Commits on Jun 26, 2015

1. crypto: discourage and deprecate small DH groups …

   This fixes issue 25366.
   
   In particular:
       - DH groups of size < 1024 are disabled by default
         (there is only one such group: modp1) and their
         use will throw an exception
       - a new cmdline switch --enable-small-dh-groups and
         the SMALL_DH_GROUPS_ENABLE env. variable are introduced;
         they override the default setting and therefore enable
         modp1 group
       - the documentation & tests are updated
   
   The change has been triggered by the security report "Imperfect Forward
   Secrecy: How Diffie-Hellman Fails in Practice" which proved that small,
   predefined DH primes groups should not be used.

   

   thinred committed Jun 26, 2015
   Configuration menu

   • View commit details
   • Copy full SHA for a45cb6c
   • Browse repository at this point

   Copy the full SHA

   a45cb6c View commit details

   Browse the repository at this point in the history