Re: [Dovecot] 2048-bit Diffie-Hellman parameters

2013-09-24 Thread Robert Schetterer
Am 24.09.2013 08:48, schrieb Marios Titas: Currently, dovecot generates two primes for Diffie-Hellman key exchanges: a 512-bit one and a 1024-bit one. In light of recent events, I think it would be wise to add support for 2048-bit primes as well, or even better, add a configuration option that

Re: [Dovecot] 2048-bit Diffie-Hellman parameters

2013-09-24 Thread Stan Hoeppner
On 9/24/2013 1:48 AM, Marios Titas wrote: Currently, dovecot generates two primes for Diffie-Hellman key exchanges: a 512-bit one and a 1024-bit one. In light of recent events, I think it would be wise to add support for 2048-bit primes as well... Why play incremental tiddly-winks with the

Re: [Dovecot] 2048-bit Diffie-Hellman parameters

2013-09-24 Thread Reindl Harald
Am 24.09.2013 11:21, schrieb Stan Hoeppner: On 9/24/2013 1:48 AM, Marios Titas wrote: Currently, dovecot generates two primes for Diffie-Hellman key exchanges: a 512-bit one and a 1024-bit one. In light of recent events, I think it would be wise to add support for 2048-bit primes as well...

Re: [Dovecot] 2048-bit Diffie-Hellman parameters

2013-09-24 Thread Stan Hoeppner
On 9/24/2013 3:05 AM, Robert Schetterer wrote: you may get problems with older mail clients , on smtp side i discovered i.e netscape 7 ist not able to handle stuff bigger then 1024 but some more configure options maybe fine ever Netscape 7.2 is *9* years old, 7.0 is *11* years old. I think

Re: [Dovecot] 2048-bit Diffie-Hellman parameters

2013-09-24 Thread Robert Schetterer
Am 24.09.2013 11:32, schrieb Stan Hoeppner: On 9/24/2013 3:05 AM, Robert Schetterer wrote: you may get problems with older mail clients , on smtp side i discovered i.e netscape 7 ist not able to handle stuff bigger then 1024 but some more configure options maybe fine ever Netscape 7.2 is

Re: [Dovecot] 2048-bit Diffie-Hellman parameters

2013-09-24 Thread Noel Butler
On Tue, 2013-09-24 at 04:21 -0500, Stan Hoeppner wrote: NSA doesn't sniff the wire. They don't crack encryption. Neither are somebody hasnt been paying attention signature.asc Description: This is a digitally signed message part

Re: [Dovecot] 2048-bit Diffie-Hellman parameters

2013-09-24 Thread Ron Leach
On 24/09/2013 07:48, Marios Titas wrote: Currently, dovecot generates two primes for Diffie-Hellman key exchanges: a 512-bit one and a 1024-bit one. In light of recent events, I think it would be wise to add support for 2048-bit primes as well, or even better, add a configuration option that

Re: [Dovecot] 2048-bit Diffie-Hellman parameters

2013-09-24 Thread lst_hoe02
Zitat von Noel Butler noel.but...@ausics.net: On Tue, 2013-09-24 at 04:21 -0500, Stan Hoeppner wrote: NSA doesn't sniff the wire. They don't crack encryption. Neither are somebody hasnt been paying attention [OT] Why, they actually use the english TEMPORA to get the data, so at

Re: [Dovecot] 2048-bit Diffie-Hellman parameters

2013-09-24 Thread Timo Sirainen
On 24.9.2013, at 15.01, Ron Leach ronle...@tesco.net wrote: I support the OP's suggestion. Could the Dovecot developer(s) consider adding support for longer key sizes? My answer from a few days ago on a different thread: http://dovecot.org/list/dovecot/2013-September/092615.html I'd like

Re: [Dovecot] 2048-bit Diffie-Hellman parameters

2013-09-24 Thread Noel Butler
On Tue, 2013-09-24 at 14:04 +0200, lst_ho...@kwsoft.de wrote: [OT] Why, they actually use the english TEMPORA to get the data, so at least in part they don't sniff the wire... Tempora, amongst others (remember tempora is pretty old now) signature.asc Description: This is a digitally

Re: [Dovecot] 2048-bit Diffie-Hellman parameters

2013-09-24 Thread Robin
On 9/24/2013 2:28 AM, Reindl Harald wrote: maybe on your server, my logs showing the opposite and since the smtp are outgoing messages your conclusion of nobody is strange cat maillog | grep smtp | grep -v smtpd | grep TLS | wc -l 12327 cat maillog | grep smtpd | grep TLS | wc -l 13350