aws-crt 0.1.9 → 0.2.0

data/aws-crt-ffi/crt/s2n/tls/s2n_post_handshake.h

@@ -31,3 +31,4 @@ struct s2n_post_handshake {
 S2N_RESULT s2n_post_handshake_recv(struct s2n_connection *conn);
 int s2n_post_handshake_send(struct s2n_connection *conn, s2n_blocked_status *blocked);
 S2N_RESULT s2n_post_handshake_write_records(struct s2n_connection *conn, s2n_blocked_status *blocked);
+S2N_RESULT s2n_post_handshake_process(struct s2n_connection *conn, struct s2n_stuffer *in, uint8_t message_type);

data/aws-crt-ffi/crt/s2n/tls/s2n_quic_support.c

@@ -90,6 +90,35 @@ int s2n_connection_set_secret_callback(struct s2n_connection *conn, s2n_secret_c
     return S2N_SUCCESS;
 }
 
+/* Currently we need an API that quic can call to process post-handshake messages. Ideally
+ * we could re-use the s2n_recv API but that function needs to be refactored to support quic.
+ * For now we just call this API.
+ */
+int s2n_recv_quic_post_handshake_message(struct s2n_connection *conn, s2n_blocked_status *blocked)
+{
+    POSIX_ENSURE_REF(conn);
+
+    *blocked = S2N_BLOCKED_ON_READ;
+
+    uint8_t message_type = 0;
+    /* This function uses the stuffer conn->handshake.io to read in the header. This stuffer is also used 
+     * for sending post-handshake messages. This could cause a concurrency issue if we start both sending
+     * and receiving post-handshake messages while quic is enabled. Currently there's no post-handshake
+     * message that is both sent and received in quic (servers only send session tickets
+     * and clients only receive session tickets.) Therefore it is safe for us
+     * to use the stuffer here.
+     */
+    POSIX_GUARD_RESULT(s2n_quic_read_handshake_message(conn, &message_type));
+
+    /* The only post-handshake messages we support from QUIC currently are session tickets */
+    POSIX_ENSURE(message_type == TLS_SERVER_NEW_SESSION_TICKET, S2N_ERR_UNSUPPORTED_WITH_QUIC);
+    POSIX_GUARD_RESULT(s2n_post_handshake_process(conn, &conn->in, message_type));
+
+    *blocked = S2N_NOT_BLOCKED;
+
+    return S2N_SUCCESS;
+}
+
 /* When using QUIC, S2N reads unencrypted handshake messages instead of encrypted records.
  * This method sets up the S2N input buffers to match the results of using s2n_read_full_record.
  */

data/aws-crt-ffi/crt/s2n/tls/s2n_quic_support.h

@@ -89,3 +89,8 @@ S2N_API int s2n_connection_set_secret_callback(struct s2n_connection *conn, s2n_
  * not relied on for production logic.
  */
 S2N_API int s2n_error_get_alert(int error, uint8_t *alert);
+
+/* Attempts to read and process a post-handshake message from QUIC. This function
+ * should be called when post-handshake messages in QUIC have been received.
+ */
+S2N_API int s2n_recv_quic_post_handshake_message(struct s2n_connection *conn, s2n_blocked_status *blocked);

data/aws-crt-ffi/crt/s2n/tls/s2n_security_policies.c

@@ -615,6 +615,42 @@ const struct s2n_security_policy security_policy_pq_tls_1_3_2023_06_01 = {
     .ecc_preferences = &s2n_ecc_preferences_20201021,
 };
 
+/* Same as security_policy_pq_tls_1_2_2023_04_07, but with updated KEM prefs */
+const struct s2n_security_policy security_policy_pq_tls_1_2_2023_10_07 = {
+    .minimum_protocol_version = S2N_TLS12,
+    .cipher_preferences = &cipher_preferences_pq_tls_1_1_2021_05_21,
+    .kem_preferences = &kem_preferences_pq_tls_1_3_2023_06,
+    .signature_preferences = &s2n_signature_preferences_20200207,
+    .ecc_preferences = &s2n_ecc_preferences_20200310,
+};
+
+/* Same as security_policy_pq_tls_1_2_2023_04_08, but with updated KEM prefs */
+const struct s2n_security_policy security_policy_pq_tls_1_2_2023_10_08 = {
+    .minimum_protocol_version = S2N_TLS12,
+    .cipher_preferences = &cipher_preferences_pq_tls_1_0_2021_05_22,
+    .kem_preferences = &kem_preferences_pq_tls_1_3_2023_06,
+    .signature_preferences = &s2n_signature_preferences_20200207,
+    .ecc_preferences = &s2n_ecc_preferences_20200310,
+};
+
+/* Same as security_policy_pq_tls_1_2_2023_04_09, but with updated KEM prefs */
+const struct s2n_security_policy security_policy_pq_tls_1_2_2023_10_09 = {
+    .minimum_protocol_version = S2N_TLS12,
+    .cipher_preferences = &cipher_preferences_pq_tls_1_0_2021_05_24,
+    .kem_preferences = &kem_preferences_pq_tls_1_3_2023_06,
+    .signature_preferences = &s2n_signature_preferences_20200207,
+    .ecc_preferences = &s2n_ecc_preferences_20200310,
+};
+
+/* Same as security_policy_pq_tls_1_2_2023_04_10, but with updated KEM prefs */
+const struct s2n_security_policy security_policy_pq_tls_1_2_2023_10_10 = {
+    .minimum_protocol_version = S2N_TLS12,
+    .cipher_preferences = &cipher_preferences_pq_tls_1_0_2021_05_26,
+    .kem_preferences = &kem_preferences_pq_tls_1_3_2023_06,
+    .signature_preferences = &s2n_signature_preferences_20200207,
+    .ecc_preferences = &s2n_ecc_preferences_20200310,
+};
+
 const struct s2n_security_policy security_policy_kms_fips_tls_1_2_2018_10 = {
     .minimum_protocol_version = S2N_TLS12,
     .cipher_preferences = &cipher_preferences_kms_fips_tls_1_2_2018_10,
@@ -960,6 +996,10 @@ struct s2n_security_policy_selection security_policy_selection[] = {
     { .version = "PQ-TLS-1-2-2023-04-09", .security_policy = &security_policy_pq_tls_1_2_2023_04_09, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
     { .version = "PQ-TLS-1-2-2023-04-10", .security_policy = &security_policy_pq_tls_1_2_2023_04_10, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
     { .version = "PQ-TLS-1-3-2023-06-01", .security_policy = &security_policy_pq_tls_1_3_2023_06_01, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
+    { .version = "PQ-TLS-1-2-2023-10-07", .security_policy = &security_policy_pq_tls_1_2_2023_10_07, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
+    { .version = "PQ-TLS-1-2-2023-10-08", .security_policy = &security_policy_pq_tls_1_2_2023_10_08, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
+    { .version = "PQ-TLS-1-2-2023-10-09", .security_policy = &security_policy_pq_tls_1_2_2023_10_09, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
+    { .version = "PQ-TLS-1-2-2023-10-10", .security_policy = &security_policy_pq_tls_1_2_2023_10_10, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
     { .version = "20140601", .security_policy = &security_policy_20140601, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
     { .version = "20141001", .security_policy = &security_policy_20141001, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },
     { .version = "20150202", .security_policy = &security_policy_20150202, .ecc_extension_required = 0, .pq_kem_extension_required = 0 },

data/aws-crt-ffi/crt/s2n/tls/s2n_security_policies.h

@@ -151,6 +151,10 @@ extern const struct s2n_security_policy security_policy_pq_tls_1_2_2023_04_08;
 extern const struct s2n_security_policy security_policy_pq_tls_1_2_2023_04_09;
 extern const struct s2n_security_policy security_policy_pq_tls_1_2_2023_04_10;
 extern const struct s2n_security_policy security_policy_pq_tls_1_3_2023_06_01;
+extern const struct s2n_security_policy security_policy_pq_tls_1_2_2023_10_07;
+extern const struct s2n_security_policy security_policy_pq_tls_1_2_2023_10_08;
+extern const struct s2n_security_policy security_policy_pq_tls_1_2_2023_10_09;
+extern const struct s2n_security_policy security_policy_pq_tls_1_2_2023_10_10;
 
 extern const struct s2n_security_policy security_policy_cloudfront_upstream;
 extern const struct s2n_security_policy security_policy_cloudfront_upstream_tls10;

data/aws-crt-ffi/crt/s2n/tls/s2n_server_cert_request.c

@@ -172,7 +172,7 @@ int s2n_cert_req_send(struct s2n_connection *conn)
     }
 
     if (conn->actual_protocol_version == S2N_TLS12) {
-        POSIX_GUARD(s2n_send_supported_sig_scheme_list(conn, out));
+        POSIX_GUARD_RESULT(s2n_signature_algorithms_supported_list_send(conn, out));
     }
 
     /* RFC 5246 7.4.4 - If the certificate_authorities list is empty, then the

data/aws-crt-ffi/crt/s2n/tls/s2n_server_hello.c

@@ -286,9 +286,6 @@ int s2n_server_hello_recv(struct s2n_connection *conn)
         POSIX_GUARD(s2n_prf_key_expansion(conn));
     }
 
-    /* Choose a default signature scheme */
-    POSIX_GUARD(s2n_choose_default_sig_scheme(conn, &conn->handshake_params.conn_sig_scheme, S2N_SERVER));
-
     /* Update the required hashes for this connection */
     POSIX_GUARD(s2n_conn_update_required_handshake_hashes(conn));
 

data/aws-crt-ffi/crt/s2n/tls/s2n_server_key_exchange.c

@@ -48,12 +48,9 @@ int s2n_server_key_recv(struct s2n_connection *conn)
     struct s2n_kex_raw_server_data kex_data = { 0 };
     POSIX_GUARD_RESULT(s2n_kex_server_key_recv_read_data(key_exchange, conn, &data_to_verify, &kex_data));
 
-    /* Add common signature data */
-    struct s2n_signature_scheme *active_sig_scheme = &conn->handshake_params.conn_sig_scheme;
-    if (conn->actual_protocol_version == S2N_TLS12) {
-        /* Verify the SigScheme picked by the Server was in the preference list we sent (or is the default SigScheme) */
-        POSIX_GUARD(s2n_get_and_validate_negotiated_signature_scheme(conn, in, active_sig_scheme));
-    }
+    POSIX_GUARD_RESULT(s2n_signature_algorithm_recv(conn, in));
+    const struct s2n_signature_scheme *active_sig_scheme = conn->handshake_params.server_cert_sig_scheme;
+    POSIX_ENSURE_REF(active_sig_scheme);
 
     /* FIPS specifically allows MD5 for <TLS1.2 */
     if (s2n_is_in_fips_mode() && conn->actual_protocol_version < S2N_TLS12) {
@@ -257,6 +254,8 @@ int s2n_server_key_send(struct s2n_connection *conn)
 
     struct s2n_hash_state *signature_hash = &conn->handshake.hashes->hash_workspace;
     const struct s2n_kex *key_exchange = conn->secure->cipher_suite->key_exchange_alg;
+    const struct s2n_signature_scheme *sig_scheme = conn->handshake_params.server_cert_sig_scheme;
+    POSIX_ENSURE_REF(sig_scheme);
     struct s2n_stuffer *out = &conn->handshake.io;
     struct s2n_blob data_to_sign = { 0 };
 
@@ -265,7 +264,7 @@ int s2n_server_key_send(struct s2n_connection *conn)
 
     /* Add common signature data */
     if (conn->actual_protocol_version == S2N_TLS12) {
-        POSIX_GUARD(s2n_stuffer_write_uint16(out, conn->handshake_params.conn_sig_scheme.iana_value));
+        POSIX_GUARD(s2n_stuffer_write_uint16(out, sig_scheme->iana_value));
     }
 
     /* FIPS specifically allows MD5 for <TLS1.2 */
@@ -274,14 +273,14 @@ int s2n_server_key_send(struct s2n_connection *conn)
     }
 
     /* Add the random data to the hash */
-    POSIX_GUARD(s2n_hash_init(signature_hash, conn->handshake_params.conn_sig_scheme.hash_alg));
+    POSIX_GUARD(s2n_hash_init(signature_hash, sig_scheme->hash_alg));
     POSIX_GUARD(s2n_hash_update(signature_hash, conn->handshake_params.client_random, S2N_TLS_RANDOM_DATA_LEN));
     POSIX_GUARD(s2n_hash_update(signature_hash, conn->handshake_params.server_random, S2N_TLS_RANDOM_DATA_LEN));
 
     /* Add KEX specific data to the hash */
     POSIX_GUARD(s2n_hash_update(signature_hash, data_to_sign.data, data_to_sign.size));
 
-    S2N_ASYNC_PKEY_SIGN(conn, conn->handshake_params.conn_sig_scheme.sig_alg, signature_hash,
+    S2N_ASYNC_PKEY_SIGN(conn, sig_scheme->sig_alg, signature_hash,
             s2n_server_key_send_write_signature);
 }
 

data/aws-crt-ffi/crt/s2n/tls/s2n_server_new_session_ticket.c

@@ -126,6 +126,14 @@ S2N_RESULT s2n_tls13_server_nst_send(struct s2n_connection *conn, s2n_blocked_st
         return S2N_RESULT_OK;
     }
 
+    /* Legacy behavior is that the s2n server sends a NST even if the client did not indicate support
+     * for resumption or does not support the psk_dhe_ke mode. This is potentially wasteful so we 
+     * choose to not extend this behavior to QUIC.
+     */
+    if (conn->quic_enabled && conn->psk_params.psk_ke_mode != S2N_PSK_DHE_KE) {
+        return S2N_RESULT_OK;
+    }
+
     /* No-op if all tickets already sent.
      * Clean up the stuffer used for the ticket to conserve memory. */
     if (conn->tickets_to_send == conn->tickets_sent) {

data/aws-crt-ffi/crt/s2n/tls/s2n_signature_algorithms.c

@@ -26,49 +26,66 @@
 #include "tls/s2n_signature_scheme.h"
 #include "utils/s2n_safety.h"
 
-static int s2n_signature_scheme_valid_to_offer(struct s2n_connection *conn, const struct s2n_signature_scheme *scheme)
+static S2N_RESULT s2n_signature_scheme_validate_for_send(struct s2n_connection *conn,
+        const struct s2n_signature_scheme *scheme)
 {
-    POSIX_ENSURE_REF(conn);
+    RESULT_ENSURE_REF(conn);
 
-    /* We don't know what protocol version we will eventually negotiate, but we know that it won't be any higher. */
-    POSIX_ENSURE_GTE(conn->actual_protocol_version, scheme->minimum_protocol_version);
+    /* If no protocol has been negotiated yet, the actual_protocol_version will
+     * be equivalent to the client_protocol_version and represent the highest
+     * version supported.
+     */
+    RESULT_ENSURE_GTE(conn->actual_protocol_version, scheme->minimum_protocol_version);
 
     /* QUIC only supports TLS1.3 */
     if (s2n_connection_is_quic_enabled(conn) && scheme->maximum_protocol_version) {
-        POSIX_ENSURE_GTE(scheme->maximum_protocol_version, S2N_TLS13);
+        RESULT_ENSURE_GTE(scheme->maximum_protocol_version, S2N_TLS13);
     }
 
     if (!s2n_is_rsa_pss_signing_supported()) {
-        POSIX_ENSURE_NE(scheme->sig_alg, S2N_SIGNATURE_RSA_PSS_RSAE);
+        RESULT_ENSURE_NE(scheme->sig_alg, S2N_SIGNATURE_RSA_PSS_RSAE);
     }
 
     if (!s2n_is_rsa_pss_certs_supported()) {
-        POSIX_ENSURE_NE(scheme->sig_alg, S2N_SIGNATURE_RSA_PSS_PSS);
+        RESULT_ENSURE_NE(scheme->sig_alg, S2N_SIGNATURE_RSA_PSS_PSS);
     }
 
-    return 0;
+    return S2N_RESULT_OK;
 }
 
-static int s2n_signature_scheme_valid_to_accept(struct s2n_connection *conn, const struct s2n_signature_scheme *scheme)
+static bool s2n_signature_scheme_is_valid_for_send(struct s2n_connection *conn,
+        const struct s2n_signature_scheme *scheme)
 {
-    POSIX_ENSURE_REF(scheme);
-    POSIX_ENSURE_REF(conn);
+    return s2n_result_is_ok(s2n_signature_scheme_validate_for_send(conn, scheme));
+}
+
+static S2N_RESULT s2n_signature_scheme_validate_for_recv(struct s2n_connection *conn,
+        const struct s2n_signature_scheme *scheme)
+{
+    RESULT_ENSURE_REF(scheme);
+    RESULT_ENSURE_REF(conn);
 
-    POSIX_GUARD(s2n_signature_scheme_valid_to_offer(conn, scheme));
+    RESULT_GUARD(s2n_signature_scheme_validate_for_send(conn, scheme));
 
     if (scheme->maximum_protocol_version != S2N_UNKNOWN_PROTOCOL_VERSION) {
-        POSIX_ENSURE_LTE(conn->actual_protocol_version, scheme->maximum_protocol_version);
+        RESULT_ENSURE_LTE(conn->actual_protocol_version, scheme->maximum_protocol_version);
     }
 
-    POSIX_ENSURE_NE(conn->actual_protocol_version, S2N_UNKNOWN_PROTOCOL_VERSION);
+    RESULT_ENSURE_NE(conn->actual_protocol_version, S2N_UNKNOWN_PROTOCOL_VERSION);
     if (conn->actual_protocol_version >= S2N_TLS13) {
-        POSIX_ENSURE_NE(scheme->hash_alg, S2N_HASH_SHA1);
-        POSIX_ENSURE_NE(scheme->sig_alg, S2N_SIGNATURE_RSA);
+        RESULT_ENSURE_NE(scheme->hash_alg, S2N_HASH_SHA1);
+        RESULT_ENSURE_NE(scheme->sig_alg, S2N_SIGNATURE_RSA);
     } else {
-        POSIX_ENSURE_NE(scheme->sig_alg, S2N_SIGNATURE_RSA_PSS_PSS);
+        RESULT_ENSURE_NE(scheme->sig_alg, S2N_SIGNATURE_RSA_PSS_PSS);
     }
 
-    return 0;
+    return S2N_RESULT_OK;
+}
+
+static bool s2n_signature_scheme_is_valid_for_recv(struct s2n_connection *conn,
+        const struct s2n_signature_scheme *scheme)
+{
+    return s2n_result_is_ok(s2n_signature_scheme_validate_for_recv(conn, scheme));
 }
 
 static int s2n_is_signature_scheme_usable(struct s2n_connection *conn, const struct s2n_signature_scheme *candidate)
@@ -76,14 +93,14 @@ static int s2n_is_signature_scheme_usable(struct s2n_connection *conn, const str
     POSIX_ENSURE_REF(conn);
     POSIX_ENSURE_REF(candidate);
 
