tahoe-lafs/trac-2024-07-25

node web server should use DHE/ECDHE suites automatically #2385

New issue

Open

opened 2015-02-12 04:07:35 +00:00 by j3i · 3 comments

j3i commented

2015-02-12 04:07:35 +00:00

Owner

web.port = ssl:443:privateKey=key.pem:certKey=cert.pem:dhParameters=params.pem

The DH parameters should be provided automatically and cipher suites with PFS should work out of the box.

Right now you have to manually generate Diffie-Hellman parameters and define them in the config if you want to use a node's web server via TLS and not be restricted to plain RSA authentication like this: web.port = ssl:443:privateKey=key.pem:certKey=cert.pem:dhParameters=params.pem The DH parameters should be provided automatically and cipher suites with PFS should work out of the box.

tahoe-lafs added the

labels 2015-02-12 04:07:35 +00:00

tahoe-lafs added this to the undecided milestone 2015-02-12 04:07:35 +00:00

tahoe-lafs added

major

and removed

normal

labels 2015-04-12 21:53:49 +00:00

daira commented

2015-04-12 21:59:17 +00:00

Author

Owner

More recent Twisted supports ECDHE out-of-the-box, although I haven't checked whether there is anything preventing Tahoe from using it. Please check with Twisted 15.0.0 and report back whether this works now, without the :dhParameters=params.pem. (If you don't want to install Twisted 15 globally, you can edit the dependency in src/allmydata/_auto_deps.py to "Twisted >= 15.0.0" and rebuild.)

More recent Twisted supports ECDHE out-of-the-box, although I haven't checked whether there is anything preventing Tahoe from using it. Please check with Twisted 15.0.0 and report back whether this works now, without the `:dhParameters=params.pem`. (If you don't want to install Twisted 15 globally, you can edit the dependency in `src/allmydata/_auto_deps.py` to `"Twisted >= 15.0.0"` and rebuild.)

daira commented

2015-04-12 22:00:46 +00:00

Author

Owner

To see which version of Twisted is being used by Tahoe, run tahoe --version-and-path.

To see which version of Twisted is being used by Tahoe, run `tahoe --version-and-path`.

exarkun commented

2020-01-20 20:54:52 +00:00

Author

Owner

It is indeed supported by Twisted but you still have to generate and supply your own dh params if you want to use DHE/ECDHE.

I'm not quite sure what the workflow for having Tahoe-LAFS generate these automatically should be, though.

It is indeed supported by Twisted but you still have to generate and supply your own dh params if you want to use DHE/ECDHE. I'm not quite sure what the workflow for having Tahoe-LAFS generate these automatically should be, though.