Re: [TLS] Short Ephermal Diffie-Hellman keys

Thanks for the correction and clarification.

Russ

At 03:47 PM 6/3/2007, Bodo Moeller wrote:
>On Sun, Jun 03, 2007 at 01:21:36PM -0400, Russ Housley wrote:
>
> >> So, I'm no DH expert, but my understanding is that there are three
> >> common cases:
> >>
> >> 1. Randomly generated p with no special structure
> >> 2. Sophie-Germain primes where q is about p/2.
> >> 3. DSA-style groups where q<<p.
>
> >> [...]                                                    It was
> >> my understanding that we mostly encouraged people to use S-G primes
> >> in any case.
>
> > I think that FIPS 140 validated modules will use 3.  And then, one
> > needs to know q to detect small subgroups.
>
>You don't really have to check that other parties' public DH keys are
>in the proper subgroup (that is, in the order-q subgroup) when using
>*single-use* DH keys yourself.  There's nothing that could be gained
>through small-subgroup attacks in this case, and thus no need to
>check.
>
>Of course, you do need q to efficiently perform DH operations in this
>setting.  Since you don't need subgroup membership tests with them,
>single-use DH keys are very practical.
>
>Bodo

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls