nginx仅使用ECDH是否要配置ssl_dhparam

nginx仅使用ECDH是否要配置ssl_dhparam?

阅读 10.7k
2 个回答

找到几篇文章,上面描述ECDH不使用DH文件:

  1. https://community.openvpn.net...
  2. https://crypto.stackexchange....

其中有段描述:
DH and ECDH are different algorithms. They are based on similar mathematical concepts, but they use completely different data. Classical or "integer" Diffie-Hellman uses a usually-smaller subgroup of the multiplicative group of integers modulo a large prime. Elliptic-curve Diffie-Hellman uses a usually-maximal subgroup of the points on an elliptic curve over an underlying field. A DH key or cert cannot be used for ECDH, and an ECDH key or cert cannot be used for DH.

而且看了DH密钥交换和ECDH原理,ECDH完全没有使用ssl_dhparam中的参数.

因此仅使用ECDH是不用配置ssl_dhparam的.

推荐配置一个2048 bit的
否则会采用OpenSSL的1024 bit

撰写回答
你尚未登录,登录后可以
  • 和开发者交流问题的细节
  • 关注并接收问题和回答的更新提醒
  • 参与内容的编辑和改进,让解决方法与时俱进
推荐问题