Timeline for Why do I get the error "dh key too small" when the RSA key is 2048 bits?
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 13, 2023 at 2:51 | vote | accept | geckels1 | ||
| Oct 12, 2023 at 22:15 | answer | added | Peter Green | timeline score: 13 | |
| Oct 12, 2023 at 19:36 | comment | added | dave_thompson_085 | The parameters for (FF)DHE and ECDHE are completely different and separate -- FFDHE uses a subgroup of Zp* (the multiplicative group of a modular integer ring) and ECDHE uses a (sub)group over an elliptic curve. The 'DH' params affect only FFDHE and not ECDHE. In particular, all EC curves in TLS are standardized; the original standard RFC4492 had some weak ones, but in practice they weren't used, and all the ones now standardized in RFC8422 are strong, hence ECDHE-RSA suites with good symmetric depend only on the RSA and ECDHE-ECDSA suites similarly are good always. | |
| Oct 12, 2023 at 14:06 | history | became hot network question | |||
| Oct 12, 2023 at 5:23 | comment | added | geckels1 | Any particular reason why, for this server, when I specify to use an ECDHE cipher there is no complaint about they key size but when I use a DHE cipher (which OpenSSL appears to attempt by default) it complains about the key size? I think ECDHE uses smaller key size, but I'm not sure. | |
| Oct 12, 2023 at 3:43 | answer | added | Steffen Ullrich | timeline score: 11 | |
| Oct 12, 2023 at 3:41 | comment | added | dave_thompson_085 | TLS (and HTTPS) nowadays mostly uses ephemeral DH (either the classic form, now retronymed FFDHE, or the elliptic-curve form ECDHE) to provide forward secrecy, often called perfect forward secrecy (PFS). Parameters and key for this (FF)DHE or ECDHE are not in the certificate, which is used only for authentication not keyexchange. See security.stackexchange.com/q/243995 security.stackexchange.com/q/12052 security.stackexchange.com/q/41205 security.stackexchange.com/q/244058 security.stackexchange.com/q/104509 | |
| Oct 12, 2023 at 2:23 | history | edited | geckels1 | CC BY-SA 4.0 |
added 90 characters in body
|
| S Oct 12, 2023 at 2:15 | review | First questions | |||
| Oct 12, 2023 at 7:42 | |||||
| S Oct 12, 2023 at 2:15 | history | asked | geckels1 | CC BY-SA 4.0 |