Branch data Line data Source code
1 : : /*
2 : : * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3 : : *
4 : : * Licensed under the Apache License, Version 2.0 (the "License").
5 : : * You may not use this file except in compliance with the License.
6 : : * A copy of the License is located at
7 : : *
8 : : * http://aws.amazon.com/apache2.0
9 : : *
10 : : * or in the "license" file accompanying this file. This file is distributed
11 : : * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12 : : * express or implied. See the License for the specific language governing
13 : : * permissions and limitations under the License.
14 : : */
15 : :
16 : : #include "tls/s2n_security_policies.h"
17 : :
18 : : #include "api/s2n.h"
19 : : #include "crypto/s2n_pq.h"
20 : : #include "tls/s2n_certificate_keys.h"
21 : : #include "tls/s2n_connection.h"
22 : : #include "tls/s2n_supported_group_preferences.h"
23 : : #include "utils/s2n_safety.h"
24 : :
25 : : /* Default as of 10/13 */
26 : : const struct s2n_security_policy security_policy_20251014 = {
27 : : .minimum_protocol_version = S2N_TLS12,
28 : : .cipher_preferences = &cipher_preferences_20251014,
29 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2025_07,
30 : : .signature_preferences = &s2n_signature_preferences_20240501,
31 : : .ecc_preferences = &s2n_ecc_preferences_20240501,
32 : : .rules = {
33 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
34 : : },
35 : : };
36 : :
37 : : /* FIPS default as of 10/13 */
38 : : const struct s2n_security_policy security_policy_20251015 = {
39 : : .minimum_protocol_version = S2N_TLS12,
40 : : .cipher_preferences = &cipher_preferences_20251015,
41 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2025_07,
42 : : .signature_preferences = &s2n_signature_preferences_20240501,
43 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20201110,
44 : : .ecc_preferences = &s2n_ecc_preferences_20201021,
45 : : .rules = {
46 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
47 : : [S2N_FIPS_140_3] = true,
48 : : },
49 : : };
50 : :
51 : : const struct s2n_security_policy security_policy_20240501 = {
52 : : .minimum_protocol_version = S2N_TLS12,
53 : : .cipher_preferences = &cipher_preferences_20240331,
54 : : .kem_preferences = &kem_preferences_null,
55 : : .signature_preferences = &s2n_signature_preferences_20240501,
56 : : .ecc_preferences = &s2n_ecc_preferences_20240501,
57 : : .rules = {
58 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
59 : : },
60 : : };
61 : :
62 : : const struct s2n_security_policy security_policy_20240502 = {
63 : : .minimum_protocol_version = S2N_TLS12,
64 : : .cipher_preferences = &cipher_preferences_20240331,
65 : : .kem_preferences = &kem_preferences_null,
66 : : .signature_preferences = &s2n_signature_preferences_20240501,
67 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20201110,
68 : : .ecc_preferences = &s2n_ecc_preferences_20201021,
69 : : .rules = {
70 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
71 : : [S2N_FIPS_140_3] = true,
72 : : },
73 : : };
74 : :
75 : : /* TLS1.3 default as of 05/24 */
76 : : const struct s2n_security_policy security_policy_20240503 = {
77 : : .minimum_protocol_version = S2N_TLS12,
78 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2019,
79 : : .kem_preferences = &kem_preferences_null,
80 : : .signature_preferences = &s2n_signature_preferences_20240501,
81 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20201110,
82 : : .ecc_preferences = &s2n_ecc_preferences_20240501,
83 : : .rules = {
84 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
85 : : },
86 : : };
87 : :
88 : : const struct s2n_security_policy security_policy_20241001 = {
89 : : .minimum_protocol_version = S2N_TLS12,
90 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2019,
91 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
92 : : .signature_preferences = &s2n_signature_preferences_20240501,
93 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20201110,
94 : : .ecc_preferences = &s2n_ecc_preferences_20240501,
95 : : .rules = {
96 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
97 : : },
98 : : };
99 : :
100 : : /* 20241001, but with ML-DSA added */
101 : : const struct s2n_security_policy security_policy_20250512 = {
102 : : .minimum_protocol_version = S2N_TLS12,
103 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2019,
104 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
105 : : .signature_preferences = &s2n_signature_preferences_20250512,
106 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20250512,
107 : : .ecc_preferences = &s2n_ecc_preferences_20240501,
108 : : .rules = {
109 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
110 : : },
111 : : };
112 : :
113 : : const struct s2n_security_policy security_policy_20250721 = {
114 : : .minimum_protocol_version = S2N_TLS12,
115 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2019,
116 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2025_07,
117 : : .signature_preferences = &s2n_signature_preferences_20250512,
118 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20250512,
119 : : .ecc_preferences = &s2n_ecc_preferences_20240501,
120 : : .rules = {
121 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
122 : : },
123 : : };
124 : :
125 : : const struct s2n_security_policy security_policy_20241001_pq_mixed = {
126 : : .minimum_protocol_version = S2N_TLS12,
127 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2019,
128 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
129 : : .signature_preferences = &s2n_signature_preferences_20240501,
130 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20201110,
131 : : .ecc_preferences = &s2n_ecc_preferences_20240501,
132 : : .rules = {
133 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
134 : : },
135 : : };
136 : :
137 : : const struct s2n_security_policy security_policy_20240603 = {
138 : : .minimum_protocol_version = S2N_TLS12,
139 : : .cipher_preferences = &cipher_preferences_20240603,
140 : : .kem_preferences = &kem_preferences_null,
141 : : .signature_preferences = &s2n_signature_preferences_20240501,
142 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20201110,
143 : : .ecc_preferences = &s2n_ecc_preferences_20240603,
144 : : };
145 : :
146 : : const struct s2n_security_policy security_policy_20170210 = {
147 : : .minimum_protocol_version = S2N_TLS10,
148 : : .cipher_preferences = &cipher_preferences_20170210,
149 : : .kem_preferences = &kem_preferences_null,
150 : : .signature_preferences = &s2n_signature_preferences_20140601,
151 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
152 : : };
153 : :
154 : : const struct s2n_security_policy security_policy_20240417 = {
155 : : .minimum_protocol_version = S2N_TLS10,
156 : : .cipher_preferences = &cipher_preferences_20210831,
157 : : .kem_preferences = &kem_preferences_null,
158 : : .signature_preferences = &s2n_signature_preferences_20200207,
159 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20201110,
160 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
161 : : };
162 : :
163 : : /*
164 : : * This security policy is derived from the following specification:
165 : : * https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf
166 : : *
167 : : * Supports TLS1.2
168 : : */
169 : : const struct s2n_security_policy security_policy_20240416 = {
170 : : .minimum_protocol_version = S2N_TLS12,
171 : : .cipher_preferences = &cipher_preferences_default_fips,
172 : : .kem_preferences = &kem_preferences_null,
173 : : .signature_preferences = &s2n_signature_preferences_default_fips,
174 : : .certificate_signature_preferences = &s2n_signature_preferences_default_fips,
175 : : .ecc_preferences = &s2n_ecc_preferences_default_fips,
176 : : .rules = {
177 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
178 : : [S2N_FIPS_140_3] = true,
179 : : },
180 : : };
181 : :
182 : : const struct s2n_security_policy security_policy_20230317 = {
183 : : .minimum_protocol_version = S2N_TLS12,
184 : : .cipher_preferences = &cipher_preferences_20230317,
185 : : .kem_preferences = &kem_preferences_null,
186 : : .signature_preferences = &s2n_signature_preferences_20230317,
187 : : .certificate_signature_preferences = &s2n_signature_preferences_20230317,
188 : : .ecc_preferences = &s2n_ecc_preferences_20201021,
189 : : .rules = {
190 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
191 : : [S2N_FIPS_140_3] = true,
192 : : },
193 : : };
194 : :
195 : : const struct s2n_security_policy security_policy_20230317_pq = {
196 : : .minimum_protocol_version = S2N_TLS12,
197 : : .cipher_preferences = &cipher_preferences_20230317,
198 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2025_07,
199 : : .signature_preferences = &s2n_signature_preferences_20230317,
200 : : .certificate_signature_preferences = &s2n_signature_preferences_20230317,
201 : : .ecc_preferences = &s2n_ecc_preferences_20201021,
202 : : .rules = {
203 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
204 : : [S2N_FIPS_140_3] = true,
205 : : },
206 : : };
207 : :
208 : : const struct s2n_security_policy security_policy_20240331 = {
209 : : .minimum_protocol_version = S2N_TLS12,
210 : : .cipher_preferences = &cipher_preferences_20240331,
211 : : .kem_preferences = &kem_preferences_null,
212 : : .signature_preferences = &s2n_signature_preferences_20230317,
213 : : .certificate_signature_preferences = &s2n_signature_preferences_20230317,
214 : : .ecc_preferences = &s2n_ecc_preferences_20201021,
215 : : .rules = {
216 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
217 : : [S2N_FIPS_140_3] = true,
218 : : },
219 : : };
220 : :
221 : : const struct s2n_security_policy security_policy_20190801 = {
222 : : .minimum_protocol_version = S2N_TLS10,
223 : : .cipher_preferences = &cipher_preferences_20190801,
224 : : .kem_preferences = &kem_preferences_null,
225 : : /* The discrepancy in the date exists because the signature preferences
226 : : * were named when cipher preferences and signature preferences were
227 : : * tracked separately, and we chose to keep the cipher preference
228 : : * name because customers use it.
229 : : */
230 : : .signature_preferences = &s2n_signature_preferences_20200207,
231 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
232 : : };
233 : :
234 : : const struct s2n_security_policy security_policy_20190802 = {
235 : : .minimum_protocol_version = S2N_TLS10,
236 : : .cipher_preferences = &cipher_preferences_20190801,
237 : : .kem_preferences = &kem_preferences_null,
238 : : /* The discrepancy in the date exists because the signature preferences
239 : : * were named when cipher preferences and signature preferences were
240 : : * tracked separately, and we chose to keep the cipher preference
241 : : * name because customers use it.
242 : : */
243 : : .signature_preferences = &s2n_signature_preferences_20200207,
244 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
245 : : };
246 : :
247 : : const struct s2n_security_policy security_policy_20170405 = {
248 : : .minimum_protocol_version = S2N_TLS10,
249 : : .cipher_preferences = &cipher_preferences_20170405,
250 : : .kem_preferences = &kem_preferences_null,
251 : : .signature_preferences = &s2n_signature_preferences_20140601,
252 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
253 : : };
254 : :
255 : : const struct s2n_security_policy security_policy_20170405_gcm = {
256 : : .minimum_protocol_version = S2N_TLS10,
257 : : .cipher_preferences = &cipher_preferences_20170405_gcm,
258 : : .kem_preferences = &kem_preferences_null,
259 : : .signature_preferences = &s2n_signature_preferences_20140601,
260 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
261 : : };
262 : :
263 : : const struct s2n_security_policy security_policy_elb_2015_04 = {
264 : : .minimum_protocol_version = S2N_TLS10,
265 : : .cipher_preferences = &elb_security_policy_2015_04,
266 : : .kem_preferences = &kem_preferences_null,
267 : : .signature_preferences = &s2n_signature_preferences_20140601,
268 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
269 : : };
270 : :
271 : : const struct s2n_security_policy security_policy_elb_2016_08 = {
272 : : .minimum_protocol_version = S2N_TLS10,
273 : : .cipher_preferences = &elb_security_policy_2016_08,
274 : : .kem_preferences = &kem_preferences_null,
275 : : .signature_preferences = &s2n_signature_preferences_20140601,
276 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
277 : : };
278 : :
279 : : const struct s2n_security_policy security_policy_elb_tls_1_1_2017_01 = {
280 : : .minimum_protocol_version = S2N_TLS11,
281 : : .cipher_preferences = &elb_security_policy_tls_1_1_2017_01,
282 : : .kem_preferences = &kem_preferences_null,
283 : : .signature_preferences = &s2n_signature_preferences_20140601,
284 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
285 : : };
286 : :
287 : : const struct s2n_security_policy security_policy_elb_tls_1_2_2017_01 = {
288 : : .minimum_protocol_version = S2N_TLS12,
289 : : .cipher_preferences = &elb_security_policy_tls_1_2_2017_01,
290 : : .kem_preferences = &kem_preferences_null,
291 : : .signature_preferences = &s2n_signature_preferences_20140601,
292 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
293 : : };
294 : :
295 : : const struct s2n_security_policy security_policy_elb_tls_1_2_ext_2018_06 = {
296 : : .minimum_protocol_version = S2N_TLS12,
297 : : .cipher_preferences = &elb_security_policy_tls_1_2_ext_2018_06,
298 : : .kem_preferences = &kem_preferences_null,
299 : : .signature_preferences = &s2n_signature_preferences_20140601,
300 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
301 : : };
302 : :
303 : : const struct s2n_security_policy security_policy_elb_fs_2018_06 = {
304 : : .minimum_protocol_version = S2N_TLS10,
305 : : .cipher_preferences = &elb_security_policy_fs_2018_06,
306 : : .kem_preferences = &kem_preferences_null,
307 : : .signature_preferences = &s2n_signature_preferences_20140601,
308 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
309 : : .rules = {
310 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
311 : : },
312 : : };
313 : :
314 : : const struct s2n_security_policy security_policy_elb_fs_1_2_2019_08 = {
315 : : .minimum_protocol_version = S2N_TLS12,
316 : : .cipher_preferences = &elb_security_policy_fs_1_2_2019_08,
317 : : .kem_preferences = &kem_preferences_null,
318 : : .signature_preferences = &s2n_signature_preferences_20140601,
319 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
320 : : .rules = {
321 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
322 : : },
323 : : };
324 : :
325 : : const struct s2n_security_policy security_policy_elb_fs_1_1_2019_08 = {
326 : : .minimum_protocol_version = S2N_TLS11,
327 : : .cipher_preferences = &elb_security_policy_fs_1_1_2019_08,
328 : : .kem_preferences = &kem_preferences_null,
329 : : .signature_preferences = &s2n_signature_preferences_20140601,
330 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
331 : : .rules = {
332 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
333 : : },
334 : : };
335 : :
336 : : const struct s2n_security_policy security_policy_elb_fs_1_2_Res_2019_08 = {
337 : : .minimum_protocol_version = S2N_TLS12,
338 : : .cipher_preferences = &elb_security_policy_fs_1_2_Res_2019_08,
339 : : .kem_preferences = &kem_preferences_null,
340 : : .signature_preferences = &s2n_signature_preferences_20140601,
341 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
342 : : .rules = {
