| [ << ] | [ < ] | [ Up ] | [ > ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
7.9.2 Parameter generation
Several TLS ciphersuites require additional parameters that need to be generated or provided by the application. The Diffie-Hellman based ciphersuites (ANON-DH or DHE), require the group parameters to be provided. Those can either be be generated on the fly using gnutls_dh_params_generate2 or imported from pregenerated data using gnutls_dh_params_import_pkcs3. The parameters can be used in a TLS session by calling gnutls_certificate_set_dh_params or gnutls_anon_set_server_dh_params for anonymous sessions.
- gnutls_dh_params_generate2
- gnutls_dh_params_import_pkcs3
- gnutls_certificate_set_dh_params
- gnutls_anon_set_server_dh_params
Due to the time-consuming calculations required for the generation
of Diffie-Hellman parameters we suggest against performing generation
of them within an application. The certtool tool can be used to
generate or export known safe values that can be stored in code
or in a configuration file to provide the ability to replace. We also
recommend the usage of gnutls_sec_param_to_pk_bits (see Selecting cryptographic key sizes) to determine
the bit size of the generated parameters.
The ciphersuites that involve the RSA-EXPORT key exchange require additional parameters. Those ciphersuites are rarely used today because they are by design insecure, thus if you have no requirement for them, the rest of this section can be skipped. The RSA-EXPORT key exchange requires 512-bit RSA keys to be generated. It is recommended those parameters to be refreshed (regenerated) in short intervals. The following functions can be used for these parameters.
- gnutls_rsa_params_generate2
- gnutls_certificate_set_rsa_export_params
- gnutls_rsa_params_import_pkcs1
- gnutls_rsa_params_export_pkcs1
To allow renewal of the parameters within an application without accessing the credentials, which are a shared structure, an alternative interface is available using a callback function.
| [ << ] | [ < ] | [ Up ] | [ > ] | [ >> ] | [Top] | [Contents] | [Index] | [ ? ] |
This document was generated on January 4, 2012 using texi2html 5.0.