mumble-voip/mumble
Config option to set elliptic curve(s) for ECDSA/ECDHE
オープン
#2,578 opened on 2016/10/16
feature-requesthelp wantedpriority/P3 - Somewhat important
Repository metrics
- Stars
- (5,642 個のスター)
- PR merge metrics
- (PR metrics pending)
説明
Not found here https://github.com/mumble-voip/mumble/pull/1677
If there is a secp384r1 ECDSA certificate in use and you want long-term security https://www.keylength.com/en/3/ (Level 8), you want to set secp521r1 as curve for ECDHE (until curve448 has been landed in OpenSSL). But you can't just allow secp521r1, because the ECDSA cert then won't work with it's secp384r1 curve.
So there should be a config option like sslCurves=secp521r1:secp384r1 or sslCurves=secp521r1 or as default: sslCurves=auto
Please do it like: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ecdh_curve