Experti zistili ako môže NSA dešifrovať šifrovanú komunikáciu
Diskusia k článku: Experti zistili ako môže NSA dešifrovať šifrovanú komunikáciu
Prispievajte do diskusií ako
prihlásený užívateľ.
Komentár, na ktorý odpovedáte:
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Re: tamtung
Od: xvzf
|
Pridané:
2015-10-16 12:37:47
na kt. nadvazuje odpoved: "Real-world performance is big issue. On some typical HW I’m familiar with, moving from 1024-bit DHE to 2048-bit DHE is a 5x performance cost, at minimum. So at best you now get 20% of the TLS transactions-per-second that you got at 1024-bit. And that’s dedicated crypto HW, optimized for this task. Going to 4096-bit from 2048-bit is even worse.
The other issue is that there is currently no standard for negotiating Finite Field DHE key sizes, and 1024-bit is the default presumed size. If you have a client that only does 1024-bit, and the server negotiates DHE and tries to do 2048-bit – the connection will fail.
(...)
Note that ECDHE doesn’t have this problem because negotiation was built in from the start. So using ECDHE instead of DHE is a preferred real-world solution."
|
neprihlásený 