aws-crt 0.1.9 → 0.2.0

data/aws-crt-ffi/crt/aws-lc/ssl/ssl_key_share.cc

@@ -24,6 +24,7 @@
 #include <openssl/curve25519.h>
 #include <openssl/ec.h>
 #include <openssl/err.h>
+#include <openssl/evp.h>
 #include <openssl/hrss.h>
 #include <openssl/mem.h>
 #include <openssl/nid.h>
@@ -32,6 +33,9 @@
 
 #include "internal.h"
 #include "../crypto/internal.h"
+#include "../crypto/kem/internal.h"
+#include "../crypto/fipsmodule/ec/internal.h"
+#include "../crypto/kyber/kem_kyber.h"
 
 BSSL_NAMESPACE_BEGIN
 
@@ -176,20 +180,548 @@ class X25519KeyShare : public SSLKeyShare {
   uint8_t private_key_[32];
 };
 
+class KEMKeyShare : public SSLKeyShare {
+ public:
+  KEMKeyShare(int nid, uint16_t group_id) : nid_(nid), group_id_(group_id) {}
+
+  uint16_t GroupID() const override { return group_id_; }
+
+  bool Offer(CBB *out) override {
+    // Ensure |out| is valid, has no children, and has been initialized.
+    // We check that |out| has no children because otherwise CBB_data()
+    // will produce a fatal error by way of assert(cbb->child == NULL).
+    if (!out || out->child || !CBB_data(out)) {
+      OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
+      return false;
+    }
+
+    // ctx_ should not have been initialized (by e.g. a previous call
+    // to Offer()).
+    if (ctx_) {
+      OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+      return false;
+    }
+
+    // Initialize the KEM ctx
+    ctx_.reset(EVP_PKEY_CTX_new_id(EVP_PKEY_KEM, nullptr));
+    if (!ctx_ || !EVP_PKEY_CTX_kem_set_params(ctx_.get(), nid_)) {
+      OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+      return false;
+    }
+
+    // Generate a KEM keypair and retrieve the length of the public key
+    size_t public_key_len = 0;
+    EVP_PKEY *raw_key = nullptr;
+    if (!EVP_PKEY_keygen_init(ctx_.get()) ||
+        !EVP_PKEY_keygen(ctx_.get(), &raw_key) ||
+        !raw_key ||
+        !EVP_PKEY_get_raw_public_key(raw_key, nullptr, &public_key_len)) {
+      EVP_PKEY_free(raw_key);
+      OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+      return false;
+    }
+
+    // Retain the secret key for decapsulation
+    UniquePtr<EVP_PKEY> pkey(raw_key);
+    ctx_.reset(EVP_PKEY_CTX_new(pkey.get(), nullptr));
+    if (!ctx_) {
+      OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+      return false;
+    }
+
+    uint8_t *public_key = NULL;
+    size_t public_key_bytes_written = public_key_len;
+    if (!CBB_add_space(out, &public_key, public_key_len) ||
+        !EVP_PKEY_get_raw_public_key(pkey.get(), public_key,
+                                     &public_key_bytes_written) ||
+                                     public_key_bytes_written != public_key_len) {
+      OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+      return false;
+    }
+
+    return true;
+  }
+
+  // Because this is a KEM key share, |out_public_key| will be the ciphertext
+  // resulting from the encapsulation of the shared secret under the
+  // received public key, |peek_key|.
+  bool Accept(CBB *out_public_key, Array<uint8_t> *out_secret,
+              uint8_t *out_alert, Span<const uint8_t> peer_key) override {
+    // Basic nullptr checks
+    if (!out_alert) {
+      OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
+      return false;
+    }
+
+    // Set alert to internal error by default
+    *out_alert = SSL_AD_INTERNAL_ERROR;
+
+    if (!out_secret) {
+      OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
+      return false;
+    }
+
+    // Ensure |out_public_key| is valid, has no children, and has been
+    // initialized. We check that |out_public_key| has no children because
+    // otherwise CBB_data() will produce a fatal error by way of
+    // assert(cbb->child == NULL).
+    if (!out_public_key || out_public_key->child || !CBB_data(out_public_key)) {
+      OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
+      return false;
+    }
+
+    // ctx_ should not have been initialized (by e.g. a call to Offer()).
+    if (ctx_) {
+      OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+      return false;
+    }
+
+    // Ensure that peer_key is valid
+    if (!peer_key.data() || peer_key.empty()) {
+      *out_alert = SSL_AD_DECODE_ERROR;
+      OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+      return false;
+    }
+
+    // Initialize pkey from the received public key
+    UniquePtr<EVP_PKEY> pkey(
+      EVP_PKEY_kem_new_raw_public_key(nid_, peer_key.begin(), peer_key.size()));
+
+    if (!pkey) {
+      *out_alert = SSL_AD_DECODE_ERROR;
+      OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+      return false;
+    }
+
+    // Initialize the context with the pkey
+    ctx_.reset(EVP_PKEY_CTX_new(pkey.get(), nullptr));
+    if (!ctx_) {
+      OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+      return false;
+    }
+
