FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

doc: add tls.DEFAULT_ECDH_CURVE · nodejs/node@998fd1e · GitHub

/ node Public

Commit 998fd1e

Browse files
sam-github
authored and
MylesBorins
committed
doc: add tls.DEFAULT_ECDH_CURVE
A user can change the default curve for ECDH key agreement by using tls.DEFAULT_ECDH_CURVE. PR-URL: #10264 Reviewed-By: Roman Reiss <me@silverwind.io> Reviewed-By: Italo A. Casas <me@italoacasas.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
1 parent 4995a81 commit 998fd1e

1 file changed

Lines changed: 36 additions & 26 deletions

File tree

‎doc/api/tls.md‎

Lines changed: 36 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -925,10 +925,10 @@ added: v0.11.13
925925
*Note*: [`tls.createServer()`][] sets the default value to `true`, other
926926
APIs that create secure contexts leave it unset.
927927
* `ecdhCurve` {string} A string describing a named curve to use for ECDH key
928-
agreement or `false` to disable ECDH. Defaults to `prime256v1` (NIST P-256).
929-
Use [`crypto.getCurves()`][] to obtain a list of available curve names. On
930-
recent releases, `openssl ecparam -list_curves` will also display the name
931-
and description of each available elliptic curve.
928+
agreement or `false` to disable ECDH. Defaults to
929+
[`tls.DEFAULT_ECDH_CURVE`]. Use [`crypto.getCurves()`][] to obtain a list
930+
of available curve names. On recent releases, `openssl ecparam -list_curves`
931+
will also display the name and description of each available elliptic curve.
932932
* `dhparam` {string|Buffer} Diffie Hellman parameters, required for
933933
[Perfect Forward Secrecy][]. Use `openssl dhparam` to create the parameters.
934934
The key length must be greater than or equal to 1024 bits, otherwise an
@@ -1076,6 +1076,13 @@ For example:
10761076
console.log(tls.getCiphers()); // ['AES128-SHA', 'AES256-SHA', ...]
10771077
```
10781078

1079+
## tls.DEFAULT_ECDH_CURVE
1080+
1081+
The default curve name to use for ECDH key agreement in a tls server. The
1082+
default value is `'prime256v1'` (NIST P-256). Consult [RFC 4492] and
1083+
[FIPS.186-4] for more details.
1084+
1085+
10791086
## Deprecated APIs
10801087

10811088
### Class: CryptoStream
@@ -1183,32 +1190,35 @@ secure_socket = tls.TLSSocket(socket, options);
11831190

11841191
where `secure_socket` has the same API as `pair.cleartext`.
11851192

1186-
[OpenSSL cipher list format documentation]: https://www.openssl.org/docs/man1.0.2/apps/ciphers.html#CIPHER-LIST-FORMAT
11871193
[Chrome's 'modern cryptography' setting]: https://www.chromium.org/Home/chromium-security/education/tls#TOC-Cipher-Suites
1188-
[OpenSSL Options]: crypto.html#crypto_openssl_options
1189-
[modifying the default cipher suite]: #tls_modifying_the_default_tls_cipher_suite
1190-
[specific attacks affecting larger AES key sizes]: https://www.schneier.com/blog/archives/2009/07/another_new_aes.html
1191-
[`crypto.getCurves()`]: crypto.html#crypto_crypto_getcurves
1192-
[`tls.createServer()`]: #tls_tls_createserver_options_secureconnectionlistener
1193-
[`tls.createSecurePair()`]: #tls_tls_createsecurepair_context_isserver_requestcert_rejectunauthorized_options
1194-
[`tls.TLSSocket`]: #tls_class_tls_tlssocket
1195-
