Forum Discussion
Deltavista_1797
Nimbostratus
NimbostratusDHE key exchange: why is ephemeral key only 1024bit long?
Hello,
during a recent analysis comparing security options provided by Apache httpd and F5 LTM we discovered that while Apache for RHEL/CentOS has lifted a limitation of 1024 bits for ephemeral ...
Here's a bit more detail on why supporting DHE parameter lengths greater than 1024 is a non-trivial development effort, and ultimately doesn't return the value in security, given the alternatives: https://devcentral.f5.com/articles/logjams-dhe-parameters-and-other-obstacles-to-tls-excellence
Bear in mind that older clients not supporting DHE 2048 should support ECDHE as a PFS alternative of quality strength.