<div dir="ltr">Hello,<div>Thank you all for your responses. I forgot to mention that we are on OpenSSL 1.1.0 and TLS 1.2.</div><div>I have some more queries though.</div><div><br></div><div><br style="font-size:12.8px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial"><span style="font-size:12.8px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">>>Current OpenSSL isn't willing to connect to a server using a DH key size below 1024 bits.</span><br style="font-size:12.8px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">
Yes, i have verified this. However, not sure, how my OpenSSL-based client can do this, as our requirement is that we must not use DH key size below 2048 bits.</div><div><br></div><div>>>
<span style="text-decoration-style:initial;text-decoration-color:initial;font-size:12.8px;background-color:rgb(255,255,255);float:none;display:inline">I'm pretty sure that clients can and do refuse to talk to servers with small DH parameters.</span><br style="text-decoration-style:initial;text-decoration-color:initial;font-size:12.8px;background-color:rgb(255,255,255)">
</div><div><span style="text-decoration-style:initial;text-decoration-color:initial;font-size:12.8px;background-color:rgb(255,255,255);float:none;display:inline">Could you please provide some more clues how a client can do so ?</span></div><div><span style="text-decoration-style:initial;text-decoration-color:initial;font-size:12.8px;background-color:rgb(255,255,255);float:none;display:inline"><br></span></div><div><span style="text-decoration-style:initial;text-decoration-color:initial;font-size:12.8px;background-color:rgb(255,255,255);float:none;display:inline">>>
<span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">However, in TLS 1.3, the FFDHE groups are pre-defined, and the server</span><br style="text-decoration-style:initial;text-decoration-color:initial"><span style="text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">>>does not get to choose ad-hoc (p, g) pairs</span>
</span></div><div><span style="text-decoration-style:initial;text-decoration-color:initial;font-size:12.8px;background-color:rgb(255,255,255);float:none;display:inline">Yep; i saw them. Here, client plays a role to offer the supported DHE first and then, the server can use that - just like elliptic curve negotiation. But again, one catch is that custom DH groups are no more allowed, for which i didn't find a good reasoning.</span></div><div><span style="text-decoration-style:initial;text-decoration-color:initial;font-size:12.8px;background-color:rgb(255,255,255);float:none;display:inline"><br></span></div><div><span style="text-decoration-style:initial;text-decoration-color:initial;font-size:12.8px;background-color:rgb(255,255,255);float:none;display:inline"><br></span></div><div><span style="text-decoration-style:initial;text-decoration-color:initial;font-size:12.8px;background-color:rgb(255,255,255);float:none;display:inline">Regards,<br>Sanjaya</span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jun 7, 2018 at 8:52 AM, Jordan Brown <span dir="ltr"><<a href="mailto:openssl@jordan.maileater.net" target="_blank">openssl@jordan.maileater.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF"><span class="">
<div class="m_-8971466916364271480moz-cite-prefix">On 6/6/2018 12:11 PM, Sanjaya Joshi
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">I understood that when DHE ciphers are tried to be
used between two entities, it's only the server that plays a
role about selection of the DH parameters. This is not
negotiable with the client. For e.g., the server can freely use
a very low not-recommended DH group with 512 bit key length and
the client cannot deny it.</div>
</blockquote>
<br></span>
I'm pretty sure that clients can and do refuse to talk to servers
with small DH parameters.<br>
<br>
Current OpenSSL isn't willing to connect to a server using a DH key
size below 1024 bits.<br>
<br>
<a class="m_-8971466916364271480moz-txt-link-freetext" href="https://www.openssl.org/blog/blog/2015/05/20/logjam-freak-upcoming-changes/" target="_blank">https://www.openssl.org/blog/<wbr>blog/2015/05/20/logjam-freak-<wbr>upcoming-changes/</a><br>
<blockquote>To protect OpenSSL-based clients, we’re increasing the
minimum accepted DH key size to 768 bits immediately in the next
release, and to 1024 bits soon after. </blockquote><span class="HOEnZb"><font color="#888888">
<br>
<pre class="m_-8971466916364271480moz-signature" cols="72">--
Jordan Brown, Oracle Solaris</pre>
</font></span></div>
</blockquote></div><br></div>