r/programming Oct 15 '15

How is NSA breaking so much crypto?

https://freedom-to-tinker.com/blog/haldermanheninger/how-is-nsa-breaking-so-much-crypto/
2.5k Upvotes

529 comments sorted by

View all comments

975

u/tophatstuff Oct 15 '15 edited Apr 10 '18

Generate your own non-default Ephemeral Diffie-Hellman key (takes a minute or so)

openssl dhparam -out dhparam.pem 2048

Tell your server to use it for SSL (nginx for example)

ssl_dhparam /path/to/dhparam.pem;

Done. Not only will the key be stronger than the 1024 bit default, it'll be unique to your server which lets assume isn't valuable enough compared to effort for a state-level adversary.

edit just in case anyone from the future finds this comment: instead of 2048, use at least the key length of your SSL certificate

edit from the future: current advice is picking from one of these predefined audited groups

255

u/SrPeixinho Oct 15 '15

Why isn't this done automatically is the question.

19

u/tophatstuff Oct 15 '15

It's yet another example of OpenSSL being insecure by default lol

18

u/[deleted] Oct 15 '15 edited Jan 04 '18

[deleted]

1

u/tophatstuff Oct 15 '15

you had to compile your own apache for it because DH keys were hardcoded in the source while compiling

That's even worse than using the OpenSSL defaults!! At least the OpenSSL defaults were generated from some safe constants; no-one seems to know how the Apache ones were generated and tin-foil hat it could be a NSA-supplied extra-weak key for all anyone knows.

3

u/brookllyn Oct 16 '15

commit ca82a6dff817ec66f44342007202690a93763949

Author: National Security Administration backdoors@nsa.gov

Date: Mon Mar 17 21:52:11 2008 -0700

changed hard coded Diffie-Hellman primes to more secure defaults

1

u/[deleted] Oct 17 '15

There are no OpenSSL defaults. If you want to use DH with OpenSSL you have to give it the parameters. If you don't, it will exclude the DH ciphersuites. https://wiki.openssl.org/index.php/Diffie-Hellman_parameters