Open ryru opened 4 years ago
The current implementation of FFDHE in strongSwan in diffie_hellman.[ch]
uses the NIST prime numbers specified in RFC 3526 for ECDH. RFC 8446 though refers to the prime numbers specified in RFC 7919. Therefore this issue would require additional work and is not achievable easily.
Since it is not a very important feature (most would probably prefer EC based DH key exchange anyway) it is postponed for later or maybe it could be closed if no one is requires such a feature.
Since other TLS 1.3 implementations such as Firefox offers also finit field groups, it would make sense to also provide these groups in our implementation.
Note: Finit field groups would also be natively supported by strongSwan in comparison with other tls groups which usually need external 3rd party plugins.
Further it would make sense to rename
tls_named_group_t curve
totls_named_group_t tls_group
sincecurve
is not really accurate anymore.Code snipped from
tls_crypto.c
: