Re: [Curdle] draft-ietf-curdle-ssh-modp-dh-sha2

[Peter Gutmann <[e-mail]>]

Salz, Rich <[e-mail]> writes:

>I think the in-room consensus was that since this is deployed and used in
>IKE, it's okay and that no work is needed.

There is one obvious counter-argument and that's diversification.  The problem
with the DH1024 group that was pointed out in the Logjam paper is that
absolutely everything ended up using it, making it an incredibly attractive
target because if you break that you break everything that uses it.  Having
everything use the 3526 groups, or similar, just moves the problem to a
slightly larger key size.  So using known-good parameter sets that differ from
what everyone else is using, and in particular IKE and SSL, which are much
large targets than SSH, wouldn't be a bad idea.

In -LTS, one of the suggestions I make is:

  If this isn't possible, an alternative option is to pre-generate a selection
  of DH parameters and choose one set at random for each new handshake, or
  again roll them over from time to time from the pre-generated selection, so
  that an attacker has to attack multiple sets of parameters rather than just
  one.

So one possibility would be to generate, say, 16 NUMS DH parameters for each
size and publish those, and have the server select one at random.  This adds
security both in terms of diversifying from the IKE/SSL values that everyone
else uses, and forcing an attacker to break all 16 parameter sets instead of
just the one.

Peter.