Adding EnableECDH to Context

[zowens]

To enable the use of ECDH, the SSL context has to have an ECDH key.

In openssl 1.0.2 (not yet released), SSL_CTX_set_ecdh_auto can be used. As a fallback, SSL_CTX_set_tmp_ecdh can be used with a named curve.

[jtolio]

So, I think we've decided we're happy with this pull request except for the hardcoded default curve. I think I'd rather just expose SSL_CTX_set_tmp_ecdh and SSL_CTX_set_ecdh_auto separately, and if SSL_CTX_set_ecdh_auto isn't actually defined, the Go method that wraps it just returns an error or something.

Would you be okay with that?

[zowens]

I think I read somewhere that this is what nginx does. If we want to expose the curves, we may just want to have 1 func for now that sets the curve using SSL_CTX_set_tmp_ecdh without messing with SSL_CTX_set_ecdh_auto. Does that seem reasonable?

EDIT: I meant to suggest that we defer adding a function that wraps SSL_CTX_set_ecdh_auto until openssl has a release with that functionality in it and simply wrap SSL_CTX_set_tmp_ecdh.

[jtolio]

yep, that sounds good to me

[zowens]

Do you want all the curves in as constants? There's 64 in 1.0.1g... maybe just some common curves as constants?

[jtolio]

heh, up to you. I'm cool with starting with some common ones and them getting added as needed

[zowens]

I decided to just add P-256 and P-384, which are the only curves supported by Firefox. It turns out, openssl implements all 15 recommended curves from FIPS 186-4.

[jtolio]

awesome, thanks