Re: enable ephemeral Diffie-Hellman (aka EDH or DHE)

On Fri 2013-10-25 17:21:14 -0400, Daniel Kahn Gillmor wrote:

> I just noticed that when i operate perdition as a server offering TLS,
> clients are unable to select an ephemeral Diffie-Hellman key exchange
> mechanism (also known as EDH or DHE).  Since DHE is the most
> widely-supported TLS key exchange mechanism to provide Perfect Forward
> Secrecy (PFS), it seems like something perdition might want.
>
> The patch below enables DHE support for perdition.  By default, it looks
> for a PEM-encoded DH PARAMETERS section in the server's certificate
> file.  I've also added a configuration option (--ssl_dh_params_file)
> which can be used to specify a separate file for the DH params if
> desired.

I now have servers running this patch in production.  It is definitely
useful.  I'd love to get feedback from upstream about it.  If there are
questions or concerns, please share them.  If there is something I could
do differently in the patch to make it more appealing for inclusion in
perdition, please let me know what i should do.

Regards,

        --dkg

______________________________________________
Perdition-users mailing list
[email protected]
http://lists.vergenet.net/listinfo/perdition-users

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)

iQJ8BAEBCgBmBQJSd7LjXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRFQjk2OTEyODdBN0FEREUzNzU3RDkxMUVB
NTI0MDFCMTFCRkRGQTVDAAoJEKUkAbEb/fpcdZoP/2a6elso689XqdsvxNEhrz8U
a8EHVfzu2ZV1QIYz/ziAzjM9BbzqHIS2BbNYZUUrQjs9wLdR2NduWH9GJ7DCbZtu
+ht7X08gQT8Hpn/fr1L6E1OokSoNibBOlfqr3gYMIa+I6SshqbwR7vQnzinOACes
DobvQf2DRqYaCixvyZlPSCBNNqbOBitEgeZDZbO2muLC2eujfuoQOi0Om3hZ8L5F
89QR+ZOGQ95lG+qwfPq8rcp5NfU+R5AENCnzOyw2VHzwd3A0l8xs0F81xh0a6vwh
n/TotopNVkGa8erDANfMuUUfIlZ5D4+fErapOYSTsG69Aq9DPSUyhWFN/zl7vgFg
HFJO1N8hPUtUghsukLpup16UgWXUriDoB/hQTU8WbCMYRfyKP+hgLTDGLAkkNLhk
IPNlg5QJat/GrHDgZGPm/cHH80hYVE+92t3T4owCUod3e/7N6z11BK8eub/JmPpD
YLbHnb4RRv+OGnQPwJaazIR2TVCkzOtOWlf1X16jzUmAuPURW04XELEDCxSzIueo
j27rZ3E7xVeAuSdOKFaDCnK4b3qTK3PNQkmboOSFrMo/ILHuFqBh96aunaRhGVtd
pwpVuFWBlE4KA3f8O6pVIFgMbMeNyHyZOX7SXY0XiT1Yd8Qpbbe0migEMdfMgUjO
Zmi78l6TLoD0db5JuR9G
=6nWT
-----END PGP SIGNATURE-----