OpenSSL: prefer ChaCha20 ciphersuites.

openssl/patches/chacha20poly1305.patch

 From 2688f00904e4ffd647afcff69bb8fe6df8c5902b Mon Sep 17 00:00:00 2001
 From: Adam Langley <agl@chromium.org>
 Date: Mon, 9 Sep 2013 12:13:24 -0400
 Subject: [PATCH 43/52] chacha20poly1305
 
 Add support for Chacha20 + Poly1305.
 ---
  .gitignore                         |    1 +
  Configure                          |   56 +-
  Makefile.org                       |    6 +-
@@ skipping 30 matching lines @@
  create mode 100644 crypto/chacha/chachatest.c
  create mode 100644 crypto/evp/e_chacha20poly1305.c
  create mode 100644 crypto/poly1305/Makefile
  create mode 100644 crypto/poly1305/poly1305.c
  create mode 100644 crypto/poly1305/poly1305.h
  create mode 100644 crypto/poly1305/poly1305_arm.c
  create mode 100644 crypto/poly1305/poly1305_arm_asm.s
  create mode 100644 crypto/poly1305/poly1305_vec.c
  create mode 100644 crypto/poly1305/poly1305test.c
 
+diff --git a/openssl/ssl/ssl_ciph.c b/openssl/ssl/ssl_ciph.c
+index db85b29..cebb18a 100644
+--- a/ssl/ssl_ciph.c
++++ b/ssl/ssl_ciph.c
+@@ -1442,7 +1442,9 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
+        ssl_cipher_apply_rule(0, SSL_kEECDH, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);
+        ssl_cipher_apply_rule(0, SSL_kEECDH, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);
+ 
+-       /* AES is our preferred symmetric cipher */
++       /* CHACHA20 is fast and safe on all hardware and is thus our preferred
++        * symmetric cipher, with AES second. */
++       ssl_cipher_apply_rule(0, 0, 0, SSL_CHACHA20POLY1305, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);
+        ssl_cipher_apply_rule(0, 0, 0, SSL_AES, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);
+ 
+        /* Temporarily enable everything else for sorting */
 diff --git a/Configure b/Configure
 index 9c803dc..1b95384 100755
 --- a/Configure
 +++ b/Configure
 @@ -124,24 +124,24 @@ my $tlib="-lnsl -lsocket";
  my $bits1="THIRTY_TWO_BIT ";
  my $bits2="SIXTY_FOUR_BIT ";
  
 -my $x86_asm="x86cpuid.o:bn-586.o co-586.o x86-mont.o x86-gf2m.o:des-586.o crypt586.o:aes-586.o vpaes-x86.o aesni-x86.o:bf-586.o:md5-586.o:sha1-586.o sha256-586.o sha512-586.o:cast-586.o:rc4-586.o:rmd-586.o:rc5-586.o:wp_block.o wp-mmx.o:cmll-x86.o:ghash-x86.o:";
 +my $x86_asm="x86cpuid.o:bn-586.o co-586.o x86-mont.o x86-gf2m.o:des-586.o crypt586.o:aes-586.o vpaes-x86.o aesni-x86.o:bf-586.o:md5-586.o:sha1-586.o sha256-586.o sha512-586.o:cast-586.o:rc4-586.o:rmd-586.o:rc5-586.o:wp_block.o wp-mmx.o:cmll-x86.o:ghash-x86.o:::";
@@ skipping 5655 matching lines @@
 +
 +$(POLY1305TEST)$(EXE_EXT): $(POLY1305TEST).o $(DLIBCRYPTO)
 +       @target=$(CHACHATEST); $(BUILD_CMD)
 +
  $(RMDTEST)$(EXE_EXT): $(RMDTEST).o $(DLIBCRYPTO)
         @target=$(RMDTEST); $(BUILD_CMD)
  
 -- 
 1.8.4.1