Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

Can I make assumptions about minimum and maximum key sizes if all I know about a TLS server is the fact that it uses DHE_RSA for key exchange?

Can the server be configured to use weak key sizes for RSA and/or DH (e.g. 512-bit public key size) and still have a sucessful TLS connection?

share|improve this question
I guess that depends on what your client accepts. If the client has a rule to abort the connection when the key is too short, it won't work. If it doesn't have such a rule, it'll work. – CodesInChaos Feb 28 at 20:35
Commonly one can select the TLS version allowed but this seems to be insufficient if the server is using certificates that include weak keys (for example 512-bit RSA or short DH public key). The cipher suite seems to indicate the algorithm and size for the bulk-encryption algorithm but for the key-exchange only the algorithm is indicated - DHE_RSA or DH-RSA, etc – Drew Lex Feb 28 at 20:42

1 Answer

up vote 1 down vote

The cipher suites in SSL/TLS do not specify minimum or maximum sizes for the asymmetric keys involved in the key exchange or the certificates (the old "export" cipher suites specified maximum sizes, but these have been deprecated). Annex F.1.1.3 contains this text:

Because TLS allows the server to provide arbitrary DH groups, the client should verify that the DH group is of suitable size as defined by local policy.

which means that it is up to the implementations to enforce the size constraints that they wish to see enforced.

In practice, RSA and DH keys which are way too small (smaller than 512 bits) will be rejected by many implementations (and when using RSA key exchange without DHE, there is an absolute minimum of 465 bits for the RSA modulus, otherwise the key exchange cannot take place at all). Many implementations will also reject keys beyond a rather large size (e.g. more than 4096 bits), because of internal constraints in the implementation.

If you want to make sure that short keys will make the handshake fail, then you have to configure or implement it yourself on the system you control (client or server).

Microsoft has pushed an update which deactivates support for RSA and DSA keys shorter than 1024 bits -- which implies that prior to this update, they were supported. However, the Diffie-Hellman group used with DHE is not from the certificates layer, but chosen by the SSL server code itself.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.