[glib-networking] Stop allowing extremely weak DH parameters
- From: Michael Catanzaro <mcatanzaro src gnome org>
- To: commits-list gnome org
- Cc:
- Subject: [glib-networking] Stop allowing extremely weak DH parameters
- Date: Tue, 17 Feb 2015 16:01:35 +0000 (UTC)
commit f5f4a0330f1e8bd3b63d7dcdf59d3e25aa15c448
Author: Michael Catanzaro <mcatanzaro gnome org>
Date: Tue Feb 17 09:58:12 2015 -0600
Stop allowing extremely weak DH parameters
This is probably no longer needed for compatibility because nowadays
GnuTLS prioritizes ECDHE and RSA key exchange over DHE.
Note that GnuTLS currently defaults to allowing 728-bit DH parameters,
which are still very insecure. However, this is their policy to change.
https://bugzilla.redhat.com/show_bug.cgi?id=1177964#c8
tls/gnutls/gtlsconnection-gnutls.c | 5 -----
1 files changed, 0 insertions(+), 5 deletions(-)
---
diff --git a/tls/gnutls/gtlsconnection-gnutls.c b/tls/gnutls/gtlsconnection-gnutls.c
index 7436451..4074266 100644
--- a/tls/gnutls/gtlsconnection-gnutls.c
+++ b/tls/gnutls/gtlsconnection-gnutls.c
@@ -307,11 +307,6 @@ g_tls_connection_gnutls_initable_init (GInitable *initable,
return FALSE;
}
- /* Some servers (especially on embedded devices) use tiny keys that
- * gnutls will reject by default. We want it to accept them.
- */
- gnutls_dh_set_prime_bits (gnutls->priv->session, 256);
-
gnutls_transport_set_push_function (gnutls->priv->session,
g_tls_connection_gnutls_push_func);
gnutls_transport_set_pull_function (gnutls->priv->session,
[
Date Prev][
Date Next] [
Thread Prev][
Thread Next]
[
Thread Index]
[
Date Index]
[
Author Index]