Update: Transport_Layer_Security_Cheat_Sheet

[nmav]

What is missing or needs to be updated?

Use Strong Diffie-Hellman Parameters section: section needs to be updated with new guidance advising against generating own Diffie-Hellman parameters but instead use the protocol built-ins from RFC7919. TLS 1.3 doesn't allow using own parameters and negotiates using named supported_groups.

How should this be resolved?

Recommend against generating DH parameters as this is legacy practice with several drawbacks such as:

• The client has no say in the security of the parameters, so they can only accept them unconditionally or drop the connection
• The server cannot know the client's capability in handling groups, usually meaning that the server has to provide a small (and insecure) parameter that most clients can handle.

Configuring openssl for RFC7919 paremeters depends on the version. Refer to openssl DH config documentation.

[markgamache]

This seems like a solid plan.