Two new curves supported for TLS 1.2 ciphers that use ECDHE for forward secrecy

The TLS 1.2 ciphers that use Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) for forward secrecy now support two new curves for forward secrecy: X25519 and X448.

These curves are in addition to the curves introduced with the ECDHE ciphers in 9.0.1 FPx: NIST P-256, NIST P-384, and NIST P-521. X25519 and X448 offer better performance and space efficiency than the equivalent NIST Prime curves and are simpler to implement in an error-free fashion. The Wikipedia page for Curve25519 summarizes many of the reasons to prioritize use of these new curves.

The elliptic curve used for forward secrecy is negotiated dynamically as part of the TLS handshake: the client sends its list of supported curves in preference order, and the server picks one that both sides support. Domino's new ordered preference for ECDHE is:
  1. X25519
  2. NIST P-256
  3. X448
  4. NIST P-384
  5. NIST P-521
Each of these curves can be disabled with a corresponding notes.ini:
  • SSL_DISABLE_CURVE_X25519
  • SSL_DISABLE_CURVE_P256
  • SSL_DISABLE_CURVE_X448
  • SSL_DISABLE_CURVE_P384
  • SSL_DISABLE_CURVE_521