3
$\begingroup$

I am trying to understand https, as I understand https uses the Diffie–Hellman method for keys exchange and then AES for encryption.

But Diffie–Hellman needs two prime numbers, where do these come from?

$\endgroup$
6
$\begingroup$

TLS generally uses the DH groups specified in RFC7919. The RFC selects the modulii it specifies so that $(p-1)/2$ is also prime (and so the value $g$ is selects generates a large prime subgroup) - those primes have a number of other nice practical properties.

In TLS 1.2, the client could specify its own group, however that is not greatly encouraged (both because the client might get it wrong, and because it makes it difficult for the server to do validity checking).

In TLS 1.3, they removed the option to specify your own group, and so the groups in RFC7919 (or an elliptic curve group or a private group) is your only option.

$\endgroup$
  • 2
    $\begingroup$ In TLS 1.2 and earlier (back to SSL3) if not using 7919 server selects the group; client has no input except to not offer DHE suite(s) at all. Historically some server software made bad choices for DHE, like older Apache and Java before 8. In contrast SSH2 'DH Group Exchange' allows client to specify min, max, and preferred size in bits, though not a specific p (or g), and TLS >EC<DHE allowed client to specify supported_curves (optionally) since introduction in 4492. $\endgroup$ – dave_thompson_085 Feb 22 at 1:23
  • 1
    $\begingroup$ It should be added that there were reasons for selecting the specific primes in RFC7919. They were selected using an as simple algorithm as possible, that involved only common constants with no known or suspected relation to the DHE problem, specifically to avoid suspicions of the primes being doctored. $\endgroup$ – Henrick Hellström Feb 22 at 9:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.