yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-02-01 23:20:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

Up default server DH params to 2048 bits

Browse source
This commit is contained in:
Manuel Pégourié-Gonnard 2015-07-03 17:43:06 +02:00
parent f333174fa1
commit 3517c20df7
3 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
ChangeLog
View file

@ -4,7 +4,9 @@ PolarSSL ChangeLog
Security Security
* Increase the minimum size of Diffie-Hellman parameters accepted by the * Increase the minimum size of Diffie-Hellman parameters accepted by the
lient to 1024 bits, to protect against Logjam attack. client to 1024 bits, to protect against Logjam attack.
* Increase the size of default Diffie-Hellman parameters on the server to
2048 bits. This can be changed with ssl_set_dh_params().
Bugfix Bugfix
* Fix thread-safety issue in the SSL debug module. * Fix thread-safety issue in the SSL debug module.

2
include/polarssl/ssl.h
View file

@ -814,7 +814,7 @@ void ssl_set_own_cert_alt( ssl_context *ssl, x509_cert *own_cert,
/** /**
* \brief Set the Diffie-Hellman public P and G values, * \brief Set the Diffie-Hellman public P and G values,
* read as hexadecimal strings (server-side only) * read as hexadecimal strings (server-side only)
* (Default: POLARSSL_DHM_RFC5114_MODP_1024_[PG]) * (Default: POLARSSL_DHM_RFC5114_MODP_2048_[PG])
* *
* \param ssl SSL context * \param ssl SSL context
* \param dhm_P Diffie-Hellman-Merkle modulus * \param dhm_P Diffie-Hellman-Merkle modulus

4
library/ssl_tls.c
View file

@ -3075,9 +3075,9 @@ int ssl_init( ssl_context *ssl )
#if defined(POLARSSL_DHM_C) #if defined(POLARSSL_DHM_C)
if( ( ret = mpi_read_string( &ssl->dhm_P, 16, if( ( ret = mpi_read_string( &ssl->dhm_P, 16,
POLARSSL_DHM_RFC5114_MODP_1024_P) ) != 0 || POLARSSL_DHM_RFC5114_MODP_2048_P) ) != 0 ||
( ret = mpi_read_string( &ssl->dhm_G, 16, ( ret = mpi_read_string( &ssl->dhm_G, 16,
POLARSSL_DHM_RFC5114_MODP_1024_G) ) != 0 ) POLARSSL_DHM_RFC5114_MODP_2048_G) ) != 0 )
{ {
SSL_DEBUG_RET( 1, "mpi_read_string", ret ); SSL_DEBUG_RET( 1, "mpi_read_string", ret );
return( ret ); return( ret );