Hacker News Reader

Comment by f2f | Hacker News Reader

instead, programmers are given a fips-compliant "black box" drop-in openssl replacement which they're not expected to question, right? :)

View on HN

If by "question" you mean an average web scripter with a community college degree in "IT" deciding what elliptic curve to use in conjunction with what cipher suite and protocol...then maybe the answer is yes?

Are you at all familiar with Go's TLS and crypto libraries? Because, by design, unsafe and exotic curve choices aren't in the standard library. Here's the entire set of curves exposed in 1.7 to Go's TLS:

    type CurveID uint16

    const (
        CurveP256 CurveID = 23
        CurveP384 CurveID = 24
        CurveP521 CurveID = 25
    )

Reply on news.ycombinator.com