Re: [TLS] Negotiated Discrete Log DHE revision

[Daniel Kahn Gillmor <[e-mail]>]

On 04/08/2014 02:07 PM, Henrick Hellström wrote:
> However, e might be a less optimal choice for another reason, namely
> that the next higher safe prime is relatively far away from the starting
> points you get when you use e this way. For instance, in the case of the
> 6144 bit prime, it is more than 2^33 steps away from the starting point,
> which means it will take a lot of time to verify the correctness of
> these primes (once you found them).

Have you done the calculations to derive the 6144-bit prime in this
series?  If so, are you willing to share your code?

I confess i don't see why the safe primes should be farther for this
construction than a similar construction with pi, but it certainly seems
to be the case.  Is there a reference that i should read to understand
this better?

	--dkg