[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: IPSEC Security Gateways & NAT
> If you pre-comp a set of prime numbers for DH-key exchange...
> These can use only one time and they are consumed faster then
> you can come
> up new ones.
> This is the DOS idea that keep the IPSec responder so busy
> (meaninglessly)
> that
> no time for other meaningful activities.
> Recycling prime numbers for DH-key exchange is a
> implementation mistake???
As Dan said, the numbers you pre-computer are not prime. I should also point
out that it is normally acceptable to recycle the precomputed DH values if
the exchange fails.
Andrew
-------------------------------------------
Upon closer inspection, I saw that the line
dividing black from white was in fact a shade
of grey. As I drew nearer still, the grey area
grew larger. And then I was enlightened.
References: