GNU bug report logs - #9036
[PATCH] gnutls: Add option to set minimum acceptable Diffie-Hellman key size

Previous Next

Full log

View this message in rfc822 format

From: Lawrence Mitchell <wence <at> gmx.li>
To: 9036 <at> debbugs.gnu.org
Subject: bug#9036: [PATCH] gnutls: Add option to set minimum acceptable Diffie-Hellman key size
Date: Sat, 16 Jul 2011 11:27:30 +0100

Lars Magne Ingebrigtsen wrote:
> Lawrence Mitchell <wence <at> gmx.li> writes:

>> With the recent gnutls changes I could no longer send mail with
>> STARTTLS since the smtp server I connect to only advertises a D-H
>> key with 512bits.  This is smaller than the default value gnutls
>> allows and so the connection would be aborted.  This patch adds
>> the ability to set the minimum acceptable size of key, so that I
>> can send email again!

> Thanks; I'll apply your patch.

> However, is there any way to make the gnutls library adjust the size
> downwards automatically if it's too big?

The handshake returns GNUTLS_E_DH_PRIME_UNACCEPTABLE if the
number of server prime bits is too low.  I don't know how to
query the size of the server prime.  Maybe
gnutls_dh_get_prime_bits?  I'm wary to automatically adjust
downwards.

A better error message (pointing at the existance of
gnutls-min-prime-bits) in the case of this failure mode would
probably be good though.  I'll try and cook up a patch in the
next few days.

Lawrence
-- 
Lawrence Mitchell <wence <at> gmx.li>

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.