< draft-ietf-tls-negotiated-ff-dhe-00.txt   draft-ietf-tls-negotiated-ff-dhe-01.txt >
Internet Engineering Task Force D. Gillmor Internet Engineering Task Force D. Gillmor
Internet-Draft ACLU Internet-Draft ACLU
Intended status: Informational July 22, 2014 Intended status: Informational August 27, 2014
Expires: January 23, 2015 Expires: February 28, 2015
Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for TLS Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for TLS
draft-ietf-tls-negotiated-ff-dhe-00 draft-ietf-tls-negotiated-ff-dhe-01
Abstract Abstract
Traditional finite-field-based Diffie-Hellman (DH) key exchange Traditional finite-field-based Diffie-Hellman (DH) key exchange
during the TLS handshake suffers from a number of security, during the TLS handshake suffers from a number of security,
interoperability, and efficiency shortcomings. These shortcomings interoperability, and efficiency shortcomings. These shortcomings
arise from lack of clarity about which DH group parameters TLS arise from lack of clarity about which DH group parameters TLS
servers should offer and clients should accept. This document offers servers should offer and clients should accept. This document offers
a solution to these shortcomings for compatible peers by establishing a solution to these shortcomings for compatible peers by establishing
a registry of DH parameters with known structure and a mechanism for a registry of DH parameters with known structure and a mechanism for
skipping to change at page 1, line 37 skipping to change at page 1, line 37
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on January 23, 2015. This Internet-Draft will expire on February 28, 2015.
Copyright Notice Copyright Notice
Copyright (c) 2014 IETF Trust and the persons identified as the Copyright (c) 2014 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 2, line 16 skipping to change at page 2, line 16
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3
1.2. Vocabulary . . . . . . . . . . . . . . . . . . . . . . . 3 1.2. Vocabulary . . . . . . . . . . . . . . . . . . . . . . . 3
2. Client Behavior . . . . . . . . . . . . . . . . . . . . . . . 4 2. Client Behavior . . . . . . . . . . . . . . . . . . . . . . . 4
3. Server Behavior . . . . . . . . . . . . . . . . . . . . . . . 4 3. Server Behavior . . . . . . . . . . . . . . . . . . . . . . . 4
3.1. ServerDHParams changes . . . . . . . . . . . . . . . . . 5 3.1. ServerDHParams changes . . . . . . . . . . . . . . . . . 5
4. Optimizations . . . . . . . . . . . . . . . . . . . . . . . . 6 4. Optimizations . . . . . . . . . . . . . . . . . . . . . . . . 5
4.1. Checking the Peer's Public Key . . . . . . . . . . . . . 6 4.1. Checking the Peer's Public Key . . . . . . . . . . . . . 6
4.2. Short Exponents . . . . . . . . . . . . . . . . . . . . . 6 4.2. Short Exponents . . . . . . . . . . . . . . . . . . . . . 6
4.3. Table Acceleration . . . . . . . . . . . . . . . . . . . 6 4.3. Table Acceleration . . . . . . . . . . . . . . . . . . . 6
5. Open Questions . . . . . . . . . . . . . . . . . . . . . . . 7 5. Open Questions . . . . . . . . . . . . . . . . . . . . . . . 7
5.1. Server Indication of support . . . . . . . . . . . . . . 7 5.1. Server Indication of support . . . . . . . . . . . . . . 7
5.2. Normalizing Weak Groups . . . . . . . . . . . . . . . . . 7 5.2. Normalizing Weak Groups . . . . . . . . . . . . . . . . . 7
5.3. Arbitrary Groups . . . . . . . . . . . . . . . . . . . . 7 5.3. Arbitrary Groups . . . . . . . . . . . . . . . . . . . . 7
6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 8 6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 8
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8
8. Security Considerations . . . . . . . . . . . . . . . . . . . 8 8. Security Considerations . . . . . . . . . . . . . . . . . . . 8
skipping to change at page 2, line 38 skipping to change at page 2, line 38
8.2. DHE only . . . . . . . . . . . . . . . . . . . . . . . . 9 8.2. DHE only . . . . . . . . . . . . . . . . . . . . . . . . 9
8.3. Deprecating weak groups . . . . . . . . . . . . . . . . . 9 8.3. Deprecating weak groups . . . . . . . . . . . . . . . . . 9
8.4. Choice of groups . . . . . . . . . . . . . . . . . . . . 10 8.4. Choice of groups . . . . . . . . . . . . . . . . . . . . 10
8.5. Timing attacks . . . . . . . . . . . . . . . . . . . . . 10 8.5. Timing attacks . . . . . . . . . . . . . . . . . . . . . 10
8.6. Replay attacks from non-negotiated FF DHE . . . . . . . . 10 8.6. Replay attacks from non-negotiated FF DHE . . . . . . . . 10
9. Privacy Considerations . . . . . . . . . . . . . . . . . . . 11 9. Privacy Considerations . . . . . . . . . . . . . . . . . . . 11
9.1. Client fingerprinting . . . . . . . . . . . . . . . . . . 11 9.1. Client fingerprinting . . . . . . . . . . . . . . . . . . 11
10. References . . . . . . . . . . . . . . . . . . . . . . . . . 11 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 11
10.1. Normative References . . . . . . . . . . . . . . . . . . 11 10.1. Normative References . . . . . . . . . . . . . . . . . . 11
10.2. Informative References . . . . . . . . . . . . . . . . . 11 10.2. Informative References . . . . . . . . . . . . . . . . . 11
Appendix A. Named Group Registry . . . . . . . . . . . . . . . . 12 Appendix A. Named Group Registry . . . . . . . . . . . . . . . . 13
A.1. ffdhe2432 . . . . . . . . . . . . . . . . . . . . . . . . 13 A.1. ffdhe2432 . . . . . . . . . . . . . . . . . . . . . . . . 13
A.2. ffdhe3072 . . . . . . . . . . . . . . . . . . . . . . . . 13 A.2. ffdhe3072 . . . . . . . . . . . . . . . . . . . . . . . . 14
A.3. ffdhe4096 . . . . . . . . . . . . . . . . . . . . . . . . 14 A.3. ffdhe4096 . . . . . . . . . . . . . . . . . . . . . . . . 16
A.4. ffdhe6144 . . . . . . . . . . . . . . . . . . . . . . . . 15 A.4. ffdhe6144 . . . . . . . . . . . . . . . . . . . . . . . . 17
A.5. ffdhe8192 . . . . . . . . . . . . . . . . . . . . . . . . 17 A.5. ffdhe8192 . . . . . . . . . . . . . . . . . . . . . . . . 19
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 19 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 22
1. Introduction 1. Introduction
Traditional TLS [RFC5246] offers a Diffie-Hellman ephemeral (DHE) key Traditional TLS [RFC5246] offers a Diffie-Hellman ephemeral (DHE) key
exchange mode which provides Perfect Forward Secrecy for the exchange mode which provides Perfect Forward Secrecy for the
connection. The client offers a ciphersuite in the ClientHello that connection. The client offers a ciphersuite in the ClientHello that
includes DHE, and the server offers the client group parameters g and includes DHE, and the server offers the client group parameters g and
p. If the client does not consider the group strong enough (e.g. if p. If the client does not consider the group strong enough (e.g. if
p is too small, or if p is not prime, or there are small subgroups), p is too small, or if p is not prime, or there are small subgroups),
or if it is unable to process it for other reasons, it has no or if it is unable to process it for other reasons, it has no
recourse but to terminate the connection. recourse but to terminate the connection.
