[Ach] AppliedCryptoHardening: Java 7 DH-parameterlength limitation(1024bit)

[Jan Hill]

Update:

Am 03.01.2014 22:05, schrieb Jan Hill:
> Hello,
> 
> first of all thank you for:
> "AppliedCryptoHardening" :-)
> 
> In the paper I found this (page 52):

now Page 53

> 
> "We could not verify yet if installing JCE also fixes the Java7
> DH-parameterlength limitation(1024bit). TODO:do that!"
> 
> In my opinion there is a limitation to 1024 also with the strong
> encryption jars:
> 
> http://docs.oracle.com/javase/7/docs/technotes/guides/security/SunProviders.html
> 
> There ar some open issues in the tracker, but I can't send a link, looks
> like the Bugtracker is down :(

http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=7044060

> 
> 
> In Java 8 is a bugfix up to 2048, I think this was included from b56 or
> b58. I can't send a link, looks like the Bugtracker is down :(

http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=7044060

> 
> http://download.java.net/jdk8/docs/technotes/guides/security/enhancements-8.html
> 

-> Java 7 (u40) only supports DH 512-1024 Bit
-> Java 8 not released yet supports DH 512-2048 Bit

> Cheers
> Jan
> _______________________________________________
> Ach mailing list
> Ach at lists.cert.at
> http://lists.cert.at/cgi-bin/mailman/listinfo/ach
>