11
$\begingroup$

In a Diffie-Hellman exchange, the parties need to agree on a prime p and a base g in order to continue. Assuming some application that's going to want to initiate handshakes with some large portion of its users, each of which only needs to be realistically secure for a few hours,

  • Approximately how large should p be?
  • How often should p be changed, if ever? Every n handshakes, every m hours/days/weeks?
  • Is there a trade-off between dynamic generation/size of p? Is it better to find a single ~120 digit prime and always reuse it or generate a ton of ~28-38 digit primes and randomly pick one per handshake?
  • Am I even asking something approaching the right questions (and if not, could you point me in a better direction)?

Intuitively, it seems that the size of the chosen secret integers has more to do with the channel's security than the uniqueness of p, but I'm still asking since I'm no mathematician.

$\endgroup$

2 Answers 2

14
$\begingroup$

Well, to answer your questions in order:

  • How big should $p$ be? Well, it should be large enough to defend against the known attacks against it. The most efficient attack is NFS; that has been used against numbers on the order of $2^{768}$ (a 232 digit number). It would appear wise to pick a $p$ that's considerably bigger than that; around 1024 bits at a minimum, and more realistically at least 1536 bits. Notes:

    • What was actually done is use NFS to factor a 232 digit number; NFS can be adjusted to perform discrete logs to bases of the same size without an undue increase of complexity.
    • Now, you said that the connections need be secure for only a few hours. Now, NFS on numbers of that size is a large effort, almost certain to take longer than a few hours. Now, if you really don't care if someone can retrieve the keys after the connection has ended, it might seem safe to use a smaller modulii; I would personally recommend against it.

    In addition, there's another important point about $p$; $p-1$ should have a large prime factor $q$, and you should know what the factorization of $p-1$ is (so you can pick a value $g$ that is of the order $q$; that is, the smallest value $x>0$ where $g^x = 1 \mod p$ is $x=q$). If you pick a random prime $p$, and a random generator $g$, well, you're probably secure, but you won't be certain (and you'll might leak a few bits of the private exponent if the order of your random $g$ happens to have some small factors).

  • How often should $p$ be changed; well, if you pick good values for $p$ and $g$, they don't need to be changed.

  • Is there a trade-off between dynamic generation and the size of p? Well, you're far better off picking one large (and well chosen) prime p and g, and sticking to it. From the NFS analysis, a 120 digit prime is of some questionable security; a 28-38 digit prime is far from adequate.

Now, as you might be able to tell from the above discussion, picking good $p$ and $g$ values is not straightforward (at least, if you don't understand the mathematics). One good news is that people have already done the work, and have published good values. See this for some well chosen $p$ and $g$ values; these were originally intended for use in the IKE protocol, but they can be used for other purposes as well. I would personally recommend the 2048 bit value.

$\endgroup$
3
  • $\begingroup$ Rookie question: what does the 'pi' in the formulas in the link mean, e.g. 2^1536 - 2^1472 - 1 + 2^64 * { [2^1406 pi] + 741804 }? We are not talking about 3.1415..., are we? $\endgroup$
    – dasf
    Jun 27, 2018 at 8:03
  • 1
    $\begingroup$ @dasf: actually, we are talking about everyone's favorite transcendental number $\pi = 3.1415926...$. It is used to make $p$ a 'Nothing Up My Sleeve' number; that is, $p$ wasn't specifically chosen for some secret cryptographical weakness. $\endgroup$
    – poncho
    Jun 27, 2018 at 12:49
  • $\begingroup$ FWIW if you'd like integer-aka-modp-ie-nonEC DH groups created by the same NUMS method as Oakley/IKEv2 but using e instead to get different results, starting at 2048 which as of about 2015-2017 became the minimum acceptable for most things, see rfc7919 appendix A. $\endgroup$ Jul 24, 2021 at 0:54
4
$\begingroup$

Approximately how large should p be?

Current calculations say it's probably possible to crack a 1024-bit prime today with NSA-level resources, and there is speculation that the NSA has cracked some widely used 1024-bit primes.

2048-bit seems to be a common default these days.

How often should p be changed, if ever? Every n handshakes, every m hours/days/weeks?

A lot of the effort in cracking DH is per-prime, not per DH session. So by changing the DH prime, you are increasing the average cost of cracking a session.

Is there a trade-off between dynamic generation/size of p? That is, is it better to find a single ~120 digit prime and constantly reuse it, or to generate a ton of ~28-38 digit primes and randomly pick one per handshake?

In general, changing primes does create some extra work for the attacker. A single long prime will give you much better security than many short ones.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.