Re: [Curdle] draft-ietf-curdle-ssh-modp-dh-sha2

[Tero Kivinen <[e-mail]>]

Peter Gutmann writes:
> You do however need to get one or more people to actually verify them.  Until
> I asked about this a few years ago and Henrick Hellström (who probably doesn't
> work for the NSA or CIA :-) kindly obliged by running the tests, I don't know
> if anyone else had ever independently verified the values in RFC 2409 and 3526
> (someone may have, but if they did they didn't publish the fact).

I did verify the RFC 2409 primes (768, 1024, and 1536 bit groups) when
I generated the RFC3526. I do not know if anybody else has verified
the RFC3526 primes.

I did verify the RFC 7919 groups in Honolulu IETF, and there was even
typo in the draft at that point:

https://www.ietf.org/mail-archive/web/tls/current/msg15716.html

I also have page having primality proofs for the IKE and TLS groups on
my web page: https://kivinen.iki.fi/primes/

> Uhh, that's kinda missing the point, you want values that *won't* be adopted
> by everything else out there.  Unless you compartmentalised and said "these
> values are for SSH, these are for SSL, these are for IKE, these are for
> everything else".  I certainly don't want my SSH keyex to become collateral
> damage in some government agency that really just set out to break IKE, or
> VoIP, or SSL.

Actually breaking SSH is much more useful than breaking IKE or TLS.
The first time the adminstrator types sudo and his root password
inside his ssh connection, the stored SSH stream comes very valuable
for the attacker... Breaking IKE and TLS will most likely just give
some boring email text from the IETF mailing lists :-)
-- 
[e-mail]