Postgres Pro
Downloads
Home   >   mailing lists

Add support to TLS 1.3 cipher suites and curves lists - Mailing list pgsql-hackers

From Erica Zhang
Subject Add support to TLS 1.3 cipher suites and curves lists
Date
Msg-id tencent_063F89FA72CCF2E48A0DF5338841988E9809@qq.com
Whole thread Raw
Responses Re: Add support to TLS 1.3 cipher suites and curves lists
List pgsql-hackers
Tree view

Hi All,

I’m a Postgres user and I’m looking into restricting the set of allowed ciphers on Postgres and configure a concrete set of curves on our postgres instances.

I see in current Postgres doc mentioned that only TLS1.2 and below cipher lists can be configured. And there is no setting that controls the cipher choices used by TLS1.3.
As for ECDH keys currently postgres opts to support setting only a single elliptic group instead of setting a lists.
As described in below doc link:

Now I have a patch to support settings for TLS1.3 ciphersuites and expanding the configuration option for EC settings. With my patch we can do:
1. Added a new configuration option ssl_ciphers_suites to control the cipher choices used by TLS 1.3.
2. Extend the existing configuration option ssl_ecdh_curve to accept a list of curve names seperated by colon.

Could you please help to review to see if you are interested in having this change in upcoming Postgres major release(It's should be PG17)? 

Thanks in advance.

Attachment

pgsql-hackers by date:

Previous
From: Thomas Munro
Date:
Subject: Re: Assert in heapgettup_pagemode() fails due to underlying buffer change
Next
From: Ashutosh Sharma
Date:
Subject: Re: How about using dirty snapshots to locate dependent objects?