Re:Socat: “the hard coded 1024 bit DH p parameter was not pr...
by sdevlin on Monday February 01, 2016 @11:36PM
(#11017662)
Some of these issues are orthogonal.
You're correct that the ring of integers mod n with n composite will have small multiplicative subgroups. But so will the integers mod p with p prime. At the very least, 1 and p-1 will always have orders 1 and 2, respectively. I could be wrong, but I don't think the primality or compositeness of the modulus alone tells you much about the smoothness of the group order.
Small subgroups may not always lead to key recovery, but they can lead to key dictation in certain protocols. So subgroup-confinement attacks are always a consideration in this setting.
If you want to learn more about subgroup-confinement attacks on DH and ECDH, check out set 8 of cryptopals. Mail [email protected] with subject "Crazy Flamboyant for the Rap Enjoyment".
You're correct that the ring of integers mod n with n composite will have small multiplicative subgroups. But so will the integers mod p with p prime. At the very least, 1 and p-1 will always have orders 1 and 2, respectively. I could be wrong, but I don't think the primality or compositeness of the modulus alone tells you much about the smoothness of the group order.
Small subgroups may not always lead to key recovery, but they can lead to key dictation in certain protocols. So subgroup-confinement attacks are always a consideration in this setting.
If you want to learn more about subgroup-confinement attacks on DH and ECDH, check out set 8 of cryptopals. Mail [email protected] with subject "Crazy Flamboyant for the Rap Enjoyment".