SSL DH params?

Robust · Dec 27, 2015

Why are DH params needed for certificates? Works fine without them. What's their purpose exactly and why are they recommended?

eva2000 · Dec 27, 2015

see Nginx SPDY SSL Configuration - CentminMod.com LEMP Nginx web stack for CentOS

For DHE key-exchange, generate a dhparam.pem file at /usr/local/nginx/conf/ssl/domaincom/dhparam.pem with higher strength 2048 bit or 4096 bit key-exchange instead of using Nginx's OpenSSL Ephemeral Diffie-Hellman (DHE) default key of 1024 bit to at least match SSL 2048 bit certificates.
Click to expand...

and Strong SSL Security on nginx - Raymii.org

Forward Secrecy & Diffie Hellman Ephemeral Parameters
The concept of forward secrecy is simple: client and server negotiate a key that never hits the wire, and is destroyed at the end of the session. The RSA private from the server is used to sign a Diffie-Hellman key exchange between the client and the server. The pre-master key obtained from the Diffie-Hellman handshake is then used for encryption. Since the pre-master key is specific to a connection between a client and a server, and used only for a limited amount of time, it is called Ephemeral.

With Forward Secrecy, if an attacker gets a hold of the server's private key, it will not be able to decrypt past communications. The private key is only used to sign the DH handshake, which does not reveal the pre-master key. Diffie-Hellman ensures that the pre-master keys never leave the client and the server, and cannot be intercepted by a MITM.

All versions of nginx as of 1.4.4 rely on OpenSSL for input parameters to Diffie-Hellman (DH). Unfortunately, this means that Ephemeral Diffie-Hellman (DHE) will use OpenSSL's defaults, which include a 1024-bit key for the key-exchange. Since we're using a 2048-bit certificate, DHE clients will use a weaker key-exchange than non-ephemeral DH clients.
Click to expand...

Log in / Register

Forums

Want more timely Centmin Mod News Updates?

SSL DH params?

Robust Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Want more timely Centmin Mod News Updates?

SSL DH params?

Robust Member

eva2000 Administrator Staff Member

.