# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
#
# This file enables policy testing
#
# The policy string is set to the config= line in the pkcs11.txt
# it currently has 2 keywords:
#
# disallow= turn off the use of this algorithm by policy.
# allow= allow this algorithm to by used if selected by policy.
#
# The syntax is disallow=algorithm{/uses}:algorithm{/uses}
# where {} signifies an optional element
#
# valid algorithms are:
# ECC curves:
#	PRIME192V1
#	PRIME192V2
#	PRIME192V3
#	PRIME239V1
#	PRIME239V2
#	PRIME239V3
#	PRIME256V1
#	SECP112R1
#	SECP112R2
#	SECP128R1
#	SECP128R2
#	SECP160K1
#	SECP160R1
#	SECP160R2
#	SECP192K1
#	SECP192R1
#	SECP224K1
#	SECP256K1
#	SECP256R1
#	SECP384R1
#	SECP521R1
#	C2PNB163V1
#	C2PNB163V2
#	C2PNB163V3
#	C2PNB176V1
#	C2TNB191V1
#	C2TNB191V2
#	C2TNB191V3
#	C2ONB191V4
#	C2ONB191V5
#	C2PNB208W1
#	C2TNB239V1
#	C2TNB239V2
#	C2TNB239V3
#	C2ONB239V4
#	C2ONB239V5
#	C2PNB272W1
#	C2PNB304W1
#	C2TNB359V1
#	C2PNB368W1
#	C2TNB431R1
#	SECT113R1
#	SECT131R1
#	SECT131R1
#	SECT131R2
#	SECT163K1
#	SECT163R1
#	SECT163R2
#	SECT193R1
#	SECT193R2
#	SECT233K1
#	SECT233R1
#	SECT239K1
#	SECT283K1
#	SECT283R1
#	SECT409K1
#	SECT409R1
#	SECT571K1
#	SECT571R1
# Hashes:
#	MD2
#	MD4
#	MD5
#	SHA1
#	SHA224
#	SHA256
#	SHA384
#	SHA512
# MACs:
#	HMAC-SHA1
#	HMAC-SHA224
#	HMAC-SHA256
#	HMAC-SHA384
#	HMAC-SHA512
#	HMAC-MD5
# Ciphers:
#	AES128-CBC
#	AES192-CBC
#	AES256-CBC
#	AES128-GCM
#	AES192-GCM
#	AES256-GCM
#	CAMELLIA128-CBC
#	CAMELLIA192-CBC
#	CAMELLIA256-CBC
#	SEED-CBC
#	DES-EDE3-CBC
#	DES-40-CBC
#	DES-CBC
#	NULL-CIPHER
#	RC2
#	RC4
#	IDEA
# Key exchange
#	RSA
#	RSA-EXPORT
#	DHE-RSA
#	DHE-DSS
#	DH-RSA
#	DH-DSS
#	ECDHE-ECDSA
#	ECDHE-RSA
#	ECDH-ECDSA
#	ECDH-RSA
# SSL Versions
#	SSL2.0
#	SSL3.0
#	TLS1.0
#	TLS1.1
#	TLS1.2
#	DTLS1.1
#	DTLS1.2
# Include all of the above:
#       ALL
#-----------------------------------------------
# Uses are:
#    ssl
#    ssl-key-exchange
#    key-exchange (includes ssl-key-exchange)
#    cert-signature
#    signature (includes cert-signature)
#    all (includes all of the above)
#-----------------------------------------------
# In addition there are the following options:
#     min-rsa
#     min-dh
#     min-dsa
#  they have the following syntax:
#  allow=min-rsa=512:min-dh=1024
#
# Exp Enable Enable Cipher Config Policy      Test Name
# Ret  EC     TLS
# turn on single cipher 
  0 noECC  SSL3   d    disallow=all_allow=hmac-sha1:sha256:rsa:des-ede3-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0 Allowed by Narrow Policy
  0 noECC  SSL3   d    disallow=all_allow=hmac-sha1/ssl,ssl-key-exchange:sha256/cert-signature:rsa/ssl-key-exchange:des-ede3-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0 Allowed by Strict Policy
  0 noECC  SSL3   d    disallow=all_allow=md2/all:md4/all:md5/all:sha1/all:sha256/all:sha384/all:sha512/all:hmac-sha1/all:hmac-sha224/all:hmac-sha256/all:hmac-sha384/all:hmac-sha512/all:hmac-md5/all:camellia128-cbc/all:camellia192-cbc/all:camellia256-cbc/all:seed-cbc/all:des-ede3-cbc/all:des-40-cbc/all:des-cbc/all:null-cipher/all:rc2/all:rc4/all:idea/all:rsa/all:rsa-export/all:dhe-rsa/all:dhe-dss/all:ecdhe-ecdsa/all:ecdhe-rsa/all:ecdh-ecdsa/all:ecdh-rsa/all:tls-version-min=ssl2.0:tls-version-max=tls1.2 Allow All Explicitly
  1 noECC  SSL3   d    disallow=all Disallow All Explicitly.
# turn off signature only
  1 noECC  SSL3   d    disallow=sha256 Disallow SHA256 Signatures Explicitly.
  1 noECC  SSL3   d    disallow=all_allow=hmac-sha1:rsa/ssl-key-exchange:des-ede3-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0 Disallow SHA256 Signatures Implicitly Narrow.
  1 noECC  SSL3   d    disallow=all_allow=md2/all:md4/all:md5/all:sha1/all:sha384/all:sha512/all:hmac-sha1/all:hmac-sha224/all:hmac-sha256/all:hmac-sha384/all:hmac-sha512/all:hmac-md5/all:camellia128-cbc/all:camellia192-cbc/all:camellia256-cbc/all:seed-cbc/all:des-ede3-cbc/all:des-40-cbc/all:des-cbc/all:null-cipher/all:rc2/all:rc4/all:idea/all:rsa/all:rsa-export/all:dhe-rsa/all:dhe-dss/all:ecdhe-ecdsa/all:ecdhe-rsa/all:ecdh-ecdsa/all:ecdh-rsa/all:tls-version-min=ssl2.0:tls-version-max=tls1.2 Disallow SHA256 Signatures Implicitly.
# turn off single cipher 
  1 noECC  SSL3   d    disallow=des-ede3-cbc Disallow Cipher Explicitly
  1 noECC  SSL3   d    disallow=all_allow=hmac-sha1:sha256:rsa:des-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0 Disallow Cipher Implicitly Narrow.
  1 noECC  SSL3   d    disallow=all_allow=md2/all:md4/all:md5/all:sha1/all:sha256/all:sha384/all:sha512/all:hmac-sha1/all:hmac-sha224/all:hmac-sha256/all:hmac-sha384/all:hmac-sha512/all:hmac-md5/all:camellia128-cbc/all:camellia192-cbc/all:camellia256-cbc/all:seed-cbc/all:des-40-cbc/all:des-cbc/all:null-cipher/all:rc2/all:rc4/all:idea/all:rsa/all:rsa-export/all:dhe-rsa/all:dhe-dss/all:ecdhe-ecdsa/all:ecdhe-rsa/all:ecdh-ecdsa/all:ecdh-rsa/all:tls-version-min=ssl2.0:tls-verion-max=tls1.2 Disallow Cipher Implicitly.
# turn off H-Mac
  1 noECC  SSL3   d    disallow=hmac-sha1 Disallow HMAC Explicitly
  1 noECC  SSL3   d    disallow=all_allow=md5:sha256:rsa:des-ede3-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0 Disallow HMAC Implicitly Narrow.
  1 noECC  SSL3   d    disallow=all_allow=md2/all:md4/all:md5/all:sha1/all:sha256/all:sha384/all:sha512/all:hmac-sha224/all:hmac-sha256/all:hmac-sha384/all:hmac-sha512/all:hmac-md5/all:camellia128-cbc/all:camellia192-cbc/all:camellia256-cbc/all:seed-cbc/all:des-ede3-cbc/all:des-40-cbc/all:des-cbc/all:null-cipher/all:rc2/all:rc4/all:idea/all:rsa/all:rsa-export/all:dhe-rsa/all:dhe-dss/all:ecdhe-ecdsa/all:ecdhe-rsa/all:ecdh-ecdsa/all:ecdh-rsa/all:tls-version-min=ssl2.0:tls-version-max=tls1.2 Disallow HMAC Signatures Implicitly.
# turn off key exchange 
  1 noECC  SSL3   d    disallow=rsa/ssl-key-exchange Disallow Key Exchange Explicitly.
  1 noECC  SSL3   d    disallow=all_allow=hmac-sha1:sha256:dh-dss:des-ede3-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0 Disallow Key Exchange Implicitly Narrow.
  1 noECC  SSL3   d    disallow=all_allow=md2/all:md4/all:md5/all:sha1/all:sha256/all:sha384/all:sha512/all:hmac-sha1/all:hmac-sha224/all:hmac-sha256/all:hmac-sha384/all:hmac-sha512/all:hmac-md5/all:camellia128-cbc/all:camellia192-cbc/all:camellia256-cbc/all:seed-cbc/all:des-ede3-cbc/all:des-40-cbc/all:des-cbc/all:null-cipher/all:rc2/all:rc4/all:idea/all:rsa-export/all:dhe-rsa/all:dhe-dss/all:ecdhe-ecdsa/all:ecdhe-rsa/all:ecdh-ecdsa/all:ecdh-rsa/all:tls-version-min=ssl2.0:tls-version-max=tls1.2 Disallow Key Exchnage Signatures Implicitly.
# turn off  version
  1 noECC  SSL3   d    allow=tls-version-min=tls1.0:tls-version-max=tls1.2 Disallow Version Exlicitly
  1 noECC  SSL3   d    disallow=all_allow=hmac-sha1:sha256:rsa:des-ede3-cbc:tls-version-min=tls1.0:tls-version-max=tls1.2 Disallow Version Implicitly Narrow.
  1 noECC  SSL3   d    disallow=all_allow=md2/all:md4/all:md5/all:sha1/all:sha256/all:sha384/all:sha512/all:hmac-sha1/all:hmac-sha224/all:hmac-sha256/all:hmac-sha384/all:hmac-sha512/all:hmac-md5/all:camellia128-cbc/all:camellia192-cbc/all:camellia256-cbc/all:seed-cbc/all:des-ede3-cbc/all:des-40-cbc/all:des-cbc/all:null-cipher/all:rc2/all:rc4/all:idea/all:rsa/all:rsa-export/all:dhe-rsa/all:dhe-dss/all:ecdhe-ecdsa/all:ecdhe-rsa/all:ecdh-ecdsa/all:ecdh-rsa/all:tls-version-min=tls1.0:tls-version-max=tls1.2 Disallow Version Implicitly.