freenginx-1.27.5

[Maxim Dounin]

Hello!

On Thu, Apr 10, 2025 at 08:09:53AM +0300, Maxim Dounin wrote:

> On Wed, Apr 09, 2025 at 09:56:17PM +0200, A. Schulze via nginx wrote:
> 
> > Am 08.04.25 um 17:50 schrieb Maxim Dounin:
> > > Changes with freenginx 1.27.5                                    08 Apr 2025
> > > ...
> > 
> > Hello,
> > 
> > I've build freenginx with the just releases openssl-3.5.0.
> > The new PQ key exchange is enabled in openssl-3.5 and freenginx use it without special configuration.
> > (the defaults for ssl_ecdh_curve are fine)
> > 
> > But in the log, the variable 'ssl_curve' [1] still say only the numeric number 0x11ec
> > Firefox could name that key-exchange as "mlkem768x25519"
> 
> The $ssl_curve variable uses SSL_get_negotiated_group() and then 
> uses OBJ_nid2sn() as long as the group is known to OpenSSL.
> 
> It looks like OpenSSL for some reason decided not to add NIDs for 
> these groups - not sure why.  Either it is just an omission which 
> is going to be fixed, or the intention is to force users to move 
> away from using NIDs to newer interfaces, such as 
> SSL_get0_group_name() and SSL_group_to_name().
> 
> I suspect this is just an omission and it will be eventually fixed 
> in OpenSSL.  (Just for the record, with BoringSSL the code just 
> works and provides correct $ssl_curves name for X25519MLKEM768.)

For the record, here is the relevant OpenSSL issue:

https://github.com/openssl/openssl/issues/27137

It appears that the omission was indeed unintentional, but the 
suggested solution is to switch to new interfaces.

[...]

-- 
Maxim Dounin
http://mdounin.ru/