Subject: Re: [TLS] MODP group modulus derivation [was: Re: I can has SHA-1 hashes for RFC 2409/3526 MODP groups?]

From: Fedor Brunner <[email-masked]>
Date: Wed, 12 Mar 2014 20:32:46 +0100

I have prepared a small Python program for generating of RFC 3526 MODP
groups.

It's using Machin's formula for calculating Pi, trial divisions with
small primes and Miller-Rabin primality test to search for primes. It
should check all the MODP groups in couple of hours on a modern PC.

https://github.com/fedor-brunner/test_RFC3526

---

From: Peter Gutmann <[email-masked]>
Date: Wed, 12 Mar 2014 22:08:55 +0000

Daniel Kahn Gillmor <[email-masked]> writes:

>It's not clear to me that there is any advantage in a DH key exchange to
>using the RFC 5114 discrete log groups.

There's actually an enormous disadvantage to using those groups, the RFC 3526
and earlier MODP groups set the generator to 2, which is quite efficient to
work with.  RFC 5114 uses a generator of the same size as the prime, which is
stunningly inefficient (I've referred to the 5114 groups as the "WTF groups"
in code in the past).  I have no idea why the RFC would choose such an awful
generator...

Peter.