Re: [TLS] Short Ephermal Diffie-Hellman keys

Hello Nelson,

On Mon, 14 May 2007 20:46:58 +0200, Nelson B Bolyard <nelson@bolyard.com>  
wrote:

> Yngve N. Pettersen (Developer Opera Software ASA) wrote:
>> Hello all,
>>
>> I have recently started to see an increasing number of reports about
>> SSL/TLS servers using short Ephermal Diffie-Hellman keys, in some cases
>> very short ones.
>>
>> Opera's SSL/TLS client will display warnings to users if the server is
>> using RSA/DH/DSA keys shorter than (currently) 900 bits.
>
> Do you mean the length of the public value?  or the length of the prime  
> P?
>
> Do you really wish to disallow public values that are low numeric values
> even when the prime P is adequately large?

The keysize used by Opera for DH keys is calculated using OpenSSL's  
DH_size function, which returns the number of bytes in the "P" element of  
the DH (dh_st) structure, which is then multiplied by 8 (so the real size  
may be 7 bits lower than stated; should probably use a more low level  
call). Background: EVP_PKEY_bits does not return anything about DH keys,  
which is why DH_size is used.

-- 
Sincerely,
Yngve N. Pettersen

********************************************************************
Senior Developer                     Email: yngve@opera.com
Opera Software ASA                   http://www.opera.com/
Phone:  +47 24 16 42 60              Fax:    +47 24 16 40 01
********************************************************************

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls