Content-Type: text/plain Content-Disposition: inline Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.509 (Entity 5.509) From: ghudson@mit.edu Subject: git commit Content-Length: 1563 PKINIT ECDH support Add support for elliptic curve key exchange to PKINIT (RFC 5349 section 4). Extend pkinit_dh_min_bits to allow the string values "P-256", "P-384", and "P-521", using rough finite-field strength equivalents to rank them relative to the Oakley Diffie-Hellman groups. When processing TD-DH-PARAMETERS on the client, only accept the three Oakley groups or the three supported elliptic curve groups. Previously we accepted any Diffie-Hellman parameters that passed EVP_PKEY_param_check()/DH_check() and had equal or better bit strength to the original proposal. https://github.com/krb5/krb5/commit/0f870b1bcad960fd5319a3f97aafd7f4a289e2fb Author: Greg Hudson Commit: 0f870b1bcad960fd5319a3f97aafd7f4a289e2fb Branch: master doc/admin/conf_files/kdc_conf.rst | 7 +- doc/admin/conf_files/krb5_conf.rst | 7 +- src/plugins/preauth/pkinit/pkinit.h | 6 +- src/plugins/preauth/pkinit/pkinit_clnt.c | 17 +- src/plugins/preauth/pkinit/pkinit_constants.c | 27 ++ src/plugins/preauth/pkinit/pkinit_crypto.h | 7 + src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 470 ++++++++++++++------- src/plugins/preauth/pkinit/pkinit_crypto_openssl.h | 4 +- src/plugins/preauth/pkinit/pkinit_lib.c | 3 - src/plugins/preauth/pkinit/pkinit_srv.c | 17 +- src/plugins/preauth/pkinit/pkinit_trace.h | 11 + src/tests/t_pkinit.py | 12 + 12 files changed, 405 insertions(+), 183 deletions(-)