mirror of
https://git.tartarus.org/simon/putty.git
synced 2025-01-25 01:02:24 +00:00
cd60a602f5
I recently encountered a paper [1] which catalogues all kinds of things that can go wrong when one party in a discrete-log system invents a prime and the other party chooses an exponent. In particular, some choices of prime make it reasonable to use a short exponent to save time, but others make that strategy very bad. That paper is about the ElGamal encryption scheme used in OpenPGP, which is basically integer Diffie-Hellman with one side's key being persistent: a shared-secret integer is derived exactly as in DH, and then it's used to communicate a message integer by simply multiplying the shared secret by the message, mod p. I don't _know_ that any problem of this kind arises in the SSH usage of Diffie-Hellman: the standard integer DH groups in SSH are safe primes, and as far as I know, the usual generation of prime moduli for DH group exchange also picks safe primes. So the short exponents PuTTY has been using _should_ be OK. However, the range of imaginative other possibilities shown in that paper make me nervous, even so! So I think I'm going to retire the short exponent strategy, on general principles of overcaution. This slows down 4096-bit integer DH by about a factor of 3-4 (which would be worse if it weren't for the modpow speedup in the previous commit). I think that's OK, because, firstly, computers are a lot faster these days than when I originally chose to use short exponents, and secondly, more and more implementations are now switching to elliptic-curve DH, which is unaffected by this change (and with which we've always been using maximum-length exponents). [1] On the (in)security of ElGamal in OpenPGP. Luca De Feo, Bertram Poettering, Alessandro Sorniotti. https://eprint.iacr.org/2021/923 |
||
|---|---|---|
| .. | ||
| sclog | ||
| agentmulti.py | ||
| agenttest.py | ||
| agenttestdata.py | ||
| agenttestgen.py | ||
| colours.txt | ||
| cryptsuite.py | ||
| desref.py | ||
| display.txt | ||
| eccref.py | ||
| fuzzterm.c | ||
| lattrs.txt | ||
| list-accel.py | ||
| mpu-check.pl | ||
| numbertheory.py | ||
| primegen.py | ||
| scocols.txt | ||
| ssh.py | ||
| testcrypt-enum.h | ||
| testcrypt-func.h | ||
| testcrypt.c | ||
| testcrypt.py | ||
| testsc.c | ||
| testzlib.c | ||
| utf8.txt | ||
| vt100.txt | ||
| windowchange.py | ||