5

So I'm setting up one host to serve multiple SSL sites. I've been following various guides like https://cipherli.st/ and https://wiki.mozilla.org/Security/Server_Side_TLS and they both suggest to specify diffie-hellman parameters to get forward secrecy. So my question is: should I generate a new prime number for each virtual host on the system, or is it alright to share one between all the virtual hosts.

My reading of the mozilla article says that it's not that big a deal since the key generated from the exchange is ephemeral anyways, so as long as the prime is large enough (2048 bits being recommended), it should be alright?

  • I'm no expert in this regard (hence a comment, not an answer), but the prime is public knowledge so I suspect that it can be common to all hosts. – Arran Schlosberg May 18 '15 at 22:24
  • 1
    Judging from how DH works, I don't think it matters. The random numbers each side generates before running it through the mod function are what creates the forward secrecy. I don't see how it wouldn't hurt, though, other than through some weird cyptoanalytic algorithm that benefits from similar clear-text content encrypted using different modulo values. (I'm not an expert either, but that is my knee-jerk reaction). Also, ephemeral diffie-hellman is not the same as just diffie-hellman. The former regenerates keys periodically throughout the lifetime of the connection. – Qix May 18 '15 at 23:19
  • Yes, it matters, though 2048-bit makes the point rather moot. – Polynomial May 20 '15 at 16:19
  • Quite a timely question in light of the new Logjam vulnerability. weakdh.org/sysadmin.html – Arran Schlosberg May 20 '15 at 22:30
  • @Qix DH doesn't encrypt; it only "shares" a key, or for SSL/TLS more exactly a premaster secret. Ephemeral DHE regenerates that "key" at each full handshake, which happens almost never during a connection, sometimes at a new connection in a session, and always at a new session. But keys don't matter for Logjam, only parameters. – dave_thompson_085 May 24 '15 at 0:49
2

There is no formal problem, from a cryptographic point of view, in reuse of the same DH parameters (modulus and generators) by multiple people. What the recent Logjam attack highlights is that if the modulus is so small that it can be broken in practice, then the attacker can reuse most of the attack effort for subsequent breakages of DH instances that use the same parameters. In that sense, it can be argued that sharing the same DH parameters with the rest of the Internet increases the consequences of a successful cryptanalytic break; however, it can be equally argued (and, in my opinion, more convincingly) that the real problem is using the same weak modulus as everybody else lies in the "weak", not in the "same". If you use a properly generated 2048-bit modulus then no breakage shall occur at all, and sharing is harmless.

You may notice that elliptic curve variants of Diffie-Hellman commonly use the extremely widespread P-256 curve, so that's Internet-wide sharing, and that does not appear to be a problem. Arjen Lenstra once told me that it made that curve a "big, fat target", and I agree with him, but, right now, there is no known way to break that curve in realistic time. (Everybody uses the same curve because producing your own curve is not very easy, and also because specializing implementations for a single curve grants some extra performance.)

  • "then the attacker can reuse most of the attack effort for subsequent breakages of DH instances that use the same parameters" probably a silly question but if people use keys of different sizes, can they still be using the same DH parameters? If so, does the effort reuse apply to 1024-bit or 2048-bit keys? – Steve Dodier-Lazaro May 22 '15 at 16:56
  • 1
    The known methods for reusing breaking efforts work as long as the several attacked DH instances all use the exact same modulus. If the modulus has a different size, then, in particular, it is not the exact same modulus, and reuse does not apply. – Tom Leek May 22 '15 at 17:21
  • Right. That was a silly question. – Steve Dodier-Lazaro May 22 '15 at 17:22
0

Current accepted wisdom from the internet is, no you do not need a different DH set per vhost. (a different one per Server / Virtual Machine is advisable)

But the bigger question is, do you still need DH? can your service not work with ECDHE? of the awnser is yes, disable DH and switch to EDCHE (or another Elliptical Curve Cipher).

There currently less likely to be attacked and probably more future proof.

  • If you want forward secrecy with the widest possible range of clients then you need conventional DH. – Peter Green Nov 7 '18 at 17:28
  • @PeterGreen source? I mean if you want the widest possible range just use plain HTTP, As for supporting the most used devices it depands on your cliant base. (so geographical diffrences anstarget demographic matters) Check caniuse.com and ssllabs.com for more details. – LvB Nov 8 '18 at 13:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.