-v 4
-l TLS13-SHA384-SHA384
TLS 1.3 fixes/improvements Support Draft 28: able to compile code to return BAD_BINDER if no PSKs match and certificates not to be used. Change key share implementation to use server preference - server now checks each client key share's group is in supported_groups extension. Client and server examples modified to support server preference. Application can set client's and server's supported groups by rank. Server's supported groups is sent back in encrypted_extensions if preferred group is not in client's list - able to be turned off at compile time. Application can query server's preferred group from client. Able to compile using 0x0304 as version instead of draft version. Fix state machine in TLS 1.3 to support unexpected hello_retry_request. Also fixes non-blocking. Fix resumption to use the named group from session. Fix named group in session structure to be a 2-byte field. Better detection of errors in message flow. Fix DoTls13ClientHello when downgrading - don't do TLS 1.3 things. Not downgrading on client fixed. Downgrade protocol version from TLS 1.3 when not TLS 1.3 ciphersuite. Get downgrading from TLS 1.3 and resumption working. Change earlyData value to an enum. Support no extensions data (as opposed to zero length extension data) in TLS 1.3 ClientHello. Check PSK cipher suite is available to both client and server before using. Check first PSK identity chosen when server says it is using early data at client. Check PSK extension is last in client_hello on server. Check the PSK cipher suite to use is supported on client. Check the returned cipher suite for pre-shared keys is the same as client expects. Send alert decrypt_error when verification fails in certificate_verify or finished message doesn't match calculated value. Fail when certificate messages recieved in handshake when using PSK. Validate on the server that EndOfEarlyData message has been recieved before finished message when server sent EarlyData extension. 2018-04-13 11:53:42 +10:00			`# server TLSv1.3 TLS13-CHACHA20-POLY1305-SHA256`
Add TLS v1.3 as an option 2016-11-24 01:31:07 +10:00			`-v 4`
TLS 1.3 fixes/improvements Support Draft 28: able to compile code to return BAD_BINDER if no PSKs match and certificates not to be used. Change key share implementation to use server preference - server now checks each client key share's group is in supported_groups extension. Client and server examples modified to support server preference. Application can set client's and server's supported groups by rank. Server's supported groups is sent back in encrypted_extensions if preferred group is not in client's list - able to be turned off at compile time. Application can query server's preferred group from client. Able to compile using 0x0304 as version instead of draft version. Fix state machine in TLS 1.3 to support unexpected hello_retry_request. Also fixes non-blocking. Fix resumption to use the named group from session. Fix named group in session structure to be a 2-byte field. Better detection of errors in message flow. Fix DoTls13ClientHello when downgrading - don't do TLS 1.3 things. Not downgrading on client fixed. Downgrade protocol version from TLS 1.3 when not TLS 1.3 ciphersuite. Get downgrading from TLS 1.3 and resumption working. Change earlyData value to an enum. Support no extensions data (as opposed to zero length extension data) in TLS 1.3 ClientHello. Check PSK cipher suite is available to both client and server before using. Check first PSK identity chosen when server says it is using early data at client. Check PSK extension is last in client_hello on server. Check the PSK cipher suite to use is supported on client. Check the returned cipher suite for pre-shared keys is the same as client expects. Send alert decrypt_error when verification fails in certificate_verify or finished message doesn't match calculated value. Fail when certificate messages recieved in handshake when using PSK. Validate on the server that EndOfEarlyData message has been recieved before finished message when server sent EarlyData extension. 2018-04-13 11:53:42 +10:00			`-l TLS13-CHACHA20-POLY1305-SHA256`
Add TLS v1.3 as an option 2016-11-24 01:31:07 +10:00
TLS 1.3 fixes/improvements Support Draft 28: able to compile code to return BAD_BINDER if no PSKs match and certificates not to be used. Change key share implementation to use server preference - server now checks each client key share's group is in supported_groups extension. Client and server examples modified to support server preference. Application can set client's and server's supported groups by rank. Server's supported groups is sent back in encrypted_extensions if preferred group is not in client's list - able to be turned off at compile time. Application can query server's preferred group from client. Able to compile using 0x0304 as version instead of draft version. Fix state machine in TLS 1.3 to support unexpected hello_retry_request. Also fixes non-blocking. Fix resumption to use the named group from session. Fix named group in session structure to be a 2-byte field. Better detection of errors in message flow. Fix DoTls13ClientHello when downgrading - don't do TLS 1.3 things. Not downgrading on client fixed. Downgrade protocol version from TLS 1.3 when not TLS 1.3 ciphersuite. Get downgrading from TLS 1.3 and resumption working. Change earlyData value to an enum. Support no extensions data (as opposed to zero length extension data) in TLS 1.3 ClientHello. Check PSK cipher suite is available to both client and server before using. Check first PSK identity chosen when server says it is using early data at client. Check PSK extension is last in client_hello on server. Check the PSK cipher suite to use is supported on client. Check the returned cipher suite for pre-shared keys is the same as client expects. Send alert decrypt_error when verification fails in certificate_verify or finished message doesn't match calculated value. Fail when certificate messages recieved in handshake when using PSK. Validate on the server that EndOfEarlyData message has been recieved before finished message when server sent EarlyData extension. 2018-04-13 11:53:42 +10:00			`# client TLSv1.3 TLS13-CHACHA20-POLY1305-SHA256`
Add TLS v1.3 as an option 2016-11-24 01:31:07 +10:00			`-v 4`
TLS 1.3 fixes/improvements Support Draft 28: able to compile code to return BAD_BINDER if no PSKs match and certificates not to be used. Change key share implementation to use server preference - server now checks each client key share's group is in supported_groups extension. Client and server examples modified to support server preference. Application can set client's and server's supported groups by rank. Server's supported groups is sent back in encrypted_extensions if preferred group is not in client's list - able to be turned off at compile time. Application can query server's preferred group from client. Able to compile using 0x0304 as version instead of draft version. Fix state machine in TLS 1.3 to support unexpected hello_retry_request. Also fixes non-blocking. Fix resumption to use the named group from session. Fix named group in session structure to be a 2-byte field. Better detection of errors in message flow. Fix DoTls13ClientHello when downgrading - don't do TLS 1.3 things. Not downgrading on client fixed. Downgrade protocol version from TLS 1.3 when not TLS 1.3 ciphersuite. Get downgrading from TLS 1.3 and resumption working. Change earlyData value to an enum. Support no extensions data (as opposed to zero length extension data) in TLS 1.3 ClientHello. Check PSK cipher suite is available to both client and server before using. Check first PSK identity chosen when server says it is using early data at client. Check PSK extension is last in client_hello on server. Check the PSK cipher suite to use is supported on client. Check the returned cipher suite for pre-shared keys is the same as client expects. Send alert decrypt_error when verification fails in certificate_verify or finished message doesn't match calculated value. Fail when certificate messages recieved in handshake when using PSK. Validate on the server that EndOfEarlyData message has been recieved before finished message when server sent EarlyData extension. 2018-04-13 11:53:42 +10:00			`-l TLS13-CHACHA20-POLY1305-SHA256`
Add TLS v1.3 as an option 2016-11-24 01:31:07 +10:00
			`# server TLSv1.3 TLS13-AES128-GCM-SHA256`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
Modify a couple tests to use WANT_WRITE simulation. 2020-11-03 16:05:12 -06:00			`-6`
Add TLS v1.3 as an option 2016-11-24 01:31:07 +10:00
			`# client TLSv1.3 TLS13-AES128-GCM-SHA256`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
Modify a couple tests to use WANT_WRITE simulation. 2020-11-03 16:05:12 -06:00			`-6`
Add TLS v1.3 as an option 2016-11-24 01:31:07 +10:00
			`# server TLSv1.3 TLS13-AES256-GCM-SHA384`
			`-v 4`
			`-l TLS13-AES256-GCM-SHA384`

