In the book Cryptographic Engineering, it is said that fixing p, q, g for a key negotiation protocol based on DH is a bad idea (page 228 1st ed).

But allowing for flexible p, q and g requires a lot of checks and protocol tricks (e.g. requesting a lower bound on p / q)

Why do we need this flexibility? Do we add something essential with selectable parameters?

  • $\begingroup$ "DH is secure regardless" is a stronger assumption than "DH in a random Schnorr group is secure". $\endgroup$
    – user991
    Jun 30, 2013 at 10:18
  • 3
    $\begingroup$ IMO fixing the group is a good idea. If I were to use finite-field based DH I'd use a standard group, just like I use standard elliptic curves. There are minor advantages in having your own group, but IMO the added complexity isn't worth it. $\endgroup$ Jun 30, 2013 at 10:19
  • $\begingroup$ @RickyDemer Hm? Standard groups are random Schnorr groups. The only difference is that they're used by many people. $\endgroup$ Jun 30, 2013 at 10:20
  • $\begingroup$ Standard groups are supposed to be random Schnorr groups. $\:$ One would have to trust that they actually are. $\;\;\;$ $\endgroup$
    – user991
    Jun 30, 2013 at 10:22
  • $\begingroup$ @RickyDemer I changed the wording of that last sentence. $\endgroup$
    – Nuoji
    Jun 30, 2013 at 10:23

1 Answer 1


The following are the reasons I came up with for not using static/standard DH parameters.

  1. You might not trust the person who generated the group. They could have generated a group with a trapdoor (e.g., group order is smooth) which would allow them to break the resulting system.

  2. The longer you use the same group, the more time an attacker has to attack the group.

    E.g., if millions of people are using the same group, millions of times a day and the attacker has a database of terabytes of pairs $(g^x,x)$, they may be able to break a key establishment.

  3. In DH, remember we must choose a random exponent. We have seen a number of recent cases were random number generators weren't as random as originally thought (e.g., Debian OpenSSL RNG). Not reusing the same group could potentially thwart bad RNGs (though if the new group is generated using the same RNG...).

You should remember though that there are also issues with generating new groups all the time, so you have to weigh the tradeoffs. I wouldn't think that there is a clear, definitive winner for how to do it that applys to all circumstances, though when done correctly either way is secure. If the group parameters were chosen by someone I trusted (e.g., NIST), then I'd personally just use the parameters they suggest.

Why would I still recommend using a standard group
Even given the potential problems I listed above, I personally would still use a standardized group generated by someone I trust because:

  1. If they have generated it properly, you will know the order of the (sub-)group and know that it isn't smooth.
  2. The probably of #2 is still very, very small
  3. If your RNG is bad, there are probably so many other issues that even changing the group won't save you.
  4. The possibility of you not checking things exactly right when generating your own group is pretty high.
  5. Generating a new group will add significant computation time with little added security.
  • 2
    $\begingroup$ What's the problem of the knowing factorization of the order? AFAIK it is usually known. Finite fields used with DH are usually based on a safe prime or are schnorr-groups. In both cases the prime factors of the order are known. $\endgroup$ Jul 30, 2013 at 14:33
  • $\begingroup$ @CodesInChaos, you are right. Temporary memory-lapse :) Updated. $\endgroup$
    – mikeazo
    Jul 30, 2013 at 14:40
  • 1
    $\begingroup$ Isn't that an advantage of standard groups? Since for those you can easily check if they were generated properly e.g. checking that the $p$ is a safe prime, or that the groups is a schnorr group with properly sized factors. $\endgroup$ Jul 30, 2013 at 14:43
  • $\begingroup$ @CodesInChaos, yes, that was just the best example of a trapdoor I could come up with. You have a good point though. $\endgroup$
    – mikeazo
    Jul 30, 2013 at 14:52
  • 1
    $\begingroup$ @Nuoji AFAIK, if you use safe primes, the risk is minimized. The order of subgroups will be either $2,p,2p$. You could easily detect order $2$ subgroups and order $p$ and $2p$ subgroups should be sufficiently large. If it isn't strong, it depends on how much work you are willing to do to check things out. You'd have to make sure the order isn't smooth and that the order of the (sub-)group is sufficiently large. $\endgroup$
    – mikeazo
    Jul 30, 2013 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.