For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

saidshow_251381's avatar
saidshow_251381
Icon for Cirrostratus rankCirrostratus
Jul 26, 2016

DHE 1024 bits Vulnerability Solved?

Hi Guys,   I have 3 volumes on my Lab F5. - 11.6.0 - 11.6.0 with HotFix 6 - 12.1.0 with HotFix 1   I booted in to the 11.6.0 with HotFix 6 volume and performed an sslscan on the device and note...
1024
12.1
application delivery
BIG-IP
dhe
dhe 1024
security
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Jul 29, 2016

The short answer is yes and no.

 

F5 hasn't added support for 2048-bit DHE primes yet, so any sslscan or SSLLabs scan will downgrade your results because of what it believes is "weak DH".

 

However, if you understand the concepts behind "weak DH" and how such an exploit might occur, and also take into consideration that the F5 platform automatically rotates its 1024-bit primes often, the threats associates with weak DH are minimized.

 

If you just need to get an A+, then as of 12.1 and below you need to remove DHE from your cipher stack.