{"action":"created","issue":{"url":"https://api.github.com/repos/mongrel2/mongrel2/issues/295","labels_url":"https://api.github.com/repos/mongrel2/mongrel2/issues/295/labels{/name}","comments_url":"https://api.github.com/repos/mongrel2/mongrel2/issues/295/comments","events_url":"https://api.github.com/repos/mongrel2/mongrel2/issues/295/events","html_url":"https://github.com/mongrel2/mongrel2/issues/295","id":122392952,"number":295,"title":"Reinstate DHE-RSA cipher-suites and use better default DH parameters","user":{"login":"jcowgill","id":1226825,"avatar_url":"https://avatars.githubusercontent.com/u/1226825?v=3","gravatar_id":"","url":"https://api.github.com/users/jcowgill","html_url":"https://github.com/jcowgill","followers_url":"https://api.github.com/users/jcowgill/followers","following_url":"https://api.github.com/users/jcowgill/following{/other_user}","gists_url":"https://api.github.com/users/jcowgill/gists{/gist_id}","starred_url":"https://api.github.com/users/jcowgill/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jcowgill/subscriptions","organizations_url":"https://api.github.com/users/jcowgill/orgs","repos_url":"https://api.github.com/users/jcowgill/repos","events_url":"https://api.github.com/users/jcowgill/events{/privacy}","received_events_url":"https://api.github.com/users/jcowgill/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-12-15T23:32:13Z","updated_at":"2015-12-16T14:13:55Z","closed_at":null,"body":"So I was looking over the TLS code and I noticed that all the DHE cipher-suites were disabled as a result of PR #254. Why? To my knowledge, DHE-RSA is one of the more secure key exchange algorithms (second only to the elliptic curve version) and is enabled by default in most applications I've seen. It's also one of only 3 key exchange algorithms deemed secure enough for TLS 1.3:\r\nhttps://en.wikipedia.org/wiki/Transport_Layer_Security#Key_exchange_or_key_agreement\r\n\r\nIn the commits disabling these cipher-suites, it was mentioned that SSL Labs said they were insecure. I suspect that this was due to the use of 1024-bit DH paremeters rather than DHE itself being broken. Changing `ssl_default_dhm_P` and `ssl_default_dhm_G` to use one of the common DHE parameter sets >= 2048-bits from `polarssl/dhm.h` should be ok (after you've reinstated DHE-RSA)."},"comment":{"url":"https://api.github.com/repos/mongrel2/mongrel2/issues/comments/165118789","html_url":"https://github.com/mongrel2/mongrel2/issues/295#issuecomment-165118789","issue_url":"https://api.github.com/repos/mongrel2/mongrel2/issues/295","id":165118789,"user":{"login":"jcowgill","id":1226825,"avatar_url":"https://avatars.githubusercontent.com/u/1226825?v=3","gravatar_id":"","url":"https://api.github.com/users/jcowgill","html_url":"https://github.com/jcowgill","followers_url":"https://api.github.com/users/jcowgill/followers","following_url":"https://api.github.com/users/jcowgill/following{/other_user}","gists_url":"https://api.github.com/users/jcowgill/gists{/gist_id}","starred_url":"https://api.github.com/users/jcowgill/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jcowgill/subscriptions","organizations_url":"https://api.github.com/users/jcowgill/orgs","repos_url":"https://api.github.com/users/jcowgill/repos","events_url":"https://api.github.com/users/jcowgill/events{/privacy}","received_events_url":"https://api.github.com/users/jcowgill/received_events","type":"User","site_admin":false},"created_at":"2015-12-16T14:13:55Z","updated_at":"2015-12-16T14:13:55Z","body":"Ok, I'll see what I can do."}}