1 /*

     2  * Copyright (c) 2002, 2013, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.  Oracle designates this

     8  * particular file as subject to the "Classpath" exception as provided

     9  * by Oracle in the LICENSE file that accompanied this code.

    10  *

    11  * This code is distributed in the hope that it will be useful, but WITHOUT

    12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    14  * version 2 for more details (a copy is included in the LICENSE file that

    15  * accompanied this code).

    16  *

    17  * You should have received a copy of the GNU General Public License version

    18  * 2 along with this work; if not, write to the Free Software Foundation,

    19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    20  *

    21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    22  * or visit www.oracle.com if you need additional information or have any

    23  * questions.

    24  */

    25 

    26 

    27 package sun.security.ssl;

    28 

    29 import java.util.*;

    30 

    31 import java.security.NoSuchAlgorithmException;

    32 import java.security.InvalidKeyException;

    33 import java.security.SecureRandom;

    34 import java.security.KeyManagementException;

    35 

    36 import javax.crypto.Cipher;

    37 import javax.crypto.SecretKey;

    38 import javax.crypto.spec.IvParameterSpec;

    39 import javax.crypto.spec.SecretKeySpec;

    40 

    41 import static sun.security.ssl.CipherSuite.KeyExchange.*;

    42 import static sun.security.ssl.CipherSuite.PRF.*;

    43 import static sun.security.ssl.CipherSuite.CipherType.*;

    44 import static sun.security.ssl.JsseJce.*;

    45 

    46 /**

    47  * An SSL/TLS CipherSuite. Constants for the standard key exchange, cipher,

    48  * and mac algorithms are also defined in this class.

    49  *

    50  * The CipherSuite class and the inner classes defined in this file roughly

    51  * follow the type safe enum pattern described in Effective Java. This means:

    52  *

    53  *  . instances are immutable, classes are final

    54  *

    55  *  . there is a unique instance of every value, i.e. there are never two

    56  *    instances representing the same CipherSuite, etc. This means equality

    57  *    tests can be performed using == instead of equals() (although that works

    58  *    as well). [A minor exception are *unsupported* CipherSuites read from a

    59  *    handshake message, but this is usually irrelevant]

    60  *

    61  *  . instances are obtained using the static valueOf() factory methods.

    62  *

    63  *  . properties are defined as final variables and made available as

    64  *    package private variables without method accessors

    65  *

    66  *  . if the member variable allowed is false, the given algorithm is either

    67  *    unavailable or disabled at compile time

    68  *

    69  */

    70 final class CipherSuite implements Comparable<CipherSuite> {

    71 

    72     // minimum priority for supported CipherSuites

    73     final static int SUPPORTED_SUITES_PRIORITY = 1;

    74 

    75     // minimum priority for default enabled CipherSuites

    76     final static int DEFAULT_SUITES_PRIORITY = 300;

    77 

    78     // Flag indicating if CipherSuite availability can change dynamically.

    79     // This is the case when we rely on a JCE cipher implementation that

    80     // may not be available in the installed JCE providers.

    81     // It is true because we might not have an ECC implementation.

    82     final static boolean DYNAMIC_AVAILABILITY = true;

    83 

    84     private final static boolean ALLOW_ECC = Debug.getBooleanProperty

    85         ("com.sun.net.ssl.enableECC", true);

    86 

    87     // Map Integer(id) -> CipherSuite

    88     // contains all known CipherSuites

    89     private final static Map<Integer,CipherSuite> idMap;

    90 

    91     // Map String(name) -> CipherSuite

    92     // contains only supported CipherSuites (i.e. allowed == true)

    93     private final static Map<String,CipherSuite> nameMap;

    94 

    95     // Protocol defined CipherSuite name, e.g. SSL_RSA_WITH_RC4_128_MD5

    96     // we use TLS_* only for new CipherSuites, still SSL_* for old ones

    97     final String name;

    98 

    99     // id in 16 bit MSB format, i.e. 0x0004 for SSL_RSA_WITH_RC4_128_MD5

   100     final int id;

   101 

   102     // priority for the internal default preference order. the higher the

   103     // better. Each supported CipherSuite *must* have a unique priority.

   104     // Ciphersuites with priority >= DEFAULT_SUITES_PRIORITY are enabled

   105     // by default

   106     final int priority;

   107 

   108     // key exchange, bulk cipher, mac and prf algorithms. See those

   109     // classes below.

   110     final KeyExchange keyExchange;

   111     final BulkCipher cipher;

   112     final MacAlg macAlg;

   113     final PRF prfAlg;

   114 

   115     // whether a CipherSuite qualifies as exportable under 512/40 bit rules.

   116     // TLS 1.1+ (RFC 4346) must not negotiate to these suites.

   117     final boolean exportable;

   118 

   119     // true iff implemented and enabled at compile time

   120     final boolean allowed;

   121 

   122     // obsoleted since protocol version

   123     final int obsoleted;

   124 

   125     // supported since protocol version

   126     final int supported;

   127 

   128     /**

   129      * Constructor for implemented CipherSuites.

   130      */

   131     private CipherSuite(String name, int id, int priority,

   132             KeyExchange keyExchange, BulkCipher cipher,

   133             boolean allowed, int obsoleted, int supported, PRF prfAlg) {

   134         this.name = name;

   135         this.id = id;

   136         this.priority = priority;

   137         this.keyExchange = keyExchange;

   138         this.cipher = cipher;

   139         this.exportable = cipher.exportable;

   140         if (cipher.cipherType == CipherType.AEAD_CIPHER) {

   141             macAlg = M_NULL;

   142         } else if (name.endsWith("_MD5")) {

   143             macAlg = M_MD5;

   144         } else if (name.endsWith("_SHA")) {

   145             macAlg = M_SHA;

   146         } else if (name.endsWith("_SHA256")) {

   147             macAlg = M_SHA256;

   148         } else if (name.endsWith("_SHA384")) {

   149             macAlg = M_SHA384;

   150         } else if (name.endsWith("_NULL")) {

   151             macAlg = M_NULL;

   152         } else if (name.endsWith("_SCSV")) {

   153             macAlg = M_NULL;

   154         } else {

   155             throw new IllegalArgumentException

   156                     ("Unknown MAC algorithm for ciphersuite " + name);

   157         }

   158 

   159         allowed &= keyExchange.allowed;

   160         allowed &= cipher.allowed;

   161         this.allowed = allowed;

   162         this.obsoleted = obsoleted;

   163         this.supported = supported;

   164         this.prfAlg = prfAlg;

   165     }

   166 

   167     /**

   168      * Constructor for unimplemented CipherSuites.

   169      */

   170     private CipherSuite(String name, int id) {

   171         this.name = name;

   172         this.id = id;

   173         this.allowed = false;

   174 

   175         this.priority = 0;

   176         this.keyExchange = null;

   177         this.cipher = null;

   178         this.macAlg = null;

   179         this.exportable = false;

   180         this.obsoleted = ProtocolVersion.LIMIT_MAX_VALUE;

   181         this.supported = ProtocolVersion.LIMIT_MIN_VALUE;

   182         this.prfAlg = P_NONE;

   183     }

   184 

   185     /**

   186      * Return whether this CipherSuite is available for use. A

   187      * CipherSuite may be unavailable even if it is supported

   188      * (i.e. allowed == true) if the required JCE cipher is not installed.

   189      * In some configuration, this situation may change over time, call

   190      * CipherSuiteList.clearAvailableCache() before this method to obtain

   191      * the most current status.

