Re: [TLS] Short Ephermal Diffie-Hellman keys

On Sun, Jun 03, 2007 at 01:21:36PM -0400, Russ Housley wrote:

>> So, I'm no DH expert, but my understanding is that there are three
>> common cases:
>> 
>> 1. Randomly generated p with no special structure
>> 2. Sophie-Germain primes where q is about p/2.
>> 3. DSA-style groups where q<<p.

>> [...]                                                    It was
>> my understanding that we mostly encouraged people to use S-G primes
>> in any case.

> I think that FIPS 140 validated modules will use 3.  And then, one 
> needs to know q to detect small subgroups.

You don't really have to check that other parties' public DH keys are
in the proper subgroup (that is, in the order-q subgroup) when using
*single-use* DH keys yourself.  There's nothing that could be gained
through small-subgroup attacks in this case, and thus no need to
check.

Of course, you do need q to efficiently perform DH operations in this
setting.  Since you don't need subgroup membership tests with them,
single-use DH keys are very practical.

Bodo

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls