Re: [TLS] Confirming Consensus on removing RSA key Transport from TLS 1.3

[Nikos Mavrogiannopoulos <[e-mail]>]

On Tue, 2014-05-06 at 15:25 +0000, Viktor Dukhovni wrote:

> > I believe that this draft addresses the existing concerns with the DH
> > ciphersuites I'm aware of, and would be very good if the TLS WG would
> > adopt it.
> Other collections of DHE groups work in a subgroup of order "q",
> where log(q) ~ 2^{security factor}.  This speeds up the arithmetic.
> (Squares can be reduced modulo the much smaller q).

I think the speed up in that case is because the exponent x is selected
to be in the range (1,q-1). The modular reduction is again mod p.

>   Is there a
> reason to avoid those?  Problems with constant-time implementation?
> Other concerns?

This is another valid approach. Note however, that in the groups
described in the draft there is a suggested key size which speeds the
calculations similarly.

regards,
Nikos