			`# client TLSv1.3 TLS13-AES256-GCM-SHA384`
			`-v 4`
			`-l TLS13-AES256-GCM-SHA384`

			`# server TLSv1.3 TLS13-AES128-CCM-SHA256`
			`-v 4`
			`-l TLS13-AES128-CCM-SHA256`

			`# client TLSv1.3 TLS13-AES128-CCM-SHA256`
			`-v 4`
			`-l TLS13-AES128-CCM-SHA256`

			`# server TLSv1.3 TLS13-AES128-CCM-8-SHA256`
			`-v 4`
			`-l TLS13-AES128-CCM-8-SHA256`

			`# client TLSv1.3 TLS13-AES128-CCM-8-SHA256`
			`-v 4`
			`-l TLS13-AES128-CCM-8-SHA256`

add wolfSSL_get_cipher_suite_from_name(); add flags arg to GetCipherSuiteFromName(); fix GetCipherSuiteFromName() to prevent spurious substring matching; add SUITE_ALIAS() macros for use defining CipherSuiteInfo, and add CipherSuiteInfo.flags slot and associated logic, to allow alternative cipher names to be recognized; add "CCM8" cipher name variants wherever applicable, including the unit.test conf files, to recognize and test the OpenSSL variants; add tests in client_test() and server_test() to confirm correct forward and backward mapping of cipher names/aliases. 2020-11-11 22:46:02 -06:00			`# server TLSv1.3 TLS13-AES128-CCM8-SHA256 (OpenSSL-compat alias)`
			`-v 4`
			`-l TLS13-AES128-CCM8-SHA256`

