Re: gnutls.c warning

[Tassilo Horn <tsdh@gnu.org>]

"Herbert J. Skuhra" <hskuhra@eumx.net> writes:

>> I keep getting this warning, and can't find any way to turn it off.
>> 
>> gnutls.c: [1] Note that the security level of the Diffie-Hellman key exchange
>> has been lowered to 256 bits and this may allow decryption of the session data

Ditto.

>> Is there some setting to say ok, I understand, quit nagging me?
>
> After setting gnutls-min-prime-bits to 1024 I no longer get this
> warning.

,----[ C-h v gnutls-min-prime-bits RET ]
| gnutls-min-prime-bits is a variable defined in `gnutls.el'.
| Its value is 1024
| Original value was 256
| 
| Documentation:
| Minimum number of prime bits accepted by GnuTLS for key exchange.
| During a Diffie-Hellman handshake, if the server sends a prime
| number with fewer than this number of bits, the handshake is
| rejected.  (The smaller the prime number, the less secure the
| key exchange is against man-in-the-middle attacks.)
| 
| A value of nil says to use the default GnuTLS value.
`----

Hm, what happens if the value is higher than what the server wants to
provide?  Connection error (fine)?  Drop to an insecured connection
(please no!)?  Or do the servers automatically increase the bit number
if a client rejects a handshake?

Bye,
Tassilo