Subject: Re: [TLS] DH security issue in TLS

From: Nasrul Zikri <[email-masked]>
Date: Fri, 6 Dec 2019 01:37:37 +0000

> Hi All
>
> I found in NIST Special Publication 800-56A Revision 3
> 5.6.2.3.1 FFC Full Public-Key Validation Routine
> 2. Verify  that  1 = y q mod p.

That should be, 1 = y^q mod p.

>
> This test is implemented in OPENSSL
>
> This test relies on the fact  that q and p are prime
>
> Pascal
>

> > If you want the guarantee that your DH key exchange is contributive,
> > that is, that neither single party can determine with high-probability
> > the DH secret produced by the key exchange, you can either 1. use one of
> > the safe groups defined in RFC7919. When using these groups, you should
> > pick an exponent between 2 and q-1. 2. Figure out all of the low-order
> > elements of Zp* and check that the DH secret is not one of them.

What must the server do if the client is old and does not support the safe groups in RFC 7919? The advice from Mozilla is generate a 1024-bit Diffie-Hellman group. Is there good code to generate safe group efficiently? Will OpenSSL generate safe group?

Tk,
Nasrul

---

From: Viktor Dukhovni <[email-masked]>
Date: Thu, 5 Dec 2019 21:33:07 -0500

> On Dec 5, 2019, at 8:37 PM, Nasrul Zikri <[email-masked]> wrote:
> 
> What must the server do if the client is old and does not support the safe groups in RFC 7919?

Presumably the old client is doing TLS 1.2 (or 1.0), since with TLS 1.3,
the client MUST specify which groups it supports, and no others can be
used.  The server can use any FFDHE group of its choice (provided suitable
DHE ciphers are supported by the client), including one of 7919 groups,
or use ECDHE if that's supported...

> The advice from Mozilla is generate a 1024-bit Diffie-Hellman group.

> Is there good code to generate safe group efficiently?

FFDHE parameter generation is too slow to do on the fly.  Such groups
are pre-generated, and so the efficiency is not a significant concern.

> Will OpenSSL generate safe group?

Yes, if you ask nicely, but that's more of a question for the openssl-users
list than for the TLS WG.

It seems this thread is no longer on topic for this list, perhaps time to
consider moving any residual questions to more appropriate lists.

-- 
	Viktor.