   192      */

   193     boolean isAvailable() {

   194         return allowed && keyExchange.isAvailable() && cipher.isAvailable();

   195     }

   196 

   197     boolean isNegotiable() {

   198         return this != C_SCSV && isAvailable();

   199     }

   200 

   201     /**

   202      * Compares CipherSuites based on their priority. Has the effect of

   203      * sorting CipherSuites when put in a sorted collection, which is

   204      * used by CipherSuiteList. Follows standard Comparable contract.

   205      *

   206      * Note that for unsupported CipherSuites parsed from a handshake

   207      * message we violate the equals() contract.

   208      */

   209     @Override

   210     public int compareTo(CipherSuite o) {

   211         return o.priority - priority;

   212     }

   213 

   214     /**

   215      * Returns this.name.

   216      */

   217     @Override

   218     public String toString() {

   219         return name;

   220     }

   221 

   222     /**

   223      * Return a CipherSuite for the given name. The returned CipherSuite

   224      * is supported by this implementation but may not actually be

   225      * currently useable. See isAvailable().

   226      *

   227      * @exception IllegalArgumentException if the CipherSuite is unknown or

   228      * unsupported.

   229      */

   230     static CipherSuite valueOf(String s) {

   231         if (s == null) {

   232             throw new IllegalArgumentException("Name must not be null");

   233         }

   234 

   235         CipherSuite c = nameMap.get(s);

   236         if ((c == null) || (c.allowed == false)) {

   237             throw new IllegalArgumentException("Unsupported ciphersuite " + s);

   238         }

   239 

   240         return c;

   241     }

   242 

   243     /**

   244      * Return a CipherSuite with the given ID. A temporary object is

   245      * constructed if the ID is unknown. Use isAvailable() to verify that

   246      * the CipherSuite can actually be used.

   247      */

   248     static CipherSuite valueOf(int id1, int id2) {

   249         id1 &= 0xff;

   250         id2 &= 0xff;

   251         int id = (id1 << 8) | id2;

   252         CipherSuite c = idMap.get(id);

   253         if (c == null) {

   254             String h1 = Integer.toString(id1, 16);

   255             String h2 = Integer.toString(id2, 16);

   256             c = new CipherSuite("Unknown 0x" + h1 + ":0x" + h2, id);

   257         }

   258         return c;

   259     }

   260 

   261     // for use by CipherSuiteList only

   262     static Collection<CipherSuite> allowedCipherSuites() {

   263         return nameMap.values();

   264     }

   265 

   266     /*

   267      * Use this method when all of the values need to be specified.

   268      * This is primarily used when defining a new ciphersuite for

   269      * TLS 1.2+ that doesn't use the "default" PRF.

   270      */

   271     private static void add(String name, int id, int priority,

   272             KeyExchange keyExchange, BulkCipher cipher,

   273             boolean allowed, int obsoleted, int supported, PRF prf) {

   274 

   275         CipherSuite c = new CipherSuite(name, id, priority, keyExchange,

   276             cipher, allowed, obsoleted, supported, prf);

   277         if (idMap.put(id, c) != null) {

   278             throw new RuntimeException("Duplicate ciphersuite definition: "

   279                                         + id + ", " + name);

   280         }

   281         if (c.allowed) {

   282             if (nameMap.put(name, c) != null) {

   283                 throw new RuntimeException("Duplicate ciphersuite definition: "

   284                                             + id + ", " + name);

   285             }

   286         }

   287     }

   288 

   289     /*

   290      * Use this method when there is no lower protocol limit where this

   291      * suite can be used, and the PRF is P_SHA256.  That is, the

   292      * existing ciphersuites.  From RFC 5246:

   293      *

   294      *     All cipher suites in this document use P_SHA256.

   295      */

   296     private static void add(String name, int id, int priority,

   297             KeyExchange keyExchange, BulkCipher cipher,

   298             boolean allowed, int obsoleted) {

   299         // If this is an obsoleted suite, then don't let the TLS 1.2

   300         // protocol have a valid PRF value.

   301         PRF prf = P_SHA256;

   302         if (obsoleted < ProtocolVersion.TLS12.v) {

   303             prf = P_NONE;

   304         }

   305 

   306         add(name, id, priority, keyExchange, cipher, allowed, obsoleted,

   307             ProtocolVersion.LIMIT_MIN_VALUE, prf);

   308     }

   309 

   310     /*

   311      * Use this method when there is no upper protocol limit.  That is,

   312      * suites which have not been obsoleted.

   313      */

   314     private static void add(String name, int id, int priority,

   315             KeyExchange keyExchange, BulkCipher cipher, boolean allowed) {

   316         add(name, id, priority, keyExchange,

   317             cipher, allowed, ProtocolVersion.LIMIT_MAX_VALUE);

   318     }

   319 

   320     /*

   321      * Use this method to define an unimplemented suite.  This provides

   322      * a number<->name mapping that can be used for debugging.

   323      */

   324     private static void add(String name, int id) {

   325         CipherSuite c = new CipherSuite(name, id);

   326         if (idMap.put(id, c) != null) {

   327             throw new RuntimeException("Duplicate ciphersuite definition: "

   328                                         + id + ", " + name);

   329         }

   330     }

   331 

   332     /**

   333      * An SSL/TLS key exchange algorithm.

   334      */

   335     static enum KeyExchange {

   336 

   337         // key exchange algorithms

   338         K_NULL       ("NULL",       false),

   339         K_RSA        ("RSA",        true),

   340         K_RSA_EXPORT ("RSA_EXPORT", true),

   341         K_DH_RSA     ("DH_RSA",     false),

   342         K_DH_DSS     ("DH_DSS",     false),

   343         K_DHE_DSS    ("DHE_DSS",    true),

   344         K_DHE_RSA    ("DHE_RSA",    true),

   345         K_DH_ANON    ("DH_anon",    true),

   346 

   347         K_ECDH_ECDSA ("ECDH_ECDSA",  ALLOW_ECC),

   348         K_ECDH_RSA   ("ECDH_RSA",    ALLOW_ECC),

   349         K_ECDHE_ECDSA("ECDHE_ECDSA", ALLOW_ECC),

   350         K_ECDHE_RSA  ("ECDHE_RSA",   ALLOW_ECC),

   351         K_ECDH_ANON  ("ECDH_anon",   ALLOW_ECC),

   352 

   353         // Kerberos cipher suites

   354         K_KRB5       ("KRB5", true),

   355         K_KRB5_EXPORT("KRB5_EXPORT", true),

   356 

   357         // renegotiation protection request signaling cipher suite

   358         K_SCSV       ("SCSV",        true);

   359 

   360         // name of the key exchange algorithm, e.g. DHE_DSS

   361         final String name;

   362         final boolean allowed;

   363         private final boolean alwaysAvailable;

   364 

   365         KeyExchange(String name, boolean allowed) {

   366             this.name = name;

   367             this.allowed = allowed;

   368             this.alwaysAvailable = allowed &&

   369                 (!name.startsWith("EC")) && (!name.startsWith("KRB"));

   370         }

   371 

   372         boolean isAvailable() {

   373             if (alwaysAvailable) {

   374                 return true;

   375             }

   376 

   377             if (name.startsWith("EC")) {

   378                 return (allowed && JsseJce.isEcAvailable());

   379             } else if (name.startsWith("KRB")) {

   380                 return (allowed && JsseJce.isKerberosAvailable());

   381             } else {

   382                 return allowed;

   383             }

   384         }

   385 

   386         @Override

   387         public String toString() {

   388             return name;

   389         }

   390     }

   391 

   392     static enum CipherType {

   393         STREAM_CIPHER,         // null or stream cipher

   394         BLOCK_CIPHER,          // block cipher in CBC mode

   395         AEAD_CIPHER            // AEAD cipher

   396     }

   397 

   398     /**

   399      * An SSL/TLS bulk cipher algorithm. One instance per combination of

   400      * cipher and key length.

