[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Small subgroups and ISAKMP/Oakley
The 1,-1 check should be added to the spec, but I think the rest of the
good work of IEEE and X9.42 is beyond the intended scope of ISAKMP/OAKLEY;
there's no intent to reference all possible attacks.
I recommend adding a comment that only strong/Sophie Germaine/j=2 primes
be used for the modulus in the New Group exchange, but the consenting parties
must either trust each other's math or be able to independently validate
the Sophie Germaineness of the modulus (off-line beforehand or in-line on
a fast machine).
With regard to having one party force a bad key, it is still possible for
the second party to choose and exponential that forces many of the key
bits to a known value, thus opening up some room for a passive attacker.
There's no trick to this, it simply requires a lot of fast computation.
Hilarie
Follow-Ups: