Diffie-Hellman key exchange has been lowered to 256 bits

[James Cloos]

I've been getting this message on my deb box for a few days now:

,----
| gnutls.c: [1] Note that the security level of the Diffie-Hellman key
| exchange has been lowered to 256 bits and this may allow decryption of
| the session data
`----

It occurs for both nntp starttls and imaps connectins.

That box runs sid and emacs24-nox, which uses libgnutls-deb0-28
(currently 3.2.15-2).

Using gnutls-cli directly, with either --tofu or --insecure to
connect to news.gmane.org (also with --starttls) results in:

,----
| - Description: (TLS1.0)-(RSA)-(AES-128-CBC)-(SHA1)
| - Session ID: E9:A4:91:94:AF:F0:B0:0E:EB:E1:55:BD:80:8F:A5:63:88:FC:38:96:3F:75:1E:63:2B:18:F4:F1:11:D6:98:E0
| - Version: TLS1.0
| - Key Exchange: RSA
| - Cipher: AES-128-CBC
| - MAC: SHA1
| - Compression: NULL
`----

and no error.

gnutls-cli -p imaps imap.gmail.com also works well, generating:

,----
| - Description: (TLS1.2)-(ECDHE-RSA-SECP256R1)-(AES-128-GCM)
| - Session ID: 5A:B8:70:F0:43:3D:25:EF:9D:F2:2D:9A:73:5C:CB:6E:DE:45:01:0C:71:E3:D6:F6:B3:C0:B9:47:5A:E2:E4:A4
| - Ephemeral EC Diffie-Hellman parameters
| - Using curve: SECP256R1
| - Curve size: 256 bits
| - Version: TLS1.2
| - Key Exchange: ECDHE-RSA
| - Server Signature: RSA-SHA256
| - Cipher: AES-128-GCM
| - MAC: AEAD
| - Compression: NULL
`----

So I cannot see why gnus' usage triggers that warning from gnutls.

-JimC
--
-JimC

[Melleus]

Emacs' gnutls security defaults have been changed.
Try to add:

(setq gnutls-min-prime-bits nil)

to your .emacs somewhere.

[James Cloos]

M> Emacs' gnutls security defaults have been changed.

With the default of 256 for gnutls-min-prime-bits, it shouldn't complain
about ecdh with SECP256R1. The fact that it does implies that the logic
around that variable is wrong.

It also shouldn't complain when the remote site, such as gmane, doesn't
offer ecdh.

But thanks; forcing it to nil does avoid the message.

-JimC
--
-JimC

[Ted Zlatanov]

M> Emacs' gnutls security defaults have been changed.

JC> With the default of 256 for gnutls-min-prime-bits, it shouldn't complain
JC> about ecdh with SECP256R1. The fact that it does implies that the logic
JC> around that variable is wrong.

There is no logic, just a default. We had to pick a default value that
wouldn't break too many users and encourage people to increase it.

JC> It also shouldn't complain when the remote site, such as gmane, doesn't
JC> offer ecdh.

I think it should, since IIUC (but I'm not an expert) EC-DH eliminates
the need for `gnutls-min-prime-bits' altogether.

Ted

[Lars Ingebrigtsen]

Post by James Cloos
,----
| gnutls.c: [1] Note that the security level of the Diffie-Hellman key
| exchange has been lowered to 256 bits and this may allow decryption of
| the session data
`----
It occurs for both nntp starttls and imaps connectins.
That box runs sid and emacs24-nox, which uses libgnutls-deb0-28
(currently 3.2.15-2).

Is this a new warning libgnutls outputs now? If so, we should filter it
out on the Emacs side.

[Greg Troxel]

Post by Lars Ingebrigtsen

Post by James Cloos
,----
| gnutls.c: [1] Note that the security level of the Diffie-Hellman key
| exchange has been lowered to 256 bits and this may allow decryption of
| the session data
`----
It occurs for both nntp starttls and imaps connectins.
That box runs sid and emacs24-nox, which uses libgnutls-deb0-28
(currently 3.2.15-2).

Is this a new warning libgnutls outputs now? If so, we should filter it
out on the Emacs side.

No, the problem should be fixed. 256-bit DH does not make any sense.

[Lars Ingebrigtsen]

Post by Greg Troxel
No, the problem should be fixed. 256-bit DH does not make any sense.

It will use as many DH bits as the server allows. If the server only
uses 256-bits Diffie-Hellman, the connection is essentially unencrypted,
and you may chose not to talk to the server, or you may choose talk to
the server anyway. That's up to the user.

So there is no problem to be fixed.

(The network security manager (on "high") will warn about DH lower than
1024, though.)