<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style='--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'>
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'>
<div class="content">
<div style="color: #333333; border-bottom-width: 8px; border-bottom-color: #ededed; border-bottom-style: solid; font-weight: bold; line-height: 1.4; padding: 20px 0;">
Merge request <a href="https://gitlab.com/gnutls/gnutls/-/merge_requests/1904">!1904</a> was reviewed by <a href="https://gitlab.com/asosedkin">Alexander Sosedkin</a>
</div>
<p style="color: #777777;">
<a href="https://gitlab.com/asosedkin">Alexander Sosedkin</a>
commented on a
discussion on <a href="https://gitlab.com/gnutls/gnutls/-/merge_requests/1904#note_2250937010">lib/algorithms/groups.c</a>:
</p>
<table class="code gl-mb-5" style="border-spacing: 0; margin-bottom: 1rem; border-collapse: collapse; width: auto; font-family: monospace; font-size: 90%;" bgcolor="#ffffff" width="100%" cellpadding="0" cellspacing="0">
<tr class="line_holder new" style="line-height: 1.6;">
<td class="old_line diff-line-num new" data-linenumber="224" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
</td>
<td class="new_line diff-line-num new" data-linenumber="228" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
228
</td>
<td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdcde;'>+<span id="LC228" class="line" lang="c"><span class="p">}</span></span>
</pre></td>
</tr>
<tr class="line_holder new" style="line-height: 1.6;">
<td class="old_line diff-line-num new" data-linenumber="224" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
</td>
<td class="new_line diff-line-num new" data-linenumber="229" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
229
</td>
<td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdcde;'>+<span id="LC229" class="line" lang="c"></span>
</pre></td>
</tr>
<tr class="line_holder new" style="line-height: 1.6;">
<td class="old_line diff-line-num new" data-linenumber="224" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
</td>
<td class="new_line diff-line-num new" data-linenumber="230" style="width: 35px; color: rgba(5,5,6,.24); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: inherit;" align="right" bgcolor="#ddfbe6">
230
</td>
<td class="line_content new" style="padding: inherit;" bgcolor="#ecfdf0"><pre style='display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: inherit; border-radius: 2px; margin: 0; padding: 0; border: inherit solid #dcdcde;'>+<span id="LC230" class="line" lang="c"><span class="k" style="font-weight: 600;">static</span> <span class="kr" style="font-weight: 600;">inline</span> <span class="n" style="color: #333333;">bool</span> <span class="nf" style="color: #990000; font-weight: 600;">group_is_supported</span><span class="p">(</span><span class="k" style="font-weight: 600;">const</span> <span class="n" style="color: #333333;">gnutls_group_entry_st</span> <span class="o" style="font-weight: 600;">*</span><span class="n" style="color: #333333;">group</span><span class="p">)</span></span>
</pre></td>
</tr>
</table>
<div class="md" style="border-bottom-width: 4px; border-bottom-color: #ededed; border-bottom-style: solid; padding-bottom: 1em; position: relative; z-index: 1; color: #3a383f; word-wrap: break-word;">
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">Discussed out-of-band, and woo, it's complicated. Turns out I was confusing <code style='font-size: 90%; color: #18171d; word-wrap: break-word; border-radius: .25rem; background-color: #ececef; margin-top: 0; font-weight: inherit; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 0.125rem 0.25rem;'>tls-enabled-group</code> with <code style='font-size: 90%; color: #18171d; word-wrap: break-word; border-radius: .25rem; background-color: #ececef; font-weight: inherit; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 0.125rem 0.25rem;'>enabled-curve</code>. We want orthogonality on the groups level, but that doesn't mean the curve primitive switch shouldn't disable the entire hybrid scheme. It can.</p>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">The good news are, looks like we can land it as is, with <code style='font-size: 90%; color: #18171d; word-wrap: break-word; border-radius: .25rem; background-color: #ececef; margin-top: 0; font-weight: inherit; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 0.125rem 0.25rem;'>enabled-curve</code> disabling a curve precluding the use of the affected hybrid group. This seems to be expected behaviour if <code style='font-size: 90%; color: #18171d; word-wrap: break-word; border-radius: .25rem; background-color: #ececef; font-weight: inherit; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 0.125rem 0.25rem;'>enabled-curve</code> is a primitive killswitch.</p>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">The bad news are, this still leaves at least one important use case uncovered, and that is a scenario when we consider a curve is broken, we need negotiating it as part of hybrid because that's widely deployed, but we don't want, say, trusting an intermediate ECC cert in the chain using that group.</p>
<p dir="auto" style="color: #3a383f; margin: 0;" align="initial">Unfortunately, that'd require a separate RFE for a separate option or something. I've asked <a href="https://gitlab.com/tomato42" data-reference-type="user" data-user="258094" data-container="body" data-placement="top" class="gfm gfm-project_member js-user-link" title="Alicja Kario (@mention me if you need reply)" style="color: #0b5cad; background-color: #cbe2f9; border-radius: .25rem; margin-top: 0; padding: 0 2px;">@tomato42</a> to file one.</p>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #626168;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/merge_requests/1904">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.com">gitlab.com</a>. <a href="https://gitlab.com/-/sent_notifications/3d8d6e2884a88c49b117cc03a9778700/unsubscribe" target="_blank" rel="noopener noreferrer">Unsubscribe</a> from this thread · <a href="https://gitlab.com/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://gitlab.com/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Merge request","url":"https://gitlab.com/gnutls/gnutls/-/merge_requests/1904"}}</script>
</p>
</div>
</body>
</html>