<div dir="ltr">Hi Matt,<div><br></div><div>Thanks for response.</div><div><br></div><div><span class="gmail-im" style="color:rgb(80,0,80)">> 1) Supress or a way to remove secp521r1 from the currenlty installed<br>> openssl.<br><br></span>You can specify the list of groups by calling SSL_CTX_set1_groups_list<br>(or SSL_set1_groups_list) from your application. See:<br><br><a href="https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set1_groups_list.html" rel="noreferrer" target="_blank">https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set1_groups_list.html</a><br></div><div><br></div><div>--> Is there a way I can compile openssl itself to exclude '<font color="#000000">secp521r1' and install? The reason I ask is because application I am testing is squid(</font><a href="http://squid-cache.org">squid-cache.org</a><font color="#000000">) for ssl bumping purposes and it has limited </font>configurability<font color="#000000">.</font></div><div><font color="#000000"><br></font></div><div><font color="#000000">Thanks,</font></div><div><font color="#000000">Vinod</font></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Jul 2, 2021 at 4:32 PM Matt Caswell <<a href="mailto:matt@openssl.org">matt@openssl.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
<br>
On 01/07/2021 07:21, vinod mg wrote:<br>
> 1) Supress or a way to remove secp521r1 from the currenlty installed<br>
> openssl.<br>
<br>
You can specify the list of groups by calling SSL_CTX_set1_groups_list <br>
(or SSL_set1_groups_list) from your application. See:<br>
<br>
<a href="https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set1_groups_list.html" rel="noreferrer" target="_blank">https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set1_groups_list.html</a><br>
<br>
> 2) Add the cipher - "0xbaba TLS_GREASE_BA GREASE" like we see in<br>
> chrome.<br>
<br>
This is not a real cipher. It does nothing and is always ignored. <br>
OpenSSL does not support sending this value.<br>
<br>
Matt<br>
<br>
<br>
> <br>
> I am ok with custom install as well, if above cannot be done with<br>
> already installed openssl package. Please share any wiki I can<br>
> follow to impliment the same.<br>
> <br>
> ~]# openssl ecparam -list_curves<br>
> <br>
> secp224r1 : NIST/SECG curve over a 224 bit prime field<br>
> <br>
> secp256k1 : SECG curve over a 256 bit prime field<br>
> <br>
> secp384r1 : NIST/SECG curve over a 384 bit prime field<br>
> <br>
> /secp521r1 : NIST/SECG curve over a 521 bit prime field/<br>
> <br>
> prime256v1: X9.62/SECG curve over a 256 bit prime field<br>
> <br>
> <br>
> I am using below OS and version-<br>
> <br>
> # cat /etc/redhat-release<br>
> <br>
> Red Hat Enterprise Linux release 8.3 (Ootpa)<br>
> <br>
> <br>
> # opensslversion -a<br>
> <br>
> OpenSSL 1.1.1g FIPS21 Apr 2020<br>
> <br>
> built on: Thu Mar 25 16:46:53 2021 UTC<br>
> <br>
> platform: linux-x86_64<br>
> <br>
> options:bn(64,64) md2(char) rc4(16x,int) des(int) idea(int)<br>
> blowfish(ptr)<br>
> <br>
> compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -O2 -g<br>
> -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2<br>
> -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong<br>
> -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1<br>
> -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic<br>
> -fasynchronous-unwind-tables -fstack-clash-protection<br>
> -fcf-protection -Wa,--noexecstack<br>
> -Wa,--generate-missing-build-notes=yes<br>
> -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -DOPENSSL_USE_NODELETE<br>
> -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2<br>
> -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m<br>
> -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM<br>
> -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM<br>
> -DX25519_ASM -DPOLY1305_ASM -DZLIB -DNDEBUG -DPURIFY<br>
> -DDEVRANDOM="\"/dev/urandom\""<br>
> -DSYSTEM_CIPHERS_FILE="/etc/crypto-policies/back-ends/openssl.config"<br>
> <br>
> OPENSSLDIR: "/etc/pki/tls"<br>
> <br>
> ENGINESDIR: "/usr/lib64/engines-1.1"<br>
> <br>
> Seeding source: os-specific<br>
> <br>
> engines:rdrand dynamic<br>
> <br>
> <br>
> Really appriciate your time and help, thanks in advance.<br>
> <br>
> Thanks,<br>
> Vinod<br>
> <br>
</blockquote></div>