343 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
344 : : },
345 : : };
346 : :
347 : : /* CloudFront upstream */
348 : : const struct s2n_security_policy security_policy_cloudfront_upstream = {
349 : : .minimum_protocol_version = S2N_SSLv3,
350 : : .cipher_preferences = &cipher_preferences_cloudfront_upstream,
351 : : .kem_preferences = &kem_preferences_null,
352 : : .signature_preferences = &s2n_signature_preferences_20140601,
353 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
354 : : };
355 : :
356 : : const struct s2n_security_policy security_policy_cloudfront_upstream_tls10 = {
357 : : .minimum_protocol_version = S2N_TLS10,
358 : : .cipher_preferences = &cipher_preferences_cloudfront_upstream_tls10,
359 : : .kem_preferences = &kem_preferences_null,
360 : : .signature_preferences = &s2n_signature_preferences_20140601,
361 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
362 : : };
363 : :
364 : : const struct s2n_security_policy security_policy_cloudfront_upstream_tls11 = {
365 : : .minimum_protocol_version = S2N_TLS11,
366 : : .cipher_preferences = &cipher_preferences_cloudfront_upstream_tls11,
367 : : .kem_preferences = &kem_preferences_null,
368 : : .signature_preferences = &s2n_signature_preferences_20140601,
369 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
370 : : };
371 : :
372 : : const struct s2n_security_policy security_policy_cloudfront_upstream_tls12 = {
373 : : .minimum_protocol_version = S2N_TLS12,
374 : : .cipher_preferences = &cipher_preferences_cloudfront_upstream_tls12,
375 : : .kem_preferences = &kem_preferences_null,
376 : : .signature_preferences = &s2n_signature_preferences_20140601,
377 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
378 : : };
379 : :
380 : : /* CloudFront upstream 2025 -- same as original upstream above, but with:
381 : : * 1. TLSv1.3 enabled and
382 : : * 2. signature preferences updated to 2020-10-21, expanding support for RSA
383 : : * PSS while preserving support for legacy signature algorithms
384 : : */
385 : : const struct s2n_security_policy security_policy_cloudfront_upstream_2025_08_08 = {
386 : : .minimum_protocol_version = S2N_SSLv3,
387 : : .cipher_preferences = &cipher_preferences_cloudfront_upstream_2025_08_08,
388 : : .kem_preferences = &kem_preferences_null,
389 : : .signature_preferences = &s2n_signature_preferences_20250820,
390 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
391 : : };
392 : :
393 : : const struct s2n_security_policy security_policy_cloudfront_upstream_2025_08_08_tls10 = {
394 : : .minimum_protocol_version = S2N_TLS10,
395 : : .cipher_preferences = &cipher_preferences_cloudfront_upstream_2025_08_08,
396 : : .kem_preferences = &kem_preferences_null,
397 : : .signature_preferences = &s2n_signature_preferences_20250820,
398 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
399 : : };
400 : :
401 : : const struct s2n_security_policy security_policy_cloudfront_upstream_2025_08_08_tls11 = {
402 : : .minimum_protocol_version = S2N_TLS11,
403 : : .cipher_preferences = &cipher_preferences_cloudfront_upstream_2025_08_08,
404 : : .kem_preferences = &kem_preferences_null,
405 : : .signature_preferences = &s2n_signature_preferences_20250820,
406 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
407 : : };
408 : :
409 : : const struct s2n_security_policy security_policy_cloudfront_upstream_2025_08_08_tls12 = {
410 : : .minimum_protocol_version = S2N_TLS12,
411 : : .cipher_preferences = &cipher_preferences_cloudfront_upstream_2025_08_08,
412 : : .kem_preferences = &kem_preferences_null,
413 : : .signature_preferences = &s2n_signature_preferences_20250820,
414 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
415 : : };
416 : :
417 : : const struct s2n_security_policy security_policy_cloudfront_upstream_2025_08_08_tls13 = {
418 : : .minimum_protocol_version = S2N_TLS13,
419 : : .cipher_preferences = &cipher_preferences_cloudfront_upstream_2025_08_08_tls13,
420 : : .kem_preferences = &kem_preferences_null,
421 : : .signature_preferences = &s2n_signature_preferences_20250820,
422 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
423 : : };
424 : :
425 : : const struct s2n_security_policy security_policy_cloudfront_upstream_2025_08_08_pq = {
426 : : .minimum_protocol_version = S2N_SSLv3,
427 : : .cipher_preferences = &cipher_preferences_cloudfront_upstream_2025_08_08,
428 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2025_07,
429 : : .signature_preferences = &s2n_signature_preferences_20250821,
430 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
431 : : };
432 : :
433 : : const struct s2n_security_policy security_policy_cloudfront_upstream_2025_08_08_tls10_pq = {
434 : : .minimum_protocol_version = S2N_TLS10,
435 : : .cipher_preferences = &cipher_preferences_cloudfront_upstream_2025_08_08,
436 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2025_07,
437 : : .signature_preferences = &s2n_signature_preferences_20250821,
438 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
439 : : };
440 : :
441 : : const struct s2n_security_policy security_policy_cloudfront_upstream_2025_08_08_tls11_pq = {
442 : : .minimum_protocol_version = S2N_TLS11,
443 : : .cipher_preferences = &cipher_preferences_cloudfront_upstream_2025_08_08,
444 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2025_07,
445 : : .signature_preferences = &s2n_signature_preferences_20250821,
446 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
447 : : };
448 : :
449 : : const struct s2n_security_policy security_policy_cloudfront_upstream_2025_08_08_tls12_pq = {
450 : : .minimum_protocol_version = S2N_TLS12,
451 : : .cipher_preferences = &cipher_preferences_cloudfront_upstream_2025_08_08,
452 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2025_07,
453 : : .signature_preferences = &s2n_signature_preferences_20250821,
454 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
455 : : };
456 : :
457 : : const struct s2n_security_policy security_policy_cloudfront_upstream_2025_08_08_tls13_pq = {
458 : : .minimum_protocol_version = S2N_TLS13,
459 : : .cipher_preferences = &cipher_preferences_cloudfront_upstream_2025_08_08_tls13,
460 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2025_07,
461 : : .signature_preferences = &s2n_signature_preferences_20250821,
462 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
463 : : };
464 : :
465 : : /* CloudFront viewer facing */
466 : : const struct s2n_security_policy security_policy_cloudfront_ssl_v_3 = {
467 : : .minimum_protocol_version = S2N_SSLv3,
468 : : .cipher_preferences = &cipher_preferences_cloudfront_ssl_v_3,
469 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
470 : : .signature_preferences = &s2n_signature_preferences_20200207,
471 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
472 : : };
473 : :
474 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_0_2014 = {
475 : : .minimum_protocol_version = S2N_TLS10,
476 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_0_2014,
477 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
478 : : .signature_preferences = &s2n_signature_preferences_20200207,
479 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
480 : : };
481 : :
482 : : /* Same as security_policy_cloudfront_tls_1_0_2014, but with IETF standard KEM Groups */
483 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_0_2014_pq_beta = {
484 : : .minimum_protocol_version = S2N_TLS10,
485 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_0_2014,
486 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
487 : : .signature_preferences = &s2n_signature_preferences_20200207,
488 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
489 : : };
490 : :
491 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_0_2014_sha256 = {
492 : : .minimum_protocol_version = S2N_TLS10,
493 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_0_2014_sha256,
494 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
495 : : .signature_preferences = &s2n_signature_preferences_20200207,
496 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
497 : : };
498 : :
499 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_0_2016 = {
500 : : .minimum_protocol_version = S2N_TLS10,
501 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_0_2016,
502 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
503 : : .signature_preferences = &s2n_signature_preferences_20200207,
504 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
505 : : };
506 : :
507 : : /* Same as security_policy_cloudfront_tls_1_0_2016, but with TLS 1.2 as minimum */
508 : : const struct s2n_security_policy security_policy_20241106 = {
509 : : .minimum_protocol_version = S2N_TLS12,
510 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_0_2016,
511 : : .kem_preferences = &kem_preferences_null,
512 : : .signature_preferences = &s2n_signature_preferences_20200207,
513 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
514 : : };
515 : :
516 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_1_2016 = {
517 : : .minimum_protocol_version = S2N_TLS11,
518 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_1_2016,
519 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
520 : : .signature_preferences = &s2n_signature_preferences_20200207,
521 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
522 : : };
523 : :
524 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2017 = {
525 : : .minimum_protocol_version = S2N_TLS12,
526 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2017,
527 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
528 : : .signature_preferences = &s2n_signature_preferences_20200207,
529 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
530 : : };
531 : :
532 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2018_no_sha1 = {
533 : : .minimum_protocol_version = S2N_TLS12,
534 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2018,
535 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
536 : : .signature_preferences = &s2n_signature_preferences_20200207_no_sha1,
537 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
538 : : };
539 : :
540 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2018_beta = {
541 : : .minimum_protocol_version = S2N_TLS12,
542 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2018_beta,
543 : : .kem_preferences = &kem_preferences_null,
544 : : .signature_preferences = &s2n_signature_preferences_20200207,
545 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
546 : : };
547 : :
548 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2019_no_sha1 = {
549 : : .minimum_protocol_version = S2N_TLS12,
550 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2019,
551 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
552 : : .signature_preferences = &s2n_signature_preferences_20200207_no_sha1,
553 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
554 : : .rules = {
555 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
556 : : },
557 : : };
558 : :
559 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2021_no_sha1 = {
560 : : .minimum_protocol_version = S2N_TLS12,
561 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2021,
562 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
563 : : .signature_preferences = &s2n_signature_preferences_20200207_no_sha1,
564 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
565 : : .rules = {
566 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
567 : : },
568 : : };
569 : :
570 : : /* Same as security_policy_cloudfront_tls_1_2_2021_no_sha1, but with IETF standard KEM Groups */
571 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2021_no_sha1_pq_beta = {
572 : : .minimum_protocol_version = S2N_TLS12,
573 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2021,
574 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
575 : : .signature_preferences = &s2n_signature_preferences_20200207_no_sha1,
576 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
577 : : .rules = {
578 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
579 : : },
580 : : };
581 : :
582 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2021_chacha20_boosted = {
583 : : .minimum_protocol_version = S2N_TLS12,
584 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2021_chacha20_boosted,
585 : : .kem_preferences = &kem_preferences_null,
586 : : .signature_preferences = &s2n_signature_preferences_20200207,
587 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
588 : : .rules = {
589 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
590 : : },
591 : : };
592 : :
593 : : /* FIPS 140-3 compliant version of security_policy_cloudfront_tls_1_2_2021 */
594 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2025 = {
595 : : .minimum_protocol_version = S2N_TLS12,
596 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2025,
597 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
598 : : .signature_preferences = &s2n_signature_preferences_20250813,
599 : : .ecc_preferences = &s2n_ecc_preferences_default_fips,
600 : : .rules = {
601 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
602 : : [S2N_FIPS_140_3] = true,
603 : : },
604 : : };
605 : :
606 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_3_2025 = {
607 : : .minimum_protocol_version = S2N_TLS13,
608 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_3_2025,
609 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
610 : : .signature_preferences = &s2n_signature_preferences_20250813,
611 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
612 : : .rules = {
613 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
614 : : },
615 : : };
616 : :
617 : : /* CloudFront non-pq viewer facing policies */
618 : : const struct s2n_security_policy security_policy_cloudfront_ssl_v_3_no_pq = {
619 : : .minimum_protocol_version = S2N_SSLv3,
620 : : .cipher_preferences = &cipher_preferences_cloudfront_ssl_v_3,
621 : : .kem_preferences = &kem_preferences_null,
622 : : .signature_preferences = &s2n_signature_preferences_20200207,
623 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
624 : : };
625 : :
626 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_0_2014_no_pq = {
627 : : .minimum_protocol_version = S2N_TLS10,
628 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_0_2014,
629 : : .kem_preferences = &kem_preferences_null,
630 : : .signature_preferences = &s2n_signature_preferences_20200207,
631 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
632 : : };
633 : :
634 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_0_2014_sha256_no_pq = {
635 : : .minimum_protocol_version = S2N_TLS10,
636 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_0_2014_sha256,
637 : : .kem_preferences = &kem_preferences_null,
638 : : .signature_preferences = &s2n_signature_preferences_20200207,
639 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
640 : : };
641 : :
642 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_0_2016_no_pq = {
643 : : .minimum_protocol_version = S2N_TLS10,
644 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_0_2016,
645 : : .kem_preferences = &kem_preferences_null,
646 : : .signature_preferences = &s2n_signature_preferences_20200207,
647 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
648 : : };
649 : :
650 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_1_2016_no_pq = {
651 : : .minimum_protocol_version = S2N_TLS11,
652 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_1_2016,
653 : : .kem_preferences = &kem_preferences_null,
