3 ms·
Be careful with traditional Diffie-Hellman, which in practice also has problems: if your server software doesn't let you specify your own parameters, it's proba
by agwa 13y ago
Be careful with traditional Diffie-Hellman, which in practice also has problems: if your server software doesn't let you specify your own parameters, it's probably using 1024 bit parameters. All versions of Apache are guilty of this[1], as are (at least the versions I checked) Dovecot and Postfix. I would not trust 1024 bit DH in the face of an adversary like the NSA. It would be interesting to check how XMPP server software handles DH parameters.
[1] https://issues.apache.org/bugzilla/show_bug.cgi?id=49559 https://issues.apache.org/bugzilla/show_bug.cgi?id=49559
Edit to add: Prosody allows you to specify dhparams, though the documentation is vague[2]. Don't see anything in the ejabberd docs for this[3].
[2] http://prosody.im/doc/advanced_ssl_config http://prosody.im/doc/advanced_ssl_config
[3] http://www.process-one.net/docs/ejabberd/guide_en.html http://www.process-one.net/docs/ejabberd/guide_en.html
- MattJ100 13y agoYes, Prosody does allow it, but you're right that the documentation is vague - it's because it's a bit awkward at the moment. We're planning to release 0.9.1 on Monday to address this issue (or you can grab one of our nightlies at https://prosody.im/nightly/0.9/ https://prosody.im/nightly/0.9/ (build 160+) ). Should have docs up in the next couple of days, but for now it should suffice to say that you can simply add a 'dhparam' field to your existing 'ssl' option in your config file that is a path to a DH parameters file created with something like: openssl dhparam -2 2048 > prosody-dhparam.pem Hope this helps!