openssl: Remove workaround for Brainpool ECDH curves for older OpenSSL versions
Using the workaround with the EVP interface, which we use to derive shared
keys since 74e02ff5e6 ("openssl: Mainly use EVP interface for ECDH"),
would actually require us to register the OIDs of these curves as NID.
Otherwise, the two EC_GROUPs used by private and public key objects
are not considered the same and the key derivation fails.
Since the curves are supported by OpenSSL since 1.0.2 it's probably rare to
find a version without them nowadays. One exception is the old BoringSSL
version we still use on Android, which defines the NIDs but not the curve
data. However, that version also lacks support to register OIDs as NIDs,
so the only option to support these groups there would be to got back to not
using the EVP interface, which isn't in anyone's interest. If there really
is a need for them there, we could probably patch BoringSSL or use OpenSSL.
This commit is contained in:
@@ -640,10 +640,12 @@ METHOD(plugin_t, get_features, int,
|
||||
PLUGIN_PROVIDE(DH, ECP_521_BIT),
|
||||
PLUGIN_PROVIDE(DH, ECP_224_BIT),
|
||||
PLUGIN_PROVIDE(DH, ECP_192_BIT),
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x10002000L
|
||||
PLUGIN_PROVIDE(DH, ECP_256_BP),
|
||||
PLUGIN_PROVIDE(DH, ECP_384_BP),
|
||||
PLUGIN_PROVIDE(DH, ECP_512_BP),
|
||||
PLUGIN_PROVIDE(DH, ECP_224_BP),
|
||||
#endif /* OPENSSL_VERSION_NUMBER */
|
||||
#endif /* OPENSSL_NO_ECDH */
|
||||
#ifndef OPENSSL_NO_DH
|
||||
/* MODP DH groups */
|
||||
|
||||
Reference in New Issue
Block a user