[openssl-commits] [openssl] OpenSSL_1_0_2-stable update

[Kurt Roeckx]

The branch OpenSSL_1_0_2-stable has been updated
       via  a4530ce0398d673b25a15b72a18dee1d8b14c07d (commit)
      from  cb19c0d15f2f207771ef707b917e8a44912d7dc9 (commit)


- Log -----------------------------------------------------------------
commit a4530ce0398d673b25a15b72a18dee1d8b14c07d
Author: Kurt Roeckx <kurt at roeckx.be>
Date:   Sun Jan 10 13:55:08 2016 +0100

    Change minimum DH size from 768 to 1024
    
    Reviewed-by: Viktor Dukhovni <openssl-users at dukhovni.org>

-----------------------------------------------------------------------

Summary of changes:
 CHANGES       | 3 ++-
 ssl/s3_clnt.c | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 32bd5c5..e03c46f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,7 +4,8 @@
 
  Changes between 1.0.2e and 1.0.2f [xx XXX xxxx]
 
-  *)
+  *) Reject DH handshakes with parameters shorter than 1024 bits.
+     [Kurt Roeckx]
 
  Changes between 1.0.2d and 1.0.2e [3 Dec 2015]
 
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 8cbf46a..04cc9f5 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -3610,7 +3610,7 @@ int ssl3_check_cert_and_algorithm(SSL *s)
             DH_free(dh_srvr);
         }
 
-        if ((!SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && dh_size < 768)
+        if ((!SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && dh_size < 1024)
             || (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && dh_size < 512)) {
             SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, SSL_R_DH_KEY_TOO_SMALL);
             goto f_err;