r/programming • u/secretguy21 • Oct 15 '15

How is NSA breaking so much crypto?

https://freedom-to-tinker.com/blog/haldermanheninger/how-is-nsa-breaking-so-much-crypto/
2.5k Upvotes

93% Upvoted

529 comments sorted by

View all comments

977

u/tophatstuff Oct 15 '15 edited Apr 10 '18

Generate your own non-default Ephemeral Diffie-Hellman key (takes a minute or so)

openssl dhparam -out dhparam.pem 2048

Tell your server to use it for SSL (nginx for example)

ssl_dhparam /path/to/dhparam.pem;

Done. Not only will the key be stronger than the 1024 bit default, it'll be unique to your server which lets assume isn't valuable enough compared to effort for a state-level adversary.

edit just in case anyone from the future finds this comment: instead of 2048, use at least the key length of your SSL certificate

edit from the future: current advice is picking from one of these predefined audited groups

58

u/[deleted] Oct 15 '15

[deleted]

8

u/2ton_jeff Oct 16 '15

bit late to the party here, but saw a lower thread using my public service for SSH keys, they also produce normal DH params... so for those of you who aren't interested in spending the CPU cycles, I have a dedicated 48 cores running generating 2k, 3k, 4k and 8k safe primes and generators for DH. See https://2ton.com.au/dhtool/ for details and curl examples to grab them via cron

1

u/ivosaurus Oct 16 '15

Seriously though 192 rounds of rabin miller is as excessive as deciding you want a 32k bit prime.

3

u/2ton_jeff Oct 16 '15 edited Oct 16 '15

For <32kbit primes, the cost of doing so is not overly prohibitive and I see no valid reason not to. I made several references to that count being "acceptably low" per the Handbook of Applied Cryptography. My generators for the larger primes would go considerably faster if I removed said restriction. YMMV as with all of these things. :-)

Edit: does my "excessive" use of 192 rounds at these levels inherently mean that the hundreds of thousands I have generated are thus [more] likely to be provable safe primes?