654 : : .signature_preferences = &s2n_signature_preferences_20200207,
655 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
656 : : };
657 : :
658 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2017_no_pq = {
659 : : .minimum_protocol_version = S2N_TLS12,
660 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2017,
661 : : .kem_preferences = &kem_preferences_null,
662 : : .signature_preferences = &s2n_signature_preferences_20200207,
663 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
664 : : };
665 : :
666 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2018_no_sha1_no_pq = {
667 : : .minimum_protocol_version = S2N_TLS12,
668 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2018,
669 : : .kem_preferences = &kem_preferences_null,
670 : : .signature_preferences = &s2n_signature_preferences_20200207_no_sha1,
671 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
672 : : };
673 : :
674 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2019_no_sha1_no_pq = {
675 : : .minimum_protocol_version = S2N_TLS12,
676 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2019,
677 : : .kem_preferences = &kem_preferences_null,
678 : : .signature_preferences = &s2n_signature_preferences_20200207_no_sha1,
679 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
680 : : .rules = {
681 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
682 : : },
683 : : };
684 : :
685 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2021_no_sha1_no_pq = {
686 : : .minimum_protocol_version = S2N_TLS12,
687 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2021,
688 : : .kem_preferences = &kem_preferences_null,
689 : : .signature_preferences = &s2n_signature_preferences_20200207_no_sha1,
690 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
691 : : .rules = {
692 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
693 : : },
694 : : };
695 : :
696 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2025_no_pq = {
697 : : .minimum_protocol_version = S2N_TLS12,
698 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2025,
699 : : .kem_preferences = &kem_preferences_null,
700 : : .signature_preferences = &s2n_signature_preferences_20250813,
701 : : .ecc_preferences = &s2n_ecc_preferences_default_fips,
702 : : .rules = {
703 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
704 : : [S2N_FIPS_140_3] = true,
705 : : },
706 : : };
707 : :
708 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_3_2025_no_pq = {
709 : : .minimum_protocol_version = S2N_TLS13,
710 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_3_2025,
711 : : .kem_preferences = &kem_preferences_null,
712 : : .signature_preferences = &s2n_signature_preferences_20250813,
713 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
714 : : .rules = {
715 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
716 : : },
717 : : };
718 : :
719 : : /* CloudFront viewer facing legacy policies */
720 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2018 = {
721 : : .minimum_protocol_version = S2N_TLS12,
722 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2018,
723 : : .kem_preferences = &kem_preferences_null,
724 : : .signature_preferences = &s2n_signature_preferences_20200207,
725 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
726 : : };
727 : :
728 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2019 = {
729 : : .minimum_protocol_version = S2N_TLS12,
730 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2019,
731 : : .kem_preferences = &kem_preferences_null,
732 : : .signature_preferences = &s2n_signature_preferences_20200207,
733 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
734 : : .rules = {
735 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
736 : : },
737 : : };
738 : :
739 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2021 = {
740 : : .minimum_protocol_version = S2N_TLS12,
741 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2021,
742 : : .kem_preferences = &kem_preferences_null,
743 : : .signature_preferences = &s2n_signature_preferences_20200207,
744 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
745 : : .rules = {
746 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
747 : : },
748 : : };
749 : :
750 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2021_pq = {
751 : : .minimum_protocol_version = S2N_TLS12,
752 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2021,
753 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2025_07,
754 : : .signature_preferences = &s2n_signature_preferences_20200207,
755 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
756 : : .rules = {
757 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
758 : : },
759 : : };
760 : :
761 : : const struct s2n_security_policy security_policy_cloudfront_ssl_v_3_legacy = {
762 : : .minimum_protocol_version = S2N_SSLv3,
763 : : .cipher_preferences = &cipher_preferences_cloudfront_ssl_v_3_legacy,
764 : : .kem_preferences = &kem_preferences_null,
765 : : .signature_preferences = &s2n_signature_preferences_20140601,
766 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
767 : : };
768 : :
769 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_0_2014_legacy = {
770 : : .minimum_protocol_version = S2N_TLS10,
771 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_0_2014_legacy,
772 : : .kem_preferences = &kem_preferences_null,
773 : : .signature_preferences = &s2n_signature_preferences_20140601,
774 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
775 : : };
776 : :
777 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_0_2016_legacy = {
778 : : .minimum_protocol_version = S2N_TLS10,
779 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_0_2016_legacy,
780 : : .kem_preferences = &kem_preferences_null,
781 : : .signature_preferences = &s2n_signature_preferences_20140601,
782 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
783 : : };
784 : :
785 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_1_2016_legacy = {
786 : : .minimum_protocol_version = S2N_TLS11,
787 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_1_2016_legacy,
788 : : .kem_preferences = &kem_preferences_null,
789 : : .signature_preferences = &s2n_signature_preferences_20140601,
790 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
791 : : };
792 : :
793 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2018_legacy = {
794 : : .minimum_protocol_version = S2N_TLS12,
795 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2018_legacy,
796 : : .kem_preferences = &kem_preferences_null,
797 : : .signature_preferences = &s2n_signature_preferences_20140601,
798 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
799 : : };
800 : :
801 : : const struct s2n_security_policy security_policy_cloudfront_tls_1_2_2019_legacy = {
802 : : .minimum_protocol_version = S2N_TLS12,
803 : : .cipher_preferences = &cipher_preferences_cloudfront_tls_1_2_2019_legacy,
804 : : .kem_preferences = &kem_preferences_null,
805 : : .signature_preferences = &s2n_signature_preferences_20140601,
806 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
807 : : .rules = {
808 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
809 : : },
810 : : };
811 : :
812 : : const struct s2n_security_policy security_policy_aws_crt_sdk_ssl_v3 = {
813 : : .minimum_protocol_version = S2N_SSLv3,
814 : : .cipher_preferences = &cipher_preferences_aws_crt_sdk_ssl_v3,
815 : : .kem_preferences = &kem_preferences_null,
816 : : .signature_preferences = &s2n_signature_preferences_20200207,
817 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
818 : : };
819 : :
820 : : const struct s2n_security_policy security_policy_aws_crt_sdk_tls_10 = {
821 : : .minimum_protocol_version = S2N_TLS10,
822 : : .cipher_preferences = &cipher_preferences_aws_crt_sdk_default,
823 : : .kem_preferences = &kem_preferences_null,
824 : : .signature_preferences = &s2n_signature_preferences_20200207,
825 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
826 : : };
827 : :
828 : : const struct s2n_security_policy security_policy_aws_crt_sdk_tls_11 = {
829 : : .minimum_protocol_version = S2N_TLS11,
830 : : .cipher_preferences = &cipher_preferences_aws_crt_sdk_default,
831 : : .kem_preferences = &kem_preferences_null,
832 : : .signature_preferences = &s2n_signature_preferences_20200207,
833 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
834 : : };
835 : :
836 : : const struct s2n_security_policy security_policy_aws_crt_sdk_tls_12 = {
837 : : .minimum_protocol_version = S2N_TLS12,
838 : : .cipher_preferences = &cipher_preferences_aws_crt_sdk_default,
839 : : .kem_preferences = &kem_preferences_null,
840 : : .signature_preferences = &s2n_signature_preferences_20200207,
841 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
842 : : };
843 : :
844 : : const struct s2n_security_policy security_policy_aws_crt_sdk_tls_13 = {
845 : : .minimum_protocol_version = S2N_TLS13,
846 : : .cipher_preferences = &cipher_preferences_aws_crt_sdk_tls_13,
847 : : .kem_preferences = &kem_preferences_null,
848 : : .signature_preferences = &s2n_signature_preferences_20200207,
849 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
850 : : .rules = {
851 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
852 : : },
853 : : };
854 : :
855 : : const struct s2n_security_policy security_policy_aws_crt_sdk_ssl_v3_06_23 = {
856 : : .minimum_protocol_version = S2N_SSLv3,
857 : : .cipher_preferences = &cipher_preferences_aws_crt_sdk_ssl_v3,
858 : : .kem_preferences = &kem_preferences_null,
859 : : .signature_preferences = &s2n_signature_preferences_20200207,
860 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
861 : : };
862 : :
863 : : const struct s2n_security_policy security_policy_aws_crt_sdk_tls_10_06_23 = {
864 : : .minimum_protocol_version = S2N_TLS10,
865 : : .cipher_preferences = &cipher_preferences_aws_crt_sdk_default,
866 : : .kem_preferences = &kem_preferences_null,
867 : : .signature_preferences = &s2n_signature_preferences_20200207,
868 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
869 : : };
870 : :
871 : : const struct s2n_security_policy security_policy_aws_crt_sdk_tls_11_06_23 = {
872 : : .minimum_protocol_version = S2N_TLS11,
873 : : .cipher_preferences = &cipher_preferences_aws_crt_sdk_default,
874 : : .kem_preferences = &kem_preferences_null,
875 : : .signature_preferences = &s2n_signature_preferences_20200207,
876 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
877 : : };
878 : :
879 : : const struct s2n_security_policy security_policy_aws_crt_sdk_tls_12_06_23 = {
880 : : .minimum_protocol_version = S2N_TLS12,
881 : : .cipher_preferences = &cipher_preferences_aws_crt_sdk_default,
882 : : .kem_preferences = &kem_preferences_null,
883 : : .signature_preferences = &s2n_signature_preferences_20200207,
884 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
885 : : };
886 : :
887 : : const struct s2n_security_policy security_policy_aws_crt_sdk_tls_30_06_25 = {
888 : : .minimum_protocol_version = S2N_TLS12,
889 : : .cipher_preferences = &cipher_preferences_aws_crt_sdk_2025,
890 : : .kem_preferences = &kem_preferences_null,
891 : : .signature_preferences = &s2n_signature_preferences_20240501,
892 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
893 : : .rules = {
894 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
895 : : [S2N_FIPS_140_3] = true,
896 : : },
897 : : };
898 : :
899 : : const struct s2n_security_policy security_policy_aws_crt_sdk_tls_13_06_23 = {
900 : : .minimum_protocol_version = S2N_TLS13,
901 : : .cipher_preferences = &cipher_preferences_aws_crt_sdk_tls_13,
902 : : .kem_preferences = &kem_preferences_null,
903 : : .signature_preferences = &s2n_signature_preferences_20200207,
904 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
905 : : .rules = {
906 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
907 : : },
908 : : };
909 : :
910 : : const struct s2n_security_policy security_policy_kms_tls_1_0_2018_10 = {
911 : : .minimum_protocol_version = S2N_TLS10,
912 : : .cipher_preferences = &cipher_preferences_kms_tls_1_0_2018_10,
913 : : .kem_preferences = &kem_preferences_null,
914 : : .signature_preferences = &s2n_signature_preferences_20140601,
915 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
916 : : .rules = {
917 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
918 : : },
919 : : };
920 : :
921 : : const struct s2n_security_policy security_policy_kms_tls_1_0_2021_08 = {
922 : : .minimum_protocol_version = S2N_TLS10,
923 : : .cipher_preferences = &cipher_preferences_kms_tls_1_0_2021_08,
924 : : .kem_preferences = &kem_preferences_null,
925 : : .signature_preferences = &s2n_signature_preferences_20200207,
926 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
927 : : .rules = {
928 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
929 : : },
930 : : };
931 : :
932 : : const struct s2n_security_policy security_policy_kms_tls_1_2_2023_06 = {
933 : : .minimum_protocol_version = S2N_TLS12,
934 : : .cipher_preferences = &cipher_preferences_kms_tls_1_0_2021_08,
935 : : .kem_preferences = &kem_preferences_null,
936 : : .signature_preferences = &s2n_signature_preferences_20200207,
937 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
938 : : .rules = {
939 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
940 : : },
941 : : };
942 : :
943 : : /* Same as security_policy_aws_crt_sdk_tls_10_06_23 but with (IETF-standardized) ML-KEM Support */
944 : : const struct s2n_security_policy security_policy_aws_crt_sdk_tls_10_07_25_pq = {
945 : : .minimum_protocol_version = S2N_TLS10,
946 : : .cipher_preferences = &cipher_preferences_aws_crt_sdk_default,
947 : : .kem_preferences = &kem_preferences_all,
948 : : .signature_preferences = &s2n_signature_preferences_20200207,
949 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
950 : : };
951 : :
952 : : /* Same as security_policy_aws_crt_sdk_tls_12_06_23 but with (IETF-standardized) ML-KEM Support */
953 : : const struct s2n_security_policy security_policy_aws_crt_sdk_tls_12_07_25_pq = {
954 : : .minimum_protocol_version = S2N_TLS12,
955 : : .cipher_preferences = &cipher_preferences_aws_crt_sdk_default,
956 : : .kem_preferences = &kem_preferences_all,
957 : : .signature_preferences = &s2n_signature_preferences_20200207,
958 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
959 : : };
960 : :
961 : : /* Same as security_policy_aws_crt_sdk_tls_13_06_23 but with (IETF-standardized) ML-KEM Support */
962 : : const struct s2n_security_policy security_policy_aws_crt_sdk_tls_13_07_25_pq = {
963 : : .minimum_protocol_version = S2N_TLS13,
964 : : .cipher_preferences = &cipher_preferences_aws_crt_sdk_tls_13,
965 : : .kem_preferences = &kem_preferences_all,
966 : : .signature_preferences = &s2n_signature_preferences_20200207,
967 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
968 : : };
969 : :
970 : : /* Same as security_policy_aws_crt_sdk_tls_12_06_23 but with ML-KEM Support */
971 : : const struct s2n_security_policy security_policy_aws_crt_sdk_tls_12_06_23_pq = {
972 : : .minimum_protocol_version = S2N_TLS12,
973 : : .cipher_preferences = &cipher_preferences_aws_crt_sdk_default,
974 : : .kem_preferences = &kem_preferences_all,
975 : : .signature_preferences = &s2n_signature_preferences_20200207,
976 : : .ecc_preferences = &s2n_ecc_preferences_20230623,
977 : : };
978 : :
979 : : /* Same as security_policy_pq_tls_1_2_2023_10_07, but with ML-KEM support */
980 : : const struct s2n_security_policy security_policy_pq_tls_1_2_2024_10_07 = {
