From 9b369d23a51eddbd76aafb891e167ac04d168521 Mon Sep 17 00:00:00 2001
From: Ewout van Mansom <ewout@freedom.nl>
Date: Fri, 30 Nov 2018 08:57:38 +0100
Subject: [PATCH] Add eleptic curves for modern profile preset

prime256v1 (NIST P-256), secp384r1 (NIST P-384) and secp521r1 (NIST P-521) have been deemed insecure as per Daniel J. Bernstein's research (https://cr.yp.to/newelliptic/nistecc-20160106.pdf, https://safecurves.cr.yp.to/).

Despite that, the adoption of X25519 is too slim. Limiting to that curve would mean dropping compatibility with Safari, Edge and Internet Explorer.
---
 h5bp/ssl/policy_modern.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/h5bp/ssl/policy_modern.conf b/h5bp/ssl/policy_modern.conf
index 92c9a59..0a7768e 100644
--- a/h5bp/ssl/policy_modern.conf
+++ b/h5bp/ssl/policy_modern.conf
@@ -14,4 +14,5 @@
 
 ssl_protocols TLSv1.2;
 ssl_ciphers EECDH+CHACHA20:EECDH+AES;
+ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;
 ssl_prefer_server_ciphers on;