Timeline for What are the OpenSSL standard Diffie-Hellman parameters (primes)?
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 24, 2022 at 1:15 | comment | added | dave_thompson_085 | As the very same bear later said in security.stackexchange.com/questions/95178 and security.stackexchange.com/questions/42415 OpenSSL does have an option to generate DSA-style (smaller q) parameters for DH. | |
| Oct 7, 2021 at 7:18 | history | edited | CommunityBot |
replaced http://tools.ietf.org/html/draft with https://datatracker.ietf.org/doc/html/draft
|
|
| Oct 7, 2021 at 6:58 | history | edited | CommunityBot |
replaced http://tools.ietf.org/html/rfc with https://www.rfc-editor.org/rfc/rfc
|
|
| May 20, 2015 at 6:24 | comment | added | Michael Hampton | weakdh.org/imperfect-forward-secrecy.pdf | |
| Jun 2, 2014 at 8:32 | comment | added | Matt Nordhoff |
OpenSSL also contains copies of the RFC 2409/3526 parameters in crypto/bn/bn_const.c. Apache dev seems to be using them rather than making another copy.
|
|
| Apr 21, 2014 at 11:21 | comment | added | Tom Leek | The warning in the documentation is only theoretical. When you try to break discrete logarithm modulo a prime p, the first attempt is very expensive, but subsequent breaks modulo the same prime are much cheaper (you can reuse big parts of the inner attack results). This is the "specialization" they are talking about. However, a 1024-bit modulus appears to be quite beyond the technologically feasible (current record is 530 bits) so even that "first attempt" is out of reach. | |
| Apr 20, 2014 at 19:47 | comment | added | binaryanomaly |
Interesting is also the following sentence in the OpenSSL Documentation: The risk in reusing DH parameters is that an attacker may specialize on a very often used DH group. Applications should therefore generate their own DH parameters during the installation process using the openssl dhparam(1) application. Which means that if an institution specializes on the out of the box implementation apache and nginx should probably considered insecure with the standard parameters. I think this is not so well known and understood?
|
|
| Apr 20, 2014 at 15:28 | comment | added | binaryanomaly |
Nginx obviously also uses predefined 1024-bit parameters to feed openssl, as I was able to find in the source in ngx_event_openssl.c and here in the forum: forum.nginx.org/read.php?2,245335,245368
|
|
| Apr 19, 2014 at 21:02 | vote | accept | binaryanomaly | ||
| Apr 19, 2014 at 20:37 | history | answered | Tom Leek | CC BY-SA 3.0 |