Fix #116: Enables ECDHE temporary parameters in ASIO SSL #117
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
#116 is resolved via this pull request and provides required API for Corvusoft/restbed#86 |
conz27
changed the title
|
+1 |
|
BUMP! Any ETA when this will be integrated? |
|
BUMP! Would really need this to support ECDHE |
|
Rebasing my change to resolve the conflict, but the rest is up to the maintainer. |
|
@ben-crowhurst, are you able to test out this change to verify it still works for you? |
|
@chriskohlhoff , what will it take to get this feature integrated? |
ghost
mentioned this pull request
garethsb
approved these changes
Apr 12, 2019
asio/include/asio/ssl/context.hpp
Outdated
| * | ||
| * @note Calls @c SSL_CTX_set_tmp_ecdh. | ||
| */ | ||
| ASIO_DECL void use_tmp_ecdh(const std::string& certificate); |
There was a problem hiding this comment.
Should this be named use_tmp_ecdh_file for consistency with use_tmp_dh_file as opposed to use_tmp_dh?
asio/include/asio/ssl/context.hpp
Outdated
| @@ -735,6 +767,10 @@ class context | |||
| ASIO_DECL asio::error_code do_use_tmp_dh( | |||
| BIO* bio, asio::error_code& ec); | |||
|
|
|||
| // Helper function to set the temprorary ECC Diffie-Hellman parameters from a BIO. | |||
garethsb
added a commit
to sony/nmos-cpp
that referenced
this pull request
Apr 17, 2019
…amed in an ECDHE certificate Based on chriskohlhoff/asio#117 (cherry picked from commit e0d2e84d4f5aa3a0625d9d026ed150976d064887)
|
@garethsb-sony , I've applied the changes you requested. |
garethsb
reviewed
Apr 29, 2019
conz27
force-pushed
the
ecdhe_support
branch
3 times, most recently
from
eafb2c1 to
5308e4a
Compare
Implemented API context::use_tmp_ecdh(std::string& certificate) to enable SSL_CTX_set_tmp_ecdh() from OpenSSL. This functionality was missing and certificates using ECC were not able to use ECDHE due to missing temporary ECDH parameters. Using this new API, the user can just pass in their certificate and the API will identify the ECC curve and use it's generator point to create new temporary key pairs to provide Perfect Forward Secrecy (PFS).
use_tmp_ecdh -> use_tmp_ecdh_file
- modified to make the code compile with against v1.0 and v1.1 of OpenSSL
prince-chrismc
added a commit
to prince-chrismc/Hello-Boost-Beast
that referenced
this pull request
Sep 28, 2019
mezzatto
reviewed
Apr 10, 2020
| * @param certificate The name of the file containing the ECC-based certificate. | ||
| * The file must use the PEM format. | ||
| * | ||
| * @param ec Set to indicate what error occurred, if any. |
There was a problem hiding this comment.
This is copy/pasted from the other signature. Should be removed from here.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Implemented API context::use_tmp_ecdh(std::string& certificate) to
enable SSL_CTX_set_tmp_ecdh() from OpenSSL.
This functionality was missing and certificates using ECC were not able
to use ECDHE due to missing temporary ECDH parameters.
Using this new API, the user can just pass in their certificate and the
API will identify the ECC curve and use it's generator point to create
new temporary key pairs to provide Perfect Forward Secrecy (PFS).