Re: [TLS] Short Ephermal Diffie-Hellman keys

[Dr Stephen Henson <lists at drh-consultancy.demon.co.uk>]

Pasi.Eronen at nokia.com wrote:
> Mike wrote:
> 
>> This is probably the result of an administrator not wanting to
>> wait the extra 30 seconds to generate a strong key.  If the
>> server is set up to generate a key on startup, it may not start
>> listening for connections until it has completed the task.
> 
> Generating a 1024-bit DH key on a modern PC takes less 
> than 30 _milli_seconds, so I doubt this is the real reason 
> (unless the implementation is really, really stupid).
> 

The 30 seconds reference should be for DH _parameter_ generation (which
some servers perform on start up) rather than key generation.

Steve.
-- 
Dr Stephen N. Henson.
Core developer of the   OpenSSL project: http://www.openssl.org/
Freelance consultant see: http://www.drh-consultancy.co.uk/
Email: shenson at drh-consultancy.co.uk, PGP key: via homepage.

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls