Horton

Re: ecdh support causes unnecessary roundtrips

Jacob Champion <jacob.champion@enterprisedb.com>

View thread View on postgr.es
From: Jacob Champion <jacob.champion@enterprisedb.com>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Andres Freund <andres@anarazel.de>, PostgreSQL Hackers <pgsql-hackers@postgresql.org>, Marko Kreen <markokr@gmail.com>, Adrian Klaver <adrian.klaver@gmail.com>, Peter Eisentraut <peter_e@gmx.net>, Heikki Linnakangas <hlinnaka@iki.fi>
Date: 2025-03-17T23:34:45Z
Lists: pgsql-hackers

Attachments

On Thu, Mar 13, 2025 at 2:41 PM Daniel Gustafsson <daniel@yesql.se> wrote:
> OpenSSL 3.4 also doesn't like it and AFAICT neither does the upcoming 3.5, just
> haven't had the cycles yet to ship out a new patch with all the time-consuming
> testing it requires =)

Here is a squash fix to change the capitalization -- this passes
locally for LibreSSL 3.4 to 3.8 and OpenSSL 1.1.1 to 3.5.

(Hmm, my LibreSSLs are a little out of date; it looks like I need to
add 3.9 and 4.0 to the suite.)

Thanks,
--Jacob

Commits

  1. doc: Add note to ssl_group config on X25519 and FIPS

  2. Avoid using the X25519 curve in ssl tests

  3. Add X25519 to the default set of curves

  4. SSL: Support ECDH key exchange