[42916] in Cypherpunks
Re: Photuris Primality verification needed
daemon@ATHENA.MIT.EDU (Perry E. Metzger)
Sun Nov 5 11:10:54 1995
To: "William Allen Simpson" <bsimpson@morningstar.com>
Cc: cypherpunks@toad.com, ipsec-dev@eit.com
In-Reply-To: Your message of "Sat, 04 Nov 1995 20:03:25 GMT."
<1973.bsimpson@morningstar.com>
Reply-To: perry@piermont.com
Date: Sun, 05 Nov 1995 11:07:25 -0500
From: "Perry E. Metzger" <perry@piermont.com>
"William Allen Simpson" writes:
> Folks, I was somewhat disappointed in the response to our previous
> requests for verification of the strength of the prime moduli.
>
> Recently, someone asked for a smaller prime of only 512-bits for speed.
> This is more than enough for the strength of keys needed for DES, 3DES,
> MD5 and SHA. Perhaps this would be easier to have more complete and
> robust verification as well.
I think that this is a very large mistake. Allow me to explain why.
La Macchia (sp?) and Odlyzko (sp?) have a very nice result which shows
that once you've done enough precalculation on a particular modulus,
you can break any subsequent Diffie-Hellman operation performed on
that modulus with (for our purposes) no effort. 512 bits is, from what
I can tell, not far out of the realm of possibility for what someone
could try to crack with current machines given enough effort.
[Sorry about the spelling. I'm tired, and don't have time to look up
your names. I know that Brian at least reads this list and I'm sorry
about likely misspelling your name.]
Perry
