[saag] Provenance of Diffie-Hellman groups in RFC 5114

[Tim Polk <[e-mail]>]

Folks,

The three Diffie-Hellman groups included in RFC 5114 were originally used
by NIST to create test vectors to validate implementations, nothing more,
and certainly not as a recommendation for people to use or adopt them
operationally.

    We were not at that time concerned about trap doors in test vectors
since we did not expect operational use of these groups.  For operational
use, traceability of generation is an important best practice.  After some
searching through our records and old source files, NIST cannot determine
specifically how these Diffie-Hellman domain parameters were generated,
although we think that they were generated internally at NIST.

    NIST sees no need to standardize or recommend these specific
Diffie-Hellman groups for any use other than testing.  We believe it is
important that the provenance of any critical domain parameters recommended
or required by a standard be fully explained.  Therefore it would be
appropriate for the IETF to remove or deprecate any inclusion of these
groups in an RFC.

    One final note: We suspect that these groups were included to provide
an option consistent with NIST SP 800-56A and simplify validation under
NIST's Cryptographic Module Validation Program.  However, NIST has accepted
other Diffie-Hellman groups, including several groups specified in IKE and
TLS, programmatically for some time.  Further,  an upcoming revision of
NIST SP 800-56A will formally approve the commonly-used groups specified in
IETF RFCs.  Vendors that wish to comply with IETF standards and validate
their module under CMVP can do so with the usual IETF groups.

Thanks,

Tim Polk