The branch OpenSSL_1_0_2-stable has been updated via a4530ce0398d673b25a15b72a18dee1d8b14c07d (commit) from cb19c0d15f2f207771ef707b917e8a44912d7dc9 (commit)
- Log ----------------------------------------------------------------- commit a4530ce0398d673b25a15b72a18dee1d8b14c07d Author: Kurt Roeckx <k...@roeckx.be> Date: Sun Jan 10 13:55:08 2016 +0100 Change minimum DH size from 768 to 1024 Reviewed-by: Viktor Dukhovni <openssl-us...@dukhovni.org> ----------------------------------------------------------------------- Summary of changes: CHANGES | 3 ++- ssl/s3_clnt.c | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/CHANGES b/CHANGES index 32bd5c5..e03c46f 100644 --- a/CHANGES +++ b/CHANGES @@ -4,7 +4,8 @@ Changes between 1.0.2e and 1.0.2f [xx XXX xxxx] - *) + *) Reject DH handshakes with parameters shorter than 1024 bits. + [Kurt Roeckx] Changes between 1.0.2d and 1.0.2e [3 Dec 2015] diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c index 8cbf46a..04cc9f5 100644 --- a/ssl/s3_clnt.c +++ b/ssl/s3_clnt.c @@ -3610,7 +3610,7 @@ int ssl3_check_cert_and_algorithm(SSL *s) DH_free(dh_srvr); } - if ((!SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && dh_size < 768) + if ((!SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && dh_size < 1024) || (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) && dh_size < 512)) { SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, SSL_R_DH_KEY_TOO_SMALL); goto f_err; _____ openssl-commits mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-commits