981 : : .minimum_protocol_version = S2N_TLS12,
982 : : .cipher_preferences = &elb_security_policy_tls13_1_2_Ext2_2021_06,
983 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
984 : : .signature_preferences = &s2n_signature_preferences_20200207,
985 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
986 : : };
987 : :
988 : : /* Same as security_policy_pq_tls_1_2_2023_10_08, but with 3DES removed, and added ML-KEM support */
989 : : const struct s2n_security_policy security_policy_pq_tls_1_2_2024_10_08 = {
990 : : .minimum_protocol_version = S2N_TLS12,
991 : : .cipher_preferences = &cipher_preferences_20241008,
992 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
993 : : .signature_preferences = &s2n_signature_preferences_20200207,
994 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
995 : : };
996 : :
997 : : /* Same as security_policy_pq_tls_1_2_2023_10_10, but with 3DES removed, and added ML-KEM support */
998 : : const struct s2n_security_policy security_policy_pq_tls_1_2_2024_10_08_gcm = {
999 : : .minimum_protocol_version = S2N_TLS12,
1000 : : .cipher_preferences = &cipher_preferences_20241008_gcm,
1001 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
1002 : : .signature_preferences = &s2n_signature_preferences_20200207,
1003 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
1004 : : };
1005 : :
1006 : : /* Same as security_policy_pq_tls_1_2_2023_10_09 but with 3DES removed, and added ML-KEM support */
1007 : : const struct s2n_security_policy security_policy_pq_tls_1_2_2024_10_09 = {
1008 : : .minimum_protocol_version = S2N_TLS12,
1009 : : .cipher_preferences = &cipher_preferences_20241009,
1010 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
1011 : : .signature_preferences = &s2n_signature_preferences_20200207,
1012 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
1013 : : .rules = {
1014 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1015 : : },
1016 : : };
1017 : : const struct s2n_security_policy security_policy_kms_fips_tls_1_2_2018_10 = {
1018 : : .minimum_protocol_version = S2N_TLS12,
1019 : : .cipher_preferences = &cipher_preferences_kms_fips_tls_1_2_2018_10,
1020 : : .kem_preferences = &kem_preferences_null,
1021 : : .signature_preferences = &s2n_signature_preferences_20140601,
1022 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1023 : : .rules = {
1024 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1025 : : },
1026 : : };
1027 : :
1028 : : const struct s2n_security_policy security_policy_kms_fips_tls_1_2_2021_08 = {
1029 : : .minimum_protocol_version = S2N_TLS12,
1030 : : .cipher_preferences = &cipher_preferences_kms_fips_tls_1_2_2021_08,
1031 : : .kem_preferences = &kem_preferences_null,
1032 : : .signature_preferences = &s2n_signature_preferences_20200207,
1033 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1034 : : .rules = {
1035 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1036 : : },
1037 : : };
1038 : :
1039 : : /* Same as security_policy_pq_20231215, but with only ML-KEM Support */
1040 : : const struct s2n_security_policy security_policy_kms_fips_tls_1_2_2024_10 = {
1041 : : .minimum_protocol_version = S2N_TLS12,
1042 : : .cipher_preferences = &cipher_preferences_kms_fips_tls_1_2_2021_08,
1043 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
1044 : : .signature_preferences = &s2n_signature_preferences_20230317,
1045 : : .ecc_preferences = &s2n_ecc_preferences_20201021,
1046 : : .rules = {
1047 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1048 : : [S2N_FIPS_140_3] = true,
1049 : : },
1050 : : };
1051 : :
1052 : : const struct s2n_security_policy security_policy_20140601 = {
1053 : : .minimum_protocol_version = S2N_SSLv3,
1054 : : .cipher_preferences = &cipher_preferences_20140601,
1055 : : .kem_preferences = &kem_preferences_null,
1056 : : .signature_preferences = &s2n_signature_preferences_20140601,
1057 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1058 : : };
1059 : :
1060 : : const struct s2n_security_policy security_policy_20141001 = {
1061 : : .minimum_protocol_version = S2N_TLS10,
1062 : : .cipher_preferences = &cipher_preferences_20141001,
1063 : : .kem_preferences = &kem_preferences_null,
1064 : : .signature_preferences = &s2n_signature_preferences_20140601,
1065 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1066 : : };
1067 : :
1068 : : const struct s2n_security_policy security_policy_20150202 = {
1069 : : .minimum_protocol_version = S2N_TLS10,
1070 : : .cipher_preferences = &cipher_preferences_20150202,
1071 : : .kem_preferences = &kem_preferences_null,
1072 : : .signature_preferences = &s2n_signature_preferences_20140601,
1073 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1074 : : };
1075 : :
1076 : : const struct s2n_security_policy security_policy_20150214 = {
1077 : : .minimum_protocol_version = S2N_TLS10,
1078 : : .cipher_preferences = &cipher_preferences_20150214,
1079 : : .kem_preferences = &kem_preferences_null,
1080 : : .signature_preferences = &s2n_signature_preferences_20140601,
1081 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1082 : : };
1083 : :
1084 : : const struct s2n_security_policy security_policy_20160411 = {
1085 : : .minimum_protocol_version = S2N_TLS10,
1086 : : .cipher_preferences = &cipher_preferences_20160411,
1087 : : .kem_preferences = &kem_preferences_null,
1088 : : .signature_preferences = &s2n_signature_preferences_20140601,
1089 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1090 : : };
1091 : :
1092 : : const struct s2n_security_policy security_policy_20150306 = {
1093 : : .minimum_protocol_version = S2N_TLS10,
1094 : : .cipher_preferences = &cipher_preferences_20150306,
1095 : : .kem_preferences = &kem_preferences_null,
1096 : : .signature_preferences = &s2n_signature_preferences_20140601,
1097 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1098 : : };
1099 : :
1100 : : const struct s2n_security_policy security_policy_20160804 = {
1101 : : .minimum_protocol_version = S2N_TLS10,
1102 : : .cipher_preferences = &cipher_preferences_20160804,
1103 : : .kem_preferences = &kem_preferences_null,
1104 : : .signature_preferences = &s2n_signature_preferences_20140601,
1105 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1106 : : };
1107 : :
1108 : : const struct s2n_security_policy security_policy_20160824 = {
1109 : : .minimum_protocol_version = S2N_TLS10,
1110 : : .cipher_preferences = &cipher_preferences_20160824,
1111 : : .kem_preferences = &kem_preferences_null,
1112 : : .signature_preferences = &s2n_signature_preferences_20140601,
1113 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1114 : : };
1115 : :
1116 : : const struct s2n_security_policy security_policy_20190122 = {
1117 : : .minimum_protocol_version = S2N_TLS10,
1118 : : .cipher_preferences = &cipher_preferences_20190122,
1119 : : .kem_preferences = &kem_preferences_null,
1120 : : .signature_preferences = &s2n_signature_preferences_20140601,
1121 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1122 : : };
1123 : :
1124 : : const struct s2n_security_policy security_policy_20190121 = {
1125 : : .minimum_protocol_version = S2N_TLS10,
1126 : : .cipher_preferences = &cipher_preferences_20190121,
1127 : : .kem_preferences = &kem_preferences_null,
1128 : : .signature_preferences = &s2n_signature_preferences_20140601,
1129 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1130 : : };
1131 : :
1132 : : const struct s2n_security_policy security_policy_20190120 = {
1133 : : .minimum_protocol_version = S2N_TLS10,
1134 : : .cipher_preferences = &cipher_preferences_20190120,
1135 : : .kem_preferences = &kem_preferences_null,
1136 : : .signature_preferences = &s2n_signature_preferences_20140601,
1137 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1138 : : };
1139 : :
1140 : : const struct s2n_security_policy security_policy_20190214 = {
1141 : : .minimum_protocol_version = S2N_TLS10,
1142 : : .cipher_preferences = &cipher_preferences_20190214,
1143 : : .kem_preferences = &kem_preferences_null,
1144 : : .signature_preferences = &s2n_signature_preferences_20140601,
1145 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1146 : : };
1147 : :
1148 : : const struct s2n_security_policy security_policy_20190214_gcm = {
1149 : : .minimum_protocol_version = S2N_TLS10,
1150 : : .cipher_preferences = &cipher_preferences_20190214_gcm,
1151 : : .kem_preferences = &kem_preferences_null,
1152 : : .signature_preferences = &s2n_signature_preferences_20140601,
1153 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1154 : : };
1155 : :
1156 : : const struct s2n_security_policy security_policy_20210825 = {
1157 : : .minimum_protocol_version = S2N_TLS10,
1158 : : .cipher_preferences = &cipher_preferences_20210825,
1159 : : .kem_preferences = &kem_preferences_null,
1160 : : .signature_preferences = &s2n_signature_preferences_20200207,
1161 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
1162 : : };
1163 : :
1164 : : const struct s2n_security_policy security_policy_20210825_gcm = {
1165 : : .minimum_protocol_version = S2N_TLS10,
1166 : : .cipher_preferences = &cipher_preferences_20210825_gcm,
1167 : : .kem_preferences = &kem_preferences_null,
1168 : : .signature_preferences = &s2n_signature_preferences_20200207,
1169 : : .ecc_preferences = &s2n_ecc_preferences_20200310,
1170 : : };
1171 : :
1172 : : const struct s2n_security_policy security_policy_20170328 = {
1173 : : .minimum_protocol_version = S2N_TLS10,
1174 : : .cipher_preferences = &cipher_preferences_20170328,
1175 : : .kem_preferences = &kem_preferences_null,
1176 : : .signature_preferences = &s2n_signature_preferences_20140601,
1177 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1178 : : };
1179 : :
1180 : : const struct s2n_security_policy security_policy_20170328_gcm = {
1181 : : .minimum_protocol_version = S2N_TLS10,
1182 : : .cipher_preferences = &cipher_preferences_20170328_gcm,
1183 : : .kem_preferences = &kem_preferences_null,
1184 : : .signature_preferences = &s2n_signature_preferences_20140601,
1185 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1186 : : };
1187 : :
1188 : : const struct s2n_security_policy security_policy_20170718 = {
1189 : : .minimum_protocol_version = S2N_TLS10,
1190 : : .cipher_preferences = &cipher_preferences_20170718,
1191 : : .kem_preferences = &kem_preferences_null,
1192 : : .signature_preferences = &s2n_signature_preferences_20140601,
1193 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1194 : : };
1195 : :
1196 : : const struct s2n_security_policy security_policy_20170718_gcm = {
1197 : : .minimum_protocol_version = S2N_TLS10,
1198 : : .cipher_preferences = &cipher_preferences_20170718_gcm,
1199 : : .kem_preferences = &kem_preferences_null,
1200 : : .signature_preferences = &s2n_signature_preferences_20140601,
1201 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1202 : : };
1203 : :
1204 : : const struct s2n_security_policy security_policy_20201021 = {
1205 : : .minimum_protocol_version = S2N_TLS10,
1206 : : .cipher_preferences = &cipher_preferences_20190122,
1207 : : .kem_preferences = &kem_preferences_null,
1208 : : .signature_preferences = &s2n_signature_preferences_20201021,
1209 : : .ecc_preferences = &s2n_ecc_preferences_20201021,
1210 : : };
1211 : :
1212 : : const struct s2n_security_policy security_policy_20210816 = {
1213 : : .minimum_protocol_version = S2N_TLS12,
1214 : : .cipher_preferences = &cipher_preferences_20210816,
1215 : : .kem_preferences = &kem_preferences_null,
1216 : : .signature_preferences = &s2n_signature_preferences_20210816,
1217 : : .ecc_preferences = &s2n_ecc_preferences_20210816,
1218 : : .rules = {
1219 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1220 : : [S2N_FIPS_140_3] = true,
1221 : : },
1222 : : };
1223 : :
1224 : : const struct s2n_security_policy security_policy_20210816_gcm = {
1225 : : .minimum_protocol_version = S2N_TLS12,
1226 : : .cipher_preferences = &cipher_preferences_20210816_gcm,
1227 : : .kem_preferences = &kem_preferences_null,
1228 : : .signature_preferences = &s2n_signature_preferences_20210816,
1229 : : .ecc_preferences = &s2n_ecc_preferences_20210816,
1230 : : .rules = {
1231 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1232 : : [S2N_FIPS_140_3] = true,
1233 : : },
1234 : : };
1235 : :
1236 : : /*
1237 : : * This security policy is derived from the following specification:
1238 : : * https://datatracker.ietf.org/doc/html/rfc9151
1239 : : */
1240 : : const struct s2n_security_policy security_policy_20250429 = {
1241 : : .minimum_protocol_version = S2N_TLS12,
1242 : : .cipher_preferences = &cipher_preferences_20250429,
1243 : : .kem_preferences = &kem_preferences_null,
1244 : : .signature_preferences = &s2n_signature_preferences_20250429,
1245 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20250429,
1246 : : .certificate_key_preferences = &s2n_certificate_key_preferences_20250429,
1247 : : .ecc_preferences = &s2n_ecc_preferences_20210816,
1248 : : .certificate_preferences_apply_locally = true,
1249 : : };
1250 : :
1251 : : /*
1252 : : * This security policy is derived from the following specification:
1253 : : * https://datatracker.ietf.org/doc/html/rfc9151
1254 : : *
1255 : : * The following exceptions to this specification are made:
1256 : : * - RSA cipher suites are not supported to allow for perfect forward secrecy.
1257 : : * - DHE cipher suites are not supported to remove the possibility of improper Diffie-Hellman
1258 : : * parameter configuration.
1259 : : */
1260 : : const struct s2n_security_policy security_policy_20251013 = {
1261 : : .minimum_protocol_version = S2N_TLS12,
1262 : : .cipher_preferences = &cipher_preferences_20251013,
1263 : : .kem_preferences = &kem_preferences_null,
1264 : : .signature_preferences = &s2n_signature_preferences_20250429,
1265 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20250429,
1266 : : .certificate_key_preferences = &s2n_certificate_key_preferences_20250429,
1267 : : .ecc_preferences = &s2n_ecc_preferences_20210816,
1268 : : .certificate_preferences_apply_locally = true,
1269 : : .rules = {
1270 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1271 : : [S2N_FIPS_140_3] = true,
1272 : : },
1273 : : };
1274 : :
1275 : : /*
1276 : : * This security policy is a mix of default_tls13 (20240503) and rfc9151, with
1277 : : * a primary requirement that AES-256 is the ciphersuite chosen. Other
1278 : : * requirements are generally picked to raise minimum thresholds (e.g.,
1279 : : * requiring TLS 1.3) where possible without losing compatibility with modern
1280 : : * default_tls13 clients or servers.
1281 : : */
1282 : : const struct s2n_security_policy security_policy_20250211 = {
1283 : : .minimum_protocol_version = S2N_TLS13,
1284 : : .cipher_preferences = &cipher_preferences_20250211,
1285 : : .kem_preferences = &kem_preferences_null,
1286 : : .signature_preferences = &s2n_signature_preferences_20250429,
1287 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20201110,
1288 : : .ecc_preferences = &s2n_ecc_preferences_20210816,
1289 : : .rules = {
1290 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1291 : : },
1292 : : };
1293 : :
1294 : : /*
1295 : : * This is essentially identical to 20250211, but fixes a bug which required
1296 : : * P-384 keys on certificates, which invalidated the compatibility promise for
1297 : : * that policy.
1298 : : */
1299 : : const struct s2n_security_policy security_policy_20250414 = {
1300 : : .minimum_protocol_version = S2N_TLS13,
1301 : : .cipher_preferences = &cipher_preferences_20250211,
