How to set a custom DH group in Java sslengine to prevent logjam attacks?

The new logjam TLS attack is based on the common DH group This link recommends generating a new, custom 2048 bit DH group for each server

How to set a custom DH group in Java server code using sslengine?

ETA: if I only use a short DH cipher suite, i.e. DHE or ecdhe, instead of DH or ecdh, will I be safe? Or is this irrelevant?

Solution

Java (JCE / JSSE) uses some DH parameters in well known DSA groups The JCE parameter generator only allows groups with sizes between 512 and 1024 bits (or 2048), but the JSSE implementation on the other hand only accepts custom sizes between 1024 and 2048

This has some impact, you can't use any custom size, only 1024 or 2048 (using java 8) Remember, Java 7 still uses only 768 bits as the server (or 512 exportable encryption mode)

Starting from version 8, the java server uses 1024 bits by default You can use JDK tls. Ephemeraldhkeysize = 2048 increases the server side to 2048 bits See customizing size of ephemeral DH keys

Java, as a TLS client, was not strict in the old version and accepted unsafe groups

Update: using openjdk 8u65 (JSSE) has a security attribute JDK tls. server. Defaultdheparameters can define finite field parameters