[Ach] favor DHE over ECDHE?
torsten.gigler at owasp.org
Mon Mar 10 15:45:51 CET 2014
Hi Hanno, hi Aaron, Hi Pepi,
thank you very for your answers.
Yes performance issues may be a reason to not to set up the aimed
This is in theory a good idea, but ONLY if you use a reasonable large
> DHE exchange. Most people use 1024 bit.
Yes, according to BSI TR 02102 this should be 2000 bit, or if applicable
3000 bit from 2015 on.
Always prefer GCM over CBC, no matter what AES size. CBC has issues,
> AES128 has not.
> Your config will e.g. cause firefox to connect with CBC.
> Hanno Böck
I switched it to this way:
RSA.... if necessary
Could this develop to a suggestion for 'CipherStringB', too?
According to what I found in sslsabs 'Java 8b132' is the only 'Client' that
supports 0x9e, besides OpenSSL1.0.1e that supports also 0x9f. Any further
good news on this?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Ach