From 5bffa58ee0626d23e2ae163ae2f4c5223921c65c Mon Sep 17 00:00:00 2001
From: AlexsanderHamir <alexsanderhamirgomesbaptista@gmail.com>
Date: Mon, 13 Oct 2025 09:56:32 -0700
Subject: [PATCH] feat(ssl): add configurable ECDH curve for TLS performance

Add `ssl_ecdh_curve` setting to configure TLS key exchange curve.
Allows disabling PQC on OpenSSL 3.x for better performance.

Configurable via SDK (litellm.ssl_ecdh_curve), YAML (litellm_settings),
or env var (SSL_ECDH_CURVE). Common curves: X25519, prime256v1, secp384r1.
---
 .../docs/guides/security_settings.md          | 44 ++++++++++++++++++-
 litellm/__init__.py                           |  1 +
 litellm/llms/custom_httpx/http_handler.py     | 23 ++++++++++
 3 files changed, 67 insertions(+), 1 deletion(-)

diff --git a/docs/my-website/docs/guides/security_settings.md b/docs/my-website/docs/guides/security_settings.md
index 7995f6c3c9c..d6397a7c197 100644
--- a/docs/my-website/docs/guides/security_settings.md
+++ b/docs/my-website/docs/guides/security_settings.md
@@ -117,10 +117,52 @@ litellm_settings:
 ```bash
 export SSL_CERTIFICATE="/path/to/certificate.pem"
 ```
+
 </TabItem>
 </Tabs>
 
-## 5. Use HTTP_PROXY environment variable
+## 5. Configure ECDH Curve for SSL/TLS Performance
+
+The `ssl_ecdh_curve` setting allows you to configure the Elliptic Curve Diffie-Hellman (ECDH) curve used for SSL/TLS key exchange. This is particularly useful for disabling Post-Quantum Cryptography (PQC) to improve performance in environments where PQC is not required.
+
+**Use Case:** Some OpenSSL 3.x systems enable PQC by default, which can slow down TLS handshakes. Setting the ECDH curve to `X25519` disables PQC and can significantly improve connection performance.
+
+<Tabs>
+<TabItem value="sdk" label="SDK">
+
+```python
+import litellm
+litellm.ssl_ecdh_curve = "X25519"  # Disables PQC for better performance
+```
+
+</TabItem>
+<TabItem value="proxy" label="PROXY">
+
+```yaml
+litellm_settings:
+  ssl_ecdh_curve: "X25519"
+```
+
+</TabItem>  
+<TabItem value="env_var" label="Environment Variables">
+
+```bash
+export SSL_ECDH_CURVE="X25519"
+```
+
+</TabItem>
+</Tabs>
+
+**Common Valid Curves:**
+
+- `X25519` - Modern, fast curve (recommended for disabling PQC)
+- `prime256v1` - NIST P-256 curve
+- `secp384r1` - NIST P-384 curve
+- `secp521r1` - NIST P-521 curve
+
+**Note:** If an invalid curve name is provided or if your Python/OpenSSL version doesn't support this feature, LiteLLM will log a warning and continue with default curves.
+
+## 6. Use HTTP_PROXY environment variable
 
 Both httpx and aiohttp libraries use `urllib.request.getproxies` from environment variables. Before client initialization, you may set proxy (and optional SSL_CERT_FILE) by setting the environment variables:
 
diff --git a/litellm/__init__.py b/litellm/__init__.py
index e461c88efd6..95a761cd464 100644
--- a/litellm/__init__.py
+++ b/litellm/__init__.py
@@ -263,6 +263,7 @@ use_client: bool = False
 ssl_verify: Union[str, bool] = True
 ssl_security_level: Optional[str] = None
 ssl_certificate: Optional[str] = None
+ssl_ecdh_curve: Optional[str] = None  # Set to 'X25519' to disable PQC and improve performance
 disable_streaming_logging: bool = False
 disable_token_counter: bool = False
 disable_add_transform_inline_image_block: bool = False
diff --git a/litellm/llms/custom_httpx/http_handler.py b/litellm/llms/custom_httpx/http_handler.py
index a3ad2c67272..accdddbc4dd 100644
--- a/litellm/llms/custom_httpx/http_handler.py
+++ b/litellm/llms/custom_httpx/http_handler.py
@@ -1,6 +1,7 @@
 import asyncio
 import os
 import ssl
+import sys
 import time
 from typing import TYPE_CHECKING, Any, Callable, Dict, List, Mapping, Optional, Union
 
@@ -114,6 +115,28 @@ def get_ssl_configuration(
             # but falls back to widely compatible ones
             custom_ssl_context.set_ciphers(DEFAULT_SSL_CIPHERS)
 
+        # Configure ECDH curve for key exchange (e.g., to disable PQC and improve performance)
+        # Set SSL_ECDH_CURVE env var or litellm.ssl_ecdh_curve to 'X25519' to disable PQC
+        # Common valid curves: X25519, prime256v1, secp384r1, secp521r1
+        ssl_ecdh_curve = os.getenv("SSL_ECDH_CURVE", litellm.ssl_ecdh_curve)
+        if ssl_ecdh_curve and isinstance(ssl_ecdh_curve, str):
+            try:
+                custom_ssl_context.set_ecdh_curve(ssl_ecdh_curve)
+                verbose_logger.debug(f"SSL ECDH curve set to: {ssl_ecdh_curve}")
+            except AttributeError:
+                verbose_logger.warning(
+                    f"SSL ECDH curve configuration not supported. "
+                    f"Python version: {sys.version.split()[0]}, OpenSSL version: {ssl.OPENSSL_VERSION}. "
+                    f"Requested curve: {ssl_ecdh_curve}. Continuing with default curves."
+                )
+            except ValueError as e:
+                # Invalid curve name
+                verbose_logger.warning(
+                    f"Invalid SSL ECDH curve name: '{ssl_ecdh_curve}'. {e}. "
+                    f"Common valid curves: X25519, prime256v1, secp384r1, secp521r1. "
+                    f"Continuing with default curves (including PQC)."
+                )
+
         # Use our custom SSL context instead of the original ssl_verify value
         return custom_ssl_context