Lennart Koopmann | 9 Jul 14:11

How to correctly set Diffie Hellman prime bits?

Hello again list,

i am continuing experimenting with GNUTLS. I have written a client and a
server that perform anonymous (ANON-DH) TLS negotiation.

I successfully connected to a gnutls-serv --http --priority "NORMAL:
+ANON-DH" instance.

When i tried to connect to my own server (which is mostly an example
from the documentation) i got the following error:

> GNUTLS ERROR: The Diffie Hellman prime sent by the server is not
> acceptable (not long enough).

So i manually set the Diffie Hellman prime bits in the server to 1024
and in the client to 1023 (gnutls_dh_set_prime_bits (session, DH_BITS))
- With no effect. Still the same error. I also tried to set the DH prime
bits in the server to 2048. The server needed longer to start up after
this change so i guess that took effect.

I then set the DH prime bits in the client to 0 and in the server to
1024. Now i can connect:

Output of server:
> [lennart <at> sundaysister Debug]$ ./GNUTLSTest-Server 
> Server ready. Listening to port '5556'.
>
> - Anonymous DH using prime of -50 bits
> - connection from 112.93.99.0, port 50879
> - Handshake was completed
(Continue reading)

Ludovic Courtès | 9 Jul 23:19

Re: How to correctly set Diffie Hellman prime bits?

Hi,

Lennart Koopmann <lennart <at> scopeport.org> writes:

> When i tried to connect to my own server (which is mostly an example
> from the documentation) i got the following error:
>
>> GNUTLS ERROR: The Diffie Hellman prime sent by the server is not
>> acceptable (not long enough).

The solution may be to apply this patch:

  http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=b32735e1e275c4a2dbf544c04cdf344181fea555

Thanks,
Ludovic.
Lennart Koopmann | 10 Jul 11:12

Re: Re: How to correctly set Diffie Hellman prime bits?

Hey Ludovic,

thank you very much! Seems like this was fixed in GnuTLS 2.5.2? I
installed it and everything works fine with 1024 DH bits :)

Have a nice day!

Best regards
Lennart Koopmann

Am Mittwoch, den 09.07.2008, 23:19 +0200 schrieb Ludovic Courtès:
> Hi,
> 
> Lennart Koopmann <lennart <at> scopeport.org> writes:
> 
> > When i tried to connect to my own server (which is mostly an example
> > from the documentation) i got the following error:
> >
> >> GNUTLS ERROR: The Diffie Hellman prime sent by the server is not
> >> acceptable (not long enough).
> 
> The solution may be to apply this patch:
> 
>   http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=b32735e1e275c4a2dbf544c04cdf344181fea555
> 
> Thanks,
> Ludovic.
> 
> 
> 
(Continue reading)

Simon Josefsson | 10 Jul 11:25

Re: How to correctly set Diffie Hellman prime bits?

Lennart Koopmann <lennart <at> scopeport.org> writes:

> Could you please help me with that?

Try GnuTLS 2.5.2.

/Simon

Gmane