Conversely, when a TLS server receives a suggestion for a DHE Conversely, when a TLS server receives a suggestion for a DHE
ciphersuite from a client, it has no way of knowing what kinds of DH ciphersuite from a client, it has no way of knowing what kinds of DH
groups the client is capable of handling, or what the client's groups the client is capable of handling, or what the client's
security requirements are for this key exchange session. Some security requirements are for this key exchange session. Some
widely-distributed TLS clients are not capable of DH groups where p > widely-distributed TLS clients are not capable of DH groups where p >
1024. Other TLS clients may by policy wish to use DHE only if the 1024. Other TLS clients may by policy wish to use DHE only if the
server can offer a stronger group (and are willing to use a non-PFS server can offer a stronger group (and are willing to use a non-PFS
key-exchange mechanism otherwise). The server has no way of knowing key-exchange mechanism otherwise). The server has no way of knowing
which type of client is connecting, but must select DHE parameters which type of client is connecting, but must select DH parameters
with insufficient knowledge. with insufficient knowledge.
Additionally, the DH parameters chosen by the server may have a known Additionally, the DH parameters chosen by the server may have a known
structure which renders them secure against small subgroup attack, structure which renders them secure against a small subgroup attack,
but a client receiving an arbitrary p has no efficient way to verify but a client receiving an arbitrary p has no efficient way to verify
that the structure of a new group is reasonable for use. that the structure of a new group is reasonable for use.
This extension solves these problems with a registry of groups of This extension solves these problems with a registry of groups of
known reasonable structure, an extension for clients to advertise known reasonable structure, an extension for clients to advertise
support for them and servers to select them, and guidance for support for them and servers to select them, and guidance for
compliant peers to take advantage of the additional security, compliant peers to take advantage of the additional security,
availability, and efficiency offered. availability, and efficiency offered.
The use of this extension by one compliant peer when interacting with The use of this extension by one compliant peer when interacting with
skipping to change at page 3, line 44 skipping to change at page 3, line 44
1.1. Requirements Language 1.1. Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119]. document are to be interpreted as described in [RFC2119].
1.2. Vocabulary 1.2. Vocabulary
The term "DHE" is used in this document to refer to the finite-field- The term "DHE" is used in this document to refer to the finite-field-
based Diffie-Hellman ephemeral key exchange mechanism in TLS. TLS based Diffie-Hellman ephemeral key exchange mechanism in TLS. TLS
also supports elliptic-curve-based Diffie Hellman ephemeral key also supports elliptic-curve-based Diffie-Hellman (ECDHE) ephemeral
exchanges, but this document does not discuss their use. Mentions of key exchanges, but this document does not discuss their use.
DHE here refer strictly to finite-field-based DHE, and not to ECDHE. Mentions of DHE here refer strictly to finite-field-based DHE, and
not to ECDHE.
2. Client Behavior 2. Client Behavior
A TLS client that is capable of using strong finite field Diffie- A TLS client that is capable of using strong finite field Diffie-
Hellman groups can advertise its capabilities and its preferences for Hellman groups can advertise its capabilities and its preferences for
stronger key exchange by using this mechanism. stronger key exchange by using this mechanism.
The client SHOULD send an extension of type The client SHOULD send an extension of type
"negotiated_ff_dhe_groups" in the ClientHello, indicating a list of "negotiated_ff_dhe_groups" in the ClientHello, indicating a list of
known finite field Diffie-Hellman groups, ordered from most preferred known finite field Diffie-Hellman groups, ordered from most preferred
skipping to change at page 4, line 38 skipping to change at page 4, line 38
A client that offers this extension SHOULD include at least one DHE- A client that offers this extension SHOULD include at least one DHE-
key-exchange ciphersuite in the Client Hello. key-exchange ciphersuite in the Client Hello.
The known groups defined by the FiniteFieldDHEGroup registry are The known groups defined by the FiniteFieldDHEGroup registry are
listed in Appendix A. These are all safe primes derived from the listed in Appendix A. These are all safe primes derived from the
base of the natural logarithm ("e"), with the high and low 64 bits base of the natural logarithm ("e"), with the high and low 64 bits
set to 1 for efficient Montgomery or Barrett reduction. set to 1 for efficient Montgomery or Barrett reduction.
