[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
bug#9036: [PATCH] gnutls: Add option to set minimum acceptable Diffie-He
From: |
Lawrence Mitchell |
Subject: |
bug#9036: [PATCH] gnutls: Add option to set minimum acceptable Diffie-Hellman key size |
Date: |
Sat, 16 Jul 2011 11:27:30 +0100 |
User-agent: |
Gnus/5.110018 (No Gnus v0.18) Emacs/24.0.50 (gnu/linux) |
Lars Magne Ingebrigtsen wrote:
> Lawrence Mitchell <wence@gmx.li> writes:
>> With the recent gnutls changes I could no longer send mail with
>> STARTTLS since the smtp server I connect to only advertises a D-H
>> key with 512bits. This is smaller than the default value gnutls
>> allows and so the connection would be aborted. This patch adds
>> the ability to set the minimum acceptable size of key, so that I
>> can send email again!
> Thanks; I'll apply your patch.
> However, is there any way to make the gnutls library adjust the size
> downwards automatically if it's too big?
The handshake returns GNUTLS_E_DH_PRIME_UNACCEPTABLE if the
number of server prime bits is too low. I don't know how to
query the size of the server prime. Maybe
gnutls_dh_get_prime_bits? I'm wary to automatically adjust
downwards.
A better error message (pointing at the existance of
gnutls-min-prime-bits) in the case of this failure mode would
probably be good though. I'll try and cook up a patch in the
next few days.
Lawrence
--
Lawrence Mitchell <wence@gmx.li>