Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8301700 Increase the default TLS Diffie-Hellman group size from 1024-bit to 2048-bit
  3. JDK-8302171

Release Note: The Default TLS Diffie-Hellman Group Size Has Been Increased from 1024-bit to 2048-bit

XMLWordPrintable

    • Icon: Sub-task Sub-task
    • Resolution: Delivered
    • Icon: P3 P3
    • 21
    • 7u401, 8u391, 11.0.21-oracle, 17.0.9-oracle, 21
    • security-libs

        The JDK implementation of TLS 1.2 now uses a default Diffie Hellman keysize of 2048 bits when a TLS_DHE cipher suite is negotiated and either the client or server does not support FFDHE, which can negotiate a stronger keysize. The JDK TLS implementation supports FFDHE and it is enabled by default.

        As a workaround, users can revert to the previous size by setting the `jdk.tls.ephemeralDHKeySize` system property to 1024 (at their own risk).

        This change does not affect TLS 1.3 as the minimum DH group size is already 2048 bits.

              mullan Sean Mullan
              mullan Sean Mullan
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: