0

Is it possible to create a diffie-hellman param .pem file to force the openssl ctx to use only a certain type of dh exchange. For example, I know that it can be used to set the length of the dh key, but what about the type?

1

No. The type of exchange is set by the cipher suite, which agreed upon by the client and server during the handshake. As such you cannot specify, say, DHE vs. ECDHE in the DH parameters file. If you want to control that you should configure the supported cipher suites and the preferred cipher suite order on your server.

  • ... through TLS1.2. In 1.3 keyexchange is now separated from the ciphersuite and controlled directly by the supported_groups and key_share extensions -- but in 1.3 non-EC DHE must use only standardized groups (from rfc7919) so the concept of a DH parameters file becomes moot. – dave_thompson_085 Mar 8 at 6:54
  • @dave_thompson_085 Good point. – Polynomial Mar 8 at 10:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.