Здравствуйте!
Онлайн тест на сайте https://www.htbridge.com/ssl/
указывает на доступность слабых/не совместимых со стандартом NIST
эллиптических кривых:

SUPPORTED ELLIPTIC CURVES
List of all elliptic curves supported by the server:

B-571 (sect571r1) (570 bits) Good configuration
K-571 (sect571k1) (570 bits) Good configuration
P-521 (secp521r1) (521 bits) Good configuration
brainpoolP512r1 (512 bits) Good configuration
K-409 (sect409k1) (407 bits) Good configuration
B-409 (sect409r1) (409 bits) Good configuration
brainpoolP384r1 (384 bits) Good configuration
P-384 (secp384r1) (384 bits) Good configuration
K-283 (sect283k1) (281 bits) Good configuration
B-283 (sect283r1) (282 bits) Good configuration
brainpoolP256r1 (256 bits) Good configuration
secp256k1 (256 bits) Good configuration
P-256 (prime256v1) (256 bits) Good configuration
sect239k1 (238 bits) Good configuration
K-233 (sect233k1) (232 bits) Good configuration
B-233 (sect233r1) (233 bits) Good configuration
secp224k1 (225 bits) Good configuration
P-224 (secp224r1) (224 bits) Good configuration
sect193r1 (193 bits) Non-compliant with NIST guidelines
sect193r2 (193 bits) Non-compliant with NIST guidelines
secp192k1 (192 bits) Non-compliant with NIST guidelines
P-192 (prime192v1) (192 bits) Non-compliant with NIST guidelines
K-163 (sect163k1) (163 bits) Non-compliant with NIST guidelines
sect163r1 (162 bits) Non-compliant with NIST guidelines
B-163 (sect163r2) (163 bits) Non-compliant with NIST guidelines
secp160k1 (161 bits) Non-compliant with NIST guidelines
secp160r1 (161 bits) Non-compliant with NIST guidelines
secp160r2 (161 bits) Non-compliant with NIST guidelines

попытка подрезать ненужные, указав в одном из сайтов параметр
ssl_ecdh_curve
sect571r1:sect571k1:secp521r1:brainpoolP512r1:sect409k1:sect409r1:brainpoolP384r1:secp384r1:sect283k1:sect283r1:brainpoolP256r1:secp256k1:prime256v1;
не привела к результату.
Отсюда вопрос, как сократить список доступных эллиптических кривых с
разрядностью менее 256 бит?

_______________________________________________
nginx-ru mailing list
nginx-ru@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-ru