Hi ,
I have gone through the change log of openssl implementation and
come to know that there is initial support for TLSv1.2 in the openssl
library.
Please let me know following are the only TLSv1.2 support in the
openssl library. Can we say openssl supports TLSv1.2 completely or what
extend it support.
TLSv1.2 support in openssl:
1- Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF
support.
As required by RFC5289 these ciphersuites cannot be used if
for versions of TLS earlier than 1.2. [Steve Henson]
2- Add TLS v1.2 server support for client authentication. [Steve
Henson]
3- Add TLS v1.2 client side support for client authentication.
Keep cache of handshake records longer as we don't know the hash algorithm
to use
until after the certificate request message is received.
[Steve Henson]
4- Initial TLS v1.2 client support. Add a default signature
algorithms extension including all the algorithms we support. Parse new
signature format in client key exchange. Relax some ECC signing
restrictions for
TLS v1.2 as indicated in RFC5246. [Steve Henson]
5- Add server support for TLS v1.2 signature algorithms
extension. Switch to new signature format when needed using client digest
preference.
All server ciphersuites should now work correctly in TLS
v1.2. No client support yet and no support for client certificates.
[Steve Henson]
6- Initial TLS v1.2 support. Add new SHA256 digest to ssl code,
switch to SHA256 for PRF when using TLS v1.2 and later. Add new SHA256
based
ciphersuites. At present only RSA key exchange ciphersuites
work with TLS v1.2. Add new option for TLS v1.2 replacing the old and
obsolete
SSL_OP_PKCS1_CHECK flags with SSL_OP_NO_TLSv1_2. New TLSv1.2
methods and version checking. [Steve Henson]
Regards
Arashad Ahamad
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [email protected]
Automated List Manager [email protected]
