mirror of
https://git.tartarus.org/simon/putty.git
synced 2025-01-10 01:48:00 +00:00
cd60a602f5
I recently encountered a paper [1] which catalogues all kinds of things that can go wrong when one party in a discrete-log system invents a prime and the other party chooses an exponent. In particular, some choices of prime make it reasonable to use a short exponent to save time, but others make that strategy very bad. That paper is about the ElGamal encryption scheme used in OpenPGP, which is basically integer Diffie-Hellman with one side's key being persistent: a shared-secret integer is derived exactly as in DH, and then it's used to communicate a message integer by simply multiplying the shared secret by the message, mod p. I don't _know_ that any problem of this kind arises in the SSH usage of Diffie-Hellman: the standard integer DH groups in SSH are safe primes, and as far as I know, the usual generation of prime moduli for DH group exchange also picks safe primes. So the short exponents PuTTY has been using _should_ be OK. However, the range of imaginative other possibilities shown in that paper make me nervous, even so! So I think I'm going to retire the short exponent strategy, on general principles of overcaution. This slows down 4096-bit integer DH by about a factor of 3-4 (which would be worse if it weren't for the modpow speedup in the previous commit). I think that's OK, because, firstly, computers are a lot faster these days than when I originally chose to use short exponents, and secondly, more and more implementations are now switching to elliptic-curve DH, which is unaffected by this change (and with which we've always been using maximum-length exponents). [1] On the (in)security of ElGamal in OpenPGP. Luca De Feo, Bertram Poettering, Alessandro Sorniotti. https://eprint.iacr.org/2021/923 |
||
|---|---|---|
| .. | ||
| agentf.c | ||
| bpp1.c | ||
| bpp2.c | ||
| bpp-bare.c | ||
| bpp.h | ||
| censor1.c | ||
| censor2.c | ||
| channel.h | ||
| CMakeLists.txt | ||
| common.c | ||
| connection1-client.c | ||
| connection1-server.c | ||
| connection1.c | ||
| connection1.h | ||
| connection2-client.c | ||
| connection2-server.c | ||
| connection2.c | ||
| connection2.h | ||
| crc-attack-detector.c | ||
| gss.h | ||
| gssc.c | ||
| gssc.h | ||
| kex2-client.c | ||
| kex2-server.c | ||
| login1-server.c | ||
| login1.c | ||
| mainchan.c | ||
| nogss.c | ||
| nosharing.c | ||
| pgssapi.c | ||
| pgssapi.h | ||
| portfwd.c | ||
| ppl.h | ||
| scpserver.c | ||
| server.c | ||
| server.h | ||
| sesschan.c | ||
| sftp.c | ||
| sftp.h | ||
| sftpcommon.c | ||
| sftpserver.c | ||
| sharing.c | ||
| signal-list.h | ||
| ssh.c | ||
| transient-hostkey-cache.c | ||
| transport2.c | ||
| transport2.h | ||
| ttymode-list.h | ||
| userauth2-client.c | ||
| userauth2-server.c | ||
| verstring.c | ||
| x11fwd.c | ||
| zlib.c | ||