[openssl-commits] [openssl] master update

[Viktor Dukhovni]

The branch master has been updated
       via  a7cf07b4961347713b0fea321c301a0a618b4f2e (commit)
      from  c60ebfdc0860458e2a24d86760a7d686cfe1f995 (commit)


- Log -----------------------------------------------------------------
commit a7cf07b4961347713b0fea321c301a0a618b4f2e
Author: Viktor Dukhovni <openssl-users at dukhovni.org>
Date:   Thu Jan 14 01:16:16 2016 -0500

    EDH >= 1024 bits even at security level 0
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    Reviewed-by: Richard Levitte <levitte at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 ssl/ssl_cert.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
index 7f01bcc..75ccc72 100644
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -1062,9 +1062,16 @@ static int ssl_security_default_callback(SSL *s, SSL_CTX *ctx, int op,
         level = SSL_CTX_get_security_level(ctx);
     else
         level = SSL_get_security_level(s);
-    /* Level 0: anything goes */
-    if (level <= 0)
+
+    if (level <= 0) {
+        /*
+         * No EDH keys weaker than 1024-bits even at level 0, otherwise,
+         * anything goes.
+         */
+        if (op == SSL_SECOP_TMP_DH && bits < 80)
+            return 0;
         return 1;
+    }
     if (level > 5)
         level = 5;
     minbits = minbits_table[level - 1];