ssl: Make PQC groups most preferred

Author: IngelaAndin

lib/ssl/src/ssl.erl

@@ -693,9 +693,7 @@ Options common to both client and server side.
   Used to limit the size of valid TLS handshake packets to avoid DoS
   attacks.
 
-  Integer (24 bits, unsigned). Defaults to `256*1024` before OTP-26 or if SLH-DSA algorithms
-  are configured, otherwise the default is `256*1024`/2.
-
+  Integer (24 bits, unsigned). Defaults to `256*1024` since OTP-29.0
 - **`{hibernate_after, HibernateTimeout}`** - Hibernate inactive connection processes.
 
   When an integer-value is specified, the TLS/DTLS connection goes into hibernation
@@ -1392,7 +1390,7 @@ The following options are specific to the client side, or have
 different semantics for the client and server:
 
 - **`{psk_groups, Groups}`** - key exchange groups that the client
-will send pre share keys for, defaults to first group in
+will send pre shared keys for, defaults to the first group in
 supported_groups. Must be a subset of supported_groups and will
 be sent in the same order as they appear in supported_groups.
 

lib/ssl/src/ssl_config.erl

@@ -1469,10 +1469,10 @@ opt_supported_groups(UserOpts, #{versions := TlsVsns} = Opts, Env) ->
 
 opt_psk_groups(undefined, _,  _, _) ->
     undefined;
-opt_psk_groups(#supported_groups{supported_groups = SupportedGroups},  UserOpts, Opts, _Env) ->
+opt_psk_groups(#supported_groups{supported_groups = [First| _] = SupportedGroups},
+               UserOpts, Opts, _Env) ->
     %% Version dependency already asserted when SupportedGroups is supported
-    %% so is psk_groups
-    First = hd(SupportedGroups),
+    %% hence so is psk_groups
     case get_opt_list(psk_groups, [First], UserOpts, Opts) of
         {default, Default} ->
             Default;
@@ -1495,30 +1495,11 @@ opt_crl(UserOpts, Opts, _Env) ->
 opt_handshake(UserOpts, Opts, _Env) ->
     {_, HS} = get_opt_of(handshake, [hello, full], full, UserOpts, Opts),
 
-    DefaultMaxHS = default_max_hs(Opts),
-
-    {_, MHSS} = get_opt_int(max_handshake_size, 1, ?MAX_UNIT24 , DefaultMaxHS,
+    {_, MHSS} = get_opt_int(max_handshake_size, 1, ?MAX_UNIT24 , ?DEFAULT_MAX_HANDSHAKE_SIZE,
                             UserOpts, Opts),
 
     Opts#{handshake => HS, max_handshake_size => MHSS}.
 
-default_max_hs(#{signature_algs:= undefined}) ->
-    ?DEFAULT_MAX_HANDSHAKE_SIZE;
-default_max_hs(#{signature_algs:= Algs}) ->
-    %%% In OTP-26 max handshake_size was lowered by half for most
-    %%% handshakes would fit that size and OpenSSL had a lower default
-    Set = sets:intersection(sets:from_list(Algs, [{version, 2}]),
-                            sets:from_list(tls_v1:slh_dsa_schemes(),
-                                           [{version, 2}])),
-    case sets:is_empty(Set) of
-        true ->
-            ?DEFAULT_MAX_HANDSHAKE_SIZE;
-        false ->
-            %% SLH_DSA creates fairly big handshake sizes so raise limit back
-            %% if these algorithms are supported,
-            ?DEFAULT_MAX_HANDSHAKE_SIZE * 2
-    end.
-
 opt_use_srtp(UserOpts, #{protocol := Protocol} = Opts, _Env) ->
     UseSRTP = case get_opt_map(use_srtp, undefined, UserOpts, Opts) of
                   {old, UseSRTP0} ->

lib/ssl/src/ssl_handshake.hrl

@@ -87,12 +87,10 @@
 -define(FINISHED, 20).
 -define(MAX_UNIT24, 8388607).
 
-%% Usually the biggest handshake message will be the message conveying the
-%% certificate chain. This size should be sufficient for usual certificate
-%% chains, certificates without special extensions have a typical size of
-%%  1-2kB. By dividing the old default value by 2 we still have a slightly
-%% bigger margin than OpenSSL
--define(DEFAULT_MAX_HANDSHAKE_SIZE, ((256*1024) div 2)).
+%% As of OTP-29 when PQC-algorithm SLH-DSA is supported by default
+%% handshakes need to allowed to be bigger by default to handle
+%% normal SLH-DSA  keys.
+-define(DEFAULT_MAX_HANDSHAKE_SIZE, 256*1024).
 
 -record(random, {
 	  gmt_unix_time, % uint32

lib/ssl/src/tls_v1.erl

@@ -68,6 +68,7 @@
          rsa_schemes/0,
          groups/0,
          groups/1,
+         pqc_groups/0,
          group_to_enum/1,
          enum_to_group/1,
          default_groups/0,
@@ -1251,48 +1252,38 @@ ecc_curves(Version) when is_tuple(Version) ->
     ecc_curves(TLSCurves);
 ecc_curves(TLSCurves) ->
     [pubkey_cert_records:namedCurves(Curve) || Curve <- TLSCurves].
-    
+ 
 groups() ->
     TLSGroups = groups(all),
     groups(TLSGroups).
 
 -spec groups(all | default | TLSGroups :: list()) -> [ssl:group()].
 groups(all) ->
-    [x25519,
-     x448,
-     secp521r1,
-     secp384r1,
-     secp256r1,
-     brainpoolP256r1tls13,
-     brainpoolP384r1tls13,
-     brainpoolP512r1tls13,
-     mlkem512,
-     mlkem768,
-     mlkem1024,
-     x25519mlkem768,
-     secp384r1mlkem1024,
-     secp256r1mlkem768,
-     ffdhe2048,
-     ffdhe3072,
-     ffdhe4096,
-     ffdhe6144,
-     ffdhe8192];
+    pqc_groups() ++
+        [x25519,
+         x448,
+         secp521r1,
+         secp384r1,
+         secp256r1,
+         brainpoolP256r1tls13,
+         brainpoolP384r1tls13,
+         brainpoolP512r1tls13,
+         ffdhe2048,
+         ffdhe3072,
+         ffdhe4096,
+         ffdhe6144,
+         ffdhe8192];
 groups(default) ->
-    [x25519,
-     x448,
-     secp521r1,
-     secp384r1,
-     secp256r1,
-     brainpoolP512r1tls13,
-     brainpoolP384r1tls13,
-     brainpoolP256r1tls13,
-     mlkem512,
-     mlkem768,
-     mlkem1024,
-     x25519mlkem768,
-     secp384r1mlkem1024,
-     secp256r1mlkem768
-    ];
+    pqc_groups() ++
+        [x25519,
+         x448,
+         secp521r1,
+         secp384r1,
+         secp256r1,
+         brainpoolP512r1tls13,
+         brainpoolP384r1tls13,
+         brainpoolP256r1tls13
+        ];
 groups(TLSGroups) when is_list(TLSGroups) ->
     CryptoGroups = crypto_supported_groups(),
     lists:filter(fun(x25519mlkem768) ->
@@ -1307,6 +1298,13 @@ groups(TLSGroups) when is_list(TLSGroups) ->
                     (Group) ->
                          proplists:get_bool(maybe_group_to_curve(Group), CryptoGroups)
                  end, TLSGroups).
+pqc_groups() ->
+    [x25519mlkem768,
+     mlkem1024,
+     mlkem768,
+     mlkem512,
+     secp384r1mlkem1024,
+     secp256r1mlkem768].
 
 default_groups() ->
     TLSGroups = groups(default),

lib/ssl/test/ssl_api_SUITE.erl

@@ -2206,7 +2206,8 @@ customize_defaults(Opts, Role, Host) ->
                end,
     case proplists:get_value(protocol, Opts, tls) of
         dtls ->
-            {ok, #config{ssl=DOpts}} = ssl_config:handle_options([{protocol, dtls}|NoVerify], Role, Host),
+            {ok, #config{ssl=DOpts}} =
+                ssl_config:handle_options([{protocol, dtls}|NoVerify], Role, Host),
             {DOpts, DefOpts ++ Opts};
         tls ->
             {ok, #config{ssl=DOpts}} = ssl_config:handle_options(NoVerify, Role, Host),
@@ -2932,7 +2933,7 @@ options_fallback(_Config) ->
     ok.
 
 options_handshake(_Config) -> %% handshake
-    ?OK(#{handshake := full, max_handshake_size := 131072},
+    ?OK(#{handshake := full, max_handshake_size := 262144},
         [], client),
     ?OK(#{handshake := hello, max_handshake_size := 123800},
         [{handshake, hello}, {max_handshake_size, 123800}], client),