Re: [TLS] Short Ephermal Diffie-Hellman keys

[Eric Rescorla <ekr at networkresonance.com>]

At Wed, 16 May 2007 00:43:51 +0200,
Bodo Moeller wrote:
> I'd suggest stating in the TLS specification that 'q' can only be
> included in the ServerKeyExchange message for the case of prime-order
> subgroups.  These are what you'd usually use, except sometimes if the
> DH subgroup is nearly as large as 'p', which is a case where knowing
> 'q' doesn't provide significant benefits anyhow.

So, I'm no DH expert, but my understanding is that there are three
common cases:

1. Randomly generated p with no special structure
2. Sophie-Germain primes where q is about p/2.
3. DSA-style groups where q<<p.

Only in the last case does carrying around q offer much benefit.

Is this common enough that it's worth changing the spec? It was
my understanding that we mostly encouraged people to use S-G primes
in any case.

-Ekr



_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls