586643 - https://www.tescodiets.com/ uses a very weak (256-bit) Diffie-Hellman key for DHE_RSA SSL cipher suites.

Status: RESOLVED FIXED

(Tech Evangelism Graveyard :: English Other, defect)

Description

[Wan-Teh Chang]

https://www.tescodiets.com/ is an English site located in the
United Kingdom.

The server uses a very weak (256-bit) Diffie-Hellman key for
DHE_RSA SSL cipher suites.  See bug 583337 comment 25 and bug
583337 comment 30 for the original report of this problem.

To fix this server configuration problem, either
- use a 1024-bit Diffie-Hellman key for the DHE_RSA SSL cipher
  suites, or
- disable all DHE SSL cipher suites.

The latter may be easier to do.

Comment 1

[noel.mulryan]

This is no longer an issue with TescoDiets.com as DHE SSL cipher suites are now disabled on the site.

Comment 2

[Wan-Teh Chang]

noel.mulryan: thank you very much for your help.

Can you find out what SSL implementation (product
and version number) TescoDiets.com uses, and how
the 256-bit Diffie-Hellman (DH) parameters were
generated?

Since all the websites affected by bug 583337
have similar DH parameters (256 bits, with a
DH_g of 2), I suspect they all use the same SSL
implementation, or generated the DH parameters
using the same script.

This info will help us track down the source of
this problem.  Please post the info here or email
it to me and Nelson Bolyard (in the cc list).

Comment 3

[Wan-Teh Chang]

I received the info by email.  Marked the bug fixed.