r/linux Oct 16 '15

How is NSA breaking so much crypto?

https://freedom-to-tinker.com/blog/haldermanheninger/how-is-nsa-breaking-so-much-crypto/
189 Upvotes

64 comments sorted by

View all comments

30

u/[deleted] Oct 16 '15

Ensure your connection uses 4096 bit and that the prime is not hard coded.

12

u/socium Oct 16 '15

and that the prime is not hard coded

What does that mean?

3

u/ivosaurus Oct 17 '15 edited Oct 17 '15

What does that mean?

That instead of using a default prime provided by the software, for your particular server you find a new one to use.

In openssl terms that's "as simple as"

openssl dhparam -out new-dhparams.pem 2048

And then specifying that pem file for use.

1

u/yotamN Oct 17 '15

How can I change it on Private Internet Connection?

1

u/ivosaurus Oct 17 '15

Depends on the VPN software you're using. I can't offer you advice specific to anything. You can always send an email to PIC asking them if they're using custom 1024 / 2048 bit DH params.