Weak DH primes and openssh

[Darren Tucker]

On Thu, May 21, 2015 at 11:26 PM, Matthew Vernon <matthew at debian.org> wrote:
>
> You will be aware of https://weakdh.org/ by now, I presume; the
> take-home seems to be that 1024-bit DH primes might well be too weak.
> I'm wondering what (if anything!) you propose to do about this issue,
> and what Debian might do for our users?


Would you (and any other vendors) consider generating your own moduli file
for your distribution?  If a few vendors did that it'd increase the
diversity quite a lot and it'd stop us (well, specifically me) being the
point of failure for not making updates.

I have some scripts to split the screening (the CPU intensive part) up into
1 shard per CPU, which would let the whole process run in about a day on a
decent sized machine.  If there is any interest I can tidy them up and
stick them in contrib/ or something.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.