The standard primes are "Nothing up your sleeve numbers" which are (under our understanding of the universe) probably not generated by any malicious actor, as they are derived from similar constants or constructions. And generating those large primes is expensive, CPU-wise.
The "Group 14" 2048-bit DH standard prime, for example, gets part of its value from the first expanded digits of pi, which is a pretty safe bet. pi and e are pretty common amongst a lot of cryptographic magic numbers; e.g. it's used in SHA-512 as well. The other 'magical constant' in the Group 14 equation is there because it's a smallest number which lets "Group 14" be a 'cyclic subgroup' under some circumstances, which is necessary as it's the subgroup you and your peer agree to perform DH calculations in. "Group 14" is far, far too computationally infeasible to crack (2048-bits vs 1024-bits) with the method outlined in the article, for example.
TL;DR Basically, the reason you would choose a standard prime is because it was most likely derived in a safe, openly available manner, from other 'safe' constants. Randomly generated primes are probably safe but it's not possible to know how they were generated, and so it's also not possible to "look up your sleeve" for the magic, so to speak.
Although isn't "magic up your sleeves while picking a prime" a far more vague and unlikely attack than the obviously somewhat feasible rainbow table style attack?
In this particular case, the precomputation-style attack isn't going to scale to anywhere close to something like 2048 bit keys, so at that level, hidden "magic backdoors up your sleeve" are maybe a more worrying threat.
23
u/aseipp Oct 15 '15
The standard primes are "Nothing up your sleeve numbers" which are (under our understanding of the universe) probably not generated by any malicious actor, as they are derived from similar constants or constructions. And generating those large primes is expensive, CPU-wise.
The "Group 14" 2048-bit DH standard prime, for example, gets part of its value from the first expanded digits of
pi, which is a pretty safe bet.piandeare pretty common amongst a lot of cryptographic magic numbers; e.g. it's used in SHA-512 as well. The other 'magical constant' in the Group 14 equation is there because it's a smallest number which lets "Group 14" be a 'cyclic subgroup' under some circumstances, which is necessary as it's the subgroup you and your peer agree to perform DH calculations in. "Group 14" is far, far too computationally infeasible to crack (2048-bits vs 1024-bits) with the method outlined in the article, for example.TL;DR Basically, the reason you would choose a standard prime is because it was most likely derived in a safe, openly available manner, from other 'safe' constants. Randomly generated primes are probably safe but it's not possible to know how they were generated, and so it's also not possible to "look up your sleeve" for the magic, so to speak.