+    // Retrieve the lengths of the ciphertext and shared secret
+    size_t ciphertext_len = 0;
+    size_t secret_len = 0;
+    if (!EVP_PKEY_encapsulate(ctx_.get(), nullptr, &ciphertext_len,
+                              nullptr, &secret_len)) {
+      OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+      return false;
+    }
+
+    // EVP_PKEY_encapsulate() will generate a shared secret, then encapsulate it
+    // with the peer's public key. We send the resultant ciphertext to the
+    // peer by writing it to |out_public_key|, then...
+    Array<uint8_t> shared_secret;
+    if (!shared_secret.Init(secret_len)) {
+      OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
+      return false;
+    }
+
+    uint8_t *ciphertext = NULL;
+    size_t ciphertext_bytes_written = ciphertext_len;
+    size_t secret_bytes_written = secret_len;
+
+    if (!CBB_add_space(out_public_key, &ciphertext, ciphertext_len) ||
+        !EVP_PKEY_encapsulate(ctx_.get(), ciphertext,
+                              &ciphertext_bytes_written, shared_secret.data(),
+                              &secret_bytes_written) ||
+                              ciphertext_bytes_written != ciphertext_len ||
+                              secret_bytes_written != secret_len) {
+      OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+      return false;
+    }
+
+    // ...we retain the shared secret for our own use.
+    *out_secret = std::move(shared_secret);
+
+    // Success; clear the alert
+    *out_alert = 0;
+    return true;
+  }
+
+  // Because this is a KEM key share, |peer_key| is actually the ciphertext
+  // resulting from the peer encapsulating the shared secret under our public key.
+  // In Finish(), we use our previously generated secret key to decrypt
+  // that ciphertext and obtain the shared secret.
+  bool Finish(Array<uint8_t> *out_secret, uint8_t *out_alert,
+              Span<const uint8_t> peer_key) override {
+    // Basic nullptr checks
+    if (!out_alert) {
+      OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
+      return false;
+    }
+
+    // Set alert to internal error by default
+    *out_alert = SSL_AD_INTERNAL_ERROR;
+
+    if (!out_secret) {
+      OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
+      return false;
+    }
+
+    // ctx_ should have been initialized by a previous call to Offer()
+    if (!ctx_) {
+      OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+      return false;
+    }
+
+    // Retrieve the length of the shared secret
+    size_t secret_len = 0;
+    if (!EVP_PKEY_decapsulate(ctx_.get(), nullptr, &secret_len, nullptr, peer_key.size())) {
+      OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+      return false;
+    }
+
+    // |peer_key| is the ciphertext, encapsulating the shared secret,
+    // that the peer generated using our public key. We use our secret
+    // key to decapsulate it, and retain the shared secret by writing
+    // it to |out_secret|.
+    uint8_t *ciphertext = (uint8_t *)peer_key.begin();
+    Array<uint8_t> shared_secret;
+    if (!shared_secret.Init(secret_len)) {
+      OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
+      return false;
+    }
+
+    size_t secret_bytes_written = secret_len;
+    if (!EVP_PKEY_decapsulate(ctx_.get(), shared_secret.data(),
+                              &secret_bytes_written, ciphertext,
+                              peer_key.size()) ||
+                              secret_bytes_written != secret_len) {
+      OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_KEM_CIPHERTEXT);
+      return false;
+    }
+
+    *out_secret = std::move(shared_secret);
+
+    // Success; clear the alert
+    *out_alert = 0;
+    return true;
+  }
+
+ private:
+  int nid_;
+  uint16_t group_id_;
+  UniquePtr<EVP_PKEY_CTX> ctx_;
+};
+
+// A HybridKeyShare consists of key shares from two or more component groups,
+// all of which are used to generate a hybrid shared secret.
+// See https://datatracker.ietf.org/doc/html/draft-ietf-tls-hybrid-design.
+class HybridKeyShare : public SSLKeyShare {
+  public:
+    HybridKeyShare(uint16_t group_id) : group_id_(group_id),
+    exchange_performed(false), hybrid_group_(nullptr) {
+      for (const HybridGroup &hybrid_group : HybridGroups()) {
+         if (group_id_ == hybrid_group.group_id) {
+           hybrid_group_ = &hybrid_group;
+           for (size_t i = 0; i < NUM_HYBRID_COMPONENTS; i++) {
+             key_shares_[i] = SSLKeyShare::Create(hybrid_group.component_group_ids[i]);
+           }
+           return;
+         }
+      }
+      hybrid_group_ = nullptr;
+    }
+
+    uint16_t GroupID() const override { return group_id_; }
+
+    bool Offer(CBB *out) override {
+      // Ensure |out| is valid, has no children, and has been initialized.
+      // We check that |out| has no children because otherwise CBB_data()
