The dhparam thing is really about a default that if you generate
DH parameters that it defaults to 2048 instead of 1024.  This
shouldn't break anything itself, nor do I know of any other
software that would get broken by this.
Apparently Java 6 and 7 will fail to handshake if a server tries to use DH with larger than 1024 bit parameters (and Java 8 apparently fails with anything larger than 2048 bits which is not relavent to the current discussion but is sad anyway). This is especially an issue with Java 6 which does not support ECDH (most configurations put ECDH above DH in the ciphersuite preferences so java 7 ends up using ECDH).

Personally I think the security advantages of moving away from 1024 bit DH (which is probablly breakable with nsa level resources) outweigh this breakage (especially as afaict changing the defaults for parameter generation will only impact new installs not upgrades) but it is probablly something that should be documented.

Reply via email to