Subject: Re: [TLS] DH parameters, primality

From: Peter Gutmann <[email-masked]>
Date: Fri, 7 Mar 2014 11:30:24 +0000

Tanja Lange <[email-masked]> writes:

>More constructively though, verifying primality given a certificate is much
>faster 

A quick fix for TLS would be to switch from the current PKCS #3-style DH
representation to FIPS 186-style, for which you can verify the parameters
using Kravitz' kosherizer.  This was proposed some time ago but didn't get
much too much acceptance, maybe it's time to revisit it...

Peter.

---

From: Karthikeyan Bhargavan <[email-masked]>
Date: Fri, 7 Mar 2014 12:46:25 +0100

It’s worth rethinking TLS's DH representation for another reason.
It does not currently provide a slot for the subgroup size “q”.

This makes it impossible for the client to perform public key  validation for anything other than Sophie-Germain primes. (For suggested validation rules see: http://tools.ietf.org/html/rfc6989#section-2.2)

We exploit this problem as well in a variation of the triple handshake attack.
-K.

On 07 Mar 2014, at 12:30, Peter Gutmann <[email-masked]> wrote:

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls