Bug 2052296 - add a pref and enterprise policy for CNSA2.0 key agreement. r=keeler,fluent-reviewers,mkaply,flod

Differential Revision: https://phabricator.services.mozilla.com/D310120

Author: jschanck

browser/components/enterprisepolicies/Policies.sys.mjs

@@ -2585,6 +2585,12 @@ export var Policies = {
     },
   },
 
+  CNSA2KeyAgreementEnabled: {
+    onBeforeAddons(manager, param) {
+      lazy.PoliciesUtils.setAndLockPref("security.tls.enable_mlkem1024", param);
+    },
+  },
+
   PostQuantumKeyAgreementEnabled: {
     onBeforeAddons(manager, param) {
       lazy.PoliciesUtils.setAndLockPref(

browser/components/enterprisepolicies/schemas/policies-schema.json

@@ -431,6 +431,10 @@
       }
     },
 
+    "CNSA2KeyAgreementEnabled": {
+      "type": "boolean"
+    },
+
     "Containers": {
       "type": "object",
       "x-category": "Extensions",

browser/components/enterprisepolicies/tests/xpcshell/test_simple_pref_policies.js

@@ -1214,6 +1214,16 @@ const POLICIES_TESTS = [
     },
   },
 
+  // POLICY: CNSA2KeyAgreementEnabled
+  {
+    policies: {
+      CNSA2KeyAgreementEnabled: true,
+    },
+    lockedPrefs: {
+      "security.tls.enable_mlkem1024": true,
+    },
+  },
+
   // POLICY: HttpsOnlyMode
   {
     policies: {

browser/locales/en-US/browser/policies/policies-descriptions.ftl

@@ -49,6 +49,11 @@ policy-CaptivePortal = Enable or disable captive portal support.
 
 policy-CertificatesDescription = Add certificates or use built-in certificates.
 
+# CNSA 2.0 is the United States National Security Agency's Commercial National
+# Security Algorithm Suite 2.0. ML-KEM-1024 is a post-quantum key agreement
+# algorithm. Neither should be translated.
+policy-CNSA2KeyAgreementEnabled = Enable the CNSA 2.0 ML-KEM-1024 key agreement for TLS.
+
 policy-ContentAnalysis = Enable or disable connection to data-loss-prevention agent.
 
 policy-Cookies = Allow or deny websites to set cookies.

modules/libpref/init/StaticPrefList.yaml

@@ -19022,6 +19022,12 @@
   mirror: always
   rust: true
 
+# Whether to enable the CNSA 2.0 ML-KEM-1024 key agreement in TLS.
+- name: security.tls.enable_mlkem1024
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
 - name: security.tls.client_hello.send_p256_keyshare
   type: RelaxedAtomicBool
   value: @IS_NOT_NIGHTLY_BUILD@

security/manager/ssl/nsNSSCallbacks.cpp

@@ -802,6 +802,9 @@ nsCString getKeaGroupName(uint32_t aKeaGroup) {
     case ssl_grp_kem_secp384r1mlkem1024:
       groupName = "secp384r1mlkem1024"_ns;
       break;
+    case ssl_grp_kem_mlkem1024:
+      groupName = "mlkem1024"_ns;
+      break;
     case ssl_grp_ffdhe_2048:
       groupName = "FF 2048"_ns;
       break;
@@ -1163,6 +1166,7 @@ void HandshakeCallback(PRFileDesc* fd, void* client_data) {
             ECCCurve(channelInfo.keaKeyBits));
         break;
       case ssl_kea_ecdh_hybrid:
+      case ssl_kea_kem:
         break;
       default:
         MOZ_CRASH("impossible KEA");

security/manager/ssl/nsNSSComponent.cpp

@@ -1000,14 +1000,20 @@ bool SetDeprecatedTLS1CipherPrefs(const char* aPref = nullptr) {
 
