From: Hristo Venev <hristo@venev.name>
Date: Thu, 20 Apr 2017 13:44:31 +0000 (+0100)
Subject: hostapd: Document openssl_ecdh_curves configuration parameter
X-Git-Tag: hostap_2_8~359
X-Git-Url: http://git.ipfire.org/?p=thirdparty%2Fhostap.git;a=commitdiff_plain;h=464064c7e59d1b5530c3597aecca53eaaf863afc

hostapd: Document openssl_ecdh_curves configuration parameter

Signed-off-by: Hristo Venev <hristo@venev.name>
---

diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
index f3584c5b2..ee8f9610c 100644
--- a/hostapd/hostapd.conf
+++ b/hostapd/hostapd.conf
@@ -1014,6 +1014,19 @@ eap_server=0
 # use OpenSSL.
 #openssl_ciphers=DEFAULT:!EXP:!LOW
 
+# OpenSSL ECDH curves
+#
+# This is an OpenSSL specific configuration option for configuring the ECDH
+# curves for EAP-TLS/TTLS/PEAP/FAST server. If not set, automatic curve
+# selection is enabled. If set to an empty string, ECDH curve configuration is
+# not done (the exact library behavior depends on the library version).
+# Otherwise, this is a colon separated list of the supported curves (e.g.,
+# P-521:P-384:P-256). This is applicable only if hostapd is built to use
+# OpenSSL. This must not be used for Suite B cases since the same OpenSSL
+# parameter is set differently in those cases and this might conflict with that
+# design.
+#openssl_ecdh_curves=P-521:P-384:P-256
+
 # Fragment size for EAP methods
 #fragment_size=1400