Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-24897

Configure Diffie-Hellman parameters for OpenSSL

    XMLWordPrintable

    Details

    • Type: Improvement
    • Status: Closed
    • Priority: Major - P3
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 3.5.12
    • Component/s: Networking, Security
    • Labels:
      None
    • Backwards Compatibility:
      Fully Compatible
    • Sprint:
      Platforms 2017-07-31, Platforms 2017-08-21

      Description

      In order to enable Perfect Forward Security compatible cipher suites when using OpenSSL, we should to configure OpenSSL via the guidelines here: https://wiki.openssl.org/index.php/Diffie-Hellman_parameters

      Though standard Diffie-Hellman seems fairly straightforward to configure, note that the preferred way to configure Elliptic Curve Diffie-Hellman requires a call to SSL_CTX_set_ecdh_auto, which as a symbol is only exposed by OpenSSL 1.0.2 and above. We may wish to switch between ECDH configuration implementations based on what's available at compile time, though the majority of vendor supplied OpenSSL libraries will not currently be able to use it. Runtime acquisition of a function pointer may also be possible, but would be more difficult to implement.

        Attachments

          Activity

            People

            Assignee:
            adam.martin ADAM Martin (Inactive)
            Reporter:
            spencer.jackson Spencer Jackson
            Participants:
            Votes:
            1 Vote for this issue
            Watchers:
            12 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved: