Re: [saag] Yet another RFC-5114 attack

[Peter Gutmann <[e-mail]>]

And another one:

  http://eprint.iacr.org/2016/999.pdf

  Indiscreet Logs: Persistent Diffie-Hellman Backdoors in TLS

  Software implementations of discrete logarithm based cryptosystems over
  finite fields typically make the assumption that any domain parameters they
  are presented with are trustworthy, i.e., the parameters implement cyclic
  groups where the discrete logarithm problem is assumed to be hard. An
  informal and widespread justification for this seemingly exists that says
  validating parameters at run time is too computationally expensive relative
  to the perceived risk of a server sabotaging the privacy of its own
  connection. In this paper we explore this trust assumption and examine
  situations where it may not always be justified.

  We conducted an investigation of discrete logarithm domain parameters in use
  across the Internet and discovered evidence of a multitude of potentially
  backdoored moduli of unknown order in TLS and STARTTLS spanning numerous
  countries, organizations, and protocols. Although our disclosures resulted
  in a number of organizations taking down suspicious parameters, we argue the
  potential for TLS backdoors is systematic and will persist until either
  until better parameter hygiene is taken up by the community, or finite field
  based cryptography is eliminated altogether.

This problem at least:

  No mechanism is provided in TLS to communicate group order

is already fixed:

  https://datatracker.ietf.org/doc/draft-gutmann-tls-lts/

Peter.