refactor: Adds tls13 ciphersuites to default/default_fips policy#5560
Merged
maddeleine merged 6 commits intoaws:mainfrom Oct 27, 2025
Merged
refactor: Adds tls13 ciphersuites to default/default_fips policy#5560maddeleine merged 6 commits intoaws:mainfrom
maddeleine merged 6 commits intoaws:mainfrom
Conversation
CarolYeh910
approved these changes
Oct 15, 2025
c96f22d to
e8db83f
Compare
jmayclin
reviewed
Oct 16, 2025
jmayclin
approved these changes
Oct 23, 2025
Contributor
jmayclin
left a comment
There was a problem hiding this comment.
Approved, with the nit that we also add the dated versions of the policies.
CarolYeh910
approved these changes
Oct 24, 2025
f91d520 to
a4c067a
Compare
Contributor
Author
|
Note, I am overriding and merging this PR as we do expect the integv2 test to fail for reasons mentioned in the PR description. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release Summary:
Multiple changes to the s2n-tls default policy:
Resolved issues:
resolves #4765
Description of changes:
Creates two new security policies that are duplicates of "default" and "default_fips" except their ciphersuites list includes TLS1.3 ciphersuites, they now support PQ key exchange, and they now do not support CBC ciphersuites.
Note that "default" ciphersuite list supports chachapoly, but "default_fips" does not, as that ciphersuite is not fips.
Call-outs:
We are going to have to override and merge this change. This is because the cross-compatability tests for s2n clients(test_s2n_old_client_new_ticket/test_s2n_new_client_old_ticket) are correctly failing for this change. Essentially, because default previously only negotiated tls1.2, and now negotiates tls1.3, you're going to get failing resumption for the cross compat tests. You can't resume with a tls1.2 ticket on a tls1.3 connection, and you can't resume with a tls1.3 ticket on a tls1.2 connection.
If you want to know why only the client tests are failing in the cross-compat test and not the servers, the reason is that we switched the client tests to using "default" policies a while back, without also doing the same for the server tests. This means that the client tests are affected by "default" changes whereas the server tests are not.
Testing:
All other tests pass CI.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.