Horton

Thread

Commits

  1. Support configuring TLSv1.3 cipher suites

  2. Support configuring multiple ECDH curves

  3. Raise the minimum supported OpenSSL version to 1.1.1

  1. Add support to TLS 1.3 cipher suites and curves lists

    Erica Zhang <ericazhangy2021@qq.com> — 2024-06-07T06:10:57Z

    Hi All,

I’m a Postgres user and I’m looking into restricting the set of allowed ciphers on Postgres and configure a concrete set of curves on our postgres instances.

I see in current Postgres doc mentioned that only TLS1.2 and below cipher lists can be configured. And there is no setting that controls the cipher choices used by TLS1.3. 

As for ECDH keys currently postgres opts to support setting only a single elliptic group instead of setting a lists.
As described in below doc link:

https://www.postgresql.org/docs/devel/runtime-config-connection.html


Now I have a patch to support settings for TLS1.3 ciphersuites and expanding the configuration option for EC settings. With my patch we can do:
1. Added a new configuration option ssl_ciphers_suites to control the cipher choices used by TLS 1.3. 2. Extend the existing configuration option ssl_ecdh_curve to accept a list of curve names seperated by colon.

Could you please help to review to see if you are interested in having this change in upcoming Postgres major release(It's should be PG17)? 

Thanks in advance.

  2. Re: Add support to TLS 1.3 cipher suites and curves lists

    Peter Eisentraut <peter@eisentraut.org> — 2024-06-07T08:55:30Z

    On 07.06.24 08:10, Erica Zhang wrote:
> I’m a Postgres user and I’m looking into restricting the set of allowed 
> ciphers on Postgres and configure a concrete set of curves on our 
> postgres instances.

Out of curiosity, why is this needed in practice?

> Could you please help to review to see if you are interested in having 
> this change in upcoming Postgres major release(It's should be PG17)?

It would be targetting PG18 now.