GNU bug report logs - #17660
24.3; gnutls-min-prime-bits is 256

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 17660 in the body.
You can then email your comments to 17660 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Juliusz Chroboczek <jch <at> pps.univ-paris-diderot.fr>
To: bug-gnu-emacs <at> gnu.org
Subject: 24.3; gnutls-min-prime-bits is 256
Date: Sun, 01 Jun 2014 15:23:49 +0200

In gnutls.el, I see

  (defcustom gnutls-min-prime-bits 256
     ...)

This uses 256 bits for Diffie-Helman rather than the gnutls default, which
seems awfully low to me.

It looks like this was lowered due to bug#11267.  I suggest that it really
should be set to a reasonable value.

-- Juliusz

Message #8 received at 17660 <at> debbugs.gnu.org (full text, mbox):

From: Ted Zlatanov <tzz <at> lifelogs.com>
To: Juliusz Chroboczek <jch <at> pps.univ-paris-diderot.fr>
Cc: 17660 <at> debbugs.gnu.org
Subject: Re: bug#17660: 24.3; gnutls-min-prime-bits is 256
Date: Thu, 05 Jun 2014 10:30:53 -0400

On Sun, 01 Jun 2014 15:23:49 +0200 Juliusz Chroboczek <jch <at> pps.univ-paris-diderot.fr> wrote: 

JC> In gnutls.el, I see
JC>   (defcustom gnutls-min-prime-bits 256
JC>      ...)

JC> This uses 256 bits for Diffie-Helman rather than the gnutls default, which
JC> seems awfully low to me.

JC> It looks like this was lowered due to bug#11267.  I suggest that it really
JC> should be set to a reasonable value.

Please read through bug#11267 and bug#15057. The recommended solution
from the GnuTLS maintainer was to avoid the DH exchange that requires
`gnutls-min-prime-bits' altogether.  So the proper fix seems to be to
change the default for `gnutls-algorithm-priority' but that may break
some people's setups (just like raising `gnutls-min-prime-bits' would).

Ted

Message #11 received at 17660 <at> debbugs.gnu.org (full text, mbox):

From: Lars Magne Ingebrigtsen <larsi <at> gnus.org>
To: Juliusz Chroboczek <jch <at> pps.univ-paris-diderot.fr>
Cc: 17660 <at> debbugs.gnu.org
Subject: Re: bug#17660: 24.3; gnutls-min-prime-bits is 256
Date: Mon, 08 Dec 2014 20:46:35 +0100

Juliusz Chroboczek <jch <at> pps.univ-paris-diderot.fr> writes:

> In gnutls.el, I see
>
>   (defcustom gnutls-min-prime-bits 256
>      ...)
>
> This uses 256 bits for Diffie-Helman rather than the gnutls default, which
> seems awfully low to me.
>
> It looks like this was lowered due to bug#11267.  I suggest that it really
> should be set to a reasonable value.

In Emacs 25, people who want higher security can use the Network
Security Manager to achieve this, so I think the default here is
reasonable.  Closing.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.