8

Does it increase connection security if I regenerate the dhparam files used with NGINX on our servers periodically e.g. every week?

What issues may arise from this?

Is there any benefit in doing this?

  • The big bad boys aren't likely to be deterred just by a new DH param set. – Deer Hunter Mar 4 '16 at 8:11
  • I also hope you ain't doing it on production machines. – Deer Hunter Mar 4 '16 at 8:12
  • @DeerHunter that's exactly why I am asking this question, does it make sense to run such things on a productive system? Ofc the "bad boys" won't care much but does it make it anything generally more secure? – Flatron Mar 4 '16 at 9:06
10

Does it increase connection security if I regenerate the dhparam files used with NGINX on our servers periodically e.g. every week?

No, not significantly.
DH parameters are really just a large prime that takes a lot of time to be generated (because it needs to be a safe prime). Additionally there's a so-called "generator", but this one is cheap to generate.
Right now it is impossible to break a DH connection negotiated with a 2048-bit or longer safe prime. Thus if you regenerate your safe prime every week you gain no extra security beyong "unbreakable". However this should not be confused with generating your own proper (strong) parameters once. This is to make an internet-scale Logjam attack much more difficult, but as I already said is optional as the parameters can't be broken anyways.

What issues may arise from this?

More computational load. Generating the parameters is probably one of the most intense cryptographic computations you will encounter.

Is there any benefit in doing this?

You gain something like "super-forward-secrecy". With ephemeral Diffie-Hellman, the attacker needs to break each connection individually to recover plaintexts. The per-connection load can be reduced when applying the Logjam trick of doing one giant pre-computation for the parameters and only doing the last step for each connection. If you change your parameters regularly you limit the impact a Logjam-style attack could have. However, running the algorithm required for Logjam is infeasible for DH parameters that use long primes (e.g. 2048-bit or more) .

  • I agree with most of this answer, although I fail to see how a TLS server could avoid sending DH parameters either as part of ServerKeyExchange or within its certificate if a DH certificate is used, when establishing a new session. – Erwan Legrand Mar 4 '16 at 12:46
  • @ErwanLegrand, theoretically you could somehow (OID) encode a name for a set of DH parameters. But this is only a thing for ECC apparently :/ Updated the answer accordingly. – SEJPM Mar 4 '16 at 12:53

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.