Welcome! Log In Create A New Profile

Advanced

Re: ssl_dhparam and recommended-private-length

January 03, 2011 07:05AM
Well, it seems that openssl can handle it by itself if the recommended exponent length is in the pem file. Nginx uses openssl routines to decode PEM file in ngx_ssl_dhparam routine. So the recommended exponent length should be taken into account. Can anyone more experienced confirm that?

However, the default values (hardcoded in nginx source) are 1024 bit long safe prime p and generator g=2. NIST recommends to use at least 2048 bits long primes with at least 224-bit prime order subgroup starting from 1 January 2011 :) Does using any 2048 group from RFC 5114 as a default one make more sense?
Subject Author Posted

ssl_dhparam and recommended-private-length

timo2 January 03, 2011 03:57AM

Re: ssl_dhparam and recommended-private-length

timo2 January 03, 2011 07:05AM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 211
Record Number of Users: 8 on April 13, 2023
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready