For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

qusai's avatar
qusai
Icon for Nimbostratus rankNimbostratus
Feb 27, 2022

The SSL/TLS service uses Diffie-Hellman groups with insufficient strength (key size < 2048).

We have an issue with Diffie Helman Key after auto scan , how we can increase the Diffie helman Key to 2048

security

1 Reply

  • CA_Valli's avatar
    CA_Valli
    Icon for MVP rankMVP
    Feb 28, 2022

    According to K89130356 , all of BIG-IP current versions use only 1024-bit group for DH/DHE ciphers. F5 does not have support for 2048-bits yet implemented at the time of creation of this article. There is an internal RFE opened for this feature.

     

    You can tune your cipher list to remove support for DH and DHE protocols for key exchange, so that only Elliptic Curve ECDH/ECDHE suites will be negotiated in SSL handshake.