<div><div dir="auto">It’s not about that. Generating a 2048 DH can take a long time. And you said it’s fast and you want to make it real time. </div></div><div dir="auto"><br></div><div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div dir="auto">From official ssl doc <div><a href="http://erlang.org/doc/man/ssl.html" target="_blank">http://erlang.org/doc/man/ssl.html</a></div></div></div><div dir="auto"><br></div><div dir="auto"><dl><dt style="color:rgb(26,26,26);font-family:sans-serif"><strong><span class="m_2319303594718628936code" style="font-family:mono,Courier,monospace;font-weight:normal;background-color:rgb(243,243,243)">{dh, public_key:der_encoded()}</span></strong></dt><dd style="color:rgb(26,26,26);font-family:sans-serif"><p style="max-width:42em">The DER-encoded Diffie-Hellman parameters. If specified, it overrides option dhfile.</p></dd></dl></div><div><br><div class="gmail_quote"><div dir="ltr">пт, 24 авг. 2018 г. в 6:11, Frank Muller <<a href="mailto:frank.muller.erl@gmail.com" target="_blank">frank.muller.erl@gmail.com</a>>:<br></div></div></div><div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div dir="auto">How? Show us please!!!</div></div><div dir="auto"><br></div><div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div dir="auto">No, I can use dh option in Erlang and generate in des format DH prime and DH generator. It’s very fast.</div></div><div><br><div class="gmail_quote"><div dir="ltr">чт, 23 авг. 2018 г. в 22:07, Paul Peregud <<a href="mailto:paulperegud@gmail.com" target="_blank">paulperegud@gmail.com</a>>:<br></div></div></div><div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Its a long-ish process. But you can run it during installation or first run.<br></div><div><br></div><div>$ time openssl dhparam -out dhparam.pem 2048</div><div>...</div><div>real 0m3,623s<br>user 0m3,612s<br>sys 0m0,000s<br><br></div><br></div><br><div class="gmail_quote"><div dir="ltr">On Thu, Aug 23, 2018 at 5:27 PM Alexander Petrovsky <<a href="mailto:askjuise@gmail.com" target="_blank">askjuise@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div dir="auto">Yeah, Ingela, thanks! About default value and dh, dhfile options I know. The main question - is the any reasons don’t generate DH prime in real-time?</div></div><div><br><div class="gmail_quote"><div dir="ltr">чт, 23 авг. 2018 г. в 20:12, Ingela Andin <<a href="mailto:ingela.andin@gmail.com" target="_blank">ingela.andin@gmail.com</a>>:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi!<div><br></div><div>It is only the default value that is hard coded (a recommend value), you may configure your own parameters with dh or dhfile option. </div><div><br></div><div>Regards Ingela</div></div><br><div class="gmail_quote"></div><div class="gmail_quote"><div dir="ltr">Den tors 23 aug. 2018 kl 16:57 skrev Alexander Petrovsky <<a href="mailto:askjuise@gmail.com" target="_blank">askjuise@gmail.com</a>>:<br></div></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"></blockquote></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hello!<div><br></div><div>We have stumble upon default DH prime (2048 bits) in Erlang when we try to establish TLS session with cisco spa303 (VoIP hardphone) via TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039) cipher suite. Unfortunately, this hardphone can work only with 1024 bit DH prime.</div><div><br></div><div>I wonder, why Ingela hardcoded this DH prime - <a href="https://github.com/erlang/otp/commit/3458af579af6600870c5ada69b81085f47e9f52b" target="_blank">https://github.com/erlang/otp/commit/3458af579af6600870c5ada69b81085f47e9f52b</a></div><div><br></div><div>In my synthetical tests, new DH prime generation is fast enough (crypto:strong_rand_bytes(256)), about 17 us in 99 percentile in 1000000 iterations.</div><div><br></div><div>Why Ingela has hardcoded this DH prime and is any reason why I shouldn't generate DH prime in real-time?</div><div><div><br></div>-- <br><div dir="ltr" class="m_2319303594718628936m_-9112490322031926947m_4508002698633647460m_43618096393891447m_-1527491477448907520m_822854184577153557m_-8002316599735766552gmail_signature"><div dir="ltr"><div><div dir="ltr">Петровский Александр / Alexander Petrovsky,<br><br>Skype: askjuise<br><div>Phone: +7 931 9877991<div><br></div></div></div></div></div></div></div></div></blockquote></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
_______________________________________________<br>
erlang-questions mailing list<br>
<a href="mailto:erlang-questions@erlang.org" target="_blank">erlang-questions@erlang.org</a><br>
<a href="http://erlang.org/mailman/listinfo/erlang-questions" rel="noreferrer" target="_blank">http://erlang.org/mailman/listinfo/erlang-questions</a><br>
</blockquote></div>
</blockquote></div></div>-- <br><div dir="ltr" class="m_2319303594718628936m_-9112490322031926947m_4508002698633647460m_43618096393891447m_-1527491477448907520gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr">Петровский Александр / Alexander Petrovsky,<br><br>Skype: askjuise<br><div>Phone: +7 931 9877991<div><br></div></div></div></div></div></div>
_______________________________________________<br>
erlang-questions mailing list<br>
<a href="mailto:erlang-questions@erlang.org" target="_blank">erlang-questions@erlang.org</a><br>
<a href="http://erlang.org/mailman/listinfo/erlang-questions" rel="noreferrer" target="_blank">http://erlang.org/mailman/listinfo/erlang-questions</a><br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr" class="m_2319303594718628936m_-9112490322031926947m_4508002698633647460m_43618096393891447gmail_signature" data-smartmail="gmail_signature">Best regards,<br>Paul Peregud<br>+48602112091</div>
</blockquote></div></div>-- <br><div dir="ltr" class="m_2319303594718628936m_-9112490322031926947m_4508002698633647460gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr">Петровский Александр / Alexander Petrovsky,<br><br>Skype: askjuise<br><div>Phone: +7 931 9877991<div><br></div></div></div></div></div></div>
_______________________________________________<br>
erlang-questions mailing list<br>
<a href="mailto:erlang-questions@erlang.org" target="_blank">erlang-questions@erlang.org</a><br>
<a href="http://erlang.org/mailman/listinfo/erlang-questions" rel="noreferrer" target="_blank">http://erlang.org/mailman/listinfo/erlang-questions</a><br>
</blockquote></div></div>
</blockquote></div></div>-- <br><div dir="ltr" class="m_2319303594718628936gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr">Петровский Александр / Alexander Petrovsky,<br><br>Skype: askjuise<br><div>Phone: +7 931 9877991<div><br></div></div></div></div></div></div>
</blockquote></div></div>