How to botch TLS forward secrecy

Re:How to botch TLS forward secrecy by Sami_Lehtinen on Friday June 28, 2013 @12:04AM (#5956157)

How to configure Apache to use stronger than 1024 bit DHE? Like group 14.

[ Parent | on HN ]

Re:How to botch TLS forward secrecy by agwa on Friday June 28, 2013 @01:06AM (#5956375)

You can't. It hard codes 1024 bit parameters, which is highly annoying. There's a patch to allow user-specified DH parameters but it hasn't been merged:

https://issues.apache.org/bugzilla/show_bug.cgi?id=49559

I would just go with elliptic curve Diffie Hellman (which unfortunately requires Apache 2.4) and then disable the non-EC Diffie Hellman ciphers if you're concerned about using 1024 bit DH.

FWIW, nginx is a lot more flexible in configuring the cryptography.

[ Parent | on HN ]

Re:How to botch TLS forward secrecy by yuhong on Friday June 28, 2013 @02:46AM (#5956641)

Elliptical curve is faster too.

[ Parent | on HN ]