Offer more EC curves by default for client connections
Open
area/tls
enhancement
no stalebot
- Dominant language
- C++
- Stars
- 28.9k
- Forks
- 5.6k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 428
Description
By default Envoy offers only P-256 for EC curves on client connections. This creates hard to diagnose problem when a service offers curves with longer keys only. The error message has `HANDSHAKE_FAILURE_ON_CLIENT_HELLO` and you need to use TCP dump to figure out that there is mismatch between offered EC curves on client and server.
The suggestion is to include curves with higher keys by default for client connections.
"P-256","P-384","P-521" for FIPS and "P-256","P-384","P-521","X25519" for non-FIPS builds.
Contributor guide
Assessment
This issue has not been assessed yet.