5 ms·
"Prior to our work, Internet Explorer, Chrome, Firefox, and Opera all accepted 512-bit primes, whereas Safari allowed groups as small as 16 bits" I wonder what
by vmarsy 10y ago
"Prior to our work, Internet Explorer,
Chrome, Firefox, and Opera all accepted 512-bit primes,
whereas Safari allowed groups as small as 16 bits"
I wonder what the minimum are today! (Article was from 2015)
- ryuuchin 10y agoI believe the minimum considered secure for standard DHE is 2048 bits. Qualys will label 1024 bit DHE exchanges as WEAK. 256-bit+ ECDHE is also considered secure on the standard curves (x25519, secp256r1, secp384r1).
- joshAg 10y agominimum 1024. preferred is gonna be 2048 or 4096 if you have to use DHE. Actually preferred is ephemeral elliptic curve diffie hellman, or ecdhe. PS: the logjam attack is related: https://weakdh.org/ https://weakdh.org/
- Natsu 10y agoI had soooo much fun with that when I found out that one of my clients was connecting to a Logjam-vulnerable server and the OpenSSL-based code connecting to it suddenly failed without explanation after a security patch. I found it by accident because I was able to reproduce with openssl s_server, which happened to be presenting a weak DH key by default as well.
- Natsu 10y agoJust in case the above is not clear enough, newer versions of OpenSSL refuse to connect to anything with a weak DH key and nothing was showing up in our logs, making it extra confusing.
- ekimekim 10y agoFun story: when logjam broke, the company I was working for at the time immediately changed their SSL configs to require 2048-bit...then had to change it back the next day, because we had clients with ancient java versions that could only handle up to 1024. So we made do (and as far as I know, this company still makes do) with 1024 and a randomly generated dh_param.