From ab07648c18721b7ddbef5c873152f30b54a3b09e Mon Sep 17 00:00:00 2001 From: BRUHItsABunny <53124399+BRUHItsABunny@users.noreply.github.com> Date: Tue, 17 Dec 2024 18:46:34 -0600 Subject: [PATCH 1/3] feat: add ML-KEM as supported curve --- cfkem.go | 3 +++ cfkem_test.go | 1 + go.mod | 4 ++-- go.sum | 4 ++-- 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/cfkem.go b/cfkem.go index 8d440e4c..3e14dc51 100644 --- a/cfkem.go +++ b/cfkem.go @@ -41,6 +41,7 @@ var ( X25519Kyber768Draft00 = CurveID(0x6399) X25519Kyber768Draft00Old = CurveID(0xfe31) P256Kyber768Draft00 = CurveID(0xfe32) + X25519MLKEM768 = CurveID(0x11ec) invalidCurveID = CurveID(0) ) @@ -69,6 +70,8 @@ func curveIdToCirclScheme(id CurveID) kem.Scheme { return hybrid.Kyber768X25519() case P256Kyber768Draft00: return hybrid.P256Kyber768Draft00() + case X25519MLKEM768: + return hybrid.X25519MLKEM768() } return nil } diff --git a/cfkem_test.go b/cfkem_test.go index 7043d5f0..8363fc96 100644 --- a/cfkem_test.go +++ b/cfkem_test.go @@ -96,6 +96,7 @@ func TestHybridKEX(t *testing.T) { X25519Kyber768Draft00, X25519Kyber768Draft00Old, P256Kyber768Draft00, + X25519MLKEM768, } { run(curveID, true, true, false, false) run(curveID, true, false, false, false) diff --git a/go.mod b/go.mod index d73a942f..64829178 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/refraction-networking/utls -go 1.21 +go 1.22 retract ( v1.4.1 // #218 @@ -9,7 +9,7 @@ retract ( require ( github.com/andybalholm/brotli v1.0.6 - github.com/cloudflare/circl v1.3.7 + github.com/cloudflare/circl v1.5.0 github.com/klauspost/compress v1.17.4 golang.org/x/crypto v0.21.0 golang.org/x/net v0.23.0 diff --git a/go.sum b/go.sum index 231edae6..121f4b4c 100644 --- a/go.sum +++ b/go.sum @@ -1,7 +1,7 @@ github.com/andybalholm/brotli v1.0.6 h1:Yf9fFpf49Zrxb9NlQaluyE92/+X7UVHlhMNJN2sxfOI= github.com/andybalholm/brotli v1.0.6/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig= -github.com/cloudflare/circl v1.3.7 h1:qlCDlTPz2n9fu58M0Nh1J/JzcFpfgkFHHX3O35r5vcU= -github.com/cloudflare/circl v1.3.7/go.mod h1:sRTcRWXGLrKw6yIGJ+l7amYJFfAXbZG0kBSc8r4zxgA= +github.com/cloudflare/circl v1.5.0 h1:hxIWksrX6XN5a1L2TI/h53AGPhNHoUBo+TD1ms9+pys= +github.com/cloudflare/circl v1.5.0/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs= github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4= github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM= golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA= From baf223b1943f98a8ce8467d1194d9f4adec956bf Mon Sep 17 00:00:00 2001 From: BRUHItsABunny <53124399+BRUHItsABunny@users.noreply.github.com> Date: Tue, 17 Dec 2024 18:55:06 -0600 Subject: [PATCH 2/3] feat: Add Chrome 131 parrot --- u_common.go | 2 ++ u_parrots.go | 73 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 75 insertions(+) diff --git a/u_common.go b/u_common.go index 59a5a2e3..88fecc18 100644 --- a/u_common.go +++ b/u_common.go @@ -625,6 +625,8 @@ var ( HelloChrome_120 = ClientHelloID{helloChrome, "120", nil, nil} // Chrome w/ Post-Quantum Key Agreement and Encrypted ClientHello HelloChrome_120_PQ = ClientHelloID{helloChrome, "120_PQ", nil, nil} + // Chrome w/ ML-KEM curve + HelloChrome_131 = ClientHelloID{helloChrome, "131", nil, nil} HelloIOS_Auto = HelloIOS_14 HelloIOS_11_1 = ClientHelloID{helloIOS, "111", nil, nil} // legacy "111" means 11.1 diff --git a/u_parrots.go b/u_parrots.go index 885b7431..df71c8ac 100644 --- a/u_parrots.go +++ b/u_parrots.go @@ -807,6 +807,79 @@ func utlsIdToSpec(id ClientHelloID) (ClientHelloSpec, error) { &UtlsGREASEExtension{}, }), }, nil + case HelloChrome_131: + return ClientHelloSpec{ + CipherSuites: []uint16{ + GREASE_PLACEHOLDER, + TLS_AES_128_GCM_SHA256, + TLS_AES_256_GCM_SHA384, + TLS_CHACHA20_POLY1305_SHA256, + TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, + TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, + TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, + TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, + TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, + TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, + TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, + TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, + TLS_RSA_WITH_AES_128_GCM_SHA256, + TLS_RSA_WITH_AES_256_GCM_SHA384, + TLS_RSA_WITH_AES_128_CBC_SHA, + TLS_RSA_WITH_AES_256_CBC_SHA, + }, + CompressionMethods: []byte{ + 0x00, // compressionNone + }, + Extensions: ShuffleChromeTLSExtensions([]TLSExtension{ + &UtlsGREASEExtension{}, + &SNIExtension{}, + &ExtendedMasterSecretExtension{}, + &RenegotiationInfoExtension{Renegotiation: RenegotiateOnceAsClient}, + &SupportedCurvesExtension{[]CurveID{ + GREASE_PLACEHOLDER, + X25519MLKEM768, + X25519, + CurveP256, + CurveP384, + }}, + &SupportedPointsExtension{SupportedPoints: []byte{ + 0x00, // pointFormatUncompressed + }}, + &SessionTicketExtension{}, + &ALPNExtension{AlpnProtocols: []string{"h2", "http/1.1"}}, + &StatusRequestExtension{}, + &SignatureAlgorithmsExtension{SupportedSignatureAlgorithms: []SignatureScheme{ + ECDSAWithP256AndSHA256, + PSSWithSHA256, + PKCS1WithSHA256, + ECDSAWithP384AndSHA384, + PSSWithSHA384, + PKCS1WithSHA384, + PSSWithSHA512, + PKCS1WithSHA512, + }}, + &SCTExtension{}, + &KeyShareExtension{[]KeyShare{ + {Group: CurveID(GREASE_PLACEHOLDER), Data: []byte{0}}, + {Group: X25519Kyber768Draft00}, + {Group: X25519}, + }}, + &PSKKeyExchangeModesExtension{[]uint8{ + PskModeDHE, + }}, + &SupportedVersionsExtension{[]uint16{ + GREASE_PLACEHOLDER, + VersionTLS13, + VersionTLS12, + }}, + &UtlsCompressCertExtension{[]CertCompressionAlgo{ + CertCompressionBrotli, + }}, + &ApplicationSettingsExtension{SupportedProtocols: []string{"h2"}}, + BoringGREASEECH(), + &UtlsGREASEExtension{}, + }), + }, nil case HelloFirefox_55, HelloFirefox_56: return ClientHelloSpec{ TLSVersMax: VersionTLS12, From 755c451891fd0d46c434a5563c5a5f35e30b3d95 Mon Sep 17 00:00:00 2001 From: BRUHItsABunny <53124399+BRUHItsABunny@users.noreply.github.com> Date: Tue, 17 Dec 2024 19:07:28 -0600 Subject: [PATCH 3/3] fix: Chrome 131 parrot needs to send ML-KEM keyshare too --- u_parrots.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/u_parrots.go b/u_parrots.go index df71c8ac..c037eba7 100644 --- a/u_parrots.go +++ b/u_parrots.go @@ -861,7 +861,7 @@ func utlsIdToSpec(id ClientHelloID) (ClientHelloSpec, error) { &SCTExtension{}, &KeyShareExtension{[]KeyShare{ {Group: CurveID(GREASE_PLACEHOLDER), Data: []byte{0}}, - {Group: X25519Kyber768Draft00}, + {Group: X25519MLKEM768}, {Group: X25519}, }}, &PSKKeyExchangeModesExtension{[]uint8{