Re: [Cfrg] What groups to use for Diffie Hellman?

[Phillip Hallam-Baker <[e-mail]>]

The way I got suckered into RFC5441 is that it is the only RFC that appears
to be consistent with RFC2631 on how to do DH:

https://www.ietf.org/rfc/rfc2631.txt

I see the following ways forward:

1) Update RFC2631 to say use  of a short exponent is OK, and then kill
RFC5441.

2) Do a draft consistent with RFC2631 that has rigid construction and kill
5441.

3) Both.

I don't really mind which.


As far as the rigidity issue goes, I see the following hazards to avoid:

1) An attacker is one of a small circle that knows a set of parameters to
be weak and steers the group towards them.

2) An attacker constructs a set of parameters in such a way that they
contain what is in effect a backdoor that can only be used by a party that
knows the secret of the construction.

Our current approaches to rigidity are only designed to address the second
case. There really isn't a way to address the first. It is quite possible,
likely even that fast primes also speed up attacks They might even make
whole classes of attack possible or they might not.

A process that is based on H("DH2048") for a seed might or might not result
in a choice of weak parameters but it does mean that there isn't a hidden
backdoor.

Based on my conversations with NSA folk, the governing doctrine is 'NOBUS'
nobody but us. Introducing a weakness that only the NSA could exploit with
hidden knowledge nobody else could discover independently is one thing.
Developing a system with a hole anyone can find if they look long enough is
not acceptable.