Re: [86attendees] Pie?

[Tero Kivinen <[e-mail]>]

Stephane Bortzmeyer writes:
> > If you're not already aware of this, read the Tau Manifesto 
> 
> I'm not sure it has practical consequences for the IETF. Is there even
> one RFC which uses the number Pi? ("pi" in RFC 2865 is a different
> beast)

Almost all of our security protocols doing Diffie-Hellman uses Pi. For
example RFCs 2409, 2412, 2539, 2786, 3526, 4306, 4535, 5054, 5201, and
5996. And of course all documents referencing to those RFCs.

Just using grep and searching first 32 bits of PI in hex gives that
list... 

> fgrep -li 'C90FDAA2' rfc*.txt
rfc2409.txt
rfc2412.txt
rfc2539.txt
rfc2786.txt
rfc3526.txt
rfc4306.txt
rfc4535.txt
rfc5054.txt
rfc5201.txt
rfc5683.txt
rfc5996.txt

>From 2412 you can find reason for that:

----------------------------------------------------------------------
APPENDIX E The Well-Known Groups
...
   Classical Diffie-Hellman Modular Exponentiation Groups

   The primes for groups 1 and 2 were selected to have certain
   properties.  The high order 64 bits are forced to 1.  This helps the
   classical remainder algorithm, because the trial quotient digit can
   always be taken as the high order word of the dividend, possibly +1.
   The low order 64 bits are forced to 1.  This helps the Montgomery-
   style remainder algorithms, because the multiplier digit can always
   be taken to be the low order word of the dividend.  The middle bits
   are taken from the binary expansion of pi.  This guarantees that they
   are effectively random, while avoiding any suspicion that the primes
   have secretly been selected to be weak.

   Because both primes are based on pi, there is a large section of
   overlap in the hexadecimal representations of the two primes.  The
   primes are chosen to be Sophie Germain primes (i.e., (P-1)/2 is also
   prime), to have the maximum strength against the square-root attack
   on the discrete logarithm problem.

   The starting trial numbers were repeatedly incremented by 2^64 until
   suitable primes were located.

   Because these two primes are congruent to 7 (mod 8), 2 is a quadratic
   residue of each prime.  All powers of 2 will also be quadratic
   residues.  This prevents an opponent from learning the low order bit
   of the Diffie-Hellman exponent (AKA the subgroup confinement
   problem).  Using 2 as a generator is efficient for some modular
   exponentiation algorithms.  [Note that 2 is technically not a
   generator in the number theory sense, because it omits half of the
   possible residues mod P.  From a cryptographic viewpoint, this is a
   virtue.]
-- 
[e-mail]