runner: Only require a curve match in TLS 1.3 when doing key shares
The TLS-PAKE machinery will not use key shares. Moving this allows the
client to not send supported_groups when it doesn't need to.
Change-Id: I7291f6afc31d67bbfa6b810a945280bad1ac3ad6
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/75727
Commit-Queue: Adam Langley <agl@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
diff --git a/ssl/test/runner/handshake_server.go b/ssl/test/runner/handshake_server.go
index 3ba14e3..609ec80 100644
--- a/ssl/test/runner/handshake_server.go
+++ b/ssl/test/runner/handshake_server.go
@@ -590,22 +590,6 @@
hs.finishedHash.discardHandshakeBuffer()
hs.writeClientHash(hs.clientHello.marshal())
- supportedCurve := false
- var selectedCurve CurveID
- preferredCurves := config.curvePreferences()
- for _, curve := range hs.clientHello.supportedCurves {
- if slices.Contains(preferredCurves, curve) {
- supportedCurve = true
- selectedCurve = curve
- break
- }
- }
-
- if !supportedCurve {
- c.sendAlert(alertHandshakeFailure)
- return errors.New("tls: no curve supported by both client and server")
- }
-
pskIdentities := hs.clientHello.pskIdentities
pskKEModes := hs.clientHello.pskKEModes
@@ -724,8 +708,24 @@
helloRetryRequest.customExtension = config.Bugs.CustomHelloRetryRequestExtension
}
+ var selectedCurve CurveID
var selectedKeyShare *keyShareEntry
if hs.hello.hasKeyShare {
+ // Select the matching curve.
+ supportedCurve := false
+ preferredCurves := config.curvePreferences()
+ for _, curve := range hs.clientHello.supportedCurves {
+ if slices.Contains(preferredCurves, curve) {
+ supportedCurve = true
+ selectedCurve = curve
+ break
+ }
+ }
+ if !supportedCurve {
+ c.sendAlert(alertHandshakeFailure)
+ return errors.New("tls: no curve supported by both client and server")
+ }
+
// Look for the key share corresponding to our selected curve.
for i := range hs.clientHello.keyShares {
if hs.clientHello.keyShares[i].group == selectedCurve {
