• D
    Auto DH support. · 09599b52
    Dr. Stephen Henson 提交于
    Add auto DH parameter support. This is roughly equivalent to the
    ECDH auto curve selection but for DH. An application can just call
    
    SSL_CTX_set_auto_dh(ctx, 1);
    
    and appropriate DH parameters will be used based on the size of the
    server key.
    
    Unlike ECDH there is no way a peer can indicate the range of DH parameters
    it supports. Some peers cannot handle DH keys larger that 1024 bits for
    example. In this case if you call:
    
    SSL_CTX_set_auto_dh(ctx, 2);
    
    Only 1024 bit DH parameters will be used.
    
    If the server key is 7680 bits or more in size then 8192 bit DH parameters
    will be used: these will be *very* slow.
    
    The old export ciphersuites aren't supported but those are very
    insecure anyway.
    09599b52
ssl_lib.c 90.7 KB