On Sun, Jun 03, 2007 at 01:21:36PM -0400, Russ Housley wrote:
>> So, I'm no DH expert, but my understanding is that there are three
>> common cases:
>>
>> 1. Randomly generated p with no special structure
>> 2. Sophie-Germain primes where q is about p/2.
>> 3. DSA-style groups where q<<p.
>> [...] It was
>> my understanding that we mostly encouraged people to use S-G primes
>> in any case.
> I think that FIPS 140 validated modules will use 3. And then, one
> needs to know q to detect small subgroups.
You don't really have to check that other parties' public DH keys are
in the proper subgroup (that is, in the order-q subgroup) when using
*single-use* DH keys yourself. There's nothing that could be gained
through small-subgroup attacks in this case, and thus no need to
check.
Of course, you do need q to efficiently perform DH operations in this
setting. Since you don't need subgroup membership tests with them,
single-use DH keys are very practical.
Bodo
