romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-27 06:37:16 +03:00
Code Issues Projects Releases Packages Wiki Activity

schannel: Support strong crypto option

Browse source 
- Support enabling strong crypto via optional user cipher list when
  USE_STRONG_CRYPTO or SCH_USE_STRONG_CRYPTO is in the list.

MSDN says SCH_USE_STRONG_CRYPTO "Instructs Schannel to disable known
weak cryptographic algorithms, cipher suites, and SSL/TLS protocol
versions that may be otherwise enabled for better interoperability."

Ref: https://curl.se/mail/lib-2021-02/0066.html
Ref: https://curl.se/docs/manpage.html#--ciphers
Ref: https://curl.se/libcurl/c/CURLOPT_SSL_CIPHER_LIST.html
Ref: https://docs.microsoft.com/en-us/windows/win32/api/schannel/ns-schannel-schannel_cred

Closes https://github.com/curl/curl/pull/6734
This commit is contained in:
Morten Minde Neergaard 2021-03-12 12:40:22 +01:00 • committed by Jay Satiro
parent 99383194de
commit 67d3afa73f
2 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/CIPHERS.md
View file

@ -514,3 +514,9 @@ and the request will fail.
`CALG_ECMQV`,
`CALG_ECDSA`,
`CALG_ECDH_EPHEM`,
As of curl 7.77.0, you can also pass `SCH_USE_STRONG_CRYPTO` as a cipher name
to [constrain the set of available ciphers as specified in the schannel
documentation](https://docs.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-server-2022).
Note that the supported ciphers in this case follows the OS version, so if you
are running an outdated OS you might still be supporting weak ciphers.