Subject: Re: [TLS] New Algorithm identifier for EDH > 1024 bits?

From: Peter Gutmann <[email-masked]>
Date: Fri, 27 Sep 2013 06:41:09 +0000

Phillip Hallam-Baker <[email-masked]> writes:

>My understanding of the 1024 bit Ephemeral DH key issue is that it is not
>currently possible to use longer keys because a certain number of deployed
>Web servers will abort the connection if a client presents a longer key.
>
>Hmmm, wonder who made that decision...

Could that be because of all of the TLS_DHE_DSS_* suites, with DSS limited to
1024 bits so implementers also limited the matching DH to 1024 bits?  Just
wondering what other reason there could possibly be for artificially limiting
the size to 1024 bits.

Peter.

---

From: [email-masked] (Martin Rex)
Date: Mon, 30 Sep 2013 21:28:05 +0200 (CEST)

> wondering what other reason there could possibly be for artificially limiting

The delay incurred by key generation maybe?

The app-supplied credentials are either RSA or DSA.  So for DHE,
_everything_ has to be newly generated after process start and potentially
in-band during the TLS handshake, unless the application caller has
written some code that does generation out-of-band and installs/updates
the DHE keying material regularly.

-Martin