-    POSIX_GUARD(s2n_signature_scheme_valid_to_accept(conn, candidate));
+    POSIX_GUARD_RESULT(s2n_signature_scheme_validate_for_recv(conn, candidate));
     POSIX_GUARD(s2n_is_sig_scheme_valid_for_auth(conn, candidate));
 
     return S2N_SUCCESS;
 }
 
 static int s2n_choose_sig_scheme(struct s2n_connection *conn, struct s2n_sig_scheme_list *peer_wire_prefs,
-        struct s2n_signature_scheme *chosen_scheme_out)
+        const struct s2n_signature_scheme **chosen_scheme_out)
 {
     POSIX_ENSURE_REF(conn);
     POSIX_ENSURE_REF(conn->secure);
@@ -105,7 +122,7 @@ static int s2n_choose_sig_scheme(struct s2n_connection *conn, struct s2n_sig_sch
             uint16_t their_iana_val = peer_wire_prefs->iana_list[j];
 
             if (candidate->iana_value == their_iana_val) {
-                *chosen_scheme_out = *candidate;
+                *chosen_scheme_out = candidate;
                 return S2N_SUCCESS;
             }
         }
@@ -116,7 +133,8 @@ static int s2n_choose_sig_scheme(struct s2n_connection *conn, struct s2n_sig_sch
 }
 
 /* similar to s2n_choose_sig_scheme() without matching client's preference */
-int s2n_tls13_default_sig_scheme(struct s2n_connection *conn, struct s2n_signature_scheme *chosen_scheme_out)
+int s2n_tls13_default_sig_scheme(struct s2n_connection *conn,
+        const struct s2n_signature_scheme **chosen_scheme_out)
 {
     POSIX_ENSURE_REF(conn);
     POSIX_ENSURE_REF(conn->secure);
@@ -135,40 +153,81 @@ int s2n_tls13_default_sig_scheme(struct s2n_connection *conn, struct s2n_signatu
             continue;
         }
 
-        *chosen_scheme_out = *candidate;
+        *chosen_scheme_out = candidate;
         return S2N_SUCCESS;
     }
 
     POSIX_BAIL(S2N_ERR_INVALID_SIGNATURE_SCHEME);
 }
 
-int s2n_get_and_validate_negotiated_signature_scheme(struct s2n_connection *conn, struct s2n_stuffer *in,
-        struct s2n_signature_scheme *chosen_sig_scheme)
+static S2N_RESULT s2n_signature_algorithms_get_legacy_default(struct s2n_connection *conn,
+        const struct s2n_signature_scheme **default_sig_scheme)
+{
+    RESULT_ENSURE_REF(conn);
+    RESULT_ENSURE_REF(default_sig_scheme);
+
+    s2n_authentication_method auth_method = 0;
+    if (conn->mode == S2N_SERVER) {
+        RESULT_GUARD_POSIX(s2n_get_auth_method_for_cert_type(
+                conn->handshake_params.client_cert_pkey_type, &auth_method));
+    } else {
+        RESULT_ENSURE_REF(conn->secure);
+        RESULT_ENSURE_REF(conn->secure->cipher_suite);
+        auth_method = conn->secure->cipher_suite->auth_method;
+    }
+
+    if (auth_method == S2N_AUTHENTICATION_ECDSA) {
+        *default_sig_scheme = &s2n_ecdsa_sha1;
+    } else {
+        *default_sig_scheme = &s2n_rsa_pkcs1_md5_sha1;
+    }
+    return S2N_RESULT_OK;
+}
+
+S2N_RESULT s2n_signature_algorithm_recv(struct s2n_connection *conn, struct s2n_stuffer *in)
 {
-    uint16_t actual_iana_val;
-    POSIX_GUARD(s2n_stuffer_read_uint16(in, &actual_iana_val));
+    RESULT_ENSURE_REF(conn);
+
+    const struct s2n_signature_scheme **chosen_sig_scheme = NULL;
+    if (conn->mode == S2N_SERVER) {
+        chosen_sig_scheme = &conn->handshake_params.client_cert_sig_scheme;
+    } else {
+        chosen_sig_scheme = &conn->handshake_params.server_cert_sig_scheme;
+    }
+
+    /* Before TLS1.2, signature algorithms were fixed instead of negotiated */
+    if (conn->actual_protocol_version < S2N_TLS12) {
+        return s2n_signature_algorithms_get_legacy_default(conn, chosen_sig_scheme);
+    }
+
+    uint16_t iana_value = 0;
+    RESULT_ENSURE(s2n_stuffer_read_uint16(in, &iana_value) == S2N_SUCCESS,
+            S2N_ERR_BAD_MESSAGE);
 
     const struct s2n_signature_preferences *signature_preferences = NULL;
-    POSIX_GUARD(s2n_connection_get_signature_preferences(conn, &signature_preferences));
-    POSIX_ENSURE_REF(signature_preferences);
+    RESULT_GUARD_POSIX(s2n_connection_get_signature_preferences(conn, &signature_preferences));
+    RESULT_ENSURE_REF(signature_preferences);
 
     for (size_t i = 0; i < signature_preferences->count; i++) {
         const struct s2n_signature_scheme *candidate = signature_preferences->signature_schemes[i];
 
