{"action":"created","issue":{"url":"https://api.github.com/repos/joyent/node/issues/25366","labels_url":"https://api.github.com/repos/joyent/node/issues/25366/labels{/name}","comments_url":"https://api.github.com/repos/joyent/node/issues/25366/comments","events_url":"https://api.github.com/repos/joyent/node/issues/25366/events","html_url":"https://github.com/joyent/node/issues/25366","id":79457013,"number":25366,"title":"Remove (or discourage) small DH groups in crypto.getDiffieHellman","user":{"login":"thinred","id":502560,"avatar_url":"https://avatars.githubusercontent.com/u/502560?v=3","gravatar_id":"","url":"https://api.github.com/users/thinred","html_url":"https://github.com/thinred","followers_url":"https://api.github.com/users/thinred/followers","following_url":"https://api.github.com/users/thinred/following{/other_user}","gists_url":"https://api.github.com/users/thinred/gists{/gist_id}","starred_url":"https://api.github.com/users/thinred/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thinred/subscriptions","organizations_url":"https://api.github.com/users/thinred/orgs","repos_url":"https://api.github.com/users/thinred/repos","events_url":"https://api.github.com/users/thinred/events{/privacy}","received_events_url":"https://api.github.com/users/thinred/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-05-22T13:33:07Z","updated_at":"2015-05-26T20:12:54Z","closed_at":null,"body":"Hi,\r\nthe set of predefined RFC DH groups offered by getDiffieHellman should be reconsidered. Due to the new Logjam revelations (https://weakdh.org/sysadmin.html, search for OpenSSH), groups of preset prime and of size smaller than 2048 bits should be considered easily breakable (well, it's not Logjam that showed it, but only put the problem into the public's attention).\r\n\r\nAccording to https://tools.ietf.org/html/rfc4253#section-8.1 Oakley 2 Group is a MUST in SSH protocol implementations (there is at least one that exists: https://github.com/mscdex/ssh2-streams), so we cannot simply drop it. However we could do either:\r\n     1) drop modp1 group (which has 768 bits) and, possibly, modp5 as well (1536 bits)\r\n     2) deprecate all groups < 2048 bits in the docs\r\nI can prepare a patch for any of these options, but please comment.\r\n\r\nTomasz"},"comment":{"url":"https://api.github.com/repos/joyent/node/issues/comments/105651988","html_url":"https://github.com/joyent/node/issues/25366#issuecomment-105651988","issue_url":"https://api.github.com/repos/joyent/node/issues/25366","id":105651988,"user":{"login":"dnakamura","id":12418336,"avatar_url":"https://avatars.githubusercontent.com/u/12418336?v=3","gravatar_id":"","url":"https://api.github.com/users/dnakamura","html_url":"https://github.com/dnakamura","followers_url":"https://api.github.com/users/dnakamura/followers","following_url":"https://api.github.com/users/dnakamura/following{/other_user}","gists_url":"https://api.github.com/users/dnakamura/gists{/gist_id}","starred_url":"https://api.github.com/users/dnakamura/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dnakamura/subscriptions","organizations_url":"https://api.github.com/users/dnakamura/orgs","repos_url":"https://api.github.com/users/dnakamura/repos","events_url":"https://api.github.com/users/dnakamura/events{/privacy}","received_events_url":"https://api.github.com/users/dnakamura/received_events","type":"User","site_admin":false},"created_at":"2015-05-26T20:12:54Z","updated_at":"2015-05-26T20:12:54Z","body":"I might even go further and discourage use of getDiffieHellman in favor of createDiffieHellman"}}