5

So I'm setting up one host to serve multiple SSL sites. I've been following various guides like https://cipherli.st/ and https://wiki.mozilla.org/Security/Server_Side_TLS and they both suggest to specify diffie-hellman parameters to get forward secrecy. So my question is: should I generate a new prime number for each virtual host on the system, or is it alright to share one between all the virtual hosts.

My reading of the mozilla article says that it's not that big a deal since the key generated from the exchange is ephemeral anyways, so as long as the prime is large enough (2048 bits being recommended), it should be alright?

Improve this question
6
  • I'm no expert in this regard (hence a comment, not an answer), but the prime is public knowledge so I suspect that it can be common to all hosts.
    – Arran Schlosberg
    May 18, 2015 at 22:24
  • 1
    Judging from how DH works, I don't think it matters. The random numbers each side generates before running it through the mod function are what creates the forward secrecy. I don't see how it wouldn't hurt, though, other than through some weird cyptoanalytic algorithm that benefits from similar clear-text content encrypted using different modulo values. (I'm not an expert either, but that is my knee-jerk reaction). Also, ephemeral diffie-hellman is not the same as just diffie-hellman. The former regenerates keys periodically throughout the lifetime of the connection.
    – Qix - MONICA WAS MISTREATED
    May 18, 2015 at 23:19
  • Yes, it matters, though 2048-bit makes the point rather moot.
    – Polynomial
    May 20, 2015 at 16:19
  • Quite a timely question in light of the new Logjam vulnerability. weakdh.org/sysadmin.html
    – Arran Schlosberg
    May 20, 2015 at 22:30
  • @Qix DH doesn't encrypt; it only "shares" a key, or for SSL/TLS more exactly a premaster secret. Ephemeral DHE regenerates that "key" at each full handshake, which happens almost never during a connection, sometimes at a new connection in a session, and always at a new session. But keys don't matter for Logjam, only parameters.
    – dave_thompson_085
    May 24, 2015 at 0:49

2 Answers 2

Reset to default
2

There is no formal problem, from a cryptographic point of view, in reuse of the same DH parameters (modulus and generators) by multiple people. What the recent Logjam attack highlights is that if the modulus is so small that it can be broken in practice, then the attacker can reuse most of the attack effort for subsequent breakages of DH instances that use the same parameters. In that sense, it can be argued that sharing the same DH parameters with the rest of the Internet increases the consequences of a successful cryptanalytic break; however, it can be equally argued (and, in my opinion, more convincingly) that the real problem is using the same weak modulus as everybody else lies in the "weak", not in the "same". If you use a properly generated 2048-bit modulus then no breakage shall occur at all, and sharing is harmless.

You may notice that elliptic curve variants of Diffie-Hellman commonly use the extremely widespread P-256 curve, so that's Internet-wide sharing, and that does not appear to be a problem. Arjen Lenstra once told me that it made that curve a "big, fat target", and I agree with him, but, right now, there is no known way to break that curve in realistic time. (Everybody uses the same curve because producing your own curve is not very easy, and also because specializing implementations for a single curve grants some extra performance.)

Improve this answer
3
  • "then the attacker can reuse most of the attack effort for subsequent breakages of DH instances that use the same parameters" probably a silly question but if people use keys of different sizes, can they still be using the same DH parameters? If so, does the effort reuse apply to 1024-bit or 2048-bit keys?
    – Steve Dodier-Lazaro
    May 22, 2015 at 16:56
  • 1
    The known methods for reusing breaking efforts work as long as the several attacked DH instances all use the exact same modulus. If the modulus has a different size, then, in particular, it is not the exact same modulus, and reuse does not apply.
    – Tom Leek
    May 22, 2015 at 17:21
  • Right. That was a silly question.
    – Steve Dodier-Lazaro
    May 22, 2015 at 17:22
0

Current accepted wisdom from the internet is, no you do not need a different DH set per vhost. (a different one per Server / Virtual Machine is advisable)

But the bigger question is, do you still need DH? can your service not work with ECDHE? of the awnser is yes, disable DH and switch to EDCHE (or another Elliptical Curve Cipher).

There currently less likely to be attacked and probably more future proof.

Improve this answer
2
  • If you want forward secrecy with the widest possible range of clients then you need conventional DH.
    – Peter Green
    Nov 7, 2018 at 17:28
  • @PeterGreen source? I mean if you want the widest possible range just use plain HTTP, As for supporting the most used devices it depands on your cliant base. (so geographical diffrences anstarget demographic matters) Check caniuse.com and ssllabs.com for more details.
    – LvB
    Nov 8, 2018 at 13:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .