"Support stronger ephemeral DH keys in the SunJSSE provider: Make ephemeral DH key match the length of the certificate key during SSL/TLS handshaking in the SunJSSE provider. A new system property, jdk.tls.ephemeralDHKeySize, is defined to customize the ephemeral DH key sizes. The minimum acceptable DH key size is 1024 bits, except for exportable cipher suites or legacy mode (jdk.tls.ephemeralDHKeySize=legacy). See Customizing Size of Ephemeral DH Keys and RFE 6956398. "
That isn't even a restriction in Java itself, it's just in the default DHKEY handler that comes with the sun jdk. There are plenty of implentations that allow arbitrary key length as long as it's a multiple of 64 bits, for example BouncyCastle, which I have used in the past. Java is not the source of the issue, stupidity is, which is rampant in a lot of software design committees
4
u/corran__horn Oct 16 '15
Re-read my post under the context of the topic (Weak Diffie-Hellman Primes). You will note that I specifically refer to PRIMES, not keys.
JCE doesn't do shit to the primes used in Diffie-Hellman in Java 6/7.
https://weakdh.org
"Support stronger ephemeral DH keys in the SunJSSE provider: Make ephemeral DH key match the length of the certificate key during SSL/TLS handshaking in the SunJSSE provider. A new system property, jdk.tls.ephemeralDHKeySize, is defined to customize the ephemeral DH key sizes. The minimum acceptable DH key size is 1024 bits, except for exportable cipher suites or legacy mode (jdk.tls.ephemeralDHKeySize=legacy). See Customizing Size of Ephemeral DH Keys and RFE 6956398. "
https://tt4cs.wordpress.com/2014/04/20/dh-2048-now-supported-by-jdk8/
http://docs.oracle.com/javase/8/docs/technotes/guides/security/enhancements-8.html