From krishna@sac.sfbay.sun.com Fri May 16 13:54:02 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4GKs1Kc007647 for ; Fri, 16 May 2008 13:54:02 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m4GKrv3f001994; Sat, 17 May 2008 04:54:00 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K0Z00F0RBDYBR00@nwk-avmta-2.sfbay.sun.com>; Fri, 16 May 2008 13:53:58 -0700 (PDT) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K0Z00A4UBDXRE40@nwk-avmta-2.sfbay.sun.com>; Fri, 16 May 2008 13:53:57 -0700 (PDT) Received: from sac.sfbay.sun.com (new-sac.SFBay.Sun.COM [129.146.175.65]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m4GKrvdW001101; Fri, 16 May 2008 13:53:57 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4GKrtRZ007633; Fri, 16 May 2008 13:53:55 -0700 (PDT) Received: (from krishna@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id m4GKrtaG007629; Fri, 16 May 2008 13:53:55 -0700 (PDT) Date: Fri, 16 May 2008 13:53:55 -0700 (PDT) From: Krishna Yenduri Subject: AES cipher suite support in kernel SSL [PSARC/2008/330 Self Review] To: PSARC-ext@sun.com Cc: crypto-discuss@opensolaris.org Message-id: <200805162053.m4GKrtaG007629@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 1500 I am self-sponsoring this case and have marked it closed approved automatic as it just adds new legal values to an existing CLI option. The interface is committed and the release binding is micro/patch. Template Version: @(#)sac_nextcase 1.66 04/17/08 SMI This information is Copyright 2008 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: AES cipher suite support in kernel SSL 1.2. Name of Document Author/Supplier: Author: Krishna Yenduri 1.3 Date of This Document: 16 May, 2008 4. Technical Description This project adds support for the AES cipher suites - TLS_RSA_WITH_AES_128_CBC_SHA and TLS_RSA_WITH_AES_256_CBC_SHA in kernel SSL. These suites are defined in RFC 3268. Note that there is no AES_192 variant defined in this RFC. The ksslcfg(1) CLI has a -c option to limit the set of cipher suites. We add two additional cipher suite values - rsa_aes_256_cbc_sha rsa_aes_128_cbc_sha The man page diffs are in the case directory. Interfaces Exported ------------------- New values for /usr/sbin/ksslcfg -c Committed References: 1. Chown, P., "Advanced Encryption Standard (AES) Ciphersuites for Transport Layer Security (TLS)", RFC 3268, June 2002. 2. PSARC 2005/625, Greyhound (Kernel SSL proxy) amendment (Supersedes PSARC 2002/557) 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: Automatic 6.6. ARC Exposure: open