At least JSSE Java uses random primes (generated at startup). However the Java 8 default of 1024 is rather weak (not to mention the 768 bit of java 6+7). Whats worse is, that clients accept down to 512 bit. (And the client side is harder to protect with ssl accelerators). But there is SunPKCS11-NSS as an provider.
Logjam TLS attack
101–103 of 103 posts
Re: Logjam TLS attack
#102My side project tries to give secure default settings for all major webservers and other software (like haproxy, mysql, mailservers etc): https://cipherli.st/ From the start it has listed the suggestion to set up >2048 DH keys. If you want to test your site for export ciphers, you can try my other side project: https://tls.so/ - you can also use the SSL labs test but mine is faster for just testing ciphersuite. (And…
Also check out Applebaums Duraconf: https://github.com/ioerror/duraconf
Re: Logjam TLS attack
#103At least JSSE Java uses random primes (generated at startup). However the Java 8 default of 1024 is rather weak (not to mention the 768 bit of java 6+7). Whats worse is, that clients accept down to 512 bit. (And the client side is harder to protect with ssl accelerators). But there is SunPKCS11-NSS as an provider.
I am wrong, no random primes.