   401      *

   402      * Also contains a factory method to obtain in initialized CipherBox

   403      * for this algorithm.

   404      */

   405     final static class BulkCipher {

   406 

   407         // Map BulkCipher -> Boolean(available)

   408         private final static Map<BulkCipher,Boolean> availableCache =

   409                                             new HashMap<>(8);

   410 

   411         // descriptive name including key size, e.g. AES/128

   412         final String description;

   413 

   414         // JCE cipher transformation string, e.g. AES/CBC/NoPadding

   415         final String transformation;

   416 

   417         // algorithm name, e.g. AES

   418         final String algorithm;

   419 

   420         // supported and compile time enabled. Also see isAvailable()

   421         final boolean allowed;

   422 

   423         // number of bytes of entropy in the key

   424         final int keySize;

   425 

   426         // length of the actual cipher key in bytes.

   427         // for non-exportable ciphers, this is the same as keySize

   428         final int expandedKeySize;

   429 

   430         // size of the IV

   431         final int ivSize;

   432 

   433         // size of fixed IV

   434         //

   435         // record_iv_length = ivSize - fixedIvSize

   436         final int fixedIvSize;

   437 

   438         // exportable under 512/40 bit rules

   439         final boolean exportable;

   440 

   441         // Is the cipher algorithm of Cipher Block Chaining (CBC) mode?

   442         final CipherType cipherType;

   443 

   444         // size of the authentication tag, only applicable to cipher suites in

   445         // Galois Counter Mode (GCM)

   446         //

   447         // As far as we know, all supported GCM cipher suites use 128-bits

   448         // authentication tags.

   449         final int tagSize = 16;

   450 

   451         // The secure random used to detect the cipher availability.

   452         private final static SecureRandom secureRandom;

   453 

   454         static {

   455             try {

   456                 secureRandom = JsseJce.getSecureRandom();

   457             } catch (KeyManagementException kme) {

   458                 throw new RuntimeException(kme);

   459             }

   460         }

   461 

   462         BulkCipher(String transformation, CipherType cipherType, int keySize,

   463                 int expandedKeySize, int ivSize,

   464                 int fixedIvSize, boolean allowed) {

   465 

   466             this.transformation = transformation;

   467             String[] splits = transformation.split("/");

   468             this.algorithm = splits[0];

   469             this.cipherType = cipherType;

   470             this.description = this.algorithm + "/" + (keySize << 3);

   471             this.keySize = keySize;

   472             this.ivSize = ivSize;

   473             this.fixedIvSize = fixedIvSize;

   474             this.allowed = allowed;

   475 

   476             this.expandedKeySize = expandedKeySize;

   477             this.exportable = true;

   478         }

   479 

   480         BulkCipher(String transformation, CipherType cipherType, int keySize,

   481                 int ivSize, int fixedIvSize, boolean allowed) {

   482             this.transformation = transformation;

   483             String[] splits = transformation.split("/");

   484             this.algorithm = splits[0];

   485             this.cipherType = cipherType;

   486             this.description = this.algorithm + "/" + (keySize << 3);

   487             this.keySize = keySize;

   488             this.ivSize = ivSize;

   489             this.fixedIvSize = fixedIvSize;

   490             this.allowed = allowed;

   491 

   492             this.expandedKeySize = keySize;

   493             this.exportable = false;

   494         }

   495 

   496         /**

   497          * Return an initialized CipherBox for this BulkCipher.

   498          * IV must be null for stream ciphers.

   499          *

   500          * @exception NoSuchAlgorithmException if anything goes wrong

   501          */

   502         CipherBox newCipher(ProtocolVersion version, SecretKey key,

   503                 IvParameterSpec iv, SecureRandom random,

   504                 boolean encrypt) throws NoSuchAlgorithmException {

   505             return CipherBox.newCipherBox(version, this,

   506                                             key, iv, random, encrypt);

   507         }

   508 

   509         /**

   510          * Test if this bulk cipher is available. For use by CipherSuite.

   511          *

   512          * Currently all supported ciphers except AES are always available

   513          * via the JSSE internal implementations. We also assume AES/128 of

   514          * CBC mode is always available since it is shipped with the SunJCE

   515          * provider.  However, AES/256 is unavailable when the default JCE

   516          * policy jurisdiction files are installed because of key length

   517          * restrictions, and AEAD is unavailable when the underlying providers

   518          * do not support AEAD/GCM mode.

   519          */

   520         boolean isAvailable() {

   521             if (allowed == false) {

   522                 return false;

   523             }

   524 

   525             if ((this == B_AES_256) ||

   526                     (this.cipherType == CipherType.AEAD_CIPHER)) {

   527                 return isAvailable(this);

   528             }

   529 

   530             // always available

   531             return true;

   532         }

   533 

   534         // for use by CipherSuiteList.clearAvailableCache();

   535         static synchronized void clearAvailableCache() {

   536             if (DYNAMIC_AVAILABILITY) {

   537                 availableCache.clear();

   538             }

   539         }

   540 

   541         private static synchronized boolean isAvailable(BulkCipher cipher) {

   542             Boolean b = availableCache.get(cipher);

   543             if (b == null) {

   544                 int keySizeInBits = cipher.keySize * 8;

   545                 if (keySizeInBits > 128) {    // need the JCE unlimited

   546                                                // strength jurisdiction policy

   547                     try {

   548                         if (Cipher.getMaxAllowedKeyLength(

   549                                 cipher.transformation) < keySizeInBits) {

   550                             b = Boolean.FALSE;

   551                         }

   552                     } catch (Exception e) {

   553                         b = Boolean.FALSE;

   554                     }

   555                 }

   556 

   557                 if (b == null) {

   558                     b = Boolean.FALSE;          // may be reset to TRUE if

   559                                                 // the cipher is available

   560                     CipherBox temporary = null;

   561                     try {

   562                         SecretKey key = new SecretKeySpec(

   563                                             new byte[cipher.expandedKeySize],

   564                                             cipher.algorithm);

   565                         IvParameterSpec iv;

   566                         if (cipher.cipherType == CipherType.AEAD_CIPHER) {

   567                             iv = new IvParameterSpec(

   568                                             new byte[cipher.fixedIvSize]);

   569                         } else {

   570                             iv = new IvParameterSpec(new byte[cipher.ivSize]);

   571                         }

   572                         temporary = cipher.newCipher(

   573                                             ProtocolVersion.DEFAULT,

   574                                             key, iv, secureRandom, true);

   575                         b = temporary.isAvailable();

   576                     } catch (NoSuchAlgorithmException e) {

   577                         // not available

   578                     } finally {

   579                         if (temporary != null) {

   580                             temporary.dispose();

   581                         }

   582                     }

   583                 }

   584 

   585                 availableCache.put(cipher, b);

   586             }

   587 

   588             return b.booleanValue();

   589         }

   590 

   591         @Override

   592         public String toString() {

   593             return description;

   594         }

   595     }

   596 

   597     /**

   598      * An SSL/TLS key MAC algorithm.

   599      *

   600      * Also contains a factory method to obtain an initialized MAC

   601      * for this algorithm.

   602      */

   603     final static class MacAlg {

   604 

   605         // descriptive name, e.g. MD5

   606         final String name;

   607 

   608         // size of the MAC value (and MAC key) in bytes

   609         final int size;

   610 

   611         // block size of the underlying hash algorithm

   612         final int hashBlockSize;

   613 

   614         // minimal padding size of the underlying hash algorithm

   615         final int minimalPaddingSize;

   616 

   617         MacAlg(String name, int size,

   618                 int hashBlockSize, int minimalPaddingSize) {

   619             this.name = name;

   620             this.size = size;

   621             this.hashBlockSize = hashBlockSize;

   622             this.minimalPaddingSize = minimalPaddingSize;

   623         }

   624 

   625         /**

   626          * Return an initialized MAC for this MacAlg. ProtocolVersion

   627          * must either be SSL30 (SSLv3 custom MAC) or TLS10 (std. HMAC).

   628          *

   629          * @exception NoSuchAlgorithmException if anything goes wrong

   630          */

   631         MAC newMac(ProtocolVersion protocolVersion, SecretKey secret)

   632                 throws NoSuchAlgorithmException, InvalidKeyException {

   633             return new MAC(this, protocolVersion, secret);

   634         }

   635 

   636         @Override

   637         public String toString() {

   638             return name;

   639         }

   640     }

   641 

   642     // export strength ciphers

   643     final static BulkCipher B_NULL    =

   644         new BulkCipher("NULL",          STREAM_CIPHER,    0,  0,  0, 0, true);

   645     final static BulkCipher B_RC4_40  =

   646         new BulkCipher(CIPHER_RC4,      STREAM_CIPHER,    5, 16,  0, 0, true);

   647     final static BulkCipher B_RC2_40  =

   648         new BulkCipher("RC2",           BLOCK_CIPHER,     5, 16,  8, 0, false);

   649     final static BulkCipher B_DES_40  =

   650         new BulkCipher(CIPHER_DES,      BLOCK_CIPHER,     5,  8,  8, 0, true);

   651 

   652     // domestic strength ciphers

   653     final static BulkCipher B_RC4_128 =

   654         new BulkCipher(CIPHER_RC4,      STREAM_CIPHER,   16,  0,  0, true);

   655     final static BulkCipher B_DES     =

   656         new BulkCipher(CIPHER_DES,      BLOCK_CIPHER,     8,  8,  0, true);

   657     final static BulkCipher B_3DES    =

   658         new BulkCipher(CIPHER_3DES,     BLOCK_CIPHER,    24,  8,  0, true);

   659     final static BulkCipher B_IDEA    =

   660         new BulkCipher("IDEA",          BLOCK_CIPHER,    16,  8,  0, false);

   661     final static BulkCipher B_AES_128 =

   662         new BulkCipher(CIPHER_AES,      BLOCK_CIPHER,    16, 16,  0, true);

   663     final static BulkCipher B_AES_256 =

   664         new BulkCipher(CIPHER_AES,      BLOCK_CIPHER,    32, 16,  0, true);

   665     final static BulkCipher B_AES_128_GCM =

   666         new BulkCipher(CIPHER_AES_GCM,  AEAD_CIPHER,     16, 12,  4, true);

   667     final static BulkCipher B_AES_256_GCM =

   668         new BulkCipher(CIPHER_AES_GCM,  AEAD_CIPHER,     32, 12,  4, true);

   669 

   670     // MACs

   671     final static MacAlg M_NULL    = new MacAlg("NULL",     0,   0,   0);

   672     final static MacAlg M_MD5     = new MacAlg("MD5",     16,  64,   9);

   673     final static MacAlg M_SHA     = new MacAlg("SHA",     20,  64,   9);

   674     final static MacAlg M_SHA256  = new MacAlg("SHA256",  32,  64,   9);

   675     final static MacAlg M_SHA384  = new MacAlg("SHA384",  48, 128,  17);

   676 

   677     /**

   678      * PRFs (PseudoRandom Function) from TLS specifications.

   679      *

   680      * TLS 1.1- uses a single MD5/SHA1-based PRF algorithm for generating

   681      * the necessary material.

   682      *

   683      * In TLS 1.2+, all existing/known CipherSuites use SHA256, however

   684      * new Ciphersuites (e.g. RFC 5288) can define specific PRF hash

   685      * algorithms.

   686      */

   687     static enum PRF {

   688 

   689         // PRF algorithms

   690         P_NONE(     "NONE",  0,   0),

   691         P_SHA256("SHA-256", 32,  64),

   692         P_SHA384("SHA-384", 48, 128),

   693         P_SHA512("SHA-512", 64, 128);  // not currently used.

   694 

   695         // PRF characteristics

   696         private final String prfHashAlg;

   697         private final int prfHashLength;

   698         private final int prfBlockSize;

   699 

   700         PRF(String prfHashAlg, int prfHashLength, int prfBlockSize) {

   701             this.prfHashAlg = prfHashAlg;

   702             this.prfHashLength = prfHashLength;

   703             this.prfBlockSize = prfBlockSize;

   704         }

   705 

   706         String getPRFHashAlg() {

   707             return prfHashAlg;

   708         }

   709 

   710         int getPRFHashLength() {

   711             return prfHashLength;

   712         }

   713 

   714         int getPRFBlockSize() {

   715             return prfBlockSize;

   716         }

   717     }

   718 

   719     static {

   720         idMap = new HashMap<Integer,CipherSuite>();

   721         nameMap = new HashMap<String,CipherSuite>();

   722 

   723         final boolean F = false;

   724         final boolean T = true;

   725         // N: ciphersuites only allowed if we are not in FIPS mode

   726         final boolean N = (SunJSSE.isFIPS() == false);

   727 

   728         /*

   729          * TLS Cipher Suite Registry, as of August 2010.

   730          *

   731          * http://www.iana.org/assignments/tls-parameters/tls-parameters.xml

   732          *

   733          * Range      Registration Procedures   Notes

   734          * 000-191    Standards Action          Refers to value of first byte

   735          * 192-254    Specification Required    Refers to value of first byte

   736          * 255        Reserved for Private Use  Refers to value of first byte

   737          *

   738          * Value      Description                               Reference

   739          * 0x00,0x00  TLS_NULL_WITH_NULL_NULL                   [RFC5246]

   740          * 0x00,0x01  TLS_RSA_WITH_NULL_MD5                     [RFC5246]

   741          * 0x00,0x02  TLS_RSA_WITH_NULL_SHA                     [RFC5246]

   742          * 0x00,0x03  TLS_RSA_EXPORT_WITH_RC4_40_MD5            [RFC4346]

   743          * 0x00,0x04  TLS_RSA_WITH_RC4_128_MD5                  [RFC5246]

   744          * 0x00,0x05  TLS_RSA_WITH_RC4_128_SHA                  [RFC5246]

   745          * 0x00,0x06  TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5        [RFC4346]

   746          * 0x00,0x07  TLS_RSA_WITH_IDEA_CBC_SHA                 [RFC5469]

   747          * 0x00,0x08  TLS_RSA_EXPORT_WITH_DES40_CBC_SHA         [RFC4346]

   748          * 0x00,0x09  TLS_RSA_WITH_DES_CBC_SHA                  [RFC5469]

   749          * 0x00,0x0A  TLS_RSA_WITH_3DES_EDE_CBC_SHA             [RFC5246]

   750          * 0x00,0x0B  TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA      [RFC4346]

   751          * 0x00,0x0C  TLS_DH_DSS_WITH_DES_CBC_SHA               [RFC5469]

   752          * 0x00,0x0D  TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA          [RFC5246]

   753          * 0x00,0x0E  TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA      [RFC4346]

   754          * 0x00,0x0F  TLS_DH_RSA_WITH_DES_CBC_SHA               [RFC5469]

   755          * 0x00,0x10  TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA          [RFC5246]

   756          * 0x00,0x11  TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA     [RFC4346]

   757          * 0x00,0x12  TLS_DHE_DSS_WITH_DES_CBC_SHA              [RFC5469]

   758          * 0x00,0x13  TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA         [RFC5246]

   759          * 0x00,0x14  TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA     [RFC4346]

