<html>
<head>
<base href="http://icedtea.classpath.org/bugzilla/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - JSSE server is still limited to 768-bit DHE"
href="http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=2250#c4">Comment # 4</a>
on <a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - JSSE server is still limited to 768-bit DHE"
href="http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=2250">bug 2250</a>
from <span class="vcard"><a class="email" href="mailto:gnu.andrew@redhat.com" title="Andrew John Hughes <gnu.andrew@redhat.com>"> <span class="fn">Andrew John Hughes</span></a>
</span></b>
<pre>I know, that's why I said we wouldn't use the default settings in this patch.
If we instead set useLegacyEphemeralDHKeys to true by default (the patch sets
it to false), we would get the same key size as at present i.e.
dh = new DHCrypt((export ? 512 : 768), sslContext.getSecureRandom());
becomes
int keySize = export ? 512 : 1024; // default mode
if (!export) {
if (useLegacyEphemeralDHKeys) { // legacy mode
keySize = 768;
} else ...
} else ...
}
}
dh = new DHCrypt(keySize, sslContext.getSecureRandom());
If export is true in either case, the result is a key size of 512. If export is
false in either case, the key size is 768 as we have useLegacyEphemeralDHKeys
set to true by default.
Different behaviour would only occur if the user expicitly set
jdk.tls.ephemeralDHKeySize.
No-one is suggesting this would be an IcedTea-only change. We can propose it
for OpenJDK 7, along with the backlog of other patches, once it's open for
business again.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>