Subject: Re: [saag] Possible backdoor in RFC 5114

From: Antonio Sanso <[email-masked]>
Date: Wed, 12 Oct 2016 07:17:18 +0000

hi Yoav

>IANA numbers have been assigned to them for IKE, but they have not seen widespread use

I would not be too sure about this. For example see [0]. On top Exim and BouncyCastle have RFC 5114 as default for DH. 
And more to come…

regards

antonio

[0] http://blog.intothesymmetry.com/2016/01/openssl-key-recovery-attack-on-dh-small.html

---

From: Tony Finch <[email-masked]>
Date: Wed, 12 Oct 2016 10:38:20 +0100

Antonio Sanso <[email-masked]> wrote:
> I would not be too sure about this. For example see [0]. On top Exim and
> BouncyCastle have RFC 5114 as default for DH.

There was an announcement on this topic from the Exim maintainers a few
days ago.

https://lists.exim.org/lurker/message/20161008.231103.c70b2da8.en.html

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/  -  I xn--zr8h punycode
Viking, North Utsire: Variable 3 or 4, becoming southeasterly 4 or 5 later in
south. Slight, occasionally moderate. Showers later. Good.

---

From: Yoav Nir <[email-masked]>
Date: Wed, 12 Oct 2016 12:48:41 +0300

> On 12 Oct 2016, at 10:17, Antonio Sanso <[email-masked]> wrote:
> 
> hi Yoav
> 

Hey, if you’re collecting them, it is possible (though annoying) to configure “group 24” on Check Point gateways ([0]).

But I don’t know any IKE implementations that use that by default.

Yoav

[0] https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk27054

---

From: Antonio Sanso <[email-masked]>
Date: Tue, 18 Oct 2016 06:40:00 +0000

hi *,

> IANA numbers have been assigned to them for IKE, but they have not seen widespread use

jut for the sake of completeness you can find a detailed analysis of the RFC 5114’s usage in the wild in Measuring small subgroup attacks against Diffie-Hellman [0]

regards

antonio

[0] https://eprint.iacr.org/2016/995.pdf