[Cfrg] Unknown order DH groups, e.g. as in RFC3526.

Andrey Jivsov <crypto@brainhub.org> Fri, 08 March 2019 22:43 UTC

MIME-Version: 1.0
From: Andrey Jivsov <crypto@brainhub.org>
Date: Fri, 08 Mar 2019 14:43:38 -0800
Message-ID: <CAKUk3buNuoFk0BnhqkefrGezPJiAcqkwNi35TOB_QZwEaQ8ycw@mail.gmail.com>
To: cfrg@irtf.org
Content-Type: multipart/alternative; boundary="000000000000db80ee05839cf41e"
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/zJq1Jn8lsnAGIiPckjhAec-duQU>
Subject: [Cfrg] Unknown order DH groups, e.g. as in RFC3526.
Precedence: list

Greetings.

A quick question on DH primes.

The IKE DH groups document didn't specify the group order
https://tools.ietf.org/html/rfc3526 .

This is in contrast to https://tools.ietf.org/html/rfc3526 that uses safe
primes.

Is my understanding correct that, as a general rule, these primes should
not be used, e.g. where a contributory behaviour of DH is needed? The issue
here is that a random element, received from a peer, can be in any
subgroup, possibly in a subroup with lower security than 128 bits, and
there is no way to verify this efficiently.

Thank you.

[Cfrg] Unknown order DH groups, e.g. as in RFC352… Andrey Jivsov
Re: [Cfrg] Unknown order DH groups, e.g. as in RF… Scott Fluhrer (sfluhrer)
Re: [Cfrg] Unknown order DH groups, e.g. as in RF… Andrey Jivsov
Re: [Cfrg] Unknown order DH groups, e.g. as in RF… Markku-Juhani Olavi Saarinen
Re: [Cfrg] Unknown order DH groups, e.g. as in RF… Markku-Juhani Olavi Saarinen