# Diffie Hellman Group Matching to IPSec Encryption Algorithm

I'm looking for help determining acceptable Diffie Hellman (DH) Groups for specific IPSec IKE and ESP Encryption Algorithms. The goal is to choose DH groups that provide adequate protection for the keys to be used by selected Encryption Algorithms while avoiding unnecessary overhead from DH groups that are poorly-matched (slower DH groups without added security benefits?).

The specific Encryption Algorithms I can choose from include AES-CBC and AES-GCM with various key lengths (128, 256, etc).

The Diffie Hellman Groups I can select from include

• 14 = 2048-bit MODP group
• 19 = 256-bit random ECP group
• 20 = 384-bit random ECP group
• 21 = 521-bit random ECP group
• 24 = 2048-bit MODP Group with 256-bit Prime Order Subgroup

Some of the information I'm reading from Network Security vendor documents suggest the use of DH Elliptic Curve (EC) groups like 19, 20, and 21 over the other groups.

• Cisco "When possible, use ... the ... ECDH groups"
• Check Point
• "elliptic curve Diffie-Hellman groups ... provide better performance"
• "groups described in RFC 5114 (Group 24 ...) are NOT RECOMMENDED for use"
• IBM "Guideline: If you are using encryption or authentication algorithms with a 128-bit key, use Diffie-Hellman groups 5,14,19,20, or 24. If you are using encryption or authentication algorithms with a key length of 256 bits or greater, use Diffie-Hellman group 21."

I am particularly confused about when to use Groups 14 and 24. Is 24 stronger than 21? I'm thinking 21 is stronger even though the DH group number 24 is higher (just a group identifier number). I also am thinking that group 19 is stronger than 14 - not because of the higher number, but because of the stronger EC algorithm? Based on some of my reading, it appears that the groups ordered by strength from low to high would be something like 14, 24, 19, 20, 21 - meaning that if available, the ECP groups 19,20,21 should be preferred over both 14 and 24?

These crypto discussions can easily lead to advanced math and I'm hoping to avoid that as much as possible - please use the most basic explanations or simplest math possible.

Update 21 Oct 2017. I found some useful info in RFC 5114 under Section 4 "Security Considerations". Based on this recommendation, we can consider DH Groups 14 and 24 as too weak to protect AES 128 Symmetric Keys - this leaves DH Groups 19 through 21 ECP as the minimum acceptable Diffie Hellman groups for generating AES symmetric keys (128 bit and higher).

When secret keys of an appropriate size are used, an approximation of the strength of each of the Diffie-Hellman groups is provided in the table below. For each group, the table contains an RSA key size and symmetric key size that provide roughly equivalent levels of security. This data is based on the recommendations in [NIST80057].

``````GROUP                                      |  SYMMETRIC |   RSA
-------------------------------------------+------------+-------
1024-bit MODP with 160-bit Prime Subgroup  |        80  |   1024
2048-bit MODP with 224-bit Prime Subgroup  |       112  |   2048
2048-bit MODP with 256-bit Prime Subgroup  |       112  |   2048
192-bit Random ECP Group                   |        80  |   1024
224-bit Random ECP Group                   |       112  |   2048
256-bit Random ECP Group                   |       128  |   3072
384-bit Random ECP Group                   |       192  |   7680
521-bit Random ECP Group                   |       256  |  15360
``````

Group Numbers mapped to DH algorithm names from RFC 5114 "IKE" Section.

``````NAME                                                    | NUMBER
--------------------------------------------------------+---------
1024-bit MODP Group with 160-bit Prime Order Subgroup   |   22
2048-bit MODP Group with 224-bit Prime Order Subgroup   |   23
2048-bit MODP Group with 256-bit Prime Order Subgroup   |   24
192-bit Random ECP Group                                |   25
224-bit Random ECP Group                                |   26
256-bit Random ECP Group                                |   19
384-bit Random ECP Group                                |   20
521-bit Random ECP Group                                |   21
``````

I was able to find some pairing suggestions in the strongSwan Security Recommendations document under the "Cipher Selection" heading.

• "aes128-sha256-modp3072 (AES-CBC-128, SHA-256 as HMAC and DH key exchange with 3072 bit key length)" DH-Group-15 (not available on my device)
• "aes128gcm16-prfsha256-ecp256 (AES-GCM-128 AEAD, SHA-256 as PRF and ECDH key exchange with 256 bit key length)" DH-Group-19
• "aes256gcm16-prfsha384-ecp384 (AES-GCM-256 AEAD, SHA-384 as PRF and ECDH key exchange with 384 bit key length)" DH-Group-20

It seems that the pairing recommendations may be loosely based on algorithm strength analysis listed on the Belgian BlueKrypt keylength.com site.

This is the closest I could get to a diffie-hellman algorithm pairing recommendation. Please post if you find other reputable sources for selecting well-matched diffie-hellman groups for use with IPSec encryption.

• Thank you for pointing this out. So, when using an AES256 key protect it with ECP521? Sadly, Windows 10 1703 "Set-VpnConnectionIPsecConfiguration" does not support this configuration. I wonder what the harm of therefore using AES256~ECP256? – pcunite Dec 27 '18 at 6:03
• Hello @pcunite, if you can't match one of the recommended pairings, just use the most secure alternative you have available in your system. These listings should help you determine the relative strength of various crypto options. – Mister_Tom Dec 31 '18 at 14:13

Do not use DH 22,23 and 24. See https://tools.ietf.org/html/rfc8247#section-2.4

Groups 22, 23, and 24 are MODP groups with Prime Order Subgroups that are not safe primes. The seeds for these groups have not been publicly released, resulting in reduced trust in these groups. These groups were proposed as alternatives for groups 2 and 14 but never saw wide deployment. It has been shown that group 22 with 1024-bit MODP is too weak and academia have the resources to generate malicious values at this size. This has resulted in group 22 to be demoted to MUST NOT. Groups 23 and 24 have been demoted to SHOULD NOT and are expected to be further downgraded in the near future to MUST NOT. Since groups 23 and 24 have small subgroups, the checks specified in the first bullet point of Section 2.2 of "Additional Diffie-Hellman Tests for the Internet Key Exchange Protocol Version 2 (IKEv2)" [RFC6989] MUST be done when these groups are used.