| Network Working Group | D. Eastlake | |
| Request for Comments: 2539 | IBM | |
| Category: Standards Track | March 1999 |
Ashar Aziz <ashar.aziz@eng.sun.com>
Tom Markson <markson@incog.com>
Hemma Prafullchandra <hemma@eng.sun.com>
In addition, the following person provided useful comments that have been incorporated:
Ran Atkinson <rja@inet.org>
Thomas Narten <narten@raleigh.ibm.com>
X = g**i ( mod p ) Y = g**j ( mod p )
They exchange these quantities and then each calculates a Z as follows:
Zi = Y**i ( mod p ) Zj = X**j ( mod p )
shared secret between the two parties that an adversary who does not know i or j will not be able to learn from the exchanged messages (unless the adversary can derive i or j by performing a discrete logarithm mod p which is hard for strong p and g).
The private key for each party is their secret i (or j). The public
key is the pair p and g, which must be the same for the parties, and their
individual X (or Y).
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7
8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|
KEY flags |
protocol | algorithm=2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| prime length (or flag)
| prime (p) (or special) /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ prime (p) (variable length) |
generator length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| generator (g) (variable length)
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| public value length
| public value (variable length)/
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
/ public value (g^i mod p) (variable
length)
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Prime length is length of the Diffie-Hellman prime (p) in bytes if it is 16 or greater. Prime contains the binary representation of the Diffie-Hellman prime with most significant byte first (i.e., in network order). If "prime length" field is 1 or 2, then the "prime" field is actually an unsigned index into a table of 65,536 prime/generator pairs and the generator length SHOULD be zero. See Appedix A for defined table entries and Section 4 for information on allocating additional table entries. The meaning of a zero or 3 through 15 value for "prime length" is reserved.
Generator length is the length of the generator (g) in bytes. Generator is the binary representation of generator with most significant byte first. PublicValueLen is the Length of the Public Value (g**i (mod p)) in bytes. PublicValue is the binary representation of the DH public value with most significant byte first.
The corresponding algorithm=2 SIG resource record is not used so no
format for it is defined.
Well known prime/generator pairs number 0x0000 through 0x07FF can only
be assigned by an IETF standards action and this Proposed Standard assigns
0x0001 through 0x0002. Pairs number 0s0800 through 0xBFFF can be assigned
based on RFC documentation. Pairs number 0xC000 through 0xFFFF are
available for private use and are not centrally coordinated. Use of such
private pairs outside of a closed environment may result in conflicts.
In addition, the usual Diffie-Hellman key strength considerations apply.
(p-1)/2 should also be prime, g should be primitive mod p, p should be
"large", etc. [Schneier]
| [RFC1034] | Mockapetris, P., "Domain Names - Concepts and Facilities", STD 13, RFC 1034, November 1987. |
| [RFC1035] | Mockapetris, P., "Domain Names - Implementation and Specifications", STD 13, RFC 1035, November 1987. |
| [RFC2535] | Eastlake, D., "Domain Name System Security Extensions", RFC 2535, March 1999. |
| [Schneier] | Bruce Schneier, "Applied Cryptography: Protocols, Algorithms, and Source Code in C", 1996, John Wiley and Sons |
Phone: +1-914-276-2668(h)
+1-914-784-7913(w)
Fax: +1-914-784-3833(w)
EMail: dee3@us.ibm.com
Prime modulus: Length (32 bit words): 24, Data (hex):
FFFFFFFF FFFFFFFF
C90FDAA2 2168C234 C4C6628B 80DC1CD1
29024E08 8A67CC74
020BBEA6 3B139B22 514A0879 8E3404DD
EF9519B3 CD3A431B
302B0A6D F25F1437 4FE1356D 6D51C245
E485B576 625E7EC6
F44C42E9 A63A3620 FFFFFFFF FFFFFFFF
Generator: Length (32 bit words): 1, Data (hex): 2
Prime modulus: Length (32 bit words): 32, Data (hex):
FFFFFFFF FFFFFFFF
C90FDAA2 2168C234 C4C6628B 80DC1CD1
29024E08 8A67CC74
020BBEA6 3B139B22 514A0879 8E3404DD
EF9519B3 CD3A431B
302B0A6D F25F1437 4FE1356D 6D51C245
E485B576 625E7EC6
F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
EE386BFB 5A899FA5
AE9F2411 7C4B1FE6 49286651 ECE65381
FFFFFFFF FFFFFFFF
Generator: Length (32 bit words): 1, Data (hex): 2
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it or
assist in its implementation may be prepared, copied, published and distributed,
in whole or in part, without restriction of any kind, provided that the
above copyright notice and this paragraph are included on all such copies
and derivative works. However, this document itself may not be modified
in any way, such as by removing the copyright notice or references to the
Internet Society or other Internet organizations, except as needed for
the purpose of developing Internet standards in which case the procedures
for copyrights defined in the Internet Standards process must be followed,
or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.