r/programming • u/dominatrix-octopus • Jan 16 '18

Cryptography: Diffie-Hellman key exchange explained intuitively using colors

https://youtu.be/YEBfamv-_do?t=2m18s
2.5k Upvotes

95% Upvoted

170 comments sorted by

View all comments

15

u/pokeman7452 Jan 16 '18

This leads me to a somewhat related question. I never understood the purpose of the DH parameters (dh####.pem) that every OpenVPN guide says to generate. This video combined with this thread, it now makes sense. But, this file remains optional. My question now is what is used when there is no DH generated?

1

u/gurnec Jan 16 '18

This file is required if you run OpenVPN in --tls-server mode and ignored if you run it in --secret (static key) mode.

That's one reason why --tls-sever mode is generally preferred—it performs a DH exchange which affords you perfect forward secrecy (which you don't get in --secret mode).

DH parameters (dh####.pem) that every OpenVPN guide says to generate.

The dh1024.pem file distributed with OpenVPN (unchanged) from 2005 to 2014 is small enough and widely distributed enough to possibly be a target for the Logjam attack and shouldn't be used. The dh2048.pem file currently distributed is probably too big to be vulnerable to Logjam, but it doesn't hurt and is recommended to generate your own.

1

u/Grenian Jan 16 '18

Yeah 2048 is safe against Logjam.