1 /* 2 * Various and sundry protocol constants. DON'T CHANGE THESE. These values 3 * are mostly defined by the SSL2, SSL3, or TLS protocol specifications. 4 * Cipher kinds and ciphersuites are part of the public API. 5 * 6 * This Source Code Form is subject to the terms of the Mozilla Public 7 * License, v. 2.0. If a copy of the MPL was not distributed with this 8 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ 9 10 #ifndef __sslproto_h_ 11 #define __sslproto_h_ 12 13 /* All versions less than 3_0 are treated as SSL version 2 */ 14 #define SSL_LIBRARY_VERSION_2 0x0002 15 #define SSL_LIBRARY_VERSION_3_0 0x0300 16 #define SSL_LIBRARY_VERSION_TLS_1_0 0x0301 17 #define SSL_LIBRARY_VERSION_TLS_1_1 0x0302 18 #define SSL_LIBRARY_VERSION_TLS_1_2 0x0303 19 /* Note: this is the internal format, not the wire format */ 20 #define SSL_LIBRARY_VERSION_DTLS_1_0 0x0302 21 22 /* deprecated old name */ 23 #define SSL_LIBRARY_VERSION_3_1_TLS SSL_LIBRARY_VERSION_TLS_1_0 24 25 /* The DTLS version used in the spec */ 26 #define SSL_LIBRARY_VERSION_DTLS_1_0_WIRE ((~0x0100) & 0xffff) 27 28 /* Header lengths of some of the messages */ 29 #define SSL_HL_ERROR_HBYTES 3 30 #define SSL_HL_CLIENT_HELLO_HBYTES 9 31 #define SSL_HL_CLIENT_MASTER_KEY_HBYTES 10 32 #define SSL_HL_CLIENT_FINISHED_HBYTES 1 33 #define SSL_HL_SERVER_HELLO_HBYTES 11 34 #define SSL_HL_SERVER_VERIFY_HBYTES 1 35 #define SSL_HL_SERVER_FINISHED_HBYTES 1 36 #define SSL_HL_REQUEST_CERTIFICATE_HBYTES 2 37 #define SSL_HL_CLIENT_CERTIFICATE_HBYTES 6 38 39 /* Security handshake protocol codes */ 40 #define SSL_MT_ERROR 0 41 #define SSL_MT_CLIENT_HELLO 1 42 #define SSL_MT_CLIENT_MASTER_KEY 2 43 #define SSL_MT_CLIENT_FINISHED 3 44 #define SSL_MT_SERVER_HELLO 4 45 #define SSL_MT_SERVER_VERIFY 5 46 #define SSL_MT_SERVER_FINISHED 6 47 #define SSL_MT_REQUEST_CERTIFICATE 7 48 #define SSL_MT_CLIENT_CERTIFICATE 8 49 50 /* Certificate types */ 51 #define SSL_CT_X509_CERTIFICATE 0x01 52 #if 0 /* XXX Not implemented yet */ 53 #define SSL_PKCS6_CERTIFICATE 0x02 54 #endif 55 #define SSL_AT_MD5_WITH_RSA_ENCRYPTION 0x01 56 57 /* Error codes */ 58 #define SSL_PE_NO_CYPHERS 0x0001 59 #define SSL_PE_NO_CERTIFICATE 0x0002 60 #define SSL_PE_BAD_CERTIFICATE 0x0004 61 #define SSL_PE_UNSUPPORTED_CERTIFICATE_TYPE 0x0006 62 63 /* Cypher kinds (not the spec version!) */ 64 #define SSL_CK_RC4_128_WITH_MD5 0x01 65 #define SSL_CK_RC4_128_EXPORT40_WITH_MD5 0x02 66 #define SSL_CK_RC2_128_CBC_WITH_MD5 0x03 67 #define SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5 0x04 68 #define SSL_CK_IDEA_128_CBC_WITH_MD5 0x05 69 #define SSL_CK_DES_64_CBC_WITH_MD5 0x06 70 #define SSL_CK_DES_192_EDE3_CBC_WITH_MD5 0x07 71 72 /* Cipher enables. These are used only for SSL_EnableCipher 73 * These values define the SSL2 suites, and do not colide with the 74 * SSL3 Cipher suites defined below. 75 */ 76 #define SSL_EN_RC4_128_WITH_MD5 0xFF01 77 #define SSL_EN_RC4_128_EXPORT40_WITH_MD5 0xFF02 78 #define SSL_EN_RC2_128_CBC_WITH_MD5 0xFF03 79 #define SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5 0xFF04 80 #define SSL_EN_IDEA_128_CBC_WITH_MD5 0xFF05 81 #define SSL_EN_DES_64_CBC_WITH_MD5 0xFF06 82 #define SSL_EN_DES_192_EDE3_CBC_WITH_MD5 0xFF07 83 84 /* SSL v3 Cipher Suites */ 85 #define SSL_NULL_WITH_NULL_NULL 0x0000 86 87 #define SSL_RSA_WITH_NULL_MD5 0x0001 88 #define SSL_RSA_WITH_NULL_SHA 0x0002 89 #define SSL_RSA_EXPORT_WITH_RC4_40_MD5 0x0003 90 #define SSL_RSA_WITH_RC4_128_MD5 0x0004 91 #define SSL_RSA_WITH_RC4_128_SHA 0x0005 92 #define SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 0x0006 93 #define SSL_RSA_WITH_IDEA_CBC_SHA 0x0007 94 #define SSL_RSA_EXPORT_WITH_DES40_CBC_SHA 