On Thu, Jan 10, 2008 at 05:37:47PM -0800, Rodney Thayer wrote:
> >To enable ECDSA certs, just configure an additional cert/key pair in
> >the server. You can configure up to 3 certficates, one RSA cert, one
> >DSA cert and one ECDSA cert. The code for adding more certs is the
> >same for RSA and DSA.
> >
> >Which cipher-suite will actually be used by the client and server depends
> >on the client's and server's cipherlist, and whether the server takes
> >the client's preferences or asserts its own. Clearly both the client and
> >server need to support EC ciphers.
>
> Does 'openssl s_server' support this? Are there public ECC TLS
> implementations this is known to interoperate with?
OpenSSL s_server is a test tool, not an application. In 0.9.9 snapshot
builds, s_server support ECDSA, just point your cert and key files
at an ECDSA cert and private key. I have not checked whether it has a
command-line option to select an EECDH curve, but this is not important.
I only use OpenSSL, I have working code, slated for Postfix 2.6 in Q1
'09, that allows the SMTP server administrator enable EECDH and allows
clients and servers to configure of a third cert/key pair (presumably
ECDSA). With this, Postfix 2.6 will be able to do EECDH key exchange
and ECDSA authentication.
It may be some time before the first public CA signs an ECDSA cert
(especially with an ECDSA CA cert). However, with private-label CAs,
or bilateral key exchange, the EC support in OpenSSL works now when
both the server and client run OpenSSL. I don't have access to other
implementations for interop testing.
--
Viktor.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
