Re: gnutls.c warning

[Tassilo Horn <tsdh@gnu.org>]

"Herbert J. Skuhra" <hskuhra@eumx.net> writes:

>> When the client (Emacs) and the server negotiate to 1024, for
>> instance, everything is kosher.  They will try for the highest
>> number.
>
> Will they?
>
> With gnutls-min-prime-bits = 256:
>
> gnutls.c: [1] Note that the security level of the Diffie-Hellman key exchange
> has been lowered to 256 bits and this may allow decryption of the session data
>
> With gnutls-min-prime-bits = 512:
>
> gnutls.c: [1] Note that the security level of the Diffie-Hellman key exchange
> has been lowered to 512 bits and this may allow decryption of the session data
>  
> The warning is gone if value is >= 768 or nil.

Same here, so it looks like it's the other way round: they seem to
negotiate the lowest number of prime bits the client is willing to
accept.  Or well, possibly servers can be configured to do it that way,
cause I think I got that warning not with all IMAP servers I'm using.

Bye,
Tassilo