Re: [TLS] I-D Action: draft-ietf-tls-negotiated-ff-dhe-00.txt

[Daniel Kahn Gillmor <[e-mail]>]

On 07/24/2014 10:53 AM, Peter Gutmann wrote:
> - Why not just use the well-known and -accepted IKE groups from RFC 3526 for
> this?  In fact why invent entirely new groups (that don't even cover the
> existing range in RFC 3526) when there's already well-established ones
> available?

There's a possibility that a very expensive (e.g. precomputation) attack
exists that can be mounted against any given group.  If we reuse the
same group used by other mechanisms (e.g. ipsec) then the value for
mounting such an expensive attack goes up.

Selecting a different group forces an attacker to choose which group to
attack.

> - What's the thinking behind a 2432-bit group?  2048-bit I could understand,
> 2560 bits perhaps, but 2432?

This was based on the 112-bit symmetric equivalence published by ECRYPT
II.  The ECRYPT document is referenced in the draft.

> - Publishing the values of q (rather than just telling people how to calculate
> them) would be good, since it'd provide known-correct values for them.

by q i think you mean (p-1)/2 -- i'm happy to document those values
explicitly in the draft if you think that would be useful.

Regards,

	--dkg