allow p % 24 == 23 when generator == 2 in DH_check #3768
Conversation
|
@reaperhulk, thanks for your PR! By analyzing the history of the files in this pull request, we identified @palaviv, @public and @alex to be potential reviewers. |
|
Safe to rebase and bother @lvh :-) |
reaperhulk
force-pushed
the
dh-improve-check
branch
from
305e00b to
8937df0
Compare
| # DH_check will return DH_NOT_SUITABLE_GENERATOR if p % 24 does not | ||
| # equal 11 when the generator is 2. We want to ignore that error | ||
| # because p % 24 == 23 is also fine. See: | ||
| # https://crypto.stackexchange.com/questions/12961/diffie-hellman- |
There was a problem hiding this comment.
You can drop everything after the /12961/
| # DH_check will return DH_NOT_SUITABLE_GENERATOR if p % 24 does not | ||
| # equal 11 when the generator is 2. We want to ignore that error | ||
| # because p % 24 == 23 is also fine. See: | ||
| # https://crypto.stackexchange.com/questions/12961 |
There was a problem hiding this comment.
I'd be marginally happier if this had the language "quadratic residue" and "quadratic nonresidue", but looking at the SO answer it's actually... really good?
tests/hazmat/primitives/test_dh.py
Outdated
| @@ -202,7 +221,7 @@ def test_convert_to_numbers(self, backend, with_q): | |||
| dh.DHPrivateKeyWithSerialization) | |||
|
|
|||
| def test_numbers_unsupported_parameters(self, backend): | |||
| params = dh.DHParameterNumbers(23, 2) | |||
| params = dh.DHParameterNumbers(21, 2) | |||
There was a problem hiding this comment.
I would be happier if this had a comment, because someone git-blaming this (heck, me git blaming this) would probably not stop to think about why this is different/better and why 23 suddenly works now.
|
(We discussed this in a backchannel. The TL;DR is: OpenSSL's check is fine for g==2 but makes a tradeoff. Your FFDH public keys either leak a bit of your secret, or you can only get half of the possible values. Other standards might reasonably choose the opposite tradeoff.) |
|
Thanks @lvh! I've expanded the comments to address your requests! |
| # DH_check will return DH_NOT_SUITABLE_GENERATOR if p % 24 does not | ||
| # equal 11 when the generator is 2 (a quadratic nonresidue). | ||
| # We want to ignore that error because p % 24 == 23 is also fine. | ||
| # Specifically, it is a quadratic residue. Within the context of |
There was a problem hiding this comment.
Note: "it" is g here. Rest of the explanation looks fine :)
|
Since @alex has specifically indicated not wanting to touch this with a ten foot pole... |
refs #3755
Depends on #3767
https://crypto.stackexchange.com/questions/12961/diffie-hellman-parameter-check-when-g-2-must-p-mod-24-11