Re: [TLS] Negotiated Discrete Log DHE revision

There is no discrete logarithm algorithm that can take advantage of the 
fact you mention.

However, e might be a less optimal choice for another reason, namely 
that the next higher safe prime is relatively far away from the starting 
points you get when you use e this way. For instance, in the case of the 
6144 bit prime, it is more than 2^33 steps away from the starting point, 
which means it will take a lot of time to verify the correctness of 
these primes (once you found them).

On 2014-04-08 19:22, Michael D'Errico wrote:
> Also, I'm curious why "e" is chosen for constructing these primes.  Since
> the natural log of e is 1, doesn't it seem like a bad idea to stick a bunch
> of bits of e in a prime where the security is based on logarithms?
>
> Mike
>
>
>
> Michael D'Errico wrote:
>> There is already a list of DH groups managed by the IANA for IKE that was
>> established by RFC 2409 and includes the MODP groups from RFC 3526 plus
>> others.  Why not just use this existing registry and add your new e-based
>> groups to it?
>>
>> Mike
>>
>>
>>
>> Daniel Kahn Gillmor wrote:
>>> On Fri 2014-03-28 21:33:39 -0400, Daniel Kahn Gillmor
>>> <dkg@fifthhorseman.net> wrote:
>>>> I've submitted an initial stab at a proposal for negotiated discrete
>>>> log
>>>> diffie-hellman ciphersuites:
>>>>
>>>>  http://tools.ietf.org/html/draft-gillmor-tls-negotiated-dl-dhe-00
>>>
>>> Thanks to feedback from Watson Ladd and Samuel Neves over on the CFRG,
>>> i've updated the named groups in the above draft.
>>>
>>> I've also done another pass over the text:
>>>
>>>   https://tools.ietf.org/html/draft-gillmor-tls-negotiated-dl-dhe-01
>>>
>>> Comments, questions and critiques welcome.
>>>
>>>     --dkg
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>