Subject: Re: PKINIT open issues

From: Jonathan Trostle <[email-masked]>
Date: Fri, 23 Apr 2004 11:33:06 -0400 (EDT)

DH truncation is should be fine. See the paper "Hardness of Computing the
Most Significant Bits of Secret Keys in Diffie-Hellman and Related Schemes"
by D. Boneh and R. Venkatesan. For example, they show that computing 
the 32 MSB of the DH shared secret is as hard as computing the entire
secret, when using a 1024 bit prime (sqrt(p) = 32 bits).

I can't find any recommendations for sizes of DH parameters in the current
version of the draft. Generally the DH exponent should be twice as many
bits as the resulting shared secret key, e.g. using a 200 bit exponent
corresponds to a 100 bit shared secret. There should be a statement
on this. 

> I realize I'm being incredibly sloppy in the above.  I could be
> significantly less sloppy, but I believe doing so would focus the
> discussion on the details of my questions rather than on the
> information the WG needs in order to evaluate whether DH truncation is
> acceptable.

Jonathan

---

From: Sam Hartman <[email-masked]>
Date: Fri, 23 Apr 2004 13:09:14 -0400

>>>>> "Jonathan" == Jonathan Trostle <[email-masked]> writes:

    Jonathan> I can't find any recommendations for sizes of DH
    Jonathan> parameters in the current version of the
    Jonathan> draft. Generally the DH exponent should be twice as many
    Jonathan> bits as the resulting shared secret key, e.g. using a
    Jonathan> 200 bit exponent corresponds to a 100 bit shared
    Jonathan> secret. There should be a statement on this.

The statement should refer to the IETF's BCP document on this issue.