Re: [TLS] I-D Action: draft-ietf-tls-negotiated-ff-dhe-00.txt

[Yaron Sheffer <[e-mail]>]

On 07/25/2014 08:13 AM, Daniel Kahn Gillmor wrote:
> On 07/24/2014 10:53 AM, Peter Gutmann wrote:
>> - Why not just use the well-known and -accepted IKE groups from RFC 3526 for
>> this?  In fact why invent entirely new groups (that don't even cover the
>> existing range in RFC 3526) when there's already well-established ones
>> available?
>
> There's a possibility that a very expensive (e.g. precomputation) attack
> exists that can be mounted against any given group.  If we reuse the
> same group used by other mechanisms (e.g. ipsec) then the value for
> mounting such an expensive attack goes up.
>
> Selecting a different group forces an attacker to choose which group to
> attack.
>

Both IKE and TLS are high value enough that (choose your favorite 
3-letter acronym) would gladly spend the money to break either or both, 
if such an attack was possible. And actually the logical outcome of your 
argument is that we need 10 or 100 new named groups in TLS to minimize 
this risk. I don't think anybody is seriously considering that.

Thanks,
	Yaron