Comments (4)
I'll have to add two handshake extensions: the Supported Elliptic Curves Extension, and the Supported Point Formats Extension [ECC]:
Servers implementing ECC cipher suites MUST support these extensions, and when a client uses these extensions, servers MUST NOT negotiate the use of an ECC cipher suite unless they can complete the handshake while respecting the choice of curves and compression techniques specified by the client.
A part of those extensions is (1) choosing a preference list on the client side and (2) selecting the curve and the point format from the client preference list on the server side. Anybody has ideas on how it should be done? What should be our sane defaults for both client and server sides?
from s2n-tls.
There seems to be an emerging consensus that using custom curves is a bad idea, which at least leaves just the named curves to support. I think that means that our point format extension support can be very minimal. In terms of curves, 256p1 seems to be supported by just about everyone, so maybe we can start with just 256p1 as a named curve?
from s2n-tls.
Sounds like a simple and reasonable first version, I'll do that.
from s2n-tls.
384p1 is also popular and well supported by browsers. Anything outside of those two has limited support.
from s2n-tls.
Related Issues (20)
- SSLv3 handshake with openssl-1.0.2-fips
- Clarify the return value of s2n_cert_validation_callback
- Move CI docker images to the s2n-tls repository
- ci: migrate away from actions-rs
- s2n-tls binding close behavior
- bug: s2n_handshake_type_set_tls12_flag causes TLS1.3 codepath to fail
- cleanup: Change tests to use new testlib function
- Support configurable s2n blinding delay HOT 2
- Investigate packing and alignment for internal/opaque structs
- Runtime instead of compile time support check for curves
- Unpin dependencies after bumping MSRV beyond 1.72
- Organize rust bindings dependency pins into single issue HOT 2
- Send zero-length TLS1.2 NewSessionTicket message if necessary
- Run tests on Ubuntu 24.04 in CI
- Migrate CI to Ubuntu 24 HOT 1
- Purge old priority labels HOT 1
- 6 tests failing with Error Message: 'Certificate is untrusted' when compiling on RHEL 9 HOT 4
- Avoid storing signature schemes in a separate buffer HOT 1
- Reuse MAC writing logic in s2n_record_read
- add documentation for non-vendored rust bindings
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from s2n-tls.