mumble-voip/mumble

Config option to set elliptic curve(s) for ECDSA/ECDHE

Open

#2,578 opened on Oct 16, 2016

View on GitHub
 (4 comments) (0 reactions) (1 assignee)C++ (1,062 forks)batch import
feature-requesthelp wantedpriority/P3 - Somewhat important

Repository metrics

Stars
 (5,642 stars)
PR merge metrics
 (Avg merge 6d) (7 merged PRs in 30d)

Description

Not found here https://github.com/mumble-voip/mumble/pull/1677

If there is a secp384r1 ECDSA certificate in use and you want long-term security https://www.keylength.com/en/3/ (Level 8), you want to set secp521r1 as curve for ECDHE (until curve448 has been landed in OpenSSL). But you can't just allow secp521r1, because the ECDSA cert then won't work with it's secp384r1 curve.

So there should be a config option like sslCurves=secp521r1:secp384r1 or sslCurves=secp521r1 or as default: sslCurves=auto

Please do it like: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ecdh_curve

Contributor guide

Research direction
Examine the current SSL/TLS configuration in Mumble's source code, particularly how certificates and cipher suites are handled. Look for existing settings like 'sslCiphers' to understand the pattern. Then implement a new config option 'sslCurves' that accepts a colon separated list of elliptic curves (e.g., 'secp521r1:secp384r1') or 'auto'. Modify the SSL context creation code to use SSL CTX set1 curves list() or similar. Ensure backward compatibility and update documentation.
Tech stack
None
Domain
backend
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GitC++SSL/TLS basics
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60