3
$\begingroup$

In previous versions of TLS, the choice of the Diffie-Hellman parameters was up to the participants. This resulted in some implementations choosing incorrectly, resulting in vulnerable implementations being deployed. How does TLS 1.3 takes this choice away?

How are the X(g^x mod p) and Y(g^y mod p) values determined when creating a pre master key in TLS 1.3?

$\endgroup$
1

1 Answer 1

4
$\begingroup$

How does TLS 1.3 takes this choice away?

By having the client specify the DH group from the list of ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192 (which are specific 2048, 3072, 4096, 6144, 8192 bit DH groups); no other choices (other than some elliptic curve groups) are allowed. That is, neither side longer have a way to say 'hey, lets use this DH group that I just made up'.

How does the $X(g^x \bmod p)$ and $Y(g^y \bmod p)$ values are determined when creating a pre master key in TLS 1.3 ?

Those public keyshares are generated the same way - what's restricted is that $g, p$ are from a list of 5 possibilities.

$\endgroup$
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.