1Conscrypt's Capabilities 2======================================== 3 4Conscrypt is relatively selective in choosing the set of primitives to provide, focusing 5on the most important and widely-used algorithms. Following is a list of JCA algorithm names 6and other identifiers that are supported by Conscrypt. 7 8## TLS 9 10### Protocol Versions 11 12* `SSLv3` (ignored) 13* `TLSv1` 14* `TLSv1.1` 15* `TLSv1.2` 16* `TLSv1.3` 17 18Conscrypt supports TLS v1.0-1.3. For backwards compatibility it will accept 19`SSLv3` in calls to methods like 20[`setEnabledProtocols()`](https://docs.oracle.com/javase/9/docs/api/javax/net/ssl/SSLSocket.html#setEnabledProtocols-java.lang.String:A-) 21but will ignore it. 22 23### SSLContext 24 25* `Default` 26* `SSL` 27* `TLS` 28* `TLSv1` 29* `TLSv1.1` 30* `TLSv1.2` 31* `TLSv1.3` 32 33Conscrypt provides the above set of SSLContext algorithm names for JSSE 34purposes, including the special value `Default`, which is used to determine the 35value of 36[`SSLContext.getDefault()`](https://docs.oracle.com/javase/9/docs/api/javax/net/ssl/SSLContext.html#getDefault--). 37The `Default`, `SSL`, `TLS`, and `TLSv1.3` values return a context where TLS 38v1.0-1.3 are all enabled; the others return a context with TLS v1.0-1.2 enabled. 39 40### Cipher Suites 41 42#### Enabled 43* TLS 1.0-1.2 44 * `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA` 45 * `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256` 46 * `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA` 47 * `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384` 48 * `TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256` 49 * `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA` 50 * `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256` 51 * `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA` 52 * `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384` 53 * `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256` 54 * `TLS_RSA_WITH_AES_128_CBC_SHA` 55 * `TLS_RSA_WITH_AES_128_GCM_SHA256` 56 * `TLS_RSA_WITH_AES_256_CBC_SHA` 57 * `TLS_RSA_WITH_AES_256_GCM_SHA384` 58* TLS 1.3 59 * `TLS_AES_128_GCM_SHA256` 60 * `TLS_AES_256_GCM_SHA384` 61 * `TLS_CHACHA20_POLY1305_SHA256` 62 63The above cipher suites are enabled by default when the associated version of 64the protocol is enabled. The TLS 1.3 cipher suites cannot be customized; they 65are always enabled when TLS 1.3 is enabled, and any attempt to disable them via 66a call to 67[`setEnabledCipherSuites()`](https://docs.oracle.com/javase/9/docs/api/javax/net/ssl/SSLSocket.html#setEnabledCipherSuites-java.lang.String:A-) 68is ignored. 69 70#### Supported But Not Enabled 71* TLS 1.0-1.2 72 * `SSL_RSA_WITH_3DES_EDE_CBC_SHA` 73 * `TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA` 74 * `TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA` 75 * `TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256` 76 * `TLS_PSK_WITH_AES_128_CBC_SHA` 77 * `TLS_PSK_WITH_AES_256_CBC_SHA` 78 79The above cipher suites are supported, but not enabled by default. TLS 1.3 80cipher suites cannot be customized, so there are no cipher suites that are 81supported but not enabled. 82 83## Cryptography 84 85### Cipher 86 87* `AES/CBC/NoPadding` 88* `AES/CBC/PKCS5Padding` 89* `AES/CTR/NoPadding` 90* `AES/ECB/NoPadding` 91* `AES/ECB/PKCS5Padding` 92* `AES/GCM-SIV/NoPadding` 93 94AES with 128, 192, or 256-bit keys. 95 96* `AES/GCM/NoPadding` 97 98AES/GCM with 128 or 256-bit keys. 99 100* `AES_128/CBC/NoPadding` 101* `AES_128/CBC/PKCS5Padding` 102* `AES_128/ECB/NoPadding` 103* `AES_128/ECB/PKCS5Padding` 104* `AES_128/GCM/NoPadding` 105* `AES_128/GCM-SIV/NoPadding` 106* `AES_256/CBC/NoPadding` 107* `AES_256/CBC/PKCS5Padding` 108* `AES_256/ECB/NoPadding` 109* `AES_256/ECB/PKCS5Padding` 110* `AES_256/GCM/NoPadding` 111* `AES_256/GCM-SIV/NoPadding` 112 113Key-restricted versions of the AES ciphers. 114 115* `ARC4` 116 117The RC4 stream cipher. 118 119* `ChaCha20/NONE/NoPadding` 120* `ChaCha20/Poly1305/NoPadding` 121 122ChaCha with 20 rounds, 96-bit nonce, and 32-bit counter as described in 123[RFC 7539](https://tools.ietf.org/html/rfc7539), either with or without a Poly1305 AEAD 124authenticator. 125 126* `DESEDE/CBC/NoPadding` 127* `DESEDE/CBC/PKCS5Padding` 128 129Triple DES with either two or three intermediate keys. 130 131* `RSA/ECB/NoPadding` 132* `RSA/ECB/OAEPPadding` 133* `RSA/ECB/OAEPWithSHA-1AndMGF1Padding` 134* `RSA/ECB/OAEPWithSHA-224AndMGF1Padding` 135* `RSA/ECB/OAEPWithSHA-256AndMGF1Padding` 136* `RSA/ECB/OAEPWithSHA-384AndMGF1Padding` 137* `RSA/ECB/OAEPWithSHA-512AndMGF1Padding` 138* `RSA/ECB/PKCS1Padding` 139 140Conscrypt's OAEP ciphers (eg, `RSA/ECB/OAEPWithSHA-256AndMGF1Padding`) use the named digest for 141both the main digest and the MGF1 digest. This differs from the behavior of some other 142providers, including the ones bundled with OpenJDK, which always use SHA-1 for the MGF1 digest. 143For maximum compatibility, you should use `RSA/ECB/OAEPPadding` and initialize it with an 144[`OAEPParameterSpec`](https://docs.oracle.com/javase/9/docs/api/javax/crypto/spec/OAEPParameterSpec.html). 145 146### AlgorithmParameters 147* `AES` 148* `ChaCha20` 149* `DESEDE` 150* `EC` 151* `GCM` 152* `OAEP` 153* `PSS` 154 155Conscrypt's EC AlgorithmParameters implementation only supports named curves. 156 157### CertificateFactory 158* `X509` 159 160### KeyAgreement 161* `ECDH` 162 163### KeyFactory 164* `EC` 165* `RSA` 166 167### KeyGenerator 168* `AES` 169* `ARC4` 170* `ChaCha20` 171* `DESEDE` 172* `HmacMD5` 173* `HmacSHA1` 174* `HmacSHA224` 175* `HmacSHA256` 176* `HmacSHA384` 177* `HmacSHA512` 178 179### KeyPairGenerator 180* `EC` 181* `RSA` 182 183### Mac 184* `HmacMD5` 185* `HmacSHA1` 186* `HmacSHA224` 187* `HmacSHA256` 188* `HmacSHA384` 189* `HmacSHA512` 190 191### MessageDigest 192* `MD5` 193* `SHA-1` 194* `SHA-224` 195* `SHA-256` 196* `SHA-384` 197* `SHA-512` 198 199### SecretKeyFactory 200* `DESEDE` 201 202### SecureRandom 203* `SHA1PRNG` 204 205### Signature 206* `MD5withRSA` 207* `NONEwithECDSA` 208* `NONEwithRSA` 209* `SHA1withRSA` 210* `SHA1withECDSA` 211* `SHA1withRSA/PSS` 212* `SHA224withRSA` 213* `SHA224withECDSA` 214* `SHA224withRSA/PSS` 215* `SHA256withRSA` 216* `SHA256withECDSA` 217* `SHA256withRSA/PSS` 218* `SHA384withRSA` 219* `SHA384withECDSA` 220* `SHA384withRSA/PSS` 221* `SHA512withRSA` 222* `SHA512withECDSA` 223* `SHA512withRSA/PSS` 224 225### Elliptic Curves 226 227Conscrypt supports the following curves in EC crypto operations (such as ECDSA signatures) and TLS: 228 229| Curve | EC Crypto | TLS | 230| ----- | :-------: | :---: | 231| secp224r1 | X | | 232| prime256v1<br/>(aka secp256r1) | X | X | 233| secp384r1 | X | X | 234| secp521r1 | X | | 235| x25519 | | X | 236