4 ms·
Super happy that the OpenSSL team decided to be proactive and just enable `SSL_OP_SINGLE_DH_USE` for all users, as well as bump the minimum DH key size. Better
by kingkilr 11y ago
Super happy that the OpenSSL team decided to be proactive and just enable `SSL_OP_SINGLE_DH_USE` for all users, as well as bump the minimum DH key size. Better defaults for everyone!
- DannyBee 11y agoYeah, and it looks like BoringSSL did that about a year ago :) https://boringssl.googlesource.com/boringssl/+/9f226a5f5183e8814ff30e7436a128a823315532%5E!/#F1 https://boringssl.googlesource.com/boringssl/+/9f226a5f5183e...
- kingkilr 11y agoDavid's the best :-)
- unscaled 11y agoIt's about time they did. I always wondered why this was disabled by default.
- hannob 11y agoInteresting that the corresponding ECDH option is still disabled by default and ephemeral keys are cached.