1302 : : .kem_preferences = &kem_preferences_null,
1303 : : .signature_preferences = &s2n_signature_preferences_20240501,
1304 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20201110,
1305 : : .ecc_preferences = &s2n_ecc_preferences_20210816,
1306 : : .rules = {
1307 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1308 : : [S2N_FIPS_140_3] = true,
1309 : : },
1310 : : };
1311 : :
1312 : : const struct s2n_security_policy security_policy_20251113 = {
1313 : : .minimum_protocol_version = S2N_TLS12,
1314 : : .cipher_preferences = &cipher_preferences_20251113,
1315 : : .kem_preferences = &kem_preferences_null,
1316 : : .signature_preferences = &s2n_signature_preferences_20251113,
1317 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20251113,
1318 : : .ecc_preferences = &s2n_ecc_preferences_20251113,
1319 : : .strongly_preferred_groups = &cnsa_1_strong_preference,
1320 : : };
1321 : :
1322 : : const struct s2n_security_policy security_policy_20251114 = {
1323 : : .minimum_protocol_version = S2N_TLS12,
1324 : : .cipher_preferences = &cipher_preferences_20251114,
1325 : : .kem_preferences = &kem_preferences_null,
1326 : : .signature_preferences = &s2n_signature_preferences_20251113,
1327 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20251113,
1328 : : .ecc_preferences = &s2n_ecc_preferences_20251113,
1329 : : .strongly_preferred_groups = &cnsa_1_strong_preference,
1330 : : };
1331 : :
1332 : : const struct s2n_security_policy security_policy_20251115 = {
1333 : : .minimum_protocol_version = S2N_TLS12,
1334 : : .cipher_preferences = &cipher_preferences_20251115,
1335 : : .kem_preferences = &kem_preferences_null,
1336 : : .signature_preferences = &s2n_signature_preferences_20251113,
1337 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20251113,
1338 : : .ecc_preferences = &s2n_ecc_preferences_20251113,
1339 : : .strongly_preferred_groups = &cnsa_1_strong_preference,
1340 : : };
1341 : :
1342 : : const struct s2n_security_policy security_policy_20251116 = {
1343 : : .minimum_protocol_version = S2N_TLS10,
1344 : : .cipher_preferences = &cipher_preferences_20251116,
1345 : : .kem_preferences = &kem_preferences_null,
1346 : : .signature_preferences = &s2n_signature_preferences_20251113,
1347 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20251113,
1348 : : .ecc_preferences = &s2n_ecc_preferences_20251113,
1349 : : .strongly_preferred_groups = &cnsa_1_strong_preference,
1350 : : };
1351 : :
1352 : : const struct s2n_security_policy security_policy_20251117 = {
1353 : : .minimum_protocol_version = S2N_TLS12,
1354 : : .cipher_preferences = &cipher_preferences_20251117,
1355 : : .kem_preferences = &kem_preferences_null,
1356 : : .signature_preferences = &s2n_signature_preferences_20251113,
1357 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20251113,
1358 : : .ecc_preferences = &s2n_ecc_preferences_20251113,
1359 : : .strongly_preferred_groups = &cnsa_1_strong_preference,
1360 : : };
1361 : :
1362 : : /* strict CNSA 2.0 policy */
1363 : : const struct s2n_security_policy security_policy_20260219 = {
1364 : : .minimum_protocol_version = S2N_TLS13,
1365 : : .cipher_preferences = &cipher_preferences_20250211,
1366 : : .kem_preferences = &kem_preferences_pq_tls_1_3_cnsa2_2026_02,
1367 : : .signature_preferences = &s2n_signature_preferences_20260219,
1368 : : .certificate_signature_preferences = &s2n_signature_preferences_20260219,
1369 : : .certificate_key_preferences = &s2n_certificate_key_preferences_20260219,
1370 : : .ecc_preferences = &s2n_ecc_preferences_null,
1371 : : .certificate_preferences_apply_locally = true,
1372 : : .rules = {
1373 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1374 : : [S2N_FIPS_140_3] = true,
1375 : : },
1376 : : };
1377 : :
1378 : : /* CNSA 1.0 - 2.0 interop policy */
1379 : : const struct s2n_security_policy security_policy_20260220 = {
1380 : : .minimum_protocol_version = S2N_TLS12,
1381 : : .cipher_preferences = &cipher_preferences_20260220,
1382 : : .kem_preferences = &kem_preferences_pq_tls_1_3_cnsa2_2026_02,
1383 : : .signature_preferences = &s2n_signature_preferences_20260220,
1384 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20260220,
1385 : : .ecc_preferences = &s2n_ecc_preferences_20210816,
1386 : : .rules = {
1387 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1388 : : [S2N_FIPS_140_3] = true,
1389 : : },
1390 : : };
1391 : :
1392 : : /* TLS 1.3 only CNSA2 interop policy: remove TLS 1.2 ciphers from 20260721 */
1393 : : const struct s2n_security_policy security_policy_20260720 = {
1394 : : .minimum_protocol_version = S2N_TLS13,
1395 : : .cipher_preferences = &cipher_preferences_20250211,
1396 : : .kem_preferences = &kem_preferences_pq_tls_1_3_cnsa2_2026_02,
1397 : : .signature_preferences = &s2n_signature_preferences_20260220,
1398 : : .certificate_signature_preferences = &s2n_signature_preferences_20260722,
1399 : : .ecc_preferences = &s2n_ecc_preferences_20210816,
1400 : : .rules = {
1401 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1402 : : [S2N_FIPS_140_3] = true,
1403 : : },
1404 : : };
1405 : :
1406 : : /* 20260220 with expanded cert signature preferences */
1407 : : const struct s2n_security_policy security_policy_20260721 = {
1408 : : .minimum_protocol_version = S2N_TLS12,
1409 : : .cipher_preferences = &cipher_preferences_20260220,
1410 : : .kem_preferences = &kem_preferences_pq_tls_1_3_cnsa2_2026_02,
1411 : : .signature_preferences = &s2n_signature_preferences_20260220,
1412 : : .certificate_signature_preferences = &s2n_signature_preferences_20260722,
1413 : : .ecc_preferences = &s2n_ecc_preferences_20210816,
1414 : : .rules = {
1415 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1416 : : [S2N_FIPS_140_3] = true,
1417 : : },
1418 : : };
1419 : :
1420 : : /* CNSA2 interop: add MLKEM1024 and ML-DSA-87 to 20251115 */
1421 : : const struct s2n_security_policy security_policy_20260722 = {
1422 : : .minimum_protocol_version = S2N_TLS12,
1423 : : .cipher_preferences = &cipher_preferences_20251115,
1424 : : .kem_preferences = &kem_preferences_pq_tls_1_3_cnsa2_2026_02,
1425 : : .signature_preferences = &s2n_signature_preferences_20260722,
1426 : : .certificate_signature_preferences = &s2n_signature_preferences_20260722,
1427 : : .ecc_preferences = &s2n_ecc_preferences_20251113,
1428 : : .strongly_preferred_groups = &cnsa_1_strong_preference,
1429 : : };
1430 : :
1431 : : /* 20250414 with pure MLKEM1024 and ML-DSA-87 added, interoperable with CNSA 2.0 */
1432 : : const struct s2n_security_policy security_policy_20260513 = {
1433 : : .minimum_protocol_version = S2N_TLS13,
1434 : : .cipher_preferences = &cipher_preferences_20250211,
1435 : : .kem_preferences = &kem_preferences_pq_tls_1_3_cnsa2_2026_02,
1436 : : .signature_preferences = &s2n_signature_preferences_20260513,
1437 : : .certificate_signature_preferences = &s2n_certificate_signature_preferences_20260514,
1438 : : .ecc_preferences = &s2n_ecc_preferences_20210816,
1439 : : .rules = {
1440 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1441 : : [S2N_FIPS_140_3] = true,
1442 : : },
1443 : : };
1444 : :
1445 : : const struct s2n_security_policy security_policy_20260520 = {
1446 : : .minimum_protocol_version = S2N_TLS10,
1447 : : .cipher_preferences = &cipher_preferences_20260520,
1448 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
1449 : : .signature_preferences = &s2n_signature_preferences_20201021,
1450 : : .ecc_preferences = &s2n_ecc_preferences_20201021,
1451 : : };
1452 : :
1453 : : const struct s2n_security_policy security_policy_20260520_gcm = {
1454 : : .minimum_protocol_version = S2N_TLS10,
1455 : : .cipher_preferences = &cipher_preferences_20260520_gcm,
1456 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
1457 : : .signature_preferences = &s2n_signature_preferences_20201021,
1458 : : .ecc_preferences = &s2n_ecc_preferences_20201021,
1459 : : };
1460 : :
1461 : : const struct s2n_security_policy security_policy_20260521 = {
1462 : : .minimum_protocol_version = S2N_TLS12,
1463 : : .cipher_preferences = &cipher_preferences_20260521,
1464 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
1465 : : .signature_preferences = &s2n_signature_preferences_20201021,
1466 : : .ecc_preferences = &s2n_ecc_preferences_20201021,
1467 : : };
1468 : :
1469 : : const struct s2n_security_policy security_policy_20260521_gcm = {
1470 : : .minimum_protocol_version = S2N_TLS12,
1471 : : .cipher_preferences = &cipher_preferences_20260521_gcm,
1472 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
1473 : : .signature_preferences = &s2n_signature_preferences_20201021,
1474 : : .ecc_preferences = &s2n_ecc_preferences_20201021,
1475 : : };
1476 : :
1477 : : const struct s2n_security_policy security_policy_20260522 = {
1478 : : .minimum_protocol_version = S2N_TLS12,
1479 : : .cipher_preferences = &cipher_preferences_20260522,
1480 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
1481 : : .signature_preferences = &s2n_signature_preferences_20201021,
1482 : : .ecc_preferences = &s2n_ecc_preferences_20201021,
1483 : : };
1484 : :
1485 : : const struct s2n_security_policy security_policy_20260522_gcm = {
1486 : : .minimum_protocol_version = S2N_TLS12,
1487 : : .cipher_preferences = &cipher_preferences_20260522_gcm,
1488 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
1489 : : .signature_preferences = &s2n_signature_preferences_20201021,
1490 : : .ecc_preferences = &s2n_ecc_preferences_20201021,
1491 : : };
1492 : :
1493 : : const struct s2n_security_policy security_policy_20260523 = {
1494 : : .minimum_protocol_version = S2N_TLS12,
1495 : : .cipher_preferences = &cipher_preferences_20260523,
1496 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
1497 : : .signature_preferences = &s2n_signature_preferences_20240521,
1498 : : .ecc_preferences = &s2n_ecc_preferences_20201021,
1499 : : };
1500 : :
1501 : : const struct s2n_security_policy security_policy_20260523_gcm = {
1502 : : .minimum_protocol_version = S2N_TLS12,
1503 : : .cipher_preferences = &cipher_preferences_20260523_gcm,
1504 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2024_10,
1505 : : .signature_preferences = &s2n_signature_preferences_20240521,
1506 : : .ecc_preferences = &s2n_ecc_preferences_20201021,
1507 : : };
1508 : :
1509 : : const struct s2n_security_policy security_policy_test_all = {
1510 : : .minimum_protocol_version = S2N_SSLv3,
1511 : : .cipher_preferences = &cipher_preferences_test_all,
1512 : : .kem_preferences = &kem_preferences_all,
1513 : : .signature_preferences = &s2n_signature_preferences_all,
1514 : : .ecc_preferences = &s2n_ecc_preferences_test_all,
1515 : : };
1516 : :
1517 : : const struct s2n_security_policy security_policy_test_all_tls12 = {
1518 : : .minimum_protocol_version = S2N_SSLv3,
1519 : : .cipher_preferences = &cipher_preferences_test_all_tls12,
1520 : : .kem_preferences = &kem_preferences_null,
1521 : : .signature_preferences = &s2n_signature_preferences_20201021,
1522 : : .ecc_preferences = &s2n_ecc_preferences_20201021,
1523 : : };
1524 : :
1525 : : const struct s2n_security_policy security_policy_test_all_fips = {
1526 : : .minimum_protocol_version = S2N_TLS12,
1527 : : .cipher_preferences = &cipher_preferences_test_all_fips,
1528 : : .kem_preferences = &kem_preferences_all,
1529 : : .signature_preferences = &s2n_signature_preferences_test_all_fips,
1530 : : .ecc_preferences = &s2n_ecc_preferences_20201021,
1531 : : .rules = {
1532 : : [S2N_FIPS_140_3] = true,
1533 : : },
1534 : : };
1535 : :
1536 : : const struct s2n_security_policy security_policy_test_all_ecdsa = {
1537 : : .minimum_protocol_version = S2N_TLS10,
1538 : : .cipher_preferences = &cipher_preferences_test_all_ecdsa,
1539 : : .kem_preferences = &kem_preferences_null,
1540 : : .signature_preferences = &s2n_signature_preferences_20201021,
1541 : : .ecc_preferences = &s2n_ecc_preferences_test_all,
1542 : : .rules = {
1543 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1544 : : },
1545 : : };
1546 : :
1547 : : const struct s2n_security_policy security_policy_test_all_rsa_kex = {
1548 : : .minimum_protocol_version = S2N_TLS10,
1549 : : .cipher_preferences = &cipher_preferences_test_all_rsa_kex,
1550 : : .kem_preferences = &kem_preferences_null,
1551 : : .signature_preferences = &s2n_signature_preferences_20140601,
1552 : : .ecc_preferences = &s2n_ecc_preferences_20140601,
1553 : : };
1554 : :
1555 : : const struct s2n_security_policy security_policy_test_all_tls13 = {
1556 : : .minimum_protocol_version = S2N_SSLv3,
1557 : : .cipher_preferences = &cipher_preferences_test_all_tls13,
1558 : : .kem_preferences = &kem_preferences_null,
1559 : : .signature_preferences = &s2n_signature_preferences_all,
1560 : : .ecc_preferences = &s2n_ecc_preferences_test_all,
1561 : : .rules = {
1562 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1563 : : },
1564 : : };
1565 : :
1566 : : const struct s2n_security_policy security_policy_test_pq_only = {
1567 : : .minimum_protocol_version = S2N_TLS13,
1568 : : .cipher_preferences = &cipher_preferences_cloudfront_upstream_2025_08_08_tls13,
1569 : : .kem_preferences = &kem_preferences_all,
1570 : : .signature_preferences = &s2n_signature_preferences_20240501,
1571 : : .certificate_signature_preferences = &s2n_signature_preferences_20240501,
1572 : : .ecc_preferences = &s2n_ecc_preferences_null,
1573 : : .rules = {
1574 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1575 : : },
1576 : : };
1577 : :
1578 : : const struct s2n_security_policy security_policy_20200207 = {
1579 : : .minimum_protocol_version = S2N_SSLv3,
1580 : : .cipher_preferences = &cipher_preferences_test_all_tls13,
1581 : : .kem_preferences = &kem_preferences_null,
1582 : : .signature_preferences = &s2n_signature_preferences_20201021,
1583 : : .ecc_preferences = &s2n_ecc_preferences_test_all,
1584 : : .rules = {
1585 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1586 : : },
1587 : : };
1588 : :
1589 : : const struct s2n_security_policy security_policy_20200207_pq = {
1590 : : .minimum_protocol_version = S2N_SSLv3,
1591 : : .cipher_preferences = &cipher_preferences_test_all_tls13,
1592 : : .kem_preferences = &kem_preferences_pq_tls_1_3_ietf_2025_07,
1593 : : .signature_preferences = &s2n_signature_preferences_20201021,
1594 : : .ecc_preferences = &s2n_ecc_preferences_test_all,
1595 : : .rules = {
1596 : : [S2N_PERFECT_FORWARD_SECRECY] = true,
1597 : : },
1598 : : };
1599 : :
1600 : : const struct s2n_security_policy security_policy_test_ecdsa_priority = {
1601 : : .minimum_protocol_version = S2N_SSLv3,
1602 : : .cipher_preferences = &cipher_preferences_test_ecdsa_priority,
1603 : : .kem_preferences = &kem_preferences_null,
1604 : : .signature_preferences = &s2n_signature_preferences_20201021,
1605 : : .ecc_preferences = &s2n_ecc_preferences_test_all,
1606 : : };
1607 : :
1608 : : const struct s2n_security_policy security_policy_null = {
1609 : : .minimum_protocol_version = S2N_TLS10,
1610 : : .cipher_preferences = &cipher_preferences_null,
1611 : : .kem_preferences = &kem_preferences_null,
1612 : : .signature_preferences = &s2n_signature_preferences_null,
1613 : : .ecc_preferences = &s2n_ecc_preferences_null,
1614 : : };
1615 : :
1616 : : struct s2n_security_policy_selection security_policy_selection[] = {
1617 : : /* If changing named policies, please update the usage guide's docs on the corresponding policy.
1618 : : * You likely also want to update the compatibility unit tests in (tests/unit/s2n_security_rules_test.c).
