Support for ChaCha20-Poly1305 released in OpenSSL 1.1.0

Has this been standardized yet? The latest draft I can find still has a bunch of 0xTBD values for the cipher suite numbers.

https://datatracker.ietf.org/doc/draft-ietf-tls-chacha20-pol...

IANA will officially assign numbers once the I-D has progressed to standard status. They'll show up here:

http://www.iana.org/assignments/tls-parameters/tls-parameter...

In the mean time, the I-D does contain the requested values in section 3:

    TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305   = {0xTBD, 0xTBD} {0xCC, 0xA8}
    TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD} {0xCC, 0xA9}
    TLS_DHE_RSA_WITH_CHACHA20_POLY1305     = {0xTBD, 0xTBD} {0xCC, 0xAA}

    TLS_PSK_WITH_CHACHA20_POLY1305         = {0xTBD, 0xTBD} {0xCC, 0xAB}
    TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305   = {0xTBD, 0xTBD} {0xCC, 0xAC}
    TLS_DHE_PSK_WITH_CHACHA20_POLY1305     = {0xTBD, 0xTBD} {0xCC, 0xAD}
    TLS_RSA_PSK_WITH_CHACHA20_POLY1305     = {0xTBD, 0xTBD} {0xCC, 0xAE}

(the ones in the latter brackets) and IANA is very likely to use those. There's always a bit of a chicken and egg race condition here, usually resolved with a friendly mail to the IANA administrator.

RFC 7539 documents the cipher itself. It's mostly just enshrining the existing specification as an RFC, except for changing the size of the nonce and block count to meet recommended nonce sizes.

There are some additional details required to use the cipher for TLS. In particular the new modes must be assigned entries in the TLS Cipher Suite Registry, which contain the official names and the numeric values used in the wire protocol. The current draft also specifies how to construct the nonce from the record sequence number and a shared secret, to avoid having to send a nonce with each record.

There are lots of interesting features and changes in this (alpha 1) release. Release notes and full changelog: https://openssl.org/news/openssl-1.1.0-notes.html

"SSL/TLS state machine, version negotiation and record layer rewritten" from the release notes sounds scary.

The changelog says:

  *) State machine rewrite. The state machine code has been significantly
     refactored in order to remove much duplication of code and solve issues
     with the old code (see ssl/statem/README for further details). This change
     does have some associated API changes. Notably the SSL_state() function
     has been removed and replaced by SSL_get_state which now returns an
     "OSSL_HANDSHAKE_STATE" instead of an int. SSL_set_state() has been removed
     altogether. The previous handshake states defined in ssl.h and ssl3.h have
     also been removed.
     [Matt Caswell]