SSL/TLS: Diffie-Hellman Key Exchange Insufficient DH Group Strength Vulnerability

Question

I'm encountering an issue regarding the weak strength of the certificate key. The OVasp vulnerability scanner indicates that the Diffie-Hellman (DF) groups are weak on the service at port 444, which is a Tor relay. This service is running on an Ubuntu 22.04.4 LTS VPS server. Tor version 0.4.8.10.

Here are more details:

PORT    STATE SERVICE
444/tcp open  snpp
| ssl-enum-ciphers: 
|   TLSv1.2: 
|     ciphers: 
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_128_CCM (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CCM (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 1024) - A
|       TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (dh 1024) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A
|     compressors: 
| 
|     cipher preference error: Error when comparing TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 and TLS_DHE_RSA_WITH_AES_128_CCM
|     warnings: 
|       Key exchange (dh 1024) of lower strength than certificate key
|_  least strength: A

Nmap done: 1 IP address (1 host up) scanned in 9.82 seconds

I've been attempting to determine whether it's possible to change the DH group inside the Tor, but I haven't been able to find it anywhere. Additionally, I haven't found other people reporting this issue, so I'm unsure if it's directly related to Tor or if it's a problem elsewhere in my system configuration.

I've read the mitigation details on https://weakdh.org/sysadmin.html, but none of the services they describe in the text are related to Tor.

How can I increase this key size to mitigate the issue?

Thank you for any pointers or ideas on how to resolve this.

Answer 1

It's because of Tor's mimicry for HTTPS traffic - it lists as acceptable a list from the most ubiquitous web browser. And - sadly - it's a fact that people do not turn the weak ones off on a client side