+      // will produce a fatal error by way of assert(cbb->child == NULL);
+      if (!out || out->child || !CBB_data(out)) {
+        OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
+        return false;
+      }
+
+      if (!hybrid_group_ || this->exchange_performed) {
+        OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+        return false;
+      }
+
+      // Iterate through the component groups and Offer() each of their key
+      // shares. If one of the calls to a component Offer() fails,
+      // OPENSSL_PUT_ERROR will be set appropriately in that component.
+      for (const UniquePtr<SSLKeyShare> &key_share : key_shares_) {
+        if (!key_share || !key_share->Offer(out)) {
+          return false;
+        }
+      }
+      this->exchange_performed = true;
+      return true;
+    }
+
+    bool Accept(CBB *out_public_key, Array<uint8_t> *out_secret,
+                uint8_t *out_alert, Span<const uint8_t> peer_key) override {
+      if (!out_alert) {
+        OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
+        return false;
+      }
+
+      // Set alert to internal error by default
+      *out_alert = SSL_AD_INTERNAL_ERROR;
+
+      if (!out_secret|| !peer_key.data()) {
+        OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
+        return false;
+      }
+
+      // Ensure |out_public_key| is valid, has no children, and has been
+      // initialized. We check that |out_public_key| has no children because
+      // otherwise CBB_data() will produce a fatal error by way of
+      // assert(cbb->child == NULL);
+      if (!out_public_key || out_public_key->child || !CBB_data(out_public_key)) {
+        OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
+        return false;
+      }
+
+      if (!hybrid_group_ || this->exchange_performed) {
+        OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+        return false;
+      }
+
+      // A hybrid shared secret with two components should be 64 bytes.
+      // If it happens to be larger, the CBB will grow accordingly.
+      CBB hybrid_shared_secret;
+      if (!CBB_init(&hybrid_shared_secret, 64)) {
+        OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+        return false;
+      }
+
+      // Accept() each component key share. Each component's Accept() function
+      // will generate a shared secret and a public key to be sent back to
+      // the peer. The hybrid public key is the concatenation of all component
+      // public keys; the hybrid shared secret is the concatenation of all
+      // component shared secrets.
+      size_t peer_key_read_index = 0;
+      for (size_t i = 0; i < NUM_HYBRID_COMPONENTS; i++) {
+        size_t component_key_size = 0;
+        if (!get_component_offer_key_share_size(&component_key_size, hybrid_group_->component_group_ids[i])) {
+          OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+          return false;
+        }
+
+        // Verify that |peer_key| contains enough data
+        if (peer_key_read_index + component_key_size > peer_key.size()) {
+          CBB_cleanup(&hybrid_shared_secret);
+          *out_alert = SSL_AD_DECODE_ERROR;
+          OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_HYBRID_KEYSHARE);
+          return false;
+        }
+
+        Span<const uint8_t> component_key =
+          peer_key.subspan(peer_key_read_index, component_key_size);
+
+        Array<uint8_t> component_secret;
+        if (!key_shares_[i] ||
+            !key_shares_[i]->Accept(out_public_key, &component_secret, out_alert, component_key) ||
+            !CBB_add_bytes(&hybrid_shared_secret, component_secret.data(), component_secret.size())) {
+          CBB_cleanup(&hybrid_shared_secret);
+          OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+          return false;
+        }
+
+        peer_key_read_index += component_key_size;
+      }
+
+      // Final validation that |peer_key| was the correct size
+      if (peer_key_read_index != peer_key.size()) {
+        CBB_cleanup(&hybrid_shared_secret);
+        *out_alert = SSL_AD_DECODE_ERROR;
+        OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+        return false;
+      }
+
+      // Retain the hybrid shared secret for our use.
+      if (!CBBFinishArray(&hybrid_shared_secret, out_secret)) {
+        CBB_cleanup(&hybrid_shared_secret);
+        OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+        return false;
+      }
+
+      // Success; clear the alert
+      *out_alert = 0;
+
+      this->exchange_performed = true;
+      return true;
+    }
+
+    bool Finish(Array<uint8_t> *out_secret, uint8_t *out_alert,
+                Span<const uint8_t> peer_key) override {
+      if (!out_alert) {
+        OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
+        return false;
+      }
+
