ssl - 什么可能导致 "dh key too small"错误？

Question

我编写了一个使用 openssl 的程序，并将其 dockerized。

但是当我尝试使用 python:3.7 基础镜像时，出现以下错误:

[SSL: DH_KEY_TOO_SMALL] dh key too small (_ssl.c:1108)

我设法通过降低 /etc/ssl/openssl.cnf 中的安全级别来解决这个问题文件。
echo "CipherString=DEFAULT@SECLEVEL=1" >> /etc/ssl/openssl.cnf
但是这个错误到底是什么意思？

这是我无法在代码中处理的服务器端问题吗？

我只是对通过降低安全级别来解决问题感到不舒服。

更改安全级别时应该考虑什么？

谢谢 :)

Answer 1

我在 Debian wiki 上找到的最佳解释 https://wiki.debian.org/ContinuousIntegration/TriagingTips/openssl-1.1.1其中说:

In Debian the defaults are set to more secure values by default. This is done in the /etc/ssl/openssl.cnf config file. At the end of the file there is:

[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=2

This can results in errors such as:

dh key too small
ee key too small
ca md too weak

This is caused by the SECLEVEL 2 setting the security level to 112 bit. This means that RSA and DHE keys need to be at least 2048 bit long. SHA-1 is no longer supported for signatures in certificates and you need at least SHA-256. Note that CAs have stopped issuing certificates that didn't meet those requirements in January 2015, and since January 2017 all valid CA certificates should meet those requirements. However there are certificates generated by private CAs or that are in a test suite that do not meet those requirements.

SECLEVEL 1 was the default in previous versions and is at the 80 bit security level, requiring a 1024 bit RSA key.

“dh key 太简单”的问题在 https://weakdh.org/ 有详细说明
它说:

Diffie-Hellman key exchange is a popular cryptographic algorithm that allows Internet protocols to agree on a shared key and negotiate a secure connection. It is fundamental to many protocols including HTTPS, SSH, IPsec, SMTPS, and protocols that rely on TLS.

We have uncovered several weaknesses in how Diffie-Hellman key exchange has been deployed:

[..]

What Should I Do? If you run a server…

If you have a web or mail server, you should disable support for export cipher suites and use a 2048-bit Diffie-Hellman group.

该怎么办？

尽量不要改变 SECLEVEL。最好在系统范围内保持原样(SECLEVEL=2)，但尝试解决您遇到的特定连接问题。

第一步是联系您尝试通过 TLS 连接的服务的管理员，并提供上面的详细信息，以便他进行必要的更改以不再存在“弱 dh”漏洞。

如果这被证明是不可能的，或者在解决之前，只需将连接的“SSL”密码设置为 DEFAULT@SECLEVEL=1 的值。 .不幸的是，这降低了安全性，但至少它只影响这个特定的连接，而不是你的整个系统。您不需要对密码列表进行硬编码，上面的值将使事情完全像以前一样工作。

我遇到了完全相同的问题并以这种方式解决了它，因为它无法说服远程方更改其 TLS 服务器或至少使用 RSA 2048 位提供证书。