Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support curve customization #713

Open
1000TurquoisePogs opened this issue Jun 11, 2024 · 2 comments
Open

Support curve customization #713

1000TurquoisePogs opened this issue Jun 11, 2024 · 2 comments
Labels
enhancement New feature or request new not yet triaged

Comments

@1000TurquoisePogs
Copy link
Member

zowe.network.server.tls.curves is an array a user can set in zowe.yaml to customize crypto curves.
But, zss doesnt do anything with that array currently.

GSK handles curve customization much like cipher customization, which we already do here

zss/c/zss.c

Line 1192 in f44ce8a

char *ciphers = NULL;

That is, curves are specified as a string of 4 digit numbers back to back without any spaces or symbols inbetween.
Its very unfriendly to a human, so a convention of mapping from names to numbers is needed.
However, all of zowe needs to conform to the names. I dont know which name strings are available.

Node claims to use ASN.1 strings like "prime256v1"

So,

  1. make a list of names and associated numbers
  2. map from names to numbers to construct the number string (see https://www.ibm.com/docs/en/zos/3.1.0?topic=programming-cipher-suite-definitions#csdcwh__tttcsd )
  3. in tls.c, https://www.ibm.com/docs/en/zos/3.1.0?topic=reference-gsk-attribute-set-buffer must be used to set attribute "GSK_CLIENT_ECURVE_LIST" to the number string. if no number string is present, the command should be skipped as GSK defaults somehow.
@1000TurquoisePogs 1000TurquoisePogs added enhancement New feature or request new not yet triaged labels Jun 11, 2024
@JoeNemo
Copy link
Contributor

JoeNemo commented Jun 12, 2024

This sounds like a straightforward parameter addition to the schema, and feeding that info through zss.c and zowe-common-c/c/tls.c.

However the enumeration of valid values needs to be researched starting from https://datatracker.ietf.org/doc/rfc4492/ and it's related and superseding RFC's.

@1000TurquoisePogs
Copy link
Member Author

1000TurquoisePogs commented Jun 18, 2024

I believe the full list of curve strings is here https://neuromancer.sk/std/x962/
Node wants the strings.
GSK wants the IANA numbers.
The IANA numbers are here https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml
Search within for "EC Named Curve Registry"

Short story: much like our TLS cipher implementation, we should utilize the name strings, and then create the string-to-number map.

You can even query what node supports, to see their syntax:
'Oakley-EC2N-3',
'Oakley-EC2N-4',
'SM2',
'brainpoolP160r1',
'brainpoolP160t1',
'brainpoolP192r1',
'brainpoolP192t1',
'brainpoolP224r1',
'brainpoolP224t1',
'brainpoolP256r1',
'brainpoolP256t1',
'brainpoolP320r1',
'brainpoolP320t1',
'brainpoolP384r1',
'brainpoolP384t1',
'brainpoolP512r1',
'brainpoolP512t1',
'c2pnb163v1',
'c2pnb163v2',
'c2pnb163v3',
'c2pnb176v1',
'c2pnb208w1',
'c2pnb272w1',
'c2pnb304w1',
'c2pnb368w1',
'c2tnb191v1',
'c2tnb191v2',
'c2tnb191v3',
'c2tnb239v1',
'c2tnb239v2',
'c2tnb239v3',
'c2tnb359v1',
'c2tnb431r1',
'prime192v1',
'prime192v2',
'prime192v3',
'prime239v1',
'prime239v2',
'prime239v3',
'prime256v1',
'secp112r1',
'secp112r2',
'secp128r1',
'secp128r2',
'secp160k1',
'secp160r1',
'secp160r2',
'secp192k1',
'secp224k1',
'secp224r1',
'secp256k1',
'secp384r1',
'secp521r1',
'sect113r1',
'sect113r2',
'sect131r1',
'sect131r2',
'sect163k1',
'sect163r1',
'sect163r2',
'sect193r1',
'sect193r2',
'sect233k1',
'sect233r1',
'sect239k1',
'sect283k1',
'sect283r1',
'sect409k1',
'sect409r1',
'sect571k1',
'sect571r1',
'wap-wsg-idm-ecid-wtls1',
'wap-wsg-idm-ecid-wtls10',
'wap-wsg-idm-ecid-wtls11',
'wap-wsg-idm-ecid-wtls12',
'wap-wsg-idm-ecid-wtls3',
'wap-wsg-idm-ecid-wtls4',
'wap-wsg-idm-ecid-wtls5',
'wap-wsg-idm-ecid-wtls6',
'wap-wsg-idm-ecid-wtls7',
'wap-wsg-idm-ecid-wtls8',
'wap-wsg-idm-ecid-wtls9'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request new not yet triaged
Projects
None yet
Development

No branches or pull requests

2 participants