Subject: [IPsec] Question about RFC 5114

From: Joy Latten <[email-masked]>
Date: Fri, 26 Mar 2010 16:25:01 -0500

Hi,

I am looking to implement modp groups 22, 23, and 24 into IKE but have a
question.

RFC 5114 gives the prime, p, the generator, g and a subgroup, q, with a 
specific size...

Because prior rfcs for modp groups did not specify a "q", I was not sure
if this was a new constant or just stating a size requirement?
So I took a look at NIST 800-56A. In particular, 

5.6.1 Private/Public Key Pair Generation

5.6.1.1 FFC Key Pair Generation
For the FFC schemes, each static and ephemeral private key and public
key shall be generated using an Approved method and the selected valid
domain parameters (p, q, g{, SEED,pgenCounter}) (see Appendix B of FIPS
186-3). 
...

I then took a look at FIPS 186-3, Appendix B, which documents 2 methods
for finite field cryptography (FFC) key pair generation. 
For example, one method is "Key Pair Generation Using Extra Random
Bits". It actually states that "q" is an input and it is used to do an
additional computation to compute "x". 

I am somewhat confused, are the modp groups 22, 23 & 24 suppose to use
one of these new methods and that is why "q" is given in rfc 5114?
Or am I to ignore this and just continue with existing way 
where "q" is not used and there aren't any additional computations
to compute x.

I am not even sure this is correct place to ask, but any advice
would be welcome.

regards,
Joy

(Cut-n-paste from FIPs 186-3 below to show input and process)

 Input:
    (p, q, g)      The subset of the domain parameters that are used
                   for this process. p, q and g shall either be
                   provided as integers during input, or shall be
                   converted to integers prior to use.

Process:
1. N = len(q); L = len(p).    Comment: Check that the (L, N) pair
                              is specified in Section 4.2.
2. If the (L, N) pair is invalid, then return an ERROR indicator,
   Invalid_x, and Invalid_y.
3. requested_security_strength = the security strength associated
   with the (L, N) pair;      see SP 800-57.
4. Obtain a string of N+64 returned_bits from an RBG with a security
   strength of requested_security_strength or more. If an ERROR
   indication is returned, then return an ERROR indication,
   Invalid_x, and Invalid_y.
5. Convert returned_bits to the (non-negative) integer c (see
   Appendix C.2.1).
6. x = (c mod (q–1)) + 1.       Comment: 0 ≤ c mod (q–1) ≤ q–2 and
                                implies that 1 ≤ x ≤ q–1.
7. y = gx mod p.
8. Return SUCCESS, x, and y.

---

From: "Dan Harkins" <[email-masked]>
Date: Fri, 26 Mar 2010 16:55:55 -0700 (PDT)

Hi Joy,

  "q" is the order of the group defined by the "g". If you want to use
the FIPS 186-3 process for generating a D-H key pair with the other MODP
groups that don't have a defined order (like 5, 14, 15, 16...) you can
just use (p-1/2) for the value "q".

  There are going to be q distinct elements in the group and while
D-H will work with a private value x: q < x < p, you will be doing more
modular exponentiation. The FIPS 186-3 process is ensuring that your
private value, x, will be taken from a uniformly random distribution of
numbers less than q and therefore the public value y=g^x mod p will be
a random element in the group (which is what you need for D-H).

  regards,

  Dan.

On Fri, March 26, 2010 2:25 pm, Joy Latten wrote:
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>

---

From: "Scott Fluhrer (sfluhrer)" <[email-masked]>
Date: Fri, 26 Mar 2010 19:48:42 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Joy Latten
> Sent: Friday, March 26, 2010 5:25 PM
> To: [email-masked]; [email-masked]
> Cc: [email-masked]; [email-masked]
> Subject: [IPsec] Question about RFC 5114
> 
> Hi,
> 

q is the order of the generator.  For the previous (traditional) MODP groups (1,2,5,14-18), we have q=(p-1)/2

> where "q" is not used and there aren't any additional computations

Short answer: it doesn't really matter; the old way is safe (for DH).

Longer answer: FIPS 186-3 was written about generating values for DSA, not DH.  Now, for DSA, there is a known weakness if the exponents you use are biased; these algorithms used in FIPS 186-3 were designed to make sure that the exponents are unbiased (or close enough not to matter).  DH doesn't have similar issues, and so these steps aren't required (although they wouldn't hurt either).

Now, you don’t need to use the same exponent size that you would use for the same size traditional groups; for example, RFC3526 suggests an exponent of between 220-320 bits for group 14; for group 24, there's no point in an exponent greater than 256 bits.  This is because the exponent is essentially taken "mod q" by the algorithm, and so making it larger than q gives you more work without giving any benefit.  Note that when FIPS 186-3 talks about using "extra random bits", they reduce the larger value so that it is <q (step 6 of B.1.1).

On the other hand, NIST SP 800-56A also asks you to validate the peer public value (section 5.6.2.4), and this also uses q as an input.  Here's why that really does matter for groups 22-24 (and not so much for groups 1,2,5,14-18):

- If you reuse DH exponents, and you don't validate the peer's public value, then there is a way for an attacker to determine the value of your exponent modulo r, where r is a small factor of (p-1)/q.
- This attack involves sending illegal peer public values as a part of the IKE exchange, and seeing what keying material the unit comes up with.  Because these values are illegal, validating the values foils the attack.
- This takes O(r) time on the attacker's part, which is why r can't be too large.

For the traditional groups, (p-1)/q == 2, and so r=2 is the only one the attacker can use (hence the attacker would be able to determine the lsbit of your exponent via this attack, but nothing else).  It turns out that there's a short cut to test on the peer public value in this case (compute the Legendre symbol), but even if you don't, the attacker gets minimal information.

For these new groups, (p-1)/q is quite large, and in all three cases, has a number of small factors (now, NIST could have defined groups where (p-1)/q has 2 as the only small factor; they declined to do so).  For example, for group 23 (which is the worse of the three), (p-1)/q ==  2 * 3 * 3 * 5 * 43 * 73 * 157 * 387493 * 605921 * 5213881177 * 3528910760717 * 83501807020473429349 * C489 (where C489 is a 489 digit composite number with no small factors).  The attacker could use this (again, if you don't validate the peer value) to effective cut your exponent size by about 137 bits with using only  O(2**42) time); if you used 224 bit exponents, then the attacker would cut the work used to find the rest of the exponent to about O(2**44) time.  Obviously, this is not acceptable.

---

From: "Kaz Kobara" <[email-masked]>
Date: Sat, 27 Mar 2010 07:25:41 +0900

Hi Joy

When one uses a subgroup like defined in RFC 5114, q (and (p-1)/2q ) must be chosen carefully.

Precisely:
1. q must be a prime number of 2k or more bits where k is a security parameter.
2. q must be a divisor of ((p - 1) / 2).
3. Every factors of (p - 1) / (2q) must also be primes comparable to or greater than q in size.  

p corresponding such q is called a "secure prime."

X is simply to shift the range of 0 to q-2 to 1 to q-1 to exclude 0 (since g^0 mod p = 1).

Kaz

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Joy Latten
> Sent: Saturday, March 27, 2010 6:25 AM

---

From: "Scott Fluhrer (sfluhrer)" <[email-masked]>
Date: Sat, 27 Mar 2010 19:23:00 -0700

> Of Kaz Kobara
> Sent: Friday, March 26, 2010 6:26 PM
> To: [email-masked]; [email-masked]; [email-masked]
> Subject: Re: [IPsec] Question about RFC 5114
> 
> Hi Joy
> 

I must point out that the MODP groups defined in RFC 5114 do not meet criteria 3.