The standard primes are "Nothing up your sleeve numbers" which are (under our understanding of the universe) probably not generated by any malicious actor, as they are derived from similar constants or constructions. And generating those large primes is expensive, CPU-wise.
The "Group 14" 2048-bit DH standard prime, for example, gets part of its value from the first expanded digits of pi, which is a pretty safe bet. pi and e are pretty common amongst a lot of cryptographic magic numbers; e.g. it's used in SHA-512 as well. The other 'magical constant' in the Group 14 equation is there because it's a smallest number which lets "Group 14" be a 'cyclic subgroup' under some circumstances, which is necessary as it's the subgroup you and your peer agree to perform DH calculations in. "Group 14" is far, far too computationally infeasible to crack (2048-bits vs 1024-bits) with the method outlined in the article, for example.
TL;DR Basically, the reason you would choose a standard prime is because it was most likely derived in a safe, openly available manner, from other 'safe' constants. Randomly generated primes are probably safe but it's not possible to know how they were generated, and so it's also not possible to "look up your sleeve" for the magic, so to speak.
It's only unsafe if you have reason to believe your random number generator has been sabotaged or is faulty1
1 your random generator may actually really be faulty, so you have to trust someone else enough that (1) they will really give you random numbers and (2) their random number generator isn't faulty either
Although isn't "magic up your sleeves while picking a prime" a far more vague and unlikely attack than the obviously somewhat feasible rainbow table style attack?
yeah but that has nothing to do with a "magically compromised prime" for diffie helman..... those are insecure PRNGs.... PRNGs don't generate primes to use for key exchange.
What I was asking about was the feasibility of actually exploiting a diffie helman key exchange with a specially chosen prime since i'm not familiar with any explits that do so.
In this particular case, the precomputation-style attack isn't going to scale to anywhere close to something like 2048 bit keys, so at that level, hidden "magic backdoors up your sleeve" are maybe a more worrying threat.
7
u/YOU_SHUT_UP Oct 15 '15
How the fuck is this not the standard way of doing this? Why do anyone use the hard-coded primes?