Update CloudFront's upstream ECC preference list

[zz85]

Description of changes:

updating Update CloudFront's upstream ECC preference list from s2n_ecc_pref_list_20140601 to s2n_ecc_pref_list_20230623 to include X25519 inline with CloudFront's documentation in https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-ciphers-cloudfront-to-origin.html

This should only update the following security policies

• CloudFront-Upstream
• CloudFront-Upstream-TLS-1-0
• CloudFront-Upstream-TLS-1-1
• CloudFront-Upstream-TLS-1-2

Call-outs:

as mentioned in

s2n-tls/tls/s2n_ecc_preferences.c

Line 36 in e4f5bf6

/* Curve p256 is at the top of the list in order to minimize HRR */

,

s2n_ecc_pref_list_20230623 prefers p256 over x25519. using that over s2n_ecc_pref_list_20200310 should have no differences in TLS 1.2, but could improve compatibility when moving to support TLS 1.3 to origins

Testing:

Unit tests and integration tests with s2nc (see comment)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[zz85]

Update on testing, I've used the new security policy using a s2nc script against a alexa 100 top sites list I could find.

for domain in $(cat alexa-top-100); do
	echo $domain;
	echo "\n\n" | S2N_DONT_MLOCK=1 ./build/bin/s2nc -f ./tests/pems/trust-store/ca-bundle.crt  --ciphers CloudFront-Upstream $domain -e -i | head -2
	echo "ok"
	sleep 0.1
done

I've compared the results against the default security policies, and apart from domains not reachable from my testing host, I've found no regression so far.