Deutsch | English

[Ach] dhparam regeneration

Hanno Böck hanno at hboeck.de
Tue Nov 11 11:06:50 CET 2014


Am Tue, 11 Nov 2014 08:29:36 +0100
schrieb "A. Schulze" <sca at andreasschulze.de>:

> I like to know if
> - it make sense at all to renew these dh parameter file from time to
> time
> - and if so, which time span is reasonable.
> 
> I also learned these days that using the same DH parameter file on  
> multiple hosts is not advised, too.

There's no cryptographic reason to do either. You can use the same
DH parameters everywhere and as long as you like.


There's now mostly a consensus that the arbitrary DH group
selection in TLS was a mistake in the first place. The TLS working
group is preparing a new standard to have fixed groups. That'd
basically mean everyone is supposed to use the same DH parameters.

There has even been an attack that relied on arbitrary parameter
selection (part of the triple handshake attack).


cu,
-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno at hboeck.de
GPG: BBB51E42
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.cert.at/pipermail/ach/attachments/20141111/8097ad77/attachment.sig>


More information about the Ach mailing list
Kontakt
Email: reports@cert.at
Tel.: +43 1 5056416 78
mehr ...
Warnungen
mehr ...
Blog
mehr ...
Jahresbericht 2017
Ein Resumee zur digitalen Sicherheitslage in Österreich

(HTML, PDF).
Letzte Änderung: 2018/5/28 - 15:00:00
Haftungsausschluss / Datenschutzerklärung