-        if (0 != s2n_signature_scheme_valid_to_accept(conn, candidate)) {
+        if (candidate->iana_value != iana_value) {
             continue;
         }
 
-        if (candidate->iana_value == actual_iana_val) {
-            *chosen_sig_scheme = *candidate;
-            return S2N_SUCCESS;
+        if (!s2n_signature_scheme_is_valid_for_recv(conn, candidate)) {
+            continue;
         }
+
+        *chosen_sig_scheme = candidate;
+        return S2N_RESULT_OK;
     }
 
-    POSIX_BAIL(S2N_ERR_INVALID_SIGNATURE_SCHEME);
+    RESULT_BAIL(S2N_ERR_INVALID_SIGNATURE_SCHEME);
 }
 
-int s2n_choose_default_sig_scheme(struct s2n_connection *conn, struct s2n_signature_scheme *sig_scheme_out, s2n_mode signer)
+int s2n_choose_default_sig_scheme(struct s2n_connection *conn,
+        const struct s2n_signature_scheme **sig_scheme_out, s2n_mode signer)
 {
     POSIX_ENSURE_REF(conn);
     POSIX_ENSURE_REF(conn->secure);
@@ -194,7 +253,7 @@ int s2n_choose_default_sig_scheme(struct s2n_connection *conn, struct s2n_signat
 
     if (conn->actual_protocol_version < S2N_TLS12) {
         /* Before TLS1.2, signature algorithms were fixed, not chosen / negotiated. */
-        *sig_scheme_out = *default_sig_scheme;
+        *sig_scheme_out = default_sig_scheme;
         return S2N_SUCCESS;
     } else {
         /* If we attempt to negotiate a default in TLS1.2, we should ensure that
@@ -205,7 +264,7 @@ int s2n_choose_default_sig_scheme(struct s2n_connection *conn, struct s2n_signat
         POSIX_ENSURE_REF(signature_preferences);
         for (size_t i = 0; i < signature_preferences->count; i++) {
             if (signature_preferences->signature_schemes[i]->iana_value == default_sig_scheme->iana_value) {
-                *sig_scheme_out = *default_sig_scheme;
+                *sig_scheme_out = default_sig_scheme;
                 return S2N_SUCCESS;
             }
         }
@@ -214,22 +273,19 @@ int s2n_choose_default_sig_scheme(struct s2n_connection *conn, struct s2n_signat
          * is actually necessary.
          * If no valid default exists, set an unusable, invalid empty scheme.
          */
-        *sig_scheme_out = (struct s2n_signature_scheme){
-            .hash_alg = S2N_HASH_NONE,
-            .sig_alg = S2N_SIGNATURE_ANONYMOUS,
-        };
+        *sig_scheme_out = &s2n_null_sig_scheme;
         return S2N_SUCCESS;
     }
-
 }
 
-int s2n_choose_sig_scheme_from_peer_preference_list(struct s2n_connection *conn, struct s2n_sig_scheme_list *peer_wire_prefs,
-        struct s2n_signature_scheme *sig_scheme_out)
+int s2n_choose_sig_scheme_from_peer_preference_list(struct s2n_connection *conn,
+        struct s2n_sig_scheme_list *peer_wire_prefs,
+        const struct s2n_signature_scheme **sig_scheme_out)
 {
     POSIX_ENSURE_REF(conn);
     POSIX_ENSURE_REF(sig_scheme_out);
 
-    struct s2n_signature_scheme chosen_scheme = { 0 };
+    const struct s2n_signature_scheme *chosen_scheme = &s2n_null_sig_scheme;
     if (conn->actual_protocol_version < S2N_TLS13) {
         POSIX_GUARD(s2n_choose_default_sig_scheme(conn, &chosen_scheme, conn->mode));
     } else {
@@ -247,42 +303,25 @@ int s2n_choose_sig_scheme_from_peer_preference_list(struct s2n_connection *conn,
     return S2N_SUCCESS;
 }
 
-int s2n_send_supported_sig_scheme_list(struct s2n_connection *conn, struct s2n_stuffer *out)
+S2N_RESULT s2n_signature_algorithms_supported_list_send(struct s2n_connection *conn, struct s2n_stuffer *out)
 {
     const struct s2n_signature_preferences *signature_preferences = NULL;
-    POSIX_GUARD(s2n_connection_get_signature_preferences(conn, &signature_preferences));
-    POSIX_ENSURE_REF(signature_preferences);
+    RESULT_GUARD_POSIX(s2n_connection_get_signature_preferences(conn, &signature_preferences));
+    RESULT_ENSURE_REF(signature_preferences);
 
