Full_Name: Jan Bramkamp
OS: FreeBSD 9.1
Submission from: (NULL) (18.104.22.168)
OpenLDAP supports PFS TLS cipher suites using DHE with the
DH *tlso_tmp_dh_cb(SSL*,int,int) callback in libraries/libldap/tls_o.c.
DHE-RSA/DSS cipher suites are very CPU intensive and noticeably increase latency
on low-power hardware. While OpenLDAP supports ECDH-ECDSA cipher suites these
lack the PFS offered by DHE-RSA/DSS cipher suites.
>From my initial search it looks like the correct API to register such a callback
would be SSL_CTX_set_tmp_ecdh_callback(), but im not familiar the OpenLDAP code
base so patching it my self could have unintended consequences.
This how the CA was generated:
openssl ecparam -out private/ca-key.pem -name $CURVE -genkey &&
openssl req -new -x509 -days 365 -key private/ca-key.pem -out
openssl ecparam -out private/auth1-key.pem -name $CURVE -genkey &&
openssl req -new -key private/auth1-key.pem -out newcerts/auth1-csr.pem &&
openssl ca -config /usr/local/openssl/openssl.cnf -out certs/auth1-cert.pem
The (EC)DH paramter file was generated with:
openssl ecparam -name $CURVE
This was tested with slapd linked against OpenSSL 1.0.1e from ports on FreeBSD
-- Howard Chu
CTO, Symas Corp.