3 ms·
But it still asks the server to pick the group in which to do DH. This has to be exploitable somehow...
by xnyhps 11y ago
But it still asks the server to pick the group in which to do DH. This has to be exploitable somehow...
- tptacek 11y agoI agree that's a very dumb design decision, but supposedly the clients are expected to validate the DH parameters.
- xnyhps 11y agoTrue, it needs to be a safe prime, but not all 2048-bit safe primes are equally good. At the very least there are those for which the Special Number Field Sieve applies, though that's likely still infeasible. There might be very rare 2048-bit DH groups using safe primes for which the DLP problem is easily solvable, I wasn't able to find any research into whether or not those can exist.
- tptacek 11y agoYou also have to validate the generator, which is trickier than the prime.