Re: [TLS] Another IRINA bug in TLS

[Nico Williams <[e-mail]>]

On Mon, Jun 01, 2015 at 05:20:14PM -0400, Daniel Kahn Gillmor wrote:
> If we're still shipping arbitrary groups across the wire, then adding
> (q) to the data over the wire not only increases the size of the
> handshake (by the size of q) but now the receiving peer has to verify
> that:
> 
>  (a) p is prime
> 
>  (b) q itself is prime
> 
>  (c) p is actually a Lim-Lee prime
> 
> either that, or they can skip the checks and cross their fingers.
> 
> Standardizing on known safe prime moduli seems simpler and easier and
> less likely to include some steps that people will be tempted to skip
> for speed.

+1.  Pick standard groups large enough to put DLP out of reach of all
adversaries, with Moore's law in mind, with groups having a not-after
date.  As time passes these not-after dates should be revised, perhaps
periodically, to account for any improvements in DLP technology, or
slight deviations from [Moore's law's] predictions of chip transistor
count doubling times.

Nico
--