crypto/tls: pick ECDHE curves based on server preference.

Currently an ECDHE handshake uses the client's curve preference. This
generally means that we use P-521. However, P-521's strength is
mismatched with the rest of the cipher suite in most cases and we have
a fast, constant-time implementation of P-256.

With this change, Go servers will use P-256 where the client supports
it although that can be overridden in the Config.

LGTM=bradfitz
R=bradfitz
CC=golang-codereviews
https://golang.org/cl/66060043

1 files changed, 15 insertions, 15 deletions

diff --git a/src/pkg/crypto/tls/testdata/Client-TLSv12-RSA-RC4 b/src/pkg/crypto/tls/testdata/Client-TLSv12-RSA-RC4
index 2c6e776848..0377f052ae 100644
--- a/src/pkg/crypto/tls/testdata/Client-TLSv12-RSA-RC4
+++ b/src/pkg/crypto/tls/testdata/Client-TLSv12-RSA-RC4
@@ -8,11 +8,11 @@
 00000060  19 00 0b 00 02 01 00 00  0d 00 0a 00 08 04 01 04  |................|
 00000070  03 02 01 02 03 ff 01 00  01 00                    |..........|
 >>> Flow 2 (server to client)
-00000000  16 03 03 00 51 02 00 00  4d 03 03 52 cc 57 58 70  |....Q...M..R.WXp|
-00000010  03 50 58 32 ec de bc ae  18 e7 24 15 2b 4d cc d5  |.PX2......$.+M..|
-00000020  1f 40 db 80 5b 19 d9 3f  48 4b 06 20 87 fe d3 d4  |.@..[..?HK. ....|
-00000030  51 42 74 9c cf 9d fd 31  c3 53 28 f1 a4 21 16 d6  |QBt....1.S(..!..|
-00000040  4f 5a 22 09 9d 99 89 7c  f9 e7 5b 49 00 05 00 00  |OZ"....|..[I....|
+00000000  16 03 03 00 51 02 00 00  4d 03 03 53 04 f1 02 9d  |....Q...M..S....|
+00000010  2e 4e d9 17 4a 35 fa 9d  94 f6 45 0a f6 6b 5d 1c  |.N..J5....E..k].|
+00000020  1e 15 19 8d 6d 94 cc 90  d9 39 94 20 8b 4b de 76  |....m....9. .K.v|
+00000030  d5 64 5d b7 19 df e7 eb  7e a0 22 c4 09 38 a0 12  |.d].....~."..8..|
+00000040  d5 59 10 c8 31 06 dc fc  e4 9d d1 80 00 05 00 00  |.Y..1...........|
 00000050  05 ff 01 00 01 00 16 03  03 02 be 0b 00 02 ba 00  |................|
 00000060  02 b7 00 02 b4 30 82 02  b0 30 82 02 19 a0 03 02  |.....0...0......|
 00000070  01 02 02 09 00 85 b0 bb  a4 8a 7f b8 ca 30 0d 06  |.............0..|
@@ -69,15 +69,15 @@
 00000060  e6 bd 77 82 6f 23 b6 e0  bd a2 92 b7 3a ac e8 56  |..w.o#......:..V|
 00000070  f1 af 54 5e 46 87 e9 3b  33 e7 b8 28 b7 d6 c8 90  |..T^F..;3..(....|
 00000080  35 d4 1c 43 d1 30 6f 55  4e 0a 70 14 03 03 00 01  |5..C.0oUN.p.....|
-00000090  01 16 03 03 00 24 fb 2b  2f c5 19 90 a6 bc 81 c0  |.....$.+/.......|
-000000a0  ac 6b e6 1f e2 af be 10  b4 a0 c7 31 aa d8 cc a2  |.k.........1....|
-000000b0  ce 51 1e 8e d6 00 76 27  72 53                    |.Q....v'rS|
+00000090  01 16 03 03 00 24 37 14  b2 97 7b b5 f0 9a 38 05  |.....$7...{...8.|
+000000a0  22 35 69 9c 95 2f 86 4b  37 98 22 db 4e 9a 46 9c  |"5i../.K7.".N.F.|
+000000b0  b9 81 74 72 58 18 53 0c  5c 3c                    |..trX.S.\<|
 >>> Flow 4 (server to client)
-00000000  14 03 03 00 01 01 16 03  03 00 24 d4 c8 b3 8a 87  |..........$.....|
-00000010  b5 0d 01 80 fc 2c df 18  ca 17 fd 06 ad 31 29 13  |.....,.......1).|
-00000020  5f f9 b4 75 ad 49 c8 de  ec 1a ee 57 6b 1a 81     |_..u.I.....Wk..|
+00000000  14 03 03 00 01 01 16 03  03 00 24 3c b3 e7 77 5a  |..........$<..wZ|
+00000010  7c 36 5a 74 74 26 8d 5b  5a 09 96 60 e8 24 45 2f  ||6Ztt&.[Z..`.$E/|
+00000020  c2 39 14 5e db 58 12 49  ad a8 b6 ea ef 58 16     |.9.^.X.I.....X.|
 >>> Flow 5 (client to server)
-00000000  17 03 03 00 1a 8b ce be  7d c7 06 42 d0 9b 65 6c  |........}..B..el|
-00000010  23 0e 84 ef e0 a3 ec 42  4e 70 14 65 78 ad 52 15  |#......BNp.ex.R.|
-00000020  03 03 00 16 49 5f f2 e2  e0 8f d3 54 68 2a d6 ab  |....I_.....Th*..|
-00000030  28 be 50 3d 62 8b 1a b3  5b e5                    |(.P=b...[.|
+00000000  17 03 03 00 1a 6d 29 d7  ba 2f 85 02 b6 f0 82 64  |.....m)../.....d|
+00000010  6c 55 ae ab f6 fd 14 ff  b8 38 f0 f8 a6 ea cc 15  |lU.......8......|
+00000020  03 03 00 16 10 c5 d9 41  7b e2 89 67 dc 29 8e f8  |.......A{..g.)..|
+00000030  b5 ab 32 91 44 2c 27 84  49 f7                    |..2.D,'.I.|