   760          * 0x00,0x15  TLS_DHE_RSA_WITH_DES_CBC_SHA              [RFC5469]

   761          * 0x00,0x16  TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA         [RFC5246]

   762          * 0x00,0x17  TLS_DH_anon_EXPORT_WITH_RC4_40_MD5        [RFC4346]

   763          * 0x00,0x18  TLS_DH_anon_WITH_RC4_128_MD5              [RFC5246]

   764          * 0x00,0x19  TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA     [RFC4346]

   765          * 0x00,0x1A  TLS_DH_anon_WITH_DES_CBC_SHA              [RFC5469]

   766          * 0x00,0x1B  TLS_DH_anon_WITH_3DES_EDE_CBC_SHA         [RFC5246]

   767          * 0x00,0x1C-1D Reserved to avoid conflicts with SSLv3  [RFC5246]

   768          * 0x00,0x1E  TLS_KRB5_WITH_DES_CBC_SHA                 [RFC2712]

   769          * 0x00,0x1F  TLS_KRB5_WITH_3DES_EDE_CBC_SHA            [RFC2712]

   770          * 0x00,0x20  TLS_KRB5_WITH_RC4_128_SHA                 [RFC2712]

   771          * 0x00,0x21  TLS_KRB5_WITH_IDEA_CBC_SHA                [RFC2712]

   772          * 0x00,0x22  TLS_KRB5_WITH_DES_CBC_MD5                 [RFC2712]

   773          * 0x00,0x23  TLS_KRB5_WITH_3DES_EDE_CBC_MD5            [RFC2712]

   774          * 0x00,0x24  TLS_KRB5_WITH_RC4_128_MD5                 [RFC2712]

   775          * 0x00,0x25  TLS_KRB5_WITH_IDEA_CBC_MD5                [RFC2712]

   776          * 0x00,0x26  TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA       [RFC2712]

   777          * 0x00,0x27  TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA       [RFC2712]

   778          * 0x00,0x28  TLS_KRB5_EXPORT_WITH_RC4_40_SHA           [RFC2712]

   779          * 0x00,0x29  TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5       [RFC2712]

   780          * 0x00,0x2A  TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5       [RFC2712]

   781          * 0x00,0x2B  TLS_KRB5_EXPORT_WITH_RC4_40_MD5           [RFC2712]

   782          * 0x00,0x2C  TLS_PSK_WITH_NULL_SHA                     [RFC4785]

   783          * 0x00,0x2D  TLS_DHE_PSK_WITH_NULL_SHA                 [RFC4785]

   784          * 0x00,0x2E  TLS_RSA_PSK_WITH_NULL_SHA                 [RFC4785]

   785          * 0x00,0x2F  TLS_RSA_WITH_AES_128_CBC_SHA              [RFC5246]

   786          * 0x00,0x30  TLS_DH_DSS_WITH_AES_128_CBC_SHA           [RFC5246]

   787          * 0x00,0x31  TLS_DH_RSA_WITH_AES_128_CBC_SHA           [RFC5246]

   788          * 0x00,0x32  TLS_DHE_DSS_WITH_AES_128_CBC_SHA          [RFC5246]

   789          * 0x00,0x33  TLS_DHE_RSA_WITH_AES_128_CBC_SHA          [RFC5246]

   790          * 0x00,0x34  TLS_DH_anon_WITH_AES_128_CBC_SHA          [RFC5246]

   791          * 0x00,0x35  TLS_RSA_WITH_AES_256_CBC_SHA              [RFC5246]

   792          * 0x00,0x36  TLS_DH_DSS_WITH_AES_256_CBC_SHA           [RFC5246]

   793          * 0x00,0x37  TLS_DH_RSA_WITH_AES_256_CBC_SHA           [RFC5246]

   794          * 0x00,0x38  TLS_DHE_DSS_WITH_AES_256_CBC_SHA          [RFC5246]

   795          * 0x00,0x39  TLS_DHE_RSA_WITH_AES_256_CBC_SHA          [RFC5246]

   796          * 0x00,0x3A  TLS_DH_anon_WITH_AES_256_CBC_SHA          [RFC5246]

   797          * 0x00,0x3B  TLS_RSA_WITH_NULL_SHA256                  [RFC5246]

   798          * 0x00,0x3C  TLS_RSA_WITH_AES_128_CBC_SHA256           [RFC5246]

   799          * 0x00,0x3D  TLS_RSA_WITH_AES_256_CBC_SHA256           [RFC5246]

   800          * 0x00,0x3E  TLS_DH_DSS_WITH_AES_128_CBC_SHA256        [RFC5246]

   801          * 0x00,0x3F  TLS_DH_RSA_WITH_AES_128_CBC_SHA256        [RFC5246]

   802          * 0x00,0x40  TLS_DHE_DSS_WITH_AES_128_CBC_SHA256       [RFC5246]

   803          * 0x00,0x41  TLS_RSA_WITH_CAMELLIA_128_CBC_SHA         [RFC5932]

   804          * 0x00,0x42  TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA      [RFC5932]

   805          * 0x00,0x43  TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA      [RFC5932]

   806          * 0x00,0x44  TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA     [RFC5932]

   807          * 0x00,0x45  TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA     [RFC5932]

   808          * 0x00,0x46  TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA     [RFC5932]

   809          * 0x00,0x47-4F Reserved to avoid conflicts with

   810          *            deployed implementations                  [Pasi_Eronen]

   811          * 0x00,0x50-58 Reserved to avoid conflicts             [Pasi Eronen]

   812          * 0x00,0x59-5C Reserved to avoid conflicts with

   813          *            deployed implementations                  [Pasi_Eronen]

   814          * 0x00,0x5D-5F Unassigned

   815          * 0x00,0x60-66 Reserved to avoid conflicts with widely

   816          *            deployed implementations                  [Pasi_Eronen]

   817          * 0x00,0x67  TLS_DHE_RSA_WITH_AES_128_CBC_SHA256       [RFC5246]

   818          * 0x00,0x68  TLS_DH_DSS_WITH_AES_256_CBC_SHA256        [RFC5246]

   819          * 0x00,0x69  TLS_DH_RSA_WITH_AES_256_CBC_SHA256        [RFC5246]

   820          * 0x00,0x6A  TLS_DHE_DSS_WITH_AES_256_CBC_SHA256       [RFC5246]

   821          * 0x00,0x6B  TLS_DHE_RSA_WITH_AES_256_CBC_SHA256       [RFC5246]

   822          * 0x00,0x6C  TLS_DH_anon_WITH_AES_128_CBC_SHA256       [RFC5246]

   823          * 0x00,0x6D  TLS_DH_anon_WITH_AES_256_CBC_SHA256       [RFC5246]

   824          * 0x00,0x6E-83 Unassigned

   825          * 0x00,0x84  TLS_RSA_WITH_CAMELLIA_256_CBC_SHA         [RFC5932]

   826          * 0x00,0x85  TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA      [RFC5932]

   827          * 0x00,0x86  TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA      [RFC5932]

   828          * 0x00,0x87  TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA     [RFC5932]

   829          * 0x00,0x88  TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA     [RFC5932]

   830          * 0x00,0x89  TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA     [RFC5932]

   831          * 0x00,0x8A  TLS_PSK_WITH_RC4_128_SHA                  [RFC4279]

   832          * 0x00,0x8B  TLS_PSK_WITH_3DES_EDE_CBC_SHA             [RFC4279]

   833          * 0x00,0x8C  TLS_PSK_WITH_AES_128_CBC_SHA              [RFC4279]

   834          * 0x00,0x8D  TLS_PSK_WITH_AES_256_CBC_SHA              [RFC4279]

   835          * 0x00,0x8E  TLS_DHE_PSK_WITH_RC4_128_SHA              [RFC4279]

   836          * 0x00,0x8F  TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA         [RFC4279]

   837          * 0x00,0x90  TLS_DHE_PSK_WITH_AES_128_CBC_SHA          [RFC4279]

   838          * 0x00,0x91  TLS_DHE_PSK_WITH_AES_256_CBC_SHA          [RFC4279]

   839          * 0x00,0x92  TLS_RSA_PSK_WITH_RC4_128_SHA              [RFC4279]

   840          * 0x00,0x93  TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA         [RFC4279]

   841          * 0x00,0x94  TLS_RSA_PSK_WITH_AES_128_CBC_SHA          [RFC4279]

   842          * 0x00,0x95  TLS_RSA_PSK_WITH_AES_256_CBC_SHA          [RFC4279]

   843          * 0x00,0x96  TLS_RSA_WITH_SEED_CBC_SHA                 [RFC4162]

   844          * 0x00,0x97  TLS_DH_DSS_WITH_SEED_CBC_SHA              [RFC4162]

   845          * 0x00,0x98  TLS_DH_RSA_WITH_SEED_CBC_SHA              [RFC4162]

   846          * 0x00,0x99  TLS_DHE_DSS_WITH_SEED_CBC_SHA             [RFC4162]

   847          * 0x00,0x9A  TLS_DHE_RSA_WITH_SEED_CBC_SHA             [RFC4162]

   848          * 0x00,0x9B  TLS_DH_anon_WITH_SEED_CBC_SHA             [RFC4162]

   849          * 0x00,0x9C  TLS_RSA_WITH_AES_128_GCM_SHA256           [RFC5288]

   850          * 0x00,0x9D  TLS_RSA_WITH_AES_256_GCM_SHA384           [RFC5288]

   851          * 0x00,0x9E  TLS_DHE_RSA_WITH_AES_128_GCM_SHA256       [RFC5288]

   852          * 0x00,0x9F  TLS_DHE_RSA_WITH_AES_256_GCM_SHA384       [RFC5288]

   853          * 0x00,0xA0  TLS_DH_RSA_WITH_AES_128_GCM_SHA256        [RFC5288]

   854          * 0x00,0xA1  TLS_DH_RSA_WITH_AES_256_GCM_SHA384        [RFC5288]

   855          * 0x00,0xA2  TLS_DHE_DSS_WITH_AES_128_GCM_SHA256       [RFC5288]

   856          * 0x00,0xA3  TLS_DHE_DSS_WITH_AES_256_GCM_SHA384       [RFC5288]

   857          * 0x00,0xA4  TLS_DH_DSS_WITH_AES_128_GCM_SHA256        [RFC5288]

   858          * 0x00,0xA5  TLS_DH_DSS_WITH_AES_256_GCM_SHA384        [RFC5288]

   859          * 0x00,0xA6  TLS_DH_anon_WITH_AES_128_GCM_SHA256       [RFC5288]

   860          * 0x00,0xA7  TLS_DH_anon_WITH_AES_256_GCM_SHA384       [RFC5288]

   861          * 0x00,0xA8  TLS_PSK_WITH_AES_128_GCM_SHA256           [RFC5487]

   862          * 0x00,0xA9  TLS_PSK_WITH_AES_256_GCM_SHA384           [RFC5487]

   863          * 0x00,0xAA  TLS_DHE_PSK_WITH_AES_128_GCM_SHA256       [RFC5487]

   864          * 0x00,0xAB  TLS_DHE_PSK_WITH_AES_256_GCM_SHA384       [RFC5487]

   865          * 0x00,0xAC  TLS_RSA_PSK_WITH_AES_128_GCM_SHA256       [RFC5487]

   866          * 0x00,0xAD  TLS_RSA_PSK_WITH_AES_256_GCM_SHA384       [RFC5487]

   867          * 0x00,0xAE  TLS_PSK_WITH_AES_128_CBC_SHA256           [RFC5487]

   868          * 0x00,0xAF  TLS_PSK_WITH_AES_256_CBC_SHA384           [RFC5487]

   869          * 0x00,0xB0  TLS_PSK_WITH_NULL_SHA256                  [RFC5487]

   870          * 0x00,0xB1  TLS_PSK_WITH_NULL_SHA384                  [RFC5487]

   871          * 0x00,0xB2  TLS_DHE_PSK_WITH_AES_128_CBC_SHA256       [RFC5487]

   872          * 0x00,0xB3  TLS_DHE_PSK_WITH_AES_256_CBC_SHA384       [RFC5487]

   873          * 0x00,0xB4  TLS_DHE_PSK_WITH_NULL_SHA256              [RFC5487]

   874          * 0x00,0xB5  TLS_DHE_PSK_WITH_NULL_SHA384              [RFC5487]

   875          * 0x00,0xB6  TLS_RSA_PSK_WITH_AES_128_CBC_SHA256       [RFC5487]

   876          * 0x00,0xB7  TLS_RSA_PSK_WITH_AES_256_CBC_SHA384       [RFC5487]

   877          * 0x00,0xB8  TLS_RSA_PSK_WITH_NULL_SHA256              [RFC5487]

   878          * 0x00,0xB9  TLS_RSA_PSK_WITH_NULL_SHA384              [RFC5487]

   879          * 0x00,0xBA  TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256      [RFC5932]

   880          * 0x00,0xBB  TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256   [RFC5932]

   881          * 0x00,0xBC  TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256   [RFC5932]

   882          * 0x00,0xBD  TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256  [RFC5932]

   883          * 0x00,0xBE  TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256  [RFC5932]

   884          * 0x00,0xBF  TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256  [RFC5932]

   885          * 0x00,0xC0  TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256      [RFC5932]

   886          * 0x00,0xC1  TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256   [RFC5932]

   887          * 0x00,0xC2  TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256   [RFC5932]

   888          * 0x00,0xC3  TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256  [RFC5932]

   889          * 0x00,0xC4  TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256  [RFC5932]

   890          * 0x00,0xC5  TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256  [RFC5932]

   891          * 0x00,0xC6-FE         Unassigned

   892          * 0x00,0xFF  TLS_EMPTY_RENEGOTIATION_INFO_SCSV         [RFC5746]

   893          * 0x01-BF,*  Unassigned

   894          * 0xC0,0x01  TLS_ECDH_ECDSA_WITH_NULL_SHA              [RFC4492]

   895          * 0xC0,0x02  TLS_ECDH_ECDSA_WITH_RC4_128_SHA           [RFC4492]

   896          * 0xC0,0x03  TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA      [RFC4492]

   897          * 0xC0,0x04  TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA       [RFC4492]

   898          * 0xC0,0x05  TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA       [RFC4492]

   899          * 0xC0,0x06  TLS_ECDHE_ECDSA_WITH_NULL_SHA             [RFC4492]

   900          * 0xC0,0x07  TLS_ECDHE_ECDSA_WITH_RC4_128_SHA          [RFC4492]

   901          * 0xC0,0x08  TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA     [RFC4492]

   902          * 0xC0,0x09  TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA      [RFC4492]

   903          * 0xC0,0x0A  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA      [RFC4492]

   904          * 0xC0,0x0B  TLS_ECDH_RSA_WITH_NULL_SHA                [RFC4492]

   905          * 0xC0,0x0C  TLS_ECDH_RSA_WITH_RC4_128_SHA             [RFC4492]

   906          * 0xC0,0x0D  TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA        [RFC4492]

   907          * 0xC0,0x0E  TLS_ECDH_RSA_WITH_AES_128_CBC_SHA         [RFC4492]

   908          * 0xC0,0x0F  TLS_ECDH_RSA_WITH_AES_256_CBC_SHA         [RFC4492]

   909          * 0xC0,0x10  TLS_ECDHE_RSA_WITH_NULL_SHA               [RFC4492]

   910          * 0xC0,0x11  TLS_ECDHE_RSA_WITH_RC4_128_SHA            [RFC4492]

   911          * 0xC0,0x12  TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA       [RFC4492]

   912          * 0xC0,0x13  TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA        [RFC4492]

   913          * 0xC0,0x14  TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA        [RFC4492]

   914          * 0xC0,0x15  TLS_ECDH_anon_WITH_NULL_SHA               [RFC4492]

   915          * 0xC0,0x16  TLS_ECDH_anon_WITH_RC4_128_SHA            [RFC4492]

   916          * 0xC0,0x17  TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA       [RFC4492]

   917          * 0xC0,0x18  TLS_ECDH_anon_WITH_AES_128_CBC_SHA        [RFC4492]

   918          * 0xC0,0x19  TLS_ECDH_anon_WITH_AES_256_CBC_SHA        [RFC4492]

   919          * 0xC0,0x1A  TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA         [RFC5054]

   920          * 0xC0,0x1B  TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA     [RFC5054]

   921          * 0xC0,0x1C  TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA     [RFC5054]

   922          * 0xC0,0x1D  TLS_SRP_SHA_WITH_AES_128_CBC_SHA          [RFC5054]

   923          * 0xC0,0x1E  TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA      [RFC5054]

   924          * 0xC0,0x1F  TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA      [RFC5054]

   925          * 0xC0,0x20  TLS_SRP_SHA_WITH_AES_256_CBC_SHA          [RFC5054]

   926          * 0xC0,0x21  TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA      [RFC5054]

   927          * 0xC0,0x22  TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA      [RFC5054]

   928          * 0xC0,0x23  TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256   [RFC5289]

   929          * 0xC0,0x24  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384   [RFC5289]

   930          * 0xC0,0x25  TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256    [RFC5289]

   931          * 0xC0,0x26  TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384    [RFC5289]

   932          * 0xC0,0x27  TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256     [RFC5289]

   933          * 0xC0,0x28  TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384     [RFC5289]

   934          * 0xC0,0x29  TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256      [RFC5289]

   935          * 0xC0,0x2A  TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384      [RFC5289]

   936          * 0xC0,0x2B  TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256   [RFC5289]

   937          * 0xC0,0x2C  TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384   [RFC5289]

   938          * 0xC0,0x2D  TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256    [RFC5289]

   939          * 0xC0,0x2E  TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384    [RFC5289]

   940          * 0xC0,0x2F  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256     [RFC5289]

   941          * 0xC0,0x30  TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384     [RFC5289]

   942          * 0xC0,0x31  TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256      [RFC5289]

   943          * 0xC0,0x32  TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384      [RFC5289]

   944          * 0xC0,0x33  TLS_ECDHE_PSK_WITH_RC4_128_SHA            [RFC5489]

   945          * 0xC0,0x34  TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA       [RFC5489]

   946          * 0xC0,0x35  TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA        [RFC5489]

   947          * 0xC0,0x36  TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA        [RFC5489]

   948          * 0xC0,0x37  TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256     [RFC5489]

   949          * 0xC0,0x38  TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384     [RFC5489]

   950          * 0xC0,0x39  TLS_ECDHE_PSK_WITH_NULL_SHA               [RFC5489]

   951          * 0xC0,0x3A  TLS_ECDHE_PSK_WITH_NULL_SHA256            [RFC5489]

   952          * 0xC0,0x3B  TLS_ECDHE_PSK_WITH_NULL_SHA384            [RFC5489]

   953          * 0xC0,0x3C-FF Unassigned

   954          * 0xC1-FD,*  Unassigned

   955          * 0xFE,0x00-FD Unassigned

   956          * 0xFE,0xFE-FF Reserved to avoid conflicts with widely

   957          *            deployed implementations                  [Pasi_Eronen]

   958          * 0xFF,0x00-FF Reserved for Private Use                [RFC5246]

   959          */

   960 

   961         add("SSL_NULL_WITH_NULL_NULL",

   962                               0x0000,   1, K_NULL,       B_NULL,    F);

   963 

   964         /*

   965          * Definition of the CipherSuites that are enabled by default.

   966          * They are listed in preference order, most preferred first, using

   967          * the following criteria:

   968          * 1. Prefer Suite B compliant cipher suites, see RFC6460 (To be

   969          *    changed later, see below).

   970          * 2. Prefer the stronger bulk cipher, in the order of AES_256(GCM),

   971          *    AES_128(GCM), AES_256, AES_128, RC-4, 3DES-EDE.

   972          * 3. Prefer the stronger MAC algorithm, in the order of SHA384,

   973          *    SHA256, SHA, MD5.

   974          * 4. Prefer the better performance of key exchange and digital

   975          *    signature algorithm, in the order of ECDHE-ECDSA, ECDHE-RSA,

   976          *    RSA, ECDH-ECDSA, ECDH-RSA, DHE-RSA, DHE-DSS.

   977          */

   978         int p = DEFAULT_SUITES_PRIORITY * 2;

   979 

   980         // shorten names to fit the following table cleanly.

   981         int max = ProtocolVersion.LIMIT_MAX_VALUE;

   982         int tls11 = ProtocolVersion.TLS11.v;

   983         int tls12 = ProtocolVersion.TLS12.v;

   984 

   985         //  ID           Key Exchange   Cipher     A  obs  suprt  PRF

   986         //  ======       ============   =========  =  ===  =====  ========

   987 

   988         // Suite B compliant cipher suites, see RFC 6460.

   989         //

   990         // Note that, at present this provider is not Suite B compliant. The

   991         // preference order of the GCM cipher suites does not follow the spec

   992         // of RFC 6460.  In this section, only two cipher suites are listed

   993         // so that applications can make use of Suite-B compliant cipher

   994         // suite firstly.

   995         add("TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",

   996             0xc02c, --p, K_ECDHE_ECDSA, B_AES_256_GCM, T, max, tls12, P_SHA384);

   997         add("TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",

   998             0xc02b, --p, K_ECDHE_ECDSA, B_AES_128_GCM, T, max, tls12, P_SHA256);

   999 

  1000         // AES_256(GCM)

  1001         add("TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",

  1002             0xc030, --p, K_ECDHE_RSA,   B_AES_256_GCM, T, max, tls12, P_SHA384);

  1003         add("TLS_RSA_WITH_AES_256_GCM_SHA384",

  1004             0x009d, --p, K_RSA,         B_AES_256_GCM, T, max, tls12, P_SHA384);

  1005         add("TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384",

  1006             0xc02e, --p, K_ECDH_ECDSA,  B_AES_256_GCM, T, max, tls12, P_SHA384);

  1007         add("TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384",

  1008             0xc032, --p, K_ECDH_RSA,    B_AES_256_GCM, T, max, tls12, P_SHA384);

  1009         add("TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",

  1010             0x009f, --p, K_DHE_RSA,     B_AES_256_GCM, T, max, tls12, P_SHA384);

  1011         add("TLS_DHE_DSS_WITH_AES_256_GCM_SHA384",

  1012             0x00a3, --p, K_DHE_DSS,     B_AES_256_GCM, T, max, tls12, P_SHA384);

  1013 

  1014         // AES_128(GCM)

  1015         add("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",

  1016             0xc02f, --p, K_ECDHE_RSA,   B_AES_128_GCM, T, max, tls12, P_SHA256);

  1017         add("TLS_RSA_WITH_AES_128_GCM_SHA256",

  1018             0x009c, --p, K_RSA,         B_AES_128_GCM, T, max, tls12, P_SHA256);

