node web server should use DHE/ECDHE suites automatically

[j3i]

Right now you have to manually generate Diffie-Hellman parameters and define them in the config if you want to use a node's web server via TLS and not be restricted to plain RSA authentication like this:

web.port = ssl:443:privateKey=key.pem:certKey=cert.pem:dhParameters=params.pem

The DH parameters should be provided automatically and cipher suites with PFS should work out of the box.

[daira]

More recent Twisted supports ECDHE out-of-the-box, although I haven't checked whether there is anything preventing Tahoe from using it. Please check with Twisted 15.0.0 and report back whether this works now. (If you don't want to install Twisted 15 globally, you can edit the dependency in src/allmydata/_auto_deps.py to "Twisted >= 15.0.0" and rebuild.)

[daira]

To see which version of Twisted is being used by Tahoe, run tahoe --version-and-path.

[exarkun]

It is indeed supported by Twisted but you still have to generate and supply your own dh params if you want to use DHE/ECDHE.

I'm not quite sure what the workflow for having Tahoe-LAFS generate these automatically should be, though.