Subject: Re: [TLS] draft-sheffer-tls-bcp: DH recommendations

From: Peter Gutmann <[email-masked]>
Date: Mon, 23 Sep 2013 06:38:39 +0000

Patrick Pelletier <[email-masked]> writes:

>So, my interpretation is that the 1024-bit limit only applies to DSS in IE.

That would make sense, since FIPS 186 for many years limited DSS to 1024 bits
it wasn't possible to go over that size anyway.

>This is in contrast to the Java situation, where Java will offer DHE_RSA, the
>server will choose it, and then Java will bail because it doesn't support the
>DH length.

Since anyone running Java is pretty much pre-0wned out of the box, I don't
know if this one is that critical :-).

Peter.

---

From: Peter Gutmann <[email-masked]>
Date: Wed, 25 Sep 2013 12:05:25 +0000

Michael D'Errico <[email-masked]> writes:
>Peter Gutmann wrote:
>> For DH you just use Lim-Lee and you're done
>
>Can you please provide a pointer to the Lim-Lee algorithm?

It was presented in "A key recovery attack on discrete log-based schemes using
a prime order subgroup" at Crypto'97, see the link (unfortunately only to a PS
file) at http://dasan.sejong.ac.kr/~chlim/english_pub.html.  There's a PDF-ised
version available via Citeseer at 
http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.44.5296&rep=rep1&type=pdf.

Peter.