mumble icon indicating copy to clipboard operation
mumble copied to clipboard

Config option to set elliptic curve(s) for ECDSA/ECDHE

Open Darkspirit opened this issue 8 years ago • 4 comments

Not found here https://github.com/mumble-voip/mumble/pull/1677

If there is a secp384r1 ECDSA certificate in use and you want long-term security https://www.keylength.com/en/3/ (Level 8), you want to set secp521r1 as curve for ECDHE (until curve448 has been landed in OpenSSL). But you can't just allow secp521r1, because the ECDSA cert then won't work with it's secp384r1 curve.

So there should be a config option like sslCurves=secp521r1:secp384r1 or sslCurves=secp521r1 or as default: sslCurves=auto

Please do it like: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ecdh_curve

Darkspirit avatar Oct 16 '16 11:10 Darkspirit