node web server should use DHE/ECDHE suites automatically

[j3i]

Right now you have to manually generate Diffie-Hellman parameters and define them in the config if you want to use a node's web server via TLS and not be restricted to plain RSA authentication like this:

web.port = ssl:443:privateKey=key.pem:certKey=cert.pem:dhParameters=params.pem

The DH parameters should be provided automatically and cipher suites with PFS should work out of the box.

[daira]

More recent Twisted supports ECDHE out-of-the-box, although I haven't checked whether there is anything preventing Tahoe from using it. Please check with Twisted 15.0.0 and report back whether this works now, without the :dhParameters=params.pem. (If you don't want to install Twisted 15 globally, you can edit the dependency in src/allmydata/_auto_deps.py to "Twisted >= 15.0.0" and rebuild.)

[daira]

To see which version of Twisted is being used by Tahoe, run tahoe --version-and-path.

[exarkun]

It is indeed supported by Twisted but you still have to generate and supply your own dh params if you want to use DHE/ECDHE.

I'm not quite sure what the workflow for having Tahoe-LAFS generate these automatically should be, though.