non-prime and small subgroup DH

[lilyanatia]

most (all?) clients will accept very bad DH parameters, such as (31-bit subgroup):

-----BEGIN DH PARAMETERS-----
MIICCgKCAQEA////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////
///////////////////////////wAAAAHQKCAQEAu6kFl4Jni6wu89MOPQwhFQdz
k4SsloDJnHPB7SBXRjZHIkqVjTCGqO/PA4LqerBfXtgnh33YVaefTtYLQGC0bLqi
19PeEv3n8PaTB+RqMisy54p6mhBQZ2VxkiPKphpljueg1VPTN6GN7f/P2TCFXCE3
VRS3roLvvQ4CikZMyO8xVK58mU5YHv7u8A4b/rilq4m+Hr5upS5zvlKIU1iqi47d
0oyrrY9X9AVT2KtmHUdIhwMKPMWpgGGG/si/jrzPI2jAcuVDGRYx8D1btqhzFWQZ
CvJdDaVVA6JSw0XCp3zq71uzuU4vrLBRskZ/vFVw1FHmUSyR4JcDsu+YLzoT+A==
-----END DH PARAMETERS-----

or (not prime):

-----BEGIN DH PARAMETERS-----
MIIBBwKCAQBed4vGnUmyHOfbuX0tMqo0gVsdd30AOBYfqQppFv3UycvnmSdu1Q95
C/gGHCoK2L+DqRHf4OxuiPz/JpqAJtoBVAbqqf1XOALWliZIo3hJGZxrTUuZPawa
iEmzENZRFFG3IJyQ5/9g9+O2McQfYH6NaAuV8+SA7erVyx0sDjitmgW6fAxeFTVQ
oEeZiYKoyCfLhPFdT5fl4ug7MtXnNEpPjSBovMD5Xs/ZlJ3FDfsV69Swoz7dS+UK
JlCrv7Obf+tlJCMhFJf3A2GNP+RzIJddSn2JbBaTMECgpwgBuKmqkKL6LiDzNML/
rvO1LFfU+tV4bbn+RBiu+OCC2m2ZTgvHAgEF
-----END DH PARAMETERS-----

[lgarron]

Sounds good. dh-small-subgroup ( dh-bad-g/dh-bad-generator?) and dh-composite?

[lilyanatia]

I'd probably go with "small subgroup" for the first one. there are primes for which even the best possible generator generates a small subgroup, and the size of the subgroup is what makes the parameters weak. you could go even smaller than a 31-bit subgroup, but really there's no reason not to use a safe prime for DH.

clients that support DH really should do a BPSW test on p and (p-1)/2 and reject the parameters if either one comes back composite.

[lgarron]

Would you like to make a pull request with these? It should be pretty easy to copy this PR.

clients that support DH really should do a BPSW test on p and (p-1)/2 and reject the parameters if either one comes back composite.

Mumble mumble performance mumble.

[lilyanatia]

Mumble mumble performance mumble.

that's why i said "BPSW" instead of "ECPP"...

[lgarron]

Merged via PR #45.