Skip to content

Commit b476627

Browse files
alexw91alexw91
authored
Import Cloudfront PQ TLS Policies (#5539)
1 parent 8416074 commit b476627

34 files changed

+1373
-16
lines changed

‎tests/policy_snapshot/snapshots/CloudFront-SSL-v-3‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,3 +41,8 @@ curves:
4141
- x25519
4242
- secp256r1
4343
- secp384r1
44+
pq:
45+
- revision: 5
46+
- kem groups:
47+
-- X25519MLKEM768
48+
-- SecP256r1MLKEM768

‎tests/policy_snapshot/snapshots/CloudFront-SSL-v-3-no-pq‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
min version: SSLv3
2+
rules:
3+
- Perfect Forward Secrecy: no
4+
- FIPS 140-3 (2019): no
5+
cipher suites:
6+
- TLS_AES_128_GCM_SHA256
7+
- TLS_AES_256_GCM_SHA384
8+
- TLS_CHACHA20_POLY1305_SHA256
9+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
10+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
11+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
12+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
13+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
14+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
15+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
16+
- TLS_RSA_WITH_AES_128_GCM_SHA256
17+
- TLS_RSA_WITH_AES_256_GCM_SHA384
18+
- TLS_RSA_WITH_AES_128_CBC_SHA256
19+
- TLS_RSA_WITH_AES_256_CBC_SHA
20+
- TLS_RSA_WITH_AES_128_CBC_SHA
21+
- TLS_RSA_WITH_3DES_EDE_CBC_SHA
22+
- TLS_RSA_WITH_RC4_128_MD5
23+
signature schemes:
24+
- rsa_pss_pss_sha256
25+
- rsa_pss_pss_sha384
26+
- rsa_pss_pss_sha512
27+
- rsa_pss_rsae_sha256
28+
- rsa_pss_rsae_sha384
29+
- rsa_pss_rsae_sha512
30+
- rsa_pkcs1_sha256
31+
- rsa_pkcs1_sha384
32+
- rsa_pkcs1_sha512
33+
- legacy_rsa_sha224
34+
- ecdsa_sha256
35+
- ecdsa_sha384
36+
- ecdsa_sha512
37+
- legacy_ecdsa_sha224
38+
- rsa_pkcs1_sha1
39+
- ecdsa_sha1
40+
curves:
41+
- x25519
42+
- secp256r1
43+
- secp384r1

‎tests/policy_snapshot/snapshots/CloudFront-TLS-1-0-2014‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,3 +47,8 @@ curves:
4747
- x25519
4848
- secp256r1
4949
- secp384r1
50+
pq:
51+
- revision: 5
52+
- kem groups:
53+
-- X25519MLKEM768
54+
-- SecP256r1MLKEM768

‎tests/policy_snapshot/snapshots/CloudFront-TLS-1-0-2014-PQ-Beta‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
min version: TLS1.0
2+
rules:
3+
- Perfect Forward Secrecy: no
4+
- FIPS 140-3 (2019): no
5+
cipher suites:
6+
- TLS_AES_128_GCM_SHA256
7+
- TLS_AES_256_GCM_SHA384
8+
- TLS_CHACHA20_POLY1305_SHA256
9+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
10+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
11+
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
12+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
13+
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
14+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
15+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
16+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
17+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
18+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
19+
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
20+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
21+
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
22+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
23+
- TLS_RSA_WITH_AES_128_GCM_SHA256
24+
- TLS_RSA_WITH_AES_256_GCM_SHA384
25+
- TLS_RSA_WITH_AES_128_CBC_SHA256
26+
- TLS_RSA_WITH_AES_256_CBC_SHA
27+
- TLS_RSA_WITH_AES_128_CBC_SHA
28+
- TLS_RSA_WITH_3DES_EDE_CBC_SHA
29+
signature schemes:
30+
- rsa_pss_pss_sha256
31+
- rsa_pss_pss_sha384
32+
- rsa_pss_pss_sha512
33+
- rsa_pss_rsae_sha256
34+
- rsa_pss_rsae_sha384
35+
- rsa_pss_rsae_sha512
36+
- rsa_pkcs1_sha256
37+
- rsa_pkcs1_sha384
38+
- rsa_pkcs1_sha512
39+
- legacy_rsa_sha224
40+
- ecdsa_sha256
41+
- ecdsa_sha384
42+
- ecdsa_sha512
43+
- legacy_ecdsa_sha224
44+
- rsa_pkcs1_sha1
45+
- ecdsa_sha1
46+
curves:
47+
- x25519
48+
- secp256r1
49+
- secp384r1
50+
pq:
51+
- revision: 5
52+
- kem groups:
53+
-- X25519MLKEM768
54+
-- SecP256r1MLKEM768

‎tests/policy_snapshot/snapshots/CloudFront-TLS-1-0-2014-no-pq‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
min version: TLS1.0
2+
rules:
3+
- Perfect Forward Secrecy: no
4+
- FIPS 140-3 (2019): no
5+
cipher suites:
6+
- TLS_AES_128_GCM_SHA256
7+
- TLS_AES_256_GCM_SHA384
8+
- TLS_CHACHA20_POLY1305_SHA256
9+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
10+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
11+
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
12+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
13+
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
14+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
15+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
16+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
17+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
18+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
19+
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
20+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
21+
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
22+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
23+
- TLS_RSA_WITH_AES_128_GCM_SHA256
24+
- TLS_RSA_WITH_AES_256_GCM_SHA384
25+
- TLS_RSA_WITH_AES_128_CBC_SHA256
26+
- TLS_RSA_WITH_AES_256_CBC_SHA
27+
- TLS_RSA_WITH_AES_128_CBC_SHA
28+
- TLS_RSA_WITH_3DES_EDE_CBC_SHA
29+
signature schemes:
30+
- rsa_pss_pss_sha256
31+
- rsa_pss_pss_sha384
32+
- rsa_pss_pss_sha512
33+
- rsa_pss_rsae_sha256
34+
- rsa_pss_rsae_sha384
35+
- rsa_pss_rsae_sha512
36+
- rsa_pkcs1_sha256
37+
- rsa_pkcs1_sha384
38+
- rsa_pkcs1_sha512
39+
- legacy_rsa_sha224
40+
- ecdsa_sha256
41+
- ecdsa_sha384
42+
- ecdsa_sha512
43+
- legacy_ecdsa_sha224
44+
- rsa_pkcs1_sha1
45+
- ecdsa_sha1
46+
curves:
47+
- x25519
48+
- secp256r1
49+
- secp384r1

‎tests/policy_snapshot/snapshots/CloudFront-TLS-1-0-2014-sha256‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
min version: TLS1.0
2+
rules:
3+
- Perfect Forward Secrecy: no
4+
- FIPS 140-3 (2019): no
5+
cipher suites:
6+
- TLS_AES_128_GCM_SHA256
7+
- TLS_AES_256_GCM_SHA384
8+
- TLS_CHACHA20_POLY1305_SHA256
9+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
10+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
11+
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
12+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
13+
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
14+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
15+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
16+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
17+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
18+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
19+
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
20+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
21+
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
22+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
23+
- TLS_RSA_WITH_AES_128_GCM_SHA256
24+
- TLS_RSA_WITH_AES_256_GCM_SHA384
25+
- TLS_RSA_WITH_AES_128_CBC_SHA256
26+
- TLS_RSA_WITH_AES_128_CBC_SHA
27+
- TLS_RSA_WITH_AES_256_CBC_SHA256
28+
- TLS_RSA_WITH_AES_256_CBC_SHA
29+
- TLS_RSA_WITH_3DES_EDE_CBC_SHA
30+
signature schemes:
31+
- rsa_pss_pss_sha256
32+
- rsa_pss_pss_sha384
33+
- rsa_pss_pss_sha512
34+
- rsa_pss_rsae_sha256
35+
- rsa_pss_rsae_sha384
36+
- rsa_pss_rsae_sha512
37+
- rsa_pkcs1_sha256
38+
- rsa_pkcs1_sha384
39+
- rsa_pkcs1_sha512
40+
- legacy_rsa_sha224
41+
- ecdsa_sha256
42+
- ecdsa_sha384
43+
- ecdsa_sha512
44+
- legacy_ecdsa_sha224
45+
- rsa_pkcs1_sha1
46+
- ecdsa_sha1
47+
curves:
48+
- x25519
49+
- secp256r1
50+
- secp384r1
51+
pq:
52+
- revision: 5
53+
- kem groups:
54+
-- X25519MLKEM768
55+
-- SecP256r1MLKEM768

‎tests/policy_snapshot/snapshots/CloudFront-TLS-1-0-2014-sha256-no-pq‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
min version: TLS1.0
2+
rules:
3+
- Perfect Forward Secrecy: no
4+
- FIPS 140-3 (2019): no
5+
cipher suites:
6+
- TLS_AES_128_GCM_SHA256
7+
- TLS_AES_256_GCM_SHA384
8+
- TLS_CHACHA20_POLY1305_SHA256
9+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
10+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
11+
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
12+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
13+
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
14+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
15+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
16+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
17+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
18+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
19+
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
20+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
21+
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
22+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
23+
- TLS_RSA_WITH_AES_128_GCM_SHA256
24+
- TLS_RSA_WITH_AES_256_GCM_SHA384
25+
- TLS_RSA_WITH_AES_128_CBC_SHA256
26+
- TLS_RSA_WITH_AES_128_CBC_SHA
27+
- TLS_RSA_WITH_AES_256_CBC_SHA256
28+
- TLS_RSA_WITH_AES_256_CBC_SHA
29+
- TLS_RSA_WITH_3DES_EDE_CBC_SHA
30+
signature schemes:
31+
- rsa_pss_pss_sha256
32+
- rsa_pss_pss_sha384
33+
- rsa_pss_pss_sha512
34+
- rsa_pss_rsae_sha256
35+
- rsa_pss_rsae_sha384
36+
- rsa_pss_rsae_sha512
37+
- rsa_pkcs1_sha256
38+
- rsa_pkcs1_sha384
39+
- rsa_pkcs1_sha512
40+
- legacy_rsa_sha224
41+
- ecdsa_sha256
42+
- ecdsa_sha384
43+
- ecdsa_sha512
44+
- legacy_ecdsa_sha224
45+
- rsa_pkcs1_sha1
46+
- ecdsa_sha1
47+
curves:
48+
- x25519
49+
- secp256r1
50+
- secp384r1

‎tests/policy_snapshot/snapshots/CloudFront-TLS-1-0-2016‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,3 +46,8 @@ curves:
4646
- x25519
4747
- secp256r1
4848
- secp384r1
49+
pq:
50+
- revision: 5
51+
- kem groups:
52+
-- X25519MLKEM768
53+
-- SecP256r1MLKEM768

‎tests/policy_snapshot/snapshots/CloudFront-TLS-1-0-2016-no-pq‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
min version: TLS1.0
2+
rules:
3+
- Perfect Forward Secrecy: no
4+
- FIPS 140-3 (2019): no
5+
cipher suites:
6+
- TLS_AES_128_GCM_SHA256
7+
- TLS_AES_256_GCM_SHA384
8+
- TLS_CHACHA20_POLY1305_SHA256
9+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
10+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
11+
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
12+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
13+
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
14+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
15+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
16+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
17+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
18+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
19+
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
20+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
21+
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
22+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
23+
- TLS_RSA_WITH_AES_128_GCM_SHA256
24+
- TLS_RSA_WITH_AES_256_GCM_SHA384
25+
- TLS_RSA_WITH_AES_128_CBC_SHA256
26+
- TLS_RSA_WITH_AES_256_CBC_SHA
27+
- TLS_RSA_WITH_AES_128_CBC_SHA
28+
signature schemes:
29+
- rsa_pss_pss_sha256
30+
- rsa_pss_pss_sha384
31+
- rsa_pss_pss_sha512
32+
- rsa_pss_rsae_sha256
33+
- rsa_pss_rsae_sha384
34+
- rsa_pss_rsae_sha512
35+
- rsa_pkcs1_sha256
36+
- rsa_pkcs1_sha384
37+
- rsa_pkcs1_sha512
38+
- legacy_rsa_sha224
39+
- ecdsa_sha256
40+
- ecdsa_sha384
41+
- ecdsa_sha512
42+
- legacy_ecdsa_sha224
43+
- rsa_pkcs1_sha1
44+
- ecdsa_sha1
45+
curves:
46+
- x25519
47+
- secp256r1
48+
- secp384r1

‎tests/policy_snapshot/snapshots/CloudFront-TLS-1-1-2016‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,3 +46,8 @@ curves:
4646
- x25519
4747
- secp256r1
4848
- secp384r1
49+
pq:
50+
- revision: 5
51+
- kem groups:
52+
-- X25519MLKEM768
53+
-- SecP256r1MLKEM768

0 commit comments

Comments
 (0)