The use of the base of the natural logarithm here is as a "nothing- The use of the base of the natural logarithm here is as a "nothing-
up-my-sleeve" number. The goal is to guarantee that the bits in the up-my-sleeve" number. The goal is to guarantee that the bits in the
middle of the modulus that they are effectively random, while middle of the modulus are effectively random, while avoiding any
avoiding any suspicion that the primes have secretly been selected to suspicion that the primes have secretly been selected to be weak
be weak according to some secret criteria. [RFC3526] used pi for according to some secret criteria. [RFC3526] used pi for this value.
this value. See Section 8.4 for reasons that this draft does not See Section 8.4 for reasons that this draft does not reuse pi.
reuse pi.
A client who offers a group MUST be able and willing to perform a DH A client who offers a group MUST be able and willing to perform a DH
key exchange using that group. key exchange using that group.
3. Server Behavior 3. Server Behavior
A TLS server MUST NOT send the NegotiatedDHParams extension to a A TLS server MUST NOT send the NegotiatedDHParams extension to a
client that does not offer it first. client that does not offer it first.
A compatible TLS server that receives this extension from a client A compatible TLS server that receives this extension from a client
skipping to change at page 6, line 21 skipping to change at page 6, line 16
4.1. Checking the Peer's Public Key 4.1. Checking the Peer's Public Key
Peers should validate the each other's public key Y (dh_Ys offered by Peers should validate the each other's public key Y (dh_Ys offered by
the server or DH_Yc offered by the client) by ensuring that 1 < Y < the server or DH_Yc offered by the client) by ensuring that 1 < Y <
p-1. This simple check ensures that the remote peer is properly p-1. This simple check ensures that the remote peer is properly
behaved and isn't forcing the local system into a small subgroup. behaved and isn't forcing the local system into a small subgroup.
To reach the same assurance with an unknown group, the client would To reach the same assurance with an unknown group, the client would
need to verify the primality of the modulus, learn the factors of need to verify the primality of the modulus, learn the factors of
p-1, and test Y against each factor. p-1, and test both the generator g and Y against each factor to avoid
small subgroup attacks.
4.2. Short Exponents 4.2. Short Exponents
Traditional Finite Field Diffie-Hellman has each peer choose their Traditional Finite Field Diffie-Hellman has each peer choose their
secret exponent from the range [2,p-2]. Using exponentiation by secret exponent from the range [2,p-2]. Using exponentiation by
squaring, this means each peer must do roughly 2*log_2(p) squaring, this means each peer must do roughly 2*log_2(p)
multiplications, twice (once for the generator and once for the multiplications, twice (once for the generator and once for the
peer's public key). peer's public key).
Peers concerned with performance may also prefer to choose their Peers concerned with performance may also prefer to choose their
skipping to change at page 8, line 9 skipping to change at page 8, line 9
reducing the incentive for precomputation-driven attacks on any reducing the incentive for precomputation-driven attacks on any
specific group (e.g. section 1 of [RFC4419]). However, arbitrary specific group (e.g. section 1 of [RFC4419]). However, arbitrary
large groups are expensive to transmit over the network and it is large groups are expensive to transmit over the network and it is
computationally infeasible for the client to verify their structure computationally infeasible for the client to verify their structure
during a key exchange. If we instead allow the server to propose during a key exchange. If we instead allow the server to propose
arbitrary groups, we could make it a MUST that the generated groups arbitrary groups, we could make it a MUST that the generated groups
use safe prime moduli, while still allowing clients to signal support use safe prime moduli, while still allowing clients to signal support
(and desire) for large groups. This leaves the client in the (and desire) for large groups. This leaves the client in the
position of relying on the server to choose a strong modulus, though. position of relying on the server to choose a strong modulus, though.
Note that in at least one known attack against TLS Note that in several known attacks against TLS and SSL
[SECURE-RESUMPTION], a malicious server uses a deliberately broken [SECURE-RESUMPTION] [CROSS-PROTOCOL] [SSL3-ANALYSIS], a malicious
finite field DHE group to impersonate the client to a different server uses a deliberately broken finite field DHE group to
server. impersonate the client to a different server.
6. Acknowledgements 6. Acknowledgements
Thanks to Fedor Brunner, Dave Fergemann, Sandy Harris, Watson Ladd, Thanks to Fedor Brunner, Dave Fergemann, Sandy Harris, Watson Ladd,
Nikos Mavrogiannopolous, Niels Moeller, Kenny Paterson, and Tom Nikos Mavrogiannopolous, Niels Moeller, Kenny Paterson, and Tom
Ritter for their comments and suggestions on this draft. Any Ritter for their comments and suggestions on this draft. Any
mistakes here are not theirs. mistakes here are not theirs.
7. IANA Considerations 7. IANA Considerations
skipping to change at page 11, line 35 skipping to change at page 11, line 35
10. References 10. References
10.1. Normative References 10.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997. Requirement Levels", BCP 14, RFC 2119, March 1997.
10.2. Informative References 10.2. Informative References
[CROSS-PROTOCOL]
Mavrogiannopolous, N., Vercauteren, F., Velichkov, V., and
B. Preneel, "A Cross-Protocol Attack on the TLS Protocol",
October 2012,
<http://www.cosic.esat.kuleuven.be/publications/
article-2216.pdf>.
[ECRYPTII] [ECRYPTII]
European Network of Excellence in Cryptology II, "ECRYPT European Network of Excellence in Cryptology II, "ECRYPT
II Yearly Report on Algorithms and Keysizes (2011-2012)", II Yearly Report on Algorithms and Keysizes (2011-2012)",
September 2012, September 2012,
<http://www.ecrypt.eu.org/documents/D.SPA.20.pdf>. <http://www.ecrypt.eu.org/documents/D.SPA.20.pdf>.
