Subject: RE: PKINIT-23: DH GROUP SELECTION: ticket 530

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 26 Jan 2005 10:18:24 -0800

Some context for the proposed new text:

Here is the old text:

   5.  If a Diffie-Hellman key is being used, the parameters MUST be
       chosen from Oakley Group 2 or 14.  Implementations MUST support
       Group 2; they are RECOMMENDED to support Group 14 (See
       [RFC2409]). 

Why limit ourselves to these two groups--and implicitly to only 1024-bit
and 2048-bit keys?  There may be legitimate uses for larger groups, EC
groups, and perhaps other yet-to-be-defined groups.  Why forbid these?

Group 14 is clearly too weak to be used with 256 AES keys, per RFC 3766.
we Microsoft would like to recommend group 16 and 4.

There were some past discussions on the list that we should add
recommendation for the exponent size, I said I would add some hence the
text for the exponent size in the new text.

-- Larry

-----Original Message-----
From: Jeffrey Hutzelman [mailto:[email-masked]] 
Sent: Wednesday, January 26, 2005 7:02 AM
To: Liqiang(Larry) Zhu; [email-masked]
Subject: Re: PKINIT-23: DH GROUP SELECTION: ticket 530 

On Wednesday, January 26, 2005 03:03:25 -0800 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:

> Section 3.2.1
>
>
>    5.  If the Diffie-Hellman key agreement method is used,
>        implemenations MUST support Oakley 1024-bit MODP well-known
group
>        2 [RFC2412] and SHOULD support Oakley 2048-bit MODP well-known
>        group 14 and Oakley 4096-bit MODP well-known group 16
[RFC3526].
>        They MAY support Oakley 185-bit EC2N group 4 [RFC2412].  The
>        exponent size used in the Diffie-Hellman must be selected so
that
>        it matches other parts of the system.  It should not be the
>        weakest link in the security system.  It should have double the
>        entropy of the strength of the entire system, i.e., if you use
a
>        group whose strength is 128 bits, you must use more than 256
bits
>        of randomness in the exponent used in the Diffie-Hellman
>        calculation.

I think it's pretty clear in the text of 530 that the WG consensus was
MUST support group 2 and SHOULD support group 14.  There was no
consensus to RECOMMEND any other MODP group, nor to say anthing about an
EC2N group.

The point of #530 was that the "SHOULD group 14" requires a normative
reference to the document which defines group 14, which is currently
missing from PKINIT.

If you have an argument that the document should say something different
than what it does, please describe the change and make an argument for
it, instead of just posting new text without any context.

-- Jeff

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 26 Jan 2005 13:45:43 -0600

> groups, and perhaps other yet-to-be-defined groups.  Why forbid these?

I don't get it -- where are other groups forbidden?

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Wed, 26 Jan 2005 18:08:47 -0500

I'd recommend looking at mandating support for AES128 in pkinit
implementations and suggesting that be used instead of aes256 so you
can get a smaller DH group.