ssl: Make PQC groups most preferred

Author: IngelaAndin

lib/ssl/src/ssl.erl

@@ -693,8 +693,7 @@ Options common to both client and server side.
   Used to limit the size of valid TLS handshake packets to avoid DoS
   attacks.
 
-  Integer (24 bits, unsigned). Defaults to `256*1024` before OTP-26 or if SLH-DSA algorithms
-  are configured, otherwise the default is `256*1024`/2.
+  Integer (24 bits, unsigned). Defaults to `262144` since OTP 29.0
 
 - **`{hibernate_after, HibernateTimeout}`** - Hibernate inactive connection processes.
 
@@ -751,7 +750,7 @@ Common certificate related options to both client and server.
   connection will be selected.
 
   The different signature algorithms are prioritized in the following
-  order: `mldsa`, `slh-dsa`, `eddsa`, `ecdsa`, `rsa_pss_pss`, `rsa`, and `dsa`. If more
+  order: `mldsa`, `slhdsa`, `eddsa`, `ecdsa`, `rsa_pss_pss`, `rsa`, and `dsa`. If more
   than one key is supplied for the same signature algorithm, they will
   be prioritized by strength (except for _engine keys_; see the next
   paragraph). This offers flexibility to, for instance, configure a
@@ -1392,7 +1391,7 @@ The following options are specific to the client side, or have
 different semantics for the client and server:
 
 - **`{psk_groups, Groups}`** - key exchange groups that the client
-will send pre share keys for, defaults to first group in
+will send pre shared keys for, defaults to the first group in
 supported_groups. Must be a subset of supported_groups and will
 be sent in the same order as they appear in supported_groups.
 
@@ -1445,7 +1444,7 @@ different semantics for the client and server.
   > #### Change {: .info }
   >
   > The default for `Verify` was changed to `verify_peer` in
-  > Erlang/OTP 26.
+  > Erlang/OTP 26.0.
 
 - **`{cacerts, CACerts}`** - Trusted certificates
 
@@ -1864,7 +1863,7 @@ Certificate related options for a server.
   `true`, the server fails if the client does not have a certificate to send, that
   is, sends an empty certificate. If set to `false`, it fails only if the client
   sends an invalid certificate (an empty certificate is considered valid).
-  Defaults to `true`, the default value was changed in OTP-26.0.
+  Defaults to `true`, the default value was changed in OTP 26.0.
 
 - **`{certificate_authorities, ServerCertAuth}`** - Inter-operate hint option
 
@@ -3180,7 +3179,7 @@ eccs(Other) ->
 -doc """
 Returns all supported groups in TLS 1.3.
 
-Existed since OTP 22.0; documented as of OTP 27.
+Existed since OTP 22.0; documented as of OTP 27.0.
 """.
 -spec groups() -> [group()].
 %%--------------------------------------------------------------------
@@ -3195,7 +3194,7 @@ groups() ->
 -doc """
 Returns default supported groups in TLS 1.3.
 
-Existed since OTP 22.0; documented as of OTP 27.
+Existed since OTP 22.0; documented as of OTP 27.0.
 """.
 
 %%--------------------------------------------------------------------

lib/ssl/src/ssl_config.erl

@@ -1469,10 +1469,10 @@ opt_supported_groups(UserOpts, #{versions := TlsVsns} = Opts, Env) ->
 
 opt_psk_groups(undefined, _,  _, _) ->
     undefined;
-opt_psk_groups(#supported_groups{supported_groups = SupportedGroups},  UserOpts, Opts, _Env) ->
+opt_psk_groups(#supported_groups{supported_groups = [First| _] = SupportedGroups},
+               UserOpts, Opts, _Env) ->
     %% Version dependency already asserted when SupportedGroups is supported
-    %% so is psk_groups
-    First = hd(SupportedGroups),
+    %% hence so is psk_groups
     case get_opt_list(psk_groups, [First], UserOpts, Opts) of
         {default, Default} ->
             Default;
@@ -1495,30 +1495,11 @@ opt_crl(UserOpts, Opts, _Env) ->
 opt_handshake(UserOpts, Opts, _Env) ->
     {_, HS} = get_opt_of(handshake, [hello, full], full, UserOpts, Opts),
 
-    DefaultMaxHS = default_max_hs(Opts),
-
-    {_, MHSS} = get_opt_int(max_handshake_size, 1, ?MAX_UNIT24 , DefaultMaxHS,
+    {_, MHSS} = get_opt_int(max_handshake_size, 1, ?MAX_UNIT24 , ?DEFAULT_MAX_HANDSHAKE_SIZE,
                             UserOpts, Opts),
 
     Opts#{handshake => HS, max_handshake_size => MHSS}.
 
-default_max_hs(#{signature_algs:= undefined}) ->
-    ?DEFAULT_MAX_HANDSHAKE_SIZE;
-default_max_hs(#{signature_algs:= Algs}) ->
-    %%% In OTP-26 max handshake_size was lowered by half for most
-    %%% handshakes would fit that size and OpenSSL had a lower default
-    Set = sets:intersection(sets:from_list(Algs, [{version, 2}]),
-                            sets:from_list(tls_v1:slh_dsa_schemes(),
-                                           [{version, 2}])),
-    case sets:is_empty(Set) of
-        true ->
-            ?DEFAULT_MAX_HANDSHAKE_SIZE;
-        false ->
-            %% SLH_DSA creates fairly big handshake sizes so raise limit back
-            %% if these algorithms are supported,
-            ?DEFAULT_MAX_HANDSHAKE_SIZE * 2
-    end.
-
 opt_use_srtp(UserOpts, #{protocol := Protocol} = Opts, _Env) ->
     UseSRTP = case get_opt_map(use_srtp, undefined, UserOpts, Opts) of
                   {old, UseSRTP0} ->

lib/ssl/src/ssl_handshake.hrl

@@ -87,12 +87,10 @@
 -define(FINISHED, 20).
 -define(MAX_UNIT24, 8388607).
 
