4 ms·
I agree with the author and ran into the same problem when learning (and later teaching) D–H. A good explanation is given in the following crypto.stackexhcange
by spekcular 6y ago
I agree with the author and ran into the same problem when learning (and later teaching) D–H.
A good explanation is given in the following crypto.stackexhcange answer; the last two paragraphs in particular are the short version: https://crypto.stackexchange.com/a/829 https://crypto.stackexchange.com/a/829.
- cryptonector 6y agoThat says | There is no security issue with Diffie-Hellman (or DSA) if you reuse previously generated p, q and g; ... That's... not entirely true. For small enough p an attacker can mount a precomputation attack against the group. That's something the NSA is rumored to have done for standard (now obsolete) 512-bit DH groups. For large enough primes p this is not really a concern though, so, yeah. Also, DH is pretty much obsolete now with ECDH.
- spekcular 6y agoYes, I totally agree. The qualifier "for large enough p" should be added. For anyone reading this who's wondering about the NSA attack, some details can be found here: https://weakdh.org/ https://weakdh.org/. Circumstantial evidence that the NSA did what that website describes is given in the research paper there.