[ENISA] European Union Agency for Network and Information Security [ENISA] European Union Agency for Network and Information Security
Agency, "Algorithms, Key Sizes and Parameters Report, Agency, "Algorithms, Key Sizes and Parameters Report,
version 1.0", October 2013, version 1.0", October 2013,
<http://www.enisa.europa.eu/activities/identity-and- <http://www.enisa.europa.eu/activities/identity-and-
skipping to change at page 12, line 33 skipping to change at page 12, line 45
Authentication over TLS", March 2014, <https://secure- Authentication over TLS", March 2014, <https://secure-
resumption.com/>. resumption.com/>.
[SESSION-HASH] [SESSION-HASH]
Bhargavan, K., Delignat-Lavaud, A., Pironti, A., Langley, Bhargavan, K., Delignat-Lavaud, A., Pironti, A., Langley,
A., and M. Ray, "Triple Handshakes Considered Harmful: A., and M. Ray, "Triple Handshakes Considered Harmful:
Breaking and Fixing Authentication over TLS", March 2014, Breaking and Fixing Authentication over TLS", March 2014,
<https://secure-resumption.com/draft-bhargavan-tls- <https://secure-resumption.com/draft-bhargavan-tls-
session-hash-00.txt>. session-hash-00.txt>.
[SSL3-ANALYSIS]
Schneier, B. and D. Wagner, "Analysis of the SSL 3.0
protocol", 1996, <https://www.schneier.com/paper-ssl.pdf>.
[STRONGSWAN-IKE] [STRONGSWAN-IKE]
Brunner, T. and A. Steffen, "Diffie Hellman Groups in Brunner, T. and A. Steffen, "Diffie Hellman Groups in
IKEv2 Cipher Suites", October 2013, IKEv2 Cipher Suites", October 2013,
<https://wiki.strongswan.org/projects/strongswan/wiki/ <https://wiki.strongswan.org/projects/strongswan/wiki/
IKEv2CipherSuites#Diffie-Hellman-Groups>. IKEv2CipherSuites#Diffie-Hellman-Groups>.
Appendix A. Named Group Registry Appendix A. Named Group Registry
The primes in these finite field groups are all safe primes, that is, The primes in these finite field groups are all safe primes, that is,
a prime p is a safe prime when q = (p-1)/2 is also prime. Where e is a prime p is a safe prime when q = (p-1)/2 is also prime. Where e is
skipping to change at page 13, line 15 skipping to change at page 13, line 35
derived. derived.
A.1. ffdhe2432 A.1. ffdhe2432
The 2432-bit group has registry value 0, and is calcluated from the The 2432-bit group has registry value 0, and is calcluated from the
following formula: following formula:
The modulus is: p = 2^2432 - 2^2368 + {[2^2302 * e] + 2111044} * 2^64 The modulus is: p = 2^2432 - 2^2368 + {[2^2302 * e] + 2111044} * 2^64
- 1 - 1
Its hexadecimal representation is: The hexadecimal representation of p is:
FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1 FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1
D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9 D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9
7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561 7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561
2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935 2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935
984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735 984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735
30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB 30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB
B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19 B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19
0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61 0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61
9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73 9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73
3BB5FCBC 2EC22005 C58EF183 7D1683B2 C6F34A26 C1B2EFFA 3BB5FCBC 2EC22005 C58EF183 7D1683B2 C6F34A26 C1B2EFFA
886B4238 611FCFDC DE355B3B 6519035B BC34F4DE F99C0238 886B4238 611FCFDC DE355B3B 6519035B BC34F4DE F99C0238
61B46FC9 D6E6C907 7AD91D26 91F7F7EE 598CB0FA C186D91C 61B46FC9 D6E6C907 7AD91D26 91F7F7EE 598CB0FA C186D91C
AEFE1309 8533C8B3 FFFFFFFF FFFFFFFF AEFE1309 8533C8B3 FFFFFFFF FFFFFFFF
The generator is: g = 2 The generator is: g = 2
The group size is: q = (p-1)/2
The group size is (p-1)/2 The hexadecimal representation of q is:
7FFFFFFF FFFFFFFF D6FC2A2C 515DA54D 57EE2B10 139E9E78
EC5CE2C1 E7169B4A D4F09B20 8A3219FD E649CEE7 124D9F7C
BE97F1B1 B1863AEC 7B40D901 576230BD 69EF8F6A EAFEB2B0
9219FA8F AF833768 42B1B2AA 9EF68D79 DAAB89AF 3FABE49A
CC278638 707345BB F15344ED 79F7F439 0EF8AC50 9B56F39A
98566527 A41D3CBD 5E0558C1 59927DB0 E88454A5 D96471FD
DCB56D5B B06BFA34 0EA7A151 EF1CA6FA 572B76F3 B1B95D8C
8583D3E4 770536B8 4F017E70 E6FBF176 601A0266 941A17B0
C8B97F4E 74C2C1FF C7278919 777940C1 E1FF1D8D A637D6B9
9DDAFE5E 17611002 E2C778C1 BE8B41D9 6379A513 60D977FD
4435A11C 308FE7EE 6F1AAD9D B28C81AD DE1A7A6F 7CCE011C
30DA37E4 EB736483 BD6C8E93 48FBFBF7 2CC6587D 60C36C8E
577F0984 C299E459 FFFFFFFF FFFFFFFF
The estimated symmetric-equivalent strength of this group is 112 The estimated symmetric-equivalent strength of this group is 112
bits. bits.
Peers using ffdhe2432 that want to optimize their key exchange with a Peers using ffdhe2432 that want to optimize their key exchange with a
short exponent (Section 4.2) should choose a secret key of at least short exponent (Section 4.2) should choose a secret key of at least
224 bits. 224 bits.
