Forum Discussion
saidshow_251381
Cirrostratus
Jul 26, 2016DHE 1024 bits Vulnerability Solved?
Hi Guys,
I have 3 volumes on my Lab F5.
- 11.6.0
- 11.6.0 with HotFix 6
- 12.1.0 with HotFix 1
I booted in to the 11.6.0 with HotFix 6 volume and performed an sslscan on the device and note...
Kevin_Stewart
Employee
Jul 29, 2016The short answer is yes and no.
F5 hasn't added support for 2048-bit DHE primes yet, so any sslscan or SSLLabs scan will downgrade your results because of what it believes is "weak DH".
However, if you understand the concepts behind "weak DH" and how such an exploit might occur, and also take into consideration that the F5 platform automatically rotates its 1024-bit primes often, the threats associates with weak DH are minimized.
If you just need to get an A+, then as of 12.1 and below you need to remove DHE from your cipher stack.
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects