b1940a76ad
TLS used to prefer larger curves, under the idea that a larger curve has a higher security strength and is therefore harder to attack. However, brute force attacks are not a practical concern, so this was not particularly meaningful. If a curve is considered secure enough to be allowed, then we might as well use it. So order curves by resource usage. The exact definition of what this means is purposefully left open. It may include criteria such as performance and memory usage. Risk of side channels could be a factor as well, although it didn't affect the current choice. The current list happens to exactly correspond to the numbers reported by one run of the benchmark program for "full handshake/s" on my machine. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
9 lines
367 B
Text
9 lines
367 B
Text
Default behavior changes
|
|
* Some default policies for X.509 certificate verification and TLS have
|
|
changed: curves and hashes weaker than 255 bits are no longer accepted
|
|
by default. The default order in TLS now favors faster curves over larger
|
|
curves.
|
|
|
|
Removals
|
|
* Remove the compile-time option
|
|
MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE.
|