Skip to content

gh-109945: Enable spec of multiple curves/groups for TLS #119244

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
planetf1 wants to merge 13 commits into
base: main
Choose a base branch
from
Open

gh-109945: Enable spec of multiple curves/groups for TLS #119244

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
403b917
gh-109945 Enable spec of multiple curves/groups for TLS
planetf1 May 20, 2024
8ac3842
gh-109945 Additional testcases for ssl
planetf1 Jun 4, 2024
65490a2
gh-109945 Refine exception & add more tests
planetf1 Jun 3, 2024
8ec8608
📜🤖 Added by blurb_it.
blurb-it[bot] Jun 4, 2024
ebad50c
gh-109945 update documentation
planetf1 Jun 4, 2024
af71eee
gh-109945 fix incorrect reference management of string
planetf1 Jun 4, 2024
8459b66
gh-109945 fix openssl<3 tests
planetf1 Jun 4, 2024
1af4b23
gh-109945 update docs to clarify change is OpenSSL 3 and above
planetf1 Jun 4, 2024
b48e5bc
gh-109945 Corrected typo/whitespace in docs
planetf1 Jun 4, 2024
42ec0c8
gh-109945 Correct thread issue
planetf1 Jun 4, 2024
67fd580
gh-109945 do not call _setSSLError
planetf1 Jun 4, 2024
fae2620
gh-109945 remove commented code
planetf1 Jul 17, 2024
8a2cbde
gh-109945 update NEWS to correct function call format check
planetf1 Jul 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
gh-109945 update docs to clarify change is OpenSSL 3 and above 
Signed-off-by: Nigel Jones <jonesn@uk.ibm.com>
  • Loading branch information
@planetf1
planetf1 committed Jul 17, 2024
commit 1af4b23566872df3e4cd7d501b308047892b0fd4
11 changes: 7 additions & 4 deletions Doc/library/ssl.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1763,11 +1763,14 @@ to speed up repeated connections from the same clients.

.. method:: SSLContext.set_ecdh_curve(curve_name)

Set the curve names for Elliptic Curve-based Diffie-Hellman (ECDH) key
Set the curve name for Elliptic Curve-based Diffie-Hellman (ECDH) key
exchange. ECDH is significantly faster than regular DH while arguably
as secure. The *curve_name* parameter should be a colon separated string describing
one or more well-known elliptic curves, for example ``prime256v1`` for a widely
supported curve, or ``prime256v1:brainpoolP384r1`` to specify two curves that will be
as secure. The *curve_name* parameter should be a string describing
a well-known elliptic curve, for example ``prime256v1`` for a widely
supported curve.

For OpenSSL 3.0 and above *curve_name* parameter can be a colon separated
list of curves, for example ``prime256v1:brainpoolP384r1`` specifies two curves that will be
used on a client hello.

This setting doesn't apply to client sockets. You can also use the
Expand Down
2 changes: 1 addition & 1 deletion Misc/NEWS.d/next/Library/2024-06-04-07-28-18.gh-issue-109945.02TejW.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
Adds support for multiple curves to be specified in SSLContext.set_ecdh_curve(curve_name) by setting curve_name to a colon separated list of curves. This allows multiple curves to be passed on a client hello.
Adds support for multiple curves to be specified in SSLContext.set_ecdh_curve(curve_name) for OpenSSL 3.0 and above by setting curve_name to a colon separated list of curves. This allows multiple curves to be passed on a client hello.