Forum Discussion

Deltavista_1797's avatar
Deltavista_1797
Icon for Nimbostratus rankNimbostratus
Dec 10, 2014

DHE key exchange: why is ephemeral key only 1024bit long?

Hello,   during a recent analysis comparing security options provided by Apache httpd and F5 LTM we discovered that while Apache for RHEL/CentOS has lifted a limitation of 1024 bits for ephemeral ...
application delivery
LTM
security
Joe_M's avatar
Joe_M
Icon for Nimbostratus rankNimbostratus
Mar 10, 2015

I am quite familiar with all of those documents. That is precisely how I have put together my cipher string. Here it is, nothing weak is in there.

 

ECDHE:AES-GCM+RSA:DHE:AES+RSA:!DTLSv1:!RC4:!3DES:!SSLv3:!LOW:@STRENGTH:+TLSv1_1:+TLSv1

 

This has NOTHING to do with the cipher itself! It has to do with (from what I can tell) the Diffe-Hellman parameters that don't appear to be configurable on the F5.

 

https://wiki.openssl.org/index.php/Diffie-Hellman_parameters