From 550597a43a8d7e5c82cff55066dabbb4518d4a85 Mon Sep 17 00:00:00 2001 From: Aidan Keefe Date: Fri, 21 Aug 2026 09:43:42 -0600 Subject: [PATCH] strengthen wording of 'test only' comment and cite relvent RFC along with correcting 'Currently allows comment to represent current behavior' --- wolfssl/ssl.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/wolfssl/ssl.h b/wolfssl/ssl.h index 14507d1688..230fcb7d62 100644 --- a/wolfssl/ssl.h +++ b/wolfssl/ssl.h @@ -6319,8 +6319,11 @@ WOLFSSL_API int wolfSSL_CTX_AllowEncryptThenMac(WOLFSSL_CTX* ctx, int set); WOLFSSL_API int wolfSSL_AllowEncryptThenMac(WOLFSSL *s, int set); #endif -/* This feature is used to set a fixed ephemeral key and is for testing only */ -/* Currently allows ECDHE and DHE only */ +/* This feature is used to set a fixed ephemeral key and is for testing only. + * Reusing a key share across connections is incorrect behavior + * and is forbidden by RFC 9846 Section 1.2 so do not enable this in + * production. */ +/* Currently allows DHE, ECDHE, X25519 and X448 only */ #ifdef WOLFSSL_STATIC_EPHEMERAL WOLFSSL_API int wolfSSL_CTX_set_ephemeral_key(WOLFSSL_CTX* ctx, int keyAlgo, const char* key, unsigned int keySz, int format);