Re: [PATCH 2/2] virnettlscontext: Don't pass static key length to gnutls_dh_params_generate2()

On 1/4/22 12:59, Daniel P. Berrangé wrote:

We shouldn't be introducing use of gnutls_sec_param_to_pk_bits at all IMHO, rather we should be removing use of gnutls_dh_params_generate2 instead.

The recommendation is to use pre-generated DH parameters from the the FFDHE set of RFC7919.

In gnutls >= 3.6.0 this happens automatically.

In gnutls >= 3.5.6 && < 3.6.0 we can replace thegnutls_dh_params_generate2 + gnutls_certificate_set_dh_params pair of calls, with just gnutls_certificate_set_known_dh_params()

Fair enough, I don't know enough about gnutls, but let me see if I can cook a patch. Michal