<html>
<head>
<base href="http://icedtea.classpath.org/bugzilla/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - JSSE server still defaults to 768-bit DHE"
href="http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=2528">2528</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>JSSE server still defaults to 768-bit DHE
</td>
</tr>
<tr>
<th>Product</th>
<td>IcedTea
</td>
</tr>
<tr>
<th>Version</th>
<td>7-hg
</td>
</tr>
<tr>
<th>Hardware</th>
<td>all
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>IcedTea
</td>
</tr>
<tr>
<th>Assignee</th>
<td>gnu.andrew@redhat.com
</td>
</tr>
<tr>
<th>Reporter</th>
<td>thoger@redhat.com
</td>
</tr>
<tr>
<th>CC</th>
<td>unassigned@icedtea.classpath.org
</td>
</tr></table>
<p>
<div>
<pre>This is a follow-up on <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - JSSE server is still limited to 768-bit DHE"
href="show_bug.cgi?id=2250">bug 2250</a>, which led to introduction of support of the
jdk.tls.ephemeralDHKeySize system property. Prior to the change, JSSE server
could only use 768-bit DHE keys (with non-export cipher suites). The change
makes it possible to request larger keys, up to 2048-bit.
The patch applied did not change the default key size though. The recent
research indicates that 768-bit is not strong enough any more and can be broken
with resources available to academic teams.
<a href="https://weakdh.org/">https://weakdh.org/</a>
<a href="https://weakdh.org/imperfect-forward-secrecy.pdf">https://weakdh.org/imperfect-forward-secrecy.pdf</a>
The default key size should be increased to at least 1024-bit (the JDK8
default). The above research also indicates that 1024-bit may be within reach
of state-level attackers, but going above 1024 by default is problematic, as
older JDK versions (including current Oracle JDK 6 and 7) do not accept keys
above 1024-bit on the client side. 1024 should still be considered as the new
default.
A minor quirk of the patch backported to OpenJDK for <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - JSSE server is still limited to 768-bit DHE"
href="show_bug.cgi?id=2250">bug 2250</a> - it limits
customizedDHKeySize to be between 1024 and 2048. That's probably fine in JDK8
that never defaulted to size below 1024, but may be somewhat odd in 7 (or 6),
as it does not allow the use of -Djdk.tls.ephemeralDHKeySize=768 to force the
current default if the default is changed to 1024. "legacy" is not explicitly
supported either.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>