OpenSSL: prefer ChaCha20 ciphersuites.

patches.chromium/0007-chacha.patch

 diff -burN android-openssl-lhash2/openssl.config android-openssl/openssl.config
 --- android-openssl-lhash2/openssl.config       2013-11-05 14:38:31.187575574 -0500
 +++ android-openssl/openssl.config      2013-11-05 15:03:54.661551145 -0500
 @@ -432,6 +432,7 @@
  crypto/buffer/buf_err.c \
  crypto/buffer/buf_str.c \
  crypto/buffer/buffer.c \
 +crypto/chacha/chacha_enc.c \
  crypto/cmac/cm_ameth.c \
  crypto/cmac/cm_pmeth.c \
@@ skipping 1600 matching lines @@
 ++
 ++These functions were first added to OpenSSL 1.0.2.
 ++
 ++=cut
 +-- 
 +1.8.4.1
 +
 diff -burN android-openssl-lhash2/patches/chacha20poly1305.patch android-openssl/patches/chacha20poly1305.patch
 --- android-openssl-lhash2/patches/chacha20poly1305.patch       1969-12-31 19:00:00.000000000 -0500
 +++ android-openssl/patches/chacha20poly1305.patch      2013-11-05 15:15:28.454480948 -0500
-@@ -0,0 +1,5725 @@
+@@ -0,0 +1,5740 @@
 +From 2688f00904e4ffd647afcff69bb8fe6df8c5902b Mon Sep 17 00:00:00 2001
 +From: Adam Langley <agl@chromium.org>
 +Date: Mon, 9 Sep 2013 12:13:24 -0400
 +Subject: [PATCH 43/52] chacha20poly1305
 +
 +Add support for Chacha20 + Poly1305.
 +---
 + .gitignore                         |    1 +
 + Configure                          |   56 +-
 + Makefile.org                       |    6 +-
@@ skipping 30 matching lines @@
 + create mode 100644 crypto/chacha/chachatest.c
 + create mode 100644 crypto/evp/e_chacha20poly1305.c
 + create mode 100644 crypto/poly1305/Makefile
 + create mode 100644 crypto/poly1305/poly1305.c
 + create mode 100644 crypto/poly1305/poly1305.h
 + create mode 100644 crypto/poly1305/poly1305_arm.c
 + create mode 100644 crypto/poly1305/poly1305_arm_asm.s
 + create mode 100644 crypto/poly1305/poly1305_vec.c
 + create mode 100644 crypto/poly1305/poly1305test.c
 +
++diff --git a/openssl/ssl/ssl_ciph.c b/openssl/ssl/ssl_ciph.c
++index db85b29..cebb18a 100644
++--- a/ssl/ssl_ciph.c
+++++ b/ssl/ssl_ciph.c
++@@ -1442,7 +1442,9 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
++       ssl_cipher_apply_rule(0, SSL_kEECDH, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);
++       ssl_cipher_apply_rule(0, SSL_kEECDH, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);
++ 
++-      /* AES is our preferred symmetric cipher */
+++      /* CHACHA20 is fast and safe on all hardware and is thus our preferred
+++       * symmetric cipher, with AES second. */
+++      ssl_cipher_apply_rule(0, 0, 0, SSL_CHACHA20POLY1305, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);
++       ssl_cipher_apply_rule(0, 0, 0, SSL_AES, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);
++ 
++       /* Temporarily enable everything else for sorting */
 +diff --git a/Configure b/Configure
 +index 9c803dc..1b95384 100755
 +--- a/Configure
 ++++ b/Configure
 +@@ -124,24 +124,24 @@ my $tlib="-lnsl -lsocket";
 + my $bits1="THIRTY_TWO_BIT ";
 + my $bits2="SIXTY_FOUR_BIT ";
 + 
 +-my $x86_asm="x86cpuid.o:bn-586.o co-586.o x86-mont.o x86-gf2m.o:des-586.o crypt586.o:aes-586.o vpaes-x86.o aesni-x86.o:bf-586.o:md5-586.o:sha1-586.o sha256-586.o sha512-586.o:cast-586.o:rc4-586.o:rmd-586.o:rc5-586.o:wp_block.o wp-mmx.o:cmll-x86.o:ghash-x86.o:";
 ++my $x86_asm="x86cpuid.o:bn-586.o co-586.o x86-mont.o x86-gf2m.o:des-586.o crypt586.o:aes-586.o vpaes-x86.o aesni-x86.o:bf-586.o:md5-586.o:sha1-586.o sha256-586.o sha512-586.o:cast-586.o:rc4-586.o:rmd-586.o:rc5-586.o:wp_block.o wp-mmx.o:cmll-x86.o:ghash-x86.o:::";
@@ skipping 7476 matching lines @@
 +       SSL_TLSV1_2,
 +       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
 +-      SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
 ++      SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256|SSL_CIPHER_ALGORITHM2_AEAD|FIXED_NONCE_LEN(4),
 +       128,
 +       128,
 +       },
 +-- 
 +1.8.4.1
 +