{"action":"created","issue":{"url":"https://api.github.com/repos/cloudflare/cfssl/issues/222","labels_url":"https://api.github.com/repos/cloudflare/cfssl/issues/222/labels{/name}","comments_url":"https://api.github.com/repos/cloudflare/cfssl/issues/222/comments","events_url":"https://api.github.com/repos/cloudflare/cfssl/issues/222/events","html_url":"https://github.com/cloudflare/cfssl/pull/222","id":81185374,"number":222,"title":"Add support for scanning server elliptic curve preferences.","user":{"login":"jkroll","id":132342,"avatar_url":"https://avatars.githubusercontent.com/u/132342?v=3","gravatar_id":"","url":"https://api.github.com/users/jkroll","html_url":"https://github.com/jkroll","followers_url":"https://api.github.com/users/jkroll/followers","following_url":"https://api.github.com/users/jkroll/following{/other_user}","gists_url":"https://api.github.com/users/jkroll/gists{/gist_id}","starred_url":"https://api.github.com/users/jkroll/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jkroll/subscriptions","organizations_url":"https://api.github.com/users/jkroll/orgs","repos_url":"https://api.github.com/users/jkroll/repos","events_url":"https://api.github.com/users/jkroll/events{/privacy}","received_events_url":"https://api.github.com/users/jkroll/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-05-26T23:35:49Z","updated_at":"2015-06-05T22:50:13Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/cloudflare/cfssl/pulls/222","html_url":"https://github.com/cloudflare/cfssl/pull/222","diff_url":"https://github.com/cloudflare/cfssl/pull/222.diff","patch_url":"https://github.com/cloudflare/cfssl/pull/222.patch"},"body":"This change adds support for scanning server curve choice preferences for the ECDH cipher suites, which is interesting in light of logjam (even though that only affects non-ED DH, it's nice to know what's happening in case something similar becomes interesting in the future). This fixes #221, although it's slightly more involved than @jacobhaven suggested. Specifically, the server curve preference is not declared until the ServerKeyExchange message, meaning that you have to go well past ServerHello to extract it.\r\n\r\nThe scan is performed using the same algorithm as for cipher suites, where the server's negotiated preference is dropped iteratively from the list of all possible choices until we've enumerated the server's preference list.\r\n\r\nUpdate: the scan results now seem correct (assuming the right return is only `secp256r1` for all ECDH cipher suites CloudFlare supports - I can't tell from the published SSL config which curve(s) are used). The only remaining issue is that the handshake in cf-tls sometimes fails in specific conditions (assuming the scan results are correct).\r\n\r\nNB - the buildbot always fails here because this code depends on unmerged changes to cf-tls. Is there a way to specify which branch it should build from?"},"comment":{"url":"https://api.github.com/repos/cloudflare/cfssl/issues/comments/109469552","html_url":"https://github.com/cloudflare/cfssl/pull/222#issuecomment-109469552","issue_url":"https://api.github.com/repos/cloudflare/cfssl/issues/222","id":109469552,"user":{"login":"jkroll","id":132342,"avatar_url":"https://avatars.githubusercontent.com/u/132342?v=3","gravatar_id":"","url":"https://api.github.com/users/jkroll","html_url":"https://github.com/jkroll","followers_url":"https://api.github.com/users/jkroll/followers","following_url":"https://api.github.com/users/jkroll/following{/other_user}","gists_url":"https://api.github.com/users/jkroll/gists{/gist_id}","starred_url":"https://api.github.com/users/jkroll/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jkroll/subscriptions","organizations_url":"https://api.github.com/users/jkroll/orgs","repos_url":"https://api.github.com/users/jkroll/repos","events_url":"https://api.github.com/users/jkroll/events{/privacy}","received_events_url":"https://api.github.com/users/jkroll/received_events","type":"User","site_admin":false},"created_at":"2015-06-05T22:50:13Z","updated_at":"2015-06-05T22:50:13Z","body":"Done. I thought the whole tao of Go was that `gofmt` was meant to take care of all that stuff for you. Also, that naming convention seems backwards to me with the rest of the usual Go naming conventions, but never mind."}}