-%% Usually the biggest handshake message will be the message conveying the
-%% certificate chain. This size should be sufficient for usual certificate
-%% chains, certificates without special extensions have a typical size of
-%%  1-2kB. By dividing the old default value by 2 we still have a slightly
-%% bigger margin than OpenSSL
--define(DEFAULT_MAX_HANDSHAKE_SIZE, ((256*1024) div 2)).
+%% As of OTP-29 when PQC-algorithm SLH-DSA is supported by default
+%% handshakes need to allowed to be bigger by default to handle
+%% normal SLH-DSA keys.
+-define(DEFAULT_MAX_HANDSHAKE_SIZE, 256*1024).
 
 -record(random, {
 	  gmt_unix_time, % uint32

lib/ssl/src/tls_v1.erl

@@ -1248,48 +1248,37 @@ ecc_curves(Version) when is_tuple(Version) ->
     ecc_curves(TLSCurves);
 ecc_curves(TLSCurves) ->
     [pubkey_cert_records:namedCurves(Curve) || Curve <- TLSCurves].
-    
+ 
 groups() ->
     TLSGroups = groups(all),
     groups(TLSGroups).
 
 -spec groups(all | default | TLSGroups :: list()) -> [ssl:group()].
 groups(all) ->
-    [x25519,
-     x448,
-     secp521r1,
-     secp384r1,
-     secp256r1,
-     brainpoolP256r1tls13,
-     brainpoolP384r1tls13,
-     brainpoolP512r1tls13,
-     mlkem512,
-     mlkem768,
-     mlkem1024,
-     x25519mlkem768,
-     secp384r1mlkem1024,
-     secp256r1mlkem768,
-     ffdhe2048,
-     ffdhe3072,
-     ffdhe4096,
-     ffdhe6144,
-     ffdhe8192];
+    default_pqc_hybrid_groups() ++
+        [x25519,
+         x448,
+         secp521r1,
+         secp384r1,
+         secp256r1,
+         brainpoolP256r1tls13,
+         brainpoolP384r1tls13,
+         brainpoolP512r1tls13
+         ] ++
+        other_pqc_hybrid_groups() ++
+        pqc_plain_groups() ++
+        dhe_groups();
 groups(default) ->
-    [x25519,
-     x448,
-     secp521r1,
-     secp384r1,
-     secp256r1,
-     brainpoolP512r1tls13,
-     brainpoolP384r1tls13,
-     brainpoolP256r1tls13,
-     mlkem512,
-     mlkem768,
-     mlkem1024,
-     x25519mlkem768,
-     secp384r1mlkem1024,
-     secp256r1mlkem768
-    ];
+    default_pqc_hybrid_groups() ++
+        [x25519,
+         x448,
+         secp521r1,
+         secp384r1,
+         secp256r1,
+         brainpoolP512r1tls13,
+         brainpoolP384r1tls13,
+         brainpoolP256r1tls13
+        ];
 groups(TLSGroups) when is_list(TLSGroups) ->
     CryptoGroups = crypto_supported_groups(),
     lists:filter(fun(x25519mlkem768) ->
@@ -1305,6 +1294,25 @@ groups(TLSGroups) when is_list(TLSGroups) ->
                          proplists:get_bool(maybe_group_to_curve(Group), CryptoGroups)
                  end, TLSGroups).
 
+default_pqc_hybrid_groups() ->
+    [x25519mlkem768].
+
+other_pqc_hybrid_groups()->
+    [secp384r1mlkem1024,
+     secp256r1mlkem768].
+
+pqc_plain_groups() ->
+    [mlkem1024,
+     mlkem768,
+     mlkem512].
+
+dhe_groups() ->
+    [ffdhe2048,
+     ffdhe3072,
+     ffdhe4096,
+     ffdhe6144,
+     ffdhe8192].
+
 default_groups() ->
     TLSGroups = groups(default),
     groups(TLSGroups).

lib/ssl/test/ssl_api_SUITE.erl

@@ -2233,7 +2233,8 @@ customize_defaults(Opts, Role, Host) ->
                end,
     case proplists:get_value(protocol, Opts, tls) of
         dtls ->
-            {ok, #config{ssl=DOpts}} = ssl_config:handle_options([{protocol, dtls}|NoVerify], Role, Host),
+            {ok, #config{ssl=DOpts}} =
+                ssl_config:handle_options([{protocol, dtls}|NoVerify], Role, Host),
             {DOpts, DefOpts ++ Opts};
         tls ->
             {ok, #config{ssl=DOpts}} = ssl_config:handle_options(NoVerify, Role, Host),
@@ -2959,7 +2960,7 @@ options_fallback(_Config) ->
     ok.
 
 options_handshake(_Config) -> %% handshake
-    ?OK(#{handshake := full, max_handshake_size := 131072},
+    ?OK(#{handshake := full, max_handshake_size := 262144},
         [], client),
     ?OK(#{handshake := hello, max_handshake_size := 123800},
         [{handshake, hello}, {max_handshake_size, 123800}], client),