Subject: Re: [TLS] STRAW POLL: Size of the Minimum FF DHE group

From: Peter Gutmann <[email-masked]>
Date: Tue, 4 Nov 2014 18:46:02 +0000

Sean Turner <[email-masked]> writes:

>The draft currently includes a minimum group size of 2432 but the WG also
>discussed 2048.  Groups smaller than 2048 were discounted for a standards
>track document as too weak for use but might be documented in a separate 
>=93historic=94 draft.

See my previous comments on this, these groups are still being actively used,
and will continue to be used until the hardware they're used with dies.  So
having them documented would be useful, not least because if the IETF doesn't
do it then some (probably several) other standards groups will do it for them.

>The chairs would like to poll the WG on one of the issues in the draft namely
>the size of the minimum group.

If the only choice is between 2048 and 24something then I'll go with 2048.
What's the significance of 24something anyway?

Peter.

---

From: Bodo Moeller <[email-masked]>
Date: Wed, 5 Nov 2014 10:01:44 +0100

Peter Gutmann <[email-masked]>:

> What's the significance of 24something anyway?

2048 = 0x0800
2432 = 0x0980

I.e., the authors of the 2012 ECRYPT II Yearly Report on Algorithms and
Keysize still are fond of powers of two.

Bodo

---

From: Michael Sweet <[email-masked]>
Date: Wed, 05 Nov 2014 05:55:52 -0500

Um, I'm no TLS expert but I do know that 2432 (0x980) is not a power of 2.

Sent from my iPad

> On Nov 5, 2014, at 4:01 AM, Bodo Moeller <[email-masked]> wrote:
> 
> I.e., the authors of the 2012 ECRYPT II Yearly Report on Algorithms and Keysize still are fond of powers of two.
> 
> Bodo
> 
> 
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: Bodo Moeller <[email-masked]>
Date: Wed, 5 Nov 2014 12:07:32 +0100

> Um, I'm no TLS expert but I do know that 2432 (0x980) is not a power of 2.

It's a small multiple of a power of 2.

---

From: Michael Sweet <[email-masked]>
Date: Wed, 05 Nov 2014 07:03:12 -0500

You can stretch the definition to say it's a non-integral power of 2 (2^11.2479), but any number fits that definition.

You could also say it is 19 x 2^7 or 1.1875 x 2^11.

But there is no solution for "2432 = 2^n" where "n" is an integer.

> On Nov 5, 2014, at 6:07 AM, Bodo Moeller <[email-masked]> wrote:
> 
> Michael Sweet <[email-masked] <mailto:[email-masked]>>:

_________________________________________________________
Michael Sweet, Senior Printing System Engineer, PWG Chair

---

From: Bodo Moeller <[email-masked]>
Date: Wed, 5 Nov 2014 13:08:09 +0100

You can stretch the definition to say it's a non-integral power of 2
> (2^11.2479), but any number fits that definition.
>

Of course, but do you think it's a coincidence that all the
ECRYPT-recommended prime sizes are small (integral) multiples of a
(non-trivial) power of two? I think not.

(Not that there's anything wrong with that.)

Bodo