ssl - Determine Diffie-Hellman "Parameters" Length for a TLS handshake in Java -

i'd make https connection server and, if i'm using non-ephemeral dh key exchange, i'd know parameters connection. actually, don't care if it's ephemeral or not.

what i'm looking ability make connection , warn if connection using "weak" dh parameters. can check @ connection-time? or set of dh parameters (or, more specifically, length of parameters, in bits) defined cipher suite itself?

for example, qualys community thread has illustration of cipher suites ssllabs considers "weak" (well, considers them weak... have public tool complains them): https://community.qualys.com/thread/14821

they mention e.g. tls_dhe_rsa_with_aes_256_gcm_sha384 cipher suite 0x9f , mention dh parameters. parameters' parameters baked-into cipher suite (meaning always 1024-bit) or configuration of server makes cipher suites weak due specific dh parameter choice?

in either case, i'd able sniff information connection if @ possible. know if can done, , how?

i've written code attempt information handshake, keep getting null object hoping contain data.

sslsocketfactory sf = ...; socket sock = new socket(); sock.connect(address, timeout);  sslsocket socket = (sslsocket)sf.createsocket(sock, host, port, true); socket.starthandshake(); sslsession sess = socket.gethandshakesession(); 

i hoping sess @ point contain interesting information handshake, it's null. javadoc starthandshake indicates notify event listener when handshake completed. tried this:

sslsocketfactory sf = ...; socket sock = new socket(); sock.connect(address, timeout);  sslsocket socket = (sslsocket)sf.createsocket(sock, host, port, true); socket.starthandshake(); // sslsession sess = socket.gethandshakesession(); sslsession sess = socket.getsession(); // forces handshake complete sess = socket.gethandshakesession(); 

... sess still null @ point. "real" sslsession exist , gives me information connection, "handshake session" seems null.

so tried writing handshakecompletedlistener, , in fact sslsession, appears same 1 can sslsocket already, "handshake" session seems unhelpful.

how can parameters sslsession?

are parameters' parameters baked-into cipher suite (meaning 1024-bit) or configuration of server makes cipher suites weak due specific dh parameter choice?

no, configuration parameter for protocol. there default of 1024 bits java may changed globally jsse (the java tls implementation) using system property: jdk.tls.ephemeraldhkeysize. best set during startup -d option java vm.

for static dh key pairs (that used authentication) have dh certificate. don't think you'll find any, uses rsa authentication.

in either case, i'd able sniff information connection if @ possible. know if can done, , how?

well, sniffing tools such wireshark suffice. undoubtedly can parse things dh parameters tls connection (if used in first place of course).

you can debug connections using -djavax.net.debug

for java applications / libraries cipher suite , then, if contains dhe_ aforementioned system property (keeping in mind default values).

---

the java jsse api not written deep packet inspection in mind. it's (literally) service oriented implementation servers , client applications. although of course use openjdk code (it's gpl'ed, right?) better off using separate implementation, possibly more permissive license.

for sniffer rather use c/c++ (or @ least c/c++ frontend) java.