Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Protect Yourself from NSA Attacks on 1024-bit DH

eff.org

Post reply on HN
Print view View original

11–20 of 140 posts

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#12

Post by decisiveness »

diafygi wrote: post #2

Does anyone have links to bugs for the affected programs to make 2048 the minimum by default? It seems like we shouldn't have to continue to manually configure secure settings. OpenVPN? SSH? Nginx? Apache? Where are the bugs to make these not use insecure dhparams by default?

Easy-rsa[1] (OpenVPN's key/cert generation/signing tool) version 3 will generate a 2048 bit diffie hellman key by default. Previous versions of easy-rsa used 1024 bit as default.

Here is a comment written in the vars configuration file for easy-rsa 2.2.2:

    # Increase this to 2048 if you
    # are paranoid.  This will slow
    # down TLS negotiation performance
    # as well as the one-time DH parms
    # generation process.
    export KEY_SIZE=1024
So if you used easy-rsa version 2.2.2 or previous to generate your diffie hellman key for the server, and didn't increase the default size in the vars file before doing so, your server uses a 1024 bit diffie hellman key.

[1]https://github.com/OpenVPN/easy-rsa

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#15

Post by agwa »

windexh8er wrote: post #14

Is TLS w/3DES still considered safe (TLS_RSA_WITH_3DES_EDE_CBC_SHA)? My guess is that it's the next to "go", but is it a risk currently?

3DES (the cipher) is secure but incredibly slow. It's often included in server ciphersuites to support old clients (the alternative for old clients is RC4, which is not secure).

Edit: I should mention though that 3DES as used in TLS is vulnerable to BEAST if not mitigated client-side and possibly Lucky 13 too, so the ciphersuite ought to be the next to "go" along with the other CBC ciphersuites. Still better than RC4 though.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#16

Post by windexh8er »

agwa wrote: post #15
windexh8er wrote: post #14

Is TLS w/3DES still considered safe (TLS_RSA_WITH_3DES_EDE_CBC_SHA)? My guess is that it's the next to "go", but is it a risk currently?

3DES (the cipher) is secure but incredibly slow. It's often included in server ciphersuites to support old clients (the alternative for old clients is RC4, which is not secure). Edit: I should mention though that 3DES as used in TLS is vulnerable to BEAST if not mitigated client-side and possibly Lucky 13 too, so the ciphersuite ought to be the next to "go" along with the other CBC ciphersuites. Still better than RC4…

Thank you I had an idea of the performance delta. But, comparatively (to something like TLS_RSA_WITH_AES_[256|128]_CBC_SHA) how does it compare?

Edit: Thanks for the edit! What I was looking for.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#17

Post by jamielinux »

agwa wrote: post #5
diafygi wrote: post #2

Does anyone have links to bugs for the affected programs to make 2048 the minimum by default? It seems like we shouldn't have to continue to manually configure secure settings. OpenVPN? SSH? Nginx? Apache? Where are the bugs to make these not use insecure dhparams by default?

OpenVPN makes you provide your own parameters; there is no default. As of Apache 2.4.7, the default DH parameters have the same number of bits as your RSA key, and since CAs have required at least 2048 bit RSA for a few years now, you'll be fine. OpenSSH does ship parameters that are larger than 1024 bits (in addition to 1024 bit parameters), and with the "group-exchange" kex, sufficiently-secure parameters should be…

  agwa wrote:
  > Last I looked nginx used fixed 1024 bit parameters, which is very bad.
  > I don't know if this has changed or if there's a bug report.
NGINX has had the ssl_dhparam directive (allowing dhparam of arbitrary size) since version 0.7.2, released in 2008.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#18

Post by schoen »

arielweisberg wrote: post #13

How can you tell if the commercial VPN service you are using is vulnerable? The client on mine is very easy to use, but has no debug output/log or console that I can find so I don't know what it is doing.

Do you know what VPN protocol it is? I wonder if it would be easy to figure out in Wireshark if you had a recording of the beginning of a session.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#19

Post by tux »

If you use "Chromium" on linux instead of "Chrome" you can do this; (create a shortcut with this command)

chromium --cipher-suite-blacklist=0x0033,0x0039,0x009E,0xcc15

Also if you use Nginx web browser; (read this article)

https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx....

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#20

Post by subliminalpanda »

arielweisberg wrote: post #13

How can you tell if the commercial VPN service you are using is vulnerable? The client on mine is very easy to use, but has no debug output/log or console that I can find so I don't know what it is doing.

You could always ask them.

As an alternative, VPSs are cheap nowadays and you can easily spin up a VPN server automatically with something like Streisand

Post reply on HN