Subject: [TLS] Draft-ietf-tls-negotited-ff-dhe-07

From: Tero Kivinen <[email-masked]>
Date: Thu, 26 Mar 2015 21:48:34 +0200

In Honolulu I verified that the primes generated in the
draft-ietf-tls-negotited-ff-dhe correctly, i.e. I generated them
again, and got same results. I also verified that they are primes
using primo. This morning I checked that the new 2048 bit group added
after that is also correct, but found problem there.

The actual hex number in the draft is correct, but the formula for the
numebr is wrong.

I.e. A.1. ffdhe2048 says:

   The modulus is: p = 2^2048 - 2^1984 + {[2^1918 * e] + 560315 } * 2^64
   - 1

but that does not match the hex number, there is off-by-one error. The
number 560315 should be 560316 instead.

https://www.wolframalpha.com/input/?i=2^2048+-+2^1984+++{trunc(2^1918+*+e)+++560315+}+*+2^64++++-+1+in+hex

https://www.wolframalpha.com/input/?i=2^2048+-+2^1984+++{trunc(2^1918+*+e)+++560316+}+*+2^64++++-+1+in+hex

I also put all the primo primality proof certificates on my web page
(along with the IKE primality certificates):
https://kivinen.iki.fi/primes/ 
-- 
[email-masked]

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Sat, 28 Mar 2015 12:43:00 -0400

> number 560315 should be 560316 instead.

Yikes, I can confirm this.

Thanks to Tero for verifying the formulas as well as the hex numbers.
It appears i had rounded instead of flooring when computing ffdhe2048,
how embarrassing.  I plan to submit -08 when i get back on-network that
will have this piece corrected.

> https://kivinen.iki.fi/primes/ 

I've also calculated primo primality proofs and placed them here:

 https://dkg.fifthhorseman.net/ffdhe-primality-proofs/

Regards,

        --dkg