Subject: [TLS] Any advice regarding frequency of generating new DH parameters?

From: Mike <[email-masked]>
Date: Fri, 15 Dec 2006 16:56:08 -0800

Hi,

I'm wondering if there is any generally accepted advice
on how long to use the same Diffie-Hellman parameters in
a TLS server.  Does the answer depend on whether the
server generates a new public key from the parameters
for each new connection (mine does)?

Thanks for any insight,

Mike

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: <[email-masked]>
Date: Mon, 18 Dec 2006 11:53:33 +0200

Hi Mike,

Protocols such as IKEv2 use the same modulus (p) and generator (g)
forever (but of course generate new public/private values), since 
they don't actually send the p/g values, but just the group number.

IMHO it probably would make sense for a TLS implementation to use 
one of the groups specified in RFC 4306 or 3526, instead of e.g. 
generating a random prime p (generating random primes is kind of 
slow, and then you have to worry about RFC 2785 etc.). 

(Would others agree with this recommendation? Should we add it 
to the TLS 1.2 spec?)

Best regards,
Pasi 

> -----Original Message-----
> From: ext Mike [mailto:[email-masked]] 
> Sent: 16 December, 2006 02:56
> To: [email-masked]
> Subject: [TLS] Any advice regarding frequency of generating 
> new DHparameters?
> 
> Hi,
>

---

From: Mike <[email-masked]>
Date: Mon, 18 Dec 2006 09:07:27 -0800

Thanks for the reply and pointers to the RFC's.  In RFC 3526 they
estimate the strength of their DH groups, and the strength of the
1536-bit modulus is estimated to be between 90 and 120 bits.
Since 1024 bits is common in TLS, the strength would be somewhat
lower than that.  The RSA key exchange method uses 368 bits of
random data which seems much stronger.  Should we recommend using
larger moduli in the Diffie-Hellman key exchange methods?  And
should we encourage checking the size of the ServerDHParams.p
when acting as a client to make sure it is not too small?

Also, how safe is it to use the DH key exchange method, since the
public key(s) are fixed in the certificate(s)?

Mike