diff options
| author | Giuseppe D'Angelo <[email protected]> | 2023-06-21 13:30:35 +0200 |
|---|---|---|
| committer | Giuseppe D'Angelo <[email protected]> | 2023-06-27 10:55:27 +0200 |
| commit | 3ec24e329c9ef6802786a37f30ddd8982e903480 (patch) | |
| tree | 1998538406a0bf34deba8547abd6d4d41ad2d287 /src/network/ssl/qsslconfiguration.cpp | |
| parent | 543ae6e6a43519b9fca6758c4a8c78625fcb2c86 (diff) | |
SSL: upgrade the default DH parameters
We have been using as default DH parameters the 1024-bit MODP group.
This is now considered insecure, and applications should use the
2048-bit at a minimum [1]. This commit therefore replaces the parameters
with the 2048-bit MODP group from [2].
To double check the data, use openssl asn1parse to verify that the prime
matches. For instance:
1) put the encoded string in a `encoded.txt` file (c&p from the source,
removing the double quotes)
2) put the hexadecimal value of the 2048-bit group in a `reference.txt`
file (c&p from [2])
3) compare the output of openssl asn1parse with the reference. For
instance like this:
$ diff <(openssl asn1parse < encoded.txt | grep -m 1 INTEGER | perl -pe 's/.*://; s/\n//') <(perl -0777 -pe 's/\s//g' reference.txt) && echo OK
OK
[1] https://datatracker.ietf.org/doc/html/rfc8247#section-2.4
[2] https://datatracker.ietf.org/doc/html/rfc3526#section-3
[ChangeLog][QtNetwork][QSslDiffieHellmanParameters] The default
Diffie-Hellman parameters are now using the 2048-bit MODP group from
RFC 3526.
Pick-to: 6.6 6.5 6.2 5.15
Change-Id: I47133cd78ba0e954b8f93a3da09fa2c760c9f7a8
Reviewed-by: Timur Pocheptsov <[email protected]>
Diffstat (limited to 'src/network/ssl/qsslconfiguration.cpp')
| -rw-r--r-- | src/network/ssl/qsslconfiguration.cpp | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/src/network/ssl/qsslconfiguration.cpp b/src/network/ssl/qsslconfiguration.cpp index 11d5d462214..5acadebc13a 100644 --- a/src/network/ssl/qsslconfiguration.cpp +++ b/src/network/ssl/qsslconfiguration.cpp @@ -919,7 +919,11 @@ void QSslConfiguration::setPreSharedKeyIdentityHint(const QByteArray &hint) Retrieves the current set of Diffie-Hellman parameters. If no Diffie-Hellman parameters have been set, the QSslConfiguration object - defaults to using the 1024-bit MODP group from RFC 2409. + defaults to using the 2048-bit MODP group from RFC 3526. + + \note The default parameters may change in future Qt versions. + Please check the documentation of the \e{exact Qt version} that you + are using in order to know what defaults that version uses. */ QSslDiffieHellmanParameters QSslConfiguration::diffieHellmanParameters() const { @@ -933,7 +937,11 @@ QSslDiffieHellmanParameters QSslConfiguration::diffieHellmanParameters() const a server to \a dhparams. If no Diffie-Hellman parameters have been set, the QSslConfiguration object - defaults to using the 1024-bit MODP group from RFC 2409. + defaults to using the 2048-bit MODP group from RFC 3526. + + \note The default parameters may change in future Qt versions. + Please check the documentation of the \e{exact Qt version} that you + are using in order to know what defaults that version uses. */ void QSslConfiguration::setDiffieHellmanParameters(const QSslDiffieHellmanParameters &dhparams) { |