+      // Set alert to internal error by default
+      *out_alert = SSL_AD_INTERNAL_ERROR;
+
+      if (!out_secret || !peer_key.data()) {
+        OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
+        return false;
+      }
+
+      if (!hybrid_group_ || !this->exchange_performed) {
+        OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+        return false;
+      }
+
+      // A hybrid shared secret with two components should be 64 bytes.
+      // If it happens to be larger, the CBB will grow accordingly.
+      CBB hybrid_shared_secret;
+      if (!CBB_init(&hybrid_shared_secret, 64)) {
+        OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+        return false;
+      }
+
+      // Finish() each component key share. Each component's Finish() function
+      // will generate a shared secret. The hybrid shared secret is the
+      // concatenation of all component shared secrets.
+      size_t peer_key_index = 0;
+      for (size_t i = 0; i < NUM_HYBRID_COMPONENTS; i++) {
+
+        size_t component_key_size = 0;
+        if (!get_component_accept_key_share_size(&component_key_size, hybrid_group_->component_group_ids[i])) {
+          OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+          return false;
+        }
+
+        // Verify that |peer_key| contains enough data
+        if (peer_key_index + component_key_size > peer_key.size()) {
+          CBB_cleanup(&hybrid_shared_secret);
+          *out_alert = SSL_AD_DECODE_ERROR;
+          OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+          return false;
+        }
+
+        Span<const uint8_t> component_key =
+          peer_key.subspan(peer_key_index, component_key_size);
+
+        Array<uint8_t> component_secret;
+        if (!key_shares_[i] ||
+            !key_shares_[i]->Finish(&component_secret, out_alert, component_key) ||
+            !CBB_add_bytes(&hybrid_shared_secret, component_secret.data(), component_secret.size())) {
+          CBB_cleanup(&hybrid_shared_secret);
+          OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+          return false;
+        }
+
+        peer_key_index += component_key_size;
+      }
+
+      // Final validation that |peer_key| was the correct size
+      if (peer_key_index != peer_key.size()) {
+        CBB_cleanup(&hybrid_shared_secret);
+        *out_alert = SSL_AD_DECODE_ERROR;
+        OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+        return false;
+      }
+
+      // Retain the hybrid shared secret for our use.
+      if (!CBBFinishArray(&hybrid_shared_secret, out_secret)) {
+        CBB_cleanup(&hybrid_shared_secret);
+        OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+        return false;
+      }
+
+      // Success; clear the alert
+      *out_alert = 0;
+      return true;
+    }
+
+  private:
+   // Only need to support SSL Groups that are a component of a supported HybridKeyShare
+   bool get_component_offer_key_share_size(size_t *out, uint16_t component_group_id) {
+     switch (component_group_id) {
+     case SSL_GROUP_SECP256R1:
+       *out = 1 + (2 * EC_P256R1_FIELD_ELEM_BYTES);
+       return true;
+     case SSL_GROUP_KYBER768_R3:
+       *out = KYBER768_R3_PUBLIC_KEY_BYTES;
+       return true;
+     case SSL_GROUP_X25519:
+       *out = 32;
+       return true;
+     default:
+       return false;
+     }
+   }
+
+   // Only need to support SSL Groups that are a component of a supported HybridKeyShare
+   bool get_component_accept_key_share_size(size_t *out, uint16_t component_group_id) {
+     switch (component_group_id) {
+     case SSL_GROUP_SECP256R1:
+       *out = 1 + (2 * EC_P256R1_FIELD_ELEM_BYTES);
+       return true;
+     case SSL_GROUP_KYBER768_R3:
+       *out = KYBER768_R3_CIPHERTEXT_BYTES;
+       return true;
+     case SSL_GROUP_X25519:
+       *out = 32;
+       return true;
+     default:
+       return false;
+     }
+   }
+
+   uint16_t group_id_;
+   bool exchange_performed;
+   const HybridGroup *hybrid_group_;
+   UniquePtr<SSLKeyShare> key_shares_[NUM_HYBRID_COMPONENTS];
+};
+
 CONSTEXPR_ARRAY NamedGroup kNamedGroups[] = {
     {NID_secp224r1, SSL_GROUP_SECP224R1, "P-224", "secp224r1"},
     {NID_X9_62_prime256v1, SSL_GROUP_SECP256R1, "P-256", "prime256v1"},
     {NID_secp384r1, SSL_GROUP_SECP384R1, "P-384", "secp384r1"},
     {NID_secp521r1, SSL_GROUP_SECP521R1, "P-521", "secp521r1"},
     {NID_X25519, SSL_GROUP_X25519, "X25519", "x25519"},
+    {NID_SecP256r1Kyber768Draft00, SSL_GROUP_SECP256R1_KYBER768_DRAFT00, "SecP256r1Kyber768Draft00", ""},
+    {NID_X25519Kyber768Draft00, SSL_GROUP_X25519_KYBER768_DRAFT00, "X25519Kyber768Draft00", ""},
+};
+
+CONSTEXPR_ARRAY uint16_t kPQGroups[] = {
+    SSL_GROUP_KYBER512_R3,
+    SSL_GROUP_KYBER768_R3,
+    SSL_GROUP_KYBER1024_R3,
+    SSL_GROUP_SECP256R1_KYBER768_DRAFT00,
+    SSL_GROUP_X25519_KYBER768_DRAFT00
 };
 
