News for hackers. Stuff that matters.

A comment on Socat: “the hard coded 1024 bit DH p parameter was not prime”. Parent comment

Re:Socat: “the hard coded 1024 bit DH p parameter was not pr... by CamperBob2 on Monday February 01, 2016 @04:19PM (#11015548)
It might be "easy" but is it quick enough to be tolerated as part of a build?
[ Parent | on HN ]
Re:Socat: “the hard coded 1024 bit DH p parameter was not pr... by anderskaseorg on Monday February 01, 2016 @05:14PM (#11015992)
A primality certificate could be included that allows the prime to be verified quickly during the build. This certificate for the 2048-bit prime took 90 seconds to generate, and can be verified in 3 seconds.

http://web.mit.edu/andersk/Public/socat-prime.pl

https://en.wikipedia.org/wiki/Primality_certificate

[ Parent | on HN ]
Re:Socat: “the hard coded 1024 bit DH p parameter was not pr... by lorenzhs on Monday February 01, 2016 @04:29PM (#11015612)
The primality test of the original number using gp that archgoon posted takes 6ms on my Sandy Bridge laptop, that's plenty fast. (The new number takes a minute to check, though, so that might really be too long)
[ Parent | on HN ]
Re:Socat: “the hard coded 1024 bit DH p parameter was not pr... by sdhsdh on Monday February 01, 2016 @04:48PM (#11015765)
Maxima's primep takes 360ms on the 1024-bit one for me, so seems quick enough to stick into the build.

It sounds like the chance if it passing the test is around 10^-15 using the default values; which seems sufficient for a build test which is run many times.

[ Parent | on HN ]
Re:Socat: “the hard coded 1024 bit DH p parameter was not pr... by jldugger on Monday February 01, 2016 @06:35PM (#11016559)
If this the alternative, it very well might be.
[ Parent | on HN ]
Re:Socat: “the hard coded 1024 bit DH p parameter was not pr... by leni536 on Tuesday February 02, 2016 @04:30AM (#11018461)
Just build your sensitive hard coded primes in a separate object file. It rarely needs updating.
[ Parent | on HN ]