I am trying to understand https, as I understand https uses the Diffie–Hellman method for keys exchange and then AES for encryption.
But Diffie–Hellman needs two prime numbers, where do these come from?
$\begingroup$
$\endgroup$
4
-
1$\begingroup$ The Pohlig-Hellman? $\endgroup$– kelalakaFeb 21, 2020 at 17:33
-
1$\begingroup$ Also, related Diffie-Hellman: choosing wrong generator “g” parameter and its implications of practical attacks $\endgroup$– kelalakaFeb 21, 2020 at 17:44
-
1$\begingroup$ they are randomly generated, then tested for prime. $\endgroup$– dandavisFeb 21, 2020 at 20:09
-
2$\begingroup$ Actually, DH only needs one prime number (the generator need not be prime) $\endgroup$– ponchoFeb 21, 2020 at 21:05
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
TLS generally uses the DH groups specified in RFC7919. The RFC selects the modulii it specifies so that $(p-1)/2$ is also prime (and so the value $g$ is selects generates a large prime subgroup) - those primes have a number of other nice practical properties.
In TLS 1.2, the client could specify its own group, however that is not greatly encouraged (both because the client might get it wrong, and because it makes it difficult for the server to do validity checking).
In TLS 1.3, they removed the option to specify your own group, and so the groups in RFC7919 (or an elliptic curve group or a private group) is your only option.
-
2$\begingroup$ In TLS 1.2 and earlier (back to SSL3) if not using 7919 server selects the group; client has no input except to not offer DHE suite(s) at all. Historically some server software made bad choices for DHE, like older Apache and Java before 8. In contrast SSH2 'DH Group Exchange' allows client to specify min, max, and preferred size in bits, though not a specific p (or g), and TLS >EC<DHE allowed client to specify supported_curves (optionally) since introduction in 4492. $\endgroup$ Feb 22, 2020 at 1:23
-
1$\begingroup$ It should be added that there were reasons for selecting the specific primes in RFC7919. They were selected using an as simple algorithm as possible, that involved only common constants with no known or suspected relation to the DHE problem, specifically to avoid suspicions of the primes being doctored. $\endgroup$ Feb 22, 2020 at 9:43