Sets the list of “supported elliptic curves” for this context.
For a TLS client, the list is directly used in the Supported Elliptic Curves Extension. For a server, the list is used by OpenSSL
to determine the set of shared curves. OpenSSL
will pick the most appropriate one from it.
Note that this works differently with old OpenSSL
(<= 1.0.1). Only one curve can be set, and this has no effect for TLS clients.
ctx1 = OpenSSL::SSL::SSLContext.new ctx1.ecdh_curves = "X25519:P-256:P-224" svr = OpenSSL::SSL::SSLServer.new(tcp_svr, ctx1) Thread.new { svr.accept } ctx2 = OpenSSL::SSL::SSLContext.new ctx2.ecdh_curves = "P-256" cli = OpenSSL::SSL::SSLSocket.new(tcp_sock, ctx2) cli.connect p cli.tmp_key.group.curve_name # => "prime256v1" (is an alias for NIST P-256)
Writes string to the SSL
connection in a non-blocking manner. Raises an SSLError
if writing would block.
Returns the result of the peer certificates verification. See verify(1) for error values and descriptions.
If no peer certificate was presented X509_V_OK is returned.
Returns the error string corresponding to the error code retrieved by error
.
Returns a status string for the response.
Returns the ln (long name) of the hash algorithm used to generate the issuerNameHash and the issuerKeyHash values.
Obtains a list of all predefined curves by the OpenSSL
. Curve names are returned as sn.
See the OpenSSL
documentation for EC_get_builtin_curves().
See the OpenSSL
documentation for EC_KEY_get0_private_key()
See the OpenSSL
documentation for EC_KEY_set_private_key()
Returns whether this EC
instance has a private key. The private key (BN
) can be retrieved with EC#private_key
.
Encrypt string with the private key. padding defaults to PKCS1_PADDING. The encrypted string output can be decrypted using public_decrypt
.
Decrypt string, which has been encrypted with the public key, with the private key. padding defaults to PKCS1_PADDING.
Verifies data using the Probabilistic Signature Scheme (RSA-PSS).
The return value is true
if the signature is valid, false
otherwise. RSAError
will be raised if an error occurs.
See sign_pss
for the signing operation and an example code.
A String
containing the message digest algorithm name.
A String
. The data to be signed.
The length in octets of the salt. Two special values are reserved: :digest
means the digest length, and :auto
means automatically determining the length based on the signature.
The hash algorithm used in MGF1.
General callback for OpenSSL
verify