0x0008 95 #define SSL_RSA_WITH_DES_CBC_SHA 0x0009 96 #define SSL_RSA_WITH_3DES_EDE_CBC_SHA 0x000a 97 98 #define SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA 0x000b 99 #define SSL_DH_DSS_WITH_DES_CBC_SHA 0x000c 100 #define SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA 0x000d 101 #define SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA 0x000e 102 #define SSL_DH_RSA_WITH_DES_CBC_SHA 0x000f 103 #define SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA 0x0010 104 105 #define SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA 0x0011 106 #define SSL_DHE_DSS_WITH_DES_CBC_SHA 0x0012 107 #define SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA 0x0013 108 #define SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA 0x0014 109 #define SSL_DHE_RSA_WITH_DES_CBC_SHA 0x0015 110 #define SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA 0x0016 111 112 #define SSL_DH_ANON_EXPORT_WITH_RC4_40_MD5 0x0017 113 #define SSL_DH_ANON_WITH_RC4_128_MD5 0x0018 114 #define SSL_DH_ANON_EXPORT_WITH_DES40_CBC_SHA 0x0019 115 #define SSL_DH_ANON_WITH_DES_CBC_SHA 0x001a 116 #define SSL_DH_ANON_WITH_3DES_EDE_CBC_SHA 0x001b 117 118 #define SSL_FORTEZZA_DMS_WITH_NULL_SHA 0x001c /* deprecated */ 119 #define SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA 0x001d /* deprecated */ 120 #define SSL_FORTEZZA_DMS_WITH_RC4_128_SHA 0x001e /* deprecated */ 121 122 /* New TLS cipher suites */ 123 #define TLS_RSA_WITH_AES_128_CBC_SHA 0x002F 124 #define TLS_DH_DSS_WITH_AES_128_CBC_SHA 0x0030 125 #define TLS_DH_RSA_WITH_AES_128_CBC_SHA 0x0031 126 #define TLS_DHE_DSS_WITH_AES_128_CBC_SHA 0x0032 127 #define TLS_DHE_RSA_WITH_AES_128_CBC_SHA 0x0033 128 #define TLS_DH_ANON_WITH_AES_128_CBC_SHA 0x0034 129 130 #define TLS_RSA_WITH_AES_256_CBC_SHA 0x0035 131 #define TLS_DH_DSS_WITH_AES_256_CBC_SHA 0x0036 132 #define TLS_DH_RSA_WITH_AES_256_CBC_SHA 0x0037 133 #define TLS_DHE_DSS_WITH_AES_256_CBC_SHA 0x0038 134 #define TLS_DHE_RSA_WITH_AES_256_CBC_SHA 0x0039 135 #define TLS_DH_ANON_WITH_AES_256_CBC_SHA 0x003A 136 #define TLS_RSA_WITH_NULL_SHA256 0x003B 137 #define TLS_RSA_WITH_AES_128_CBC_SHA256 0x003C 138 #define TLS_RSA_WITH_AES_256_CBC_SHA256 0x003D 139 140 #define TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 0x0041 141 #define TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA 0x0042 142 #define TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA 0x0043 143 #define TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA 0x0044 144 #define TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 0x0045 145 #define TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA 0x0046 146 147 #define TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA 0x0062 148 #define TLS_RSA_EXPORT1024_WITH_RC4_56_SHA 0x0064 149 150 #define TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA 0x0063 151 #define TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA 0x0065 152 #define TLS_DHE_DSS_WITH_RC4_128_SHA 0x0066 153 #define TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 0x0067 154 #define TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 0x006B 155 156 #define TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 0x0084 157 #define TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA 0x0085 158 #define TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA 0x0086 159 #define TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA 0x0087 160 #define TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 0x0088 161 #define TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA 0x0089 162 163 #define TLS_RSA_WITH_SEED_CBC_SHA 0x0096 164 165 #define TLS_RSA_WITH_AES_128_GCM_SHA256 0x009C 166 #define TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 0x009E 167 #define TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 0x00A2 168 169 /* TLS "Signaling Cipher Suite Value" (SCSV). May be requested by client. 