-}  // namespace
+CONSTEXPR_ARRAY HybridGroup kHybridGroups[] = {
+  {
+    SSL_GROUP_SECP256R1_KYBER768_DRAFT00,  // group_id
+    {
+      SSL_GROUP_SECP256R1,            // component_group_ids[0]
+      SSL_GROUP_KYBER768_R3,          // component_group_ids[1]
+    },
+  },
+
+  {
+    SSL_GROUP_X25519_KYBER768_DRAFT00,     // group_id
+    {
+      SSL_GROUP_X25519,               // component_group_ids[0]
+      SSL_GROUP_KYBER768_R3,          // component_group_ids[1]
+    },
+  }
+};
+
+} // namespace
 
 Span<const NamedGroup> NamedGroups() {
   return MakeConstSpan(kNamedGroups, OPENSSL_ARRAY_SIZE(kNamedGroups));
 }
 
+Span<const HybridGroup> HybridGroups() {
+  return MakeConstSpan(kHybridGroups, OPENSSL_ARRAY_SIZE(kHybridGroups));
+}
+
+Span<const uint16_t> PQGroups() {
+  return MakeConstSpan(kPQGroups, OPENSSL_ARRAY_SIZE(kPQGroups));
+}
+
 UniquePtr<SSLKeyShare> SSLKeyShare::Create(uint16_t group_id) {
   switch (group_id) {
     case SSL_GROUP_SECP224R1:
@@ -202,6 +734,14 @@ UniquePtr<SSLKeyShare> SSLKeyShare::Create(uint16_t group_id) {
       return MakeUnique<ECKeyShare>(NID_secp521r1, SSL_GROUP_SECP521R1);
     case SSL_GROUP_X25519:
       return MakeUnique<X25519KeyShare>();
+    case SSL_GROUP_KYBER768_R3:
+      // Kyber, as a standalone group, is not a NamedGroup; however, we
+      // need to create Kyber key shares as part of hybrid groups.
+      return MakeUnique<KEMKeyShare>(NID_KYBER768_R3, SSL_GROUP_KYBER768_R3);
+    case SSL_GROUP_SECP256R1_KYBER768_DRAFT00:
+      return MakeUnique<HybridKeyShare>(SSL_GROUP_SECP256R1_KYBER768_DRAFT00);
+    case SSL_GROUP_X25519_KYBER768_DRAFT00:
+      return MakeUnique<HybridKeyShare>(SSL_GROUP_X25519_KYBER768_DRAFT00);
     default:
       return nullptr;
   }
@@ -231,7 +771,7 @@ bool ssl_name_to_group_id(uint16_t *out_group_id, const char *name, size_t len)
       *out_group_id = group.group_id;
       return true;
     }
-    if (len == strlen(group.alias) &&
+    if ((strlen(group.alias) > 0) && len == strlen(group.alias) &&
         !strncmp(group.alias, name, len)) {
       *out_group_id = group.group_id;
       return true;

