From 206291a0bc82ca5e699fdde49f602f8e79b829dd Mon Sep 17 00:00:00 2001 From: Hakase Date: Thu, 18 Apr 2019 02:01:45 +0900 Subject: [PATCH] Remove Curve (P-224, P-521) --- README.ko.md | 2 +- README.md | 2 +- src/http/modules/ngx_http_ssl_module.c | 2 +- src/mail/ngx_mail_ssl_module.c | 2 +- src/stream/ngx_stream_ssl_module.c | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/README.ko.md b/README.ko.md index e069eed..e99db08 100644 --- a/README.ko.md +++ b/README.ko.md @@ -25,7 +25,7 @@ example Web Server - [https://ssl.hakase.io/](https://ssl.hakase.io/) - ssl_protocols : TLSv1.2 TLSv1.3 - ssl_ciphers : [TLS13+AESGCM+AES128|TLS13+CHACHA20]:TLS13+AESGCM+AES256:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA - ssl_prefer_server_ciphers : On - - ssl_ecdh_curve : X25519:P-256:P-384:P-224:P-521 + - ssl_ecdh_curve : X25519:P-256:P-384 - ssl_session_timeout : 64800 (< TLSv1.3) - ssl_session_timeout_tls13 : 172800 (TLSv1.3 only) - **ssl_dhparam** 는 사용하지 마십시오. 필요 없습니다. diff --git a/README.md b/README.md index 76e7cb2..1f9ca6b 100644 --- a/README.md +++ b/README.md @@ -26,7 +26,7 @@ Example Web Server - [https://ssl.hakase.io/](https://ssl.hakase.io/) - ssl_protocols : TLSv1.2 TLSv1.3 - ssl_ciphers : [TLS13+AESGCM+AES128|TLS13+CHACHA20]:TLS13+AESGCM+AES256:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA - ssl_prefer_server_ciphers : On - - ssl_ecdh_curve : X25519:P-256:P-384:P-224:P-521 + - ssl_ecdh_curve : X25519:P-256:P-384 - ssl_session_timeout : 64800 (< TLSv1.3) - ssl_session_timeout_tls13 : 172800 (TLSv1.3 only) - DO NOT USE **ssl_dhparam**. Not required. diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c index 92f912a..5cfd391 100644 --- a/src/http/modules/ngx_http_ssl_module.c +++ b/src/http/modules/ngx_http_ssl_module.c @@ -15,7 +15,7 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c, #define NGX_DEFAULT_CIPHERS "[TLS13+AESGCM+AES128|TLS13+CHACHA20]:TLS13+AESGCM+AES256:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA" -#define NGX_DEFAULT_ECDH_CURVE "X25519:P-256:P-384:P-224:P-521" +#define NGX_DEFAULT_ECDH_CURVE "X25519:P-256:P-384" #define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1" diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c index 4ee7b5d..5ccf024 100644 --- a/src/mail/ngx_mail_ssl_module.c +++ b/src/mail/ngx_mail_ssl_module.c @@ -11,7 +11,7 @@ #define NGX_DEFAULT_CIPHERS "[TLS13+AESGCM+AES128|TLS13+CHACHA20]:TLS13+AESGCM+AES256:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA" -#define NGX_DEFAULT_ECDH_CURVE "X25519:P-256:P-384:P-224:P-521" +#define NGX_DEFAULT_ECDH_CURVE "X25519:P-256:P-384" static void *ngx_mail_ssl_create_conf(ngx_conf_t *cf); diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c index 61df997..b416abc 100644 --- a/src/stream/ngx_stream_ssl_module.c +++ b/src/stream/ngx_stream_ssl_module.c @@ -15,7 +15,7 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c, #define NGX_DEFAULT_CIPHERS "[TLS13+AESGCM+AES128|TLS13+CHACHA20]:TLS13+AESGCM+AES256:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA" -#define NGX_DEFAULT_ECDH_CURVE "X25519:P-256:P-384:P-224:P-521" +#define NGX_DEFAULT_ECDH_CURVE "X25519:P-256:P-384" static ngx_int_t ngx_stream_ssl_handler(ngx_stream_session_t *s);