The following are the reasons I came up with for not using static/standard DH parameters.
- You might not trust the person who generated the group. They could have generated a group with a trapdoor (e.g., group order is smooth) which would allow them to break the resulting system.
The longer you use the same group, the more time an attacker has to attack the group.
E.g., if millions of people are using the same group, millions of times a day and the attacker has a database of terabytes of pairs $(g^x,x)$, they may be able to break a key establishment.
- In DH, remember we must choose a random exponent. We have seen a number of recent cases were random number generators weren't as random as originally thought (e.g., Debian OpenSSL RNG). Not reusing the same group could potentially thwart bad RNGs (though if the new group is generated using the same RNG...).
You should remember though that there are also issues with generating new groups all the time, so you have to weigh the tradeoffs. I wouldn't think that there is a clear, definitive winner for how to do it that applys to all circumstances, though when done correctly either way is secure. If the group parameters were chosen by someone I trusted (e.g., NIST), then I'd personally just use the parameters they suggest.
Why would I still recommend using a standard group
Even given the potential problems I listed above, I personally would still use a standardized group generated by someone I trust because:
- If they have generated it properly, you will know the order of the (sub-)group and know that it isn't smooth.
- The probably of #2 is still very, very small
- If your RNG is bad, there are probably so many other issues that even changing the group won't save you.
- The possibility of you not checking things exactly right when generating your own group is pretty high.
- Generating a new group will add significant computation time with little added security.