I am setting up a server using nginx. I have it working with a self signed ecc certificate and if I connect it reports ECDHE-ECDSA which is what I wanted. But I was also wondering if I could use Camellia with this.

  • RFC 4492 specifies the ECC extensions.
  • RFC 5932 - specifies the Camellia Cipher Suites for TLS

but I can see no intersection between the two? Am I missing something or is this not possible?


The cipher suites you're looking for are defined in RFC 6367, as listed in the TLS Cipher Suite Registry. (To find them on the Registry page, scroll down to "0xC0,0x72" or "RFC6367".)

However, you have another problem: OpenSSL doesn't support them. If you really want to use them, you'll have to find a reverse proxy/SSL terminator/web server -- and client! -- that uses something like GnuTLS or PolarSSL.

(I hope someone will add support for modern Camellia cipher suites to OpenSSL, just because I think Camellia is neat, but I'm afraid that someone won't be me.)

By the way, if you meant ephemeral elliptic curve Diffie-Hellman, you meant "ECDHE-ECDSA". "ECDH-ECDSA" is actually a different thing -- also defined for Camellia in the above RFC -- which isn't ephemeral, and which people mostly never use.

In August 2014, support for the eight HMAC-based cipher suites from RFC 6367 was committed to OpenSSL. The GCM suites weren't added, but Camellia is now usable with ECC -- if you run OpenSSL from git, anyway. I don't know what release it will be in. (For all I know, the commit might be reverted tomorrow! In any case, it's progress.)

  • Thanks. I did mean ECDHE edited question to reflect that. – Jeremy French Nov 22 '13 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.