  1019         add("TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256",

  1020             0xc02d, --p, K_ECDH_ECDSA,  B_AES_128_GCM, T, max, tls12, P_SHA256);

  1021         add("TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256",

  1022             0xc031, --p, K_ECDH_RSA,    B_AES_128_GCM, T, max, tls12, P_SHA256);

  1023         add("TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",

  1024             0x009e, --p, K_DHE_RSA,     B_AES_128_GCM, T, max, tls12, P_SHA256);

  1025         add("TLS_DHE_DSS_WITH_AES_128_GCM_SHA256",

  1026             0x00a2, --p, K_DHE_DSS,     B_AES_128_GCM, T, max, tls12, P_SHA256);

  1027 

  1028         // AES_256(CBC)

  1029         add("TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",

  1030             0xc024, --p, K_ECDHE_ECDSA, B_AES_256, T, max, tls12, P_SHA384);

  1031         add("TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",

  1032             0xc028, --p, K_ECDHE_RSA,   B_AES_256, T, max, tls12, P_SHA384);

  1033         add("TLS_RSA_WITH_AES_256_CBC_SHA256",

  1034             0x003d, --p, K_RSA,         B_AES_256, T, max, tls12, P_SHA256);

  1035         add("TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384",

  1036             0xc026, --p, K_ECDH_ECDSA,  B_AES_256, T, max, tls12, P_SHA384);

  1037         add("TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384",

  1038             0xc02a, --p, K_ECDH_RSA,    B_AES_256, T, max, tls12, P_SHA384);

  1039         add("TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",

  1040             0x006b, --p, K_DHE_RSA,     B_AES_256, T, max, tls12, P_SHA256);

  1041         add("TLS_DHE_DSS_WITH_AES_256_CBC_SHA256",

  1042             0x006a, --p, K_DHE_DSS,     B_AES_256, T, max, tls12, P_SHA256);

  1043 

  1044         add("TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",

  1045             0xC00A, --p, K_ECDHE_ECDSA, B_AES_256, T);

  1046         add("TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",

  1047             0xC014, --p, K_ECDHE_RSA,   B_AES_256, T);

  1048         add("TLS_RSA_WITH_AES_256_CBC_SHA",

  1049             0x0035, --p, K_RSA,         B_AES_256, T);

  1050         add("TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA",

  1051             0xC005, --p, K_ECDH_ECDSA,  B_AES_256, T);

  1052         add("TLS_ECDH_RSA_WITH_AES_256_CBC_SHA",

  1053             0xC00F, --p, K_ECDH_RSA,    B_AES_256, T);

  1054         add("TLS_DHE_RSA_WITH_AES_256_CBC_SHA",

  1055             0x0039, --p, K_DHE_RSA,     B_AES_256, T);

  1056         add("TLS_DHE_DSS_WITH_AES_256_CBC_SHA",

  1057             0x0038, --p, K_DHE_DSS,     B_AES_256, T);

  1058 

  1059         // AES_128(CBC)

  1060         add("TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",

  1061             0xc023, --p, K_ECDHE_ECDSA, B_AES_128, T, max, tls12, P_SHA256);

  1062         add("TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",

  1063             0xc027, --p, K_ECDHE_RSA,   B_AES_128, T, max, tls12, P_SHA256);

  1064         add("TLS_RSA_WITH_AES_128_CBC_SHA256",

  1065             0x003c, --p, K_RSA,         B_AES_128, T, max, tls12, P_SHA256);

  1066         add("TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256",

  1067             0xc025, --p, K_ECDH_ECDSA,  B_AES_128, T, max, tls12, P_SHA256);

  1068         add("TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256",

  1069             0xc029, --p, K_ECDH_RSA,    B_AES_128, T, max, tls12, P_SHA256);

  1070         add("TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",

  1071             0x0067, --p, K_DHE_RSA,     B_AES_128, T, max, tls12, P_SHA256);

  1072         add("TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",

  1073             0x0040, --p, K_DHE_DSS,     B_AES_128, T, max, tls12, P_SHA256);

  1074 

  1075         add("TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",

  1076             0xC009, --p, K_ECDHE_ECDSA, B_AES_128, T);

  1077         add("TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",

  1078             0xC013, --p, K_ECDHE_RSA,   B_AES_128, T);

  1079         add("TLS_RSA_WITH_AES_128_CBC_SHA",

  1080             0x002f, --p, K_RSA,         B_AES_128, T);

  1081         add("TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA",

  1082             0xC004, --p, K_ECDH_ECDSA,  B_AES_128, T);

  1083         add("TLS_ECDH_RSA_WITH_AES_128_CBC_SHA",

  1084             0xC00E, --p, K_ECDH_RSA,    B_AES_128, T);

  1085         add("TLS_DHE_RSA_WITH_AES_128_CBC_SHA",

  1086             0x0033, --p, K_DHE_RSA,     B_AES_128, T);

  1087         add("TLS_DHE_DSS_WITH_AES_128_CBC_SHA",

  1088             0x0032, --p, K_DHE_DSS,     B_AES_128, T);

  1089 

  1090         // RC-4

  1091         add("TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",

  1092             0xC007, --p, K_ECDHE_ECDSA, B_RC4_128, N);

  1093         add("TLS_ECDHE_RSA_WITH_RC4_128_SHA",

  1094             0xC011, --p, K_ECDHE_RSA,   B_RC4_128, N);

  1095         add("SSL_RSA_WITH_RC4_128_SHA",

  1096             0x0005, --p, K_RSA,         B_RC4_128, N);

  1097         add("TLS_ECDH_ECDSA_WITH_RC4_128_SHA",

  1098             0xC002, --p, K_ECDH_ECDSA,  B_RC4_128, N);

  1099         add("TLS_ECDH_RSA_WITH_RC4_128_SHA",

  1100             0xC00C, --p, K_ECDH_RSA,    B_RC4_128, N);

  1101 

  1102         // 3DES_EDE

  1103         add("TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",

  1104             0xC008, --p, K_ECDHE_ECDSA, B_3DES,    T);

  1105         add("TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",

  1106             0xC012, --p, K_ECDHE_RSA,   B_3DES,    T);

  1107         add("SSL_RSA_WITH_3DES_EDE_CBC_SHA",

  1108             0x000a, --p, K_RSA,         B_3DES,    T);

  1109         add("TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA",

  1110             0xC003, --p, K_ECDH_ECDSA,  B_3DES,    T);

  1111         add("TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA",

  1112             0xC00D, --p, K_ECDH_RSA,    B_3DES,    T);

  1113         add("SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA",

  1114             0x0016, --p, K_DHE_RSA,     B_3DES,    T);

  1115         add("SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA",

  1116             0x0013, --p, K_DHE_DSS,     B_3DES,    N);

  1117 

  1118         add("SSL_RSA_WITH_RC4_128_MD5",

  1119             0x0004, --p, K_RSA,         B_RC4_128, N);

  1120 

  1121         // Renegotiation protection request Signalling Cipher Suite Value (SCSV)

  1122         add("TLS_EMPTY_RENEGOTIATION_INFO_SCSV",

  1123             0x00ff, --p, K_SCSV,        B_NULL,    T);

  1124 

  1125         /*

  1126          * Definition of the CipherSuites that are supported but not enabled

  1127          * by default.

  1128          * They are listed in preference order, preferred first, using the

  1129          * following criteria:

  1130          * 1. CipherSuites for KRB5 need additional KRB5 service

  1131          *    configuration, and these suites are not common in practice,

  1132          *    so we put KRB5 based cipher suites at the end of the supported

  1133          *    list.

  1134          * 2. If a cipher suite has been obsoleted, we put it at the end of