A.2. ffdhe3072 A.2. ffdhe3072
The 3072-bit prime has registry value 1, and is calcluated from the The 3072-bit prime has registry value 1, and is calcluated from the
following formula: following formula:
p = 2^3072 - 2^3008 + {[2^2942 * e] + 2625351} * 2^64 -1 p = 2^3072 - 2^3008 + {[2^2942 * e] + 2625351} * 2^64 -1
Its hexadecimal representation is: The hexadecimal representation of p is:
FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1 FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1
D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9 D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9
7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561 7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561
2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935 2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935
984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735 984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735
30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB 30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB
B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19 B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19
0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61 0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61
9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73 9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73
3BB5FCBC 2EC22005 C58EF183 7D1683B2 C6F34A26 C1B2EFFA 3BB5FCBC 2EC22005 C58EF183 7D1683B2 C6F34A26 C1B2EFFA
886B4238 611FCFDC DE355B3B 6519035B BC34F4DE F99C0238 886B4238 611FCFDC DE355B3B 6519035B BC34F4DE F99C0238
61B46FC9 D6E6C907 7AD91D26 91F7F7EE 598CB0FA C186D91C 61B46FC9 D6E6C907 7AD91D26 91F7F7EE 598CB0FA C186D91C
AEFE1309 85139270 B4130C93 BC437944 F4FD4452 E2D74DD3 AEFE1309 85139270 B4130C93 BC437944 F4FD4452 E2D74DD3
64F2E21E 71F54BFF 5CAE82AB 9C9DF69E E86D2BC5 22363A0D 64F2E21E 71F54BFF 5CAE82AB 9C9DF69E E86D2BC5 22363A0D
ABC52197 9B0DEADA 1DBF9A42 D5C4484E 0ABCD06B FA53DDEF ABC52197 9B0DEADA 1DBF9A42 D5C4484E 0ABCD06B FA53DDEF
3C1B20EE 3FD59D7C 25E41D2B 66C62E37 FFFFFFFF FFFFFFFF 3C1B20EE 3FD59D7C 25E41D2B 66C62E37 FFFFFFFF FFFFFFFF
The generator is: g = 2 The generator is: g = 2
The group size is: (p-1)/2 The group size is: q = (p-1)/2
The hexadecimal representation of q is:
7FFFFFFF FFFFFFFF D6FC2A2C 515DA54D 57EE2B10 139E9E78
EC5CE2C1 E7169B4A D4F09B20 8A3219FD E649CEE7 124D9F7C
BE97F1B1 B1863AEC 7B40D901 576230BD 69EF8F6A EAFEB2B0
9219FA8F AF833768 42B1B2AA 9EF68D79 DAAB89AF 3FABE49A
CC278638 707345BB F15344ED 79F7F439 0EF8AC50 9B56F39A
98566527 A41D3CBD 5E0558C1 59927DB0 E88454A5 D96471FD
DCB56D5B B06BFA34 0EA7A151 EF1CA6FA 572B76F3 B1B95D8C
8583D3E4 770536B8 4F017E70 E6FBF176 601A0266 941A17B0
C8B97F4E 74C2C1FF C7278919 777940C1 E1FF1D8D A637D6B9
9DDAFE5E 17611002 E2C778C1 BE8B41D9 6379A513 60D977FD
4435A11C 308FE7EE 6F1AAD9D B28C81AD DE1A7A6F 7CCE011C
30DA37E4 EB736483 BD6C8E93 48FBFBF7 2CC6587D 60C36C8E
577F0984 C289C938 5A098649 DE21BCA2 7A7EA229 716BA6E9
B279710F 38FAA5FF AE574155 CE4EFB4F 743695E2 911B1D06
D5E290CB CD86F56D 0EDFCD21 6AE22427 055E6835 FD29EEF7
9E0D9077 1FEACEBE 12F20E95 B363171B FFFFFFFF FFFFFFFF
The estimated symmetric-equivalent strength of this group is 125 The estimated symmetric-equivalent strength of this group is 125
bits. bits.
Peers using ffdhe3072 that want to optimize their key exchange with a Peers using ffdhe3072 that want to optimize their key exchange with a
short exponent (Section 4.2) should choose a secret key of at least short exponent (Section 4.2) should choose a secret key of at least
250 bits. 250 bits.
A.3. ffdhe4096 A.3. ffdhe4096
The 4096-bit group has registry value 2, and is calcluated from the The 4096-bit group has registry value 2, and is calcluated from the
following formula: following formula:
The modulus is: p = 2^4096 - 2^4032 + {[2^3966 * e] + 5736041} * 2^64 The modulus is: p = 2^4096 - 2^4032 + {[2^3966 * e] + 5736041} * 2^64
- 1 - 1
Its hexadecimal representation is: The hexadecimal representation of p is:
FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1 FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1
D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9 D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9
7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561 7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561
2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935 2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935