-    POSIX_GUARD(s2n_stuffer_write_uint16(out, s2n_supported_sig_scheme_list_size(conn)));
+    struct s2n_stuffer_reservation size = { 0 };
+    RESULT_GUARD_POSIX(s2n_stuffer_reserve_uint16(out, &size));
 
     for (size_t i = 0; i < signature_preferences->count; i++) {
         const struct s2n_signature_scheme *const scheme = signature_preferences->signature_schemes[i];
-        if (0 == s2n_signature_scheme_valid_to_offer(conn, scheme)) {
-            POSIX_GUARD(s2n_stuffer_write_uint16(out, scheme->iana_value));
+        RESULT_ENSURE_REF(scheme);
+        if (s2n_signature_scheme_is_valid_for_send(conn, scheme)) {
+            RESULT_GUARD_POSIX(s2n_stuffer_write_uint16(out, scheme->iana_value));
         }
     }
+    RESULT_GUARD_POSIX(s2n_stuffer_write_vector_size(&size));
 
-    return 0;
-}
-
-int s2n_supported_sig_scheme_list_size(struct s2n_connection *conn)
-{
-    return s2n_supported_sig_schemes_count(conn) * TLS_SIGNATURE_SCHEME_LEN;
-}
-
-int s2n_supported_sig_schemes_count(struct s2n_connection *conn)
-{
-    const struct s2n_signature_preferences *signature_preferences = NULL;
-    POSIX_GUARD(s2n_connection_get_signature_preferences(conn, &signature_preferences));
-    POSIX_ENSURE_REF(signature_preferences);
-
-    uint8_t count = 0;
-    for (size_t i = 0; i < signature_preferences->count; i++) {
-        if (0 == s2n_signature_scheme_valid_to_offer(conn, signature_preferences->signature_schemes[i])) {
-            count++;
-        }
-    }
-    return count;
+    return S2N_RESULT_OK;
 }
 
 int s2n_recv_supported_sig_scheme_list(struct s2n_stuffer *in, struct s2n_sig_scheme_list *sig_hash_algs)

data/aws-crt-ffi/crt/s2n/tls/s2n_signature_algorithms.h

@@ -28,15 +28,17 @@ struct s2n_sig_scheme_list {
     uint8_t len;
 };
 
-int s2n_choose_default_sig_scheme(struct s2n_connection *conn, struct s2n_signature_scheme *sig_scheme_out, s2n_mode signer);
-int s2n_tls13_default_sig_scheme(struct s2n_connection *conn, struct s2n_signature_scheme *sig_scheme_out);
+int s2n_choose_default_sig_scheme(struct s2n_connection *conn,
+        const struct s2n_signature_scheme **sig_scheme_out, s2n_mode signer);
+int s2n_tls13_default_sig_scheme(struct s2n_connection *conn,
+        const struct s2n_signature_scheme **sig_scheme_out);
 
-int s2n_choose_sig_scheme_from_peer_preference_list(struct s2n_connection *conn, struct s2n_sig_scheme_list *sig_hash_algs,
-        struct s2n_signature_scheme *sig_scheme_out);
-int s2n_get_and_validate_negotiated_signature_scheme(struct s2n_connection *conn, struct s2n_stuffer *in,
-        struct s2n_signature_scheme *chosen_sig_scheme);
+int s2n_choose_sig_scheme_from_peer_preference_list(struct s2n_connection *conn,
+        struct s2n_sig_scheme_list *sig_hash_algs,
+        const struct s2n_signature_scheme **sig_scheme_out);
+
+S2N_RESULT s2n_signature_algorithm_recv(struct s2n_connection *conn, struct s2n_stuffer *in);
 
 int s2n_recv_supported_sig_scheme_list(struct s2n_stuffer *in, struct s2n_sig_scheme_list *sig_hash_algs);
-int s2n_send_supported_sig_scheme_list(struct s2n_connection *conn, struct s2n_stuffer *out);
-int s2n_supported_sig_schemes_count(struct s2n_connection *conn);
-int s2n_supported_sig_scheme_list_size(struct s2n_connection *conn);
+S2N_RESULT s2n_signature_algorithms_supported_list_send(struct s2n_connection *conn,
+        struct s2n_stuffer *out);

data/aws-crt-ffi/crt/s2n/tls/s2n_signature_scheme.c

@@ -22,6 +22,15 @@
 #include "tls/s2n_connection.h"
 #include "utils/s2n_safety.h"
 
+const struct s2n_signature_scheme s2n_null_sig_scheme = {
+    .iana_value = 0,
+    .hash_alg = S2N_HASH_NONE,
+    .sig_alg = S2N_SIGNATURE_ANONYMOUS,
+    .libcrypto_nid = 0,
+    .signature_curve = NULL,
+    .maximum_protocol_version = 0,
+};
+
 /* RSA PKCS1 */
 const struct s2n_signature_scheme s2n_rsa_pkcs1_md5_sha1 = {
     .iana_value = TLS_SIGNATURE_SCHEME_PRIVATE_INTERNAL_RSA_PKCS1_MD5_SHA1,

data/aws-crt-ffi/crt/s2n/tls/s2n_signature_scheme.h

@@ -39,6 +39,8 @@ struct s2n_signature_preferences {
     const struct s2n_signature_scheme *const *signature_schemes;
 };
 
