[Cfrg] Question about primes of special form and the NFS

[Watson Ladd <[e-mail]>]

Dear all,
draft-gillmor-tls-negotiated-dl-dhe-00 contains primes of the form
2^{b}-2^{b-64}+k*2^64-1 for b a multiple of 64 and k small, and
recommends them as DHE groups. This is to close a security hole in TLS
in which no set of DHE parameters exists, and no one realized they
can't be validated.

This is not as bad as primes of the form 2^b-small, for which the SNFS
applies trivially. However, I am worried that some of the speedups
might still happen. It's probably not possible, but I don't know the
state of the art in this area, and would appreciate any references
dealing with extensions of SNFS to numbers that aren't that special.

Sincerely,
Watson Ladd