Forum Discussion
saidshow_251381
Jul 26, 2016Cirrostratus
DHE 1024 bits Vulnerability Solved?
Hi Guys,
I have 3 volumes on my Lab F5.
- 11.6.0
- 11.6.0 with HotFix 6
- 12.1.0 with HotFix 1
I booted in to the 11.6.0 with HotFix 6 volume and performed an sslscan on the device and note...
Kevin_Stewart
Jul 29, 2016Employee
The short answer is yes and no.
F5 hasn't added support for 2048-bit DHE primes yet, so any sslscan or SSLLabs scan will downgrade your results because of what it believes is "weak DH".
However, if you understand the concepts behind "weak DH" and how such an exploit might occur, and also take into consideration that the F5 platform automatically rotates its 1024-bit primes often, the threats associates with weak DH are minimized.
If you just need to get an A+, then as of 12.1 and below you need to remove DHE from your cipher stack.
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects