A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE 2020-04-18T14:07:56+00:00 2020-04-18T14:07:56+00:00 jsing 2020-04-18T14:07:56+00:00 urn:sha1:45ae045ccf3a3740b07e9b2ecbbbbb3320d2f36d SSL_get_server_tmp_key() provides the peer ephemeral public key used for key exchange. In the case of TLSv1.3 this is essentially the peer public key from the key share used for TLSv1.3 key exchange, hence make it availaable via SSL_get_server_tmp_key(). ok inoguchi@ tb@ 2020-04-18T13:43:47+00:00 jsing 2020-04-18T13:43:47+00:00 urn:sha1:abc33faa6642ecaef54804e3868c167537a9467a The key share code previously only allowed for key shares to be generated using one of the groups in our default list (X25519, secp256r1, secp384r1). Relax this and allow key shares using any of the groups in our NID list. ok inoguchi@ tb@ 2020-04-17T17:16:53+00:00 jsing 2020-04-17T17:16:53+00:00 urn:sha1:2e87f749d998f3ec34a4a2a2ff59dc9b879cc4d8 Generate a client key share using our preferred group, rather than always using X25519. This means that the key share group can be controlled via SSL{_CTX,}_set1_groups() and SSL{_CTX,}_set1_groups_list(). ok beck@ 2020-02-04T18:06:26+00:00 jsing 2020-02-04T18:06:26+00:00 urn:sha1:55e955577ce91cf9355af5e89ceb0e839a704456 ok inoguchi@ tb@ 2020-02-01T12:41:58+00:00 jsing 2020-02-01T12:41:58+00:00 urn:sha1:417cbaf48fe2b28af88ca93f9a89dea1b12d6ad7 Even if we're not processing/using the peer public key from the key share, we still need to unpack it in order to parse the TLS extension correctly. Resolves issues with TLSv1.3 clients talking to TLSv1.2 server. ok tb@ 2020-01-30T17:09:23+00:00 jsing 2020-01-30T17:09:23+00:00 urn:sha1:8c4b49ffef3b61d982a273df3cd92b2e017aa065 Pull out the key share handling code and provide a clean/self contained interface. This will make it easier to support groups other than X25519. ok beck@ inoguchi@ tb@