[`net.Server`]: net.html#net_class_net_server
1196-
[`net.Socket`]: net.html#net_class_net_socket
1197-
[`net.Server.address()`]: net.html#net_server_address
1198-
[`'secureConnect'`]: #tls_event_secureconnect
1199-
[`'secureConnection'`]: #tls_event_secureconnection
1200-
[Perfect Forward Secrecy]: #tls_perfect_forward_secrecy
1201-
[Stream]: stream.html#stream_stream
1202-
[SSL_METHODS]: https://www.openssl.org/docs/man1.0.2/ssl/ssl.html#DEALING-WITH-PROTOCOL-METHODS
1203-
[tls.Server]: #tls_class_tls_server
1204-
[SSL_CTX_set_timeout]: https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_timeout.html
1205-
[Forward secrecy]: https://en.wikipedia.org/wiki/Perfect_forward_secrecy
12061194
[DHE]: https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange
12071195
[ECDHE]: https://en.wikipedia.org/wiki/Elliptic_curve_Diffie%E2%80%93Hellman
1208-
[asn1.js]: https://npmjs.org/package/asn1.js
1196+
[FIPS.186-4]: http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf
1197+
[Forward secrecy]: https://en.wikipedia.org/wiki/Perfect_forward_secrecy
12091198
[OCSP request]: https://en.wikipedia.org/wiki/OCSP_stapling
1210-
[TLS recommendations]: https://wiki.mozilla.org/Security/Server_Side_TLS
1199+
[OpenSSL Options]: crypto.html#crypto_openssl_options
1200+
[OpenSSL cipher list format documentation]: https://www.openssl.org/docs/man1.0.2/apps/ciphers.html#CIPHER-LIST-FORMAT
1201+
[Perfect Forward Secrecy]: #tls_perfect_forward_secrecy
1202+
[RFC 4492]: https://www.rfc-editor.org/rfc/rfc4492.txt
1203+
[SSL_CTX_set_timeout]: https://www.openssl.org/docs/man1.0.2/ssl/SSL_CTX_set_timeout.html
1204+
[SSL_METHODS]: https://www.openssl.org/docs/man1.0.2/ssl/ssl.html#DEALING-WITH-PROTOCOL-METHODS
1205+
[Stream]: stream.html#stream_stream
12111206
[TLS Session Tickets]: https://www.ietf.org/rfc/rfc5077.txt
1207+
[TLS recommendations]: https://wiki.mozilla.org/Security/Server_Side_TLS
1208+
[`'secureConnect'`]: #tls_event_secureconnect
1209+
[`'secureConnection'`]: #tls_event_secureconnection
1210+
[`crypto.getCurves()`]: crypto.html#crypto_crypto_getcurves
1211+
[`net.Server.address()`]: net.html#net_server_address
1212+
[`net.Server`]: net.html#net_class_net_server
1213+
[`net.Socket`]: net.html#net_class_net_socket
1214+
[`tls.DEFAULT_ECDH_CURVE`]: #tls_tls_default_ecdh_curve
12121215
[`tls.TLSSocket.getPeerCertificate()`]: #tls_tlssocket_getpeercertificate_detailed
1213-
[`tls.createSecureContext()`]: #tls_tls_createsecurecontext_options
1216+
[`tls.TLSSocket`]: #tls_class_tls_tlssocket
12141217
[`tls.connect()`]: #tls_tls_connect_options_callback
1218+
[`tls.createSecureContext()`]: #tls_tls_createsecurecontext_options
1219+
[`tls.createSecurePair()`]: #tls_tls_createsecurepair_context_isserver_requestcert_rejectunauthorized_options
1220+
[`tls.createServer()`]: #tls_tls_createserver_options_secureconnectionlistener
1221+
[asn1.js]: https://npmjs.org/package/asn1.js
1222+
[modifying the default cipher suite]: #tls_modifying_the_default_tls_cipher_suite
1223+
[specific attacks affecting larger AES key sizes]: https://www.schneier.com/blog/archives/2009/07/another_new_aes.html
1224+
[tls.Server]: #tls_class_tls_server

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL