mirror/mongoose
1
0
Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2024-11-24 19:19:00 +08:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Use weaker but faster cipher suites

Browse Source 
ECDHE is way too slow on ESP8266 w/o cryptochip, this sometimes results in WiFi STA deauths.
Disable DHE completely because it's just hopelessly slow.

PUBLISHED_FROM=d9c8e95b7d5c992f9e127726c569f187b1e0b453
This commit is contained in:
Deomid Ryabkov 2017-11-21 18:16:01 +03:00 committed by Cesanta Bot
parent a197646867
commit 101afbc9b8
1 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
mongoose.c
View File

@ -5181,6 +5181,7 @@ static enum mg_ssl_if_result mg_use_cert(struct mg_ssl_if_ctx *ctx,
}
static const int mg_s_cipher_list[] = {
#if CS_PLATFORM != CS_P_ESP8266
MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
@ -5195,7 +5196,29 @@ static const int mg_s_cipher_list[] = {
MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,
MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256,
MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256,
MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA, 0};
MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA,
#else
/*
* ECDHE is way too slow on ESP8266 w/o cryptochip, this sometimes results
* in WiFi STA deauths. Use weaker but faster cipher suites. Sad but true.
* Disable DHE completely because it's just hopelessly slow.
*/
MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256,
MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256,
MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,
MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,
MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,
MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,
MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA,
#endif /* CS_PLATFORM != CS_P_ESP8266 */
0,
};
/*
* Ciphers can be specified as a colon-separated list of cipher suite names.