18 ms·
So do the adversaries we worry most about use the same prime numbers as everybody else, or do they come up with their own? It seems the most likely outcome is t
by mark-r 10y ago
So do the adversaries we worry most about use the same prime numbers as everybody else, or do they come up with their own? It seems the most likely outcome is that the NSA is able to spy on Americans much more easily than they can spy on anybody else.
- mirimir 10y agoAnyone can "come up with their own". In Debian, install openvpn with easy-rsa. Then: # cd /etc/openvpn/easy-rsa # source ./vars # ./build-dh Some time (depending on sources of randomness) later, you'll have a unique dh2048.pem key, aka prime, such as this one I just created: -----BEGIN DH PARAMETERS----- MIIBCAKCAQEA3Mdx5SV5kjdmq+QdTG+JIwkqdlsrXYitOTUK2GQdlRI9JhYFW3cZ 6R1oLy14JbhTKTHEzRrljePCyJJDq1gAVAcIdIazNWFRnuAMRN5HdJcDyXluaajO k3u9HDVlIyTIDiJC6fNXuq76AQV1J+8V5t2s+nqhYFIjxxeXdSdGqeGlINgM+kMm cRZa77UTk3MZK0uEjxeZNFnMIW+laCUT96YB8Vs+PH+7JPeMPBWJP7yQmrSEkOgD h8BxnE+P+6lTgtNgd1wKDzdGd8wES7ObXhAcxhZnKSUIUyuzzaJtXDMsj/rXXQip xIXKARi8X7uCaYZUEh5qC2F+uBoPjV6NywIBAg== -----END DH PARAMETERS-----
- vertex-four 10y agoOr just run: openssl dhparam -out dhparam.pem 2048
- mark-r 10y agoThe question isn't about what's possible, the question is about common practice. If everybody used their own private prime numbers this wouldn't have been news.
- ooqr 10y agoThanks! I'll use that for all my secrets
- Godel_unicode 10y agoYou might be interested in googling Suite B. It lays out guidelines for encrypting government data up to the Top Secret level. If you dig a little bit, you can find guidelines for auditing crypto implementations and also for handling/generating key material. Briefly, Suite B is AES-GCM, ECDH, ECDSA, and SHA2. Edit: autocorrect