data/aws-crt-ffi/crt/aws-lc/ssl/ssl_lib.cc

@@ -2545,6 +2545,13 @@ const SSL_CIPHER *SSL_get_current_cipher(const SSL *ssl) {
   return session == nullptr ? nullptr : session->cipher;
 }
 
+STACK_OF(SSL_CIPHER) *SSL_get_client_ciphers(const SSL *ssl) {
+  if (ssl == NULL || ssl->s3 == NULL) {
+    return NULL;
+  }
+  return ssl->client_cipher_suites.get();
+}
+
 int SSL_session_reused(const SSL *ssl) {
   return ssl->s3->session_reused || SSL_in_early_data(ssl);
 }
@@ -3062,6 +3069,8 @@ int SSL_clear(SSL *ssl) {
     return 0;  // SSL_clear may not be used after shedding config.
   }
 
+  ssl->client_cipher_suites.reset();
+
   // In OpenSSL, reusing a client |SSL| with |SSL_clear| causes the previously
   // established session to be offered the next time around. wpa_supplicant
   // depends on this behavior, so emulate it.
@@ -3258,3 +3267,29 @@ int SSL_CTX_set_tlsext_status_arg(SSL_CTX *ctx, void *arg) {
   ctx->legacy_ocsp_callback_arg = arg;
   return 1;
 }
+
+uint16_t SSL_get_curve_id(const SSL *ssl) { return SSL_get_group_id(ssl); }
+
+const char *SSL_get_curve_name(uint16_t curve_id) {
+  return SSL_get_group_name(curve_id);
+}
+
+size_t SSL_get_all_curve_names(const char **out, size_t max_out) {
+  return SSL_get_all_group_names(out, max_out);
+}
+
+int SSL_CTX_set1_curves(SSL_CTX *ctx, const int *curves, size_t num_curves) {
+  return SSL_CTX_set1_groups(ctx, curves, num_curves);
+}
+
+int SSL_set1_curves(SSL *ssl, const int *curves, size_t num_curves) {
+  return SSL_set1_groups(ssl, curves, num_curves);
+}
+
+int SSL_CTX_set1_curves_list(SSL_CTX *ctx, const char *curves) {
+  return SSL_CTX_set1_groups_list(ctx, curves);
+}
+
+int SSL_set1_curves_list(SSL *ssl, const char *curves) {
+  return SSL_set1_groups_list(ssl, curves);
+}