Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
In previous versions of TLS, the choice of the Diffie-Hellman parameters was up to the participants. This resulted in some implementations choosing incorrectly, resulting in vulnerable implementations being deployed. How does TLS 1.3 takes this choice away?
How are the X(g^x mod p) and Y(g^y mod p) values determined when creating a pre master key in TLS 1.3?
How does TLS 1.3 takes this choice away?
By having the client specify the DH group from the list of ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192 (which are specific 2048, 3072, 4096, 6144, 8192 bit DH groups); no other choices (other than some elliptic curve groups) are allowed. That is, neither side longer have a way to say 'hey, lets use this DH group that I just made up'.
How does the $X(g^x \bmod p)$ and $Y(g^y \bmod p)$ values are determined when creating a pre master key in TLS 1.3 ?
Those public keyshares are generated the same way - what's restricted is that $g, p$ are from a list of 5 possibilities.