+extern const struct s2n_signature_scheme s2n_null_sig_scheme;
+
 /* RSA PKCS1 */
 /* s2n_rsa_pkcs1_md5_sha1 is not in any preference list, but it is needed since it's the default for TLS 1.0 and 1.1 if
  * no SignatureScheme is sent. */

data/aws-crt-ffi/crt/s2n/tls/s2n_tls13_certificate_verify.c

@@ -49,12 +49,12 @@ const uint8_t S2N_CLIENT_CERT_VERIFY_CONTEXT[] = { 0x54, 0x4c, 0x53, 0x20, 0x31,
     0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x00 };
 
 static int s2n_tls13_write_cert_verify_signature(struct s2n_connection *conn,
-        struct s2n_signature_scheme *chosen_sig_scheme);
+        const struct s2n_signature_scheme *chosen_sig_scheme);
 static int s2n_tls13_write_signature(struct s2n_connection *conn, struct s2n_blob *signature);
 static int s2n_tls13_generate_unsigned_cert_verify_content(struct s2n_connection *conn,
         struct s2n_stuffer *unsigned_content, s2n_mode mode);
 static int s2n_tls13_cert_read_and_verify_signature(struct s2n_connection *conn,
-        struct s2n_signature_scheme *chosen_sig_scheme);
+        const struct s2n_signature_scheme *chosen_sig_scheme);
 static uint8_t s2n_tls13_cert_verify_header_length(s2n_mode mode);
 
 int s2n_tls13_cert_verify_send(struct s2n_connection *conn)
@@ -63,16 +63,17 @@ int s2n_tls13_cert_verify_send(struct s2n_connection *conn)
 
     if (conn->mode == S2N_SERVER) {
         /* Write digital signature */
-        POSIX_GUARD(s2n_tls13_write_cert_verify_signature(conn, &conn->handshake_params.conn_sig_scheme));
+        POSIX_GUARD(s2n_tls13_write_cert_verify_signature(conn, conn->handshake_params.server_cert_sig_scheme));
     } else {
         /* Write digital signature */
-        POSIX_GUARD(s2n_tls13_write_cert_verify_signature(conn, &conn->handshake_params.client_cert_sig_scheme));
+        POSIX_GUARD(s2n_tls13_write_cert_verify_signature(conn, conn->handshake_params.client_cert_sig_scheme));
     }
 
     return 0;
 }
 
-int s2n_tls13_write_cert_verify_signature(struct s2n_connection *conn, struct s2n_signature_scheme *chosen_sig_scheme)
+int s2n_tls13_write_cert_verify_signature(struct s2n_connection *conn,
+        const struct s2n_signature_scheme *chosen_sig_scheme)
 {
     POSIX_ENSURE_REF(conn->handshake_params.our_chain_and_key);
 
@@ -144,28 +145,21 @@ uint8_t s2n_tls13_cert_verify_header_length(s2n_mode mode)
 
 int s2n_tls13_cert_verify_recv(struct s2n_connection *conn)
 {
+    POSIX_GUARD_RESULT(s2n_signature_algorithm_recv(conn, &conn->handshake.io));
+    /* Read the rest of the signature and verify */
     if (conn->mode == S2N_SERVER) {
-        /* Read the algorithm and update sig_scheme */
-        POSIX_GUARD(s2n_get_and_validate_negotiated_signature_scheme(conn, &conn->handshake.io,
-                &conn->handshake_params.client_cert_sig_scheme));
-
-        /* Read the rest of the signature and verify */
         POSIX_GUARD(s2n_tls13_cert_read_and_verify_signature(conn,
-                &conn->handshake_params.client_cert_sig_scheme));
+                conn->handshake_params.client_cert_sig_scheme));
     } else {
-        /* Read the algorithm and update sig_scheme */
-        POSIX_GUARD(s2n_get_and_validate_negotiated_signature_scheme(conn, &conn->handshake.io,
-                &conn->handshake_params.conn_sig_scheme));
-
-        /* Read the rest of the signature and verify */
-        POSIX_GUARD(s2n_tls13_cert_read_and_verify_signature(conn, &conn->handshake_params.conn_sig_scheme));
+        POSIX_GUARD(s2n_tls13_cert_read_and_verify_signature(conn,
+                conn->handshake_params.server_cert_sig_scheme));
     }
 
     return 0;
 }
 
 int s2n_tls13_cert_read_and_verify_signature(struct s2n_connection *conn,
-        struct s2n_signature_scheme *chosen_sig_scheme)
+        const struct s2n_signature_scheme *chosen_sig_scheme)
 {
     struct s2n_stuffer *in = &conn->handshake.io;
     DEFER_CLEANUP(struct s2n_blob signed_content = { 0 }, s2n_free);