[glib-networking] Stop allowing extremely weak DH parameters



commit f5f4a0330f1e8bd3b63d7dcdf59d3e25aa15c448
Author: Michael Catanzaro <mcatanzaro gnome org>
Date:   Tue Feb 17 09:58:12 2015 -0600

    Stop allowing extremely weak DH parameters
    
    This is probably no longer needed for compatibility because nowadays
    GnuTLS prioritizes ECDHE and RSA key exchange over DHE.
    
    Note that GnuTLS currently defaults to allowing 728-bit DH parameters,
    which are still very insecure. However, this is their policy to change.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1177964#c8

 tls/gnutls/gtlsconnection-gnutls.c |    5 -----
 1 files changed, 0 insertions(+), 5 deletions(-)
---
diff --git a/tls/gnutls/gtlsconnection-gnutls.c b/tls/gnutls/gtlsconnection-gnutls.c
index 7436451..4074266 100644
--- a/tls/gnutls/gtlsconnection-gnutls.c
+++ b/tls/gnutls/gtlsconnection-gnutls.c
@@ -307,11 +307,6 @@ g_tls_connection_gnutls_initable_init (GInitable     *initable,
       return FALSE;
     }
 
-  /* Some servers (especially on embedded devices) use tiny keys that
-   * gnutls will reject by default. We want it to accept them.
-   */
-  gnutls_dh_set_prime_bits (gnutls->priv->session, 256);
-
   gnutls_transport_set_push_function (gnutls->priv->session,
                                      g_tls_connection_gnutls_push_func);
   gnutls_transport_set_pull_function (gnutls->priv->session,


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]