Horton

Re: ecdh support causes unnecessary roundtrips

Daniel Gustafsson <daniel@yesql.se>

View thread View on postgr.es
From: Daniel Gustafsson <daniel@yesql.se>
To: Jacob Champion <jacob.champion@enterprisedb.com>
Cc: Andres Freund <andres@anarazel.de>, PostgreSQL Hackers <pgsql-hackers@postgresql.org>, Marko Kreen <markokr@gmail.com>, Adrian Klaver <adrian.klaver@gmail.com>, Peter Eisentraut <peter_e@gmx.net>, Heikki Linnakangas <hlinnaka@iki.fi>
Date: 2025-03-13T21:41:12Z
Lists: pgsql-hackers 
> On 13 Mar 2025, at 22:39, Jacob Champion <jacob.champion@enterprisedb.com> wrote:
> 
> On Tue, Mar 4, 2025 at 4:05 PM Daniel Gustafsson <daniel@yesql.se> wrote:
>>> On 4 Mar 2025, at 20:19, Daniel Gustafsson <daniel@yesql.se> wrote:
>>> Thanks for the reminder, this is sitting on my must-have TODO for 18 and I
>>> agree that we should add x25519 to the default set.
>> 
>> And to add some code for that proposal, the attached adds it to the default set.
> 
> In mundane-annoyances news, LibreSSL apparently does not accept
> "x25519" and wants "X25519" instead. :D

OpenSSL 3.4 also doesn't like it and AFAICT neither does the upcoming 3.5, just
haven't had the cycles yet to ship out a new patch with all the time-consuming
testing it requires =)

--
Daniel Gustafsson

Commits

  1. doc: Add note to ssl_group config on X25519 and FIPS

  2. Avoid using the X25519 curve in ssl tests

  3. Add X25519 to the default set of curves

  4. SSL: Support ECDH key exchange