At Wed, 16 May 2007 00:43:51 +0200,
Bodo Moeller wrote:
> I'd suggest stating in the TLS specification that 'q' can only be
> included in the ServerKeyExchange message for the case of prime-order
> subgroups. These are what you'd usually use, except sometimes if the
> DH subgroup is nearly as large as 'p', which is a case where knowing
> 'q' doesn't provide significant benefits anyhow.
So, I'm no DH expert, but my understanding is that there are three
common cases:
1. Randomly generated p with no special structure
2. Sophie-Germain primes where q is about p/2.
3. DSA-style groups where q<<p.
Only in the last case does carrying around q offer much benefit.
Is this common enough that it's worth changing the spec? It was
my understanding that we mostly encouraged people to use S-G primes
in any case.
