diff options
| author | Nick Mathewson <nickm@torproject.org> | 2013-10-31 14:03:01 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2013-10-31 14:03:01 -0400 |
| commit | 61029d69269d58e530028ee69b148581d3d8bd93 (patch) | |
| tree | 717d5e656824d14e9ad994e586a99fca6e65a180 | |
| parent | a19e3e26f467ecbf31f2c4174d699cd1989caf7a (diff) | |
| parent | 1b312f7b55bc5322f3029ad12715d9f348d44650 (diff) | |
| download | tor-61029d69269d58e530028ee69b148581d3d8bd93.tar tor-61029d69269d58e530028ee69b148581d3d8bd93.tar.gz | |
Merge remote-tracking branch 'origin/maint-0.2.4'
| -rw-r--r-- | changes/bug9780 | 8 | ||||
| -rw-r--r-- | doc/tor.1.txt | 2 | ||||
| -rw-r--r-- | src/common/tortls.c | 4 |
3 files changed, 10 insertions, 4 deletions
diff --git a/changes/bug9780 b/changes/bug9780 new file mode 100644 index 000000000..3cb51bd52 --- /dev/null +++ b/changes/bug9780 @@ -0,0 +1,8 @@ + o Minor bugfixes (performance, fingerprinting): + - Our default TLS ecdhe groups were backwards: we meant to be using + P224 for relays (for performance win) and P256 for bridges (since + it is more common in the wild). Instead we had it backwards. After + reconsideration, we decided that the default should be P256 on all + hosts, since its security is probably better, and since P224 is + reportedly used quite little in the wild. Found by "skruffy" on + IRC. Fix for bug 9780; bugfix on 0.2.4.8-alpha. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 993b7cb9b..5dc17b5f3 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1671,7 +1671,7 @@ is non-zero): What EC group should we try to use for incoming TLS connections? P224 is faster, but makes us stand out more. Has no effect if we're a client, or if our OpenSSL version lacks support for ECDHE. - (Default: P224 for public servers; P256 for bridges.) + (Default: P256) [[CellStatistics]] **CellStatistics** **0**|**1**:: When this option is enabled, Tor writes statistics on the mean time that diff --git a/src/common/tortls.c b/src/common/tortls.c index 77ade866e..5aee664b8 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1344,10 +1344,8 @@ tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime, nid = NID_secp224r1; else if (flags & TOR_TLS_CTX_USE_ECDHE_P256) nid = NID_X9_62_prime256v1; - else if (flags & TOR_TLS_CTX_IS_PUBLIC_SERVER) - nid = NID_X9_62_prime256v1; else - nid = NID_secp224r1; + nid = NID_X9_62_prime256v1; /* Use P-256 for ECDHE. */ ec_key = EC_KEY_new_by_curve_name(nid); if (ec_key != NULL) /*XXXX Handle errors? */ |