From b7138087d757f3e4190af92386145a1d942b7b8b Mon Sep 17 00:00:00 2001 From: Ingela Anderton Andin Date: Thu, 6 Sep 2018 15:49:47 +0200 Subject: ssl: Correct handling of all PSK cipher suites Before only some PSK suites would be correctly negotiated and most PSK ciphers suites would fail the connection. PSK cipher suites are anonymous in the sense that they do not use certificates except for rsa_psk. --- lib/ssl/src/ssl_handshake.erl | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'lib/ssl/src') diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl index fa446081b3..3888f9dcf6 100644 --- a/lib/ssl/src/ssl_handshake.erl +++ b/lib/ssl/src/ssl_handshake.erl @@ -1058,7 +1058,9 @@ select_curve(undefined, _, _) -> select_hashsign(_, _, KeyExAlgo, _, _Version) when KeyExAlgo == dh_anon; KeyExAlgo == ecdh_anon; KeyExAlgo == srp_anon; - KeyExAlgo == psk -> + KeyExAlgo == psk; + KeyExAlgo == dhe_psk; + KeyExAlgo == ecdhe_psk -> {null, anon}; %% The signature_algorithms extension was introduced with TLS 1.2. Ignore it if we have %% negotiated a lower version. -- cgit v1.2.3