increase timeouts for test connections

Add more strong pseudoprimes in tests

DHE small subgroup checks

the CRT leaks are as applicable to ServerKeyExchange as they
are to CertificateVerify, if only harder to exploit

also fixes the incorrect generator for 3072-bit params,
it was 2, but should be 5. Keep the old params in the list,
but don't use them for creating the verifier values
(see makeVerifier)

rfc 7919 mandates that in case the client advertised
any ffdhe groups (including unrecognised ones), if server
can't find a fallback cipher, it needs to fail connection
with insufficient_security alert

AES init speedup

Parser fixes

# Conflicts:
#	tlslite/utils/codec.py

DHE improvements

Because NSS zero-pads the key share in SKE message, the
writeParams and thus hash calculation for the message won't
match and the signature verification will fail

this patch extends the message parser to store the length
of the field together with value and recreate it on write

since the extension is specified as:

   opaque ProtocolName<1..2^8-1>;

   struct {
       ProtocolName protocol_name_list<2..2^16-1>
   } ProtocolNameList;

empty list or empty protocol name is a protocol violation, as
such, it should cause sending a decode_error alert

SKE hash bug

the DBM module on Windows creates databases as .dat files
by default (even if the original filename did not include it)
so retry deleting alternative name if the original one failed

remove correct file on Windows

Sanity checking in SNI

explain why the check is duplicate in tlsconnection

send correct alerts in case the ALPN ext is malformed

post-merge changelog update

Fixes: #163

add python 3.6 to .travis.yml

if old session was negotiated without EMS, we need to create
a completely new session for EMS to be useful

when the Extended Master Secret extension is negotiated
with client certificates, the used session hash
for master secret calculation is not correct, fix it

add a big composite number to test the non-working of M-R primality test

Extended Master Secret fixup

because for handling messages like Certificate Verify, it
is necessary to sign or verify a raw hash, not a message,
we need to be able to create RSA-PSS signatures over raw
hashes too

update the methods to support both signing raw hashes and
signing with hashing

step 10 in Section 9.1.2. statest that it's
emLen - hLen - sLen - 2 leftmost octets that need to be zero,
but python's subscripts are righ-exclusive and start with zero
so we need to check up to that number exactly

as RSA-PSS parameters may have restrictions on used hash
algorithm, salt length, etc. the actual encoding of
AlgorithmIdentifier can be variable - ignore the parameters
for the rsa-pss Alg Id's

…56v1

fixup EMS and ECDHE without extensions

correctly handle errors from RSA_PSS verification

make ECDHE and FFDHE ciphersuite enabling more logical

add definitions of ciphersuites that use ECDSA certificates,
useful for decoding, fuzzing and scanning, even if unsupported
for tlslite-ng itself

the definition of the extension requires client to send
at least one item in the list, thus empty extension is
malformed - reject those

The ECC TLS RFC states that if the client doesn't advertise
any curves, it means that it supports any and the server
can then select any curve. That was OK when there was only
one set of curves supported in TLS. Now we have the legacy
curves, brainpool curves and djb (x25519 and x448) curves,
meaning that client that doesn't advertise any curves is likely
to support only the legacy curves, not the newer ones.

Thus we need to separate the default curve from most wanted
curve as the former must be most compatible while still
relatively secure while the latter can be fastest or most
secure, but will be negotiated only when client also supports
it.

default to a common curve if no curves advertised

use implementation with implicit looping

do not do array subscripting, create the array on the fly
using an iterator, nearly twice as fast