[openssl-commits] [openssl] master update
Matt Caswell
matt at openssl.org
Wed May 3 16:06:49 UTC 2017
The branch master has been updated
via 47f7cf051bbb5d67778f6250c3c85341afea86d6 (commit)
via 863fe19b5fb4a2af9f47ed664cb9dcb7d52331d1 (commit)
from 6d9d8019bbc02e73ee1fdb5f6ffe3dd6ffcaa9d8 (commit)
- Log -----------------------------------------------------------------
commit 47f7cf051bbb5d67778f6250c3c85341afea86d6
Author: Matt Caswell <matt at openssl.org>
Date: Wed May 3 16:39:57 2017 +0100
Update the documentation for "Groups" and "Curves"
Reviewed-by: Rich Salz <rsalz at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3375)
commit 863fe19b5fb4a2af9f47ed664cb9dcb7d52331d1
Author: Matt Caswell <matt at openssl.org>
Date: Wed May 3 16:39:32 2017 +0100
Add the -groups option to s_server/s_client
This should have been added before but was missed.
Reviewed-by: Rich Salz <rsalz at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3375)
-----------------------------------------------------------------------
Summary of changes:
apps/apps.h | 11 +++++++----
doc/man3/SSL_CONF_cmd.pod | 44 ++++++++++++++++++++++++++++++++++++--------
2 files changed, 43 insertions(+), 12 deletions(-)
diff --git a/apps/apps.h b/apps/apps.h
index de50de5..3c1da48 100644
--- a/apps/apps.h
+++ b/apps/apps.h
@@ -213,9 +213,9 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate,
OPT_S_NOTLS1_3, OPT_S_BUGS, OPT_S_NO_COMP, OPT_S_NOTICKET, \
OPT_S_SERVERPREF, OPT_S_LEGACYRENEG, OPT_S_LEGACYCONN, \
OPT_S_ONRESUMP, OPT_S_NOLEGACYCONN, OPT_S_STRICT, OPT_S_SIGALGS, \
- OPT_S_CLIENTSIGALGS, OPT_S_CURVES, OPT_S_NAMEDCURVE, OPT_S_CIPHER, \
- OPT_S_DHPARAM, OPT_S_RECORD_PADDING, OPT_S_DEBUGBROKE, OPT_S_COMP, \
- OPT_S__LAST
+ OPT_S_CLIENTSIGALGS, OPT_S_GROUPS, OPT_S_CURVES, OPT_S_NAMEDCURVE, \
+ OPT_S_CIPHER, OPT_S_DHPARAM, OPT_S_RECORD_PADDING, OPT_S_DEBUGBROKE, \
+ OPT_S_COMP, OPT_S__LAST
# define OPT_S_OPTIONS \
{"no_ssl3", OPT_S_NOSSL3, '-',"Just disable SSLv3" }, \
@@ -244,8 +244,10 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate,
{"client_sigalgs", OPT_S_CLIENTSIGALGS, 's', \
"Signature algorithms to support for client certificate" \
" authentication (colon-separated list)" }, \
+ {"groups", OPT_S_GROUPS, 's', \
+ "Groups to advertise (colon-separated list)" }, \
{"curves", OPT_S_CURVES, 's', \
- "Elliptic curves to advertise (colon-separated list)" }, \
+ "Groups to advertise (colon-separated list)" }, \
{"named_curve", OPT_S_NAMEDCURVE, 's', \
"Elliptic curve used for ECDHE (server-side only)" }, \
{"cipher", OPT_S_CIPHER, 's', "Specify cipher list to be used"}, \
@@ -276,6 +278,7 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate,
case OPT_S_STRICT: \
case OPT_S_SIGALGS: \
case OPT_S_CLIENTSIGALGS: \
+ case OPT_S_GROUPS: \
case OPT_S_CURVES: \
case OPT_S_NAMEDCURVE: \
case OPT_S_CIPHER: \
diff --git a/doc/man3/SSL_CONF_cmd.pod b/doc/man3/SSL_CONF_cmd.pod
index efd766d..6731cf7 100644
--- a/doc/man3/SSL_CONF_cmd.pod
+++ b/doc/man3/SSL_CONF_cmd.pod
@@ -73,6 +73,26 @@ The B<value> argument is a colon separated list of curves. The curve can be
either the B<NIST> name (e.g. B<P-256>) or an OpenSSL OID name (e.g
B<prime256v1>). Curve names are case sensitive.
+=item B<-groups>
+
+This sets the supported groups. For clients, the groups are
+sent using the supported groups extension. For servers, it is used
+to determine which group to use. This setting affects groups used for both
+signatures and key exchange, if applicable. It also affects the preferred
+key_share sent by a client in a TLSv1.3 compatible connection.
+
+The B<value> argument is a colon separated list of groups. The group can be
+either the B<NIST> name (e.g. B<P-256>), some other commonly used name where
+applicable (e.g. B<X25519>) or an OpenSSL OID name (e.g B<prime256v1>). Group
+names are case sensitive. The list should be in order of preference with the
+most preferred group first. The first listed group will be the one used for a
+key_share by a TLSv1.3 client.
+
+=item B<-curves>
+
+This is a synonym for the "-groups" command.
+
+
=item B<-named_curve>
This sets the temporary curve used for ephemeral ECDH modes. Only used by
@@ -273,16 +293,24 @@ used to determine which signature algorithm to with the client certificate.
The syntax of B<value> is identical to B<SignatureAlgorithms>. If not set then
the value set for B<SignatureAlgorithms> will be used instead.
-=item B<Curves>
+=item B<Groups>
-This sets the supported elliptic curves. For clients the curves are
-sent using the supported curves extension. For servers it is used
-to determine which curve to use. This setting affects curves used for both
-signatures and key exchange, if applicable.
+This sets the supported groups. For clients, the groups are
+sent using the supported groups extension. For servers, it is used
+to determine which group to use. This setting affects groups used for both
+signatures and key exchange, if applicable. It also affects the preferred
+key_share sent by a client in a TLSv1.3 compatible connection.
-The B<value> argument is a colon separated list of curves. The curve can be
-either the B<NIST> name (e.g. B<P-256>) or an OpenSSL OID name (e.g
-B<prime256v1>). Curve names are case sensitive.
+The B<value> argument is a colon separated list of groups. The group can be
+either the B<NIST> name (e.g. B<P-256>), some other commonly used name where
+applicable (e.g. B<X25519>) or an OpenSSL OID name (e.g B<prime256v1>). Group
+names are case sensitive. The list should be in order of preference with the
+most preferred group first. The first listed group will be the one used for a
+key_share by a TLSv1.3 client.
+
+=item B<Curves>
+
+This is a synonym for the "Groups" command.
=item B<MinProtocol>
More information about the openssl-commits
mailing list