Increase the Secure Shell Minimum Recommended Diffie-Hellman Modulus Size to 2048 Bits
updates
- rfc-4419 — Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer Protocol
Extracted elements (13)
The document notes that the 2048-bit minimum may itself need to be increased to 3072 bits for forward-looking users, motivating the SHOULD requirements permitting 3072-bit groups to ensure implementations are prepared for future increases.
The LOGJAM research demonstrated that 768-bit DH groups can be broken and extrapolated the attack to 1024-bit groups, showing that state-sponsored actors and well-resourced organizations can break 1024-bit DH. This motivated raising the minimum from 1024 to 2048 bits.
The server should return the smallest group it knows that is larger than the size the client requested; if no such group exists, the server SHOULD return the largest group it knows. The returned group SHOULD be at least 2048 bits, retained from and updating RFC 4419.
If the server does not know a group larger than the client's requested size, the server SHOULD return the largest group it knows. This requirement is retained from RFC 4419.
In all cases, the size of the DH group SHOULD be at least 2048 bits; setting the group size to 3072 SHOULD be possible as the need may arise in coming years. This updates RFC 4419 Section 3 paragraph 11.
In all cases, the size of the returned group SHOULD be at least 2048 bits. Setting the group size to 3072 SHOULD be possible, as the need may arise in the coming years.
Operating systems SHOULD NOT log DH groups that are less than 2048 bits in size, as doing so would create an additional attack surface for Denial of Service attacks.
Servers and clients SHOULD support groups with a modulus length of k bits where 2048 <= k <= 8192. The recommended minimum values for min and max are 2048 and 8192, respectively.
SSH clients SHOULD be able to send a value of 3072 bits for the preferred acceptable group size 'n' in the SSH_MSG_KEY_DH_GEX_REQUEST message, as this need may arise in coming years.
SSH servers and SSH clients SHOULD support groups with a minimum acceptable group size of 2048 bits for the 'min' value of the SSH_MSG_KEY_DH_GEX_REQUEST client message.
SSH_MSG_KEY_DH_GEX_REQUEST is the client message used in DH Group Exchange; it carries 'min' (minimum acceptable group size), 'n' (preferred group size), and 'max' (maximum acceptable group size) in bits. The minimum acceptable 'min' value is updated to 2048 bits by this document.
A hostile or compromised SSH server implementation could use backdoored DH primes (as described in [Backdoor-DH]) to supply weakened g and p values, or could exfiltrate the calculated secret through a covert channel to a passive listener.
A malicious client could cause a Denial of Service by intentionally making multiple connections requesting DH groups smaller than 2048 bits in size; operating systems SHOULD NOT log such groups to avoid creating additional attack surface.