disabledAlgorithms "DHE keySize < 1024" support?
ecki at zusammenkunft.net
Sat May 23 13:50:06 UTC 2015
Am Sat, 23 May 2015 08:30:26 +0800
schrieb Xuelei Fan <xuelei.fan at oracle.com>:
> Please refer to the "Customizing Size of Ephemeral Diffie-Hellman
> Keys" section of JSSE Reference Guide.
Thanks Xulei, but I think this does not address the minimum accepted
size of an client SSLSocket (at least I could not see that in the
description). It only allows to configure the server generated groups
in the ServerKeyExchange.
When setting jdk.tls.ephemeralDHKeySize=2048 I still can connect to
BTW in Regards to the Server side:
That document should mention that the parameter group is generated
randomly on first use (matching DSA restrictions). It is a good thing
there are no standard primes used, it would be better if they are
constructed not specifically for DSA (as mentioned in the Logjam
I can imagine that in the future for higher security mutual agreed
parameter groups become more important, so let me point to
http://bugs.java.com/view_bug.do?bug_id=4641806 as well.
More information about the security-dev