Not detecting 'insufficient' Eliptic Curves - TLS

[dennisbaaten]

Currently not all Elliptic Curves are detected and/or classified correctly. The IT Security Guidelines for Transport Layer Security (NCSC) lists four EC's that are "Good", one that is "Phase out", and all other curves are "Insufficient":

Good: secp384r1, secp256r1, curve 448, curve 25519
Phase out: secp224r1
Insufficient: Other curves

When some of these of these other curves are offered, they are not detected and the Key Exchange Parameters test passes.

Example:
https://en.internet.nl/site/preac35.portaltalk.net/1528602/#control-panel-14

SSLlabs:
https://www.ssllabs.com/ssltest/analyze.html?d=preac35.portaltalk.net&hideResults=on

secp256r1
secp521r1
brainpoolP512r1
brainpoolP384r1
secp384r1
brainpoolP256r1
secp256k1
sect571r1
sect571k1
sect409k1
sect409r1
sect283k1
sect283r1

Immuniweb:
https://www.immuniweb.com/ssl/preac35.portaltalk.net/zLroHaOP/

P-256 (prime256v1) (256 bits)
P-521 (secp521r1) (521 bits)
brainpoolP512r1 (512 bits)
brainpoolP384r1 (384 bits)
P-384 (secp384r1) (384 bits)
brainpoolP256r1 (256 bits)
secp256k1 (256 bits)
B-571 (sect571r1) (570 bits)
K-571 (sect571k1) (570 bits)
K-409 (sect409k1) (407 bits)
B-409 (sect409r1) (409 bits)
K-283 (sect283k1) (281 bits)
B-283 (sect283r1) (282 bits)

[mxsasha]

We should evaluate this in context of #714 rather than fix in the current code.