hostapd: Document openssl_ecdh_curves configuration parameter

Signed-off-by: Hristo Venev <hristo@venev.name>

diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
index f3584c5b26bd59a34a72ba16863eed65a0a5c028..ee8f9610c24fe7df9577e665196119656f9d7755 100644 (file)
--- a/hostapd/hostapd.conf
+++ b/hostapd/hostapd.conf
@@ -1014,6 +1014,19 @@ eap_server=0
 # use OpenSSL.
 #openssl_ciphers=DEFAULT:!EXP:!LOW
 
+# OpenSSL ECDH curves
+#
+# This is an OpenSSL specific configuration option for configuring the ECDH
+# curves for EAP-TLS/TTLS/PEAP/FAST server. If not set, automatic curve
+# selection is enabled. If set to an empty string, ECDH curve configuration is
+# not done (the exact library behavior depends on the library version).
+# Otherwise, this is a colon separated list of the supported curves (e.g.,
+# P-521:P-384:P-256). This is applicable only if hostapd is built to use
+# OpenSSL. This must not be used for Suite B cases since the same OpenSSL
+# parameter is set differently in those cases and this might conflict with that
+# design.
+#openssl_ecdh_curves=P-521:P-384:P-256
+
 # Fragment size for EAP methods
 #fragment_size=1400