SSL_SET_TMP_ECDH(3)

💅 SSL_SET_TMP_ECDH(3) 💅

okay so this is the SSL_SET_TMP_ECDH(3) page from the Library Functions Manual, and it's lowkey a glow-up story: LibreSSL does the EC curve thing automatically now, so most of these functions are just here to be iconic and/or deprecated. Let's get into it, bestie. 🦋

---

✨ NAME ✨

SSL_set_tmp_ecdh, SSL_CTX_set_tmp_ecdh, SSL_set_ecdh_auto, SSL_CTX_set_ecdh_auto, SSL_set_tmp_ecdh_callback, SSL_CTX_set_tmp_ecdh_callback — select a curve for ECDH ephemeral key exchange 🔐✨

---

🌸 SYNOPSIS 🌸

       #include <openssl/ssl.h>

       long
       SSL_set_tmp_ecdh(SSL *ssl, EC_KEY *ecdh);

       long
       SSL_CTX_set_tmp_ecdh(SSL_CTX *ctx, EC_KEY *ecdh);

       long
       SSL_set_ecdh_auto(SSL *ssl, int state);

       long
       SSL_CTX_set_ecdh_auto(SSL_CTX *ctx, int state);

       void
       SSL_set_tmp_ecdh_callback(SSL *ssl,
           EC_KEY *(*ecdh)(SSL *ssl, int is_export, int keylength));

       void
       SSL_CTX_set_tmp_ecdh_callback(SSL_CTX *ctx,
           EC_KEY *(*ecdh)(SSL *ssl, int is_export, int keylength));

---

🎀 DESCRIPTION 🎀

Automatic EC curve selection and generation is always enabled in LibreSSL, and applications cannot manually provide EC keys for use with ECDH key exchange. So yes, bestie, the library is the main character here and it's handling the curve selection for you. 💅

The only remaining effect of SSL_set_tmp_ecdh() is that the curve of the given ecdh key becomes the only curve enabled for the ssl connection, so it is equivalent to calling SSL_set1_groups_list(3) with the same single curve name. It's giving "one curve only, no cap." 🎯

SSL_CTX_set_tmp_ecdh() has the same effect on all connections that will be created from ctx in the future. So it's the group-chat admin version of the same vibe. 👑

The functions SSL_set_ecdh_auto(), SSL_CTX_set_ecdh_auto(), SSL_set_tmp_ecdh_callback(), and SSL_CTX_set_tmp_ecdh_callback() are deprecated and have no effect. Like, they're literally just standing there looking pretty. 🚨✋

🫶 tiny vibe check: deprecated here means exactly what it says in the original — these four do not do anything. Don't build your whole personality around them.

---

🌈 RETURN VALUES 🌈

SSL_set_tmp_ecdh() and SSL_CTX_set_tmp_ecdh() return 1 on success or 0 on failure. Basic success/fail energy, no drama. ✅❌

SSL_set_ecdh_auto(), SSL_CTX_set_ecdh_auto(), SSL_set_tmp_ecdh_callback(), and SSL_CTX_set_tmp_ecdh_callback() always return 1. They said "yes" and contributed nothing else, honestly. 💀✨

---

👀 SEE ALSO 👀

• ssl(3)
• SSL_CTX_set1_groups(3)
• SSL_CTX_set_cipher_list(3)
• SSL_CTX_set_options(3)
• SSL_CTX_set_tmp_dh_callback(3)
• SSL_new(3)

---

🦋 HISTORY 🦋

SSL_set_tmp_ecdh(), SSL_CTX_set_tmp_ecdh(), SSL_set_tmp_ecdh_callback(), and SSL_CTX_set_tmp_ecdh_callback() first appeared in OpenSSL 0.9.8 and have been available since OpenBSD 4.5. Vintage icons, fr fr. 🎀

SSL_CTX_set_ecdh_auto() and SSL_set_ecdh_auto() first appeared in OpenSSL 1.0.2 and have been available since OpenBSD 5.7. Late arrivals, still slayed. 💅

---

mwah 💋 this page is from Debian, dated November 30, 2021, and it's the SSL_SET_TMP_ECDH(3) manual page — bye bestie, go forth and let LibreSSL handle the curves! 🫶✨