 // static
 bool SetKyberPolicy(const char* aPref = nullptr) {
-  if (aPref != nullptr && strcmp(aPref, "security.tls.enable_kyber") != 0) {
+  if (aPref != nullptr && strcmp(aPref, "security.tls.enable_kyber") != 0 &&
+      strcmp(aPref, "security.tls.enable_mlkem1024") != 0) {
     return false;
   }
   if (StaticPrefs::security_tls_enable_kyber()) {
     NSS_SetAlgorithmPolicy(SEC_OID_MLKEM768X25519, NSS_USE_ALG_IN_SSL_KX, 0);
   } else {
     NSS_SetAlgorithmPolicy(SEC_OID_MLKEM768X25519, 0, NSS_USE_ALG_IN_SSL_KX);
   }
+  if (StaticPrefs::security_tls_enable_mlkem1024()) {
+    NSS_SetAlgorithmPolicy(SEC_OID_ML_KEM_1024, NSS_USE_ALG_IN_SSL_KX, 0);
+  } else {
+    NSS_SetAlgorithmPolicy(SEC_OID_ML_KEM_1024, 0, NSS_USE_ALG_IN_SSL_KX);
+  }
   return true;
 }
 

security/manager/ssl/nsNSSIOLayer.cpp

@@ -1580,26 +1580,27 @@ static nsresult nsSSLIOLayerSetOptions(PRFileDesc* fd, bool forSTARTTLS,
   // nsNSSCallbacks.cpp when changing the lists here.
   unsigned int additional_shares =
       StaticPrefs::security_tls_client_hello_send_p256_keyshare();
-  if (StaticPrefs::security_tls_enable_kyber() &&
-      range.max >= SSL_LIBRARY_VERSION_TLS_1_3) {
-    const SSLNamedGroup namedGroups[] = {
-        ssl_grp_kem_mlkem768x25519, ssl_grp_ec_curve25519, ssl_grp_ec_secp256r1,
-        ssl_grp_ec_secp384r1,       ssl_grp_ec_secp521r1,  ssl_grp_ffdhe_2048,
-        ssl_grp_ffdhe_3072};
-    if (SECSuccess !=
-        SSL_NamedGroupConfig(fd, namedGroups, std::size(namedGroups))) {
-      return NS_ERROR_FAILURE;
-    }
+  bool tls13 = range.max >= SSL_LIBRARY_VERSION_TLS_1_3;
+
+  AutoTArray<SSLNamedGroup, 8> namedGroups;
+  if (StaticPrefs::security_tls_enable_kyber() && tls13) {
+    namedGroups.AppendElement(ssl_grp_kem_mlkem768x25519);
     additional_shares += 1;
-  } else {
-    const SSLNamedGroup namedGroups[] = {
-        ssl_grp_ec_curve25519, ssl_grp_ec_secp256r1, ssl_grp_ec_secp384r1,
-        ssl_grp_ec_secp521r1,  ssl_grp_ffdhe_2048,   ssl_grp_ffdhe_3072};
-    // Skip the |ssl_grp_kem_mlkem768x25519| entry.
-    if (SECSuccess !=
-        SSL_NamedGroupConfig(fd, namedGroups, std::size(namedGroups))) {
-      return NS_ERROR_FAILURE;
-    }
+  }
+  namedGroups.AppendElement(ssl_grp_ec_curve25519);
+  namedGroups.AppendElement(ssl_grp_ec_secp256r1);
+  namedGroups.AppendElement(ssl_grp_ec_secp384r1);
+  namedGroups.AppendElement(ssl_grp_ec_secp521r1);
+  namedGroups.AppendElement(ssl_grp_ffdhe_2048);
+  namedGroups.AppendElement(ssl_grp_ffdhe_3072);
+
+  if (StaticPrefs::security_tls_enable_mlkem1024() && tls13) {
+    namedGroups.AppendElement(ssl_grp_kem_mlkem1024);
+  }
+
+  if (SECSuccess !=
+      SSL_NamedGroupConfig(fd, namedGroups.Elements(), namedGroups.Length())) {
+    return NS_ERROR_FAILURE;
   }
 
   // If additional_shares == 2, send mlkem768x25519, x25519, and p256.
@@ -1610,7 +1611,7 @@ static nsresult nsSSLIOLayerSetOptions(PRFileDesc* fd, bool forSTARTTLS,
   }
 
   // Enabling Certificate Compression Decoding mechanisms.
-  if (range.max >= SSL_LIBRARY_VERSION_TLS_1_3 &&
+  if (tls13 &&
       !(infoObject->GetProviderFlags() &
         (nsISocketProvider::BE_CONSERVATIVE | nsISocketProvider::IS_RETRY))) {
     SSLCertificateCompressionAlgorithm zlibAlg = {1, "zlib", nullptr,

security/manager/ssl/tests/unit/test_faulty_server.js

@@ -138,3 +138,36 @@ add_task(
     );
   }
 );
+
+// SSL_ERROR_BASE + 155. The client aborts when a HelloRetryRequest selects a
+// group it did not offer.
+const SSL_ERROR_RX_MALFORMED_HELLO_RETRY_REQUEST = SSL_ERROR_BASE + 155;
+
+// With the pref disabled, the client does not enable ML-KEM-1024. The server
+// offers only ML-KEM-1024 and requests it via a HelloRetryRequest, but since
+// the client did not advertise ML-KEM-1024 it rejects the retry.
+add_connection_test(
+  "mlkem1024.example.com",
+  SSL_ERROR_RX_MALFORMED_HELLO_RETRY_REQUEST,
+  function () {
+    Services.prefs.setBoolPref("security.tls.enable_mlkem1024", false);
+  }
+);
+
+// With the pref enabled, the client advertises ML-KEM-1024 in supported_groups
+// without sending a key share for it. A server that offers only ML-KEM-1024
+// therefore completes the handshake via a HelloRetryRequest.
+add_connection_test(
+  "mlkem1024.example.com",
+  PRErrorCodeSuccess,
+  function () {
+    Services.prefs.setBoolPref("security.tls.enable_mlkem1024", true);
+  },
+  function (aSecurityInfo) {
+    equal(
+      aSecurityInfo.keaGroupName,
+      "mlkem1024",
+      "should have negotiated ML-KEM-1024 via HelloRetryRequest"
+    );
+  }
+);

security/manager/ssl/tests/unit/tlsserver/cmd/FaultyServer.cpp

@@ -21,6 +21,7 @@ enum FaultType {
   ZeroRtt,
   UnknownSNI,
   Mlkem768x25519,
+  Mlkem1024,
 };
 
 struct FaultyServerHost {
@@ -47,6 +48,8 @@ const char* kHostMlkem768x25519NetInterrupt =
 const char* kHostMlkem768x25519AlertAfterServerHello =
     "mlkem768x25519-alert-after-server-hello.example.com";
 
+const char* kHostMlkem1024 = "mlkem1024.example.com";
+
 const char* kCertWildcard = "default-ee";
 
 /* Each type of failure gets a different SNI.
@@ -65,6 +68,7 @@ MOZ_RUNINIT const FaultyServerHost sFaultyServerHosts[]{
     {kHostPSKDecryptErrorNoEarlyData, kCertWildcard, ZeroRtt},
     {kHostMlkem768x25519NetInterrupt, kCertWildcard, Mlkem768x25519},
     {kHostMlkem768x25519AlertAfterServerHello, kCertWildcard, Mlkem768x25519},
+    {kHostMlkem1024, kCertWildcard, Mlkem1024},
     {nullptr, nullptr},
 };
 
@@ -228,17 +232,23 @@ int32_t DoSNISocketConfig(PRFileDesc* aFd, const SECItem* aSrvNameArr,
     fprintf(stderr, "found pre-defined host '%s'\n", host->mHostName);
   }
 
-  const SSLNamedGroup mlkemTestNamedGroups[] = {ssl_grp_kem_mlkem768x25519,
-                                                ssl_grp_ec_curve25519};
+  const SSLNamedGroup hybridTestNamedGroups[] = {ssl_grp_kem_mlkem768x25519,
+                                                 ssl_grp_ec_curve25519};
+
+  const SSLNamedGroup mlkem1024TestNamedGroups[] = {ssl_grp_kem_mlkem1024};
 
   switch (host->mFaultType) {
     case ZeroRtt:
       SSL_SecretCallback(aFd, &SecretCallbackFailZeroRtt, (void*)host);
       break;
     case Mlkem768x25519:
       SSL_SecretCallback(aFd, &SecretCallbackFailMlkem768x25519, (void*)host);
-      SSL_NamedGroupConfig(aFd, mlkemTestNamedGroups,
-                           std::size(mlkemTestNamedGroups));
+      SSL_NamedGroupConfig(aFd, hybridTestNamedGroups,
+                           std::size(hybridTestNamedGroups));
+      break;
+    case Mlkem1024:
+      SSL_NamedGroupConfig(aFd, mlkem1024TestNamedGroups,
+                           std::size(mlkem1024TestNamedGroups));
       break;
     case None:
       break;