Re: [TLS] ID Tracker State Update Notice: <draft-ietf-tls-negotiated-ff-dhe-08.txt>

[Andrey Jivsov <[e-mail]>]

I have a mostly editorial comment for sec 1.

The document calls the composite group with p-1 elements a "group" in 
sec 5. The document calls the the 2-element group in sec 5.1 a "small 
subgroup". The document calls the prime group with q=(p-1)/2 elements a 
"group" in sec. A.

Let's say we continue to call the q-element subset of p-1-element group 
a group, and continue to call the 2-element subset of p-1-element group 
a subgroup.

My concern is that the sec. 1 may be interpreted as that by virtue of 
using groups from this document a client avoids the issue of small 
subgroups. In reality, the main benefit of groups in this document is 
that they give us the minimal small subgroup and there is an efficient 
check for the membership in the large (sub)group. This check is 
correctly specified in sec 5.1, but it should not be skipped.

1. The sentences with two first occurrences of "subgroup", both in 
section 1, should be reworded to not suggest that this document avoids 
small subgroups.

2. One can go further and try to clear the terminology about the group 
by assuming that the
- _group_ has p-1
- _prime group_ has q
- _small subgroup_ has 2 elements.

i.e. insert "prime" in front of some "group", where appropriate.

BTW, I like the ability for the client to indicate the support for the 
DH group size.