Skip to content
Permalink
Browse files
doc: deprecate modp1, modp2, and modp5 groups
These MODP groups should not be used by new applications, and existing
applications should attempt to migrate to stronger groups (or different
key exchange mechanisms).

Some applications still rely on these particular groups, so Node.js will
likely maintain support, directly or indirectly, for the foreseeable
future.

Refs: #44539
PR-URL: #44588
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
  • Loading branch information
tniessen authored and RafaelGSS committed Sep 26, 2022
1 parent 2d92610 commit 4ad1b0abc327b686f81c1a79999f0cb88c9a8922
Show file tree
Hide file tree
Showing 3 changed files with 29 additions and 4 deletions.
@@ -1185,15 +1185,20 @@ const dh = createDiffieHellmanGroup('modp16');

The following groups are supported:

* `'modp1'` (768 bits, [RFC 2409][] Section 6.1)
* `'modp2'` (1024 bits, [RFC 2409][] Section 6.2)
* `'modp5'` (1536 bits, [RFC 3526][] Section 2)
* `'modp14'` (2048 bits, [RFC 3526][] Section 3)
* `'modp15'` (3072 bits, [RFC 3526][] Section 4)
* `'modp16'` (4096 bits, [RFC 3526][] Section 5)
* `'modp17'` (6144 bits, [RFC 3526][] Section 6)
* `'modp18'` (8192 bits, [RFC 3526][] Section 7)

The following groups are still supported but deprecated (see [Caveats][]):

* `'modp1'` (768 bits, [RFC 2409][] Section 6.1) <span class="deprecated-inline"></span>
* `'modp2'` (1024 bits, [RFC 2409][] Section 6.2) <span class="deprecated-inline"></span>
* `'modp5'` (1536 bits, [RFC 3526][] Section 2) <span class="deprecated-inline"></span>

These deprecated groups might be removed in future versions of Node.js.

## Class: `ECDH`

<!-- YAML
@@ -3199,9 +3199,28 @@ Package imports and exports targets mapping into paths including a double slash
error in a future release. This same deprecation also applies to pattern matches
starting or ending in a slash.

### DEP0167: Weak `DiffieHellmanGroup` instances (`modp1`, `modp2`, `modp5`)

<!-- YAML
changes:
- version: REPLACEME
pr-url: https://github.com/nodejs/node/pull/44588
description: Documentation-only deprecation.
-->

Type: Documentation-only

The well-known MODP groups `modp1`, `modp2`, and `modp5` are deprecated because
they are not secure against practical attacks. See [RFC 8247 Section 2.4][] for
details.

These groups might be removed in future versions of Node.js. Applications that
rely on these groups should evaluate using stronger MODP groups instead.

[Legacy URL API]: url.md#legacy-url-api
[NIST SP 800-38D]: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
[RFC 6066]: https://tools.ietf.org/html/rfc6066#section-3
[RFC 8247 Section 2.4]: https://www.rfc-editor.org/rfc/rfc8247#section-2.4
[WHATWG URL API]: url.md#the-whatwg-url-api
[`"exports"` or `"main"` entry]: packages.md#main-entry-point-export
[`--pending-deprecation`]: cli.md#--pending-deprecation
@@ -598,7 +598,8 @@ hr {
padding-left: 5rem;
}

#toc .stability_0::after {
#toc .stability_0::after,
.deprecated-inline::after {
background-color: var(--red2);
color: var(--white);
content: "deprecated";

0 comments on commit 4ad1b0a

Please sign in to comment.