1619 : : */
1620 : : { .version = "default", .security_policy = &security_policy_20251014, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1621 : : { .version = "default_tls13", .security_policy = &security_policy_20240503, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1622 : : { .version = "default_fips", .security_policy = &security_policy_20251015, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1623 : : { .version = "default_pq", .security_policy = &security_policy_20250721, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1624 : : { .version = "20241106", .security_policy = &security_policy_20241106, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1625 : : { .version = "20240501", .security_policy = &security_policy_20240501, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1626 : : { .version = "20240502", .security_policy = &security_policy_20240502, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1627 : : { .version = "20240503", .security_policy = &security_policy_20240503, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1628 : : { .version = "20230317", .security_policy = &security_policy_20230317, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1629 : : { .version = "20230317_pq", .security_policy = &security_policy_20230317_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1630 : : { .version = "20240331", .security_policy = &security_policy_20240331, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1631 : : { .version = "20240417", .security_policy = &security_policy_20240417, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1632 : : { .version = "20240416", .security_policy = &security_policy_20240416, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1633 : : { .version = "20241001", .security_policy = &security_policy_20241001, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1634 : : { .version = "20250512", .security_policy = &security_policy_20250512, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1635 : : { .version = "20250721", .security_policy = &security_policy_20250721, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1636 : : { .version = "20251014", .security_policy = &security_policy_20251014, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1637 : : { .version = "20251015", .security_policy = &security_policy_20251015, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1638 : : { .version = "20241001_pq_mixed", .security_policy = &security_policy_20241001_pq_mixed, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1639 : : { .version = "ELBSecurityPolicy-TLS-1-0-2015-04", .security_policy = &security_policy_elb_2015_04, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1640 : : /* Not a mistake. TLS-1-0-2015-05 and 2016-08 are equivalent */
1641 : : { .version = "ELBSecurityPolicy-TLS-1-0-2015-05", .security_policy = &security_policy_elb_2016_08, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1642 : : { .version = "ELBSecurityPolicy-2016-08", .security_policy = &security_policy_elb_2016_08, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1643 : : { .version = "ELBSecurityPolicy-TLS-1-1-2017-01", .security_policy = &security_policy_elb_tls_1_1_2017_01, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1644 : : { .version = "ELBSecurityPolicy-TLS-1-2-2017-01", .security_policy = &security_policy_elb_tls_1_2_2017_01, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1645 : : { .version = "ELBSecurityPolicy-TLS-1-2-Ext-2018-06", .security_policy = &security_policy_elb_tls_1_2_ext_2018_06, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1646 : : { .version = "ELBSecurityPolicy-FS-2018-06", .security_policy = &security_policy_elb_fs_2018_06, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1647 : : { .version = "ELBSecurityPolicy-FS-1-2-2019-08", .security_policy = &security_policy_elb_fs_1_2_2019_08, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1648 : : { .version = "ELBSecurityPolicy-FS-1-1-2019-08", .security_policy = &security_policy_elb_fs_1_1_2019_08, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1649 : : { .version = "ELBSecurityPolicy-FS-1-2-Res-2019-08", .security_policy = &security_policy_elb_fs_1_2_Res_2019_08, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1650 : : { .version = "ELBSecurityPolicy-TLS13-1-3-CNSA2-INTEROP1-FIPS-PQ-2026-07", .security_policy = &security_policy_20260720, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1651 : : { .version = "ELBSecurityPolicy-TLS13-1-2-CNSA2-INTEROP2-FIPS-PQ-2026-07", .security_policy = &security_policy_20260721, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1652 : : { .version = "ELBSecurityPolicy-TLS13-1-2-CNSA2-INTEROP3-FIPS-PQ-2026-07", .security_policy = &security_policy_20260722, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1653 : : { .version = "CloudFront-Upstream", .security_policy = &security_policy_cloudfront_upstream, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1654 : : { .version = "CloudFront-Upstream-TLS-1-0", .security_policy = &security_policy_cloudfront_upstream_tls10, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1655 : : { .version = "CloudFront-Upstream-TLS-1-1", .security_policy = &security_policy_cloudfront_upstream_tls11, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1656 : : { .version = "CloudFront-Upstream-TLS-1-2", .security_policy = &security_policy_cloudfront_upstream_tls12, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1657 : : { .version = "CloudFront-Upstream-2025", .security_policy = &security_policy_cloudfront_upstream_2025_08_08, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1658 : : { .version = "CloudFront-Upstream-TLS-1-0-2025", .security_policy = &security_policy_cloudfront_upstream_2025_08_08_tls10, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1659 : : { .version = "CloudFront-Upstream-TLS-1-1-2025", .security_policy = &security_policy_cloudfront_upstream_2025_08_08_tls11, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1660 : : { .version = "CloudFront-Upstream-TLS-1-2-2025", .security_policy = &security_policy_cloudfront_upstream_2025_08_08_tls12, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1661 : : { .version = "CloudFront-Upstream-TLS-1-3-2025", .security_policy = &security_policy_cloudfront_upstream_2025_08_08_tls13, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1662 : : { .version = "CloudFront-Upstream-2025-PQ", .security_policy = &security_policy_cloudfront_upstream_2025_08_08_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1663 : : { .version = "CloudFront-Upstream-TLS-1-0-2025-PQ", .security_policy = &security_policy_cloudfront_upstream_2025_08_08_tls10_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1664 : : { .version = "CloudFront-Upstream-TLS-1-1-2025-PQ", .security_policy = &security_policy_cloudfront_upstream_2025_08_08_tls11_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1665 : : { .version = "CloudFront-Upstream-TLS-1-2-2025-PQ", .security_policy = &security_policy_cloudfront_upstream_2025_08_08_tls12_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1666 : : { .version = "CloudFront-Upstream-TLS-1-3-2025-PQ", .security_policy = &security_policy_cloudfront_upstream_2025_08_08_tls13_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1667 : : /* CloudFront Viewer Facing */
1668 : : { .version = "CloudFront-SSL-v-3", .security_policy = &security_policy_cloudfront_ssl_v_3, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1669 : : { .version = "CloudFront-TLS-1-0-2014", .security_policy = &security_policy_cloudfront_tls_1_0_2014, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1670 : : { .version = "CloudFront-TLS-1-0-2014-sha256", .security_policy = &security_policy_cloudfront_tls_1_0_2014_sha256, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1671 : : { .version = "CloudFront-TLS-1-0-2016", .security_policy = &security_policy_cloudfront_tls_1_0_2016, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1672 : : { .version = "CloudFront-TLS-1-1-2016", .security_policy = &security_policy_cloudfront_tls_1_1_2016, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1673 : : { .version = "CloudFront-TLS-1-2-2017", .security_policy = &security_policy_cloudfront_tls_1_2_2017, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1674 : : { .version = "CloudFront-TLS-1-2-2018-no-sha1", .security_policy = &security_policy_cloudfront_tls_1_2_2018_no_sha1, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1675 : : { .version = "CloudFront-TLS-1-2-2019-no-sha1", .security_policy = &security_policy_cloudfront_tls_1_2_2019_no_sha1, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1676 : : { .version = "CloudFront-TLS-1-2-2021-no-sha1", .security_policy = &security_policy_cloudfront_tls_1_2_2021_no_sha1, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1677 : : { .version = "CloudFront-TLS-1-2-2025", .security_policy = &security_policy_cloudfront_tls_1_2_2025, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1678 : : { .version = "CloudFront-TLS-1-3-2025", .security_policy = &security_policy_cloudfront_tls_1_3_2025, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1679 : : /* CloudFront Non-PQ Viewer Facing */
1680 : : { .version = "CloudFront-SSL-v-3-no-pq", .security_policy = &security_policy_cloudfront_ssl_v_3_no_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1681 : : { .version = "CloudFront-TLS-1-0-2014-no-pq", .security_policy = &security_policy_cloudfront_tls_1_0_2014_no_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1682 : : { .version = "CloudFront-TLS-1-0-2014-sha256-no-pq", .security_policy = &security_policy_cloudfront_tls_1_0_2014_sha256_no_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1683 : : { .version = "CloudFront-TLS-1-0-2016-no-pq", .security_policy = &security_policy_cloudfront_tls_1_0_2016_no_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1684 : : { .version = "CloudFront-TLS-1-1-2016-no-pq", .security_policy = &security_policy_cloudfront_tls_1_1_2016_no_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1685 : : { .version = "CloudFront-TLS-1-2-2017-no-pq", .security_policy = &security_policy_cloudfront_tls_1_2_2017_no_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1686 : : { .version = "CloudFront-TLS-1-2-2018-no-sha1-no-pq", .security_policy = &security_policy_cloudfront_tls_1_2_2018_no_sha1_no_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1687 : : { .version = "CloudFront-TLS-1-2-2019-no-sha1-no-pq", .security_policy = &security_policy_cloudfront_tls_1_2_2019_no_sha1_no_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1688 : : { .version = "CloudFront-TLS-1-2-2021-no-sha1-no-pq", .security_policy = &security_policy_cloudfront_tls_1_2_2021_no_sha1_no_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1689 : : { .version = "CloudFront-TLS-1-2-2025-no-pq", .security_policy = &security_policy_cloudfront_tls_1_2_2025_no_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1690 : : { .version = "CloudFront-TLS-1-3-2025-no-pq", .security_policy = &security_policy_cloudfront_tls_1_3_2025_no_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1691 : : /* CloudFront Unofficial Viewer Facing */
1692 : : { .version = "CloudFront-TLS-1-0-2014-PQ-Beta", .security_policy = &security_policy_cloudfront_tls_1_0_2014_pq_beta, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1693 : : { .version = "CloudFront-TLS-1-2-2021-no-sha1-PQ-Beta", .security_policy = &security_policy_cloudfront_tls_1_2_2021_no_sha1_pq_beta, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1694 : : { .version = "CloudFront-TLS-1-2-2018-Beta", .security_policy = &security_policy_cloudfront_tls_1_2_2018_beta, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1695 : : { .version = "CloudFront-TLS-1-2-2021-Chacha20-Boosted", .security_policy = &security_policy_cloudfront_tls_1_2_2021_chacha20_boosted, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1696 : : /* CloudFront Legacy policies */
1697 : : { .version = "CloudFront-SSL-v-3-Legacy", .security_policy = &security_policy_cloudfront_ssl_v_3_legacy, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1698 : : { .version = "CloudFront-TLS-1-0-2014-Legacy", .security_policy = &security_policy_cloudfront_tls_1_0_2014_legacy, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1699 : : { .version = "CloudFront-TLS-1-0-2016-Legacy", .security_policy = &security_policy_cloudfront_tls_1_0_2016_legacy, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1700 : : { .version = "CloudFront-TLS-1-1-2016-Legacy", .security_policy = &security_policy_cloudfront_tls_1_1_2016_legacy, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1701 : : { .version = "CloudFront-TLS-1-2-2018-Legacy", .security_policy = &security_policy_cloudfront_tls_1_2_2018_legacy, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1702 : : { .version = "CloudFront-TLS-1-2-2019-Legacy", .security_policy = &security_policy_cloudfront_tls_1_2_2019_legacy, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1703 : : { .version = "CloudFront-TLS-1-2-2018", .security_policy = &security_policy_cloudfront_tls_1_2_2018, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1704 : : { .version = "CloudFront-TLS-1-2-2019", .security_policy = &security_policy_cloudfront_tls_1_2_2019, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1705 : : { .version = "CloudFront-TLS-1-2-2021", .security_policy = &security_policy_cloudfront_tls_1_2_2021, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1706 : : { .version = "CloudFront-TLS-1-2-2021-PQ", .security_policy = &security_policy_cloudfront_tls_1_2_2021_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1707 : : /* CRT allows users to choose the minimal TLS protocol they want to negotiate with. This translates to 5 different security policies in s2n */
1708 : : { .version = "AWS-CRT-SDK-SSLv3.0", .security_policy = &security_policy_aws_crt_sdk_ssl_v3, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1709 : : { .version = "AWS-CRT-SDK-TLSv1.0", .security_policy = &security_policy_aws_crt_sdk_tls_10, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1710 : : { .version = "AWS-CRT-SDK-TLSv1.1", .security_policy = &security_policy_aws_crt_sdk_tls_11, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1711 : : { .version = "AWS-CRT-SDK-TLSv1.2", .security_policy = &security_policy_aws_crt_sdk_tls_12, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1712 : : { .version = "AWS-CRT-SDK-TLSv1.3", .security_policy = &security_policy_aws_crt_sdk_tls_13, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1713 : : { .version = "AWS-CRT-SDK-SSLv3.0-2023", .security_policy = &security_policy_aws_crt_sdk_ssl_v3_06_23, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1714 : : { .version = "AWS-CRT-SDK-TLSv1.0-2023", .security_policy = &security_policy_aws_crt_sdk_tls_10_06_23, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1715 : : { .version = "AWS-CRT-SDK-TLSv1.0-2025-PQ", .security_policy = &security_policy_aws_crt_sdk_tls_10_07_25_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1716 : : { .version = "AWS-CRT-SDK-TLSv1.1-2023", .security_policy = &security_policy_aws_crt_sdk_tls_11_06_23, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1717 : : { .version = "AWS-CRT-SDK-TLSv1.2-2023", .security_policy = &security_policy_aws_crt_sdk_tls_12_06_23, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1718 : : { .version = "AWS-CRT-SDK-TLSv1.2-2023-PQ", .security_policy = &security_policy_aws_crt_sdk_tls_12_06_23_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1719 : : { .version = "AWS-CRT-SDK-TLSv1.2-2025", .security_policy = &security_policy_aws_crt_sdk_tls_30_06_25, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1720 : : { .version = "AWS-CRT-SDK-TLSv1.2-2025-PQ", .security_policy = &security_policy_aws_crt_sdk_tls_12_07_25_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1721 : : { .version = "AWS-CRT-SDK-TLSv1.3-2023", .security_policy = &security_policy_aws_crt_sdk_tls_13_06_23, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1722 : : { .version = "AWS-CRT-SDK-TLSv1.3-2025-PQ", .security_policy = &security_policy_aws_crt_sdk_tls_13_07_25_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1723 : : /* KMS TLS Policies*/
