Subject: Re: [TLS] AD review of draft-ietf-tls-negotiated-ff-dhe-08

From: Peter Gutmann <[email-masked]>
Date: Wed, 15 Apr 2015 14:43:34 +0000

Santiago Zanella <[email-masked]> writes:

>A current full IPv4 survey of groups used for FFDHE shows that the 2048-bit
>MODP group from RFC3526 is the 5th most common (and the most common with a
>modulus longer than 1024 bits): roughly 7.8% of over 10M hosts use it. For
>comparison, 8.7% use IKE 1024-bit MODP group. The other MODP groups in
>RFC3526 are used only marginally.

So... if 8.7% is the most widely-used group (since you qualify the 7.8% one
with "the most common with a modulus longer than 1024 bits"), that means the
most common group is one that the ff-dhe draft doesn't allow you to specify,
and the most common group with a modulus longer than 1024 bits is... another
one that the ff-dhe draft doesn't allow you to specify.

Peter.

---

From: Santiago Zanella <[email-masked]>
Date: Wed, 15 Apr 2015 17:32:15 +0200

Peter Gutmann <[email-masked]> wrote:
> So... if 8.7% is the most widely-used group (since you qualify the
> 7.8% one with "the most common with a modulus longer than 1024
> bits")

That does not follow from what I said. The 8.7% group is the 4th most
common, the top 3 have also 1024-bit moduli.

> that means the most common group is one that the ff-dhe draft
> doesn't allow you to specify, and the most common group with a
> modulus longer than 1024 bits is... another one that the ff-dhe
> draft doesn't allow you to specify.

Yes, and rightfully so because we want to get rid of 1024-bit groups
and have good reasons not to reuse groups from other protocols. But
note that the draft reserves codepoints for private use that can be
used locally to specify other groups.

The minimum acceptable size was set at 2048 bits was a result of a
straw poll:

 http://www.ietf.org/mail-archive/web/tls/current/msg14438.html

 --Santiago

---

From: Peter Gutmann <[email-masked]>
Date: Wed, 15 Apr 2015 15:38:58 +0000

Santiago Zanella <[email-masked]> writes:

>That does not follow from what I said. The 8.7% group is the 4th most common,
>the top 3 have also 1024-bit moduli.

Yeah, that was the puzzling bit, so just out of curiosity what were the other
1024-bit groups if they weren't the RFC 2409 one?

Peter.

---

From: Santiago Zanella <[email-masked]>
Date: Wed, 15 Apr 2015 17:54:38 +0200

The others are custom groups hardcoded in popular web servers (Apache, nginx).

 --Santiago