			`# client TLSv1.3 TLS13-AES128-CCM8-SHA256 (OpenSSL-compat alias)`
			`-v 4`
			`-l TLS13-AES128-CCM8-SHA256`

Allow TLS 1.2 to be compiled out. 2018-05-17 09:08:03 +10:00			`# server TLSv1.3 resumption`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-r`

			`# client TLSv1.3 resumption`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-r`

			`# server TLSv1.3 resumption - SHA384`
			`-v 4`
			`-l TLS13-AES256-GCM-SHA384`
			`-r`

			`# client TLSv1.3 resumption - SHA384`
			`-v 4`
			`-l TLS13-AES256-GCM-SHA384`
			`-r`

			`# server TLSv1.3 PSK without (EC)DHE`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-r`

			`# client TLSv1.3 PSK without (EC)DHE`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-r`
			`-K`

TLS v1.3 0-RTT 2017-06-19 11:37:10 +10:00			`# server TLSv1.3 accepting EarlyData`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-r`
			`-0`

			`# client TLSv1.3 sending EarlyData`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-r`
			`-0`

			`# server TLSv1.3 not accepting EarlyData`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-r`

			`# client TLSv1.3 sending EarlyData`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-r`
			`-0`

			`# server TLSv1.3 accepting EarlyData`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-r`
			`-0`

			`# client TLSv1.3 not sending EarlyData`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-r`
Allow TLS 1.2 to be compiled out. 2018-05-17 09:08:03 +10:00
			`# server TLSv1.3`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`

			`# client TLSv1.3 Fragments`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-F 1`

			`# server TLSv1.3`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`

			`# client TLSv1.3 HelloRetryRequest to negotiate Key Exchange algorithm`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-J`

			`# server TLSv1.3`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-J`

			`# client TLSv1.3 HelloRetryRequest with cookie`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-J`

			`# server TLSv1.3`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`

			`# client TLSv1.3 DH key exchange`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-y`

			`# server TLSv1.3`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`

			`# client TLSv1.3 ECC key exchange`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-Y`

			`# server TLSv1.3`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`

			`# client TLSv1.3 ECC key exchange`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-Y`

			`# server TLSv1.3 multiple cipher suites`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES128-CCM-SHA256:TLS13-AES128-CCM-8-SHA256`

			`# client TLSv1.3`
			`-v 4`
Can't send empty list for the client when sniffer is enabled or it will use `AES128-SHA`. 2020-06-01 13:31:46 -07:00			`-l TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES128-CCM-SHA256:TLS13-AES128-CCM-8-SHA256`
Allow TLS 1.2 to be compiled out. 2018-05-17 09:08:03 +10:00
			`# server TLSv1.3 KeyUpdate`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-U`

			`# client TLSv1.3 KeyUpdate`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-I`

TLS Session Ticket: Option to disable for TLS 1.2 and below Customer may want session ticket supported with TLS 1.3 but not TLS 1.2 and below. 2021-01-22 11:27:23 +10:00			`# server TLSv1.3 No session ticket`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-T`

			`# client TLSv1.3 No session ticket`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`

Allow TLS 1.2 to be compiled out. 2018-05-17 09:08:03 +10:00			`# server TLSv1.3 Post-Handshake Authentication`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-Q`

			`# client TLSv1.3 Post-Handshake Authentication`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`-Q`
TLS 1.3 and Integrity-only ciphersuites 2019-07-26 08:26:55 +10:00
TLS 1.3: send ticket Can send a new session ticket any time after handshake is complete with TLS v1.3. Added API for server application to do this. Added tests. 2022-06-01 10:36:01 +10:00			`# server TLSv1.3 Send Ticket explicitly`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`
			`--send-ticket`

			`# client TLSv1.3 Send Ticket explicitly`
			`-v 4`
			`-l TLS13-AES128-GCM-SHA256`

TLS 1.3 and Integrity-only ciphersuites 2019-07-26 08:26:55 +10:00			`# server TLSv1.3 Integrity-only SHA256`
			`-v 4`
			`-l TLS13-SHA256-SHA256`

			`# client TLSv1.3 Integrity-only SHA256`
			`-v 4`
			`-l TLS13-SHA256-SHA256`

			`# server TLSv1.3 Integrity-only SHA384`
			`-v 4`
			`-l TLS13-SHA384-SHA384`

			`# client TLSv1.3 Integrity-only SHA384`
			`-v 4`
			`-l TLS13-SHA384-SHA384`