984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735 984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735
30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB 30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB
B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19 B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19
0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61 0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61
9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73 9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73
skipping to change at page 15, line 28 skipping to change at page 16, line 38
64F2E21E 71F54BFF 5CAE82AB 9C9DF69E E86D2BC5 22363A0D 64F2E21E 71F54BFF 5CAE82AB 9C9DF69E E86D2BC5 22363A0D
ABC52197 9B0DEADA 1DBF9A42 D5C4484E 0ABCD06B FA53DDEF ABC52197 9B0DEADA 1DBF9A42 D5C4484E 0ABCD06B FA53DDEF
3C1B20EE 3FD59D7C 25E41D2B 669E1EF1 6E6F52C3 164DF4FB 3C1B20EE 3FD59D7C 25E41D2B 669E1EF1 6E6F52C3 164DF4FB
7930E9E4 E58857B6 AC7D5F42 D69F6D18 7763CF1D 55034004 7930E9E4 E58857B6 AC7D5F42 D69F6D18 7763CF1D 55034004
87F55BA5 7E31CC7A 7135C886 EFB4318A ED6A1E01 2D9E6832 87F55BA5 7E31CC7A 7135C886 EFB4318A ED6A1E01 2D9E6832
A907600A 918130C4 6DC778F9 71AD0038 092999A3 33CB8B7A A907600A 918130C4 6DC778F9 71AD0038 092999A3 33CB8B7A
1A1DB93D 7140003C 2A4ECEA9 F98D0ACC 0A8291CD CEC97DCF 1A1DB93D 7140003C 2A4ECEA9 F98D0ACC 0A8291CD CEC97DCF
8EC9B55A 7F88A46B 4DB5A851 F44182E1 C68A007E 5E655F6A 8EC9B55A 7F88A46B 4DB5A851 F44182E1 C68A007E 5E655F6A
FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
The base is: g = 2 The generator is: g = 2
The group size is: (p-1)/2 The group size is: q = (p-1)/2
The hexadecimal representation of q is:
7FFFFFFF FFFFFFFF D6FC2A2C 515DA54D 57EE2B10 139E9E78
EC5CE2C1 E7169B4A D4F09B20 8A3219FD E649CEE7 124D9F7C
BE97F1B1 B1863AEC 7B40D901 576230BD 69EF8F6A EAFEB2B0
9219FA8F AF833768 42B1B2AA 9EF68D79 DAAB89AF 3FABE49A
CC278638 707345BB F15344ED 79F7F439 0EF8AC50 9B56F39A
98566527 A41D3CBD 5E0558C1 59927DB0 E88454A5 D96471FD
DCB56D5B B06BFA34 0EA7A151 EF1CA6FA 572B76F3 B1B95D8C
8583D3E4 770536B8 4F017E70 E6FBF176 601A0266 941A17B0
C8B97F4E 74C2C1FF C7278919 777940C1 E1FF1D8D A637D6B9
9DDAFE5E 17611002 E2C778C1 BE8B41D9 6379A513 60D977FD
4435A11C 308FE7EE 6F1AAD9D B28C81AD DE1A7A6F 7CCE011C
30DA37E4 EB736483 BD6C8E93 48FBFBF7 2CC6587D 60C36C8E
577F0984 C289C938 5A098649 DE21BCA2 7A7EA229 716BA6E9
B279710F 38FAA5FF AE574155 CE4EFB4F 743695E2 911B1D06
D5E290CB CD86F56D 0EDFCD21 6AE22427 055E6835 FD29EEF7
9E0D9077 1FEACEBE 12F20E95 B34F0F78 B737A961 8B26FA7D
BC9874F2 72C42BDB 563EAFA1 6B4FB68C 3BB1E78E AA81A002
43FAADD2 BF18E63D 389AE443 77DA18C5 76B50F00 96CF3419
5483B005 48C09862 36E3BC7C B8D6801C 0494CCD1 99E5C5BD
0D0EDC9E B8A0001E 15276754 FCC68566 054148E6 E764BEE7
C764DAAD 3FC45235 A6DAD428 FA20C170 E345003F 2F32AFB5
7FFFFFFF FFFFFFFF
The estimated symmetric-equivalent strength of this group is 150 The estimated symmetric-equivalent strength of this group is 150
bits. bits.
Peers using ffdhe4096 that want to optimize their key exchange with a Peers using ffdhe4096 that want to optimize their key exchange with a
short exponent (Section 4.2) should choose a secret key of at least short exponent (Section 4.2) should choose a secret key of at least
300 bits. 300 bits.
A.4. ffdhe6144 A.4. ffdhe6144
The 6144-bit group has registry value 3, and is calcluated from the The 6144-bit group has registry value 3, and is calcluated from the
following formula: following formula:
The modulus is: p = 2^6144 - 2^6080 + {[2^6014 * e] + 15705020} * The modulus is: p = 2^6144 - 2^6080 + {[2^6014 * e] + 15705020} *
2^64 - 1 2^64 - 1
Its hexadecimal representation is: The hexadecimal representation of p is:
FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1 FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1
D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9 D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9
7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561 7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561
2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935 2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935
984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735 984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735
30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB 30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB
B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19 B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19
0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61 0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61
9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73 9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73
skipping to change at page 16, line 38 skipping to change at page 18, line 38
CDAD0657 FCCFEC71 9B1F5C3E 4E46041F 388147FB 4CFDB477 CDAD0657 FCCFEC71 9B1F5C3E 4E46041F 388147FB 4CFDB477
A52471F7 A9A96910 B855322E DB6340D8 A00EF092 350511E3 A52471F7 A9A96910 B855322E DB6340D8 A00EF092 350511E3
0ABEC1FF F9E3A26E 7FB29F8C 183023C3 587E38DA 0077D9B4 0ABEC1FF F9E3A26E 7FB29F8C 183023C3 587E38DA 0077D9B4
763E4E4B 94B2BBC1 94C6651E 77CAF992 EEAAC023 2A281BF6 763E4E4B 94B2BBC1 94C6651E 77CAF992 EEAAC023 2A281BF6
B3A739C1 22611682 0AE8DB58 47A67CBE F9C9091B 462D538C B3A739C1 22611682 0AE8DB58 47A67CBE F9C9091B 462D538C
D72B0374 6AE77F5E 62292C31 1562A846 505DC82D B854338A D72B0374 6AE77F5E 62292C31 1562A846 505DC82D B854338A
E49F5235 C95B9117 8CCF2DD5 CACEF403 EC9D1810 C6272B04 E49F5235 C95B9117 8CCF2DD5 CACEF403 EC9D1810 C6272B04
5B3B71F9 DC6B80D6 3FDD4A8E 9ADB1E69 62A69526 D43161C1 5B3B71F9 DC6B80D6 3FDD4A8E 9ADB1E69 62A69526 D43161C1
A41D570D 7938DAD4 A40E329C D0E40E65 FFFFFFFF FFFFFFFF A41D570D 7938DAD4 A40E329C D0E40E65 FFFFFFFF FFFFFFFF
The generator is: 2 The generator is: g = 2
The group size is: (p-1)/2 The group size is: q = (p-1)/2
The hexadecimal representation of q is:
7FFFFFFF FFFFFFFF D6FC2A2C 515DA54D 57EE2B10 139E9E78
EC5CE2C1 E7169B4A D4F09B20 8A3219FD E649CEE7 124D9F7C
BE97F1B1 B1863AEC 7B40D901 576230BD 69EF8F6A EAFEB2B0
9219FA8F AF833768 42B1B2AA 9EF68D79 DAAB89AF 3FABE49A
CC278638 707345BB F15344ED 79F7F439 0EF8AC50 9B56F39A
98566527 A41D3CBD 5E0558C1 59927DB0 E88454A5 D96471FD
DCB56D5B B06BFA34 0EA7A151 EF1CA6FA 572B76F3 B1B95D8C
8583D3E4 770536B8 4F017E70 E6FBF176 601A0266 941A17B0
C8B97F4E 74C2C1FF C7278919 777940C1 E1FF1D8D A637D6B9
9DDAFE5E 17611002 E2C778C1 BE8B41D9 6379A513 60D977FD
4435A11C 308FE7EE 6F1AAD9D B28C81AD DE1A7A6F 7CCE011C
30DA37E4 EB736483 BD6C8E93 48FBFBF7 2CC6587D 60C36C8E
577F0984 C289C938 5A098649 DE21BCA2 7A7EA229 716BA6E9
B279710F 38FAA5FF AE574155 CE4EFB4F 743695E2 911B1D06
D5E290CB CD86F56D 0EDFCD21 6AE22427 055E6835 FD29EEF7
9E0D9077 1FEACEBE 12F20E95 B34F0F78 B737A961 8B26FA7D
BC9874F2 72C42BDB 563EAFA1 6B4FB68C 3BB1E78E AA81A002
43FAADD2 BF18E63D 389AE443 77DA18C5 76B50F00 96CF3419
5483B005 48C09862 36E3BC7C B8D6801C 0494CCD1 99E5C5BD
0D0EDC9E B8A0001E 15276754 FCC68566 054148E6 E764BEE7
C764DAAD 3FC45235 A6DAD428 FA20C170 E345003F 2F06EC81
05FEB25B 2281B63D 2733BE96 1C29951D 11DD2221 657A9F53
1DDA2A19 4DBB1264 48BDEEB2 58E07EA6 59C74619 A6380E1D
66D6832B FE67F638 CD8FAE1F 2723020F 9C40A3FD A67EDA3B
D29238FB D4D4B488 5C2A9917 6DB1A06C 50077849 1A8288F1
855F60FF FCF1D137 3FD94FC6 0C1811E1 AC3F1C6D 003BECDA
3B1F2725 CA595DE0 CA63328F 3BE57CC9 77556011 95140DFB
59D39CE0 91308B41 05746DAC 23D33E5F 7CE4848D A316A9C6
6B9581BA 3573BFAF 31149618 8AB15423 282EE416 DC2A19C5
724FA91A E4ADC88B C66796EA E5677A01 F64E8C08 63139582
2D9DB8FC EE35C06B 1FEEA547 4D6D8F34 B1534A93 6A18B0E0
D20EAB86 BC9C6D6A 5207194E 68720732 FFFFFFFF FFFFFFFF
The estimated symmetric-equivalent strength of this group is 175 The estimated symmetric-equivalent strength of this group is 175
bits. bits.
Peers using ffdhe6144 that want to optimize their key exchange with a Peers using ffdhe6144 that want to optimize their key exchange with a
short exponent (Section 4.2) should choose a secret key of at least short exponent (Section 4.2) should choose a secret key of at least
350 bits. 350 bits.
A.5. ffdhe8192 A.5. ffdhe8192
The 8192-bit group has registry value 4, and is calcluated from the The 8192-bit group has registry value 4, and is calcluated from the
following formula: following formula:
The modulus is: p = 2^8192 - 2^8128 + {[2^8062 * e] + 10965728} * The modulus is: p = 2^8192 - 2^8128 + {[2^8062 * e] + 10965728} *
2^64 - 1 2^64 - 1
The hexadecimal representation of p is:
Its hexadecimal representation is:
FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1 FFFFFFFF FFFFFFFF ADF85458 A2BB4A9A AFDC5620 273D3CF1
D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9 D8B9C583 CE2D3695 A9E13641 146433FB CC939DCE 249B3EF9
7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561 7D2FE363 630C75D8 F681B202 AEC4617A D3DF1ED5 D5FD6561
2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935 2433F51F 5F066ED0 85636555 3DED1AF3 B557135E 7F57C935
984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735 984F0C70 E0E68B77 E2A689DA F3EFE872 1DF158A1 36ADE735
