Re: [jetty-users] How to use a stronger Diffie Hellman group in Jetty?

[Travis Spencer <travis@xxxxxxxxx>]

See https://java.com/en/configure_crypto.html#DHAKeySize

IINM, you can update $JAVA_HOME/conf/security/java.security (on Java 9+) or $JAVA_HOME/lib/security/java.security (on Java < 9) to have

DH keySize < 2048

in the jdk.tls.disabledAlgorithms security property.

If I read that weakdh.org web page and the java.com one correctly, I think that should disable weak DH params. To test, I did like this:

$ openssl s_client -connect localhost:443 -showcerts -cipher "EDH" < /dev/null 2>&1 | grep "Server Temp Key"
Server Temp Key: DH, 2048 bits

Against my server, even without disabling DH keys < 2048, I still got the above value which IINM means the weakness spoken about on weakdh.org is not an issue.

HTH!

On Fri, Jan 7, 2022 at 10:52 PM <gouessej@xxxxxxxxx> wrote:

Hello

I would like to avoid using common Diffie Hellman primes in order to improve the security during key exchange, I tried to follow these steps:
https://weakdh.org/sysadmin.html

I know how to exclude some cipher suites:
https://www.eclipse.org/jetty/javadoc/jetty-11/org/eclipse/jetty/util/ssl/SslContextFactory.html#addExcludeCipherSuites(java.lang.String...)

However, I haven't found a way of telling Jetty to use new DH parameters generated with "openssl dhparam -out dhparams.pem 2048". Where can I cleanly override that?

Best regards.

_______________________________________________
jetty-users mailing list
jetty-users@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jetty-users