Re: [TLS] STRAW POLL: Size of the Minimum FF DHE group

[Bodo Moeller <[e-mail]>]

Viktor Dukhovni <[e-mail]>:

I take it the new DHE $\mathbb{Z}^*_p$ subgroups will be cyclic
> with prime order $q$, where $q$ is a much shorter prime


Wrong, see draft-ietf-tls-negotiated-ff-dhe-02.  The new groups have prime
group order q = (p-1)/2.


Manuel Pégourié-Gonnard <[e-mail]>:

multiplication is quadratic, and the length of the exponent, which is
> roughly
> the number of multiplications, is linear in the size of the group.
>

No, because you can still use short exponents. If you're doing that,
draft-ietf-tls-negotiated-ff-dhe-02 recommends (at least) 224 bits [*] for
the exponent when using the 2432-bit modulus.

Bodo


[*] Minor editing issue: it actually says that you can use exponents in the
[2,2^224] range, but also says that you "should choose a secret key of at
least 224 bits". Since there's no discussion of leading zeros in the
document (I think), the latter could be read as requiring a [2^223, ...]
range.