Make TLS groups configurable#8076
Conversation
| "type": "array", | ||
| "items": { | ||
| "type": "string", | ||
| "enum": [ |
There was a problem hiding this comment.
The node configuration is not captured by attestation, and therefore also not by join policy, so it cannot contain security-sensitive settings such as supported groups. Otherwise a joining node could pick weak values that would neither be auditable through the ledger, nor rejected by policy.
I think this is ideally moved to the code, where we detect if we crypto provider support PQC values, and extend the list in that case. If it must be configurable per node, then it would have to be a CLI value, but I don't think it's necessary.
| SSL_set1_curves_list(ssl, "P-521:P-384:P-256"); | ||
| // Restrict the supported groups to those configured by the operator. | ||
| const auto group_list = groups_to_list(groups); | ||
| validate_groups(groups); |
There was a problem hiding this comment.
What is the relationship between groups and curves?
There was a problem hiding this comment.
OpenSSL’s curves setters are exact legacy aliases for the groups setters—not separate constraints. “Groups” is the TLS 1.3 terminology encompassing EC curves, finite-field DH, and hybrid/PQ groups. Calling either replaces the same list; SSL_CTX_* sets context defaults, while SSL_* sets the individual connection.
The list controls key exchange and, for TLS ≤1.2, EC signature groups. In TLS 1.3, signatures are separate. Also, “first mutually supported group wins” is not strictly true: OpenSSL may prefer an existing key share to avoid a retry. OpenSSL 3.5 requires /-separated security tiers to strictly prefer PQ over classical fallback; this PR currently joins everything with :.
References: OpenSSL 3.3 groups/curves API and OpenSSL 3.5 group-tuple semantics.
There was a problem hiding this comment.
TLS 1.3 separates key exchange groups from signature schemes:
SSL_CTX_set1_sigalgs_list(ctx, "ecdsa_secp384r1_sha384:rsa_pss_rsae_sha256");
SSL_set1_sigalgs_list(ssl, "ecdsa_secp384r1_sha384:rsa_pss_rsae_sha256");
For client-certificate authentication, there are corresponding *_set1_client_sigalgs_list() calls. PR #8076 does not set these, so OpenSSL’s defaults govern signatures; its groups setting controls only TLS 1.3 key agreement.
2 participants
No description provided.