On Sun, Sep 21, 2025 at 12:26:13PM +0200, Dmitriy Alekseev via Postfix-users wrote:
> Want to take your attention to https://www.rfc-editor.org/rfc/rfc7919 and > https://ssl-config.mozilla.org/ as it can change your view a bit on DH. > This keys are publicly available f.e. > https://ssl-config.mozilla.org/ffdhe4096.txt > > About key size, if you go above 2048, you already break some old software > so there no reason to stick to 3072, go with 4096... I disagree. There's little reason to try to push FFDHE to its limits, performance gets bad quickly. Most clients capable of stronger groups use ECDHE, those that for some reason still want FFDHE are well served by 3072-bit groups. Much of the web uses 2048-bit RSA keys, there's no reason to try to turn up security to 11 with excessive 4096 bit keys. -- Viktor. 🇺🇦 Слава Україні! _______________________________________________ Postfix-users mailing list -- postfix-users@postfix.org To unsubscribe send an email to postfix-users-le...@postfix.org
