database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-12 21:01:52 +03:00
Code Activity

SSL: Support ECDH key exchange

Browse Source 
This sets up ECDH key exchange, when compiling against OpenSSL that
supports EC.  Then the ECDHE-RSA and ECDHE-ECDSA cipher suites can be
used for SSL connections.  The latter one means that EC keys are now
usable.

The reason for EC key exchange is that it's faster than DHE and it
allows to go to higher security levels where RSA will be horribly slow.

There is also new GUC option ssl_ecdh_curve that specifies the curve
name used for ECDH.  It defaults to "prime256v1", which is the most
common curve in use in HTTPS.

From: Marko Kreen <markokr@gmail.com>
Reviewed-by: Adrian Klaver <adrian.klaver@gmail.com>
This commit is contained in:
Peter Eisentraut
2013-12-07 15:11:44 -05:00
parent 91484409bd
commit 3164721462
4 changed files with 69 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/backend/utils/misc/guc.c
View File

@ -127,6 +127,7 @@ extern char *temp_tablespaces;
extern bool ignore_checksum_failure;
extern bool synchronize_seqscans;
extern char *SSLCipherSuites;
extern char *SSLECDHCurve;
extern bool SSLPreferServerCiphers;
#ifdef TRACE_SORT
@ -3150,6 +3151,21 @@ static struct config_string ConfigureNamesString[] =
NULL, NULL, NULL
},
{
{"ssl_ecdh_curve", PGC_POSTMASTER, CONN_AUTH_SECURITY,
gettext_noop("Sets the curve to use for ECDH."),
NULL,
GUC_SUPERUSER_ONLY
},
&SSLECDHCurve,
#ifdef USE_SSL
"prime256v1",
#else
"none",
#endif
NULL, NULL, NULL
},
{
{"application_name", PGC_USERSET, LOGGING_WHAT,
gettext_noop("Sets the application name to be reported in statistics and logs."),