TLS CECPQ1 (experimental post-quantum) ciphers.

net/socket/ssl_client_socket_impl.cc

Index: net/socket/ssl_client_socket_impl.cc
diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket_impl.cc
index 487a406d1f7124593946c9f640526636e0fac185..ce0b9879906f1a1c1326579b367ec5dce160fe0e 100644
--- a/net/socket/ssl_client_socket_impl.cc
+++ b/net/socket/ssl_client_socket_impl.cc
@@ -17,6 +17,7 @@
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
+#include "base/feature_list.h"
 #include "base/lazy_instance.h"
 #include "base/macros.h"
 #include "base/memory/singleton.h"
@@ -84,6 +85,12 @@ const uint8_t kTbProtocolVersionMinor = 6;
 const uint8_t kTbMinProtocolVersionMajor = 0;
 const uint8_t kTbMinProtocolVersionMinor = 6;
 
+// Reviewer: enable or disable by default?  Is there an obviously right choice
+// here?  I'm defaulting to DISABLED_BY_DEFAULT because it seems like the
+// easiest mechanism to enable this on desktop only.

[davidben, 2016/06/28 21:23:53]

I think disabled by default is probably right?

[mab, 2016/06/28 22:12:33]

Per conversation with agl, I'm removing the Finch call for now.

+const base::Feature kPostQuantumExperiment{"SSLPostQuantumExperiment",
+                                           base::FEATURE_DISABLED_BY_DEFAULT};
+
 bool EVP_MDToPrivateKeyHash(const EVP_MD* md, SSLPrivateKey::Hash* hash) {
   switch (EVP_MD_type(md)) {
     case NID_md5_sha1:
@@ -966,7 +973,27 @@ int SSLClientSocketImpl::Init() {
   // DHE_RSA_WITH_AES_256_GCM_SHA384. Historically, AES_256_GCM was not
   // supported. As DHE is being deprecated, don't add a cipher only to remove it
   // immediately.
-  std::string command(
+  std::string command;
+  if (base::FeatureList::IsEnabled(kPostQuantumExperiment)) {
+    // These are experimental, non-standard ciphersuites.  They are part of an
+    // experiment in post-quantum cryptography.  They're not intended to
+    // represent a de-facto standard, and will be removed from BoringSSL in
+    // ~2018.
+    if (EVP_has_aes_hardware()) {
+      command.append(
+          "CECPQ1-RSA-AES256-GCM-SHA384:"
+          "CECPQ1-ECDSA-AES256-GCM-SHA384:");
+    }
+    command.append(
+        "CECPQ1-RSA-CHACHA20-POLY1305-SHA256:"
+        "CECPQ1-ECDSA-CHACHA20-POLY1305-SHA256:");
+    if (!EVP_has_aes_hardware()) {
+      command.append(
+          "CECPQ1-RSA-AES256-GCM-SHA384:"
+          "CECPQ1-ECDSA-AES256-GCM-SHA384:");
+    }
+  }
+  command.append(
       "DEFAULT:!SHA256:!SHA384:!DHE-RSA-AES256-GCM-SHA384:!aPSK:!RC4");

[davidben, 2016/06/28 21:23:53]

DEFAULT is kind of dumb and doesn't work if it's not at the front (probably
should fix that...). That said, it just expands to SSL_DEFAULT_CIPHER_SUITE_LIST
which expands to "ALL". Since we're already going nuts with "ALL" not actually
meaning all ciphers, I'm happy enough saying that DEFAULT will always mean ALL
from now on.

[mab, 2016/06/28 22:12:33]

Sooo ... I should change this to "ALL"?  :-)

 
   if (ssl_config_.require_ecdhe)