6 Commits

Author	SHA1	Message	Date
Jakob Borg	e6b78e5d56	lib/rand: Break out random functions into separate package ... The intention for this package is to provide a combination of the security of crypto/rand and the convenience of math/rand. It should be the first choice of random data unless ultimate performance is required and the usage is provably irrelevant from a security standpoint. GitHub-Pull-Request: https://github.com/syncthing/syncthing/pull/3186	2016-05-26 07:02:56 +00:00
Jakob Borg	6d11006b54	Generate ECDSA keys instead of RSA ... This replaces the current 3072 bit RSA certificates with 384 bit ECDSA certificates. The advantage is these certificates are smaller and essentially instantaneous to generate. According to RFC4492 (ECC Cipher Suites for TLS), Table 1: Comparable Key Sizes, ECC has comparable strength to 3072 bit RSA at 283 bits - so we exceed that. There is no compatibility issue with existing Syncthing code - this is verified by the integration test ("h2" instance has the new certificate). There are browsers out there that don't understand ECC certificates yet, although I think they're dying out. In the meantime, I've retained the RSA code for the HTTPS certificate, but pulled it down to 2048 bits. I don't think a higher security level there is motivated, is this matches current industry standard for HTTPS certificates.	2015-11-27 09:15:12 +01:00
Jakob Borg	64354b51c9	Generate certs with SHA256 signature instead of SHA1 ... Doesn't matter at all for BEP, but the same stuff is used by the web UI and modern browsers are starting to dislike SHA1 extra much.	2015-09-09 12:55:17 +02:00
AudriusButkevicius	3d6ea23511	Clarify names	2015-09-02 22:00:51 +01:00
AudriusButkevicius	61130ea191	Add AcceptNoWrap to DowngradingListener	2015-09-02 21:25:56 +01:00
AudriusButkevicius	3299438cbd	Move TLS utilities into a separate package	2015-09-02 21:05:54 +01:00