2

Recently discovered the need to upgrade our DH key exchange length (used for TLS) from 1024 bits to 2048 bits (due to Logjam exploit and other factors). The question is: How will making that change affect client compatibility? Is there an official list of OS's/browsers that can support 2048-bit crypto for key exchange when using TLS? I've only seen mutterings about older client versions of Java (

  • FWIW recent Firefox (AIR about a year) rejects DHE 1024 and requires 2048. And current Chrome doesn't offer DHE at all, only ECDHE (only with P256,P384,X25519) and plain-RSA. AFAIK IE offers only DHE-DSS not DHE-RSA so if you don't have a DSA cert it can't matter. Suncle Java before 8 definitely does fail for DHE over 1024 (Stack has multiple Qs on this), although 7 out of the box and 6 with a tweak prefers ECDHE over DHE so if your server supports ECDHE (with sane curves) the incompatibility that would occur on DHE doesn't matter. – dave_thompson_085 Sep 7 '17 at 4:18
  • Thanks, @dave_thompson_085. Good information; is there a reason you didn't post as an answer? Also, do you know of any OS dependencies (i.e. does WinXP support higher key strengths for TLS negotiation)? – 7YR43L Sep 11 '17 at 15:35
  • (1) I don't have a list only a few items. (2) I don't recall trying this when XP was current or even supported, but I dug up my old XPSP3+IE8 netbook and it appears to handshake with DHE-2k but the key derivation is apparently wrong because Finished is rejected (by OpenSSL); for DHE-4k it aborts the handshake with FIN after ServerKX. Note these are with a DSA(-1) cert. FWIW XP needed SP3 to handle sha2 signatures on certs, which affects security but not 'key strength', and Server2003 didn't get an SP and needed a hotfix. OTOH Firefox 21 ca 2013-06 on that system DHE-2k and 4k works. – dave_thompson_085 Sep 12 '17 at 23:37
1

Modern browsers will be perfectly happy accepting 2048-bit DH moduli. You can verify that your site's TLS configuration is compatible with popular browsers by using SSLTest. Only (very) outdated versions of Java tend to have problems with DH moduli larger than 1024 bits.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.