tree 63222730f7418b7fa0cfae4701b2d15aed2b522b
parent 1227d7cdf1153836e48a72f5475f5e2e8bd8442e
author Simon Butcher <simon.butcher@arm.com> 1476364397 +0100
committer Simon Butcher <simon.butcher@arm.com> 1476364397 +0100

Add simple test for repeated IVs when using AEAD

In a USENIX WOOT '16 paper the authors exploit implementation
mistakes that cause Initialisation Vectors (IV) to repeat. This
did not happen in mbed TLS, and this test makes sure that this
won't happen in the future either.

A new test option is introduced to ssl-opt.sh that checks the server
and client logs for a pattern and fails in case there are any
duplicates in the lines following the matching ones. (This is
necessary because of the structure of the logging)

Added a test case as well to utilise the new option. This test forces
the TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 ciphersuite to make the
client and the server use an AEAD cipher.

Hanno Böck, Aaron Zauner, Sean Devlin, Juraj Somorovsky and Philipp
Jovanovic, "Nonce-Disrespecting Adversaries: Practical Forgery Attacks
on GCM in TLS", USENIX WOOT '16