SSL: upgrade the default DH parameters
We have been using as default DH parameters the 1024-bit MODP group. This is now considered insecure, and applications should use the 2048-bit at a minimum [1]. This commit therefore replaces the parameters with the 2048-bit MODP group from [2]. To double check the data, use openssl asn1parse to verify that the prime matches. For instance: 1) put the encoded string in a `encoded.txt` file (c&p from the source, removing the double quotes) 2) put the hexadecimal value of the 2048-bit group in a `reference.txt` file (c&p from [2]) 3) compare the output of openssl asn1parse with the reference. For instance like this: $ diff <(openssl asn1parse < encoded.txt | grep -m 1 INTEGER | perl -pe 's/.*://; s/\n//') <(perl -0777 -pe 's/\s//g' reference.txt) && echo OK OK [1] https://datatracker.ietf.org/doc/html/rfc8247#section-2.4 [2] https://datatracker.ietf.org/doc/html/rfc3526#section-3 [ChangeLog][QtNetwork][QSslDiffieHellmanParameters] The default Diffie-Hellman parameters are now using the 2048-bit MODP group from RFC 3526. Pick-to: 6.6 6.5 6.2 5.15 Change-Id: I47133cd78ba0e954b8f93a3da09fa2c760c9f7a8 Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
This commit is contained in:
parent
543ae6e6a4
commit
3ec24e329c
@ -919,7 +919,11 @@ void QSslConfiguration::setPreSharedKeyIdentityHint(const QByteArray &hint)
|
||||
Retrieves the current set of Diffie-Hellman parameters.
|
||||
|
||||
If no Diffie-Hellman parameters have been set, the QSslConfiguration object
|
||||
defaults to using the 1024-bit MODP group from RFC 2409.
|
||||
defaults to using the 2048-bit MODP group from RFC 3526.
|
||||
|
||||
\note The default parameters may change in future Qt versions.
|
||||
Please check the documentation of the \e{exact Qt version} that you
|
||||
are using in order to know what defaults that version uses.
|
||||
*/
|
||||
QSslDiffieHellmanParameters QSslConfiguration::diffieHellmanParameters() const
|
||||
{
|
||||
@ -933,7 +937,11 @@ QSslDiffieHellmanParameters QSslConfiguration::diffieHellmanParameters() const
|
||||
a server to \a dhparams.
|
||||
|
||||
If no Diffie-Hellman parameters have been set, the QSslConfiguration object
|
||||
defaults to using the 1024-bit MODP group from RFC 2409.
|
||||
defaults to using the 2048-bit MODP group from RFC 3526.
|
||||
|
||||
\note The default parameters may change in future Qt versions.
|
||||
Please check the documentation of the \e{exact Qt version} that you
|
||||
are using in order to know what defaults that version uses.
|
||||
*/
|
||||
void QSslConfiguration::setDiffieHellmanParameters(const QSslDiffieHellmanParameters &dhparams)
|
||||
{
|
||||
|
@ -33,17 +33,18 @@
|
||||
|
||||
QT_BEGIN_NAMESPACE
|
||||
|
||||
// The 1024-bit MODP group from RFC 2459 (Second Oakley Group)
|
||||
// The 2048-bit MODP group from RFC 3526
|
||||
Q_AUTOTEST_EXPORT const char *qssl_dhparams_default_base64 =
|
||||
"MIGHAoGBAP//////////yQ/aoiFowjTExmKLgNwc0SkCTgiKZ8x0Agu+pjsTmyJR"
|
||||
"Sgh5jjQE3e+VGbPNOkMbMCsKbfJfFDdP4TVtbVHCReSFtXZiXn7G9ExC6aY37WsL"
|
||||
"/1y29Aa37e44a/taiZ+lrp8kEXxLH+ZJKGZR7OZTgf//////////AgEC";
|
||||
"MIIBCAKCAQEA///////////JD9qiIWjCNMTGYouA3BzRKQJOCIpnzHQCC76mOxObIlFKCHmO"
|
||||
"NATd75UZs806QxswKwpt8l8UN0/hNW1tUcJF5IW1dmJefsb0TELppjftawv/XLb0Brft7jhr"
|
||||
"+1qJn6WunyQRfEsf5kkoZlHs5Fs9wgB8uKFjvwWY2kg2HFXTmmkWP6j9JM9fg2VdI9yjrZYc"
|
||||
"YvNWIIVSu57VKQdwlpZtZww1Tkq8mATxdGwIyhghfDKQXkYuNs474553LBgOhgObJ4Oi7Aei"
|
||||
"j7XFXfBvTFLJ3ivL9pVYFxg5lUl86pVq5RXSJhiY+gUQFXKOWoqsqmj//////////wIBAg==";
|
||||
|
||||
/*!
|
||||
Returns the default QSslDiffieHellmanParameters used by QSslSocket.
|
||||
|
||||
This is currently the 1024-bit MODP group from RFC 2459, also
|
||||
known as the Second Oakley Group.
|
||||
This is currently the 2048-bit MODP group from RFC 3526.
|
||||
*/
|
||||
QSslDiffieHellmanParameters QSslDiffieHellmanParameters::defaultParameters()
|
||||
{
|
||||
|
Loading…
Reference in New Issue
Block a user