Re: ecdh support causes unnecessary roundtrips
Daniel Gustafsson <daniel@yesql.se>
From: Daniel Gustafsson <daniel@yesql.se>
To: Andres Freund <andres@anarazel.de>
Cc: PostgreSQL Hackers <pgsql-hackers@postgresql.org>,
Marko Kreen <markokr@gmail.com>,
Adrian Klaver <adrian.klaver@gmail.com>,
Peter Eisentraut <peter_e@gmx.net>,
Heikki Linnakangas <hlinnaka@iki.fi>
Date: 2024-06-17T17:51:45Z
Lists: pgsql-hackers
> On 17 Jun 2024, at 19:44, Andres Freund <andres@anarazel.de> wrote: >> Let's bring that to Erica's patch for allowing a list of curves. > > I'm kinda wondering if we ought to do something about this in the > backbranches. Forcing unnecessary roundtrips onto everyone for the next five > years due to an oversight on our part isn't great. Once you're not local, the > roundtrip does measurably increase the "time to first query". I don't disagree, but wouldn't it be the type of behavioural change which we typically try to avoid in backbranches? Changing the default of the ecdh GUC would perhaps be doable? (assuming that's a working solution to avoid the roundtrip). Amending the documentation is the one thing we certainly can do but 99.9% of affected users won't know they are affected so won't look for that section. -- Daniel Gustafsson
Commits
-
doc: Add note to ssl_group config on X25519 and FIPS
- db93988ab0e7 19 (unreleased) landed
-
Avoid using the X25519 curve in ssl tests
- 07e90c691358 19 (unreleased) landed
-
Add X25519 to the default set of curves
- daa02c6bd926 18.0 landed
-
SSL: Support ECDH key exchange
- 3164721462d5 9.4.0 cited