30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB 30ACCA4F 483A797A BC0AB182 B324FB61 D108A94B B2C8E3FB
B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19 B96ADAB7 60D7F468 1D4F42A3 DE394DF4 AE56EDE7 6372BB19
0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61 0B07A7C8 EE0A6D70 9E02FCE1 CDF7E2EC C03404CD 28342F61
9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73 9172FE9C E98583FF 8E4F1232 EEF28183 C3FE3B1B 4C6FAD73
skipping to change at page 18, line 49 skipping to change at page 20, line 50
CB2C0F1C C01BD702 29388839 D2AF05E4 54504AC7 8B758282 CB2C0F1C C01BD702 29388839 D2AF05E4 54504AC7 8B758282
2846C0BA 35C35F5C 59160CC0 46FD8251 541FC68C 9C86B022 2846C0BA 35C35F5C 59160CC0 46FD8251 541FC68C 9C86B022
BB709987 6A460E74 51A8A931 09703FEE 1C217E6C 3826E52C BB709987 6A460E74 51A8A931 09703FEE 1C217E6C 3826E52C
51AA691E 0E423CFC 99E9E316 50C1217B 624816CD AD9A95F9 51AA691E 0E423CFC 99E9E316 50C1217B 624816CD AD9A95F9
D5B80194 88D9C0A0 A1FE3075 A577E231 83F81D4A 3F2FA457 D5B80194 88D9C0A0 A1FE3075 A577E231 83F81D4A 3F2FA457
1EFC8CE0 BA8A4FE8 B6855DFE 72B0A66E DED2FBAB FBE58A30 1EFC8CE0 BA8A4FE8 B6855DFE 72B0A66E DED2FBAB FBE58A30
FAFABE1C 5D71A87E 2F741EF8 C1FE86FE A6BBFDE5 30677F0D FAFABE1C 5D71A87E 2F741EF8 C1FE86FE A6BBFDE5 30677F0D
97D11D49 F7A8443D 0822E506 A9F4614E 011E2A94 838FF88C 97D11D49 F7A8443D 0822E506 A9F4614E 011E2A94 838FF88C
D68C8BB7 C5C6424C FFFFFFFF FFFFFFFF D68C8BB7 C5C6424C FFFFFFFF FFFFFFFF
The base is: g = 2 The generator is: g = 2
The group size is: q = (p-1)/2
The hexadecimal representation of q is:
7FFFFFFF FFFFFFFF D6FC2A2C 515DA54D 57EE2B10 139E9E78
EC5CE2C1 E7169B4A D4F09B20 8A3219FD E649CEE7 124D9F7C
BE97F1B1 B1863AEC 7B40D901 576230BD 69EF8F6A EAFEB2B0
9219FA8F AF833768 42B1B2AA 9EF68D79 DAAB89AF 3FABE49A
CC278638 707345BB F15344ED 79F7F439 0EF8AC50 9B56F39A
98566527 A41D3CBD 5E0558C1 59927DB0 E88454A5 D96471FD
DCB56D5B B06BFA34 0EA7A151 EF1CA6FA 572B76F3 B1B95D8C
8583D3E4 770536B8 4F017E70 E6FBF176 601A0266 941A17B0
C8B97F4E 74C2C1FF C7278919 777940C1 E1FF1D8D A637D6B9
9DDAFE5E 17611002 E2C778C1 BE8B41D9 6379A513 60D977FD
4435A11C 308FE7EE 6F1AAD9D B28C81AD DE1A7A6F 7CCE011C
30DA37E4 EB736483 BD6C8E93 48FBFBF7 2CC6587D 60C36C8E
577F0984 C289C938 5A098649 DE21BCA2 7A7EA229 716BA6E9
B279710F 38FAA5FF AE574155 CE4EFB4F 743695E2 911B1D06
D5E290CB CD86F56D 0EDFCD21 6AE22427 055E6835 FD29EEF7
9E0D9077 1FEACEBE 12F20E95 B34F0F78 B737A961 8B26FA7D
BC9874F2 72C42BDB 563EAFA1 6B4FB68C 3BB1E78E AA81A002
43FAADD2 BF18E63D 389AE443 77DA18C5 76B50F00 96CF3419
5483B005 48C09862 36E3BC7C B8D6801C 0494CCD1 99E5C5BD
0D0EDC9E B8A0001E 15276754 FCC68566 054148E6 E764BEE7
C764DAAD 3FC45235 A6DAD428 FA20C170 E345003F 2F06EC81
05FEB25B 2281B63D 2733BE96 1C29951D 11DD2221 657A9F53
1DDA2A19 4DBB1264 48BDEEB2 58E07EA6 59C74619 A6380E1D
66D6832B FE67F638 CD8FAE1F 2723020F 9C40A3FD A67EDA3B
D29238FB D4D4B488 5C2A9917 6DB1A06C 50077849 1A8288F1
855F60FF FCF1D137 3FD94FC6 0C1811E1 AC3F1C6D 003BECDA
3B1F2725 CA595DE0 CA63328F 3BE57CC9 77556011 95140DFB
59D39CE0 91308B41 05746DAC 23D33E5F 7CE4848D A316A9C6
6B9581BA 3573BFAF 31149618 8AB15423 282EE416 DC2A19C5
724FA91A E4ADC88B C66796EA E5677A01 F64E8C08 63139582
2D9DB8FC EE35C06B 1FEEA547 4D6D8F34 B1534A93 6A18B0E0
D20EAB86 BC9C6D6A 5207194E 67FA3555 1B568026 7B00641C
0F212D18 ECA8D732 7ED91FE7 64A84EA1 B43FF5B4 F6E8E62F
05C661DE FB258877 C35B18A1 51D5C414 AAAD97BA 3E499332
E596078E 600DEB81 149C441C E95782F2 2A282563 C5BAC141
1423605D 1AE1AFAE 2C8B0660 237EC128 AA0FE346 4E435811
5DB84CC3 B523073A 28D45498 84B81FF7 0E10BF36 1C137296
28D5348F 07211E7E 4CF4F18B 286090BD B1240B66 D6CD4AFC
EADC00CA 446CE050 50FF183A D2BBF118 C1FC0EA5 1F97D22B
8F7E4670 5D4527F4 5B42AEFF 39585337 6F697DD5 FDF2C518
7D7D5F0E 2EB8D43F 17BA0F7C 60FF437F 535DFEF2 9833BF86
CBE88EA4 FBD4221E 84117283 54FA30A7 008F154A 41C7FC46
6B4645DB E2E32126 7FFFFFFF FFFFFFFF
The group size is: (p-1)/2
The estimated symmetric-equivalent strength of this group is 192 The estimated symmetric-equivalent strength of this group is 192
bits. bits.
Peers using ffdhe8192 that want to optimize their key exchange with a Peers using ffdhe8192 that want to optimize their key exchange with a
short exponent (Section 4.2) should choose a secret key of at least short exponent (Section 4.2) should choose a secret key of at least
384 bits. 384 bits.
Author's Address Author's Address
Daniel Kahn Gillmor Daniel Kahn Gillmor
 End of changes. 28 change blocks. 
40 lines changed or deleted 191 lines changed or added

This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/