1724 : : { .version = "KMS-TLS-1-0-2018-10", .security_policy = &security_policy_kms_tls_1_0_2018_10, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1725 : : { .version = "KMS-TLS-1-0-2021-08", .security_policy = &security_policy_kms_tls_1_0_2021_08, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1726 : : { .version = "KMS-TLS-1-2-2023-06", .security_policy = &security_policy_kms_tls_1_2_2023_06, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1727 : : { .version = "KMS-FIPS-TLS-1-2-2018-10", .security_policy = &security_policy_kms_fips_tls_1_2_2018_10, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1728 : : { .version = "KMS-FIPS-TLS-1-2-2021-08", .security_policy = &security_policy_kms_fips_tls_1_2_2021_08, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1729 : : { .version = "KMS-FIPS-TLS-1-2-2024-10", .security_policy = &security_policy_kms_fips_tls_1_2_2024_10, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1730 : : { .version = "PQ-TLS-1-2-2024-10-07", .security_policy = &security_policy_pq_tls_1_2_2024_10_07, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1731 : : { .version = "PQ-TLS-1-2-2024-10-08", .security_policy = &security_policy_pq_tls_1_2_2024_10_08, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1732 : : { .version = "PQ-TLS-1-2-2024-10-08_gcm", .security_policy = &security_policy_pq_tls_1_2_2024_10_08_gcm, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1733 : : { .version = "PQ-TLS-1-2-2024-10-09", .security_policy = &security_policy_pq_tls_1_2_2024_10_09, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1734 : : { .version = "20140601", .security_policy = &security_policy_20140601, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1735 : : { .version = "20141001", .security_policy = &security_policy_20141001, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1736 : : { .version = "20150202", .security_policy = &security_policy_20150202, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1737 : : { .version = "20150214", .security_policy = &security_policy_20150214, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1738 : : { .version = "20150306", .security_policy = &security_policy_20150306, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1739 : : { .version = "20160411", .security_policy = &security_policy_20160411, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1740 : : { .version = "20160804", .security_policy = &security_policy_20160804, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1741 : : { .version = "20160824", .security_policy = &security_policy_20160824, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1742 : : { .version = "20170210", .security_policy = &security_policy_20170210, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1743 : : { .version = "20170328", .security_policy = &security_policy_20170328, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1744 : : { .version = "20170328_gcm", .security_policy = &security_policy_20170328_gcm, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1745 : : { .version = "20190214", .security_policy = &security_policy_20190214, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1746 : : { .version = "20190214_gcm", .security_policy = &security_policy_20190214_gcm, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1747 : : { .version = "20210825", .security_policy = &security_policy_20210825, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1748 : : { .version = "20210825_gcm", .security_policy = &security_policy_20210825_gcm, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1749 : : { .version = "20170405", .security_policy = &security_policy_20170405, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1750 : : { .version = "20170405_gcm", .security_policy = &security_policy_20170405_gcm, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1751 : : { .version = "20170718", .security_policy = &security_policy_20170718, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1752 : : { .version = "20170718_gcm", .security_policy = &security_policy_20170718_gcm, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1753 : : { .version = "20190120", .security_policy = &security_policy_20190120, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1754 : : { .version = "20190121", .security_policy = &security_policy_20190121, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1755 : : { .version = "20190122", .security_policy = &security_policy_20190122, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1756 : : { .version = "20190801", .security_policy = &security_policy_20190801, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1757 : : { .version = "20190802", .security_policy = &security_policy_20190802, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1758 : : { .version = "20200207", .security_policy = &security_policy_20200207, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1759 : : { .version = "20200207_pq", .security_policy = &security_policy_20200207_pq, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1760 : : { .version = "20201021", .security_policy = &security_policy_20201021, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1761 : : { .version = "20210816", .security_policy = &security_policy_20210816, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1762 : : { .version = "20210816_GCM", .security_policy = &security_policy_20210816_gcm, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1763 : : { .version = "20240603", .security_policy = &security_policy_20240603, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1764 : : { .version = "20250211", .security_policy = &security_policy_20250211, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1765 : : { .version = "20250414", .security_policy = &security_policy_20250414, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1766 : : { .version = "20250429", .security_policy = &security_policy_20250429, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1767 : : { .version = "20251013", .security_policy = &security_policy_20251013, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1768 : : { .version = "20251113", .security_policy = &security_policy_20251113, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1769 : : { .version = "20251114", .security_policy = &security_policy_20251114, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1770 : : { .version = "20251115", .security_policy = &security_policy_20251115, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1771 : : { .version = "20251116", .security_policy = &security_policy_20251116, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1772 : : /* the same as 20251114, but without any SHA1 HMAC ciphers */
1773 : : { .version = "20251117", .security_policy = &security_policy_20251117, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1774 : : { .version = "20260219", .security_policy = &security_policy_20260219, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1775 : : { .version = "20260220", .security_policy = &security_policy_20260220, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1776 : : { .version = "20260513", .security_policy = &security_policy_20260513, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1777 : : { .version = "20260520", .security_policy = &security_policy_20260520, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1778 : : { .version = "20260520_gcm", .security_policy = &security_policy_20260520_gcm, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1779 : : { .version = "20260521", .security_policy = &security_policy_20260521, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1780 : : { .version = "20260521_gcm", .security_policy = &security_policy_20260521_gcm, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1781 : : { .version = "20260522", .security_policy = &security_policy_20260522, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1782 : : { .version = "20260522_gcm", .security_policy = &security_policy_20260522_gcm, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1783 : : { .version = "20260523", .security_policy = &security_policy_20260523, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1784 : : { .version = "20260523_gcm", .security_policy = &security_policy_20260523_gcm, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1785 : : { .version = "20260720", .security_policy = &security_policy_20260720, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1786 : : { .version = "20260722", .security_policy = &security_policy_20260722, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1787 : : /* If changing this, please update the usage guide's docs on the corresponding policy. */
1788 : : { .version = "rfc9151", .security_policy = &security_policy_20251013, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1789 : : { .version = "cnsa_1", .security_policy = &security_policy_20251013, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1790 : : { .version = "cnsa_2", .security_policy = &security_policy_20260219, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1791 : : { .version = "cnsa_1_2_interop", .security_policy = &security_policy_20260220, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1792 : : { .version = "test_all", .security_policy = &security_policy_test_all, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1793 : : { .version = "test_all_fips", .security_policy = &security_policy_test_all_fips, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1794 : : { .version = "test_all_ecdsa", .security_policy = &security_policy_test_all_ecdsa, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1795 : : { .version = "test_all_rsa_kex", .security_policy = &security_policy_test_all_rsa_kex, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1796 : : { .version = "test_ecdsa_priority", .security_policy = &security_policy_test_ecdsa_priority, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1797 : : { .version = "test_all_tls12", .security_policy = &security_policy_test_all_tls12, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1798 : : { .version = "test_all_tls13", .security_policy = &security_policy_test_all_tls13, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1799 : : { .version = "test_pq_only", .security_policy = &security_policy_test_pq_only, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1800 : : { .version = "null", .security_policy = &security_policy_null, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
1801 : : { .version = NULL, .security_policy = NULL, .ecc_extension_required = 0, .pq_kem_extension_required = 0 }
1802 : : };
1803 : :
1804 : : const char *deprecated_security_policies[] = {
1805 : : "KMS-PQ-TLS-1-0-2019-06",
1806 : : "KMS-PQ-TLS-1-0-2020-02",
1807 : : "KMS-PQ-TLS-1-0-2020-07",
1808 : : "PQ-TLS-1-0-2020-12",
1809 : : "PQ-TLS-1-1-2021-05-17",
1810 : : "PQ-TLS-1-0-2021-05-18",
1811 : : "PQ-TLS-1-0-2021-05-19",
1812 : : "PQ-TLS-1-0-2021-05-20",
1813 : : "PQ-TLS-1-1-2021-05-21",
1814 : : "PQ-TLS-1-0-2021-05-22",
1815 : : "PQ-TLS-1-0-2021-05-23",
1816 : : "PQ-TLS-1-0-2021-05-24",
1817 : : "PQ-TLS-1-0-2021-05-25",
1818 : : "PQ-TLS-1-0-2021-05-26",
1819 : : "PQ-TLS-1-0-2023-01-24",
1820 : : "PQ-TLS-1-2-2023-04-07",
1821 : : "PQ-TLS-1-2-2023-04-08",
1822 : : "PQ-TLS-1-2-2023-04-09",
1823 : : "PQ-TLS-1-2-2023-04-10",
1824 : : "PQ-TLS-1-3-2023-06-01",
1825 : : "PQ-TLS-1-2-2023-10-07",
1826 : : "PQ-TLS-1-2-2023-10-08",
1827 : : "PQ-TLS-1-2-2023-10-09",
1828 : : "PQ-TLS-1-2-2023-10-10",
1829 : : "PQ-TLS-1-2-2023-12-13",
1830 : : "PQ-TLS-1-2-2023-12-14",
1831 : : "PQ-TLS-1-2-2023-12-15",
1832 : : "PQ-SIKE-TEST-TLS-1-0-2019-11",
1833 : : "PQ-SIKE-TEST-TLS-1-0-2020-02",
1834 : : "20240730",
1835 : : };
1836 : : const size_t deprecated_security_policies_len = s2n_array_len(deprecated_security_policies);
1837 : :
1838 : : int s2n_find_security_policy_from_version(const char *version, const struct s2n_security_policy **security_policy)
1839 : 5929 : {
1840 [ + + ][ + - ]: 5929 : POSIX_ENSURE_REF(version);
1841 [ - + ][ # # ]: 5927 : POSIX_ENSURE_REF(security_policy);
1842 : :
1843 [ + + ]: 92801 : for (int i = 0; security_policy_selection[i].version != NULL; i++) {
1844 [ + + ]: 92766 : if (!strcasecmp(version, security_policy_selection[i].version)) {
1845 : 5892 : *security_policy = security_policy_selection[i].security_policy;
1846 : 5892 : return 0;
1847 : 5892 : }
1848 : 92766 : }
1849 : :
1850 [ + + ]: 615 : for (size_t i = 0; i < deprecated_security_policies_len; i++) {
1851 [ + + ]: 612 : if (!strcasecmp(version, deprecated_security_policies[i])) {
1852 [ + - ]: 32 : POSIX_BAIL(S2N_ERR_DEPRECATED_SECURITY_POLICY);
1853 : 32 : }
1854 : 612 : }
1855 : :
1856 [ + - ]: 3 : POSIX_BAIL(S2N_ERR_INVALID_SECURITY_POLICY);
1857 : 3 : }
1858 : :
1859 : : /* Find the label e.g. "20190422" for a given security policy
1860 : : *
1861 : : * This relies on the exact security policy pointer being available in the security
1862 : : * policy table. If no match is found in the security policy table then "unknown"
1863 : : * will be returned.
1864 : : *
1865 : : * Note that a given security policy may appear in the security policy table multiple
1866 : : * times under different names. This is the case for our default policy, which
1867 : : * has both a `default` and numbered label. This function will return the label
1868 : : * of the first matching entry.
1869 : : *
1870 : : * The returned `char *` is static memory and must not be freed by the application.
1871 : : */
1872 : : const char *s2n_find_version_from_security_policy(const struct s2n_security_policy *security_policy)
1873 : 20740 : {
1874 [ + + ]: 1054446 : for (int i = 0; security_policy_selection[i].version != NULL; i++) {
1875 [ + + ]: 1049826 : if (security_policy_selection[i].security_policy == security_policy) {
1876 : 16120 : return security_policy_selection[i].version;
1877 : 16120 : }
1878 : 1049826 : }
1879 : :
1880 : 4620 : return "unknown";
1881 : 20740 : }
1882 : :
1883 : : static int s2n_config_validate_security_policy(struct s2n_config *config, const struct s2n_security_policy *security_policy)
1884 : 6046 : {
1885 [ - + ][ # # ]: 6046 : POSIX_ENSURE_REF(config);
1886 [ # # ][ - + ]: 6046 : POSIX_ENSURE_REF(security_policy);
1887 [ # # ][ - + ]: 6046 : POSIX_ENSURE_REF(security_policy->cipher_preferences);
1888 [ # # ][ - + ]: 6046 : POSIX_ENSURE_REF(security_policy->kem_preferences);
1889 [ # # ][ - + ]: 6046 : POSIX_ENSURE_REF(security_policy->signature_preferences);
1890 [ # # ][ - + ]: 6046 : POSIX_ENSURE_REF(security_policy->ecc_preferences);
1891 : :
1892 : : /* If the security policy's minimum version is higher than what libcrypto supports, return an error. */
1893 [ - + ][ # # ]: 6046 : POSIX_ENSURE((security_policy->minimum_protocol_version <= s2n_get_highest_fully_supported_tls_version()), S2N_ERR_PROTOCOL_VERSION_UNSUPPORTED);
1894 : :
1895 [ + + ]: 6046 : if (security_policy == &security_policy_null) {
1896 : 4 : return S2N_SUCCESS;
1897 : 4 : }
1898 : :
1899 : : /* Ensure that all strongly preferred groups are supported by our libcrypto. */
1900 [ - + ][ # # ]: 6042 : for (size_t i = 0; security_policy->strongly_preferred_groups != NULL && i < security_policy->strongly_preferred_groups->count; i++) {
1901 : 0 : const struct s2n_kem_group *strongly_preferred_kem_group = NULL;
1902 : 0 : bool found_kem_group_from_iana = false;
1903 [ # # ]: 0 : POSIX_GUARD(s2n_find_kem_group_from_iana_id(security_policy->strongly_preferred_groups->iana_ids[i], &strongly_preferred_kem_group, &found_kem_group_from_iana));
1904 : :
1905 [ # # ]: 0 : if (found_kem_group_from_iana) {
1906 [ # # ][ # # ]: 0 : POSIX_ENSURE(s2n_kem_group_is_available(strongly_preferred_kem_group), S2N_ERR_INVALID_SECURITY_POLICY);
1907 : 0 : }
1908 : 0 : }
1909 : :
1910 : : /* Ensure that an ECC or PQ key exchange can occur. */
1911 : 6042 : uint32_t ecc_available = security_policy->ecc_preferences->count;
1912 : 6042 : uint32_t kem_groups_available = 0;
1913 [ - + ]: 6042 : POSIX_GUARD_RESULT(s2n_kem_preferences_groups_available(security_policy->kem_preferences, &kem_groups_available));
1914 [ + + ][ + - ]: 6042 : POSIX_ENSURE(ecc_available + kem_groups_available > 0, S2N_ERR_INVALID_SECURITY_POLICY);
1915 : :
1916 : : /* If the config contains certificates violating the security policy cert preferences, return an error. */
1917 [ + + ]: 6040 : POSIX_GUARD_RESULT(s2n_config_validate_loaded_certificates(config, security_policy));
1918 : 6038 : return S2N_SUCCESS;
1919 : 6040 : }
1920 : :
1921 : : int s2n_config_set_security_policy(struct s2n_config *config, const struct s2n_security_policy *security_policy)
1922 : 4395 : {
1923 [ # # ][ - + ]: 4395 : POSIX_ENSURE_REF(config);
1924 [ + + ]: 4395 : POSIX_GUARD(s2n_config_validate_security_policy(config, security_policy));
1925 : 4392 : config->security_policy = security_policy;
1926 : 4392 : return 0;
1927 : 4395 : }
1928 : :
1929 : : int s2n_config_set_cipher_preferences(struct s2n_config *config, const char *version)
1930 : 4397 : {
1931 : 4397 : const struct s2n_security_policy *security_policy = NULL;
1932 [ + + ]: 4397 : POSIX_GUARD(s2n_find_security_policy_from_version(version, &security_policy));
1933 [ + + ]: 4395 : POSIX_GUARD(s2n_config_set_security_policy(config, security_policy));
1934 : 4392 : return S2N_SUCCESS;
1935 : 4395 : }
1936 : :
1937 : : int s2n_connection_set_security_policy(struct s2n_connection *conn, const struct s2n_security_policy *security_policy)
1938 : 1651 : {
1939 [ - + ][ # # ]: 1651 : POSIX_ENSURE_REF(conn);
1940 [ + + ]: 1651 : POSIX_GUARD(s2n_config_validate_security_policy(conn->config, security_policy));
1941 : 1650 : conn->security_policy_override = security_policy;
1942 : 1650 : return 0;
1943 : 1651 : }
1944 : :
1945 : : int s2n_connection_set_cipher_preferences(struct s2n_connection *conn, const char *version)
1946 : 1263 : {
1947 : 1263 : const struct s2n_security_policy *security_policy = NULL;
1948 [ + + ]: 1263 : POSIX_GUARD(s2n_find_security_policy_from_version(version, &security_policy));
1949 [ + + ]: 1261 : POSIX_GUARD(s2n_connection_set_security_policy(conn, security_policy));
1950 : 1260 : return S2N_SUCCESS;
1951 : 1261 : }
1952 : :
1953 : : int s2n_security_policies_init()
1954 : 348 : {
1955 [ + + ]: 60204 : for (int i = 0; security_policy_selection[i].version != NULL; i++) {
1956 : 59856 : const struct s2n_security_policy *security_policy = security_policy_selection[i].security_policy;
1957 [ - + ][ # # ]: 59856 : POSIX_ENSURE_REF(security_policy);
1958 : 59856 : const struct s2n_cipher_preferences *cipher_preference = security_policy->cipher_preferences;
1959 [ - + ][ # # ]: 59856 : POSIX_ENSURE_REF(cipher_preference);
1960 : 59856 : const struct s2n_kem_preferences *kem_preference = security_policy->kem_preferences;
1961 [ # # ][ - + ]: 59856 : POSIX_ENSURE_REF(kem_preference);
1962 : 59856 : const struct s2n_ecc_preferences *ecc_preference = security_policy->ecc_preferences;
1963 [ - + ][ # # ]: 59856 : POSIX_ENSURE_REF(ecc_preference);
1964 [ - + ]: 59856 : POSIX_GUARD(s2n_check_ecc_preferences_curves_list(ecc_preference));
1965 : :
1966 : 59856 : const struct s2n_signature_preferences *certificate_signature_preference = security_policy->certificate_signature_preferences;
1967 [ + + ]: 59856 : if (certificate_signature_preference != NULL) {
1968 [ - + ]: 13224 : POSIX_GUARD_RESULT(s2n_validate_certificate_signature_preferences(certificate_signature_preference));
1969 : 13224 : }
1970 : :
1971 [ + + ]: 59856 : if (security_policy != &security_policy_null) {
1972 : : /* All policies must have at least one ecc curve or PQ kem group configured. */
1973 : 59508 : bool ecc_kx_supported = ecc_preference->count > 0;
1974 : 59508 : bool pq_kx_supported = kem_preference->tls13_kem_group_count > 0;
1975 [ # # ][ + - ]: 59508 : POSIX_ENSURE(ecc_kx_supported || pq_kx_supported, S2N_ERR_INVALID_SECURITY_POLICY);
[ + + ]
1976 : :
1977 : : /* A PQ key exchange is only supported in TLS 1.3, so PQ-only policies must require TLS 1.3.*/
1978 [ + + ]: 59508 : if (!ecc_kx_supported) {
1979 [ - + ][ # # ]: 1044 : POSIX_ENSURE(security_policy->minimum_protocol_version >= S2N_TLS13, S2N_ERR_INVALID_SECURITY_POLICY);
1980 : 1044 : }
1981 : 59508 : }
1982 : :
1983 [ + + ]: 908628 : for (int j = 0; j < cipher_preference->count; j++) {
1984 : 848772 : struct s2n_cipher_suite *cipher = cipher_preference->suites[j];
1985 [ # # ][ - + ]: 848772 : POSIX_ENSURE_REF(cipher);
1986 : :
1987 : 848772 : const uint8_t *iana = cipher->iana_value;
1988 : :
1989 [ + + ]: 848772 : if (cipher->minimum_required_tls_version >= S2N_TLS13) {
1990 : 104748 : security_policy_selection[i].supports_tls13 = 1;
1991 : 104748 : }
1992 : :
1993 : : /* Sanity check that valid tls13 has minimum tls version set correctly */
1994 [ - + ][ # # ]: 848772 : S2N_ERROR_IF(s2n_is_valid_tls13_cipher(iana) ^ (cipher->minimum_required_tls_version >= S2N_TLS13),
1995 : 848772 : S2N_ERR_INVALID_SECURITY_POLICY);
1996 : :
1997 [ + + ]: 848772 : if (s2n_cipher_suite_requires_ecc_extension(cipher)) {
1998 : 594384 : security_policy_selection[i].ecc_extension_required = 1;
1999 : 594384 : }
2000 : :
2001 [ - + ][ # # ]: 848772 : if (s2n_cipher_suite_requires_pq_extension(cipher) && kem_preference->kem_count > 0) {
2002 : 0 : security_policy_selection[i].pq_kem_extension_required = 1;
2003 : 0 : }
2004 : 848772 : }
2005 : :
2006 [ - + ]: 59856 : POSIX_GUARD(s2n_validate_kem_preferences(kem_preference, security_policy_selection[i].pq_kem_extension_required));
2007 : :
2008 : : /* Validate that security rules are correctly applied.
2009 : : * This should be checked by a unit test, but outside of unit tests we
2010 : : * check again here to cover the case where the unit tests are not run.
2011 : : */
2012 [ - + ]: 59856 : if (!s2n_in_unit_test()) {
2013 : 0 : struct s2n_security_rule_result result = { 0 };
2014 [ # # ]: 0 : POSIX_GUARD_RESULT(s2n_security_policy_validate_security_rules(security_policy, &result));
2015 [ # # ][ # # ]: 0 : POSIX_ENSURE(!result.found_error, S2N_ERR_INVALID_SECURITY_POLICY);
2016 : 0 : }
2017 : 59856 : }
2018 : 348 : return 0;
2019 : 348 : }
2020 : :
2021 : : bool s2n_ecc_is_extension_required(const struct s2n_security_policy *security_policy)
2022 : 15763 : {
2023 [ + + ]: 15763 : if (security_policy == NULL) {
2024 : 1 : return false;
2025 : 1 : }
2026 : :
2027 [ + + ]: 1229689 : for (int i = 0; security_policy_selection[i].version != NULL; i++) {
2028 [ + + ]: 1224312 : if (security_policy_selection[i].security_policy == security_policy) {
2029 : 10385 : return 1 == security_policy_selection[i].ecc_extension_required;
2030 : 10385 : }
2031 : 1224312 : }
2032 : :
2033 : : /* If cipher preference is not in the official list, compute the result */
2034 : 5377 : const struct s2n_cipher_preferences *cipher_preferences = security_policy->cipher_preferences;
2035 [ - + ]: 5377 : if (cipher_preferences == NULL) {
2036 : 0 : return false;
2037 : 0 : }
2038 [ + + ]: 138607 : for (size_t i = 0; i < cipher_preferences->count; i++) {
2039 [ + + ]: 136141 : if (s2n_cipher_suite_requires_ecc_extension(cipher_preferences->suites[i])) {
2040 : 2911 : return true;
2041 : 2911 : }
2042 : 136141 : }
2043 : :
2044 : 2466 : return false;
2045 : 5377 : }
2046 : :
2047 : : bool s2n_pq_kem_is_extension_required(const struct s2n_security_policy *security_policy)
2048 : 7887 : {
2049 [ + + ]: 7887 : if (security_policy == NULL) {
2050 : 1 : return false;
2051 : 1 : }
2052 : :
2053 [ + + ]: 615308 : for (int i = 0; security_policy_selection[i].version != NULL; i++) {
2054 [ + + ]: 612619 : if (security_policy_selection[i].security_policy == security_policy) {
2055 : 5197 : return 1 == security_policy_selection[i].pq_kem_extension_required;
2056 : 5197 : }
2057 : 612619 : }
2058 : :
2059 : : /* Preferences with no KEMs for the TLS 1.2 PQ KEM extension do not require that extension. */
2060 [ + - ][ + + ]: 2689 : if (security_policy->kem_preferences && security_policy->kem_preferences->kem_count == 0) {
2061 : 2688 : return false;
2062 : 2688 : }
2063 : :
2064 : : /* If cipher preference is not in the official list, compute the result */
2065 : 1 : const struct s2n_cipher_preferences *cipher_preferences = security_policy->cipher_preferences;
2066 [ - + ]: 1 : if (cipher_preferences == NULL) {
2067 : 0 : return false;
2068 : 0 : }
2069 [ + + ]: 2 : for (size_t i = 0; i < cipher_preferences->count; i++) {
2070 [ - + ]: 1 : if (s2n_cipher_suite_requires_pq_extension(cipher_preferences->suites[i])) {
2071 : 0 : return true;
2072 : 0 : }
2073 : 1 : }
2074 : 1 : return false;
2075 : 1 : }
2076 : :
2077 : : /* Checks whether cipher preference supports TLS 1.3 based on whether it is configured
2078 : : * with TLS 1.3 ciphers. Returns true or false.
2079 : : */
2080 : : bool s2n_security_policy_supports_tls13(const struct s2n_security_policy *security_policy)
2081 : 15919 : {
2082 [ + + ]: 15919 : if (security_policy == NULL) {
2083 : 1 : return false;
2084 : 1 : }
2085 : :
2086 [ + + ]: 1044928 : for (size_t i = 0; security_policy_selection[i].version != NULL; i++) {
2087 [ + + ]: 1040225 : if (security_policy_selection[i].security_policy == security_policy) {
2088 : 11215 : return security_policy_selection[i].supports_tls13 == 1;
2089 : 11215 : }
2090 : 1040225 : }
2091 : :
2092 : : /* if cipher preference is not in the official list, compute the result */
2093 : 4703 : const struct s2n_cipher_preferences *cipher_preferences = security_policy->cipher_preferences;
2094 [ - + ]: 4703 : if (cipher_preferences == NULL) {
2095 : 0 : return false;
2096 : 0 : }
2097 : :
2098 [ + + ]: 106625 : for (size_t i = 0; i < cipher_preferences->count; i++) {
2099 [ + + ]: 103276 : if (cipher_preferences->suites[i]->minimum_required_tls_version >= S2N_TLS13) {
2100 : 1354 : return true;
2101 : 1354 : }
2102 : 103276 : }
2103 : :
2104 : 3349 : return false;
2105 : 4703 : }
2106 : :
2107 : : int s2n_connection_is_valid_for_cipher_preferences(struct s2n_connection *conn, const char *version)
2108 : 7 : {
2109 [ # # ][ - + ]: 7 : POSIX_ENSURE_REF(conn);
2110 [ - + ][ # # ]: 7 : POSIX_ENSURE_REF(version);
2111 [ - + ][ # # ]: 7 : POSIX_ENSURE_REF(conn->secure);
2112 [ - + ][ # # ]: 7 : POSIX_ENSURE_REF(conn->secure->cipher_suite);
2113 : :
2114 : 7 : const struct s2n_security_policy *security_policy = NULL;
2115 [ + + ]: 7 : POSIX_GUARD(s2n_find_security_policy_from_version(version, &security_policy));
2116 [ - + ][ # # ]: 6 : POSIX_ENSURE_REF(security_policy);
2117 : :
2118 : : /* make sure we don't use a tls version lower than that configured by the version */
2119 [ + + ]: 6 : if (s2n_connection_get_actual_protocol_version(conn) < security_policy->minimum_protocol_version) {
2120 : 2 : return 0;
2121 : 2 : }
2122 : :
2123 : 4 : struct s2n_cipher_suite *cipher = conn->secure->cipher_suite;
2124 [ - + ][ # # ]: 4 : POSIX_ENSURE_REF(cipher);
2125 [ + + ]: 9 : for (int i = 0; i < security_policy->cipher_preferences->count; ++i) {
2126 [ + + ]: 8 : if (s2n_constant_time_equals(security_policy->cipher_preferences->suites[i]->iana_value, cipher->iana_value, S2N_TLS_CIPHER_SUITE_LEN)) {
2127 : 3 : return 1;
2128 : 3 : }
2129 : 8 : }
2130 : :
2131 : 1 : return 0;
2132 : 4 : }
2133 : :
2134 : : int s2n_validate_kem_preferences(const struct s2n_kem_preferences *kem_preferences, bool pq_kem_extension_required)
2135 : 59863 : {
2136 [ + - ][ + + ]: 59863 : POSIX_ENSURE_REF(kem_preferences);
2137 : :
2138 : : /* Basic sanity checks to assert that the count is 0 if and only if the associated list is NULL */
2139 [ + + ][ + - ]: 59862 : POSIX_ENSURE(S2N_IFF(kem_preferences->tls13_kem_group_count == 0, kem_preferences->tls13_kem_groups == NULL),
2140 : 59860 : S2N_ERR_INVALID_SECURITY_POLICY);
2141 [ + + ][ + - ]: 59860 : POSIX_ENSURE(S2N_IFF(kem_preferences->kem_count == 0, kem_preferences->kems == NULL),
2142 : 59859 : S2N_ERR_INVALID_SECURITY_POLICY);
2143 [ - + ][ # # ]: 59859 : POSIX_ENSURE(kem_preferences->tls13_kem_group_count <= S2N_KEM_GROUPS_COUNT, S2N_ERR_ARRAY_INDEX_OOB);
2144 : :
2145 : : /* The PQ KEM extension is applicable only to TLS 1.2 */
2146 [ + + ]: 59859 : if (pq_kem_extension_required) {
2147 [ + - ][ + - ]: 1 : POSIX_ENSURE(kem_preferences->kem_count > 0, S2N_ERR_INVALID_SECURITY_POLICY);
2148 [ # # ][ # # ]: 0 : POSIX_ENSURE(kem_preferences->kems != NULL, S2N_ERR_INVALID_SECURITY_POLICY);
2149 : 59858 : } else {
2150 [ - + ][ # # ]: 59858 : POSIX_ENSURE(kem_preferences->kem_count == 0, S2N_ERR_INVALID_SECURITY_POLICY);
2151 [ # # ][ - + ]: 59858 : POSIX_ENSURE(kem_preferences->kems == NULL, S2N_ERR_INVALID_SECURITY_POLICY);
2152 : 59858 : }
2153 : :
2154 : 59858 : return S2N_SUCCESS;
2155 : 59859 : }
2156 : :
2157 : : S2N_RESULT s2n_validate_certificate_signature_preferences(const struct s2n_signature_preferences *certificate_signature_preferences)
2158 : 13227 : {
2159 [ - + ][ # # ]: 13227 : RESULT_ENSURE_REF(certificate_signature_preferences);
2160 : :
2161 : 13227 : size_t rsa_pss_scheme_count = 0;
2162 : :
2163 [ + + ]: 158004 : for (size_t i = 0; i < certificate_signature_preferences->count; i++) {
2164 [ + + ]: 144777 : if (certificate_signature_preferences->signature_schemes[i]->libcrypto_nid == NID_rsassaPss) {
2165 : 60560 : rsa_pss_scheme_count++;
2166 : 60560 : }
2167 : 144777 : }
2168 : :
2169 : : /*
2170 : : * https://github.com/aws/s2n-tls/issues/3435
2171 : : *
2172 : : * The Openssl function used to parse signatures off certificates does not differentiate between any rsa pss
2173 : : * signature schemes. Therefore a security policy with a certificate signatures preference list must include
2174 : : * all rsa_pss signature schemes. */
2175 [ + - ][ + + ]: 13227 : RESULT_ENSURE(rsa_pss_scheme_count == NUM_RSA_PSS_SCHEMES || rsa_pss_scheme_count == 0, S2N_ERR_INVALID_SECURITY_POLICY);
[ + + ]
2176 : 13226 : return S2N_RESULT_OK;
2177 : 13227 : }
2178 : :
2179 : : S2N_RESULT s2n_security_policy_get_version(const struct s2n_security_policy *security_policy, const char **version)
2180 : 107 : {
2181 [ # # ][ - + ]: 107 : RESULT_ENSURE_REF(version);
2182 : 107 : *version = NULL;
2183 [ + + ]: 9708 : for (size_t i = 0; security_policy_selection[i].version != NULL; i++) {
2184 [ + + ]: 9693 : if (security_policy_selection[i].security_policy == security_policy) {
2185 : 92 : *version = security_policy_selection[i].version;
2186 : 92 : return S2N_RESULT_OK;
2187 : 92 : }
2188 : 9693 : }
2189 [ + - ]: 15 : RESULT_BAIL(S2N_ERR_INVALID_SECURITY_POLICY);
2190 : 15 : }
2191 : :
2192 : : S2N_RESULT s2n_security_policy_validate_cert_signature(const struct s2n_security_policy *security_policy,
2193 : : const struct s2n_cert_info *info, s2n_error error)
2194 : 717 : {
2195 [ - + ][ # # ]: 717 : RESULT_ENSURE_REF(info);
2196 [ - + ][ # # ]: 717 : RESULT_ENSURE_REF(security_policy);
2197 : 717 : const struct s2n_signature_preferences *sig_preferences = security_policy->certificate_signature_preferences;
2198 : :
2199 [ + + ]: 717 : if (sig_preferences != NULL) {
2200 [ + + ]: 1455 : for (size_t i = 0; i < sig_preferences->count; i++) {
2201 [ + + ]: 1444 : if (sig_preferences->signature_schemes[i]->libcrypto_nid == info->signature_nid) {
2202 : 269 : return S2N_RESULT_OK;
2203 : 269 : }
2204 : 1444 : }
2205 : :
2206 [ + - ]: 11 : RESULT_BAIL(error);
2207 : 11 : }
2208 : 437 : return S2N_RESULT_OK;
2209 : 717 : }
2210 : :
2211 : : S2N_RESULT s2n_security_policy_validate_cert_key(const struct s2n_security_policy *security_policy,
2212 : : const struct s2n_cert_info *info, s2n_error error)
2213 : 1308 : {
2214 [ # # ][ - + ]: 1308 : RESULT_ENSURE_REF(info);
2215 [ # # ][ - + ]: 1308 : RESULT_ENSURE_REF(security_policy);
2216 : 1308 : const struct s2n_certificate_key_preferences *key_preferences = security_policy->certificate_key_preferences;
2217 : :
2218 [ + + ]: 1308 : if (key_preferences != NULL) {
2219 [ + + ]: 120 : for (size_t i = 0; i < key_preferences->count; i++) {
2220 [ + + ]: 111 : if (key_preferences->certificate_keys[i]->public_key_libcrypto_nid == info->public_key_nid
2221 [ + + ]: 111 : && key_preferences->certificate_keys[i]->bits == info->public_key_bits) {
2222 : 83 : return S2N_RESULT_OK;
2223 : 83 : }
2224 : 111 : }
2225 [ + - ]: 9 : RESULT_BAIL(error);
2226 : 9 : }
2227 : 1216 : return S2N_RESULT_OK;
2228 : 1308 : }
2229 : :
2230 : : S2N_RESULT s2n_security_policy_validate_certificate_chain(
2231 : : const struct s2n_security_policy *security_policy,
2232 : : const struct s2n_cert_chain_and_key *cert_key_pair)
2233 : 1263 : {
2234 [ - + ][ # # ]: 1263 : RESULT_ENSURE_REF(security_policy);
2235 [ - + ][ # # ]: 1263 : RESULT_ENSURE_REF(cert_key_pair);
2236 [ - + ][ # # ]: 1263 : RESULT_ENSURE_REF(cert_key_pair->cert_chain);
2237 : :
2238 [ + + ]: 1263 : if (!security_policy->certificate_preferences_apply_locally) {
2239 : 1228 : return S2N_RESULT_OK;
2240 : 1228 : }
2241 : :
2242 : 35 : struct s2n_cert *current = cert_key_pair->cert_chain->head;
2243 [ + + ]: 104 : while (current != NULL) {
2244 [ + + ]: 84 : RESULT_GUARD(s2n_security_policy_validate_cert_key(security_policy, ¤t->info,
2245 : 78 : S2N_ERR_SECURITY_POLICY_INCOMPATIBLE_CERT));
2246 [ + + ]: 78 : RESULT_GUARD(s2n_security_policy_validate_cert_signature(security_policy, ¤t->info,
2247 : 69 : S2N_ERR_SECURITY_POLICY_INCOMPATIBLE_CERT));
2248 : 69 : current = current->next;
2249 : 69 : }
2250 : 20 : return S2N_RESULT_OK;
2251 : 35 : }
|
