On Tue, Feb 18, 2014, Varma Dantuluri wrote: > Thanks Steve for the response. Given the current way it is done in > OpenSSL-1.0.1f, what is the right thing for the application to do? Should > the application be using a static EC_KEY for each of the curves that are > supported? >
For 1.0.1f the callback is pretty useless as you can't easily tell which curves the peer supports. So instead most application pick a common curve like P-256 (which just about everything should support) and set it as s single set of ECDH parameters using SSL_CTX_set_tmp_ecdh(). Then if the peer supports P-256 it will be used otherwise a non ECDH ciphersuite will be used instead. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
