{"action":"created","issue":{"url":"https://api.github.com/repos/ssllabs/ssllabs-scan/issues/213","labels_url":"https://api.github.com/repos/ssllabs/ssllabs-scan/issues/213/labels{/name}","comments_url":"https://api.github.com/repos/ssllabs/ssllabs-scan/issues/213/comments","events_url":"https://api.github.com/repos/ssllabs/ssllabs-scan/issues/213/events","html_url":"https://github.com/ssllabs/ssllabs-scan/issues/213","id":106209960,"number":213,"title":"Incorrect Key Exchange score when offering DHE and ECDHE","user":{"login":"TheWolfH","id":5102666,"avatar_url":"https://avatars.githubusercontent.com/u/5102666?v=3","gravatar_id":"","url":"https://api.github.com/users/TheWolfH","html_url":"https://github.com/TheWolfH","followers_url":"https://api.github.com/users/TheWolfH/followers","following_url":"https://api.github.com/users/TheWolfH/following{/other_user}","gists_url":"https://api.github.com/users/TheWolfH/gists{/gist_id}","starred_url":"https://api.github.com/users/TheWolfH/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TheWolfH/subscriptions","organizations_url":"https://api.github.com/users/TheWolfH/orgs","repos_url":"https://api.github.com/users/TheWolfH/repos","events_url":"https://api.github.com/users/TheWolfH/events{/privacy}","received_events_url":"https://api.github.com/users/TheWolfH/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-09-13T10:52:32Z","updated_at":"2015-09-13T12:02:44Z","closed_at":null,"body":"When a server uses a 4096-bit RSA certificate and offers both DHE (4096-bit DH parameters) and ECDHE key exchange (256-bit ECDH parameters), it is awarded a perfect 100% score for its key exchange.\r\nHowever, 256-bit ECDH is believed to be equivalent to 3072-bit RSA, which - according to the Server Rating guide - should be awarded a score of 90%.\r\nActually, I think the current score of 100% should be kept for this kind of setup, as it reflects the current recommendations for up-to-date TLS security. However, maybe the Server Rating guide should be updated to include the standards used for assessing ECDHE key exchanges (currently, there is no mention of such standards, just for DH(E)).\r\n\r\nExample website conforming to the mentioned configuration: https://www.ssllabs.com/ssltest/analyze.html?d=bulldog-hosting.de"},"comment":{"url":"https://api.github.com/repos/ssllabs/ssllabs-scan/issues/comments/139865045","html_url":"https://github.com/ssllabs/ssllabs-scan/issues/213#issuecomment-139865045","issue_url":"https://api.github.com/repos/ssllabs/ssllabs-scan/issues/213","id":139865045,"user":{"login":"TheWolfH","id":5102666,"avatar_url":"https://avatars.githubusercontent.com/u/5102666?v=3","gravatar_id":"","url":"https://api.github.com/users/TheWolfH","html_url":"https://github.com/TheWolfH","followers_url":"https://api.github.com/users/TheWolfH/followers","following_url":"https://api.github.com/users/TheWolfH/following{/other_user}","gists_url":"https://api.github.com/users/TheWolfH/gists{/gist_id}","starred_url":"https://api.github.com/users/TheWolfH/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TheWolfH/subscriptions","organizations_url":"https://api.github.com/users/TheWolfH/orgs","repos_url":"https://api.github.com/users/TheWolfH/repos","events_url":"https://api.github.com/users/TheWolfH/events{/privacy}","received_events_url":"https://api.github.com/users/TheWolfH/received_events","type":"User","site_admin":false},"created_at":"2015-09-13T12:02:44Z","updated_at":"2015-09-13T12:02:44Z","body":"I'm not talking about certificates, but about ECDH parameters. If you use 256-bit ECDH parameters, you are (inconsistently with the Server Rating guide) awarded the full score.\r\nAlso, the 100% can still be seen by looking at how far the bar reaches. So if the numeric values are to be deleted (I have no problem with that), the whole diagram right to the total grade should be removed."}}