diff options
| author | Peter Eisentraut <peter_e@gmx.net> | 2013-12-07 15:11:44 -0500 |
|---|---|---|
| committer | Peter Eisentraut <peter_e@gmx.net> | 2013-12-07 15:11:44 -0500 |
| commit | 3164721462d547fa2d15e2a2f07eb086a3590fd5 (patch) | |
| tree | 2f834c8d59ba452f47136cfde94a62d806715492 /doc/src | |
| parent | 91484409bdd17f330d10671d388b72d4ef1451d7 (diff) | |
| download | postgresql-3164721462d547fa2d15e2a2f07eb086a3590fd5.tar.gz postgresql-3164721462d547fa2d15e2a2f07eb086a3590fd5.zip | |
SSL: Support ECDH key exchange
This sets up ECDH key exchange, when compiling against OpenSSL that
supports EC. Then the ECDHE-RSA and ECDHE-ECDSA cipher suites can be
used for SSL connections. The latter one means that EC keys are now
usable.
The reason for EC key exchange is that it's faster than DHE and it
allows to go to higher security levels where RSA will be horribly slow.
There is also new GUC option ssl_ecdh_curve that specifies the curve
name used for ECDH. It defaults to "prime256v1", which is the most
common curve in use in HTTPS.
From: Marko Kreen <markokr@gmail.com>
Reviewed-by: Adrian Klaver <adrian.klaver@gmail.com>
Diffstat (limited to 'doc/src')
| -rw-r--r-- | doc/src/sgml/config.sgml | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index 1946bb083d9..fee83c1496b 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -907,6 +907,24 @@ include 'filename' </listitem> </varlistentry> + <varlistentry id="guc-ssl-ecdh-curve" xreflabel="ssl_ecdh_curve"> + <term><varname>ssl_ecdh_curve</varname> (<type>string</type>)</term> + <indexterm> + <primary><varname>ssl_ecdh_curve</> configuration parameter</primary> + </indexterm> + <listitem> + <para> + Specifies the name of the curve to use in ECDH key exchanges. The + default is <literal>prime256p1</>. + </para> + + <para> + The list of available curves can be shown with the command + <literal>openssl ecparam -list_curves</literal>. + </para> + </listitem> + </varlistentry> + <varlistentry id="guc-password-encryption" xreflabel="password_encryption"> <term><varname>password_encryption</varname> (<type>boolean</type>)</term> <indexterm> |