170 * Must NEVER be chosen by server. SSL 3.0 server acknowledges by sending 171 * back an empty Renegotiation Info (RI) server hello extension. 172 */ 173 #define TLS_EMPTY_RENEGOTIATION_INFO_SCSV 0x00FF 174 175 /* TLS_FALLBACK_SCSV is a signaling cipher suite value that indicates that a 176 * handshake is the result of TLS version fallback. This value is not IANA 177 * assigned. */ 178 #define TLS_FALLBACK_SCSV 0x5600 179 180 /* Cipher Suite Values starting with 0xC000 are defined in informational 181 * RFCs. 182 */ 183 #define TLS_ECDH_ECDSA_WITH_NULL_SHA 0xC001 184 #define TLS_ECDH_ECDSA_WITH_RC4_128_SHA 0xC002 185 #define TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA 0xC003 186 #define TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA 0xC004 187 #define TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA 0xC005 188 189 #define TLS_ECDHE_ECDSA_WITH_NULL_SHA 0xC006 190 #define TLS_ECDHE_ECDSA_WITH_RC4_128_SHA 0xC007 191 #define TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA 0xC008 192 #define TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 0xC009 193 #define TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 0xC00A 194 195 #define TLS_ECDH_RSA_WITH_NULL_SHA 0xC00B 196 #define TLS_ECDH_RSA_WITH_RC4_128_SHA 0xC00C 197 #define TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA 0xC00D 198 #define TLS_ECDH_RSA_WITH_AES_128_CBC_SHA 0xC00E 199 #define TLS_ECDH_RSA_WITH_AES_256_CBC_SHA 0xC00F 200 201 #define TLS_ECDHE_RSA_WITH_NULL_SHA 0xC010 202 #define TLS_ECDHE_RSA_WITH_RC4_128_SHA 0xC011 203 #define TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 0xC012 204 #define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 0xC013 205 #define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 0xC014 206 207 #define TLS_ECDH_anon_WITH_NULL_SHA 0xC015 208 #define TLS_ECDH_anon_WITH_RC4_128_SHA 0xC016 209 #define TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA 0xC017 210 #define TLS_ECDH_anon_WITH_AES_128_CBC_SHA 0xC018 211 #define TLS_ECDH_anon_WITH_AES_256_CBC_SHA 0xC019 212 213 #define TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 0xC023 214 #define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 0xC027 215 216 #define TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0xC02B 217 #define TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 0xC02D 218 #define TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 0xC02F 219 #define TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 0xC031 220 221 #define TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 0xCC13 222 #define TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 0xCC14 223 224 /* Netscape "experimental" cipher suites. */ 225 #define SSL_RSA_OLDFIPS_WITH_3DES_EDE_CBC_SHA 0xffe0 226 #define SSL_RSA_OLDFIPS_WITH_DES_CBC_SHA 0xffe1 227 228 /* New non-experimental openly spec'ed versions of those cipher suites. */ 229 #define SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA 0xfeff 230 #define SSL_RSA_FIPS_WITH_DES_CBC_SHA 0xfefe 231 232 /* DTLS-SRTP cipher suites from RFC 5764 */ 233 /* If you modify this, also modify MAX_DTLS_SRTP_CIPHER_SUITES in sslimpl.h */ 234 #define SRTP_AES128_CM_HMAC_SHA1_80 0x0001 235 #define SRTP_AES128_CM_HMAC_SHA1_32 0x0002 236 #define SRTP_NULL_HMAC_SHA1_80 0x0005 237 #define SRTP_NULL_HMAC_SHA1_32 0x0006 238 239 #endif /* __sslproto_h_ */ 240