[tor-bugs] #5598 [Tor Relay]: Generate DH groups asynchronously when we change TLS keys

[Tor Bug Tracker & Wiki]

#5598: Generate DH groups asynchronously when we change TLS keys
-------------------------+--------------------------------------------------
 Reporter:  rransom      |          Owner:     
     Type:  enhancement  |         Status:  new
 Priority:  major        |      Milestone:     
Component:  Tor Relay    |        Version:     
 Keywords:               |         Parent:     
   Points:               |   Actualpoints:     
-------------------------+--------------------------------------------------

Comment(by nickm):

 So my current thinking here is that this option doesn't actually help
 fingerprinting resistance or PFS much.

 I can be persuaded otherwise wrt fingerprinting if I get data that the
 mod_ssl prime is actually rare in the wild.

 With respect to the PFS case, I believe Ian: the right solution for PFS is
 a better group, not more DH groups. In 0.2.4.x, we're hoping to move to a
 better, similarly popular group (say, P256). (With Chrome's use of it, and
 recent openssl improvements, I'd be surprised if P256 is less common than
 "DH in Z_p with a randomly generated 2048-bit prime".)

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5598#comment:17>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online