Re: [Cfrg] What groups to use for Diffie Hellman?

On 10/31/2016 6:07 AM, Peter Gutmann wrote:
> jonas weber <jonasweber86@yandex.com> writes:
>
>> Given the uncertainty over the RFC-5114 groups, I believe it would be helpful
>> to have an RFC with a list of primes as you describe. Many of us use shorter
>> exponents to save computation and having a list of verifiable primes would be
>> useful, particularly if they could be registered for use in IKE and TLS.
> I've been having a discussion about this off-list, may as well make it public
> if others are interested... the main issue is how to generate the values,
> presumably you'd want safe primes (so p = 2q + 1), g = 2 for efficiency, and
> some NUMS source for the primes.  One suggestion was PBKDF2( "DH 2048" ),
> PBKDF2( "DH 1024" ), etc as the seed value and then some deterministic way to
> get from there to the final prime.
Appendix A of FIPS 186-4 defines a method ( section A.1.2)to generate 
DSA/DH domain values from a seed using Shawe-Taylor.  I'm not sure it 
meets all of your requirements, but it may be a stepping off point.  One 
useful thing about this would be that the test harnesses already exist 
for validating an implementation provides the right answer.

Mike

>   And maybe pseudocode so anyone can
> replicate it using whatever bignum library they prefer (rather than, say,
> "plug the following formula into Mathematica").  How NUMS does it have to get?
>
> Peter.
>       
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg