What is the benefit of having multiple Diffie Hellman moduli of the same length in OpenSSH's moduli file? In the distributed moduli file there are around 40 primes for each length to choose from randomly...

In contrast, when using OpenSSL it seems to be sufficient to be only use a single modulus.


Having only one moduli of some length makes Logjam attack feasible, because the attacker can make pre-computation of parameters for given moduli and them break the communication in fraction of the time needed without the knowledge what will be the prime used.

Having more primes (and of course long enough ones 1024 b and more) mitigates the attack, because even running pre-computation is really expensive operation and making it 40 times is usually blocker.

  • I'm not entirely convinced: First, OpenSSH has been using multiple primes longer than Logjam is known (the ones currently distributed are from 2012). Then, adding a factor of 40 (i.e. five bits) is not really a wide safety margin... Third, why should this be different for OpenSSL? – J. Doe Dec 9 '15 at 20:17
  • 1) That the attack was not known, does not mean that it is not benefit. 2) It is not adding. It is multiplication. And you are multiplying a hell of large number, for example for 1024b primes, it is millions core-years as stated in the linked article. – Jakuje Dec 9 '15 at 20:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.